luna - wolfssl/CMakeLists.txt

   1# CMakeLists.txt
   2#
   3# Copyright (C) 2006-2024 wolfSSL Inc.
   4#
   5# This file is part of wolfSSL. (formerly known as CyaSSL)
   6#
   7# Usage:
   8# $ mkdir build
   9# $ cd build
  10# $ cmake ..
  11# $ cmake --build .
  12#
  13# To build with debugging use:
  14# $ cmake .. -DCMAKE_BUILD_TYPE=Debug
  15#
  16# See "Building with CMake" in INSTALL for more.
  17
  18####################################################
  19# Project
  20####################################################
  21
  22cmake_minimum_required(VERSION 3.16)
  23
  24if(${CMAKE_VERSION} VERSION_LESS "3.22")
  25    message(STATUS "This project recommends using CMake version 3.22 or higher. You are using ${CMAKE_VERSION}.")
  26else()
  27    cmake_policy(SET CMP0128 NEW)
  28endif()
  29
  30if("${CMAKE_SOURCE_DIR}" STREQUAL "${CMAKE_BINARY_DIR}")
  31    message(FATAL_ERROR "In-source builds are not allowed.\
  32     Run cmake from a separate directory from where CMakeLists.txt lives.\
  33     NOTE: cmake will now create CMakeCache.txt and CMakeFiles/*.\
  34     You must delete them, or cmake will refuse to work.")
  35endif()
  36
  37project(wolfssl VERSION 5.9.1 LANGUAGES C ASM)
  38
  39# Set WOLFSSL_ROOT if not already defined
  40if ("${WOLFSSL_ROOT}" STREQUAL "")
  41    # we'll assume this CMakeLists.txt is in the root of wolfSSL
  42    if (EXISTS "${CMAKE_SOURCE_DIR}/wolfcrypt/src/")
  43        get_filename_component(WOLFSSL_ROOT "${CMAKE_SOURCE_DIR}" ABSOLUTE)
  44        message(STATUS "Found WOLFSSL_ROOT = ${WOLFSSL_ROOT}")
  45    endif()
  46else()
  47    message(STATUS "Using predefined WOLFSSL_ROOT = ${WOLFSSL_ROOT}")
  48endif()
  49
  50# shared library versioning
  51# increment if interfaces have been removed or changed
  52set(WOLFSSL_LIBRARY_VERSION_FIRST 44)
  53
  54# increment if interfaces have been added
  55# set to zero if WOLFSSL_LIBRARY_VERSION_FIRST is incremented
  56set(WOLFSSL_LIBRARY_VERSION_SECOND 2)
  57
  58# increment if source code has changed
  59# set to zero if WOLFSSL_LIBRARY_VERSION_FIRST is incremented or
  60# WOLFSSL_LIBRARY_VERSION_SECOND is incremented
  61set(WOLFSSL_LIBRARY_VERSION_THIRD 0)
  62
  63set(LIBTOOL_FULL_VERSION ${WOLFSSL_LIBRARY_VERSION_FIRST}.${WOLFSSL_LIBRARY_VERSION_SECOND}.${WOLFSSL_LIBRARY_VERSION_THIRD})
  64
  65set(WOLFSSL_DEFINITIONS)
  66set(WOLFSSL_LINK_LIBS)
  67set(WOLFSSL_INCLUDE_DIRS)
  68
  69# Initialize pkg-config private variables
  70set(PC_LIBS_PRIVATE "")
  71
  72set(CMAKE_MODULE_PATH ${CMAKE_MODULE_PATH} "${CMAKE_CURRENT_SOURCE_DIR}/cmake/modules/")
  73include(${CMAKE_CURRENT_SOURCE_DIR}/cmake/functions.cmake)
  74
  75####################################################
  76# Compiler
  77####################################################
  78# Let CMake choose default compiler
  79
  80# TODO: See gl_VISIBILITY in visibility.m4. Need to perform
  81#       the same checks.
  82# TODO: Turn on warnings.
  83
  84if(CMAKE_C_COMPILER_ID STREQUAL "AppleClang")
  85    # Silence ranlib warning "has no symbols"
  86    set(CMAKE_C_ARCHIVE_CREATE   "<CMAKE_AR> Scr <TARGET> <LINK_FLAGS> <OBJECTS>")
  87    set(CMAKE_CXX_ARCHIVE_CREATE "<CMAKE_AR> Scr <TARGET> <LINK_FLAGS> <OBJECTS>")
  88    set(CMAKE_C_ARCHIVE_FINISH   "<CMAKE_RANLIB> -no_warning_for_no_symbols -c <TARGET>")
  89    set(CMAKE_CXX_ARCHIVE_FINISH "<CMAKE_RANLIB> -no_warning_for_no_symbols -c <TARGET>")
  90endif()
  91
  92include(CheckIncludeFile)
  93
  94check_include_file("arpa/inet.h" HAVE_ARPA_INET_H)
  95check_include_file("fcntl.h" HAVE_FCNTL_H)
  96check_include_file("limits.h" HAVE_LIMITS_H)
  97check_include_file("netdb.h" HAVE_NETDB_H)
  98check_include_file("netinet/in.h" HAVE_NETINET_IN_H)
  99check_include_file("stddef.h" HAVE_STDDEF_H)
 100check_include_file("time.h" HAVE_TIME_H)
 101check_include_file("sys/ioctl.h" HAVE_SYS_IOCTL_H)
 102check_include_file("sys/socket.h" HAVE_SYS_SOCKET_H)
 103check_include_file("sys/time.h" HAVE_SYS_TIME_H)
 104check_include_file("errno.h" HAVE_ERRNO_H)
 105check_include_file("dlfcn.h" HAVE_DLFCN_H)
 106check_include_file("inttypes.h" HAVE_INTTYPES_H)
 107check_include_file("memory.h" HAVE_MEMORY_H)
 108check_include_file("stdint.h" HAVE_STDINT_H)
 109check_include_file("stdlib.h" HAVE_STDLIB_H)
 110check_include_file("string.h" HAVE_STRING_H)
 111check_include_file("strings.h" HAVE_STRINGS_H)
 112check_include_file("sys/stat.h" HAVE_SYS_STAT_H)
 113check_include_file("sys/types.h" HAVE_SYS_TYPES_H)
 114check_include_file("unistd.h" HAVE_UNISTD_H)
 115
 116include(CheckFunctionExists)
 117
 118# TODO: Also check if these functions are declared by the
 119#       expected headers. See comments around
 120#       AC_CHECK_FUNCS/AC_CHECK_DECLS in configure.ac.
 121check_function_exists("gethostbyname" HAVE_GETHOSTBYNAME)
 122check_function_exists("getaddrinfo" HAVE_GETADDRINFO)
 123check_function_exists("gettimeofday" HAVE_GETTIMEOFDAY)
 124check_function_exists("gmtime_r" HAVE_GMTIME_R)
 125check_function_exists("inet_ntoa" HAVE_INET_NTOA)
 126check_function_exists("memset" HAVE_MEMSET)
 127check_function_exists("socket" HAVE_SOCKET)
 128check_function_exists("strftime" HAVE_STRFTIME)
 129check_function_exists("__atomic_fetch_add" HAVE_C___ATOMIC)
 130check_function_exists("getpid" HAVE_GETPID)
 131
 132include(CheckSymbolExists)
 133check_symbol_exists(isascii "ctype.h" HAVE_ISASCII)
 134
 135include(CheckTypeSize)
 136
 137check_type_size("__uint128_t" __UINT128_T)
 138check_type_size("long long" SIZEOF_LONG_LONG)
 139check_type_size("long" SIZEOF_LONG)
 140check_type_size("time_t" SIZEOF_TIME_T)
 141check_type_size("uintptr_t" HAVE_UINTPTR_T)
 142
 143# By default, HAVE___UINT128_T gets defined as TRUE,
 144# but we want it as 1.
 145if(HAVE___UINT128_T)
 146    set(HAVE___UINT128_T "1" CACHE INTERNAL "Result of TRY_COMPILE" FORCE)
 147    list(APPEND WOLFSSL_DEFINITIONS "-DHAVE___UINT128_T")
 148endif()
 149
 150if(CMAKE_VERSION VERSION_LESS "3.20")
 151    # TestBigEndian was deprecated in 3.20
 152    include(TestBigEndian)
 153    test_big_endian(IS_BIG_ENDIAN)
 154    set(CMAKE_C_BYTE_ORDER "LITTLE_ENDIAN")
 155    if(IS_BIG_ENDIAN)
 156        set(CMAKE_C_BYTE_ORDER "BIG_ENDIAN")
 157    endif()
 158endif()
 159
 160# Thread local storage
 161include(CheckCSourceCompiles)
 162
 163if(CMAKE_C_COMPILER_ID STREQUAL "OpenWatcom")
 164    if(CMAKE_SYSTEM_NAME STREQUAL "Windows")
 165        list(APPEND WOLFSSL_DEFINITIONS "-DHAVE_THREAD_LS")
 166    endif()
 167else()
 168    set(TLS_KEYWORDS "__thread" "__declspec(thread)")
 169    foreach(TLS_KEYWORD IN LISTS TLS_KEYWORDS)
 170        set(TLS_CODE "#include <stdlib.h>
 171                  static void foo(void) {
 172                     static ${TLS_KEYWORD} int bar\;
 173                     exit(1)\;
 174                  }
 175
 176                  int main() {
 177                    return 0\;
 178                  }"
 179        )
 180        check_c_source_compiles(${TLS_CODE} THREAD_LS_ON)
 181
 182        if(THREAD_LS_ON)
 183            list(APPEND WOLFSSL_DEFINITIONS "-DHAVE_THREAD_LS")
 184            break()
 185        else()
 186            # THREAD_LS_ON is cached after each call to
 187            # check_c_source_compiles, and the function
 188            # won't run subsequent times if the variable
 189            # is in the cache. To make it run again, we
 190            # need to remove the variable from the cache.
 191            unset(THREAD_LS_ON CACHE)
 192        endif()
 193    endforeach()
 194endif()
 195
 196# TODO: AX_PTHREAD does a lot. Need to implement the
 197#       rest of its logic.
 198find_package(Threads)
 199
 200####################################################
 201# Cross Compile Example
 202####################################################
 203
 204#set(CMAKE_SYSTEM_NAME Linux)
 205#set(CMAKE_SYSTEM_PROCESSOR arm)
 206#set(CMAKE_C_COMPILER "/opt/arm-linux-musleabihf-cross/bin/arm-linux-musleabihf-gcc")
 207#set(CMAKE_CXX_COMPILER "/opt/arm-linux-musleabihf-cross/bin/arm-linux-musleabihf-g++")
 208#set(CMAKE_SYSROOT "/opt/arm-linux-musleabihf-cross/arm-linux-musleabihf/")
 209# Example for setting CFLAGS
 210#set(CMAKE_C_FLAGS "-std=gnu89 ${CMAKE_C_FLAGS}")
 211# Example for map file and custom linker script
 212#set(CMAKE_EXE_LINKER_FLAGS " -Xlinker -Map=output.map -T\"${CMAKE_CURRENT_SOURCE_DIR}/linker.ld\"")
 213
 214message(STATUS "C Compiler ID: ${CMAKE_C_COMPILER_ID}")
 215
 216if(DEFINED WARNING_C_FLAGS)
 217    set(CMAKE_C_FLAGS "${WARNING_C_FLAGS} ${CMAKE_C_FLAGS}")
 218endif()
 219
 220if(CMAKE_C_COMPILER_ID STREQUAL "OpenWatcom")
 221    set(CMAKE_C_FLAGS "${CMAKE_C_FLAGS} -wx -wcd=202")
 222    list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_HAVE_MIN -DWOLFSSL_HAVE_MAX -DNO_WRITEV")
 223elseif(WIN32)
 224    # Windows cl.exe does not support the -Wextra, -Wno-unused and -Werror flags.
 225    set(CMAKE_C_FLAGS "-Wall ${CMAKE_C_FLAGS}")
 226else()
 227    set(CMAKE_C_FLAGS "-Wall -Wextra -Wno-unused -Werror ${CMAKE_C_FLAGS}")
 228endif()
 229
 230####################################################
 231# Build Options
 232####################################################
 233# TODO: - FIPS
 234#       - Distro
 235#       - Linux Kernel Module
 236#       - Single precision math
 237#       - Enable all
 238#       - Enable all crypto
 239
 240# For reproducible build, gate out from the build anything that might
 241# introduce semantically frivolous jitter, maximizing chance of
 242# identical object files.
 243add_option("WOLFSSL_REPRODUCIBLE_BUILD"
 244    "Enable maximally reproducible build (default: disabled)"
 245    "no" "yes;no")
 246
 247if(WOLFSSL_REPRODUCIBLE_BUILD)
 248    list(APPEND WOLFSSL_DEFINITIONS "-DHAVE_REPRODUCIBLE_BUILD")
 249    set(CMAKE_C_ARCHIVE_CREATE "<CMAKE_AR> Dqc <TARGET> <LINK_FLAGS> <OBJECTS>")
 250    set(CMAKE_C_ARCHIVE_APPEND "<CMAKE_AR> Dq  <TARGET> <LINK_FLAGS> <OBJECTS>")
 251    set(CMAKE_C_ARCHIVE_FINISH "<CMAKE_RANLIB> -D <TARGET>")
 252endif()
 253
 254add_option("WOLFSSL_INSTALL" "Create install target for WolfSSL project" "yes" "yes;no")
 255
 256# Support for forcing 32-bit mode
 257# TODO: detect platform from other options
 258add_option("WOLFSSL_32BIT"
 259    "Enables 32-bit support (default: disabled)"
 260    "no" "yes;no")
 261
 262# 16-bit compiler support
 263add_option("WOLFSSL_16BIT"
 264    "Enables 16-bit support (default: disabled)"
 265    "no" "yes;no")
 266if(WOLFSSL_16BIT)
 267    list(APPEND WOLFSSL_DEFINITIONS "-DWC_16BIT_CPU")
 268endif()
 269
 270# Support for disabling all ASM
 271add_option("WOLFSSL_ASM"
 272    "Enables option for assembly (default: enabled)"
 273    "yes" "yes;no")
 274
 275if(NOT WOLFSSL_ASM)
 276    list(APPEND WOLFSSL_DEFINITIONS
 277        "-DTFM_NO_ASM"
 278        "-DWOLFSSL_NO_ASM")
 279endif()
 280
 281# Enable Debugging
 282add_option("WOLFSSL_DEBUG"
 283    "Enables option for debug (default: disabled)"
 284    "no" "yes;no")
 285
 286if(WOLFSSL_DEBUG)
 287    # Optional variable inspection
 288    if (0)
 289        get_cmake_property(_variableNames VARIABLES)
 290        list (SORT _variableNames)
 291        message(STATUS "")
 292        message(STATUS "ALL VARIABLES BEGIN")
 293        message(STATUS "")
 294        foreach (_variableName ${_variableNames})
 295            message(STATUS "${_variableName}=${${_variableName}}")
 296        endforeach()
 297        message(STATUS "")
 298        message(STATUS "ALL VARIABLES END")
 299        message(STATUS "")
 300    endif()
 301
 302    if (CMAKE_C_COMPILER_ID STREQUAL "Watcom" OR CMAKE_C_COMPILER_ID STREQUAL "OpenWatcom" OR CMAKE_GENERATOR STREQUAL "Watcom WMake")
 303        # Open Watcom v2 does not support -g debugging
 304        message(STATUS "Detected Watcom compiler, using CMAKE_C_FLAGS_DEBUG -d2")
 305        set(CMAKE_C_FLAGS_DEBUG "-d2 ${CMAKE_C_FLAGS_DEBUG}")
 306    else()
 307        set(CMAKE_C_FLAGS "-g ${CMAKE_C_FLAGS}")
 308    endif()
 309    list(APPEND WOLFSSL_DEFINITIONS
 310        "-DDEBUG_WOLFSSL"
 311        "-DDEBUG")
 312endif()
 313
 314
 315# Single threaded
 316add_option("WOLFSSL_SINGLE_THREADED"
 317    "Enable wolfSSL single threaded (default: disabled)"
 318    "no" "yes;no")
 319
 320# TODO: Logic here isn't complete, yet (see AX_PTHREAD)
 321if(NOT WOLFSSL_SINGLE_THREADED)
 322    if(CMAKE_USE_PTHREADS_INIT)
 323        list(APPEND WOLFSSL_LINK_LIBS Threads::Threads)
 324        set(HAVE_PTHREAD 1)
 325        list(APPEND WOLFSSL_DEFINITIONS "-DHAVE_PTHREAD")
 326    endif()
 327else()
 328    list(APPEND WOLFSSL_DEFINITIONS "-DSINGLE_THREADED")
 329endif()
 330
 331# DTLS-SRTP
 332add_option("WOLFSSL_SRTP"
 333    "Enables wolfSSL DTLS-SRTP (default: disabled)"
 334    "no" "yes;no")
 335
 336if(WOLFSSL_SRTP)
 337    list(APPEND WOLFSSL_DEFINITIONS
 338        "-DWOLFSSL_SRTP")
 339    set(WOLFSSL_DTLS "yes")
 340    set(WOLFSSL_KEYING_MATERIAL "yes")
 341endif()
 342
 343
 344# DTLS
 345add_option("WOLFSSL_DTLS"
 346    "Enables wolfSSL DTLS (default: disabled)"
 347    "no" "yes;no")
 348
 349if(WOLFSSL_DTLS)
 350    list(APPEND WOLFSSL_DEFINITIONS
 351        "-DWOLFSSL_DTLS")
 352endif()
 353
 354
 355# TLS v1.3
 356add_option("WOLFSSL_TLS13"
 357    "Enable wolfSSL TLS v1.3 (default: enabled)"
 358    "yes" "yes;no")
 359
 360if("${FIPS_VERSION}" STREQUAL "v1")
 361    override_cache(WOLFSSL_TLS13 "no")
 362endif()
 363
 364# Post-handshake authentication
 365add_option("WOLFSSL_POSTAUTH"
 366    "Enable wolfSSL Post-handshake Authentication (default: disabled)"
 367    "no" "yes;no")
 368
 369if(WOLFSSL_POSTAUTH)
 370    if(NOT WOLFSSL_TLS13)
 371        message(WARNING "TLS 1.3 is disabled - disabling Post-handshake Authentication")
 372        override_cache(WOLFSSL_POSTAUTH "no")
 373    else()
 374        list(APPEND WOLFSSL_DEFINITIONS
 375            "-DWOLFSSL_POST_HANDSHAKE_AUTH")
 376    endif()
 377endif()
 378
 379# Certificate Authentication with External PSK (RFC 8773bis)
 380add_option("WOLFSSL_CERT_WITH_EXTERN_PSK"
 381    "Enable Certificate Authentication with External PSKs for TLS 1.3 (default: disabled)"
 382    "no" "yes;no")
 383
 384if(WOLFSSL_CERT_WITH_EXTERN_PSK)
 385    if(NOT WOLFSSL_TLS13)
 386        message(WARNING "TLS 1.3 is disabled - disabling cert-with-extern-psk")
 387        override_cache(WOLFSSL_CERT_WITH_EXTERN_PSK "no")
 388    elseif(NOT WOLFSSL_PSK)
 389        message(WARNING "PSK is disabled - disabling cert-with-extern-psk")
 390        override_cache(WOLFSSL_CERT_WITH_EXTERN_PSK "no")
 391    else()
 392        list(APPEND WOLFSSL_DEFINITIONS
 393            "-DWOLFSSL_CERT_WITH_EXTERN_PSK")
 394    endif()
 395endif()
 396
 397# Hello Retry Request Cookie
 398add_option("WOLFSSL_HRR_COOKIE"
 399    "Enable the server to send Cookie Extension in HRR with state (default: disabled)"
 400    "undefined" "yes;no;undefined")
 401
 402if("${WOLFSSL_HRR_COOKIE}" STREQUAL "yes")
 403    if(NOT WOLFSSL_TLS13)
 404        message(WARNING "TLS 1.3 is disabled - disabling HRR Cookie")
 405        override_cache(WOLFSSL_HRR_COOKIE "no")
 406    else()
 407        list(APPEND WOLFSSL_DEFINITIONS
 408            "-DWOLFSSL_SEND_HRR_COOKIE")
 409    endif()
 410endif()
 411
 412# DTLS v1.3
 413add_option("WOLFSSL_DTLS13"
 414    "Enable wolfSSL DTLS v1.3 (default: disabled)"
 415    "no" "yes;no")
 416
 417if(WOLFSSL_DTLS13)
 418    if (NOT WOLFSSL_DTLS)
 419      message(FATAL_ERROR "DTLS13 requires DTLS")
 420    endif()
 421    if (NOT WOLFSSL_TLS13)
 422      message(FATAL_ERROR "DTLS13 requires TLS13")
 423    endif()
 424    list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_DTLS13")
 425    list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_W64_WRAPPER")
 426    if ("${WOLFSSL_HRR_COOKIE}" STREQUAL "undefined")
 427      message(WARNING "DTLS1.3 is enabled - enabling HRR Cookie")
 428      override_cache(WOLFSSL_HRR_COOKIE "yes")
 429      list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_SEND_HRR_COOKIE")
 430    endif()
 431    if (WOLFSSL_AES)
 432      list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_AES_DIRECT")
 433    endif()
 434endif()
 435
 436# DTLS ConnectionID support
 437add_option("WOLFSSL_DTLS_CID"
 438    "Enables wolfSSL DTLS CID (default: disabled)"
 439    "no" "yes;no")
 440
 441if(WOLFSSL_DTLS_CID)
 442    if(NOT WOLFSSL_DTLS13)
 443        message(FATAL_ERROR "CID are supported only for DTLSv1.3")
 444    endif()
 445    list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_DTLS_CID")
 446endif()
 447
 448# DTLS 1.3 Fragment ClientHello
 449add_option("WOLFSSL_DTLS_CH_FRAG"
 450    "Enable wolfSSL DTLS 1.3 Fragment ClientHello (default: disabled)"
 451    "no" "yes;no")
 452
 453if(WOLFSSL_DTLS_CH_FRAG)
 454    if(NOT WOLFSSL_DTLS13)
 455        message(FATAL_ERROR "DTLS 1.3 Fragment ClientHello is supported only for DTLSv1.3")
 456    endif()
 457    list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_DTLS_CH_FRAG")
 458endif()
 459
 460# RNG
 461add_option("WOLFSSL_RNG"
 462    "Enable compiling and using RNG (default: enabled)"
 463    "yes" "yes;no")
 464
 465if(NOT WOLFSSL_RNG)
 466    list(APPEND WOLFSSL_DEFINITIONS "-DWC_NO_RNG")
 467endif()
 468
 469# QUIC
 470add_option(WOLFSSL_QUIC
 471    "Enable QUIC support (default: disabled)"
 472    "no" "yes;no")
 473
 474if(WOLFSSL_QUIC)
 475    set(WOLFSSL_ALPN "yes")
 476    set(WOLFSSL_OPENSSLEXTRA "yes")
 477    set(WOLFSSL_AESCTR "yes")
 478    set(WOLFSSL_CURVE25519 "yes")
 479    set(WOLFSSL_SNI "yes")
 480    list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_QUIC" "-DHAVE_EX_DATA")
 481endif()
 482
 483# Curl
 484add_option(WOLFSSL_CURL
 485    "Enable CURL support (default: disabled)"
 486    "no" "yes;no")
 487
 488if(WOLFSSL_CURL)
 489    set(WOLFSSL_MD4 "yes")
 490    set(WOLFSSL_DES3 "yes")
 491    set(WOLFSSL_ALPN "yes")
 492    set(WOLFSSL_EX_DATA "yes")
 493    set(WOLFSSL_WOLFSSH "yes")
 494    set(WOLFSSL_OPENSSLEXTRA "yes")
 495    set(WOLFSSL_CRL "yes")
 496    set(WOLFSSL_OCSP "yes")
 497    set(WOLFSSL_OCSPSTAPLING "yes")
 498    set(WOLFSSL_OCSPSTAPLING_V2 "yes")
 499    # Note: OCSP sets requisite HAVE_TLS_EXTENSIONS and HAVE_CERTIFICATE_STATUS_REQUEST(_V2)
 500    set(WOLFSSL_SNI "yes")
 501    set(WOLFSSL_ALT_CERT_CHAINS "yes")
 502    set(WOLFSSL_IP_ALT_NAME "yes")
 503    set(WOLFSSL_SESSION_TICKET "yes")
 504    list(APPEND WOLFSSL_DEFINITIONS
 505        "-DNO_SESSION_CACHE_REF" "-DWOLFSSL_DES_ECB")
 506endif()
 507
 508# ALPN
 509add_option(WOLFSSL_ALPN
 510    "Enable ALPN support (default: disabled)"
 511    "no" "yes;no")
 512
 513if(WOLFSSL_ALPN)
 514    list(APPEND WOLFSSL_DEFINITIONS "-DHAVE_ALPN" "-DHAVE_TLS_EXTENSIONS")
 515endif()
 516
 517# altcertchains
 518add_option(WOLFSSL_ALT_CERT_CHAINS
 519    "Enable support for Alternate certification chains (default: disabled)"
 520    "no" "yes;no")
 521
 522if(WOLFSSL_ALT_CERT_CHAINS)
 523        list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_ALT_CERT_CHAINS")
 524endif()
 525
 526# ip-alt-name
 527add_option(WOLFSSL_IP_ALT_NAME
 528    "Enable support for IP alternative name (default: disabled)"
 529    "no" "yes;no")
 530
 531if(WOLFSSL_IP_ALT_NAME)
 532        list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_IP_ALT_NAME")
 533endif()
 534
 535# wolfSSH
 536add_option(WOLFSSL_WOLFSSH
 537    "Enable support for wolfSSH (default: disabled)"
 538    "no" "yes;no")
 539
 540if(WOLFSSL_WOLFSSH)
 541    list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_WOLFSSH")
 542endif()
 543
 544
 545# TODO: - DTLS-SCTP
 546#       - DTLS multicast
 547#       - OpenSSH
 548#       - OpenVPN
 549#       - Nginx
 550#       - HAProxy
 551#       - wpa_supplicant
 552#       - Fortress
 553#       - libwebsockets
 554#       - Qt
 555#       - SSL bump
 556#       - sniffer
 557#       - Signal
 558#       - OpenSSL coexist
 559#       - Max strength
 560
 561# Harden, enable Timing Resistance and Blinding by default
 562add_option("WOLFSSL_HARDEN"
 563    "Enable Hardened build, Enables Timing Resistance and Blinding (default: enabled)"
 564    "yes" "yes;no")
 565
 566if(WOLFSSL_HARDEN)
 567    list(APPEND WOLFSSL_DEFINITIONS "-DTFM_TIMING_RESISTANT" "-DECC_TIMING_RESISTANT")
 568
 569    if(WOLFSSL_RNG)
 570        list(APPEND WOLFSSL_DEFINITIONS "-DWC_RSA_BLINDING")
 571    endif()
 572else()
 573    list(APPEND WOLFSSL_DEFINITIONS "-DWC_NO_HARDEN")
 574endif()
 575
 576add_option(WOLFSSL_OPENSSLEXTRA
 577    "Enable extra OpenSSL API, size+ (default: disabled)"
 578    "no" "yes;no")
 579
 580add_option(WOLFSSL_OPENSSLALL
 581    "Enable all OpenSSL API, size++ (default: disabled)"
 582    "no" "yes;no")
 583
 584add_option(WOLFSSL_ASIO
 585    "Enable asio support (default: disabled)"
 586    "no" "yes;no")
 587
 588if (WOLFSSL_ASIO)
 589    list(APPEND WOLFSSL_DEFINITIONS
 590    "-DWOLFSSL_ASIO" "-DASIO_USE_WOLFSSL"
 591    "-DBOOST_ASIO_USE_WOLFSSL" "-DHAVE_EX_DATA"
 592    "-DSSL_TXT_TLSV1_2" "-DOPENSSL_NO_SSL2" "-DOPENSSL_NO_SSL3"
 593    "-DHAVE_OCSP" "-DWOLFSSL_KEY_GEN")
 594    override_cache(WOLFSSL_OPENSSLALL "yes")
 595    override_cache(WOLFSSL_OPENSSLEXTRA "yes")
 596endif()
 597
 598if (WOLFSSL_OPENSSLEXTRA AND NOT WOLFSSL_OPENSSLCOEXIST)
 599    list(APPEND WOLFSSL_DEFINITIONS
 600      "-DOPENSSL_EXTRA")
 601endif()
 602
 603if (WOLFSSL_OPENSSLALL)
 604    list(APPEND WOLFSSL_DEFINITIONS
 605      "-DOPENSSL_ALL" "-DWOLFSSL_EITHER_SIDE" "-DWC_RSA_NO_PADDING"
 606      "-DWC_RSA_PSS" "-DWOLFSSL_PSS_LONG_SALT" "-DWOLFSSL_TICKET_HAVE_ID"
 607      "-DWOLFSSL_ERROR_CODE_OPENSSL" "-DWOLFSSL_CERT_NAME_ALL")
 608endif()
 609
 610add_option(WOLFSSL_NO_STUB
 611    "Removes OpenSSL compatibility stub functions (default: disabled)"
 612    "no" "yes;no")
 613
 614if (WOLFSSL_NO_STUB)
 615    list(APPEND WOLFSSL_DEFINITIONS
 616      "-DNO_WOLFSSL_STUB")
 617endif()
 618
 619# TODO: - IPv6 test apps
 620
 621set(WOLFSSL_SLOW_MATH "yes")
 622
 623# liboqs
 624add_option(WOLFSSL_OQS
 625    "Enable integration with the OQS (Open Quantum Safe) liboqs library (default: disabled)"
 626    "no" "yes;no")
 627
 628# Falcon (provided via liboqs)
 629add_option(WOLFSSL_FALCON
 630    "Enable Falcon post-quantum signatures via liboqs (default: disabled)"
 631    "no" "yes;no")
 632
 633# ML-KEM/Kyber
 634add_option(WOLFSSL_MLKEM
 635    "Enable the wolfSSL PQ ML-KEM library (default: disabled)"
 636    "yes" "yes;no")
 637
 638if (WOLFSSL_MLKEM)
 639    list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_HAVE_MLKEM")
 640    list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_SHA3")
 641    list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_SHAKE128")
 642    list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_SHAKE256")
 643
 644    set_wolfssl_definitions("WOLFSSL_HAVE_MLKEM" RESULT)
 645    set_wolfssl_definitions("WOLFSSL_SHA3"       RESULT)
 646    set_wolfssl_definitions("WOLFSSL_SHAKE128"   RESULT)
 647    set_wolfssl_definitions("WOLFSSL_SHAKE256"   RESULT)
 648endif()
 649
 650# When MLKEM and DTLS 1.3 are both enabled, DTLS ClientHello fragmenting is
 651# required (PQC keys in ClientHello can exceed MTU), so enable it automatically.
 652if(WOLFSSL_MLKEM AND WOLFSSL_DTLS13 AND NOT WOLFSSL_DTLS_CH_FRAG)
 653    message(STATUS "MLKEM and DTLS 1.3 are enabled; enabling DTLS ClientHello fragmenting")
 654    override_cache(WOLFSSL_DTLS_CH_FRAG "yes")
 655    list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_DTLS_CH_FRAG")
 656endif()
 657
 658# Disable ML-KEM as standalone TLS key exchange (non-hybrid); when enabled (default), standalone is disabled
 659add_option(WOLFSSL_TLS_NO_MLKEM_STANDALONE
 660    "Disable ML-KEM as standalone TLS key exchange (non-hybrid) (default: enabled, i.e. standalone disabled)"
 661    "yes" "yes;no")
 662
 663if (WOLFSSL_TLS_NO_MLKEM_STANDALONE)
 664    list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_TLS_NO_MLKEM_STANDALONE")
 665endif()
 666
 667# PQ/T hybrid combinations
 668add_option(WOLFSSL_PQC_HYBRIDS
 669    "Enable PQ/T hybrid combinations (default: enabled)"
 670    "yes" "yes;no")
 671
 672if (WOLFSSL_PQC_HYBRIDS)
 673    list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_PQC_HYBRIDS")
 674endif()
 675
 676# Dilithium
 677add_option(WOLFSSL_DILITHIUM
 678    "Enable the wolfSSL PQ Dilithium (ML-DSA) implementation (default: disabled)"
 679    "no" "yes;no")
 680
 681if (WOLFSSL_DILITHIUM)
 682    list(APPEND WOLFSSL_DEFINITIONS "-DHAVE_DILITHIUM")
 683    list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_SHA3")
 684    list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_SHAKE128")
 685    list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_SHAKE256")
 686
 687    set_wolfssl_definitions("HAVE_DILITHIUM"       RESULT)
 688    set_wolfssl_definitions("WOLFSSL_SHA3"         RESULT)
 689    set_wolfssl_definitions("WOLFSSL_SHAKE128"     RESULT)
 690    set_wolfssl_definitions("WOLFSSL_SHAKE256"     RESULT)
 691endif()
 692
 693# LMS
 694add_option(WOLFSSL_LMS
 695    "Enable the PQ LMS Stateful Hash-based Signature Scheme (default: disabled)"
 696    "no" "yes;no")
 697
 698add_option(WOLFSSL_LMSSHA256192
 699    "Enable the LMS SHA_256_192 truncated variant (default: disabled)"
 700    "no" "yes;no")
 701
 702add_option(WOLFSSL_LMSNOSHA256256
 703    "Disable the LMS SHA_256_256 standard variant (default: disabled)"
 704    "no" "yes;no")
 705
 706if (WOLFSSL_LMS)
 707    list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_HAVE_LMS")
 708
 709    set_wolfssl_definitions("WOLFSSL_HAVE_LMS" RESULT)
 710
 711    if (WOLFSSL_LMSSHA256192)
 712        list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_LMS_SHA256_192")
 713
 714        set_wolfssl_definitions("WOLFSSL_LMS_SHA256_192"    RESULT)
 715    endif()
 716
 717    if (WOLFSSL_LMSNOSHA256256)
 718        list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_NO_LMS_SHA256_256")
 719
 720        set_wolfssl_definitions("WOLFSSL_NO_LMS_SHA256_256" RESULT)
 721    endif()
 722endif()
 723
 724# Experimental features
 725add_option(WOLFSSL_EXPERIMENTAL
 726    "Enable experimental features (default: disabled)"
 727    "no" "yes;no")
 728
 729add_option(WOLFSSL_EXTRA_PQC_HYBRIDS
 730    "Enable extra PQ/T hybrid combinations (default: disabled)"
 731    "no" "yes;no")
 732
 733message(STATUS "Looking for WOLFSSL_EXPERIMENTAL")
 734if (WOLFSSL_EXPERIMENTAL)
 735    message(STATUS "Looking for WOLFSSL_EXPERIMENTAL - found")
 736
 737    # We've enabled the experimental environment, but let's
 738    # check if any experimental features are also enabled:
 739    set(WOLFSSL_FOUND_EXPERIMENTAL_FEATURE 0)
 740
 741    set_wolfssl_definitions("WOLFSSL_EXPERIMENTAL_SETTINGS" RESULT)
 742
 743    # Cross-validate WOLFSSL_OQS and WOLFSSL_FALCON: liboqs is only linked
 744    # when a liboqs-backed algorithm (Falcon) is actually enabled.
 745    if (WOLFSSL_FALCON AND NOT WOLFSSL_OQS)
 746        message(FATAL_ERROR "WOLFSSL_FALCON requires WOLFSSL_OQS.")
 747    endif()
 748    if (WOLFSSL_OQS AND NOT WOLFSSL_FALCON)
 749        message(FATAL_ERROR "WOLFSSL_OQS requires WOLFSSL_FALCON.")
 750    endif()
 751
 752    # Checking for experimental feature: OQS
 753    message(STATUS "Looking for WOLFSSL_OQS")
 754    if (WOLFSSL_OQS)
 755        set(WOLFSSL_FOUND_EXPERIMENTAL_FEATURE 1)
 756        message(STATUS "Looking for WOLFSSL_OQS - found")
 757
 758        message(STATUS "Checking OQS")
 759        find_package(OQS)
 760        if (OQS_FOUND)
 761            message(STATUS "Checking OQS - found")
 762            list(APPEND WOLFSSL_LINK_LIBS ${OQS_LIBRARY})
 763            list(APPEND WOLFSSL_INCLUDE_DIRS ${OQS_INCLUDE_DIR})
 764
 765            set_wolfssl_definitions("HAVE_LIBOQS"          RESULT)
 766            set_wolfssl_definitions("HAVE_TLS_EXTENSIONS"  RESULT)
 767            set_wolfssl_definitions("OPENSSL_EXTRA"        RESULT)
 768            set_wolfssl_definitions("HAVE_FALCON"          RESULT)
 769
 770        else()
 771            message(STATUS "Checking OQS - not found")
 772            message(STATUS "WARNING: WOLFSSL_OQS enabled but not found: OQS_LIBRARY=${OQS_LIBRARY}, OQS_INCLUDE_DIR=${OQS_INCLUDE_DIR} ")
 773        endif()
 774    else()
 775        message(STATUS "Looking for WOLFSSL_OQS - not found")
 776    endif()
 777
 778    # Checking for experimental feature: extra PQ/T hybrid combinations
 779    message(STATUS "Looking for WOLFSSL_EXTRA_PQC_HYBRIDS")
 780    if (WOLFSSL_EXTRA_PQC_HYBRIDS)
 781        set(WOLFSSL_FOUND_EXPERIMENTAL_FEATURE 1)
 782        message(STATUS "Looking for WOLFSSL_EXTRA_PQC_HYBRIDS - found")
 783        list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_EXTRA_PQC_HYBRIDS")
 784    else()
 785        message(STATUS "Looking for WOLFSSL_EXTRA_PQC_HYBRIDS - not found")
 786    endif()
 787
 788    # Other experimental feature detection can be added here...
 789
 790    # Were any experimental features found? Display a message.
 791    if(WOLFSSL_FOUND_EXPERIMENTAL_FEATURE)
 792        message(STATUS "WOLFSSL_EXPERIMENTAL enabled, experimental features enabled.")
 793    else()
 794        message(STATUS "Warning: WOLFSSL_EXPERIMENTAL enabled, but no experimental features enabled.")
 795    endif()
 796
 797else()
 798    # Experimental mode not enabled, but were any experimental features enabled? Error out if so:
 799    message(STATUS "Looking for WOLFSSL_EXPERIMENTAL - not found")
 800    if (WOLFSSL_OQS)
 801        message(FATAL_ERROR "Error: WOLFSSL_OQS requires WOLFSSL_EXPERIMENTAL at this time.")
 802    endif()
 803    if (WOLFSSL_FALCON)
 804        message(FATAL_ERROR "Error: WOLFSSL_FALCON requires WOLFSSL_EXPERIMENTAL at this time.")
 805    endif()
 806endif()
 807
 808# LMS
 809add_option(WOLFSSL_LMS
 810    "Enable the wolfSSL LMS implementation (default: disabled)"
 811    "no" "yes;no")
 812
 813# XMSS
 814add_option(WOLFSSL_XMSS
 815    "Enable the wolfSSL XMSS implementation (default: disabled)"
 816    "no" "yes;no")
 817
 818# SLH-DSA
 819add_option(WOLFSSL_SLHDSA
 820    "Enable the wolfSSL SLH-DSA implementation (default: disabled)"
 821    "no" "yes;no")
 822
 823if (WOLFSSL_SLHDSA)
 824    message(STATUS "Automatically set related requirements for SLH-DSA")
 825    add_definitions("-DWOLFSSL_HAVE_SLHDSA")
 826    add_definitions("-DWOLFSSL_WC_SLHDSA")
 827    add_definitions("-DWOLFSSL_SHAKE256")
 828
 829    set_wolfssl_definitions("WOLFSSL_HAVE_SLHDSA" RESULT)
 830    set_wolfssl_definitions("WOLFSSL_WC_SLHDSA"   RESULT)
 831    set_wolfssl_definitions("WOLFSSL_SHAKE256"    RESULT)
 832    message(STATUS "Looking for WOLFSSL_SLHDSA - found")
 833endif()
 834
 835# TODO: - Lean PSK
 836#       - Lean TLS
 837#       - Low resource
 838#       - Titan cache
 839#       - Huge cache
 840#       - Big cache
 841#       - Small cache
 842#       - Persistent session cache
 843#       - Persistent cert cache
 844#       - Write duplicate
 845#       - Atomic user record layer
 846#       - Public key callbacks
 847#       - Microchip/Atmel CryptoAuthLib
 848#       - dual-certs
 849
 850# AES-CBC
 851add_option("WOLFSSL_AESCBC"
 852    "Enable wolfSSL AES-CBC support (default: enabled)"
 853    "yes" "yes;no")
 854
 855if(NOT WOLFSSL_AESCBC)
 856    list(APPEND WOLFSSL_DEFINITIONS "-DNO_AES_CBC")
 857endif()
 858
 859# AES-GCM
 860add_option("WOLFSSL_AESGCM"
 861    "Enable wolfSSL AES-GCM support (default: enabled)"
 862    "yes" "yes;no;table;small;word32;4bit")
 863
 864# leanpsk and leantls don't need gcm
 865if(WOLFSSL_LEAN_PSK OR (WOLFSSL_LEAN_TLS AND NOT WOLFSSL_TLS13))
 866    override_cache(WOLFSSL_AESGCM "no")
 867endif()
 868
 869if(WOLFSSL_AESGCM AND CMAKE_C_BYTE_ORDER STREQUAL "LITTLE_ENDIAN")
 870    override_cache(WOLFSSL_AESGCM "4bit")
 871endif()
 872
 873if(WOLFSSL_AESGCM)
 874    if("${WOLFSSL_AESGCM}" STREQUAL "word32")
 875        list(APPEND WOLFSSL_DEFINITIONS "-DGCM_WORD32")
 876        override_cache(WOLFSSL_AESGCM "yes")
 877    endif()
 878
 879    if(("${WOLFSSL_AESGCM}" STREQUAL "small") OR WOLFSSL_LOW_RESOURCE)
 880        list(APPEND WOLFSSL_DEFINITIONS "-DGCM_SMALL")
 881        override_cache(WOLFSSL_AESGCM "yes")
 882    endif()
 883
 884    if("${WOLFSSL_AESGCM}" STREQUAL "table")
 885        list(APPEND WOLFSSL_DEFINITIONS "-DGCM_TABLE")
 886        override_cache(WOLFSSL_AESGCM "yes")
 887    endif()
 888
 889    if("${WOLFSSL_AESGCM}" STREQUAL "4bit")
 890        list(APPEND WOLFSSL_DEFINITIONS "-DGCM_TABLE_4BIT")
 891        override_cache(WOLFSSL_AESGCM "yes")
 892    endif()
 893
 894    list(APPEND WOLFSSL_DEFINITIONS "-DHAVE_AESGCM")
 895endif()
 896
 897if(WOLFSSL_QUIC)
 898    if(NOT WOLFSSL_TLS13)
 899        message(FATAL_ERROR "TLS 1.3 is disabled - necessary for QUIC")
 900    endif()
 901    if(NOT WOLFSSL_AESGCM)
 902        message(FATAL_ERROR "AES-GCM is disabled - necessary for QUIC")
 903    endif()
 904endif()
 905
 906# AES-SIV
 907add_option("WOLFSSL_AESSIV"
 908    "Enable wolfSSL AES-SIV support (default: disabled)"
 909    "no" "yes;no")
 910
 911if(WOLFSSL_AESSIV)
 912    list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_AES_SIV")
 913endif()
 914
 915# AES-CTR
 916add_option("WOLFSSL_AESCTR"
 917    "Enable wolfSSL AES-CTR support (default: disabled)"
 918    "no" "yes;no")
 919
 920if(WOLFSSL_OPENVPN OR
 921   WOLFSSL_LIBSSH2 OR
 922   WOLFSSL_AESSIV OR
 923   WOLFSSL_CLU)
 924    override_cache(WOLFSSL_AESCTR "yes")
 925endif()
 926
 927if(WOLFSSL_AESCTR AND NOT WOLFSSL_FORTRESS)
 928    list(APPEND WOLFSSL_DEFINITIONS
 929        "-DWOLFSSL_AES_COUNTER"
 930        "-DWOLFSSL_AES_DIRECT")
 931endif()
 932
 933# ARIA
 934add_option("WOLFSSL_ARIA"
 935    "Enable wolfSSL ARIA support (default: disabled)"
 936    "no" "yes;no")
 937
 938# AES-CCM
 939add_option("WOLFSSL_AESCCM"
 940    "Enable wolfSSL AES-CCM support (default: disabled)"
 941    "no" "yes;no")
 942
 943# AES-OFB
 944add_option("WOLFSSL_AESOFB"
 945    "Enable wolfSSL AES-OFB support (default: disabled)"
 946    "no" "yes;no")
 947
 948# AES-ECB
 949add_option("WOLFSSL_AESECB"
 950    "Enable wolfSSL AES-ECB support (default: disabled)"
 951    "no" "yes;no")
 952
 953if(WOLFSSL_AESECB)
 954    list(APPEND WOLFSSL_DEFINITIONS "-DHAVE_AES_ECB")
 955endif()
 956
 957# AES-CTS
 958add_option("WOLFSSL_AESCTS"
 959    "Enable wolfSSL AES-CTS support (default: disabled)"
 960    "no" "yes;no")
 961
 962if(WOLFSSL_AESCTS)
 963    if(NOT WOLFSSL_AESCBC)
 964        message(FATAL_ERROR "AES-CTS requires AES-CBC.")
 965    endif()
 966    list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_AES_CTS")
 967endif()
 968
 969# TODO: - AES-GCM stream
 970#       - AES-ARM
 971#       - Xilinx hardened crypto
 972#       - Intel AES-NI
 973#       - Intel ASM
 974#       - Intel RDRAND
 975#       - Linux af_alg
 976#       - Linux dev crpyto calls
 977#       - Camellia
 978#       - MD2
 979#       - RIPEMD
 980#       - BLAKE2
 981
 982add_option("WOLFSSL_AESCFB"
 983    "Enable wolfSSL AES-CFB support (default: disabled)"
 984    "no" "yes;no")
 985
 986# Align data
 987add_option("WOLFSSL_ALIGN_DATA"
 988    "Align data for ciphers (default: enabled)"
 989    "yes" "yes;no")
 990if(WOLFSSL_ALIGN_DATA)
 991    list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_USE_ALIGN")
 992endif()
 993
 994# SHA224
 995set(SHA224_DEFAULT "no")
 996if(("${CMAKE_SYSTEM_PROCESSOR}" MATCHES "x86_64|AMD64|arm64") OR
 997    ("${CMAKE_SYSTEM_PROCESSOR}" STREQUAL "aarch64"))
 998    if(NOT WOLFSSL_AFALG AND NOT WOLFSSL_DEVCRYPTO AND
 999       (NOT WOLFSSL_FIPS OR ("${FIPS_VERSION}" STREQUAL "v2")))
1000        set(SHA224_DEFAULT "yes")
1001    endif()
1002endif()
1003
1004add_option("WOLFSSL_SHA224"
1005    "Enable wolfSSL SHA-224 support (default: enabled on x86_64/aarch64)"
1006    ${SHA224_DEFAULT} "yes;no")
1007
1008# SHA3
1009set(SHA3_DEFAULT "no")
1010if(("${CMAKE_SYSTEM_PROCESSOR}" MATCHES "x86_64|AMD64|arm64") OR
1011    ("${CMAKE_SYSTEM_PROCESSOR}" STREQUAL "aarch64"))
1012    if(NOT WOLFSSL_FIPS OR ("${FIPS_VERSION}" STREQUAL "v2"))
1013        set(SHA3_DEFAULT "yes")
1014    endif()
1015endif()
1016
1017add_option("WOLFSSL_SHA3"
1018    "Enable wolfSSL SHA-3 support (default: enabled on x86_64/aarch64)"
1019     ${SHA3_DEFAULT} "yes;no;small")
1020
1021# SHAKE256
1022add_option("WOLFSSL_SHAKE256"
1023    "Enable wolfSSL SHAKE256 support (default: enabled on x86_64/aarch64)"
1024    "no" "yes;no;small")
1025
1026# SHAKE128
1027add_option("WOLFSSL_SHAKE128"
1028    "Enable wolfSSL SHAKE128 support (default: enabled on x86_64/aarch64)"
1029    "no" "yes;no;small")
1030
1031# SHA512
1032add_option("WOLFSSL_SHA512"
1033    "Enable wolfSSL SHA-512 support (default: enabled)"
1034    "yes" "yes;no")
1035
1036# options that don't require sha512
1037if(WOLFSSL_LEAN_PSK OR
1038   WOLFSSL_LEAN_TLS OR
1039   WOLFSSL_32BIT OR
1040   WOLFSSL_16BIT)
1041    override_cache(WOLFSSL_SHA512 "no")
1042endif()
1043
1044# options that require sha512
1045if(WOLFSSL_OPENSSH OR
1046   WOLFSSL_WPAS OR
1047   WOLFSSL_FORTRESS)
1048    override_cache(WOLFSSL_SHA512 "yes")
1049endif()
1050
1051if(WOLFSSL_SHA512)
1052    list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_SHA512")
1053endif()
1054
1055# SHA384
1056add_option("WOLFSSL_SHA384"
1057    "Enable wolfSSL SHA-384 support (default: enabled)"
1058    "yes" "yes;no")
1059
1060# options that don't require sha384
1061if(WOLFSSL_LEAN_PSK OR
1062   WOLFSSL_LEAN_TLS OR
1063   WOLFSSL_32BIT OR
1064   WOLFSSL_16BIT)
1065    override_cache(WOLFSSL_SHA384 "no")
1066endif()
1067
1068# options that require sha384
1069if(WOLFSSL_OPENSSH OR
1070   WOLFSSL_WPAS OR
1071   WOLFSSL_FORTRESS)
1072    override_cache(WOLFSSL_SHA384 "yes")
1073endif()
1074
1075if(WOLFSSL_SHA384)
1076    list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_SHA384")
1077endif()
1078
1079# TODO: - Session certs
1080#       - SEP
1081
1082add_option("WOLFSSL_KEYGEN"
1083    "Enable key generation (default: disabled)"
1084    "no" "yes;no")
1085
1086add_option("WOLFSSL_CERTGEN"
1087    "Enable cert generation (default: disabled)"
1088    "no" "yes;no")
1089
1090add_option("WOLFSSL_CERTREQ"
1091    "Enable cert request generation (default: disabled)"
1092    "no" "yes;no")
1093
1094add_option("WOLFSSL_CERTEXT"
1095    "Enable cert request extensions (default: disabled)"
1096    "no" "yes;no")
1097
1098add_option("WOLFSSL_CERTGENCACHE"
1099    "Enable decoded cert caching (default: disabled)"
1100    "no" "yes;no")
1101
1102# HKDF
1103add_option("WOLFSSL_HKDF"
1104    "Enable HKDF (HMAC-KDF) support (default: disabled)"
1105    "no" "yes;no")
1106
1107if(WOLFSSL_TLS13)
1108    override_cache(WOLFSSL_HKDF "yes")
1109endif()
1110
1111if(WOLFSSL_HKDF)
1112    list(APPEND WOLFSSL_DEFINITIONS "-DHAVE_HKDF")
1113endif()
1114
1115# DSA
1116add_option("WOLFSSL_DSA"
1117    "Enable DSA (default: disabled)"
1118    "no" "yes;no")
1119
1120if(NOT WOLFSSL_DSA AND NOT WOLFSSL_OPENSSH)
1121    list(APPEND WOLFSSL_DEFINITIONS "-DNO_DSA")
1122endif()
1123
1124# ECC Shamir
1125add_option("WOLFSSL_ECCSHAMIR"
1126    "Enable ECC Shamir (default: enabled)"
1127    "yes" "yes;no")
1128
1129# ECC
1130add_option("WOLFSSL_ECC"
1131    "Enable ECC (default: enabled)"
1132    "yes" "yes;no;nonblock")
1133
1134# lean psk doesn't need ecc
1135if(WOLFSSL_LEAN_PSK)
1136    override_cache(WOLFSSL_ECC "no")
1137endif()
1138
1139if(WOLFSSL_OPENSSH OR
1140   WOLFSSL_NGINX OR
1141   WOLFSSL_SIGNAL)
1142    override_cache(WOLFSSL_ECC "yes")
1143endif()
1144
1145if(WOLFSSL_ECC)
1146    list(APPEND WOLFSSL_DEFINITIONS "-DHAVE_ECC" "-DTFM_ECC256")
1147
1148    if(WOLFSSL_ECCSHAMIR AND NOT WOLFSSL_LOW_RESOURCE)
1149        list(APPEND WOLFSSL_DEFINITIONS "-DECC_SHAMIR")
1150    endif()
1151
1152    if("${WOLFSSL_ECC}" STREQUAL "nonblock")
1153        list(APPEND WOLFSSL_DEFINITIONS "-DWC_ECC_NONBLOCK")
1154    endif()
1155endif()
1156
1157# ECCSI
1158add_option("WOLFSSL_ECCSI"
1159    "Enable ECCSI (default: disabled)"
1160    "no" "yes;no")
1161
1162if(WOLFSSL_ECCSI)
1163    if (NOT WOLFSSL_ECC)
1164        message(FATAL_ERROR "cannot enable ECCSI without enabling ECC.")
1165    endif()
1166
1167    list(APPEND WOLFSSL_DEFINITIONS "-DWOLFCRYPT_HAVE_ECCSI")
1168endif()
1169
1170# SAKKE
1171add_option("WOLFSSL_SAKKE"
1172    "Enable SAKKE (default: disabled)"
1173    "no" "yes;no")
1174
1175if(WOLFSSL_SAKKE)
1176    if (NOT WOLFSSL_ECC)
1177        message(FATAL_ERROR "cannot enable SAKKE without enabling ECC.")
1178    endif()
1179
1180    list(APPEND WOLFSSL_DEFINITIONS "-DWOLFCRYPT_HAVE_SAKKE")
1181endif()
1182
1183# SipHash
1184add_option("WOLFSSL_SIPHASH"
1185    "Enable SipHash (default: disabled)"
1186    "no" "yes;no")
1187
1188if(WOLFSSL_SIPHASH)
1189    list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_SIPHASH")
1190endif()
1191
1192add_option("WOLFSSL_PUBLIC_MP"
1193    "Enable public MP API (default: disabled)"
1194    "no" "yes;no")
1195
1196if(WOLFSSL_WOLFSSH OR WOLFSSL_WPAS OR WOLFSSL_ECCSI)
1197    override_cache(WOLFSSL_PUBLIC_MP "yes")
1198endif()
1199
1200if(WOLFSSL_PUBLIC_MP)
1201    list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_PUBLIC_MP")
1202endif()
1203
1204# TODO: - Compressed key
1205#       - FP ECC, fixed point cache ECC
1206#       - ECC encrypt
1207#       - PSK
1208#       - Single PSK identity
1209
1210# ECC custom curves
1211add_option("WOLFSSL_ECCCUSTCURVES"
1212    "Enable ECC Custom Curves (default: disabled)"
1213    "no" "yes;no;all")
1214
1215if(WOLFSSL_ECCCUSTCURVES)
1216    if("${WOLFSSL_ECCCUSTCURVES}" STREQUAL "all")
1217        list(APPEND WOLFSSL_DEFINITIONS "-DHAVE_ECC_SECPR2")
1218        list(APPEND WOLFSSL_DEFINITIONS "-DHAVE_ECC_SECPR3")
1219        list(APPEND WOLFSSL_DEFINITIONS "-DHAVE_ECC_BRAINPOOL")
1220        list(APPEND WOLFSSL_DEFINITIONS "-DHAVE_ECC_KOBLITZ")
1221        list(APPEND WOLFSSL_DEFINITIONS "-DHAVE_ECC_CDH")
1222    endif()
1223
1224    list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_CUSTOM_CURVES")
1225endif()
1226
1227# CURVE25519
1228set(WOLFSSL_CURVE25519_SMALL "no")
1229add_option("WOLFSSL_CURVE25519"
1230    "Enable Curve25519 (default: disabled)"
1231    "no" "yes;no;small;no128bit")
1232
1233if(WOLFSSL_OPENSSH)
1234    override_cache(WOLFSSL_CURVE25519 "yes")
1235endif()
1236
1237if(WOLFSSL_CURVE25519)
1238    if("${WOLFSSL_CURVE25519}" STREQUAL "small" OR WOLFSSL_LOW_RESOURCE)
1239        list(APPEND WOLFSSL_DEFINITIONS "-DCURVE25519_SMALL")
1240        set(WOLFSSL_CURVE25519_SMALL "yes")
1241    endif()
1242
1243    if("${WOLFSSL_CURVE25519}" STREQUAL "no128bit" OR WOLFSSL_32BIT)
1244        list(APPEND WOLFSSL_DEFINITIONS "-DNO_CURVED25519_128BIT")
1245    endif()
1246
1247    list(APPEND WOLFSSL_DEFINITIONS "-DHAVE_CURVE25519")
1248    set(WOLFSSL_FEMATH "yes")
1249endif()
1250
1251# ED25519
1252set(WOLFSSL_ED25519_SMALL "no")
1253add_option("WOLFSSL_ED25519"
1254    "Enable ED25519 (default: disabled)"
1255    "no" "yes;no")
1256
1257if(WOLFSSL_OPENSSH OR WOLFSSL_CLU)
1258    override_cache(WOLFSSL_ED25519 "yes")
1259endif()
1260
1261if(WOLFSSL_ED25519 AND NOT WOLFSSL_32BIT)
1262    if("${WOLFSSL_ED25519}" STREQUAL "small" OR WOLFSSL_LOW_RESOURCE)
1263        list(APPEND WOLFSSL_DEFINITIONS "-DED25519_SMALL")
1264        set(WOLFSSL_ED25519_SMALL "yes")
1265        set(WOLFSSL_CURVE25519_SMALL "yes")
1266    endif()
1267
1268    if(NOT WOLFSSL_SHA512)
1269        message(FATAL_ERROR "cannot enable ed25519 without enabling sha512.")
1270    endif()
1271
1272    set(WOLFSSL_FEMATH "yes")
1273    set(WOLFSSL_GEMATH "yes")
1274    list(APPEND WOLFSSL_DEFINITIONS "-DHAVE_ED25519")
1275endif()
1276
1277# CURVE448
1278set(WOLFSSL_CURVE448_SMALL "no")
1279add_option("WOLFSSL_CURVE448"
1280    "Enable Curve448 (default: disabled)"
1281    "no" "yes;no;small")
1282
1283if(WOLFSSL_CURVE448)
1284    if("${WOLFSSL_CURVE448}" STREQUAL "small" OR WOLFSSL_LOW_RESOURCE)
1285        list(APPEND WOLFSSL_DEFINITIONS "-DCURVE448_SMALL")
1286        set(WOLFSSL_CURVE448_SMALL "yes")
1287    endif()
1288
1289    if("${WOLFSSL_CURVE448}" STREQUAL "no128bit" OR WOLFSSL_32BIT)
1290        list(APPEND WOLFSSL_DEFINITIONS "-DNO_CURVED448_128BIT")
1291    endif()
1292
1293    list(APPEND WOLFSSL_DEFINITIONS "-DHAVE_CURVE448")
1294    set(WOLFSSL_FE448 "yes")
1295endif()
1296
1297# ED448
1298set(WOLFSSL_ED448_SMALL "no")
1299add_option("WOLFSSL_ED448"
1300    "Enable ED448 (default: disabled)"
1301    "no" "yes;no;small")
1302
1303if(WOLFSSL_ED448 AND NOT WOLFSSL_32BIT)
1304    if("${WOLFSSL_ED448}" STREQUAL "small" OR WOLFSSL_LOW_RESOURCE)
1305        list(APPEND WOLFSSL_DEFINITIONS "-DED448_SMALL")
1306        set(WOLFSSL_ED448_SMALL "yes")
1307        set(WOLFSSL_CURVE448_SMALL "yes")
1308    endif()
1309
1310    if(NOT WOLFSSL_SHA512)
1311        message(FATAL_ERROR "cannot enable ed448 without enabling sha512.")
1312    endif()
1313
1314    set(WOLFSSL_FE448 "yes")
1315    set(WOLFSSL_GE448 "yes")
1316    list(APPEND WOLFSSL_DEFINITIONS "-DHAVE_ED448")
1317
1318    # EdDSA448 requires SHAKE256 which requires SHA-3
1319    override_cache(WOLFSSL_SHAKE256 "yes")
1320endif()
1321
1322# Error strings
1323add_option("WOLFSSL_ERROR_STRINGS"
1324    "Enable error strings table (default: enabled)"
1325    "yes" "yes;no")
1326
1327if(NOT WOLFSSL_ERROR_STRINGS)
1328    list(APPEND WOLFSSL_DEFINITIONS "-DNO_ERROR_STRINGS")
1329else()
1330    # turn off error strings if leanpsk or leantls on
1331    if(WOLFSSL_LEAN_PSK OR WOLFSSL_LEAN_TLS)
1332        list(APPEND WOLFSSL_DEFINITIONS "-DNO_ERROR_STRINGS")
1333        override_cache(WOLFSSL_ERROR_STRINGS "no")
1334    endif()
1335endif()
1336
1337# Error queue
1338add_option("WOLFSSL_ERROR_QUEUE"
1339    "Enables adding nodes to error queue when compiled with OPENSSL_EXTRA (default: enabled)"
1340    "yes" "yes;no")
1341
1342if(NOT WOLFSSL_ERROR_QUEUE)
1343    list(APPEND WOLFSSL_DEFINITIONS "-DNO_ERROR_QUEUE")
1344endif()
1345
1346# Old TLS
1347add_option("WOLFSSL_OLD_TLS"
1348    "Enable old TLS versions < 1.2 (default: disabled)"
1349    "no" "yes;no")
1350
1351if(NOT WOLFSSL_OLD_TLS)
1352    list(APPEND WOLFSSL_DEFINITIONS "-DNO_OLD_TLS")
1353else()
1354    # turn off old if leanpsk or leantls on
1355    if(WOLFSSL_LEAN_PSK OR WOLFSSL_LEAN_TLS)
1356        list(APPEND WOLFSSL_DEFINITIONS "-DNO_OLD_TLS")
1357        override_cache(WOLFSSL_OLD_TLS "no")
1358    endif()
1359endif()
1360
1361# TLSv1.2
1362add_option("WOLFSSL_TLSV12"
1363    "Enable TLS versions 1.2 (default: enabled)"
1364    "yes" "yes;no")
1365
1366if(NOT WOLFSSL_TLSV12)
1367    list(APPEND WOLFSSL_DEFINITIONS
1368        "-DWOLFSSL_NO_TLS12"
1369        "-DNO_OLD_TLS")
1370endif()
1371
1372# TODO: - TLSv1.0
1373#       - SSLv3
1374#       - Stack size
1375#       - Stack size verbose
1376
1377# Memory
1378add_option("WOLFSSL_MEMORY"
1379    "Enable memory callbacks (default: enabled)"
1380    "yes" "yes;no")
1381
1382if(NOT WOLFSSL_MEMORY)
1383    list(APPEND WOLFSSL_DEFINITIONS "-DNO_WOLFSSL_MEMORY")
1384else()
1385    # turn off memory cb if leanpsk or leantls on
1386    if(WOLFSSL_LEAN_PSK OR WOLFSSL_LEAN_TLS)
1387        list(APPEND WOLFSSL_DEFINITIONS "-DNO_WOLFSSL_MEMORY")
1388    endif()
1389endif()
1390
1391# TODO: - Track memory
1392#       - Memory log
1393#       - Stack log
1394
1395# RSA
1396add_option("WOLFSSL_RSA"
1397    "Enable RSA (default: enabled)"
1398    "yes" "yes;no")
1399
1400if(NOT WOLFSSL_RSA)
1401    list(APPEND WOLFSSL_DEFINITIONS "-DNO_RSA")
1402else()
1403    if(WOLFSSL_LEAN_PSK OR WOLFSSL_LEAN_TLS)
1404        list(APPEND WOLFSSL_DEFINITIONS "-DNO_RSA")
1405        override_cache(WOLFSSL_RSA "no")
1406    endif()
1407endif()
1408
1409# RSA Direct
1410add_option("WOLFSSL_WC_RSA_DIRECT"
1411    "Enable RSA Direct (default: disabled)"
1412    "no" "yes;no")
1413
1414if(WOLFSSL_RSA AND WOLFSSL_WC_RSA_DIRECT)
1415    list(APPEND WOLFSSL_DEFINITIONS "-DWC_RSA_DIRECT")
1416endif()
1417
1418# OAEP
1419add_option("WOLFSSL_OAEP"
1420    "Enable RSA OAEP (default: enabled)"
1421    "yes" "yes;no")
1422
1423if(NOT WOLFSSL_OAEP)
1424    list(APPEND WOLFSSL_DEFINITIONS "-DWC_NO_RSA_OAEP")
1425endif()
1426
1427# TODO: - RSA public only
1428#       - RSA verify inline only
1429
1430# RSA-PSS
1431add_option("WOLFSSL_RSA_PSS"
1432    "Enable RSA-PSS (default: disabled)"
1433    "no" "yes;no")
1434
1435if(NOT WOLFSSL_RSA)
1436    override_cache(WOLFSSL_RSA_PSS "no")
1437else()
1438    if(WOLFSSL_TLS13)
1439        override_cache(WOLFSSL_RSA_PSS "yes")
1440    endif()
1441endif()
1442if(WOLFSSL_RSA_PSS)
1443    list(APPEND WOLFSSL_DEFINITIONS "-DWC_RSA_PSS")
1444    list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_PSS_LONG_SALT")
1445endif()
1446
1447# DH
1448add_option("WOLFSSL_DH"
1449    "Enable DH (default: enabled)"
1450    "yes" "yes;no;const")
1451
1452if(WOLFSSL_OPENSSH)
1453    override_cache(WOLFSSL_DH "yes")
1454endif()
1455
1456if(NOT WOLFSSL_DH)
1457    list(APPEND WOLFSSL_DEFINITIONS "-DNO_DH")
1458else()
1459    if(WOLFSSL_LEAN_PSK OR WOLFSSL_LEAN_TLS)
1460      list(APPEND WOLFSSL_DEFINITIONS "-DNO_DH")
1461      override_cache(WOLFSSL_DH "no")
1462    endif()
1463endif()
1464
1465if("${WOLFSSL_DH}" STREQUAL "const")
1466    list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_DH_CONST")
1467    set(WOLFSSL_DH_CONST "yes")
1468endif()
1469
1470# TODO: - Anonymous
1471
1472# ASN
1473# turn off asn, which means no certs, no rsa, no dsa, no ecc,
1474# and no big int (unless dh is on)
1475add_option("WOLFSSL_ASN"
1476    "Enable ASN (default: enabled)"
1477    "yes" "yes;no")
1478
1479if(NOT WOLFSSL_ASN)
1480    list(APPEND WOLFSSL_DEFINITIONS "-DNO_ASN" "-DNO_CERTS")
1481
1482    if(NOT WOLFSSL_DH AND NOT WOLFSSL_ECC)
1483        # DH and ECC need bigint
1484        list(APPEND WOLFSSL_DEFINITIONS "-DNO_BIG_INT")
1485    endif()
1486else()
1487    # turn off ASN if leanpsk on
1488    if(WOLFSSL_LEAN_PSK)
1489        list(APPEND WOLFSSL_DEFINITIONS
1490            "-DNO_ASN"
1491            "-DNO_CERTS"
1492            "-DNO_BIG_INT")
1493        override_cache(WOLFSSL_ASN "no")
1494    else()
1495        if("${WOLFSSL_ASN}" STREQUAL "nocrypt")
1496            list(APPEND WOLFSSL_DEFINITIONS "-DNO_ASN_CRYPT")
1497            # TODO: verify that this is correct
1498            override_cache(WOLFSSL_PWDBASED "no")
1499        endif()
1500    endif()
1501endif()
1502
1503if(WOLFSSL_RSA AND NOT WOLFSSL_RSA_VFY AND NOT WOLFSSL_ASN)
1504    message(FATAL_ERROR "please disable rsa if disabling asn.")
1505endif()
1506
1507if(WOLFSSL_DSA AND NOT WOLFSSL_ASN)
1508    message(FATAL_ERROR "please disable dsa if disabling asn.")
1509endif()
1510
1511# DH and ECC need bigint
1512if(NOT WOLFSSL_ASN AND
1513   NOT WOLFSSL_DH AND
1514   NOT WOLFSSL_ECC AND
1515   NOT WOLFSSL_RSA)
1516    override_cache(WOLFSSL_FAST_MATH "no")
1517    set(WOLFSSL_SLOWMATH "no")
1518endif()
1519
1520# AES
1521add_option("WOLFSSL_AES"
1522    "Enable AES (default: enabled)"
1523    "yes" "yes;no")
1524
1525if(NOT WOLFSSL_AES)
1526    list(APPEND WOLFSSL_DEFINITIONS "-DNO_AES")
1527
1528    if(WOLFSSL_FORTRESS)
1529        message(FATAL_ERROR "fortress requires aes")
1530    endif()
1531    if(WOLFSSL_ECC_ENCRYPT)
1532        message(FATAL_ERROR "cannot enable eccencrypt and hkdf without aes.")
1533    endif()
1534    if(WOLFSSL_AESGCM)
1535        message(FATAL_ERROR "AESGCM requires AES.")
1536    endif()
1537    if(WOLFSSL_AESCCM)
1538        message(FATAL_ERROR "AESCCM requires AES.")
1539    endif()
1540    if(WOLFSSL_AESCTR)
1541        message(FATAL_ERROR "AESCTR requires AES.")
1542    endif()
1543    if(WOLFSSL_AESECB)
1544        message(FATAL_ERROR "AES-ECB requires AES.")
1545    endif()
1546    if(WOLFSSL_AESCTS)
1547        message(FATAL_ERROR "AES-CTS requires AES.")
1548    endif()
1549else()
1550    if(WOLFSSL_LEAN_PSK)
1551        list(APPEND WOLFSSL_DEFINITIONS "-DNO_AES")
1552        override_cache(WOLFSSL_AES "no")
1553    endif()
1554endif()
1555
1556# Coding
1557add_option("WOLFSSL_CODING"
1558    "Enable coding base 16/64 (default: enabled)"
1559    "yes" "yes;no")
1560
1561if(NOT WOLFSSL_CODING)
1562    list(APPEND WOLFSSL_DEFINITIONS "-DNO_CODING")
1563else()
1564    # turn off CODING if leanpsk on
1565    if(WOLFSSL_LEAN_PSK)
1566        list(APPEND WOLFSSL_DEFINITIONS "-DNO_CODING")
1567        override_cache(WOLFSSL_CODING "no")
1568    endif()
1569endif()
1570
1571# Base64
1572set(BASE64_ENCODE_DEFAULT "no")
1573if("${CMAKE_SYSTEM_PROCESSOR}" MATCHES "x86_64|AMD64|arm64")
1574    set(BASE64_ENCODE_DEFAULT "yes")
1575endif()
1576
1577set(WOLFSSL_BASE64_ENCODE_HELP_STRING "Enable Base64 encoding (default: enabled on x86_64)")
1578add_option("WOLFSSL_BASE64_ENCODE" ${WOLFSSL_BASE64_ENCODE_HELP_STRING} ${BASE64_ENCODE_DEFAULT} "yes;no")
1579
1580if(WOLFSSL_BASE64_ENCODE)
1581    list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_BASE64_ENCODE")
1582endif()
1583
1584# TODO: - Base16
1585
1586# DES3
1587set(WOLFSSL_DES3_HELP_STRING "Enable DES3 (default: disabled)")
1588add_option("WOLFSSL_DES3" ${WOLFSSL_DES3_HELP_STRING} "no" "yes;no")
1589
1590if(WOLFSSL_OPENSSH OR
1591   WOLFSSL_QT OR
1592   WOLFSSL_OPENVPN OR
1593   WOLFSSL_WPAS OR
1594   WOLFSSL_ASIO)
1595    override_cache(WOLFSSL_DES3 "yes")
1596endif()
1597
1598# DES3 TLS Suites
1599set(WOLFSSL_DES3_TLS_SUITES_STRING "Enable DES3 TLS cipher suites (default: disabled)")
1600add_option("WOLFSSL_DES3_TLS_SUITES" ${WOLFSSL_DES3_TLS_SUITES_STRING} "no" "yes;no")
1601
1602if(NOT WOLFSSL_DES3_TLS_SUITES)
1603    list(APPEND WOLFSSL_DEFINITIONS "-DNO_DES3_TLS_SUITES")
1604endif()
1605
1606# ARC4
1607set(WOLFSSL_ARC4_HELP_STRING "Enable ARC4 (default: disabled)")
1608add_option("WOLFSSL_ARC4" ${WOLFSSL_ARC4_HELP_STRING} "no" "yes;no")
1609
1610if(WOLFSSL_OPENSSH OR WOLFSSL_WPAS)
1611    override_cache(WOLFSSL_ARC4 "yes")
1612endif()
1613
1614# MD5
1615set(WOLFSSL_MD5_HELP_STRING "Enable MD5 (default: disabled)")
1616add_option("WOLFSSL_MD5" ${WOLFSSL_MD5_HELP_STRING} "no" "yes;no")
1617
1618if(WOLFSSL_WPAS OR
1619   WOLFSSL_HAPROXY OR
1620   WOLFSSL_NGINX OR
1621   WOLFSSL_OPENSSH OR
1622   WOLFSSL_OPENSSLEXTRA OR
1623   WOLFSSL_OPENVPN OR
1624   WOLFSSL_OLD_TLS OR
1625   WOLFSSL_FORTRESS OR
1626   WOLFSSL_LIGHTY OR
1627   WOLFSSL_DES3 OR
1628   WOLFSSL_OPENSSLALL)
1629    override_cache(WOLFSSL_MD5 "yes")
1630endif()
1631
1632if(NOT WOLFSSL_MD5)
1633    list(APPEND WOLFSSL_DEFINITIONS "-DNO_MD5" "-DNO_OLD_TLS")
1634endif()
1635
1636# SHA
1637add_option("WOLFSSL_SHA"
1638    "Enable SHA (default: enabled)"
1639    "yes" "yes;no")
1640
1641if(NOT WOLFSSL_SHA)
1642    list(APPEND WOLFSSL_DEFINITIONS "-DNO_SHA" "-DNO_OLD_TLS")
1643else()
1644    # turn off SHA if leanpsk or leantls on
1645    if(WOLFSSL_LEAN_PSK OR WOLFSSL_LEAN_TLS)
1646        list(APPEND WOLFSSL_DEFINITIONS "-DNO_SHA" "-DNO_OLD_TLS")
1647        override_cache(WOLFSSL_SHA "no")
1648    endif()
1649endif()
1650
1651# TODO: - AES-XTS
1652#       - Web server
1653#       - Web client
1654add_option("WOLFSSL_CMAC"
1655    "Enable CMAC (default: disabled)"
1656    "no" "yes;no")
1657
1658if(WOLFSSL_WPAS OR
1659   WOLFSSL_NTP OR
1660   WOLFSSL_AESSIV)
1661    override_cache(WOLFSSL_CMAC "yes")
1662endif()
1663
1664if(WOLFSSL_CMAC)
1665    if (NOT WOLFSSL_AES)
1666        message(FATAL_ERROR "Cannot use CMAC without AES.")
1667    else()
1668        list(APPEND WOLFSSL_DEFINITIONS
1669            "-DWOLFSSL_CMAC"
1670            "-DWOLFSSL_AES_DIRECT")
1671    endif()
1672endif()
1673
1674# SHE (Secure Hardware Extension) key update message generation
1675# standard: core SHE support, extended: adds custom KDF/header overrides
1676add_option("WOLFSSL_SHE"
1677    "Enable SHE key update support (standard|extended|no)"
1678    "no" "standard;extended;no")
1679
1680if(WOLFSSL_SHE STREQUAL "standard" OR WOLFSSL_SHE STREQUAL "extended")
1681    if (NOT WOLFSSL_AES)
1682        message(FATAL_ERROR "Cannot use SHE without AES.")
1683    else()
1684        list(APPEND WOLFSSL_DEFINITIONS
1685            "-DWOLFSSL_SHE"
1686            "-DWOLFSSL_CMAC"
1687            "-DWOLFSSL_AES_DIRECT")
1688        override_cache(WOLFSSL_CMAC "yes")
1689        override_cache(WOLFSSL_AESCBC "yes")
1690    endif()
1691endif()
1692
1693if(WOLFSSL_SHE STREQUAL "extended")
1694    list(APPEND WOLFSSL_DEFINITIONS
1695        "-DWOLFSSL_SHE_EXTENDED")
1696endif()
1697
1698# TODO: - RC2
1699#       - FIPS, again (there's more logic for FIPS in configure.ac)
1700#       - Selftest
1701
1702# SHA224
1703if(WOLFSSL_SHA224)
1704    list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_SHA224")
1705endif()
1706
1707# SHA3
1708if("${WOLFSSL_SHA3}" STREQUAL "small")
1709    list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_SHA3_SMALL")
1710    override_cache(WOLFSSL_SHA3 "yes")
1711endif()
1712
1713if(WOLFSSL_SHA3 AND NOT WOLFSSL_32BIT)
1714    list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_SHA3")
1715endif()
1716
1717# SHAKE256
1718if(WOLFSSL_SHAKE256)
1719    if(NOT WOLFSSL_32BIT)
1720        list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_SHAKE256")
1721
1722        if(NOT WOLFSSL_SHA3)
1723            message(FATAL_ERROR "Must have SHA-3 enabled: --enable-sha3")
1724        endif()
1725    endif()
1726else()
1727    list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_NO_SHAKE256")
1728endif()
1729
1730# SHAKE128
1731if(WOLFSSL_SHAKE128)
1732    if(NOT WOLFSSL_32BIT)
1733        list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_SHAKE128")
1734
1735        if(NOT WOLFSSL_SHA3)
1736            message(FATAL_ERROR "Must have SHA-3 enabled: --enable-sha3")
1737        endif()
1738    endif()
1739else()
1740    list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_NO_SHAKE128")
1741endif()
1742
1743# POLY1305
1744set(POLY1305_DEFAULT "yes")
1745if(WOLFSSL_FIPS)
1746    set(POLY1305_DEFAULT "no")
1747endif()
1748
1749set(WOLFSSL_POLY1305_HELP_STRING "Enable wolfSSL POLY1305 support (default: enabled)")
1750add_option("WOLFSSL_POLY1305" ${WOLFSSL_POLY1305_HELP_STRING} ${POLY1305_DEFAULT} "yes;no")
1751
1752# leanpsk and leantls don't need poly1305
1753if(WOLFSSL_LEAN_PSK OR WOLFSSL_LEAN_TLS)
1754    override_cache(WOLFSSL_POLY1305 "no")
1755endif()
1756
1757if(WOLFSSL_POLY1305)
1758    list(APPEND WOLFSSL_DEFINITIONS
1759        "-DHAVE_POLY1305"
1760        "-DHAVE_ONE_TIME_AUTH")
1761endif()
1762
1763# CHACHA
1764set(CHACHA_DEFAULT "yes")
1765if(WOLFSSL_FIPS)
1766    set(CHACHA_DEFAULT "no")
1767endif()
1768
1769add_option("WOLFSSL_CHACHA"
1770    "Enable CHACHA (default: enabled). Use `=noasm` to disable ASM AVX/AVX2 speedups"
1771    ${CHACHA_DEFAULT} "yes;no;noasm")
1772
1773# leanpsk and leantls don't need chacha
1774if(WOLFSSL_LEAN_PSK OR WOLFSSL_LEAN_TLS)
1775    override_cache(WOLFSSL_CHACHA "no")
1776endif()
1777
1778if(("${WOLFSSL_CHACHA}" STREQUAL "noasm") OR NOT WOLFSSL_ASM)
1779    list(APPEND WOLFSSL_DEFINITIONS "-DNO_CHACHA_ASM")
1780endif()
1781
1782if(NOT ("${WOLFSSL_CHACHA}" STREQUAL "noasm") AND WOLFSSL_CHACHA)
1783    list(APPEND WOLFSSL_DEFINITIONS "-DHAVE_CHACHA")
1784endif()
1785
1786# TODO: - XCHACHA
1787
1788# SRAM PUF
1789add_option("WOLFSSL_PUF"
1790    "Enable SRAM PUF support (default: disabled)"
1791    "no" "yes;no")
1792
1793if(WOLFSSL_PUF)
1794    list(APPEND WOLFSSL_DEFINITIONS
1795        "-DWOLFSSL_PUF"
1796        "-DWOLFSSL_PUF_SRAM"
1797        "-DHAVE_HKDF")
1798    override_cache(WOLFSSL_HKDF "yes")
1799endif()
1800
1801# PUF test mode (synthetic SRAM data injection)
1802add_option("WOLFSSL_PUF_TEST"
1803    "Enable PUF test mode with synthetic data (default: disabled)"
1804    "no" "yes;no")
1805
1806if(WOLFSSL_PUF_TEST)
1807    list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_PUF_TEST")
1808endif()
1809
1810# Hash DRBG
1811add_option("WOLFSSL_HASH_DRBG"
1812    "Enable Hash DRBG support (default: enabled)"
1813    "yes" "yes;no")
1814
1815if(WOLFSSL_HASH_DRBG)
1816    list(APPEND WOLFSSL_DEFINITIONS "-DHAVE_HASHDRBG")
1817else()
1818    # turn on Hash DRBG if FIPS is on
1819    if(WOLFSSL_FIPS)
1820        list(APPEND WOLFSSL_DEFINITIONS "-DHAVE_HASHDRBG")
1821        override_cache(WOLFSSL_HASH_DRBG "yes")
1822    else()
1823        list(APPEND WOLFSSL_DEFINITIONS "-DWC_NO_HASHDRBG")
1824    endif()
1825endif()
1826
1827# Filesystem
1828if(WOLFSSL_LINUX_KM)
1829    set(FILESYSTEM_DEFAULT "no")
1830else()
1831    set(FILESYSTEM_DEFAULT "yes")
1832endif()
1833
1834add_option("WOLFSSL_FILESYSTEM"
1835    "Enable Filesystem support (default: enabled)"
1836    ${FILESYSTEM_DEFAULT} "yes;no")
1837
1838if(NOT WOLFSSL_FILESYSTEM)
1839    list(APPEND WOLFSSL_DEFINITIONS "-DNO_FILESYSTEM")
1840else()
1841    if(WOLFSSL_LEAN_PSK OR WOLFSSL_LEAN_TLS)
1842        list(APPEND WOLFSSL_DEFINITIONS "-DNO_FILESYSTEM")
1843        override_cache(WOLFSSL_FILESYSTEM "no")
1844    endif()
1845endif()
1846
1847# Inline function support
1848add_option("WOLFSSL_INLINE"
1849    "Enable inline functions (default: enabled)"
1850    "yes" "yes;no")
1851
1852if(NOT WOLFSSL_INLINE)
1853    list(APPEND WOLFSSL_DEFINITIONS "-DNO_INLINE")
1854endif()
1855
1856add_option("WOLFSSL_ARMASM_INLINE"
1857    "Enable ARM assembly inline functions (default: disabled)"
1858    "no" "yes;no")
1859
1860if (WOLFSSL_ARMASM_INLINE)
1861    list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_ARMASM_INLINE")
1862endif()
1863
1864# TODO:
1865#       - CRL monitor
1866#       - User crypto
1867#       - Whitewood netRandom client library
1868#       - Max fragment length
1869#       - ALPN
1870#       - Trusted CA indication
1871#       - Truncated HMAC
1872#       - Renegotiation indication
1873#       - Secure renegotiation
1874#       - Fallback SCSV
1875
1876add_option(WOLFSSL_OCSP "Enable OCSP (default: disabled)" "no" "yes;no")
1877add_option(WOLFSSL_OCSPSTAPLING "Enable OCSP Stapling (default: disabled)" "no" "yes;no")
1878add_option(WOLFSSL_OCSPSTAPLING_V2 "Enable OCSP Stapling v2 (default: disabled)" "no" "yes;no")
1879add_option(WOLFSSL_CRL
1880    "Enable CRL (Use =io for inline CRL HTTP GET) (default: disabled)"
1881    "no" "yes;no;io")
1882
1883
1884set(SNI_DEFAULT "no")
1885if(("${CMAKE_SYSTEM_PROCESSOR}" MATCHES "x86_64|x86|AMD64|arm64") OR
1886    ("${CMAKE_SYSTEM_PROCESSOR}" STREQUAL "aarch64"))
1887    set(SNI_DEFAULT "yes")
1888endif()
1889set(WOLFSSL_SNI_HELP_STRING "Enable SNI (default: disabled)")
1890add_option(WOLFSSL_SNI ${WOLFSSL_SNI_HELP_STRING} ${SNI_DEFAULT} "yes;no")
1891
1892set(WOLFSSL_TLSX_HELP_STRING "Enable all TLS Extensions (default: disabled)")
1893add_option(WOLFSSL_TLSX ${WOLFSSL_TLSX_HELP_STRING} "no" "yes;no")
1894
1895add_option(WOLFSSL_EX_DATA
1896    "Enable app data (default: disabled)"
1897    "no" "yes;no")
1898
1899if (WOLFSSL_EX_DATA)
1900    list(APPEND WOLFSSL_DEFINITIONS
1901      "-DHAVE_EX_DATA")
1902endif()
1903
1904# Supported elliptic curves extensions
1905add_option("WOLFSSL_SUPPORTED_CURVES"
1906    "Enable Supported Elliptic Curves (default: enabled)"
1907    "yes" "yes;no")
1908
1909if(WOLFSSL_SUPPORTED_CURVES)
1910    if(NOT WOLFSSL_ECC AND NOT WOLFSSL_CURVE25519 AND NOT WOLFSSL_CURVE448)
1911        override_cache(WOLFSSL_SUPPORTED_CURVES "no")
1912    else()
1913        list(APPEND WOLFSSL_DEFINITIONS
1914            "-DHAVE_TLS_EXTENSIONS"
1915            "-DHAVE_SUPPORTED_CURVES")
1916    endif()
1917endif()
1918
1919# Diffie-Hellman
1920if(WOLFSSL_DH)
1921    if(WOLFSSL_TLS13 OR WOLFSSL_SUPPORTED_CURVES)
1922        list(APPEND WOLFSSL_DEFINITIONS "-DHAVE_FFDHE_2048")
1923    endif()
1924endif()
1925
1926# TODO: - FFDHE params only
1927
1928# TLS 1.3 Requires either ECC or (RSA/DH), or CURVE25519/ED25519 or CURVE448/ED448
1929if (NOT WOLFSSL_ECC AND
1930    (NOT WOLFSSL_RSA OR NOT WOLFSSL_DH) AND
1931    (NOT WOLFSSL_CURVE25519 OR NOT WOLFSSL_ED25519) AND
1932    (NOT WOLFSSL_CURVE448 AND NOT WOLFSSL_ED448))
1933    override_cache(WOLFSSL_TLS13 "no")
1934endif()
1935if (WOLFSSL_TLS13)
1936    list(APPEND WOLFSSL_DEFINITIONS
1937        "-DHAVE_SUPPORTED_CURVES"
1938        "-DWOLFSSL_TLS13"
1939        "-DHAVE_TLS_EXTENSIONS"
1940        )
1941endif()
1942
1943# Session Ticket Extension
1944add_option("WOLFSSL_SESSION_TICKET"
1945    "Enable Session Ticket (default: disabled)"
1946    "no" "yes;no")
1947
1948if(WOLFSSL_NGINX OR WOLFSSL_WPAS OR WOLFSSL_HAPROXY OR WOLFSSL_LIGHTY)
1949    override_cache(WOLFSSL_SESSION_TICKET "yes")
1950endif()
1951
1952if(WOLFSSL_SESSION_TICKET)
1953    list(APPEND WOLFSSL_DEFINITIONS
1954        "-DHAVE_TLS_EXTENSIONS"
1955        "-DHAVE_SESSION_TICKET")
1956endif()
1957
1958add_option("WOLFSSL_TICKET_NONCE_MALLOC"
1959    "Enable dynamic allocation of ticket nonces (default: disabled)"
1960    "no" "yes;no")
1961
1962if(WOLFSSL_TICKET_NONCE_MALLOC)
1963    list(APPEND WOLFSSL_DEFINITIONS
1964        "-DWOLFSSL_TICKET_NONCE_MALLOC")
1965endif()
1966
1967# Extended master secret extension
1968add_option("WOLFSSL_EXTENDED_MASTER"
1969    "Enable Extended Master Secret (default: enabled)"
1970    "yes" "yes;no")
1971
1972if(WOLFSSL_EXTENDED_MASTER)
1973    list(APPEND WOLFSSL_DEFINITIONS "-DHAVE_EXTENDED_MASTER")
1974endif()
1975
1976
1977if(NOT WOLFSSL_ARC4)
1978    list(APPEND WOLFSSL_DEFINITIONS "-DNO_RC4")
1979else()
1980    # turn off ARC4 if leanpsk or leantls on
1981    if(WOLFSSL_LEAN_PSK OR WOLFSSL_LEAN_TLS)
1982        list(APPEND WOLFSSL_DEFINITIONS "-DNO_RC4")
1983        override_cache(WOLFSSL_ARC4 "no")
1984    endif()
1985endif()
1986
1987# TODO: - TLS extensions
1988#       - Early data handshake
1989#       - SCEP
1990#       - Secure remote password
1991#       - Indefinite length encoded messages
1992#       - Small stack cache
1993#       - Small stack
1994#       - Valgrind
1995#       - Test certs
1996#       - I/O pool example
1997#       - Certificate service
1998#       - wolfSSL JNI
1999#       - lighttpd/lighty
2000#       - Asio
2001#       - Apache HTTPD
2002
2003set(WOLFSSL_PKCS7_HELP_STRING "Enable PKCS7 (default: disabled)")
2004add_option(WOLFSSL_PKCS7 ${WOLFSSL_PKCS7_HELP_STRING} "no" "yes;no")
2005
2006set(WOLFSSL_TPM_HELP_STRING "Enable wolfTPM options (default: disabled)")
2007add_option(WOLFSSL_TPM ${WOLFSSL_TPM_HELP_STRING} "no" "yes;no")
2008
2009set(WOLFSSL_CLU_HELP_STRING "Enable wolfCLU options (default: disabled)")
2010add_option(WOLFSSL_CLU ${WOLFSSL_CLU_HELP_STRING} "no" "yes;no")
2011
2012set(WOLFSSL_AESKEYWRAP_HELP_STRING "Enable AES key wrap support (default: disabled)")
2013add_option(WOLFSSL_AESKEYWRAP ${WOLFSSL_AESKEYWRAP_HELP_STRING} "no" "yes;no")
2014
2015set(WOLFSSL_X963KDF_HELP_STRING "Enable X9.63 KDF support (default: disabled)")
2016add_option(WOLFSSL_X963KDF ${WOLFSSL_X963KDF_HELP_STRING} "no" "yes;no")
2017
2018set(WOLFSSL_NULL_CIPHER_HELP_STRING "Enable NULL cipher support (default: disabled)")
2019add_option(WOLFSSL_NULL_CIPHER ${WOLFSSL_NULL_CIPHER_HELP_STRING} "no" "yes;no")
2020
2021# Encrypt-then-mac
2022add_option("WOLFSSL_ENC_THEN_MAC"
2023    "Enable Encryptr-Then-Mac extension (default: enabled)"
2024    "yes" "yes;no")
2025
2026if(WOLFSSL_APACHE_HTTPD)
2027    override_cache(WOLFSSL_ENC_THEN_MAC "no")
2028endif()
2029
2030if(WOLFSSL_TLSX)
2031    override_cache(WOLFSSL_ENC_THEN_MAC "yes")
2032endif()
2033
2034if(WOLFSSL_SNIFFER)
2035    override_cache(WOLFSSL_ENC_THEN_MAC "no")
2036endif()
2037
2038# stunnel Support
2039# TODO: rest of stunnel support
2040add_option("WOLFSSL_STUNNEL"
2041    "Enable stunnel (default: disabled)"
2042    "no" "yes;no")
2043
2044if(WOLFSSL_ENC_THEN_MAC)
2045    list(APPEND WOLFSSL_DEFINITIONS "-DHAVE_ENCRYPT_THEN_MAC")
2046endif()
2047
2048if(NOT WOLFSSL_PSK AND
2049   NOT WOLFSSL_LEAN_PSK AND
2050   NOT WOLFSSL_STUNNEL)
2051    list(APPEND WOLFSSL_DEFINITIONS "-DNO_PSK")
2052endif()
2053
2054# MD4
2055set(WOLFSSL_MD4_HELP_STRING "Enable MD4 (default: disabled)")
2056add_option("WOLFSSL_MD4" ${WOLFSSL_MD4_HELP_STRING} "no" "yes;no")
2057
2058if(NOT WOLFSSL_MD4)
2059    # turn on MD4 if using stunnel
2060    if(WOLFSSL_STUNNEL OR WOLFSSL_WPAS)
2061        override_cache(WOLFSSL_MD4 "yes")
2062    else()
2063        list(APPEND WOLFSSL_DEFINITIONS "-DNO_MD4")
2064    endif()
2065endif()
2066
2067#  Encrypted keys
2068add_option("WOLFSSL_ENCKEYS"
2069    "Enable PEM encrypted key support (default: disabled)"
2070    "no" "yes;no")
2071
2072if(NOT WOLFSSL_ENCKEYS)
2073    if(WOLFSSL_OPENSSLEXTRA OR
2074        WOLFSSL_WEBSERVER OR
2075        WOLFSSL_WPAS)
2076        # opensslextra, webserver, and WPAS  needs enckeys
2077        override_cache(WOLFSSL_ENCKEYS "yes")
2078    endif()
2079endif()
2080
2081if(WOLFSSL_ENCKEYS)
2082    list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_ENCRYPTED_KEYS")
2083endif()
2084
2085# PKCS#12
2086set(WOLFSSL_PKCS12_HELP_STRING "Enable pkcs12 (default: enabled)")
2087add_option("WOLFSSL_PKCS12" ${WOLFSSL_PKCS12_HELP_STRING} "yes" "yes;no")
2088if(NOT WOLFSSL_ASN)
2089  override_cache(WOLFSSL_PKCS12 "no")
2090endif()
2091
2092if(NOT WOLFSSL_PKCS12)
2093  list(APPEND WOLFSSL_DEFINITIONS "-DNO_PKCS12")
2094endif()
2095
2096# PKCS#11
2097add_option("WOLFSSL_PKCS11"
2098    "Enable PKCS#11 (default: disabled)"
2099    "no" "yes;no")
2100
2101if(WOLFSSL_PKCS11 AND NOT WIN32)
2102    list(APPEND WOLFSSL_DEFINITIONS "-DHAVE_PKCS11 -DHAVE_WOLF_BIGINT")
2103    list(APPEND WOLFSSL_LINK_LIBS ${CMAKE_DL_LIBS})
2104endif()
2105
2106
2107# PWDBASED has to come after certservice since we want it on w/o explicit on
2108# PWDBASED
2109add_option("WOLFSSL_PWDBASED"
2110    "Enable PWDBASED (default: disabled)"
2111    "no" "yes;no")
2112
2113if(NOT WOLFSSL_PWDBASED)
2114    if(WOLFSSL_OPENSSLEXTRA OR
2115        WOLFSSL_OPENSSLALL OR
2116        WOLFSSL_WEBSERVER OR
2117        WOLFSSL_ENC_KEYS OR
2118        WOLFSSL_PKCS12)
2119        # opensslextra, opensslall, webserver, and enckeys needs pwdbased
2120        override_cache(WOLFSSL_PWDBASED "yes")
2121    else()
2122        list(APPEND WOLFSSL_DEFINITIONS "-DNO_PWDBASED")
2123    endif()
2124endif()
2125
2126# TODO: - SCRYPT
2127#       - wolfCrypt only
2128
2129# fastmath
2130add_option("WOLFSSL_FAST_MATH"
2131    "Enable fast math ops (default: disabled)"
2132    "no" "yes;no")
2133
2134if(WOLFSSL_FAST_MATH)
2135    # turn off fastmath if leanpsk on or asn off (w/o DH and ECC)
2136    if(WOLFSSL_LEAN_PSK OR NOT WOLFSSL_ASN)
2137        if(NOT WOLFSSL_DH AND
2138           NOT WOLFSSL_ECC AND
2139           NOT WOLFSSL_RSA)
2140            override_cache(WOLFSSL_FAST_MATH "no")
2141        else()
2142            list(APPEND WOLFSSL_DEFINITIONS "-DUSE_FAST_MATH")
2143            set(WOLFSSL_SLOWMATH "no")
2144        endif()
2145    else()
2146        list(APPEND WOLFSSL_DEFINITIONS "-DUSE_FAST_MATH")
2147        set(WOLFSSL_SLOWMATH "no")
2148    endif()
2149endif()
2150
2151# TODO: - Fast huge math
2152
2153# Set processor-specific build macros
2154if("${CMAKE_SYSTEM_PROCESSOR}" MATCHES "x86_64|AMD64")
2155    set(WOLFSSL_X86_64_BUILD ON)
2156    add_option("WOLFSSL_X86_64_BUILD_ASM" "Build ASM files" "yes" "yes;no")
2157    list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_X86_64_BUILD")
2158elseif("${CMAKE_SYSTEM_PROCESSOR}" MATCHES "aarch64|arm64")
2159    list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_AARCH64_BUILD")
2160endif()
2161
2162# SP math all
2163add_option("WOLFSSL_SP_MATH_ALL"
2164    "Enable Single Precision math implementation for full algorithm suite (default: enabled)"
2165    "yes" "yes;no")
2166
2167# Enable examples, used to disable examples
2168if(WOLFSSL_LINUX_KM)
2169    set(EXAMPLES_DEFAULT "no")
2170else()
2171    set(EXAMPLES_DEFAULT "yes")
2172endif()
2173
2174add_option("WOLFSSL_EXAMPLES"
2175    "Enable examples (default: enabled)"
2176    ${EXAMPLES_DEFAULT} "yes;no")
2177
2178if(NOT WOLFSSL_FILESYSTEM OR
2179   NOT WOLFSSL_INLINE OR
2180   WOLFSSL_CRYPT_ONLY)
2181    override_cache(WOLFSSL_EXAMPLES "no")
2182endif()
2183
2184# Enable wolfCrypt test and benchmark
2185if(WOLFSSL_LINUX_KM)
2186    set(CRYPT_TESTS_DEFAULT "no")
2187else()
2188    set(CRYPT_TESTS_DEFAULT "yes")
2189endif()
2190
2191add_option("WOLFSSL_CRYPT_TESTS"
2192    "Enable Crypt Bench/Test (default: enabled)"
2193    ${CRYPT_TESTS_DEFAULT} "yes;no")
2194
2195add_option("WOLFSSL_CRYPT_TESTS_LIBS"
2196    "Build static libraries from the wolfCrypt test and benchmark sources (default: disabled)"
2197    "no" "yes;no")
2198
2199add_option("WOLFSSL_CRYPT_TESTS_HELP"
2200    "Add help text to wolfCrypt test (default: disabled)"
2201    "no" "yes;no")
2202
2203# TODO: - LIBZ
2204#       - Cavium
2205#       - Cavium V
2206#       - Cavium Octeon
2207#       - Intel QuickAssist
2208#       - SP ASM (and other SP logic)
2209#       - Fast RSA
2210#       - Static memory use
2211#       - Microchip API
2212#       - Asynchronous crypto
2213
2214# Asynchronous threading
2215add_option("WOLFSSL_ASYNC_THREADS"
2216    "Enable Asynchronous Threading (default: enabled)"
2217    "yes" "yes;no")
2218
2219if(WOLFSSL_ASYNC_CRYPT AND WOLFSSL_ASYNC_THREADS)
2220    if(CMAKE_USE_PTHREADS_INIT)
2221        override_cache(WOLFSSL_ASYNC_THREADS "yes")
2222    else()
2223        override_cache(WOLFSSL_ASYNC_THREADS "no")
2224    endif()
2225else()
2226    override_cache(WOLFSSL_ASYNC_THREADS "no")
2227endif()
2228
2229if(WOLFSSL_ASYNC_THREADS)
2230    list(APPEND WOLFSSL_LINK_LIBS Threads::Threads)
2231    list(APPEND WOLFSSL_DEFINITIONS "-D_GNU_SOURCE")
2232else()
2233    list(APPEND WOLFSSL_DEFINITIONS "-DWC_NO_ASYNC_THREADING")
2234endif()
2235
2236# TODO: - Session export
2237
2238add_option("WOLFSSL_CRYPTOCB"
2239    "Enable crypto callbacks (default: disabled)"
2240    "no" "yes;no")
2241
2242add_option("WOLFSSL_CRYPTOCB_NO_SW_TEST"
2243    "Disable crypto callback SW testing (default: disabled)"
2244    "no" "yes;no")
2245
2246add_option("WOLFSSL_CRYPTOCB_RSA_PAD"
2247    "Enable RSA padding aware crypto callbacks (default: disabled)"
2248    "no" "yes;no")
2249
2250add_option("WOLFSSL_PKCALLBACKS"
2251    "Enable public key callbacks (default: disabled)"
2252    "no" "yes;no")
2253
2254add_option("WOLFSSL_OLD_NAMES"
2255    "Keep backwards compat with old names (default: enabled)"
2256    "yes" "yes;no")
2257
2258if(NOT WOLFSSL_OLD_NAMES AND NOT WOLFSSL_OPENSSL_COEXIST)
2259    list(APPEND WOLFSSL_DEFINITIONS
2260        "-DNO_OLD_RNGNAME"
2261        "-DNO_OLD_WC_NAMES"
2262        "-DNO_OLD_SSL_NAMES"
2263        "-DNO_OLD_SHA_NAMES")
2264endif()
2265
2266# TODO: - Memory tests
2267#       - Hash flags
2268
2269# Support for enabling setting default DH parameters
2270add_option("WOLFSSL_DH_DEFAULT_PARAMS"
2271    "Enables option for default dh parameters (default: disabled)"
2272    "no" "yes;no")
2273
2274if(WOLFSSL_DH_DEFAULT_PARAMS OR NOT WOLFSSL_QT)
2275    override_cache(WOLFSSL_DH_DEFAULT_PARAMS "yes")
2276    list(APPEND WOLFSSL_DEFINITIONS "-DHAVE_DH_DEFAULT_PARAMS")
2277endif()
2278
2279if(NOT WOLFSSL_DES3)
2280    list(APPEND WOLFSSL_DEFINITIONS "-DNO_DES3")
2281else()
2282    # turn off DES3 if leanpsk or leantls on
2283    if(WOLFSSL_LEAN_PSK OR WOLFSSL_LEAN_TLS)
2284        list(APPEND WOLFSSL_DEFINITIONS "-DNO_DES3")
2285        override_cache(WOLFSSL_DES3 "no")
2286    endif()
2287endif()
2288
2289add_option("WOLFSSL_USER_SETTINGS"
2290    "Use your own user_settings.h and do not add Makefile CFLAGS (default: disabled)"
2291    "no" "yes;no")
2292
2293add_option("WOLFSSL_USER_SETTINGS_ASM"
2294    "Enable use of user_settings_asm.h in assembly files (default: disabled)"
2295    "no" "yes;no")
2296
2297add_option("WOLFSSL_OPTFLAGS"
2298    "Enable default optimization CFLAGS for the compiler (default: enabled)"
2299    "yes" "yes;no")
2300
2301add_option("WOLFSSL_SYS_CA_CERTS"
2302    "Enable ability to load CA certs from OS (default: enabled)"
2303    "yes" "yes;no")
2304
2305if(WOLFSSL_SYS_CA_CERTS)
2306    if(APPLE)
2307        # Headers used for MacOS default system CA certs behavior. Only MacOS SDK will have this header
2308        check_include_file("Security/SecTrustSettings.h" HAVE_SECURITY_SECTRUSTSETTINGS_H)
2309        # Headers used for Apple native cert validation. All device SDKs should have these headers
2310        check_include_file("Security/SecCertificate.h" HAVE_SECURITY_SECCERTIFICATE_H)
2311        check_include_file("Security/SecTrust.h" HAVE_SECURITY_SECTRUST_H)
2312        check_include_file("Security/SecPolicy.h" HAVE_SECURITY_SECPOLICY_H)
2313        # Either Security/SecTrustSettings (for MacOS cert loading), or the
2314        # trio of Security/SecCertificate.h, Security/SecTrust.h, and
2315        # Security/SecPolicy.h (for native trust APIs on other apple devices)
2316        # must be present. Default to SecTrustSettings method on MacOS.
2317        if(HAVE_SECURITY_SECTRUSTSETTINGS_H OR (HAVE_SECURITY_SECCERTIFICATE_H
2318                                                AND HAVE_SECURITY_SECTRUST_H
2319                                                AND HAVE_SECURITY_SECPOLICY_H))
2320            find_library(CORE_FOUNDATION_FRAMEWORK CoreFoundation)
2321            if(NOT CORE_FOUNDATION_FRAMEWORK)
2322                message(FATAL_ERROR "Can't enable system CA certs without CoreFoundation framework.")
2323            else()
2324                find_library(SECURITY_FRAMEWORK Security)
2325                if(NOT SECURITY_FRAMEWORK)
2326                    message(FATAL_ERROR "Can't enable system CA certs without Security framework.")
2327                endif()
2328            endif()
2329
2330            # MacOS should not use native cert validation by default, but other apple devices should.
2331            if(NOT HAVE_SECURITY_SECTRUSTSETTINGS_H AND HAVE_SECURITY_SECCERTIFICATE_H
2332                                                    AND HAVE_SECURITY_SECTRUST_H
2333                                                    AND HAVE_SECURITY_SECPOLICY_H)
2334                list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_APPLE_NATIVE_CERT_VALIDATION")
2335            endif()
2336
2337        else()
2338            message(FATAL_ERROR "Can't enable system CA certs without Apple Security.framework headers.")
2339        endif()
2340    elseif(NOT WIN32 AND NOT WOLFSSL_FILESYSTEM)
2341        message("Can't enable system CA certs without a filesystem.")
2342        override_cache(WOLFSSL_SYS_CA_CERTS "no")
2343    endif()
2344
2345
2346    if(WOLFSSL_SYS_CA_CERTS)
2347        list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_SYS_CA_CERTS")
2348    endif()
2349endif()
2350
2351# FLAGS operations
2352
2353if(WOLFSSL_AESCCM)
2354    list(APPEND WOLFSSL_DEFINITIONS "-DHAVE_AESCCM")
2355endif()
2356
2357if(WOLFSSL_AESOFB)
2358    list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_AES_OFB" "-DWOLFSSL_AES_DIRECT")
2359endif()
2360
2361if(WOLFSSL_TPM)
2362    override_cache(WOLFSSL_KEYGEN    "yes")
2363    override_cache(WOLFSSL_CERTGEN   "yes")
2364    override_cache(WOLFSSL_CRYPTOCB  "yes")
2365    override_cache(WOLFSSL_CERTREQ   "yes")
2366    override_cache(WOLFSSL_CERTEXT   "yes")
2367    override_cache(WOLFSSL_PKCS7     "yes")
2368    override_cache(WOLFSSL_AESCFB    "yes")
2369    override_cache(WOLFSSL_PUBLIC_MP "yes")
2370    list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_ALLOW_ENCODING_CA_FALSE")
2371endif()
2372
2373if(WOLFSSL_CLU)
2374    override_cache(WOLFSSL_CERTGEN  "yes")
2375    override_cache(WOLFSSL_CERTREQ  "yes")
2376    override_cache(WOLFSSL_CERTEXT  "yes")
2377    override_cache(WOLFSSL_MD5      "yes")
2378    override_cache(WOLFSSL_AESCTR   "yes")
2379    override_cache(WOLFSSL_KEYGEN   "yes")
2380    override_cache(WOLFSSL_OPENSSLALL "yes")
2381    override_cache(WOLFSSL_ED25519  "yes")
2382    override_cache(WOLFSSL_SHA512   "yes")
2383    override_cache(WOLFSSL_DES3     "yes")
2384    override_cache(WOLFSSL_PKCS7    "yes")
2385    list(APPEND WOLFSSL_DEFINITIONS "-DHAVE_OID_ENCODING" "-DWOLFSSL_NO_ASN_STRICT" "-DWOLFSSL_ALT_NAMES")
2386    # Add OPENSSL_ALL definition to ensure OpenSSL compatibility functions are available
2387    list(APPEND WOLFSSL_DEFINITIONS "-DOPENSSL_ALL")
2388    # Remove NO_DES3 from WOLFSSL_DEFINITIONS to ensure DES3 is enabled
2389    list(REMOVE_ITEM WOLFSSL_DEFINITIONS "-DNO_DES3")
2390endif()
2391
2392if(WOLFSSL_AESCFB)
2393    list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_AES_CFB")
2394endif()
2395
2396
2397if(WOLFSSL_PKCS7)
2398    list(APPEND WOLFSSL_DEFINITIONS "-DHAVE_PKCS7")
2399    override_cache(WOLFSSL_AESKEYWRAP "yes")
2400    # Enable prereqs if not already enabled
2401    if(WOLFSSL_ECC)
2402        override_cache(WOLFSSL_X963KDF "yes")
2403    endif()
2404endif()
2405
2406if(WOLFSSL_X963KDF)
2407    list(APPEND WOLFSSL_DEFINITIONS "-DHAVE_X963_KDF")
2408endif()
2409
2410if(WOLFSSL_AESKEYWRAP)
2411    list(APPEND WOLFSSL_DEFINITIONS
2412        "-DHAVE_AES_KEYWRAP"
2413        "-DWOLFSSL_AES_DIRECT"
2414        )
2415endif()
2416
2417if(WOLFSSL_NULL_CIPHER)
2418    list(APPEND WOLFSSL_DEFINITIONS "-DHAVE_NULL_CIPHER")
2419endif()
2420
2421# Hybrid Public Key Encryption (RFC9180)
2422add_option("WOLFSSL_HPKE"
2423        "Enable wolfSSL hybrid public key encryption (default: disabled)"
2424        "no" "yes;no")
2425
2426# Encrypted Client Hello (ECH)
2427add_option("WOLFSSL_ECH"
2428        "Enable wolfSSL encrypted client hello (default: disabled)"
2429        "no" "yes;no")
2430
2431# Keying Material Exporter / TLS Exporter
2432add_option("WOLFSSL_KEYING_MATERIAL"
2433        "Enable wolfSSL keying material export (default: disabled)"
2434        "no" "yes;no")
2435
2436if(WOLFSSL_HPKE)
2437    if(NOT WOLFSSL_ECC)
2438        message(FATAL_ERROR "HPKE supported only with ECC (WOLFSSL_ECC)")
2439    endif()
2440    list(APPEND WOLFSSL_DEFINITIONS "-DHAVE_HPKE")
2441    override_cache(WOLFSSL_HKDF "yes")
2442endif()
2443
2444if(WOLFSSL_ECH)
2445    if(NOT WOLFSSL_HPKE)
2446        message(FATAL_ERROR "ECH supported only with HPKE (WOLFSSL_HPKE)")
2447    endif()
2448    if(NOT WOLFSSL_SNI)
2449        message(FATAL_ERROR "ECH supported only with SNI (WOLFSSL_SNI)")
2450    endif()
2451    list(APPEND WOLFSSL_DEFINITIONS "-DHAVE_ECH")
2452endif()
2453
2454if(WOLFSSL_KEYING_MATERIAL)
2455    list(APPEND WOLFSSL_DEFINITIONS "-DHAVE_KEYING_MATERIAL")
2456endif()
2457
2458if(WOLFSSL_KEYGEN)
2459    list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_KEY_GEN")
2460endif()
2461if(WOLFSSL_CERTGEN)
2462    list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_CERT_GEN")
2463endif()
2464if(WOLFSSL_CERTREQ)
2465    list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_CERT_REQ")
2466endif()
2467if(WOLFSSL_CERTEXT)
2468    list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_CERT_EXT")
2469endif()
2470if(WOLFSSL_CERTGENCACHE)
2471    list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_CERT_GEN_CACHE")
2472endif()
2473
2474if(WOLFSSL_CRYPTOCB)
2475    list(APPEND WOLFSSL_DEFINITIONS "-DWOLF_CRYPTO_CB")
2476endif()
2477
2478if(WOLFSSL_CRYPTOCB_NO_SW_TEST)
2479    list(APPEND WOLFSSL_DEFINITIONS "-DWC_TEST_NO_CRYPTOCB_SW_TEST")
2480endif()
2481
2482if(WOLFSSL_CRYPTOCB_RSA_PAD)
2483    if(NOT WOLFSSL_CRYPTOCB)
2484        message(FATAL_ERROR "WOLFSSL_CRYPTOCB_RSA_PAD requires WOLFSSL_CRYPTOCB")
2485    endif()
2486    list(APPEND WOLFSSL_DEFINITIONS "-DWOLF_CRYPTO_CB_RSA_PAD")
2487endif()
2488
2489# Public Key Callbacks
2490if(WOLFSSL_PKCALLBACKS)
2491    list(APPEND WOLFSSL_DEFINITIONS "-DHAVE_PK_CALLBACKS")
2492endif()
2493
2494if(WOLFSSL_OCSPSTAPLING)
2495    list(APPEND WOLFSSL_DEFINITIONS "-DHAVE_CERTIFICATE_STATUS_REQUEST" "-DHAVE_TLS_EXTENSIONS")
2496    override_cache(WOLFSSL_OCSP "yes")
2497endif()
2498
2499if(WOLFSSL_OCSPSTAPLING_V2)
2500    list(APPEND WOLFSSL_DEFINITIONS "-DHAVE_CERTIFICATE_STATUS_REQUEST_V2" "-DHAVE_TLS_EXTENSIONS")
2501    override_cache(WOLFSSL_OCSP "yes")
2502endif()
2503
2504# must be below OCSP stapling options to allow override
2505if (WOLFSSL_OCSP)
2506   list(APPEND WOLFSSL_DEFINITIONS "-DHAVE_OCSP")
2507endif()
2508
2509if (WOLFSSL_CRL STREQUAL "yes")
2510    list(APPEND WOLFSSL_DEFINITIONS "-DHAVE_CRL")
2511elseif(WOLFSSL_CRL STREQUAL "io")
2512    list(APPEND WOLFSSL_DEFINITIONS "-DHAVE_CRL" "-DHAVE_CRL_IO")
2513endif()
2514
2515if (WOLFSSL_SNI)
2516   list(APPEND WOLFSSL_DEFINITIONS "-DHAVE_TLS_EXTENSIONS" "-DHAVE_SNI")
2517endif()
2518
2519if (WOLFSSL_TLSX)
2520  list(APPEND WOLFSSL_DEFINITIONS
2521    "-DHAVE_TLS_EXTENSIONS"
2522    "-DHAVE_SNI"
2523    "-DHAVE_MAX_FRAGMENT"
2524    "-DHAVE_TRUNCATED_HMAC"
2525    "-DHAVE_ALPN"
2526    "-DHAVE_TRUSTED_CA")
2527    if (WOLFSSL_ECC OR WOLFSSL_CURVE25519 OR WOLFSSL_CURVE448 OR WOLFSSL_TLS13)
2528       list(APPEND WOLFSSL_DEFINITIONS  "-DHAVE_SUPPORTED_CURVES")
2529    endif()
2530endif()
2531
2532
2533add_option("WOLFSSL_CAAM"
2534    "Enable use of CAAM with NXP (default: disabled)"
2535    "no" "yes;no")
2536if (WOLFSSL_CAAM)
2537   list(APPEND WOLFSSL_DEFINITIONS  "-DWOLFSSL_CAAM")
2538endif()
2539
2540if (WOLFSSL_ARIA)
2541   list(APPEND WOLFSSL_DEFINITIONS  "-DHAVE_ARIA")
2542endif()
2543
2544# Generates the BUILD_* flags. These control what source files are included in
2545# the library. A series of AM_CONDITIONALs handle this in configure.ac.
2546generate_build_flags()
2547
2548# TODO: - Bit of logic after optimization flags option (above)
2549#       - Check for build-type conflicts section
2550
2551# USER SETTINGS
2552if(WOLFSSL_USER_SETTINGS)
2553    # Replace all options and just use WOLFSSL_USER_SETTINGS
2554    set(WOLFSSL_DEFINITIONS "-DWOLFSSL_USER_SETTINGS")
2555endif()
2556
2557if(WOLFSSL_USER_SETTINGS_ASM)
2558    if(WOLFSSL_USER_SETTINGS)
2559        list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_USER_SETTINGS_ASM")
2560        # Create user_settings_asm.h for use in assembly files (e.g. .S files).
2561        if(WIN32)
2562            execute_process(COMMAND
2563            $ENV{SHELL} ${CMAKE_CURRENT_SOURCE_DIR}/scripts/user_settings_asm.sh
2564            "${CMAKE_C_FLAGS} ${CMAKE_CXX_FLAGS}"
2565            RESULT_VARIABLE USER_SETTINGS_ASM_RET)
2566        else()
2567            execute_process(COMMAND
2568            ${CMAKE_CURRENT_SOURCE_DIR}/scripts/user_settings_asm.sh
2569            "${CMAKE_C_FLAGS} ${CMAKE_CXX_FLAGS}"
2570            RESULT_VARIABLE USER_SETTINGS_ASM_RET)
2571        endif()
2572        if (NOT USER_SETTINGS_ASM_RET EQUAL 0)
2573            message(FATAL_ERROR
2574            "${CMAKE_CURRENT_SOURCE_DIR}/scripts/user_settings_asm.sh failed.")
2575        endif()
2576    else()
2577        message(FATAL_ERROR
2578        "Must have WOLFSSL_USER_SETTINGS to enable WOLFSSL_USER_SETTINGS_ASM.")
2579    endif()
2580endif()
2581
2582add_option("WOLFSSL_CONFIG_H"
2583    "Enable generation of config.h and define HAVE_CONFIG_H (default: enabled)"
2584    "yes" "yes;no")
2585
2586if(WOLFSSL_CONFIG_H)
2587    add_definitions("-DHAVE_CONFIG_H")
2588    configure_file("${CMAKE_CURRENT_SOURCE_DIR}/cmake/config.in"
2589                   "${CMAKE_CURRENT_BINARY_DIR}/config.h" )
2590    set(abs_top_srcdir ${CMAKE_CURRENT_SOURCE_DIR})
2591    set(abs_top_builddir ${CMAKE_CURRENT_BINARY_DIR})
2592    configure_file("${CMAKE_CURRENT_SOURCE_DIR}/wolfcrypt/test/test_paths.h.in"
2593                   "${CMAKE_CURRENT_BINARY_DIR}/wolfcrypt/test/test_paths.h" )
2594endif()
2595
2596# If config.h or wolfssl/options.h exists, delete it to avoid
2597# a mixup with build/wolfssl/options.h.
2598if (EXISTS "${CMAKE_CURRENT_SOURCE_DIR}/wolfssl/options.h")
2599    file(REMOVE "${CMAKE_CURRENT_SOURCE_DIR}/wolfssl/options.h")
2600endif()
2601
2602if (EXISTS "${CMAKE_CURRENT_SOURCE_DIR}/config.h")
2603    file(REMOVE "${CMAKE_CURRENT_SOURCE_DIR}/config.h")
2604endif()
2605
2606# Suppress some warnings about separate compilation, inlining
2607add_definitions("-DWOLFSSL_IGNORE_FILE_WARN")
2608# Generate user options header
2609message(STATUS "Generating user options header...")
2610if (${CMAKE_DISABLE_SOURCE_CHANGES})
2611    set(WOLFSSL_BUILD_OUT_OF_TREE_DEFAULT "${CMAKE_DISABLE_SOURCE_CHANGES}")
2612else()
2613    set(WOLFSSL_BUILD_OUT_OF_TREE_DEFAULT "yes")
2614endif()
2615add_option("WOLFSSL_BUILD_OUT_OF_TREE"
2616    "Don't generate files in the source tree (default: ${WOLFSSL_BUILD_OUT_OF_TREE_DEFAULT})"
2617    "${WOLFSSL_BUILD_OUT_OF_TREE_DEFAULT}" "yes;no")
2618if (${WOLFSSL_BUILD_OUT_OF_TREE})
2619   set(WOLFSSL_OUTPUT_BASE ${CMAKE_CURRENT_BINARY_DIR})
2620else()
2621   set(WOLFSSL_OUTPUT_BASE ${CMAKE_CURRENT_SOURCE_DIR})
2622endif()
2623set(OPTION_FILE "${WOLFSSL_OUTPUT_BASE}/wolfssl/options.h")
2624
2625# sccache
2626add_option("ENABLE_SCCACHE"
2627        "Enable sccache (default: disabled)"
2628        "no" "yes;no")
2629
2630if (ENABLE_SCCACHE AND (NOT WOLFSSL_SCCACHE_ALREADY_SET_FLAG))
2631    find_program(SCCACHE sccache REQUIRED)
2632    if(SCCACHE)
2633        message(STATUS "Enable sccache")
2634
2635        if(CMAKE_C_COMPILER_LAUNCHER)
2636            set(CMAKE_C_COMPILER_LAUNCHER "${CMAKE_C_COMPILER_LAUNCHER}" "${SCCACHE}")
2637        else()
2638            set(CMAKE_C_COMPILER_LAUNCHER "${SCCACHE}")
2639        endif()
2640        if(CMAKE_CXX_COMPILER_LAUNCHER)
2641            set(CMAKE_CXX_COMPILER_LAUNCHER "${CMAKE_CXX_COMPILER_LAUNCHER}" "${SCCACHE}")
2642        else()
2643            set(CMAKE_CXX_COMPILER_LAUNCHER "${SCCACHE}")
2644        endif()
2645
2646        if (MSVC)
2647            if(CMAKE_BUILD_TYPE STREQUAL "Debug")
2648                string(REPLACE "/Zi" "/Z7" CMAKE_CXX_FLAGS_DEBUG "${CMAKE_CXX_FLAGS_DEBUG}")
2649                string(REPLACE "/Zi" "/Z7" CMAKE_C_FLAGS_DEBUG "${CMAKE_C_FLAGS_DEBUG}")
2650            elseif(CMAKE_BUILD_TYPE STREQUAL "Release")
2651                string(REPLACE "/Zi" "/Z7" CMAKE_CXX_FLAGS_RELEASE "${CMAKE_CXX_FLAGS_RELEASE}")
2652                string(REPLACE "/Zi" "/Z7" CMAKE_C_FLAGS_RELEASE "${CMAKE_C_FLAGS_RELEASE}")
2653            elseif(CMAKE_BUILD_TYPE STREQUAL "RelWithDebInfo")
2654                string(REPLACE "/Zi" "/Z7" CMAKE_CXX_FLAGS_RELWITHDEBINFO "${CMAKE_CXX_FLAGS_RELWITHDEBINFO}")
2655                string(REPLACE "/Zi" "/Z7" CMAKE_C_FLAGS_RELWITHDEBINFO "${CMAKE_C_FLAGS_RELWITHDEBINFO}")
2656            endif()
2657        endif()
2658        set(WOLFSSL_SCCACHE_ALREADY_SET_FLAG ON)
2659    endif()
2660endif()
2661
2662add_option("WOLFSSL_KEYLOG_EXPORT"
2663    "Enable insecure export of TLS secrets to an NSS keylog file (default: disabled)"
2664    "no" "yes;no")
2665if(WOLFSSL_KEYLOG_EXPORT)
2666    message(WARNING "Keylog export enabled -- Sensitive key data will be stored insecurely.")
2667    list(APPEND WOLFSSL_DEFINITIONS
2668        "-DSHOW_SECRETS"
2669        "-DHAVE_SECRET_CALLBACK"
2670        "-DWOLFSSL_SSLKEYLOGFILE"
2671        "-DWOLFSSL_KEYLOG_EXPORT_WARNED")
2672endif()
2673
2674
2675file(REMOVE ${OPTION_FILE})
2676
2677####################################################
2678# Library Target
2679####################################################
2680
2681# TODO: - Build shared/static libs based on enables. Check CMake
2682#         global flag BUILD_SHARED_LIBS.
2683option(BUILD_SHARED_LIBS "Build shared libraries (.dll/.so) instead of static ones (.lib/.a)" ON)
2684
2685set(LIB_SOURCES "")
2686# Generates a list of sources to include in the library.
2687# Corresponds to the instances of "src_libwolfssl_la_SOURCES += ..."
2688# in the *.am files.
2689generate_lib_src_list("${LIB_SOURCES}")
2690if(BUILD_SHARED_LIBS)
2691    message(STATUS "BUILD_SHARED_LIBS enabled: ${LIB_SOURCES}")
2692    add_library(wolfssl SHARED ${LIB_SOURCES})
2693else()
2694    message(STATUS "Static Libs: ${LIB_SOURCES}")
2695    add_library(wolfssl STATIC ${LIB_SOURCES})
2696endif()
2697
2698add_library(wolfssl::wolfssl ALIAS wolfssl)
2699
2700if (NOT "$ENV{ARIA_DIR}" STREQUAL "")
2701    message(STATUS "Found Environment variable ARIA_DIR=$ENV{ARIA_DIR}")
2702    if(WOLFSSL_ARIA)
2703        message(STATUS "wolfSSL WOLFSSL_ARIA is enabled")
2704    else()
2705        message(STATUS "wolfSSL WOLFSSL_ARIA is not enabled. To enable, specify a user_settings.h file or run: cmake .. -DWOLFSSL_ARIA=yes")
2706        message(STATUS "Clear the ARIA_DIR environment variable to otherwise suppress this message when not using ARIA ciphers.")
2707    endif()
2708endif()
2709
2710# ARIA Check
2711if(WOLFSSL_ARIA)
2712    message(STATUS "WOLFSSL_ARIA is enabled")
2713
2714    find_package(ARIA)
2715
2716    if(ARIA_FOUND)
2717        message(STATUS "ARIA find_package() success.")
2718    else()
2719        message(FATAL_ERROR "WOLFSSL_ARIA is enabled, but find_package() did not find ARIA MagicCrypto.\n"
2720                            "Check ARIA_DIR environment variable and/or copy MagicCrypto directory locally.")
2721    endif()
2722
2723    list(APPEND WOLFSSL_LINK_LIBS "${ARIA_LIB_FILE}")
2724
2725    # The cmake target_include_directories() will complain about local directories,
2726    # so we'll handle MagicCrypto differently when found in wolfssl.
2727    # see below to use include_directories() instead.
2728    if(ARIA_IS_LOCAL)
2729        # there's also a wolfssl port API to include, plus local ARIA include
2730        include_directories("wolfssl/wolfcrypt/port/aria" "MagicCrypto/include")
2731    else()
2732        # see below for target_include_directories() instead
2733        include_directories("wolfssl/wolfcrypt/port/aria")
2734        message(STATUS "ARIA_IS_LOCAL is false, appending ${ARIA_INCLUDE_DIR} to WOLFSSL_INCLUDE_DIRS")
2735        list(APPEND WOLFSSL_INCLUDE_DIRS "${ARIA_INCLUDE_DIR}")
2736    endif()
2737
2738    add_library(MagicCrypto_lib
2739        ${CMAKE_CURRENT_SOURCE_DIR}/wolfcrypt/src/port/aria/aria-crypt.c
2740        ${CMAKE_CURRENT_SOURCE_DIR}/wolfcrypt/src/port/aria/aria-cryptocb.c
2741    )
2742
2743    set_target_properties(MagicCrypto_lib PROPERTIES OUTPUT_NAME "MagicCrypto")
2744    target_link_libraries(MagicCrypto_lib wolfssl)
2745    target_compile_options(MagicCrypto_lib PRIVATE "-DHAVE_ARIA")
2746
2747    # ARIA was enabled and we successfully found it.
2748    set(HAVE_ARIA 1)
2749    list(APPEND WOLFSSL_DEFINITIONS "-DHAVE_ARIA")
2750
2751    message(STATUS "ARIA Check: WOLFSSL_LINK_LIBS    = ${WOLFSSL_LINK_LIBS}")
2752endif()
2753
2754foreach(DEF IN LISTS WOLFSSL_DEFINITIONS)
2755    string(REGEX MATCH "^(-D)?([^=]+)(=(.*))?$" DEF_MATCH ${DEF})
2756    if (NOT "${CMAKE_MATCH_4}" STREQUAL "")
2757        set(${CMAKE_MATCH_2} ${CMAKE_MATCH_4})
2758        # message("set(${CMAKE_MATCH_2} ${CMAKE_MATCH_4})")
2759    else()
2760        set(${CMAKE_MATCH_2} 1)
2761        # message("set(${CMAKE_MATCH_2} 1)")
2762    endif()
2763endforeach()
2764
2765# If new build options are added please update the cmake/options.h.in
2766configure_file(${CMAKE_CURRENT_SOURCE_DIR}/cmake/options.h.in ${OPTION_FILE})
2767
2768set_target_properties(wolfssl
2769    PROPERTIES
2770        SOVERSION ${WOLFSSL_LIBRARY_VERSION_FIRST}
2771        VERSION ${LIBTOOL_FULL_VERSION}
2772)
2773
2774target_compile_definitions(wolfssl PRIVATE "BUILDING_WOLFSSL")
2775if(${BUILD_SHARED_LIBS})
2776    target_compile_definitions(wolfssl PUBLIC "WOLFSSL_DLL")
2777endif()
2778target_compile_definitions(wolfssl PRIVATE ${WOLFSSL_DEFINITIONS})
2779
2780####################################################
2781# Include Directories
2782####################################################
2783
2784if("${WOLFSSL_INCLUDE_DIRS}" STREQUAL "")
2785    message(STATUS "WOLFSSL_INCLUDE_DIRS is blank. No additional directories will be added.")
2786else()
2787    message(STATUS "WOLFSSL_INCLUDE_DIRS = ${WOLFSSL_INCLUDE_DIRS}")
2788endif()
2789
2790target_include_directories(wolfssl
2791    PUBLIC
2792        $<INSTALL_INTERFACE:include>
2793        $<BUILD_INTERFACE:${CMAKE_CURRENT_SOURCE_DIR}>
2794        $<BUILD_INTERFACE:${CMAKE_CURRENT_BINARY_DIR}>
2795        ${WOLFSSL_INCLUDE_DIRS}
2796)
2797
2798####################################################
2799# Link Libraries
2800####################################################
2801
2802target_link_libraries(wolfssl PUBLIC ${WOLFSSL_LINK_LIBS})
2803
2804if(CMAKE_C_COMPILER_ID STREQUAL "OpenWatcom")
2805    if(CMAKE_SYSTEM_NAME STREQUAL "Windows")
2806        target_link_libraries(wolfssl PUBLIC ws2_32 crypt32)
2807    endif()
2808elseif (WIN32 OR ${CMAKE_SYSTEM_NAME} MATCHES "^MSYS" OR ${CMAKE_SYSTEM_NAME} MATCHES "^MINGW")
2809    # For Windows link required libraries
2810    message("Building on Windows/MSYS/MINGW")
2811    target_link_libraries(wolfssl PUBLIC
2812        ws2_32 crypt32 advapi32)
2813elseif(APPLE)
2814    message("Building on Apple")
2815    if(WOLFSSL_SYS_CA_CERTS)
2816        target_link_libraries(wolfssl PUBLIC
2817            ${CORE_FOUNDATION_FRAMEWORK}
2818            ${SECURITY_FRAMEWORK})
2819    endif()
2820else()
2821    message("Building on Linux (or other)")
2822    if(WOLFSSL_DH AND NOT WOLFSSL_DH_CONST)
2823        # DH requires math (m) library
2824        target_link_libraries(wolfssl
2825            PUBLIC
2826                m)
2827    endif()
2828endif()
2829
2830####################################################
2831# Tests and Examples
2832####################################################
2833
2834enable_testing()
2835if(WOLFSSL_EXAMPLES)
2836
2837    # Build wolfSSL client example
2838    add_executable(client
2839        ${CMAKE_CURRENT_SOURCE_DIR}/examples/client/client.c)
2840    target_link_libraries(client wolfssl)
2841    target_compile_definitions(client PRIVATE ${WOLFSSL_DEFINITIONS})
2842    set_property(TARGET client
2843                 PROPERTY RUNTIME_OUTPUT_DIRECTORY
2844                 ${WOLFSSL_OUTPUT_BASE}/examples/client)
2845
2846    # Build wolfSSL server example
2847    add_executable(server
2848        ${CMAKE_CURRENT_SOURCE_DIR}/examples/server/server.c)
2849    target_link_libraries(server wolfssl)
2850    target_compile_definitions(server PRIVATE ${WOLFSSL_DEFINITIONS})
2851    set_property(TARGET server
2852                 PROPERTY RUNTIME_OUTPUT_DIRECTORY
2853                 ${WOLFSSL_OUTPUT_BASE}/examples/server)
2854
2855    # Build echo client example
2856    add_executable(echoclient
2857        ${CMAKE_CURRENT_SOURCE_DIR}/examples/echoclient/echoclient.c)
2858    target_include_directories(echoclient PRIVATE
2859        ${CMAKE_CURRENT_BINARY_DIR})
2860    target_link_libraries(echoclient wolfssl)
2861    target_compile_definitions(echoclient PRIVATE ${WOLFSSL_DEFINITIONS})
2862    set_property(TARGET echoclient
2863                 PROPERTY RUNTIME_OUTPUT_DIRECTORY
2864                 ${WOLFSSL_OUTPUT_BASE}/examples/echoclient)
2865
2866    # Build echo server example
2867    add_executable(echoserver
2868        ${CMAKE_CURRENT_SOURCE_DIR}/examples/echoserver/echoserver.c)
2869    target_include_directories(echoserver PRIVATE
2870        ${CMAKE_CURRENT_BINARY_DIR})
2871    target_link_libraries(echoserver wolfssl)
2872    target_compile_definitions(echoserver PRIVATE ${WOLFSSL_DEFINITIONS})
2873    set_property(TARGET echoserver
2874                 PROPERTY RUNTIME_OUTPUT_DIRECTORY
2875                 ${WOLFSSL_OUTPUT_BASE}/examples/echoserver)
2876
2877    if(NOT WIN32 AND NOT WOLFSSL_SINGLE_THREADED)
2878        # Build TLS benchmark example
2879        add_executable(tls_bench
2880            ${CMAKE_CURRENT_SOURCE_DIR}/examples/benchmark/tls_bench.c)
2881        target_link_libraries(tls_bench wolfssl)
2882        target_compile_definitions(tls_bench PRIVATE ${WOLFSSL_DEFINITIONS})
2883        if(CMAKE_USE_PTHREADS_INIT)
2884            target_link_libraries(tls_bench Threads::Threads)
2885        endif()
2886        set_property(TARGET tls_bench
2887                 PROPERTY RUNTIME_OUTPUT_DIRECTORY
2888                 ${WOLFSSL_OUTPUT_BASE}/examples/benchmark)
2889    endif()
2890
2891    # Build unit tests
2892    add_executable(unit_test
2893        tests/api.c
2894        tests/api/test_md2.c
2895        tests/api/test_md4.c
2896        tests/api/test_md5.c
2897        tests/api/test_sha.c
2898        tests/api/test_sha256.c
2899        tests/api/test_sha512.c
2900        tests/api/test_sha3.c
2901        tests/api/test_blake2.c
2902        tests/api/test_sm3.c
2903        tests/api/test_ripemd.c
2904        tests/api/test_hash.c
2905        tests/api/test_hmac.c
2906        tests/api/test_cmac.c
2907        tests/api/test_she.c
2908        tests/api/test_des3.c
2909        tests/api/test_chacha.c
2910        tests/api/test_poly1305.c
2911        tests/api/test_chacha20_poly1305.c
2912        tests/api/test_camellia.c
2913        tests/api/test_arc4.c
2914        tests/api/test_rc2.c
2915        tests/api/test_aes.c
2916        tests/api/test_ascon.c
2917        tests/api/test_sm4.c
2918        tests/api/test_wc_encrypt.c
2919        tests/api/test_random.c
2920        tests/api/test_wolfmath.c
2921        tests/api/test_rsa.c
2922        tests/api/test_dsa.c
2923        tests/api/test_dh.c
2924        tests/api/test_ecc.c
2925        tests/api/test_sm2.c
2926        tests/api/test_curve25519.c
2927        tests/api/test_ed25519.c
2928        tests/api/test_curve448.c
2929        tests/api/test_ed448.c
2930        tests/api/test_mlkem.c
2931        tests/api/test_mldsa.c
2932        tests/api/test_slhdsa.c
2933        tests/api/test_signature.c
2934        tests/api/test_dtls.c
2935        tests/api/test_ocsp.c
2936        tests/api/test_evp.c
2937        tests/api/test_tls_ext.c
2938        tests/api/test_tls.c
2939        tests/api/test_x509.c
2940        tests/api/test_asn.c
2941        tests/api/test_pkcs7.c
2942        tests/api/test_pkcs12.c
2943        tests/api/test_ossl_asn1.c
2944        tests/api/test_ossl_bio.c
2945        tests/api/test_ossl_bn.c
2946        tests/api/test_ossl_cipher.c
2947        tests/api/test_ossl_dh.c
2948        tests/api/test_ossl_dgst.c
2949        tests/api/test_ossl_dsa.c
2950        tests/api/test_ossl_ec.c
2951        tests/api/test_ossl_ecx.c
2952        tests/api/test_ossl_mac.c
2953        tests/api/test_ossl_rsa.c
2954        tests/api/test_ossl_sk.c
2955        tests/api/test_ossl_x509.c
2956        tests/api/test_ossl_x509_ext.c
2957        tests/api/test_ossl_x509_name.c
2958        tests/api/test_ossl_x509_pk.c
2959        tests/api/test_ossl_x509_vp.c
2960        tests/api/test_ossl_x509_io.c
2961        tests/api/test_ossl_x509_crypto.c
2962        tests/api/test_ossl_x509_acert.c
2963        tests/api/test_ossl_x509_info.c
2964        tests/api/test_ossl_x509_str.c
2965        tests/api/test_ossl_x509_lu.c
2966        tests/api/test_ossl_pem.c
2967        tests/api/test_ossl_rand.c
2968        tests/api/test_ossl_obj.c
2969        tests/api/test_ossl_p7p12.c
2970        tests/api/test_evp_digest.c
2971        tests/api/test_evp_cipher.c
2972        tests/api/test_evp_pkey.c
2973        tests/api/test_certman.c
2974        tests/api/test_tls13.c
2975        tests/srp.c
2976        tests/suites.c
2977        tests/w64wrapper.c
2978        tests/unit.c
2979        tests/quic.c
2980        tests/utils.c
2981        testsuite/utils.c
2982        examples/server/server.c
2983        examples/client/client.c
2984        wolfcrypt/test/test.c)
2985    target_include_directories(unit_test PRIVATE
2986        ${CMAKE_CURRENT_BINARY_DIR})
2987    target_compile_options(unit_test PUBLIC "-DNO_MAIN_DRIVER")
2988    target_link_libraries(unit_test wolfssl)
2989    target_compile_definitions(unit_test PRIVATE ${WOLFSSL_DEFINITIONS})
2990    if(CMAKE_USE_PTHREADS_INIT)
2991        target_link_libraries(unit_test Threads::Threads)
2992    endif()
2993    set_property(TARGET unit_test
2994                 PROPERTY RUNTIME_OUTPUT_DIRECTORY
2995                 ${WOLFSSL_OUTPUT_BASE}/tests/)
2996    set_property(TARGET unit_test
2997                 PROPERTY RUNTIME_OUTPUT_NAME
2998                 unit.test)
2999    add_test(NAME unit_test
3000             COMMAND $<TARGET_FILE:unit_test>
3001             WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR})
3002endif()
3003
3004if(WOLFSSL_CRYPT_TESTS)
3005    if(WOLFSSL_CRYPT_TESTS_LIBS)
3006        # Build wolfCrypt test as a library. This will compile test.c and make
3007        # its functions available as a CMake target that other CMake targets can
3008        # pull in, in addition to producing the library itself. Note that this
3009        # feature is not enabled by default, and the API of this library and
3010        # wofcryptbench_lib should NOT be treated as stable.
3011        add_library(wolfcrypttest_lib
3012            ${CMAKE_CURRENT_SOURCE_DIR}/wolfcrypt/test/test.c)
3013        set_target_properties(wolfcrypttest_lib PROPERTIES OUTPUT_NAME "wolfcrypttest")
3014        target_link_libraries(wolfcrypttest_lib wolfssl)
3015        target_compile_definitions(wolfcrypttest_lib PRIVATE ${WOLFSSL_DEFINITIONS})
3016        target_compile_options(wolfcrypttest_lib PRIVATE "-DNO_MAIN_DRIVER")
3017        if(WOLFSSL_CRYPT_TESTS_HELP)
3018            target_compile_options(wolfcrypttest_lib PRIVATE "-DHAVE_WOLFCRYPT_TEST_OPTIONS")
3019        endif()
3020
3021        # Make another library for the wolfCrypt benchmark code.
3022        add_library(wolfcryptbench_lib
3023            ${CMAKE_CURRENT_SOURCE_DIR}/wolfcrypt/benchmark/benchmark.c)
3024        set_target_properties(wolfcryptbench_lib PROPERTIES OUTPUT_NAME "wolfcryptbench")
3025        target_link_libraries(wolfcryptbench_lib wolfssl)
3026        target_compile_definitions(wolfcryptbench_lib PRIVATE ${WOLFSSL_DEFINITIONS})
3027        target_compile_options(wolfcryptbench_lib PRIVATE "-DNO_MAIN_DRIVER")
3028    endif()
3029
3030    # Build wolfCrypt test executable.
3031    add_executable(wolfcrypttest
3032        ${CMAKE_CURRENT_SOURCE_DIR}/wolfcrypt/test/test.c)
3033    target_link_libraries(wolfcrypttest wolfssl)
3034    target_compile_definitions(wolfcrypttest PRIVATE ${WOLFSSL_DEFINITIONS})
3035    set_property(TARGET wolfcrypttest
3036                 PROPERTY RUNTIME_OUTPUT_DIRECTORY
3037                 ${WOLFSSL_OUTPUT_BASE}/wolfcrypt/test)
3038    set_property(TARGET wolfcrypttest
3039                 PROPERTY RUNTIME_OUTPUT_NAME
3040                 testwolfcrypt)
3041    if(WOLFSSL_CRYPT_TESTS_HELP)
3042        target_compile_options(wolfcrypttest PRIVATE "-DHAVE_WOLFCRYPT_TEST_OPTIONS")
3043    endif()
3044    add_test(NAME wolfcrypttest
3045             COMMAND $<TARGET_FILE:wolfcrypttest>
3046             WORKING_DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR})
3047
3048    # Build wolfCrypt benchmark executable.
3049    add_executable(wolfcryptbench
3050        ${CMAKE_CURRENT_SOURCE_DIR}/wolfcrypt/benchmark/benchmark.c)
3051    target_include_directories(wolfcryptbench PRIVATE
3052        ${CMAKE_CURRENT_BINARY_DIR})
3053    target_link_libraries(wolfcryptbench wolfssl)
3054    target_compile_definitions(wolfcryptbench PRIVATE ${WOLFSSL_DEFINITIONS})
3055    set_property(TARGET wolfcryptbench
3056                 PROPERTY RUNTIME_OUTPUT_DIRECTORY
3057                 ${WOLFSSL_OUTPUT_BASE}/wolfcrypt/benchmark)
3058    set_property(TARGET wolfcryptbench
3059                 PROPERTY RUNTIME_OUTPUT_NAME
3060                 benchmark)
3061endif()
3062
3063####################################################
3064# Installation
3065####################################################
3066
3067include(GNUInstallDirs)
3068
3069set(HEADER_EXCLUDE
3070  "internal.h"
3071  "wolfssl/wolfcrypt/port/nrf51.h"
3072  "wolfssl/wolfcrypt/port/arm"
3073  "wolfssl/wolfcrypt/port/cypress"
3074  "wolfssl/wolfcrypt/port/Espressif"
3075  "wolfssl/wolfcrypt/port/iotsafe"
3076  "wolfssl/wolfcrypt/port/nxp"
3077  "wolfssl/wolfcrypt/port/pic"
3078  "wolfssl/wolfcrypt/port/Renesas"
3079  "wolfssl/wolfcrypt/port/silabs"
3080  "wolfssl/wolfcrypt/port/st"
3081  "wolfssl/wolfcrypt/port/ti"
3082  "wolfssl/wolfcrypt/port/xilinx"
3083  )
3084
3085# TODO: add support for the various ports
3086
3087# For distro build don't install options.h.
3088# It depends on the architecture and conflicts with Multi-Arch.
3089if(BUILD_DISTRO)
3090  list(APPEND HEADER_EXCLUDE
3091    "options.h")
3092endif()
3093
3094if(NOT BUILD_CRYPTOAUTHLIB)
3095  list(APPEND HEADER_EXCLUDE
3096    "wolfssl/wolfcrypt/port/atmel")
3097endif()
3098
3099if(NOT BUILD_AFALG)
3100  list(APPEND HEADER_EXCLUDE
3101    "wolfssl/wolfcrypt/port/af_alg")
3102endif()
3103
3104if(NOT BUILD_KCAPI)
3105  list(APPEND HEADER_EXCLUDE
3106    "wolfssl/wolfcrypt/port/kcapi"
3107    )
3108endif()
3109
3110if(NOT BUILD_DEVCRYPTO)
3111  list(APPEND HEADER_EXCLUDE
3112    "wolfssl/wolfcrypt/port/devcrypto")
3113endif()
3114
3115if(NOT BUILD_ASYNCCRYPT)
3116  list(APPEND HEADER_EXCLUDE
3117    "wolfssl/wolfcrypt/async.h")
3118endif()
3119
3120if(NOT BUILD_PKCS11)
3121    list(APPEND HEADER_EXCLUDE
3122      "wolfssl/wolfcrypt/wc_pkcs11.h"
3123      "wolfssl/wolfcrypt/pkcs11.h"
3124      )
3125endif()
3126
3127if(NOT BUILD_CAVIUM AND NOT BUILD_OCTEON_SYNC)
3128  list(APPEND HEADER_EXCLUDE
3129    "wolfssl/wolfcrypt/port/cavium")
3130else()
3131  if(NOT BUILD_CAVIUM)
3132    list(APPEND HEADER_EXCLUDE
3133      "wolfssl/wolfcrypt/port/cavium/cavium_nitrox.h")
3134  endif()
3135
3136  if(NOT BUILD_OCTEON_SYNC)
3137    list(APPEND HEADER_EXCLUDE
3138      "wolfssl/wolfcrypt/port/cavium/cavium_octeon_sync.h"
3139      )
3140  endif()
3141endif()
3142
3143
3144if(NOT BUILD_INTEL_QA AND NOT BUILD_INTEL_QA_SYNC)
3145  list(APPEND HEADER_EXCLUDE
3146    "wolfssl/wolfcrypt/port/intel")
3147else()
3148  if(NOT BUILD_INTEL_QA)
3149    list(APPEND HEADER_EXCLUDE
3150      "wolfssl/wolfcrypt/port/intel/quickassist.h"
3151      "wolfssl/wolfcrypt/port/intel/quickassist_mem.h"
3152      )
3153  endif()
3154
3155  if(NOT BUILD_INTEL_QA_SYNC)
3156    list(APPEND HEADER_EXCLUDE
3157      "wolfssl/wolfcrypt/port/intel/quickassist_sync.h")
3158  endif()
3159endif()
3160
3161if(NOT BUILD_SP)
3162  list(APPEND HEADER_EXCLUDE
3163    "wolfssl/wolfcrypt/sp.h")
3164endif()
3165
3166if(NOT BUILD_SP_INT)
3167  list(APPEND HEADER_EXCLUDE
3168    "wolfssl/wolfcrypt/sp_int.h")
3169endif()
3170
3171if(NOT BUILD_SELFTEST)
3172  list(APPEND HEADER_EXCLUDE
3173    "wolfssl/wolfcrypt/selftest.h")
3174endif()
3175
3176if(NOT BUILD_FIPS OR BUILD_FIPS_V1)
3177  list(APPEND HEADER_EXCLUDE
3178    "wolfssl/wolfcrypt/fips.h")
3179endif()
3180
3181if(NOT BUILD_QNXCAAM OR BUILD_CAAM)
3182  list(APPEND HEADER_EXCLUDE
3183    "wolfssl/wolfcrypt/port/caam"
3184    )
3185endif()
3186
3187list(JOIN HEADER_EXCLUDE "|" EXCLUDED_HEADERS_REGEX)
3188
3189string(PREPEND EXCLUDED_HEADERS_REGEX "(")
3190string(APPEND  EXCLUDED_HEADERS_REGEX ")")
3191
3192if(WOLFSSL_INSTALL)
3193
3194    set(INSTALLED_EXAMPLES
3195        ${CMAKE_CURRENT_SOURCE_DIR}/examples/echoserver/echoserver.c
3196        ${CMAKE_CURRENT_SOURCE_DIR}/examples/sctp/sctp-server.c
3197        ${CMAKE_CURRENT_SOURCE_DIR}/examples/sctp/sctp-client-dtls.c
3198        ${CMAKE_CURRENT_SOURCE_DIR}/examples/sctp/sctp-client.c
3199        ${CMAKE_CURRENT_SOURCE_DIR}/examples/sctp/sctp-server-dtls.c
3200        ${CMAKE_CURRENT_SOURCE_DIR}/examples/echoclient/echoclient.c
3201        ${CMAKE_CURRENT_SOURCE_DIR}/examples/server/server.c
3202        ${CMAKE_CURRENT_SOURCE_DIR}/examples/benchmark/tls_bench.c
3203        ${CMAKE_CURRENT_SOURCE_DIR}/examples/client/client.c)
3204
3205
3206    # Install the library
3207    install(TARGETS wolfssl
3208            EXPORT wolfssl-targets
3209            LIBRARY DESTINATION ${CMAKE_INSTALL_LIBDIR}
3210            ARCHIVE DESTINATION ${CMAKE_INSTALL_LIBDIR}
3211            RUNTIME DESTINATION ${CMAKE_INSTALL_BINDIR}
3212            )
3213    # Install the headers
3214    install(DIRECTORY ${WOLFSSL_OUTPUT_BASE}/wolfssl/
3215            DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}/wolfssl
3216            FILES_MATCHING PATTERN "*.h"
3217            REGEX ${EXCLUDED_HEADERS_REGEX} EXCLUDE)
3218    install(DIRECTORY ${CMAKE_CURRENT_SOURCE_DIR}/wolfssl/
3219            DESTINATION ${CMAKE_INSTALL_INCLUDEDIR}/wolfssl
3220            FILES_MATCHING PATTERN "*.h"
3221            REGEX ${EXCLUDED_HEADERS_REGEX} EXCLUDE)
3222
3223    # Install the examples
3224    install(FILES ${INSTALLED_EXAMPLES}
3225            DESTINATION ${CMAKE_INSTALL_DOCDIR}/example)
3226    # Install README.txt and taoCert.txt
3227    install(FILES
3228            ${CMAKE_CURRENT_SOURCE_DIR}/doc/README.txt
3229            ${CMAKE_CURRENT_SOURCE_DIR}/certs/taoCert.txt
3230            DESTINATION ${CMAKE_INSTALL_DOCDIR})
3231    # Install the export set
3232    install(EXPORT wolfssl-targets
3233            DESTINATION ${CMAKE_INSTALL_LIBDIR}/cmake/wolfssl
3234            FILE wolfssl-targets.cmake
3235            NAMESPACE wolfssl::)
3236
3237    # TODO: Distro build + rules for what to include in the distro.
3238    #       See various include.am files.
3239
3240    set(prefix ${CMAKE_INSTALL_PREFIX})
3241    set(exec_prefix "\${prefix}")
3242    set(libdir "\${exec_prefix}/lib")
3243    set(includedir "\${prefix}/include")
3244    set(VERSION ${PROJECT_VERSION})
3245
3246    if(CMAKE_C_COMPILER_ID STREQUAL "OpenWatcom")
3247    else()
3248        # Setting libm in Libs.private of wolfssl.pc.
3249        # See "Link Libraries" in above about `m` insertion to LINK_LIBRARIES
3250        get_target_property(_wolfssl_dep_libs wolfssl LINK_LIBRARIES)
3251        list(FIND _wolfssl_dep_libs m _dep_libm)
3252        if ("${_dep_libm}" GREATER -1)
3253            set(LIBM -lm)
3254        else()
3255            set(LIBM)
3256        endif()
3257    endif()
3258
3259    # Add required frameworks for static linking on Apple platforms
3260    if(APPLE AND NOT BUILD_SHARED_LIBS)
3261        if(WOLFSSL_SYS_CA_CERTS)
3262            list(APPEND PC_LIBS_PRIVATE "-framework CoreFoundation" "-framework Security")
3263        endif()
3264    endif()
3265
3266    # Convert lists to space-separated strings for pkg-config
3267    string(JOIN " " PC_LIBS_PRIVATE ${PC_LIBS_PRIVATE})
3268
3269    configure_file(support/wolfssl.pc.in ${CMAKE_CURRENT_BINARY_DIR}/support/wolfssl.pc @ONLY)
3270    install(FILES ${CMAKE_CURRENT_BINARY_DIR}/support/wolfssl.pc
3271    DESTINATION ${CMAKE_INSTALL_LIBDIR}/pkgconfig)
3272
3273    include(CMakePackageConfigHelpers)
3274    configure_package_config_file(${CMAKE_CURRENT_SOURCE_DIR}/cmake/Config.cmake.in
3275    "${CMAKE_CURRENT_BINARY_DIR}/wolfssl-config.cmake"
3276    INSTALL_DESTINATION "${CMAKE_INSTALL_LIBDIR}/cmake/wolfssl"
3277    NO_SET_AND_CHECK_MACRO
3278    NO_CHECK_REQUIRED_COMPONENTS_MACRO
3279    )
3280
3281    export(EXPORT wolfssl-targets
3282    FILE "${CMAKE_CURRENT_BINARY_DIR}/wolfssl-targets.cmake"
3283    NAMESPACE wolfssl::
3284    )
3285
3286    write_basic_package_version_file(
3287    "${CMAKE_CURRENT_BINARY_DIR}/wolfssl-config-version.cmake"
3288    VERSION "${wolfssl_VERSION_MAJOR}.${wolfssl_VERSION_MINOR}"
3289    COMPATIBILITY AnyNewerVersion
3290    )
3291
3292    install(FILES
3293    ${CMAKE_CURRENT_BINARY_DIR}/wolfssl-config.cmake
3294    ${CMAKE_CURRENT_BINARY_DIR}/wolfssl-config-version.cmake
3295    DESTINATION ${CMAKE_INSTALL_LIBDIR}/cmake/wolfssl
3296    )
3297endif()