Hi alem,

It looks like you're failing to build the kernel helper get_thread_size.  You could try bypassing the need to build this by building with KERNEL_THREAD_STACK_SIZE=16384 make, but we generally don't expect that you should be having issues building this.
Are you confident your kernel module build environment is set up correctly?  Are you able to build any other kernel modules, even an example "hello world" module?

Please share some details on your project and whether you are using wolfSSL in a commercial or personal project.  You are welcome to email us at support [AT] wolfssl [DOT] com if this information is sensitive.

Thanks,
Kareem

Hello Sunnysunday,

Those cipher suites require WOLFSSL_STATIC_PSK defined and PSK, AES/AES-CBC, TLS and SHA256 enabled.  It looks like your config is only missing WOLFSSL_STATIC_PSK, you will need to manually add this flag as it is not supported with a configure argument currently: "CFLAGS=-DWOLFSSL_STATIC_PSK" ./configure ...

Thanks,
Kareem

For the dynamic library error you need to copy the given hash into verifyCore in fips_test.c and rebuild wolfSSL.

Hi Volga,

That error means the FIPS hash was not updated correctly, you will need to update your FIPS hash or wolfSSL will not initialize.

Thanks,
Kareem

Hello volga629,

-203 IN_CORE_FIPS_E means our FIPS hash check failed.  When building wolfSSL FIPS you must update the FIPS hash after any build option/environment change, you can either run the script fips-hash.sh in the root of the wolfSSL directory or run the wolfCrypt test and copy the hash it outputs to fips_test.c.  Then rebuild and retry using wolfSSL with strongswan.

Thanks,
Kareem

Hi volga629,

You can safely disregard the message in your most recent post as it is just a warning.

For the missing references you are seeing, you will need multiple defines added to your build settings for strongswan.  Since you are using FIPS ready, you will want to start with our "WIN10" Visual Studio project and define WOLFSSL_FIPS_READY in user_settings.h: https://github.com/wolfSSL/wolfssl/tree … /IDE/WIN10
Then you will want to add the following defines to fully enable strongswan support:

#define OPENSSL_ALL
#define SESSION_CERTS
#define WOLFSSL_KEY_GEN
#define WOLFSSL_CERT_GEN
#define WOLFSSL_CERT_EXT
#define HAVE_CRL
#define WOLFSSL_CERT_REQ
#define HAVE_OCSP
#define WOLFSSL_DES_ECB
#define WOLFSSL_LOG_PRINTF
#define WOLFSSL_PUBLIC_MP
#define HAVE_EX_DATA
#define WOLFSSL_DTLS

Thanks,
Kareem

Hello volga629,

Yes, after building wolfSSL you will want to install it with "sudo make install" so your linker can find it.  Depending on wolfSSL's install path, you may need to add the path to LD_LIBRARY_PATH as well.

Thanks,
Kareem

Hello Isabella,

To enable a DTLS MTU you will need to define WOLFSSL_DTLS and WOLFSSL_DTLS_MTU.  These defines enable DTLS and enable setting the DTLS MTU.  We do support DTLS 1.3 as well which you can enable by defining WOLFSSL_DTLS13.

The implication is you're enabling DTLS which is different than TLS, it uses UDP vs TLS which uses TCP.  You can't set the MTU in TLS 1.3, we only support this for DTLS.

Thanks,
Kareem

I'm glad to hear you were able to get your connection working.
Check out our documentation on static memory here: https://www.wolfssl.com/docs/static-buffer-allocation/

Hello Happy,

After enabling CRL checking, wolfSSL will automatically check your CRL as part of the connection.
If you want to manually perform this check, you can set up a cert manager, enable CRL checking on it with wolfSSL_CertManagerEnableCRL, load your CRL with wolfSSL_CertManagerLoadCRL/wolfSSL_CertManagerLoadCRLBuffer then call wolfSSL_CertManagerCheckCRL to check the CRL: https://www.wolfssl.com/documentation/m … ercheckcrl

Thanks,
Kareem

Hi Scott,

The two main sources of documentation on our build flags are section 2 of our manual and our user_settings.h examples:
https://www.wolfssl.com/documentation/m … ssor-macro
https://github.com/wolfSSL/wolfssl/tree … es/configs

PSK is enabled by default and doesn't need a flag to enable it.  If you wanted to disable it, you would define NO_PSK.
<wolfssl dir>/configure.ac is what translates our configure arguments into defines, but I would recommend consulting our documentation first.

Thanks,
Kareem