Topic: wolfssl tls13
Hello, I am trying to use tl 1.3 with pkcs11. I am running into an issue when calling wolfSSL_connect(), despite initializing ssl with tls 1.3 client method when wolfSSL_connect() is called "TLS 1.2 or lower" message is sent. This seems to happen in the code at
#ifdef WOLFSSL_TLS13
i (ssl.options.tls1_3) {
return wolfSSL_connect_TLSv13(ssl);
}
#endif
the macro causes the if statement to be called but it fails and wolfSSL_connect_TLSv13(ssL) is not called presumably leading to a version error on the server side. My question is where is ssl.options.tls1_3 set to 1? If it is not explicitly set and just inherits the ctx.options field then where is that happening? I have "--enabled-tls13" as well as set ctx = wolfSSL_CTX_new(wolfTLSv1_3_client_method())) == NULL.
I do want to add when I set both server and client to tls 1.2 methods the connection works.
Below is my options.h configuration.
ifdef WOLFSSL_NO_OPTIONS_H
/* options.h inhibited by configuration */
#elif !defined(WOLFSSL_OPTIONS_H)
#define WOLFSSL_OPTIONS_H
#ifdef __cplusplus
extern "C" {
#endif
#undef WOLFSSL_HAVE_ATOMIC_H
#define WOLFSSL_HAVE_ATOMIC_H
#undef WOLFSSL_HAVE_ASSERT_H
#define WOLFSSL_HAVE_ASSERT_H
#undef HAVE_C___ATOMIC
#define HAVE_C___ATOMIC 1
#undef HAVE_THREAD_LS
#define HAVE_THREAD_LS
#undef DEBUG_WOLFSSL
#define DEBUG_WOLFSSL
#undef WOLFSSL_DEBUG_CODEPOINTS
#define WOLFSSL_DEBUG_CODEPOINTS
#undef WOLFSSL_DEBUG_TRACE_ERROR_CODES
#define WOLFSSL_DEBUG_TRACE_ERROR_CODES
#undef NO_DO178
#define NO_DO178
#undef WOLFSSL_X86_64_BUILD
#define WOLFSSL_X86_64_BUILD
#undef WOLFSSL_ASN_TEMPLATE
#define WOLFSSL_ASN_TEMPLATE
#undef ERROR_QUEUE_PER_THREAD
#define ERROR_QUEUE_PER_THREAD
#undef TFM_TIMING_RESISTANT
#define TFM_TIMING_RESISTANT
#undef ECC_TIMING_RESISTANT
#define ECC_TIMING_RESISTANT
#undef WC_RSA_BLINDING
#define WC_RSA_BLINDING
#undef WOLFSSL_ARMASM_NO_HW_CRYPTO
#define WOLFSSL_ARMASM_NO_HW_CRYPTO
#undef WOLFSSL_USE_ALIGN
#define WOLFSSL_USE_ALIGN
#undef WOLFSSL_SHA224
#define WOLFSSL_SHA224
#undef WOLFSSL_SHA512
#define WOLFSSL_SHA512
#undef WOLFSSL_SHA384
#define WOLFSSL_SHA384
#undef HAVE_HKDF
#define HAVE_HKDF
#undef HAVE_ECC
#define HAVE_ECC
#undef ECC_SHAMIR
#define ECC_SHAMIR
#undef ECC_MIN_KEY_SZ
#define ECC_MIN_KEY_SZ 224
#undef HAVE_ECC_BRAINPOOL
#define HAVE_ECC_BRAINPOOL
#undef HAVE_ECC_ENCRYPT
#define HAVE_ECC_ENCRYPT
#undef NO_OLD_TLS
#define NO_OLD_TLS
#undef WC_RSA_PSS
#define WC_RSA_PSS
#undef WOLFSSL_PSS_LONG_SALT
#define WOLFSSL_PSS_LONG_SALT
#undef WOLFSSL_ASN_PRINT
#define WOLFSSL_ASN_PRINT
#undef WOLFSSL_BASE64_ENCODE
#define WOLFSSL_BASE64_ENCODE
#undef WOLFSSL_CUSTOM_CURVES
#define WOLFSSL_CUSTOM_CURVES
#undef HAVE_ECC_SECPR2
#define HAVE_ECC_SECPR2
#undef HAVE_ECC_SECPR3
#define HAVE_ECC_SECPR3
#undef HAVE_ECC_BRAINPOOL
#define HAVE_ECC_BRAINPOOL
#undef HAVE_ECC_KOBLITZ
#define HAVE_ECC_KOBLITZ
#undef HAVE_ECC_CDH
#define HAVE_ECC_CDH
#undef WOLFSSL_SHA3
#define WOLFSSL_SHA3
#undef WOLFSSL_NO_SHAKE128
#define WOLFSSL_NO_SHAKE128
#undef WOLFSSL_NO_SHAKE256
#define WOLFSSL_NO_SHAKE256
#undef HAVE_POLY1305
#define HAVE_POLY1305
#undef HAVE_CHACHA
#define HAVE_CHACHA
#undef HAVE_HASHDRBG
#define HAVE_HASHDRBG
#undef HAVE_TLS_EXTENSIONS
#define HAVE_TLS_EXTENSIONS
#undef HAVE_SNI
#define HAVE_SNI
#undef HAVE_TLS_EXTENSIONS
#define HAVE_TLS_EXTENSIONS
#undef HAVE_SUPPORTED_CURVES
#define HAVE_SUPPORTED_CURVES
#undef HAVE_FFDHE_2048
#define HAVE_FFDHE_2048
#undef HAVE_SUPPORTED_CURVES
#define HAVE_SUPPORTED_CURVES
#undef WOLFSSL_TLS13
#define WOLFSSL_TLS13
#undef HAVE_TLS_EXTENSIONS
#define HAVE_TLS_EXTENSIONS
#undef HAVE_EXTENDED_MASTER
#define HAVE_EXTENDED_MASTER
#undef HAVE_TLS_EXTENSIONS
#define HAVE_TLS_EXTENSIONS
#undef HAVE_SNI
#define HAVE_SNI
#undef HAVE_MAX_FRAGMENT
#define HAVE_MAX_FRAGMENT
#undef HAVE_TRUNCATED_HMAC
#define HAVE_TRUNCATED_HMAC
#undef HAVE_ALPN
#define HAVE_ALPN
#undef HAVE_TRUSTED_CA
#define HAVE_TRUSTED_CA
#undef HAVE_SUPPORTED_CURVES
#define HAVE_SUPPORTED_CURVES
#undef NO_RC4
#define NO_RC4
#undef HAVE_ENCRYPT_THEN_MAC
#define HAVE_ENCRYPT_THEN_MAC
#undef NO_PSK
#define NO_PSK
#undef NO_MD4
#define NO_MD4
#undef WOLFSSL_ENCRYPTED_KEYS
#define WOLFSSL_ENCRYPTED_KEYS
#undef HAVE_PKCS11
#define HAVE_PKCS11
#undef HAVE_WOLF_BIGINT
#define HAVE_WOLF_BIGINT
#undef WOLFSSL_SP_MATH_ALL
#define WOLFSSL_SP_MATH_ALL
#undef WOLFSSL_SP_X86_64
#define WOLFSSL_SP_X86_64
#undef WOLF_CRYPTO_CB
#define WOLF_CRYPTO_CB
#undef WC_NO_ASYNC_THREADING
#define WC_NO_ASYNC_THREADING
#undef HAVE_DH_DEFAULT_PARAMS
#define HAVE_DH_DEFAULT_PARAMS
#undef HAVE_CURVE25519
#define HAVE_CURVE25519
#undef HAVE_ED25519
#define HAVE_ED25519
#undef WOLFSSL_SYS_CA_CERTS
#define WOLFSSL_SYS_CA_CERTS
#undef OPENSSL_EXTRA
#define OPENSSL_EXTRA
#undef NO_DES3
#define NO_DES3
#undef NO_DES3_TLS_SUITES
#define NO_DES3_TLS_SUITES
#undef GCM_TABLE_4BIT
#define GCM_TABLE_4BIT
#undef HAVE_AESGCM
#define HAVE_AESGCM
#undef WOLFSSL_AESGCM_STREAM
#define WOLFSSL_AESGCM_STREAM
#undef HAVE_TLS_EXTENSIONS
#define HAVE_TLS_EXTENSIONS
#undef HAVE_SERVER_RENEGOTIATION_INFO
#define HAVE_SERVER_RENEGOTIATION_INFO
#undef HAVE___UINT128_T
#define HAVE___UINT128_T 1
#undef HAVE_GETPID
#define HAVE_GETPID 1
#undef HAVE_WC_INTROSPECTION
#define HAVE_WC_INTROSPECTION
#ifdef __cplusplus
}
#endif
#endif /* WOLFSSL_OPTIONS_H */