Fully disabled TLS 1.2

.github/configs/os-check-linux.json

@@ -425,6 +425,19 @@
   "--disable-sha512", "--disable-sha3", "--enable-aesgcm=small", "--enable-sp-math",
   "--enable-sp=smallec256", "--disable-sp-asm",
   "CPPFLAGS=-DNO_WOLFSSL_SERVER -DWOLFSSL_NO_TLS12 -DNO_SESSION_CACHE -DWOLFSSL_AES_NO_UNROLL -DUSE_SLOW_SHA256 -DWOLFSSL_NO_ASYNC_IO -DWOLFSSL_DTLS_ONLY"]},
+{"name": "no-tlsv12-ocspstapling",
+ "comment": "--disable-tlsv12 with the two feature axes that reach TLS 1.2-only code from a TLS 1.3 build: OCSP stapling, whose chain-status path calls ProcessCSR_ex, and the OpenSSL compatibility layer, which is where most of the tests that hard-code a TLS 1.2 method live. Nothing else covers the plain option - dtls13-client-minimal above reaches the define through CPPFLAGS and strips most of the crypto with it, and psk.yml's static-psk-lowresource-tls13 pairs it with --disable-asn.",
+ "configure": ["--disable-tlsv12", "--enable-ocspstapling", "--enable-opensslextra"]},
+{"name": "no-tlsv12-ocspstapling2",
+ "comment": "status_request_v2 without status_request, which is the one stapling shape where the TLS 1.3 chain-status path is not compiled: ProcessCSR_ex then has only its TLS 1.2 caller, so compiling TLS 1.2 out left it with none and -Wunused-function broke the build. no-tlsv12-ocspstapling above enables v1 and cannot reach it.",
+ "configure": ["--disable-tlsv12", "--enable-ocspstapling2"]},
+{"name": "no-tlsv12-dtls13",
+ "comment": "DTLS 1.3 with the TLS 1.2 handshake compiled out, both sides. dtls13-client-minimal above covers the same version pair but is client-only through NO_WOLFSSL_SERVER, so the DTLS 1.3 server path under WOLFSSL_NO_TLS12 has no other coverage. This is also the one combination configure still accepts once TLS 1.2 is gone: DTLS without --enable-dtls13 is rejected, because DTLS 1.2 is the TLS 1.2 handshake. Connection ID and session tickets are on because both pull in DTLS 1.2-only test and record-layer code that the version gating has to reach.",
+ "configure": ["--disable-tlsv12", "--enable-dtls", "--enable-dtls13",
+  "--enable-dtlscid", "--enable-session-ticket"]},
+{"name": "no-tlsv12-sniffer",
+ "comment": "The sniffer picks its master-secret derivation, resumption key derivation, Finished parsing and record decryption by version, and with WOLFSSL_NO_TLS12 only the TLS 1.3 halves of those are compiled in. sniffer-curves-enckeys keeps TLS 1.2 enabled, so it never builds them that way; scripts/sniffer-testsuite.test probes snifftest for the versions it was built with and runs the TLS 1.3 legs here.",
+ "configure": ["--enable-sniffer", "--disable-tlsv12"]},
 {"name": "opensslextra-no-filesystem-no-bio", "minutes": 0.9,
  "configure": ["--enable-opensslextra", "--disable-filesystem", "CPPFLAGS=-DNO_BIO"]},
 {"name": "no-examples-no-malloc", "minutes": 0.8,

CMakeLists.txt

@@ -1918,12 +1918,6 @@ add_option("WOLFSSL_TLSV12"
     "Enable TLS versions 1.2 (default: enabled)"
     "yes" "yes;no")
 
-if(NOT WOLFSSL_TLSV12)
-    list(APPEND WOLFSSL_DEFINITIONS
-        "-DWOLFSSL_NO_TLS12"
-        "-DNO_OLD_TLS")
-endif()
-
 # TODO: - TLSv1.0
 #       - SSLv3
 #       - Stack size
@@ -2571,6 +2565,34 @@ if (WOLFSSL_TLS13)
         )
 endif()
 
+if(NOT WOLFSSL_TLSV12)
+    # Compiling the pre-TLS-1.3 handshake out leaves the versions built on
+    # top of it with nothing to run on, so reject them the way configure does.
+    if(WOLFSSL_OLD_TLS)
+        message(FATAL_ERROR
+            "WOLFSSL_TLSV12=no cannot be combined with WOLFSSL_OLD_TLS=yes: "
+            "TLS 1.0 and 1.1 use the TLS 1.2 handshake.")
+    endif()
+    if(NOT WOLFSSL_TLS13)
+        message(FATAL_ERROR
+            "WOLFSSL_TLSV12=no needs WOLFSSL_TLS13=yes: no TLS version would "
+            "be left to negotiate.")
+    endif()
+    if(WOLFSSL_MCAST)
+        message(FATAL_ERROR
+            "WOLFSSL_TLSV12=no cannot be combined with WOLFSSL_MCAST: "
+            "multicast rides on DTLS 1.2 and its NULL cipher suite.")
+    endif()
+    if(WOLFSSL_DTLS AND NOT WOLFSSL_DTLS13)
+        message(FATAL_ERROR
+            "WOLFSSL_TLSV12=no with WOLFSSL_DTLS=yes needs WOLFSSL_DTLS13=yes: "
+            "DTLS 1.2 uses the TLS 1.2 handshake.")
+    endif()
+    # NO_OLD_TLS is already in the list: the check above leaves
+    # WOLFSSL_OLD_TLS off, which is what adds it.
+    list(APPEND WOLFSSL_DEFINITIONS "-DWOLFSSL_NO_TLS12")
+endif()
+
 # Session Ticket Extension
 add_option("WOLFSSL_SESSION_TICKET"
     "Enable Session Ticket (default: disabled)"

ChangeLog.md

@@ -2,6 +2,29 @@
 
 ## Behavioral Changes
 
+* **Behavioral change (`--disable-tlsv12` compiles TLS 1.2 out)**: the option
+  set the summary line and a few derived settings, but never defined
+  `WOLFSSL_NO_TLS12`, so the whole TLS 1.2 implementation was still built and a
+  peer could still negotiate it.  The only place the define was added is a FIPS
+  bundle, whose condition skips it when the user asked for the option, so no
+  autotools configuration reached it; the CMake `WOLFSSL_TLSV12=no` path was
+  unaffected.  The option now defines it, which is what the bundles that turn
+  the version off, `--enable-tinytls13` among them, have been documented as
+  doing.  A build that passes `--disable-tlsv12` and still expects to negotiate
+  TLS 1.2 has to stop passing it.  Because the pre-TLS-1.3 handshake is now
+  compiled out, configure rejects the combinations that depend on it:
+  `--enable-oldtls`, which builds on the TLS 1.2 handshake; TLS 1.3 off, which
+  would leave no version to negotiate; and DTLS without DTLS 1.3, for the same
+  reason on the datagram side; and multicast, which rides on DTLS 1.2 and its
+  NULL cipher suite.  CMake rejects the same four for `-DWOLFSSL_TLSV12=no`;
+  it used to accept `-DWOLFSSL_OLD_TLS=yes` beside it and define `NO_OLD_TLS`
+  anyway, so the reported option and the build disagreed.  The sniffer, the
+  examples and the test suite pick their code paths by version where they used
+  to assume TLS 1.2 was present, so `--disable-tlsv12`, that with
+  `--enable-ocspstapling --enable-opensslextra`, `--enable-sniffer
+  --disable-tlsv12` and `--enable-dtls --enable-dtls13 --enable-dtlscid
+  --enable-session-ticket --disable-tlsv12` now build and test cleanly.
+
 * **Behavioral change (`wc_PufReadSram` health tests the raw SRAM readout)**:
   the raw readout is now health tested before the context accepts it, and a
   readout that cannot be SRAM power-on noise is rejected with `PUF_READ_E`

configure.ac

@@ -9424,6 +9424,18 @@ then
     AM_CFLAGS="$AM_CFLAGS -DNO_SESSION_CACHE"
 fi
 
+# Compile out TLS 1.2 itself, not just its derived settings. Runs after the
+# bundles that turn the version off, so --enable-tinytls13 and friends land
+# here too. The check keeps the option idempotent for the FIPS bundles that
+# add the define themselves.
+if test "$ENABLED_TLSV12" = "no"
+then
+    case "$AM_CFLAGS" in
+        *-DWOLFSSL_NO_TLS12*) ;;
+        *) AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_NO_TLS12" ;;
+    esac
+fi
+
 # PKCS7
 AC_ARG_ENABLE([pkcs7],
     [AS_HELP_STRING([--enable-pkcs7],[Enable PKCS7 (default: disabled)])],
@@ -13103,6 +13115,30 @@ AS_IF([(test "x$ENABLED_DTLS" = "xno") && \
       [AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_DTLS"
        ENABLED_DTLS=yes])
 
+# --disable-tlsv12 compiles the pre-TLS-1.3 handshake out, so the versions and
+# features built on top of it cannot be left on, and something has to be left
+# to negotiate. Runs here because old TLS, DTLS and the version flags are all
+# final by this point.
+if test "$ENABLED_TLS" != "no" && test "$ENABLED_TLSV12" = "no"
+then
+    if test "$ENABLED_OLD_TLS" = "yes"
+    then
+        AC_MSG_ERROR([cannot disable tlsv12 while old TLS is enabled: TLS 1.0 and 1.1 use the TLS 1.2 handshake. Add --disable-oldtls, and drop --enable-tlsv10 or --enable-sslv3 if passed, since they turn it back on.])
+    fi
+    if test "$ENABLED_TLS13" = "no"
+    then
+        AC_MSG_ERROR([cannot disable tlsv12 with tls13 disabled: no TLS version would be left to negotiate.])
+    fi
+    if test "$ENABLED_MCAST" = "yes"
+    then
+        AC_MSG_ERROR([cannot disable tlsv12 with mcast enabled: multicast rides on DTLS 1.2 and its NULL cipher suite. Add --disable-mcast.])
+    fi
+    if test "$ENABLED_DTLS" = "yes" && test "$ENABLED_DTLS13" = "no"
+    then
+        AC_MSG_ERROR([cannot disable tlsv12 while DTLS is enabled without dtls13: DTLS 1.2 uses the TLS 1.2 handshake. Add --enable-dtls13, or drop what enables DTLS (sctp, srtp, mcast and strongswan turn it on too).])
+    fi
+fi
+
 # Multicast requires the null cipher
 AS_IF([test "x$ENABLED_NULL_CIPHER" = "xno" && \
         test "x$ENABLED_MCAST" = "xyes"],

examples/benchmark/dtls_bench.c

@@ -124,6 +124,7 @@ static double now_sec(void)
     return (double)ts.tv_sec + (double)ts.tv_nsec / 1e9;
 }
 
+#ifndef NO_WOLFSSL_CLIENT
 /* Post-handshake send sink. Pretends every byte was transmitted but does
  * nothing; the kernel's UDP/IP path never runs. Used via -z to measure the
  * pure wolfSSL encrypt-and-frame ceiling, free of any I/O cost. */
@@ -132,6 +133,7 @@ static int dtls_bench_sink_send(WOLFSSL* ssl, char* buf, int sz, void* ctx)
     (void)ssl; (void)buf; (void)ctx;
     return sz;
 }
+#endif /* !NO_WOLFSSL_CLIENT */
 
 static void print_stats(const char* dir, long long bytes, double sec)
 {
@@ -338,6 +340,9 @@ static int bind_to_iface(int fd, const char* ifname)
 #endif
 }
 
+/* Only the DTLS legs below need these; the plain-UDP baseline does not. */
+#if !defined(NO_WOLFSSL_SERVER) || !defined(NO_WOLFSSL_CLIENT)
+
 static WOLFSSL_METHOD* pick_method(int version, int isServer)
 {
     if (version == 13) {
@@ -404,6 +409,8 @@ static int set_mtu(WOLFSSL* ssl, int mtu)
 #endif
 }
 
+#endif /* !NO_WOLFSSL_SERVER || !NO_WOLFSSL_CLIENT */
+
 /* ----- Plain-UDP baseline (-n) ----- */
 
 static int udp_server(const cfg_t* c)
@@ -523,6 +530,8 @@ static int udp_client(const cfg_t* c)
 
 /* ----- DTLS server ----- */
 
+#ifndef NO_WOLFSSL_SERVER
+
 static int dtls_server(const cfg_t* c)
 {
     int                ret      = 1;
@@ -658,8 +667,12 @@ static int dtls_server(const cfg_t* c)
     return ret;
 }
 
+#endif /* !NO_WOLFSSL_SERVER */
+
 /* ----- DTLS client ----- */
 
+#ifndef NO_WOLFSSL_CLIENT
+
 static int dtls_client(const cfg_t* c)
 {
     int                ret      = 1;
@@ -797,6 +810,8 @@ static int dtls_client(const cfg_t* c)
     return ret;
 }
 
+#endif /* !NO_WOLFSSL_CLIENT */
+
 int main(int argc, char** argv)
 {
     cfg_t c;
@@ -807,7 +822,20 @@ int main(int argc, char** argv)
     if (c.plainUdp) {
         return c.isServer ? udp_server(&c) : udp_client(&c);
     }
-    return c.isServer ? dtls_server(&c) : dtls_client(&c);
+    if (c.isServer) {
+#ifndef NO_WOLFSSL_SERVER
+        return dtls_server(&c);
+#else
+        fprintf(stderr, "DTLS server not compiled in!\n");
+        return 1;
+#endif
+    }
+#ifndef NO_WOLFSSL_CLIENT
+    return dtls_client(&c);
+#else
+    fprintf(stderr, "DTLS client not compiled in!\n");
+    return 1;
+#endif
 }
 
 #else /* DTLS_BENCH_ENABLED */

examples/client/client.c

@@ -2470,6 +2470,12 @@ THREAD_RETURN WOLFSSL_THREAD client_test(void* args)
 
     ((func_args*)args)->return_code = -1; /* error state */
 
+#ifdef HAVE_PK_CALLBACKS
+    /* The ECC callbacks read keyGenCnt whether or not certificates are
+     * compiled in, so this cannot sit inside the NO_CERTS block below. */
+    XMEMSET(&pkCbInfo, 0, sizeof(pkCbInfo));
+#endif
+
 #ifndef NO_RSA
     verifyCert = caCertFile;
     ourCert    = cliCertFile;
@@ -3418,7 +3424,8 @@ THREAD_RETURN WOLFSSL_THREAD client_test(void* args)
             method = wolfDTLSv1_3_client_method_ex;
             break;
 #endif /* WOLFSSL_DTLS13 */
-    #if defined(OPENSSL_EXTRA) || defined(WOLFSSL_EITHER_SIDE)
+    #if (defined(OPENSSL_EXTRA) || defined(WOLFSSL_EITHER_SIDE)) && \
+        !defined(WOLFSSL_NO_TLS12)
         case -3:
             method = wolfDTLSv1_2_method_ex;
             break;
@@ -5116,6 +5123,10 @@ THREAD_RETURN WOLFSSL_THREAD client_test(void* args)
 
 exit:
 
+#ifdef HAVE_PK_CALLBACKS
+    CleanupPkCallbackContexts(&pkCbInfo);
+#endif
+
 #ifdef WOLFSSL_WOLFSENTRY_HOOKS
     wolfsentry_ret =
         wolfsentry_shutdown(WOLFSENTRY_CONTEXT_ARGS_OUT_EX4(&wolfsentry, NULL));

examples/echoclient/echoclient.c

@@ -134,7 +134,8 @@ void echoclient_test(void* args)
 #endif
 
 #if !defined(NO_TLS)
-    #if defined(WOLFSSL_TLS13) && defined(WOLFSSL_SNIFFER)
+    #if defined(WOLFSSL_TLS13) && defined(WOLFSSL_SNIFFER) && \
+        !defined(WOLFSSL_NO_TLS12)
     method = wolfTLSv1_2_client_method();
     #else
     method = wolfSSLv23_client_method();
@@ -174,10 +175,13 @@ void echoclient_test(void* args)
             err_sys("can't load ca buffer");
 #endif
 
-#if defined(WOLFSSL_SNIFFER)
+#if defined(WOLFSSL_SNIFFER) && !defined(WOLFSSL_NO_TLS12)
     /* Only set if not running testsuite */
     if (XSTRSTR(argv[0], "testsuite") == NULL) {
-        /* don't use EDH, can't sniff tmp keys */
+        /* don't use EDH, can't sniff tmp keys. A TLS 1.3 sniffer needs a key
+         * log file or static ephemeral keys instead, so this static RSA suite
+         * is only pinned where TLS 1.2 exists. Advisory: a build without the
+         * suite's ciphers keeps the default list. */
         SSL_CTX_set_cipher_list(ctx, "AES256-SHA");
     }
 #endif

examples/echoserver/echoserver.c

@@ -151,7 +151,8 @@ THREAD_RETURN WOLFSSL_THREAD echoserver_test(void* args)
     tcp_listen(&sockfd, &port, useAnyAddr, 0, 0);
 
 #if !defined(NO_TLS)
-    #if defined(WOLFSSL_TLS13) && defined(WOLFSSL_SNIFFER)
+    #if defined(WOLFSSL_TLS13) && defined(WOLFSSL_SNIFFER) && \
+        !defined(WOLFSSL_NO_TLS12)
     method = wolfTLSv1_2_server_method();
     #else
     method = wolfSSLv23_server_method();
@@ -264,10 +265,13 @@ THREAD_RETURN WOLFSSL_THREAD echoserver_test(void* args)
     }
 #endif
 
-#if defined(WOLFSSL_SNIFFER)
+#if defined(WOLFSSL_SNIFFER) && !defined(WOLFSSL_NO_TLS12)
     /* Only set if not running testsuite */
     if (XSTRSTR(argv[0], "testsuite") == NULL) {
-        /* don't use EDH, can't sniff tmp keys */
+        /* don't use EDH, can't sniff tmp keys. A TLS 1.3 sniffer needs a key
+         * log file or static ephemeral keys instead, so this static RSA suite
+         * is only pinned where TLS 1.2 exists. Advisory: a build without the
+         * suite's ciphers keeps the default list. */
         wolfSSL_CTX_set_cipher_list(ctx, "AES256-SHA");
     }
 #endif

examples/server/server.c

@@ -1878,6 +1878,12 @@ THREAD_RETURN WOLFSSL_THREAD server_test(void* args)
 
     ((func_args*)args)->return_code = -1; /* error state */
 
+#ifdef HAVE_PK_CALLBACKS
+    /* The ECC callbacks read keyGenCnt whether or not certificates are
+     * compiled in, so this cannot sit inside the NO_CERTS block below. */
+    XMEMSET(&pkCbInfo, 0, sizeof(pkCbInfo));
+#endif
+
 #ifndef NO_RSA
     verifyCert = cliCertFile;
     ourCert    = svrCertFile;
@@ -2784,7 +2790,8 @@ THREAD_RETURN WOLFSSL_THREAD server_test(void* args)
             method = wolfDTLSv1_3_server_method_ex;
             break;
 #endif
-    #if defined(OPENSSL_EXTRA) || defined(WOLFSSL_EITHER_SIDE)
+    #if (defined(OPENSSL_EXTRA) || defined(WOLFSSL_EITHER_SIDE)) && \
+        !defined(WOLFSSL_NO_TLS12)
         case -3:
             method = wolfDTLSv1_2_method_ex;
             break;
@@ -4195,6 +4202,10 @@ THREAD_RETURN WOLFSSL_THREAD server_test(void* args)
 
 exit:
 
+#ifdef HAVE_PK_CALLBACKS
+    CleanupPkCallbackContexts(&pkCbInfo);
+#endif
+
 #ifdef WOLFSSL_WOLFSENTRY_HOOKS
     wolfsentry_ret =
         wolfsentry_shutdown(WOLFSENTRY_CONTEXT_ARGS_OUT_EX4(&wolfsentry, NULL));