The developers of the wolfSSL cryptographic library are advancing the wolfIP TCP/IP stack, optimized for use on embedded devices with limited resources, as well as for systems operating in real-time mode and solutions requiring enhanced reliability (Safety-Critical). To ensure predictable resource consumption, dynamic memory allocation is not used in wolfIP — all buffers and socket tables have a fixed size and are configurable at compile time. The project code is written in C and is distributed under the GPLv3 license.
The project can be used as a user-space TCP/IP stack, replacing the network stack of Linux, FreeBSD, and macOS, and is also suitable for use in embedded systems based on FreeRTOS, SafeRTOS, Zephyr, Azure RTOS ThreadX, NuttX, RTEMS, VxWorks, and QNX. Additionally, wolfIP can be used to create self-contained network applications that run on bare metal. When combined with the wolfSSL library, it supports TLS 1.3, allowing the creation of compact embedded systems that support HTTPS.
Key features of wolfIP:
- Use of pre-allocated static memory buffers for processing network packets. Calls to malloc and free are not used.
- Ability to be used instead of standard system network stacks on POSIX systems.
- Support for BSD sockets in both non-blocking and blocking modes.
- Compact size (4200 lines of code, four times smaller than the lwIP TCP/IP stack).
- Support for STM32 Ethernet network interfaces.
- Ability to use TAP network interface for testing operation without hardware.
- Development with a focus on systems with high security requirements: deterministic and reproducible configuration; a deployment model that ensures security (Secure-by-default); isolation between components. Support for secure version updates; long-term maintenance.
- Consideration of high-reliability system requirements: no dynamic resource allocation; fixed memory pools; controlled resource use; predictable behavior; simplified architecture; support for artifact generation for verification.
- Implementation of IPv4, UDP, TCP, IPSEC, ARP, ICMP, DHCP client, DNS client, and HTTP/HTTPS server. Support for TCP RFC 7323 (TCP Timestamps, RTT measurement, PAWS, Window Scaling), MSS (Maximum Segment Size), RTO (Retransmission timeout), and SACK (Selective Acknowledgment). Several congestion control algorithms.
Among the limitations of wolfIP is its use only as an endpoint capable of establishing and accepting connections but not supporting traffic routing between network interfaces.
Additionally, it is worth noting the active development by a Red Hat employee of a similar TCP/IP stack, passt, which operates in user space and does not use dynamic memory allocation. The passt project is being developed to establish a communication channel between the host environment and guest systems in QEMU as a more secure replacement for libslirp. The passt code is written in C, consists of about 5000 lines, and is distributed under the GPLv2+ license.
Key features of passt include: support for IPv6 in addition to IPv4, optimizations based on AVX2 instructions, protection against synflood, built-in support for QEMU, libvirt, and Podman, packages for all popular distributions, ARP proxy service, minimalist DHCPD, DHCPv6, and NDP servers, seccomp profile to block all unused system calls, NAT support, and the ability to be used as a transparent replacement for slirp4netns.
Source: opennet.ru
