I have to 'squeeze' all the needed code to run ldaps on an embedded system. So the 3 MiB of lybcrypto and almost 700KiB of libssl are way too much.

I'm now experimenting on ldapsearch because reading from ldap is the most important goal.

I've checked with ld ldapsearch which shared objects are used by ldapsearch and i found this:

670K /usr/local/lib64/libssl.so.1.1    **
3,3M /usr/local/lib64/libcrypto.so.1.1 **
 40K  /usr/lib64/libcrypt.so.1 -> libcrypt-2.17.so
104K /usr/lib64/libresolv.so.2 -> libresolv-2.17.so
2,1M /usr/lib64/libc.so.6 -> libc-2.17.so **
 19K /usr/lib64/libdl.so.2 -> libdl-2.17.so
139K /usr/lib64/libpthread.so.0 -> libpthread-2.17.so
 12K  usr/lib64/libfreebl3.so

so the ones marked ** are the most critical

Now I have absolutely no idea how to compile this stuff starting from downloaded source and what command should I give to gcc to compile optimizing size.

I also taught if it would give space save to static-link the shared-object. (I think, based on what I read, optimizer in this case could strip most of unused code while linking as so all the entry point would be compiled anyway)

I found the optimization I could try first is -Os, I put it into cflags and lib_cflags string in Configurations/00-base-templates.conf but size is still the same

EDIT Another option I was suggested is to use strip, but I don't know how to give it to .\config

  • Please tell some details about your embedded system (processor, memory, OS, ...) If you have more than one program that needs to handle SSL connections it will probably increase the total size when you use static libraries. I guess you need special library versions optimized for space like uClibc-ng and maybe an environment to create the base system for your embedded device, e.g buildroot, yocto or ptxdist. – Bodo Feb 13 at 10:11
  • Actually the target is a PPC with 10 MiB flash memory and a custom linux. By now, ldap is the only service that will require openssl. Now I'm tasked to find out if it's viable to deploy ldaps on that system. Currently the data that will be distributed via ldap are updated by-hand on each and every device. – DDS Feb 13 at 10:44
  • @Please add all clarification to the question. How do you create the custom Linux? Does this system allow to use alternative libraries? Maybe you can replace openssl with a different library. A search for "openssl embedded" led me to "wolfssl", which seems to be used in openembedded, see layers.openembedded.org/layerindex/branch/master/layers – Bodo Feb 13 at 10:57
  • 1> I did not created the custom *nix (it's a product internal to our company) 2> I can use other libs but those must be certified for safety – DDS Feb 13 at 11:07
  • You don't necessarily need to add strip to the config file. It can be called as a command on the compiled .so file. You could try it by copying one of the pre-compiled .so files (eg /usr/local/lib64/libssl.so.1.1) and running strip on the copy. See the user manual: linux.die.net/man/1/strip – Philip Couling Feb 13 at 11:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.