Hello Eric:

Thanks for the help.
I followed your guidance and I checked I'm actually using TLS1.2 (somehow I though I was using 1.1) which seems to be the default for AWS IoT Core.

Anyway, I replaced the function to use the wolfSSLv23_client_method( ) which seems to be a better choice to take care of selecting the highest version supported from both ends. Nevertheless, the error continues with same error message....

Any idea what else could be causing the error? Something related to certificates could also give this error?

I appreciate any direction.

Regards;
Gus

Thanks, Kaleb.

BTW, is MD5 supported in wolfSSL? I'm using v. 3.9 and I only found MD2.c in the files...

Thanks
Gus

Update:
I realized the flash routines add 512 bytes of RAM so I guess the current memory configuration for the stack is at the limit, so this change affects the overall wolfSSL stack functioning (to clarify, this doesn't come from my local array, but from the flash routines as it seems they need an extra space to handle the data before writing the flash).

I also wanted to share that, even without the flash routines, it was working fine BUT if at some point the SSL connection breaks, an attempt to reconnect (going through the SSL process again) gives the same error (RSA....: memory/config problem). So it seems there are some memory leakage or garbage that doesn't allow to do the TLS handshaking process for a second time. Only way is to reboot to start from fresh....

It seems I will need to reconfigure memory, but I would like to understand the wolfSSL stack memory requirements to avoid this problem.  The current value of FP_MAX_BITS is 4096. Changing it to 8192 doesn't solve the problem.

Thanks
Gus

UPDATE:

After many hours of debugging, I think I found the problem...

When the interface receives more than one packet from the last time the code checked for new packets, both messages are passed as one (combining both), and it seems this is not valid for the decryption. I still see with wireshark that all messages are received separately, but the network interface passes them as one.  Can be this the case?

Socks 69
Rev Buffer size 1
Rev Buffer size 1
Rev Buffer size 38
Subscribed Topic = devControl/ABC106{
                                      "Msg":"Help!"
                                                   }

Message (size: 19) = {
                       "Msg":"Help!"
                                    }

Socks 138
Rev Buffer size 1
Rev Buffer size 1
Rev Buffer size 38
Subscribed Topic = devControl/ABC106{
                                      "Msg":"Help!"
                                                   }

Message (size: 19) = {
                       "Msg":"Help!"
                                    }

Socks 69
.....SendAlert.....2 20
----> Detecta problema Decrypting

If this is causing the error, I will see how can I modify it to avoid this problem.
Thanks
Gus

David:

While reviewing the code, I realized I have a high priority task which looks for packets arriving from a Radio interface and forward them via MQTT Pub which utilizes wolfSSL_write() to send data to the cloud.
I also have another (lower prority) task which waits for data (MQTT Sub) from the cloud and utilizes wolfSSL_read() for this.
It seems at some point, while the latest task is checking for arrived packets from the cloud, it might be interrupted by the first one to send the radio packets to the cloud. I'm not sure at which point the task is being interrupted but it's possible that while using wolfSSL_read() this happen, leading to a potential problem.

How should I protect the wolfSSL access? Should I use a lock for avoiding concurrent access to wolfSSL_read() and  wolfSSL_write() functions?

UPDATE: it seems you wrote by the time I was writing this message... Thanks for clarifications. I just want to add I'm using MQTT Eclipse Paho as it was the one coming with the example. Anyway, I will continue working on following your advices.

Thank you for your support.
Regards;
Gus

Hello David:

Thank you very much for your support.

Answering your questions, I'm using the Atmel Zero touch AWS IoT kit (http://www.atmel.com/applications/iot/aws-zero-touch-secure-provisioning-platform/default.aspx?tab=overview ) as a base code. The project is using FreeRTOS and the mcu is Atmel ATSAM4E (with AES) and the kit comes with ATECC508 Crypto chip. (Original code was provided by ATSAMG55 but I ported to my mcu).
Honestly, I'm not sure if Encryption is done by Hardware or Software; how can I check this?

Thanks for the input; I will try to check the memory issue. I will continue investigating on this direction. Any other input, it will be much appreciated.

UPDATE: I tried to search for 'WOLFSSL_TRACK_MEMORY' but it is not there... In settings.h, the configuration define is 'ATMEL_AWS_WOLFSSL' with following configuration;

#if defined(ATMEL_AWS_WOLFSSL)
    #define SINGLE_THREADED
    #define HAVE_ECC
    #define HAVE_AESGCM
    #define HAVE_PK_CALLBACKS
    #define NO_FILESYSTEM
    #define NO_PSK
    #define NO_OLD_TLS
    #define NO_WRITEV
    #define NO_WOLFSSL_DIR
    #define NO_DEV_RANDOM
    #define NO_DSA
    #define NO_HC128
    #define NO_RABBIT
    #define NO_MD2
    #define NO_MD4
    #define NO_MD5
    #define NO_SHA
    #define NO_RC4
    #define NO_DES3
    #define NO_PWDBASED
    #define NO_SKID
    #define NO_SESSION_CACHE
    #define WOLFSSL_USER_IO
    #define WOLFSSL_STATIC_DH
    #define WOLFSSL_CERT_GEN
    #define WOLFSSL_SMALL_STACK
    //#define DEBUG_WOLFSSL
    #define NO_WOLFSSL_SERVER    
#endif

Regards;
Gus

Hello Kaleb:

The is only one place in code where that function is called and it seems to be Ok (no errors seen in the log);

       /* Since AWS IoT server was signed by the VeriSign root CA, this root CA certificate should be loaded to WolfSSL to verify AWS
                        ioT.   */
       ret = wolfSSL_CTX_load_verify_buffer(kit->tls.context, AWS_IOT_ROOT_CERT, sizeof(AWS_IOT_ROOT_CERT),
                                  SSL_FILETYPE_PEM);
       if (ret != SSL_SUCCESS) {
        AWS_ERROR("Failed to set root cert!");
        break;
       }

I ckecked the AWS_IOT_ROOT_CERT is defined (I copied from the working example)

I'm confused as it seems the CA is processed twice; before sending the CLIENT_HELLO and after receiving the SERVER_HELLO. Is this the case?

The first time seems to be Ok, according the log;

wolfSSL Entering wolfSSL_Init
wolfSSL Entering WOLFSSL_CTX_new
wolfSSL Entering wolfSSL_CertManagerNew
wolfSSL Leaving WOLFSSL_CTX_new, return 0
wolfSSL Entering wolfSSL_CTX_set_cipher_list
wolfSSL Entering wolfSSL_CTX_load_verify_buffer
Processing CA PEM file
wolfSSL Entering PemToDer
Adding a CA
wolfSSL Entering GetExplicitVersion
wolfSSL Entering GetMyVersion
Got Cert Header
wolfSSL Entering GetAlgoId
wolfSSL Entering GetObjectId()
Got Algo ID
Getting Cert Name
Getting Cert Name
Got Subject Name
wolfSSL Entering GetAlgoId
wolfSSL Entering GetObjectId()
Got Key
Parsed Past Key
wolfSSL Entering DecodeCertExtensions
wolfSSL Entering GetObjectId()
wolfSSL Entering DecodeBasicCaConstraint
wolfSSL Entering GetObjectId()
wolfSSL Entering DecodeKeyUsage
wolfSSL Entering GetObjectId()
wolfSSL Entering GetObjectId()
wolfSSL Entering DecodeSubjKeyId
wolfSSL Entering GetAlgoId
wolfSSL Entering GetObjectId()
    Parsed new CA
    Freeing Parsed CA
    Freeing der CA
        OK Freeing der CA
wolfSSL Leaving AddCA, return 0
   Processed a CA
Processed at least one valid CA. Other stuff OK
wolfSSL Entering wolfSSL_CTX_use_certificate_chain_buffer
wolfSSL Entering PemToDer
Growing Tmp Chain Buffer
Processing Cert Chain
wolfSSL Entering PemToDer
   Consumed another Cert in Chain
Finished Processing Cert Chain

But the second time is when it fails;

processing certificate
Loading peer's cert chain
    Put another cert into chain
    Put another cert into chain
wolfSSL Entering GetExplicitVersion
wolfSSL Entering GetMyVersion
Got Cert Header
wolfSSL Entering GetAlgoId
wolfSSL Entering GetObjectId()
Got Algo ID
Getting Cert Name
Getting Cert Name
Failed to verify CA from chain
Verifying Peer's cert
wolfSSL Entering GetExplicitVersion
wolfSSL Entering GetMyVersion
Got Cert Header
wolfSSL Entering GetAlgoId
wolfSSL Entering GetObjectId()
Got Algo ID
Getting Cert Name
Getting Cert Name
Got Subject Name
wolfSSL Entering GetAlgoId
wolfSSL Entering GetObjectId()
wolfSSL Entering GetObjectId()
Got Key
Parsed Past Key
wolfSSL Entering DecodeCertExtensions
wolfSSL Entering GetObjectId()
wolfSSL Entering DecodeAltNames
wolfSSL Entering GetObjectId()
wolfSSL Entering DecodeBasicCaConstraint
wolfSSL Entering GetObjectId()
wolfSSL Entering DecodeKeyUsage
wolfSSL Entering GetObjectId()
wolfSSL Entering DecodeExtKeyUsage
wolfSSL Entering GetObjectId()
wolfSSL Entering GetObjectId()
wolfSSL Entering GetObjectId()
Certificate Policy extension not supported yet.
wolfSSL Entering GetObjectId()
wolfSSL Entering DecodeAuthKeyId
wolfSSL Entering GetObjectId()
wolfSSL Entering DecodeCrlDist
wolfSSL Entering GetObjectId()
wolfSSL Entering DecodeAuthInfo
wolfSSL Entering GetObjectId()
wolfSSL Entering GetObjectId()
wolfSSL Entering GetAlgoId
wolfSSL Entering GetObjectId()
About to verify certificate signature
No CA signer to verify with
Failed to verify Peer's cert
        No callback override available, fatal
wolfSSL Leaving DoHandShakeMsgType(), return -188
wolfSSL Leaving DoHandShakeMsg(), return -188
wolfSSL error occurred, error = -188
ERROR: aws_client_mqtt_connect L#193 Error(8) : Failed to TLS connect!

However, the CA is loaded only once at the beginning...
Am' I missing something? My background is not good at this point...

Thanks
Gus

I have to set the Date/Time as the error indicates the CA cert is expired.

Thanks

Hello Kaleb:

Thanks for looking into this.

I now included #define SINGLE_THREADED and also created a project level #define WOLFSSL_LWIP but I still get the same "Conflicting types Aes" error.

(in my previous post I said including SINGLE_THREADED the project compiled, but I was including a function that call the wolfssl stack so the error was still there...).

If I don't include WOLFSSL_LWIP I get additional errors...

It seems Atmel port handles this issue as in wolfssl/wolfcrypt/src/port/atmel/atmel.c these lines remap those structures;

#include <wolfssl/wolfcrypt/settings.h>

#ifdef WOLFSSL_ATMEL

#include <wolfssl/wolfcrypt/memory.h>
#include <wolfssl/wolfcrypt/error-crypt.h>
#include <wolfssl/ssl.h>
#include <wolfssl/internal.h>

#define Aes Aes_Remap
#define Gmac Gmac_Remap
#include "asf.h"
#undef Aes
#undef Gmac

#include <wolfssl/wolfcrypt/port/atmel/atmel.h>

static bool mAtcaInitDone = 0;

#ifdef WOLFSSL_ATECC508A

/* List of available key slots */

.......

but it still fails...

I would appreciate any guide on this.

Thanks

Gus