Closed flacidsnake closed 6 years ago
Hi @flacidsnake,
Could you try adding the define NO_ASN_TIME to your settings and let me know if that resolved the GMTIME issues?
Hi @flacidsnake,
I also wanted to let you know that define will disable all time checks on certificates so it should ONLY be used for testing purposes. Once you have everything working in a test environment I would highly recommend adding a solution for XGMTIME before putting anything out in the wild.
This can impact security in that you could end up trusting expired or bad certificates when connecting to peers.
Hi @kaleb-himes
First of all. Thank you very much for your fast reply.
Indeed, defining NO_ASN_TIME at settings.h an uncommenting it at wc_port.h solved the issue and I could finally compile the example wolfssl_client.ino.
But, when compilation ends, I get this message telling the sketch is too big for Leonardo:
El Sketch usa 131036 bytes (457%) del espacio de almacenamiento de programa. El máximo es 28672 bytes. Las variables Globales usan 11352 bytes (443%) de la memoria dinámica, dejando -8792 bytes para las variables locales. El máximo es 2560 bytes.
Programa muy grande: visite http://www.arduino.cc/en/Guide/Troubleshooting#size para ver cómo reducirlo. Error compilando para la tarjeta Arduino Leonardo.
Basically, the example sketch is too big. Any idea on how to make it work?
On the other hand, what I want to do with wolf_ssl is: I just want to receive HTTPS requests and parse the JSON inside them to know if the Leonardo's LED should be ON or OFF.
How can I achieve this? Maybe disabling some cipher options to reduce the size of the sketch?
Edit: How can I disable all the cipher suites and just keep TLS 1.2 with the TLS_RSA_WITH_AES_128_CBC_SHA256 cipher suite?
Thanks in advance! Regards.
@flacidsnake,
Glad to hear that got you past the build issues. To customize the build see in that same "settings.h" header where we check #ifdef WOLFSSL_USER_SETTINGS
and then include the header user_settings.h
if that is defined?
The easiest way to track changes is to add the file user_settings.h
to the library root for Arduino and then define WOLFSSL_USER_SETTINGS in settings.h so your new header gets pulled in.
Then chapter 2 of our manual has a section "2.4.1 REMOVING FEATURES" which covers the features that can be disabled to reduce build size.
If your device really only has 28k available, the smallest build of wolfSSL to date is 23k and that's with the lean-psk option. It's pretty uncommon to come across servers in the wild that support PSK.
If you configure wolfSSL to use ECC cipher suites at a minimum you'll need roughly 60K of flash available and to use RSA cipher suites you'll need closer to 80K of flash. With such a limited flash space I am not sure you will be able to get SSL/TLS running on your device. Do you have an alternate platform you can use with more flash space?
@flacidsnake,
I never heard back from you on this item, is your device really limited to just 28K of flash? If so were you able to evaluate using a device with more available flash?
Warm Regards,
K
Hi,
I know this is closed, but I'm having similar problems as @AnthonyDeroche at #539
After doing what he posted, I'm having these compilation problems:
arduino-1.8.5\libraries\wolfssl/wolfssl/wolfcrypt/wc_port.h:469:31: error: expected unqualified-id before 'const'
E:\arduino-1.8.5\libraries\wolfssl/wolfssl/wolfcrypt/wc_port.h:469:31: error: expected ')' before 'const'
E:\arduino-1.8.5\libraries\wolfssl/wolfssl/wolfcrypt/wc_port.h:469:31: error: expected initializer before 'const'
exit status 1 Error compilando para la tarjeta Arduino Leonardo.
Files I think are involved are pasted below. Please, any clue? Thanks in advance
My file settings.h ` / settings.h
/ Place OS specific preprocessor flags, defines, includes here, will be included into every file because types.h includes it /
define XTIME fnSecondsSinceEpoch
define XGMTIME
ifndef WOLF_CRYPT_SETTINGS_H
define WOLF_CRYPT_SETTINGS_H
ifdef __cplusplus
endif
/ Uncomment next line if using IPHONE / / #define IPHONE /
/ Uncomment next line if using ThreadX / / #define THREADX /
/ Uncomment next line if using Micrium uC/OS-III / / #define MICRIUM /
/ Uncomment next line if using Mbed / / #define MBED /
/ Uncomment next line if using Microchip PIC32 ethernet starter kit / / #define MICROCHIP_PIC32 /
/ Uncomment next line if using Microchip TCP/IP stack, version 5 / / #define MICROCHIP_TCPIP_V5 /
/ Uncomment next line if using Microchip TCP/IP stack, version 6 or later / / #define MICROCHIP_TCPIP /
/ Uncomment next line if using PIC32MZ Crypto Engine / / #define WOLFSSL_MICROCHIP_PIC32MZ /
/ Uncomment next line if using FreeRTOS / / #define FREERTOS /
/ Uncomment next line if using FreeRTOS+ TCP / / #define FREERTOS_TCP /
/ Uncomment next line if using FreeRTOS Windows Simulator / / #define FREERTOS_WINSIM /
/ Uncomment next line if using RTIP / / #define EBSNET /
/ Uncomment next line if using lwip / / #define WOLFSSL_LWIP /
/ Uncomment next line if building wolfSSL for a game console / / #define WOLFSSL_GAME_BUILD /
/ Uncomment next line if building wolfSSL for LSR / / #define WOLFSSL_LSR /
/ Uncomment next line if building for Freescale Classic MQX/RTCS/MFS / / #define FREESCALE_MQX /
/ Uncomment next line if building for Freescale KSDK MQX/RTCS/MFS / / #define FREESCALE_KSDK_MQX /
/ Uncomment next line if building for Freescale KSDK Bare Metal / / #define FREESCALE_KSDK_BM /
/ Uncomment next line if building for Freescale KSDK FreeRTOS (old name FREESCALE_FREE_RTOS) / / #define FREESCALE_KSDK_FREERTOS /
/ Uncomment next line if using STM32F2 / / #define WOLFSSL_STM32F2 /
/ Uncomment next line if using STM32F4 / / #define WOLFSSL_STM32F4 /
/ Uncomment next line if using STM32F7 / / #define WOLFSSL_STM32F7 /
/ Uncomment next line if using QL SEP settings / / #define WOLFSSL_QL /
/ Uncomment next line if building for EROAD / / #define WOLFSSL_EROAD /
/ Uncomment next line if building for IAR EWARM / / #define WOLFSSL_IAR_ARM /
/ Uncomment next line if building for Rowley CrossWorks ARM / / #define WOLFSSL_ROWLEY_ARM /
/ Uncomment next line if using TI-RTOS settings / / #define WOLFSSL_TIRTOS /
/ Uncomment next line if building with PicoTCP / / #define WOLFSSL_PICOTCP /
/ Uncomment next line if building for PicoTCP demo bundle / / #define WOLFSSL_PICOTCP_DEMO /
/ Uncomment next line if building for uITRON4 / / #define WOLFSSL_uITRON4 /
/ Uncomment next line if building for uT-Kernel / / #define WOLFSSL_uTKERNEL2 /
/ Uncomment next line if using Max Strength build / / #define WOLFSSL_MAX_STRENGTH /
/ Uncomment next line if building for VxWorks / / #define WOLFSSL_VXWORKS /
/ Uncomment next line if building for Nordic nRF5x platofrm / / #define WOLFSSL_NRF5x /
/ Uncomment next line to enable deprecated less secure static DH suites / / #define WOLFSSL_STATIC_DH /
/ Uncomment next line to enable deprecated less secure static RSA suites / / #define WOLFSSL_STATIC_RSA /
/ Uncomment next line if building for ARDUINO / / Uncomment both lines if building for ARDUINO on INTEL_GALILEO /
define WOLFSSL_ARDUINO
//#define NO_INLINE // Don't know if this is mandatory for Leonardo / #define INTEL_GALILEO /
/ Uncomment next line to enable asynchronous crypto WC_PENDING_E / / #define WOLFSSL_ASYNC_CRYPT /
/ Uncomment next line if building for uTasker / / #define WOLFSSL_UTASKER /
/ Uncomment next line if building for embOS / / #define WOLFSSL_EMBOS /
/ Uncomment next line if building for RIOT-OS / / #define WOLFSSL_RIOT_OS /
/ Uncomment next line if building for using XILINX hardened crypto / / #define WOLFSSL_XILINX_CRYPT /
/ Uncomment next line if building for using XILINX / / #define WOLFSSL_XILINX /
include <wolfssl/wolfcrypt/visibility.h>
ifdef WOLFSSL_USER_SETTINGS
endif
/ make sure old RNG name is used with CTaoCrypt FIPS /
ifdef HAVE_FIPS
endif
if defined(_WIN32) && !defined(_M_X64) && \
/* The _M_X64 macro is what's used in the headers for MSC to tell if it
unrolling. */
define AES_GCM_AESNI_NO_UNROLL
endif
ifdef IPHONE
endif
ifdef THREADX
endif
ifdef HAVE_NETX
endif
if defined(HAVE_LWIP_NATIVE) / using LwIP native TCP socket /
endif
if defined(WOLFSSL_IAR_ARM) || defined(WOLFSSL_ROWLEY_ARM)
endif
ifdef MICROCHIP_PIC32
endif
ifdef WOLFSSL_MICROCHIP_PIC32MZ
endif
ifdef MICROCHIP_TCPIP_V5
endif
ifdef MICROCHIP_TCPIP
endif
ifdef MBED
endif
ifdef WOLFSSL_EROAD
endif
ifdef WOLFSSL_PICOTCP
endif
ifdef WOLFSSL_PICOTCP_DEMO
endif
ifdef FREERTOS_WINSIM
endif
ifdef WOLFSSL_VXWORKS
endif
ifdef WOLFSSL_ARDUINO
endif
ifdef WOLFSSL_UTASKER
endif
ifdef WOLFSSL_EMBOS
endif
ifdef WOLFSSL_RIOT_OS
endif
ifdef WOLFSSL_CHIBIOS
endif
ifdef WOLFSSL_NRF5x
endif
/ Micrium will use Visual Studio for compilation but not the Win32 API /
if defined(_WIN32) && !defined(MICRIUM) && !defined(FREERTOS) && \
endif
if defined(WOLFSSL_uITRON4)
define XMALLOC_USER
include
define ITRON_POOL_SIZE 1024*20
extern int uITRON4_minit(size_t poolsz) ; extern void uITRON4_malloc(size_t sz) ; extern void uITRON4_realloc(void p, size_t sz) ; extern void uITRON4_free(void p) ;
define XMALLOC(sz, heap, type) uITRON4_malloc(sz)
define XREALLOC(p, sz, heap, type) uITRON4_realloc(p, sz)
define XFREE(p, heap, type) uITRON4_free(p)
endif
if defined(WOLFSSL_uTKERNEL2)
ifndef NO_TKERNEL_MEM_POOL
endif
ifndef NO_STDIO_FGETS_REMAP
endif / !NO_STDIO_FGETS_REMAP /
endif
if defined(WOLFSSL_LEANPSK) && !defined(XMALLOC_USER)
endif
if defined(XMALLOC_USER) && defined(SSN_BUILDING_LIBYASSL)
endif
ifdef FREERTOS
endif
ifdef FREERTOS_TCP
endif
ifdef WOLFSSL_TIRTOS
endif
ifdef EBSNET
endif / EBSNET /
ifdef WOLFSSL_GAME_BUILD
endif
ifdef WOLFSSL_LSR
endif
ifdef WOLFSSL_SAFERTOS
endif
ifdef WOLFSSL_LOW_MEMORY
endif
ifdef FREESCALE_MQX
endif
ifdef FREESCALE_KSDK_MQX
endif / FREESCALE_KSDK_MQX /
if defined(FREESCALE_FREE_RTOS) || defined(FREESCALE_KSDK_FREERTOS)
endif / FREESCALE_FREE_RTOS || FREESCALE_KSDK_FREERTOS /
ifdef FREESCALE_KSDK_BM
endif / FREESCALE_KSDK_BM /
ifdef FREESCALE_COMMON
endif / FREESCALE_COMMON /
/ Classic pre-KSDK mmCAU library /
ifdef FREESCALE_USE_MMCAU_CLASSIC
endif
/ KSDK mmCAU library /
ifdef FREESCALE_USE_MMCAU
endif / FREESCALE_USE_MMCAU /
ifdef FREESCALE_USE_LTC
endif / FREESCALE_USE_LTC /
ifdef FREESCALE_LTC_TFM_RSA_4096_ENABLE
endif / FREESCALE_LTC_TFM_RSA_4096_ENABLE /
/ if LTC has AES engine but doesn't have GCM, use software with LTC AES ECB mode /
if defined(FREESCALE_USE_LTC) && !defined(FREESCALE_LTC_AES_GCM)
endif
if defined(WOLFSSL_STM32F2) || defined(WOLFSSL_STM32F4) || \
endif / WOLFSSL_STM32F2 || WOLFSSL_STM32F4 || WOLFSSL_STM32F7 /
ifdef MICRIUM
endif / MICRIUM /
ifdef WOLFSSL_QL
endif / WOLFSSL_QL /
if defined(WOLFSSL_XILINX)
endif
if defined(WOLFSSL_XILINX_CRYPT)
endif /(WOLFSSL_XILINX_CRYPT)/
ifdef WOLFSSL_IMX6
endif
/ if defined turn on all CAAM support /
ifdef WOLFSSL_IMX6_CAAM
if defined(HAVE_AESGCM) || defined(WOLFSSL_AES_XTS)
endif
endif
if !defined(XMALLOC_USER) && !defined(MICRIUM_MALLOC) && \
endif
if defined(OPENSSL_EXTRA) && !defined(NO_CERTS)
endif
/ stream ciphers except arc4 need 32bit alignment, intel ok without /
ifndef XSTREAM_ALIGN
endif
/* write dup cannot be used with secure renegotiation because write dup
if defined(HAVE_WRITE_DUP) && defined(HAVE_SECURE_RENEGOTIATION)
error "WRITE DUP and SECURE RENEGOTIATION cannot both be on"
endif
ifdef WOLFSSL_SGX
endif / WOLFSSL_SGX /
/ FreeScale MMCAU hardware crypto has 4 byte alignment. However, KSDK fsl_mmcau.h gives API with no alignment requirements (4 byte alignment is managed internally by fsl_mmcau.c) /
ifdef FREESCALE_MMCAU
endif
/ if using hardware crypto and have alignment requirements, specify the requirement here. The record header of SSL/TLS will prevent easy alignment. This hint tries to help as much as possible. /
ifndef WOLFSSL_GENERAL_ALIGNMENT
endif
if defined(WOLFSSL_GENERAL_ALIGNMENT) && (WOLFSSL_GENERAL_ALIGNMENT > 0)
else
endif
ifdef HAVE_CRL
endif
ifdef __INTEL_COMPILER
endif
/* user can specify what curves they want with ECC_USER_CURVES otherwise
ifndef ECC_USER_CURVES
if !defined(WOLFSSL_SP_MATH) && !defined(HAVE_ALL_CURVES)
endif
endif
/ ECC Configs /
ifdef HAVE_ECC
endif / HAVE_ECC /
/ Curve255519 Configs /
ifdef HAVE_CURVE25519
endif / HAVE_CURVE25519 /
/ Ed255519 Configs /
ifdef HAVE_ED25519
endif / HAVE_ED25519 /
/ AES Config /
ifndef NO_AES
endif
/ if desktop type system and fastmath increase default max bits /
ifdef WOLFSSL_X86_64_BUILD
endif
/ If using the max strength build, ensure OLD TLS is disabled. /
ifdef WOLFSSL_MAX_STRENGTH
endif
/ Default AES minimum auth tag sz, allow user to override /
ifndef WOLFSSL_MIN_AUTH_TAG_SZ
endif
/* sniffer requires:
ifdef WOLFSSL_SNIFFER
ifndef WOLFSSL_STATIC_RSA
endif
ifndef WOLFSSL_SESSION_STATS
endif
ifndef WOLFSSL_PEAK_SESSIONS
endif
endif
/* Decode Public Key extras on by default, user can turn off with
ifndef WOLFSSL_NO_DECODE_EXTRA
ifndef RSA_DECODE_EXTRA
endif
ifndef ECC_DECODE_EXTRA
endif
endif
/ C Sharp wrapper defines /
ifdef HAVE_CSHARP
endif
/ Asynchronous Crypto /
ifdef WOLFSSL_ASYNC_CRYPT
endif / WOLFSSL_ASYNC_CRYPT /
ifndef WC_ASYNC_DEV_SIZE
endif
/ leantls checks /
ifdef WOLFSSL_LEANTLS
endif / WOLFSSL_LEANTLS/
/ restriction with static memory /
ifdef WOLFSSL_STATIC_MEMORY
endif / WOLFSSL_STATIC_MEMORY /
ifdef HAVE_AES_KEYWRAP
endif
ifdef HAVE_PKCS7
endif
if !defined(WOLFCRYPT_ONLY) && !defined(NO_OLD_TLS) && \
endif
/ for backwards compatibility /
if defined(TEST_IPV6) && !defined(WOLFSSL_IPV6)
endif
/ Place any other flags or defines here /
if defined(WOLFSSL_MYSQL_COMPATIBLE) && defined(_WIN32) \
endif / WOLFSSL_MYSQL_COMPATIBLE /
if defined(WOLFSSL_NGINX) || defined(WOLFSSL_HAPROXY)
endif
if defined(WOLFSSL_NGINX)
endif
/ both CURVE and ED small math should be enabled /
ifdef CURVED25519_SMALL
endif
ifndef WOLFSSL_ALERT_COUNT_MAX
endif
/ warning for not using harden build options (default with ./configure) /
ifndef WC_NO_HARDEN
endif
if defined(NO_OLD_WC_NAMES) || defined(OPENSSL_EXTRA)
endif
/* switch for compatibility layer functionality. Has subparts i.e. BIO/X509
ifdef OPENSSL_EXTRA
undef OPENSSL_EXTRA_X509_SMALL
define OPENSSL_EXTRA_X509_SMALL
endif / OPENSSL_EXTRA /
ifdef __cplusplus
endif
endif
`
_My file wcport.h ` / wc_port.h
/! \file wolfssl/wolfcrypt/wc_port.h /
ifndef WOLF_CRYPT_PORT_H
define WOLF_CRYPT_PORT_H
include <wolfssl/wolfcrypt/settings.h>
include <wolfssl/wolfcrypt/visibility.h>
ifdef __cplusplus
endif
ifdef USE_WINDOWS_API
elif defined(THREADX)
elif defined(MICRIUM)
elif defined(FREERTOS) || defined(FREERTOS_TCP) || defined(WOLFSSL_SAFERTOS)
elif defined(EBSNET)
elif defined(FREESCALE_MQX) || defined(FREESCALE_KSDK_MQX)
elif defined(FREESCALE_FREE_RTOS)
elif defined(WOLFSSL_uITRON4)
elif defined(WOLFSSL_uTKERNEL2)
elif defined(WOLFSSL_CMSIS_RTOS)
elif defined(WOLFSSL_MDK_ARM)
elif defined(WOLFSSL_CMSIS_RTOS)
elif defined(WOLFSSL_TIRTOS)
elif defined(WOLFSSL_FROSTED)
elif defined(INTIME_RTOS)
else
endif
/ For FIPS keep the function names the same /
ifdef HAVE_FIPS
define wc_InitMutex InitMutex
define wc_FreeMutex FreeMutex
define wc_LockMutex LockMutex
define wc_UnLockMutex UnLockMutex
endif / HAVE_FIPS /
ifdef SINGLE_THREADED
else / MULTI_THREADED /
endif / SINGLE_THREADED /
/ Enable crypt HW mutex for Freescale MMCAU or PIC32MZ /
if defined(FREESCALE_MMCAU) || defined(WOLFSSL_MICROCHIP_PIC32MZ)
endif / FREESCALE_MMCAU /
ifndef WOLFSSL_CRYPT_HW_MUTEX
endif
if WOLFSSL_CRYPT_HW_MUTEX
else
endif / WOLFSSL_CRYPT_HW_MUTEX /
/ Mutex functions / WOLFSSL_API int wc_InitMutex(wolfSSL_Mutex); WOLFSSL_API wolfSSL_Mutex wc_InitAndAllocMutex(void); WOLFSSL_API int wc_FreeMutex(wolfSSL_Mutex); WOLFSSL_API int wc_LockMutex(wolfSSL_Mutex); WOLFSSL_API int wc_UnLockMutex(wolfSSL_Mutex*);
if defined(OPENSSL_EXTRA) || defined(HAVE_WEBSERVER)
/ dynamiclly set which mutex to use. unlock / lock is controlled by flag / typedef void (mutex_cb)(int flag, int type, const char* file, int line);
WOLFSSL_API int wc_LockMutex_ex(int flag, int type, const char file, int line); WOLFSSL_API int wc_SetMutexCb(mutex_cb cb);
endif
/ main crypto initialization function / WOLFSSL_API int wolfCrypt_Init(void); WOLFSSL_API int wolfCrypt_Cleanup(void);
/ filesystem abstraction layer, used by ssl.c /
ifndef NO_FILESYSTEM
if defined(EBSNET)
elif defined(LSR_FS)
elif defined(FREESCALE_MQX) || defined(FREESCALE_KSDK_MQX)
elif defined(MICRIUM)
else
endif
if !defined(NO_WOLFSSL_DIR)
endif / !NO_WOLFSSL_DIR /
endif / !NO_FILESYSTEM /
/ Windows API defines its own min() macro. /
if defined(USE_WINDOWS_API)
endif / USE_WINDOWS_API /
/ Time functions /
ifndef NO_ASN_TIME
if defined(USER_TIME)
elif defined(TIME_OVERRIDES)
elif defined(HAVE_RTP_SYS)
elif defined(MICRIUM)
elif defined(MICROCHIP_TCPIP_V5) || defined(MICROCHIP_TCPIP)
elif defined(FREESCALE_MQX) || defined(FREESCALE_KSDK_MQX)
elif defined(FREESCALE_KSDK_BM) || defined(FREESCALE_FREE_RTOS) || defined(FREESCALE_KSDK_FREERTOS)
elif defined(WOLFSSL_ATMEL)
elif defined(IDIRECT_DEV_TIME)
elif defined(_WIN32_WCE)
else
endif
/ Map default time functions /
if !defined(XTIME) && !defined(TIME_OVERRIDES) && !defined(USER_TIME)
endif
if !defined(XGMTIME) && !defined(TIME_OVERRIDES)
endif
if !defined(XVALIDATE_DATE) && !defined(HAVE_VALIDATE_DATE)
endif
/ wolf struct tm and time_t /
if defined(USE_WOLF_TM)
endif / USE_WOLF_TM /
if defined(USE_WOLF_TIME_T)
endif
/ forward declarations /
if defined(USER_TIME)
elif defined(TIME_OVERRIDES)
elif defined(WOLFSSL_GMTIME)
endif
endif / NO_ASN_TIME /
ifdef __cplusplus
endif
endif / WOLF_CRYPT_PORT_H /
`