@annadata/capacitor-mqtt-quic 0.1.6 → 0.1.7

package/android/install/wolfssl-android/armeabi-v7a/lib/libwolfssl.la

@@ -0,0 +1,41 @@
+# libwolfssl.la - a libtool library file
+# Generated by libtool (GNU libtool) 2.5.4
+#
+# Please DO NOT delete this file!
+# It is necessary for linking the library.
+
+# The name that we can dlopen(3).
+dlname=''
+
+# Names of this library.
+library_names=''
+
+# The name of the static archive.
+old_library='libwolfssl.a'
+
+# Linker flags that cannot go in dependency_libs.
+inherited_linker_flags=' -pthread'
+
+# Libraries that this one depends upon.
+dependency_libs=' -lm'
+
+# Names of additional weak libraries provided by this library
+weak_library_names=''
+
+# Version information for libwolfssl.
+current=44
+age=0
+revision=1
+
+# Is this an already installed library?
+installed=yes
+
+# Should we warn about portability when linking against -modules?
+shouldnotlink=no
+
+# Files to dlopen/dlpreopen
+dlopen=''
+dlpreopen=''
+
+# Directory that this library needs to be installed in:
+libdir='/Users/annadata/Project_A/capacitor-mqtt-quic/android/install/wolfssl-android/armeabi-v7a/lib'

package/android/install/wolfssl-android/armeabi-v7a/lib/pkgconfig/wolfssl.pc

@@ -0,0 +1,11 @@
+prefix=/Users/annadata/Project_A/capacitor-mqtt-quic/android/install/wolfssl-android/armeabi-v7a
+exec_prefix=${prefix}
+libdir=${exec_prefix}/lib
+includedir=${prefix}/include
+
+Name: wolfssl
+Description: wolfssl C library.
+Version: 5.8.4
+Libs: -L${libdir} -lwolfssl
+Libs.private: -lm 
+Cflags: -I${includedir}

package/android/install/wolfssl-android/armeabi-v7a/share/doc/wolfssl/QUIC.md

@@ -0,0 +1,117 @@
+# wolfSSL and QUIC
+
+wolfSSL *supports* QUIC implementations. It does not offer an implementation of the QUIC protocol.
+
+What does that mean?
+
+TLS works on top of the Internet's TCP protocol stack. The TCP is shipped as part of the Operating System
+and accessible via system calls and APIs. TCP itself is not secured by TLS, only the data sent via it is
+protected. TCP does not have to know anything about TLS.
+
+QUIC, on the other hand, is always protected by TLS. A QUIC implementation does always need an
+implementation of the TLS protocol, specifically TLSv1.3. It does this in new ways and TLS
+implementations need to accommodate these. Those specifics have been added to wolfSSL.
+
+## wolfSSL Configuration
+
+QUIC support is enabled in the common autoconf style via:
+
+```
+> ./configure --enable-quic
+```
+
+this drags in some very basic features. To have everything necessary for a QUIC protocol implementation like ngtcp2, one would do:
+
+```
+ ./configure --enable-quic --enable-session-ticket --enable-earlydata --enable-psk
+```
+
+**Note**: for now, quic is not enabled via `--enable-all` and always needs to be specified.
+
+## ngtcp2
+
+One of the recommended QUIC implementations is [ngtpc2](https://github.com/ngtcp2/ngtcp2). It now
+supports use of wolfSSL as its "crypto" library. Configuring ngtcp2 with wolfSSL is done via:
+
+```
+> ./configure --with-wolfssl
+```
+
+Built this way, one gets a complete, standard-conform QUIC library.
+
+### HTTP/3 != QUIC
+
+HTTP/3 is designed for the QUIC protocol. But QUIC does not know anything about HTTP/3. [nghttp3](https://github.com/ngtcp2/nghttp3) is an implementation of HTTP/3 that works with ngtcp2.
+
+A *complete* HTTP/3 choice would be `nghttp3 + ngtcp2 + wolfSSL` plus the UDP of the operating system. The examples provided in ngtcp2 build exactly that and give you clients and servers that illustrate the use of the APIs.
+
+### curl - all in one
+
+The above configuration has also been added to [curl](https://github.com/curl/curl) and its library `libcurl`. Which will, once it leaves the experimental stage, make QUIC available in your favourite command line tool and for all applications built on top of `libcurl`.
+
+### why?
+
+Why all these different blocks?
+
+The separation of HTTP/3 and QUIC is natural when you think about the relationship between TCP and HTTP/1.1. Like TCP, QUIC can and will carry other protocols. HTTP/3 is only the first one. Most likely 'DNS over QUIC' (DoQ) is the next popular, replacing DoH.
+
+The separation of QUIC's "crypto" parts from its other protocol enabling functions is a matter of security. In its experimental beginnings, QUIC had its own security design. With the emerging TLSv1.3 and all it improvements, plus decades of experience, it seemed rather unwise to have something separate in QUIC.
+
+Therefore, the complete TLSv1.3 handshake became part of the QUIC protocol, with some restrictions and simplifications (UDP based QUIC does not accommodate broken TCP middle boxes). With the need for a complete TLSv1.3 stack, QUIC implementers happily make use of existing TLS libraries.
+
+## wolfSSL API
+
+The exposed API carries all methods that the [quictls/openssl](https://github.com/quictls/openssl) introduces. This seems to become the standard, since other *SLL libraries have picked those up or are about to. The methods are all in the `wolfSSL_` prefix. There are some additional methods, which are covered below.
+
+### Core Interworking
+
+At the base is the struct `WOLFSSL_QUIC_METHOD` which carries four callbacks:
+
+* `set_encryption_secrets()`: to forward generated secrets.
+* `add_handshake_data()`: to forward Handshake messages.
+* `flush_flight()`: to tell the QUIC protocol handler to flush any buffered data.
+* `send_alert()`: to forward SSL alerts.
+
+A QUIC protocol handler installs these via `wolfSSL_CTX_set_quic_method()` or `wolfSSL_set_quic_method()`. When CRYPTO messages arrive from the peer, those are added via `wolfSSL_provide_quic_data()` to the `WOLFSSL*` instance:
+
+```
+  DATA ---recv+decrypt---+
+                         v
+            wolfSSL_provide_quic_data(ssl, ...)
+            wolfSSL_do_handshake(ssl);
+                  +-> add_handshake_data_callback(REPLY)
+                          |
+  REPLY <--encrypt+send---+
+```
+
+The wolfSSL instance performs the common TLSv1.3 handshake processing with the significant change that it does not encrypt or decrypt messages itself. It computes all the secrets and MACs as usual, however.
+
+Encryption and Decryption is done by the QUIC protocol handler. Which is why it gets access to the secrets
+at the different encryption levels: `initial`(no encryption), `handshake`, `application` and `earlydata`.
+
+For sending data, the level to use for encryption is a call parameter in `add_handshake_data()`. For received data, the level to use for decryption can be interrogated via `wolfSSL_quic_read_level()`.
+
+When the handshake is done, any additional CRYPTO messages are received in the same way, only `wolfSSL_process_quic_post_handshake()` is invoked to process them.
+
+### Crypto Support
+
+At the basic level, there are:
+
+* `wolfSSL_quic_get_aead()`: to get the AEAD cipher negotiated
+* `wolfSSL_quic_get_md()`:  to get the MD negotiated
+* `wolfSSL_quic_get_hp()`: to get the EVP_CIPHER for header protection
+* `wolfSSL_quic_get_aead_tag_len()`: the get the tag length of the negotiated AEAD cipher
+
+In addition to that, the wolfSSL QUIC API offers the following functions:
+
+* `wolfSSL_quic_crypt_new()`: to setup a `WOLFSSL_EVP_CIPHER_CTX` for en- or decryption with AEAD cipher, key and iv.
+* `wolfSSL_quic_aead_encrypt()`: to encrypt with such a context and params
+* `wolfSSL_quic_aead_decrypt()`: to decrypt with such a context and params
+
+and for key generation `wolfSSL_quic_hkdf_extract()`, `wolfSSL_quic_hkdf_expand()` and `wolfSSL_quic_hkdf()`.
+
+## Tests
+
+Tests have been added in `tests/quic.c` to run as part of `unit.tests`. Those go from basic checks on providing data and receiving secrets to complete handshakes between SSL client and server instances. These handshakes are done plain, with session resumption and with early data.
+
+These tests exchange the handshake messages between the SSL instances unencrypted, verifying their sequence and contents. They also verify that client and sever did indeed generate identical secrets for the different encryption levels.

package/android/install/wolfssl-android/armeabi-v7a/share/doc/wolfssl/README.txt

@@ -0,0 +1,8 @@
+The wolfSSL manual is available at:
+http://www.wolfssl.com/documentation/wolfSSL-Manual.pdf
+
+The wolfSSL API guide is available at:
+https://www.wolfssl.com/doxygen/wolfssl_API.html
+
+The wolfCrypt API guide is available at:
+https://www.wolfssl.com/doxygen/wolfcrypt_API.html

package/android/install/wolfssl-android/armeabi-v7a/share/doc/wolfssl/example/async_client.c

@@ -0,0 +1,245 @@
+/* async_client.c
+ *
+ * Copyright (C) 2006-2025 wolfSSL Inc.
+ *
+ * This file is part of wolfSSL.
+ *
+ * wolfSSL is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * wolfSSL is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
+ */
+
+/* TLS client demonstrating asynchronous cryptography features and optionally
+ * using the crypto or PK callbacks */
+
+#ifdef HAVE_CONFIG_H
+    #include <config.h>
+#endif
+
+/* std */
+#include <stdlib.h>
+#include <stdio.h>
+#include <string.h>
+
+/* socket */
+#include <sys/socket.h>
+#include <arpa/inet.h>
+#include <netinet/in.h>
+#include <unistd.h>
+
+/* wolfSSL */
+#ifndef WOLFSSL_USER_SETTINGS
+    #include <wolfssl/options.h>
+#endif
+#include <wolfssl/ssl.h>
+#include <wolfssl/wolfio.h>
+#include <wolfssl/wolfcrypt/error-crypt.h>
+#include "examples/async/async_tls.h"
+
+/* Test certificates and keys for RSA and ECC */
+#ifndef NO_RSA
+    #define CERT_FILE "./certs/client-cert.pem"
+    #define KEY_FILE  "./certs/client-key.pem"
+    #define CA_FILE   "./certs/ca-cert.pem"
+#elif defined(HAVE_ECC)
+    #define CERT_FILE "./certs/client-ecc-cert.pem"
+    #define KEY_FILE  "./certs/ecc-client-key.pem"
+    #define CA_FILE   "./certs/ca-ecc-cert.pem"
+#else
+    #error No authentication algorithm (ECC/RSA)
+#endif
+
+int client_async_test(int argc, char** argv)
+{
+    int ret = 0;
+    int                sockfd = SOCKET_INVALID;
+    struct sockaddr_in servAddr;
+    char               buff[TEST_BUF_SZ];
+    size_t             len;
+    int                devId = 1; /* anything besides -2 (INVALID_DEVID) */
+#ifdef WOLF_CRYPTO_CB
+    AsyncTlsCryptoCbCtx      myCtx;
+#endif
+    int  err;
+    char errBuff[WOLFSSL_MAX_ERROR_SZ];
+
+    /* declare wolfSSL objects */
+    WOLFSSL_CTX* ctx = NULL;
+    WOLFSSL*     ssl = NULL;
+
+    /* Check for proper calling convention */
+    if (argc != 2) {
+        printf("usage: %s <IPv4 address>\n", argv[0]);
+        return 0;
+    }
+
+    /* Create a socket that uses an internet IPv4 address,
+     * Sets the socket to be stream based (TCP),
+     * 0 means choose the default protocol. */
+    if ((sockfd = socket(AF_INET, SOCK_STREAM, 0)) == -1) {
+        fprintf(stderr, "ERROR: failed to create the socket\n");
+        ret = -1; goto exit;
+    }
+
+    /* Initialize the server address struct with zeros */
+    memset(&servAddr, 0, sizeof(servAddr));
+
+    /* Fill in the server address */
+    servAddr.sin_family = AF_INET;             /* using IPv4      */
+    servAddr.sin_port   = htons(DEFAULT_PORT); /* on DEFAULT_PORT */
+
+    /* Get the server IPv4 address from the command line call */
+    if (inet_pton(AF_INET, argv[1], &servAddr.sin_addr) != 1) {
+        fprintf(stderr, "ERROR: invalid address\n");
+        ret = -1; goto exit;
+    }
+
+    /* Connect to the server */
+    if ((ret = connect(sockfd, (struct sockaddr*) &servAddr, sizeof(servAddr)))
+         == -1) {
+        fprintf(stderr, "ERROR: failed to connect\n");
+        goto exit;
+    }
+
+    /*---------------------------------*/
+    /* Start of wolfSSL initialization and configuration */
+    /*---------------------------------*/
+#ifdef DEBUG_WOLFSSL
+    wolfSSL_Debugging_ON();
+#endif
+
+    /* Initialize wolfSSL */
+    if ((ret = wolfSSL_Init()) != WOLFSSL_SUCCESS) {
+        fprintf(stderr, "ERROR: Failed to initialize the library\n");
+        goto exit;
+    }
+
+    /* Create and initialize WOLFSSL_CTX */
+    if ((ctx = wolfSSL_CTX_new(wolfSSLv23_client_method())) == NULL) {
+        fprintf(stderr, "ERROR: failed to create WOLFSSL_CTX\n");
+        ret = -1; goto exit;
+    }
+
+#ifdef WOLF_CRYPTO_CB
+    XMEMSET(&myCtx, 0, sizeof(myCtx));
+    /* register a devID for crypto callbacks */
+    ret = wc_CryptoCb_RegisterDevice(devId, AsyncTlsCryptoCb, &myCtx);
+    if (ret != 0) {
+        fprintf(stderr, "wc_CryptoCb_RegisterDevice: error %d", ret);
+        goto exit;
+    }
+#endif
+    /* register a devID for crypto callbacks */
+    wolfSSL_CTX_SetDevId(ctx, devId);
+
+    /* Load client certificate into WOLFSSL_CTX */
+    if ((ret = wolfSSL_CTX_use_certificate_file(ctx, CERT_FILE, WOLFSSL_FILETYPE_PEM))
+        != WOLFSSL_SUCCESS) {
+        fprintf(stderr, "ERROR: failed to load %s, please check the file.\n",
+                CERT_FILE);
+        goto exit;
+    }
+
+    /* Load client key into WOLFSSL_CTX */
+    if ((ret = wolfSSL_CTX_use_PrivateKey_file(ctx, KEY_FILE, WOLFSSL_FILETYPE_PEM))
+        != WOLFSSL_SUCCESS) {
+        fprintf(stderr, "ERROR: failed to load %s, please check the file.\n",
+                KEY_FILE);
+        goto exit;
+    }
+
+    /* Load CA certificate into WOLFSSL_CTX */
+    if ((ret = wolfSSL_CTX_load_verify_locations(ctx, CA_FILE, NULL))
+         != WOLFSSL_SUCCESS) {
+        fprintf(stderr, "ERROR: failed to load %s, please check the file.\n",
+                CA_FILE);
+        goto exit;
+    }
+
+    /* Create a WOLFSSL object */
+    if ((ssl = wolfSSL_new(ctx)) == NULL) {
+        fprintf(stderr, "ERROR: failed to create WOLFSSL object\n");
+        ret = -1; goto exit;
+    }
+
+    /* Attach wolfSSL to the socket */
+    if ((ret = wolfSSL_set_fd(ssl, sockfd)) != WOLFSSL_SUCCESS) {
+        fprintf(stderr, "ERROR: Failed to set the file descriptor\n");
+        goto exit;
+    }
+
+    /* Connect to wolfSSL on the server side */
+    WOLFSSL_ASYNC_WHILE_PENDING(ret = wolfSSL_connect(ssl),
+                                ret != WOLFSSL_SUCCESS);
+    if (ret != WOLFSSL_SUCCESS) {
+        fprintf(stderr, "wolfSSL_connect error %d: %s\n",
+                err, wolfSSL_ERR_error_string(err, errBuff));
+        goto exit;
+    }
+
+    /* Get a message for the server from stdin */
+    printf("Message for server: ");
+    memset(buff, 0, sizeof(buff));
+    if (fgets(buff, sizeof(buff), stdin) == NULL) {
+        fprintf(stderr, "ERROR: failed to get message for server\n");
+        ret = -1; goto exit;
+    }
+    len = strnlen(buff, sizeof(buff));
+
+    /* Send the message to the server */
+    WOLFSSL_ASYNC_WHILE_PENDING(ret = wolfSSL_write(ssl, buff, (int)len),
+                                ret <= 0);
+    if (ret != (int)len) {
+        fprintf(stderr, "wolfSSL_write error %d: %s\n",
+                err, wolfSSL_ERR_error_string(err, errBuff));
+        goto exit;
+    }
+
+    /* Read the server data into our buff array */
+    memset(buff, 0, sizeof(buff));
+    WOLFSSL_ASYNC_WHILE_PENDING(ret = wolfSSL_read(ssl, buff, sizeof(buff)-1),
+                                ret <= 0);
+    if (ret < 0) {
+        fprintf(stderr, "wolfSSL_read error %d: %s\n",
+                err, wolfSSL_ERR_error_string(err, errBuff));
+        goto exit;
+    }
+
+    /* Print to stdout any data the server sends */
+    printf("Server: %s\n", buff);
+
+    /* Return reporting a success */
+    ret = 0;
+
+exit:
+    /* Cleanup and return */
+    if (sockfd != SOCKET_INVALID)
+        close(sockfd);          /* Close the connection to the server       */
+    if (ssl)
+        wolfSSL_free(ssl);      /* Free the wolfSSL object                  */
+    if (ctx)
+        wolfSSL_CTX_free(ctx);  /* Free the wolfSSL context object          */
+    wolfSSL_Cleanup();          /* Cleanup the wolfSSL environment          */
+
+    (void)argc;
+    (void)argv;
+
+    return ret;
+}
+
+#ifndef NO_MAIN_DRIVER
+int main(int argc, char** argv)
+{
+    return client_async_test(argc, argv);
+}
+#endif /* !NO_MAIN_DRIVER */