Hi de2,

Please share your build settings for wolfSSL and tinycurl, please also ensure you are using the latest version of each which is currently wolfSSL 5.7.4 and tinycurl 8.4.0.  Which TLS versions/algorithms do you require for your use case?

As you are using a static library, note that the library size is not the final size as the linker will discard a significant part of the library when linking to your application.  If you are using libcurl rather than tinycurl as a standalone application you will need to link it into your application then check the size with your toolchain's size utility or with the map file generated by your compiler.  Please also ensure that you are using your compiler's size optimization option (for example -Os) and have LTO enabled.

Thanks,
Kareem

Hi yechenz37,

We don't generally recommend --enable-all as this will enable every single feature leading to an inefficient library build.  Instead we would recommend tuning your build for your use case, if you are receiving linking errors it means you are missing a build option for an API you are using.
--enable-all does not enable small stack, they are separate defines.

We do support reallocating a buffer as long as your system supports the realloc system call, this is used in a few places in the code.

Great find on LARGE_STATIC_BUFFERS, that will help avoid allocations for connections as your TLS buffer is now larger.  How many mallocs are you seeing with this option enabled?

Thanks,
Kareem

Hi yechenz37,

Please share your wolfSSL version and build settings (user_settings.h or ./configure line), in particular if you are using small stack or SP no malloc.  These settings, especially small stack, will lead to an increase in malloc/frees.
We do support fully disabling malloc when using static memory as you've found but if you only want to minimize mallocs rather than disabling them completely we can accommodate that as well.

Are you able to share any information on your project and whether it is personal or commercial?  Feel free to email us at support [AT] wolfssl [DOT] com if this information is sensitive.

Thanks,
Kareem

Hello Sunnysunday,

Those cipher suites require WOLFSSL_STATIC_PSK defined and PSK, AES/AES-CBC, TLS and SHA256 enabled.  It looks like your config is only missing WOLFSSL_STATIC_PSK, you will need to manually add this flag as it is not supported with a configure argument currently: "CFLAGS=-DWOLFSSL_STATIC_PSK" ./configure ...

Thanks,
Kareem

For the dynamic library error you need to copy the given hash into verifyCore in fips_test.c and rebuild wolfSSL.

Hi Volga,

That error means the FIPS hash was not updated correctly, you will need to update your FIPS hash or wolfSSL will not initialize.

Thanks,
Kareem

Hello volga629,

-203 IN_CORE_FIPS_E means our FIPS hash check failed.  When building wolfSSL FIPS you must update the FIPS hash after any build option/environment change, you can either run the script fips-hash.sh in the root of the wolfSSL directory or run the wolfCrypt test and copy the hash it outputs to fips_test.c.  Then rebuild and retry using wolfSSL with strongswan.

Thanks,
Kareem

Hi volga629,

You can safely disregard the message in your most recent post as it is just a warning.

For the missing references you are seeing, you will need multiple defines added to your build settings for strongswan.  Since you are using FIPS ready, you will want to start with our "WIN10" Visual Studio project and define WOLFSSL_FIPS_READY in user_settings.h: https://github.com/wolfSSL/wolfssl/tree … /IDE/WIN10
Then you will want to add the following defines to fully enable strongswan support:

#define OPENSSL_ALL
#define SESSION_CERTS
#define WOLFSSL_KEY_GEN
#define WOLFSSL_CERT_GEN
#define WOLFSSL_CERT_EXT
#define HAVE_CRL
#define WOLFSSL_CERT_REQ
#define HAVE_OCSP
#define WOLFSSL_DES_ECB
#define WOLFSSL_LOG_PRINTF
#define WOLFSSL_PUBLIC_MP
#define HAVE_EX_DATA
#define WOLFSSL_DTLS

Thanks,
Kareem

Hello volga629,

Yes, after building wolfSSL you will want to install it with "sudo make install" so your linker can find it.  Depending on wolfSSL's install path, you may need to add the path to LD_LIBRARY_PATH as well.

Thanks,
Kareem

Hello Isabella,

To enable a DTLS MTU you will need to define WOLFSSL_DTLS and WOLFSSL_DTLS_MTU.  These defines enable DTLS and enable setting the DTLS MTU.  We do support DTLS 1.3 as well which you can enable by defining WOLFSSL_DTLS13.

The implication is you're enabling DTLS which is different than TLS, it uses UDP vs TLS which uses TCP.  You can't set the MTU in TLS 1.3, we only support this for DTLS.

Thanks,
Kareem

I'm glad to hear you were able to get your connection working.
Check out our documentation on static memory here: https://www.wolfssl.com/docs/static-buffer-allocation/

Hello Happy,

After enabling CRL checking, wolfSSL will automatically check your CRL as part of the connection.
If you want to manually perform this check, you can set up a cert manager, enable CRL checking on it with wolfSSL_CertManagerEnableCRL, load your CRL with wolfSSL_CertManagerLoadCRL/wolfSSL_CertManagerLoadCRLBuffer then call wolfSSL_CertManagerCheckCRL to check the CRL: https://www.wolfssl.com/documentation/m … ercheckcrl

Thanks,
Kareem