Use the official wolfssl-wolfcrypt crate and drop the bundled bindings

.github/test-workspace/provider-Cargo.toml

@@ -5,21 +5,15 @@ edition = "2021"
 
 [dependencies]
 rustls = { path = "../../rustls/rustls", default-features = false, features = ["tls12"] }
-chacha20poly1305 = { version = "0.10", default-features = false, features = ["alloc"] }
-der = { version = "0.7", default-features = false }  
-ecdsa = { version = "0.16.9", default-features = false, features = ["alloc"] }
-hmac = { version = "0.12", default-features = false }
+der = { version = "0.7", default-features = false }
 pkcs8 = { version = "0.10.2", default-features = false }
-rand_core = { version = "0.6", default-features = false, features = ["getrandom", "alloc"] }
-rsa = { version = "0.9", features = ["sha2"], default-features = false }
-sha2 = { version = "0.10", default-features = false }  
 signature = { version = "2", default-features = false } 
 webpki = { package = "rustls-webpki", version = "0.102", features = ["alloc"], default-features = false }
 foreign-types = { version = "0.5.0", default-features = false } 
 rustls-pki-types = { version = "1.11.0", default-features = false } 
 log = { version = "0.4.25", default-features = false } 
 env_logger = { version = "0.11.6", default-features = false }
-wolfcrypt-rs = { path = "../wolfcrypt-rs" }
+wolfssl-wolfcrypt = { git = "https://github.com/wolfSSL/wolfssl" }
 rustls-pemfile = { version = "2.2.0", default-features = false }
 hex = { version = "0.4.3", default-features = false, features = ["alloc"]} 
 wycheproof = { version = "0.6.0", default-features = false, features = [
@@ -45,7 +39,7 @@ rustls-test = {workspace = true}
 
 [features]
 default = []
-std = ["pkcs8/std", "rustls/std", "wolfcrypt-rs/std"]
+std = ["pkcs8/std", "rustls/std"]
 quic = []
 
 [profile.release]

.github/workflows/macos-build.yml

@@ -10,6 +10,11 @@ jobs:
   macos-build:
     name: Build and Test (macOS)
     runs-on: macos-latest
+    env:
+      WOLFSSL_SRC: ${{ github.workspace }}/wolfssl
+      WOLFSSL_PREFIX: ${{ github.workspace }}/wolfssl-install
+      WOLFSSL_SERVER: ${{ github.workspace }}/wolfssl/examples/server/server
+      DYLD_LIBRARY_PATH: ${{ github.workspace }}/wolfssl-install/lib
     steps:
       - uses: actions/checkout@v4
 
@@ -35,29 +40,42 @@ jobs:
           restore-keys: |
             macos-cargo-
 
-      - name: Build and Test wolfcrypt-rs
+      - name: Checkout wolfSSL master
+        uses: actions/checkout@v4
+        with:
+          repository: wolfSSL/wolfssl
+          path: wolfssl
+
+      - name: Build and install wolfSSL
+        working-directory: wolfssl
         run: |
-          cd wolfcrypt-rs
-          make build
-          make test
+          ./autogen.sh
+          ./configure --prefix="$WOLFSSL_PREFIX" \
+            --enable-all-crypto --enable-shared --disable-static \
+            CPPFLAGS=-DWOLFSSL_RSA_KEY_CHECK
+          make -j"$(sysctl -n hw.ncpu)"
+          make install
+
+      - name: Use the wolfCrypt crate from wolfSSL master
+        run: |
+          mkdir -p .cargo
+          printf '[patch."https://github.com/wolfSSL/wolfssl"]\nwolfssl-wolfcrypt = { path = "%s/wrapper/rust/wolfssl-wolfcrypt" }\n' \
+            "$WOLFSSL_SRC" > .cargo/config.toml
 
       - name: Build and Test rustls-wolfcrypt-provider
         run: |
           cd rustls-wolfcrypt-provider
           make build
           make test
           make test-quic
+          make test-std
 
       - name: Check formatting
         run: |
-          cd wolfcrypt-rs
-          cargo fmt --all -- --check
-          cd ../rustls-wolfcrypt-provider
+          cd rustls-wolfcrypt-provider
           cargo fmt --all -- --check
 
       - name: Run clippy
         run: |
-          cd wolfcrypt-rs
-          cargo clippy -- -D warnings -A unnecessary-transmutes
-          cd ../rustls-wolfcrypt-provider
+          cd rustls-wolfcrypt-provider
           cargo clippy --all-features -- -D warnings

.github/workflows/macos-rustls-tests.yml

@@ -10,6 +10,10 @@ jobs:
   macos-build:
     name: Build and Test (macOS)
     runs-on: macos-latest
+    env:
+      WOLFSSL_SRC: ${{ github.workspace }}/wolfssl
+      WOLFSSL_PREFIX: ${{ github.workspace }}/wolfssl-install
+      DYLD_LIBRARY_PATH: ${{ github.workspace }}/wolfssl-install/lib
     steps:
       - uses: actions/checkout@v4
 
@@ -35,6 +39,28 @@ jobs:
           restore-keys: |
             macos-cargo-
 
+      - name: Checkout wolfSSL master
+        uses: actions/checkout@v4
+        with:
+          repository: wolfSSL/wolfssl
+          path: wolfssl
+
+      - name: Build and install wolfSSL
+        working-directory: wolfssl
+        run: |
+          ./autogen.sh
+          ./configure --prefix="$WOLFSSL_PREFIX" \
+            --enable-all-crypto --enable-shared --disable-static \
+            CPPFLAGS=-DWOLFSSL_RSA_KEY_CHECK
+          make -j"$(sysctl -n hw.ncpu)"
+          make install
+
+      - name: Use the wolfCrypt crate from wolfSSL master
+        run: |
+          mkdir -p .cargo
+          printf '[patch."https://github.com/wolfSSL/wolfssl"]\nwolfssl-wolfcrypt = { path = "%s/wrapper/rust/wolfssl-wolfcrypt" }\n' \
+            "$WOLFSSL_SRC" > .cargo/config.toml
+
       - name: Checkout rustls v0.23.35
         uses: actions/checkout@v4
         with:
@@ -58,15 +84,10 @@ jobs:
           cp "$GITHUB_WORKSPACE/.github/test-workspace/workspace-Cargo.toml" Cargo.toml
 
           mkdir -p rustls-wolfcrypt-provider
-          cp -r "$GITHUB_WORKSPACE/wolfcrypt-rs" rustls-wolfcrypt-provider/
           cp -r "$GITHUB_WORKSPACE/rustls-wolfcrypt-provider" rustls-wolfcrypt-provider/
           cp "$GITHUB_WORKSPACE/.github/test-workspace/provider-Cargo.toml" \
              rustls-wolfcrypt-provider/rustls-wolfcrypt-provider/Cargo.toml
 
-      - name: Build wolfcrypt-rs
-        working-directory: rustlsv0.23.35-test-workspace/rustls-wolfcrypt-provider/wolfcrypt-rs
-        run: make build
-
       - name: Build rustls-wolfcrypt-provider
         working-directory: rustlsv0.23.35-test-workspace/rustls-wolfcrypt-provider/rustls-wolfcrypt-provider
         run: cargo build --all-features --release

.github/workflows/ubuntu-build.yml

@@ -10,6 +10,11 @@ jobs:
   ubuntu-build:
     name: Build and Test (Ubuntu)
     runs-on: ubuntu-latest
+    env:
+      WOLFSSL_SRC: ${{ github.workspace }}/wolfssl
+      WOLFSSL_PREFIX: ${{ github.workspace }}/wolfssl-install
+      WOLFSSL_SERVER: ${{ github.workspace }}/wolfssl/examples/server/server
+      LD_LIBRARY_PATH: ${{ github.workspace }}/wolfssl-install/lib
     steps:
       - uses: actions/checkout@v4
 
@@ -35,30 +40,43 @@ jobs:
           restore-keys: |
             ubuntu-cargo-
 
-      - name: Build and Test wolfcrypt-rs
+      - name: Checkout wolfSSL master
+        uses: actions/checkout@v4
+        with:
+          repository: wolfSSL/wolfssl
+          path: wolfssl
+
+      - name: Build and install wolfSSL
+        working-directory: wolfssl
         run: |
-          cd wolfcrypt-rs
-          make build
-          make test
+          ./autogen.sh
+          ./configure --prefix="$WOLFSSL_PREFIX" \
+            --enable-all-crypto --enable-shared --disable-static \
+            CPPFLAGS=-DWOLFSSL_RSA_KEY_CHECK
+          make -j"$(nproc)"
+          make install
+
+      - name: Use the wolfCrypt crate from wolfSSL master
+        run: |
+          mkdir -p .cargo
+          printf '[patch."https://github.com/wolfSSL/wolfssl"]\nwolfssl-wolfcrypt = { path = "%s/wrapper/rust/wolfssl-wolfcrypt" }\n' \
+            "$WOLFSSL_SRC" > .cargo/config.toml
 
       - name: Build and Test rustls-wolfcrypt-provider
         run: |
           cd rustls-wolfcrypt-provider
           make build
           make test
           make test-quic
+          make test-std
 
       - name: Check formatting
         run: |
-          cd wolfcrypt-rs
-          cargo fmt --all -- --check
-          cd ../rustls-wolfcrypt-provider
+          cd rustls-wolfcrypt-provider
           cargo fmt --all -- --check
 
       - name: Run clippy
         run: |
-          cd wolfcrypt-rs
-          cargo clippy --all-features -- -D warnings
-          cd ../rustls-wolfcrypt-provider
+          cd rustls-wolfcrypt-provider
           cargo clippy --all-features -- -D warnings
 

.github/workflows/ubuntu-rustls-tests.yml

@@ -10,6 +10,10 @@ jobs:
   ubuntu-build:
     name: Build and Test (Ubuntu)
     runs-on: ubuntu-latest
+    env:
+      WOLFSSL_SRC: ${{ github.workspace }}/wolfssl
+      WOLFSSL_PREFIX: ${{ github.workspace }}/wolfssl-install
+      LD_LIBRARY_PATH: ${{ github.workspace }}/wolfssl-install/lib
     steps:
       - uses: actions/checkout@v4
 
@@ -35,6 +39,28 @@ jobs:
           restore-keys: |
             ubuntu-cargo-
 
+      - name: Checkout wolfSSL master
+        uses: actions/checkout@v4
+        with:
+          repository: wolfSSL/wolfssl
+          path: wolfssl
+
+      - name: Build and install wolfSSL
+        working-directory: wolfssl
+        run: |
+          ./autogen.sh
+          ./configure --prefix="$WOLFSSL_PREFIX" \
+            --enable-all-crypto --enable-shared --disable-static \
+            CPPFLAGS=-DWOLFSSL_RSA_KEY_CHECK
+          make -j"$(nproc)"
+          make install
+
+      - name: Use the wolfCrypt crate from wolfSSL master
+        run: |
+          mkdir -p .cargo
+          printf '[patch."https://github.com/wolfSSL/wolfssl"]\nwolfssl-wolfcrypt = { path = "%s/wrapper/rust/wolfssl-wolfcrypt" }\n' \
+            "$WOLFSSL_SRC" > .cargo/config.toml
+
       - name: Checkout rustls v0.23.35
         uses: actions/checkout@v4
         with:
@@ -58,15 +84,10 @@ jobs:
           cp "$GITHUB_WORKSPACE/.github/test-workspace/workspace-Cargo.toml" Cargo.toml
 
           mkdir -p rustls-wolfcrypt-provider
-          cp -r "$GITHUB_WORKSPACE/wolfcrypt-rs" rustls-wolfcrypt-provider/
           cp -r "$GITHUB_WORKSPACE/rustls-wolfcrypt-provider" rustls-wolfcrypt-provider/
           cp "$GITHUB_WORKSPACE/.github/test-workspace/provider-Cargo.toml" \
              rustls-wolfcrypt-provider/rustls-wolfcrypt-provider/Cargo.toml
 
-      - name: Build wolfcrypt-rs
-        working-directory: rustlsv0.23.35-test-workspace/rustls-wolfcrypt-provider/wolfcrypt-rs
-        run: make build
-
       - name: Build rustls-wolfcrypt-provider
         working-directory: rustlsv0.23.35-test-workspace/rustls-wolfcrypt-provider/rustls-wolfcrypt-provider
         run: cargo build --all-features --release

.gitignore

@@ -1,4 +1,2 @@
 /rustls-wolfcrypt-provider/target
-/wolfcrypt-rs/target
-/wolfcrypt-rs/wolfssl-*/
 /rustlsv0.23.35-test-workspace/

README.md

@@ -8,12 +8,13 @@ provider itself operates independently of `std`.
 ## Status
 
 This is in an alpha stage, particularly because the Rustls API is not yet stable.
-This code currently works with Rustls = 0.23.22.
+This code currently works with Rustls = 0.23.45.
 
 ## Repo Structure
 
 - **rustls-wolfcrypt-provider**: Crate containing the code that lets you use rustls with wolfcrypt as a crypto provider.
-- **wolfcrypt-rs**: Low-level unsafe bindings for wolfcrypt generated using bindgen.
+
+It calls wolfCrypt through the official [`wolfssl-wolfcrypt`](https://github.com/wolfSSL/wolfssl/tree/master/wrapper/rust/wolfssl-wolfcrypt) crate, which links an installed wolfSSL.
 
 ## Cipher Suites (Currently) Supported
 
@@ -35,27 +36,34 @@ For more details about the supported curves, verification/signing methods, and a
 ## Usage
 
 ### Initial Setup and Installation
-*Rustc 1.77+ is required.*
+*Rustc 1.85+ is required.*
 
 1. Clone the repository:
    ```
    git clone --depth=1 git@github.com:wolfssl/rustls-wolfcrypt-provider.git
    cd rustls-wolfcrypt-provider/
    ```
 
-2. Build the wolfcrypt-rs crate to correctly generate the bindings and make sure
-   the build was successful by running the sanity check(s):
+2. Build and install wolfSSL as a shared library (from a checkout of
+   [wolfSSL](https://github.com/wolfSSL/wolfssl)):
    ```
-   cd wolfcrypt-rs/
-   make build
-   make test
+   ./autogen.sh
+   ./configure --prefix=<install dir> --enable-all-crypto --enable-shared \
+       --disable-static CPPFLAGS=-DWOLFSSL_RSA_KEY_CHECK
+   make
+   make install
    ```
 
-   Then change the current directory to the rustls-wolfcrypt-provider, build 
-   the crate, followed by running the test to make sure everything is running
-   smoothly:
+3. Build the crate and run the tests. `WOLFSSL_PREFIX` tells the wolfCrypt
+   crate where wolfSSL is installed, and the library directory must be on the
+   loader path. The end-to-end tests run wolfSSL's example server
+   (`WOLFSSL_SERVER`) from the wolfSSL source tree (`WOLFSSL_SRC`):
    ```
-   cd ../rustls-wolfcrypt-provider/
+   export WOLFSSL_PREFIX=<install dir>
+   export LD_LIBRARY_PATH=$WOLFSSL_PREFIX/lib    # DYLD_LIBRARY_PATH on macOS
+   export WOLFSSL_SRC=<wolfSSL checkout>
+   export WOLFSSL_SERVER=$WOLFSSL_SRC/examples/server/server
+   cd rustls-wolfcrypt-provider/
    make build
    make test
    ```