226

(4 replies, posted in wolfSSL)

Scotty2541 wrote:

In Wolf/src/ssl.c : Line 310087  (in version 4-7) 

/* These constant values are protocol values made by egd */
#if defined(USE_WOLFSSL_IO) && !defined(USE_WINDOWS_API)
    #define WOLFSSL_EGD_NBLOCK 0x01
    #include <sys/un.h>
#endif

A couple lines above this, this compiler conditional

#ifndef FREERTOS_TCP

should be changed to:

#if !defined(FREERTOS_TCP) && !defined(WOLFSSL_TIRTOS)

Please let us know if this resolves the issue for your environment.

Hello nmehta,

In order to give you the highest priority for your FIPS question, could you please send an email to support@wolfssl.com ?

Kind regards,
Eric @wolfSSL Support

228

(4 replies, posted in wolfSSL)

Hello Scotty2541,

Sounds like there could be a missing check for TI_RTOS. Would you please let us know if this fixes the build issue?

diff --git a/src/ssl.c b/src/ssl.c
index 7432ffe73..486b3129a 100644
--- a/src/ssl.c
+++ b/src/ssl.c
@@ -31736,7 +31736,7 @@ int wolfSSL_RAND_write_file(const char* fname)
     return bytes;
 }
 
-#ifndef FREERTOS_TCP
+#if !defined(FREERTOS_TCP) && !defined(WOLFSSL_TIRTOS)
 
 /* These constant values are protocol values made by egd */
 #if defined(USE_WOLFSSL_IO) && !defined(USE_WINDOWS_API)

Kind regards,
Eric @ wolfSSL Support

Hi Tammy,

The code changes are still making their way through the review cycle.

I just pushed another commit that fixes the build errors for

--disable-ecc

.

Thanks,
Eric

Hello Tammy,

I was able to reproduce the build errors with wolfSSL configured as:

./configure --enable-ssh --disable-filesystem --disable-aesgcm

I created a pull request here:
https://github.com/wolfSSL/wolfssh/pull/328

Thanks,
Eric @ wolfSSL Support

232

(1 replies, posted in wolfSSL)

Hello iain.moir

Welcome to the wolfSSL Support Forums!

We are constantly striving to make the build process as painless as possible, but there will always be some unique environments that need a little extra effort. We are very adept at helping users to get started with the library.

Here is our QuickStart guide:
https://www.wolfssl.com/docs/quickstart/

Please email us at support@wolssl.com with any questions.

Thanks,
Eric @ wolfSSL Support

Hi cxenof03,

Welcome to the wolfSSL Forums!

The specific option for enabling TLS sessions is `HAVE_SESSION_TICKET`.

There is not currently an equivalent macro for the `./configure --enable-all` option, but you can use the "user_settings" method to get close:
https://github.com/wolfSSL/wolfssl/tree … es/configs

Here is an example that configures most of the library options:
https://github.com/wolfSSL/wolfssl/blob … ings_all.h

Thanks,
Eric @ wolfSSL Support

234

(2 replies, posted in wolfCrypt)

Hi Hu,

Welcome to the wolfSSL Support Forums!

The RIOT-OS build does not use the same instructions as the linux build for wolfSSL. Configuration changes should be made in the user_settings.h header. You should add a define for `WOLFSSL_AES_COUNTER`.

https://github.com/RIOT-OS/RIOT/blob/ma … settings.h

Thanks,
Eric @ wolfSSL Support

Hi steins,

Thanks for the project details. If you get stuck, please send an email to support@wolfssl.com where we can better prioritize your request.

Cheers,
Eric @ wolfSSL Support

Hello steins,

Thanks for joining the wolfSSL Support forums. You are trying to isolate all the functions for parsing and decoding a certificate? Any particular reason? The compiler tools should allow you to optimize any unused functionality.

What is the environment you are building in / for?

Thank,
Eric @ wolfSSL Support

237

(1 replies, posted in wolfMQTT)

Hi Shaun,

The linux wolfMQTT client does connect to mqtt.eclipseprojects.io using TLS with the default certs / config.

eric@ubuntu:~/repos/wolfMQTT$ ./examples/mqttclient/mqttclient -h mqtt.eclipseprojects.io -t
MQTT Client: QoS 0, Use TLS 1
MQTT Net Init: Success (0)
MQTT Init: Success (0)
NetConnect: Host mqtt.eclipseprojects.io, Port 8883, Timeout 5000 ms, Use TLS 1
MQTT TLS Setup (1)
MQTT TLS Verify Callback for mqttclient: PreVerify 0, Error -188 (ASN no signer error to confirm failure)
  Subject's domain name is R3
  Allowing cert anyways
MQTT TLS Verify Callback for mqttclient: PreVerify 1, Error 0 (none)
  Subject's domain name is mqtt.eclipseprojects.io
MQTT Socket Connect: Success (0)
MQTT Connect: Proto (v3.1.1), Success (0)
MQTT Connect Ack: Return Code 0, Session Present 0
MQTT Subscribe: Success (0)
  Topic wolfMQTT/example/testTopic, Qos 0, Return Code 0
MQTT Publish: Topic wolfMQTT/example/testTopic, Success (0)
MQTT Waiting for message...
MQTT Message: Topic wolfMQTT/example/testTopic, Qos 0, Len 4
Payload (0 - 4): test
MQTT Message: Done
^CReceived SIGINT
Network Error Callback: Error (Network) (error -8)
MQTT Exiting...
MQTT Unsubscribe: Success (0)
MQTT Disconnect: Success (0)
MQTT Socket Disconnect: Success (0)

Did you try forcing TLS?

Thanks,
Eric @ wolfSSL Support

Hi Gus,

Thanks for the update. Next step in debugging this would be to review a pcap of the failing handshake.

If you'd prefer to move off this public forum, please send an email to support@wolfssl.com referencing this forum thread and attach a pcap of the handshake.

Thanks,
Eric @ wolfSSL Support

Hello Gus,

While we always recommend that users are on the latest release, the version error you are seeing is likely related to the TLS protocol version in the handshake. You will probably be able to fix the issue by configuring and using a later version of the TLS protocol to establish the connection.

Please review section 4.2 PROTOCOL SUPPORT
https://www.wolfssl.com/docs/wolfssl-manual/ch4/

Thanks,
Eric @ wolfSSL Support

240

(12 replies, posted in wolfMQTT)

Hi Remy,

No, I do not think you need the pk callback option, but you mentioned earlier in the thread.

The `NO_ECC_KEY_EXPORT` define comes from here (because `HAVE_ECC` is defined):
https://github.com/wolfSSL/wolfssl/blob … gs.h#L1821

The public key is exported to the `ssl->hsKey` structure in order to compute the shared secret.

                    ret = EccSharedSecret(ssl,
                        (ecc_key*)ssl->hsKey, ssl->peerEccKey,
                        args->output + OPAQUE8_LEN, &args->length,
                        ssl->arrays->preMasterSecret + OPAQUE16_LEN,
                        &ssl->arrays->preMasterSz,
                        WOLFSSL_CLIENT_END
                    );

Hello Tom,

Yeah, the tools do not seems to like the long types. Could you try disabling this section:
https://github.com/wolfSSL/wolfssl/blob … ings.h#L83

Is this a 32-bit platform? If so, try adding:

    #undef NO_64BIT
    #define NO_64BIT

    #undef SIZEOF_LONG
    #define SIZEOF_LONG 4

    #undef SIZEOF_LONG_LONG
    #define SIZEOF_LONG_LONG 8

Hi Tom,

Thanks for contacting wolfSSL Support. Did you already follow the guide here?
https://github.com/wolfSSL/wolfssl/tree … /XilinxSDK

It should be fairly straight forward. You would want to compile and link with the IDE. Linking with code compiled for x86 would not work.

Let us know if there are issues.

Thanks,
Eric @ wolfSSL Support

Edit: Another of our engineers has a Xilinx project repo that you might find helpful:
https://github.com/dgarske/UltraZed-EG-wolf

243

(12 replies, posted in wolfMQTT)

Do you still have `--enable-pk-callback` in your configure line?

Hello bob190

Thanks for reaching out to wolfSSL Support.

We have lots of examples! Here is a cert manager example that should be helpful:
https://github.com/wolfSSL/wolfssl-exam … ertmanager

Please feel free top ask more questions!

Kind regards,
Eric @ wolfSSL Support

Hi @kicku6

As you noted, that error usually indicates a problem with the CA. Are you sure that the peer certificate was signed by the same CA as the CA cert you used? Alternatively, you can override certificate verification errors with the verify callback. Here is an example:
https://github.com/wolfSSL/wolfssl-exam … back.c#L55

246

(12 replies, posted in wolfMQTT)

The `-K` option is expecting a path to a file.

247

(12 replies, posted in wolfMQTT)

Hi Remy,

Thanks for joining the wolfSSL Forum. When you said:

Unfortunately by using this callback, WofSSL expect the verify operation to be found, but it is not supported.

Could you please share the error that you are seeing? Is it an actual verify operation failure, or just that the init is failing because the verify does not exist (NULL)?

248

(3 replies, posted in wolfSSL)

Hello rydj

Thanks for your interest in wolfSSL. It sounds like you'll want to redirect the IO using a callback. We have an excellent examples here:
https://github.com/wolfSSL/wolfssl-exam … -callbacks

We also have a wolfSSL stunnel example in a private repository. You can request access by contacting support@wolfssl.com

Thanks,
Eric @ wolfSSL Support

249

(1 replies, posted in wolfSSL)

Hello havokdu62,

There is not a released LwIP example. We have an older PR for one that you are welcome to review, but it will need some work to be updated.

https://github.com/wolfSSL/wolfssl/pull/599

Thanks,
Eric @ wolfSSL Support

250

(1 replies, posted in wolfSSL)

Hi stroebeljc

Thanks for your note. The most up to date documentation is the Doxygen created files in the repository. We are discussing a plan for  our other docs moving forward.

Thanks,
Eric @ wolfSSL Support