search

wolfSSL / wolfssl

The wolfSSL library is a small, fast, portable implementation of TLS/SSL for embedded devices to the cloud. wolfSSL supports up to TLS 1.3 and DTLS 1.3!
https://www.wolfssl.com
GNU General Public License v2.0
2.36k stars 834 forks source link

Issue with DTLS 1.3 Server handshake #8199

Open EscaVic opened 3 days ago

EscaVic commented 3 days ago

Version

v5.7.2-stable

Description

Hi All, I'm new to WolfSSL and I am replacing OpenSSL with WolfSSL for DTLS 1.3 I'm see the following using self-signed certs that worked for our OpenSSL Build

Can I get clarification on these statements - seems to occur after the handshake,

wolfSSL Entering EmbedReceiveFrom wolfSSL Entering wolfSSL_dtls_get_using_nonblock Embed Receive From error Would block

The extended sequence is below

wolfSSL Entering DTLSv1_3_server_method_ex wolfSSL Entering wolfSSL_CTX_new_ex wolfSSL Entering wolfSSL_CertManagerNew heap param is null DYNAMIC_TYPE_CERT_MANAGER Allocating = 368 bytes wolfSSL Entering wolfSSL_CTX_set_verify wolfSSL Entering wolfSSL_CTX_set_mode wolfSSL Entering wolfSSL_CTX_set_min_proto_version wolfSSL Entering wolfSSL_CTX_get_max_proto_version wolfSSL Entering wolfSSL_CTX_get_options wolfSSL options are set through API calls and macros wolfSSL Leaving wolfSSL_CTX_get_max_proto_version, return 772 wolfSSL Entering wolfSSL_CTX_clear_options wolfSSL Entering wolfSSL_CTX_set_min_proto_version_ex wolfSSL Entering wolfSSL_CTX_allow_anon_cipher wolfSSL Leaving wolfSSL_CTX_new_ex, return 0 wolfSSL Entering wolfSSL_CTX_use_PrivateKey_file wolfSSL Entering ProcessBuffer wolfSSL Entering PemToDer wolfSSL Leaving ProcessBuffer, return 1 wolfSSL Entering wolfSSL_CTX_use_certificate_file wolfSSL Entering ProcessBuffer wolfSSL Entering PemToDer Checking cert signature type Getting Cert Name wolfSSL Entering wolfSSL_X509_NAME_new_ex wolfSSL Entering wolfSSL_X509_NAME_add_entry_by_NID Found place for name entry wolfSSL Entering wolfSSL_sk_X509_NAME_new wolfSSL Entering wolfSSL_sk_new_node wolfSSL Entering wolfSSL_sk_push wolfSSL Entering wolfSSL_X509_NAME_ENTRY_free wolfSSL Entering wolfSSL_X509_NAME_add_entry_by_NID Found place for name entry wolfSSL Entering wolfSSL_sk_push wolfSSL Entering wolfSSL_sk_new_node wolfSSL Entering wolfSSL_X509_NAME_ENTRY_free wolfSSL Entering wolfSSL_X509_NAME_add_entry_by_NID Found place for name entry wolfSSL Entering wolfSSL_sk_push wolfSSL Entering wolfSSL_sk_new_node wolfSSL Entering wolfSSL_X509_NAME_ENTRY_free wolfSSL Entering wolfSSL_X509_NAME_add_entry_by_NID Found place for name entry wolfSSL Entering wolfSSL_sk_push wolfSSL Entering wolfSSL_sk_new_node wolfSSL Entering wolfSSL_X509_NAME_ENTRY_free wolfSSL Entering wolfSSL_X509_NAME_add_entry_by_NID Found place for name entry wolfSSL Entering wolfSSL_sk_push wolfSSL Entering wolfSSL_sk_new_node wolfSSL Entering wolfSSL_X509_NAME_ENTRY_free Getting Cert Name wolfSSL Entering wolfSSL_X509_NAME_new_ex wolfSSL Entering wolfSSL_X509_NAME_add_entry_by_NID Found place for name entry wolfSSL Entering wolfSSL_sk_X509_NAME_new wolfSSL Entering wolfSSL_sk_new_node wolfSSL Entering wolfSSL_sk_push wolfSSL Entering wolfSSL_X509_NAME_ENTRY_free wolfSSL Entering wolfSSL_X509_NAME_add_entry_by_NID Found place for name entry wolfSSL Entering wolfSSL_sk_push wolfSSL Entering wolfSSL_sk_new_node wolfSSL Entering wolfSSL_X509_NAME_ENTRY_free wolfSSL Entering wolfSSL_X509_NAME_add_entry_by_NID Found place for name entry wolfSSL Entering wolfSSL_sk_push wolfSSL Entering wolfSSL_sk_new_node wolfSSL Entering wolfSSL_X509_NAME_ENTRY_free wolfSSL Entering wolfSSL_X509_NAME_add_entry_by_NID Found place for name entry wolfSSL Entering wolfSSL_sk_push wolfSSL Entering wolfSSL_sk_new_node wolfSSL Entering wolfSSL_X509_NAME_ENTRY_free wolfSSL Entering wolfSSL_X509_NAME_add_entry_by_NID Found place for name entry wolfSSL Entering wolfSSL_sk_push wolfSSL Entering wolfSSL_sk_new_node wolfSSL Entering wolfSSL_X509_NAME_ENTRY_free wolfSSL Entering GetAlgoId ECDSA/ED25519/ED448 cert signature wolfSSL Entering wolfSSL_X509_NAME_free wolfSSL Entering wolfSSL_sk_free wolfSSL Entering wolfSSL_X509_NAME_free wolfSSL Entering wolfSSL_sk_free wolfSSL Leaving ProcessBuffer, return 1 wolfSSL_CTX_load_verify_locations_ex Processing CA PEM file wolfSSL Entering ProcessBuffer wolfSSL Entering PemToDer Adding a CA Getting Cert Name wolfSSL Entering wolfSSL_X509_NAME_new_ex wolfSSL Entering wolfSSL_X509_NAME_add_entry_by_NID Found place for name entry wolfSSL Entering wolfSSL_sk_X509_NAME_new wolfSSL Entering wolfSSL_sk_new_node wolfSSL Entering wolfSSL_sk_push wolfSSL Entering wolfSSL_X509_NAME_ENTRY_free wolfSSL Entering wolfSSL_X509_NAME_add_entry_by_NID Found place for name entry wolfSSL Entering wolfSSL_sk_push wolfSSL Entering wolfSSL_sk_new_node wolfSSL Entering wolfSSL_X509_NAME_ENTRY_free wolfSSL Entering wolfSSL_X509_NAME_add_entry_by_NID Found place for name entry wolfSSL Entering wolfSSL_sk_push wolfSSL Entering wolfSSL_sk_new_node wolfSSL Entering wolfSSL_X509_NAME_ENTRY_free wolfSSL Entering wolfSSL_X509_NAME_add_entry_by_NID Found place for name entry wolfSSL Entering wolfSSL_sk_push wolfSSL Entering wolfSSL_sk_new_node wolfSSL Entering wolfSSL_X509_NAME_ENTRY_free wolfSSL Entering wolfSSL_X509_NAME_add_entry_by_NID Found place for name entry wolfSSL Entering wolfSSL_sk_push wolfSSL Entering wolfSSL_sk_new_node wolfSSL Entering wolfSSL_X509_NAME_ENTRY_free Getting Cert Name wolfSSL Entering wolfSSL_X509_NAME_new_ex wolfSSL Entering wolfSSL_X509_NAME_add_entry_by_NID Found place for name entry wolfSSL Entering wolfSSL_sk_X509_NAME_new wolfSSL Entering wolfSSL_sk_new_node wolfSSL Entering wolfSSL_sk_push wolfSSL Entering wolfSSL_X509_NAME_ENTRY_free wolfSSL Entering wolfSSL_X509_NAME_add_entry_by_NID Found place for name entry wolfSSL Entering wolfSSL_sk_push wolfSSL Entering wolfSSL_sk_new_node wolfSSL Entering wolfSSL_X509_NAME_ENTRY_free wolfSSL Entering wolfSSL_X509_NAME_add_entry_by_NID Found place for name entry wolfSSL Entering wolfSSL_sk_push wolfSSL Entering wolfSSL_sk_new_node wolfSSL Entering wolfSSL_X509_NAME_ENTRY_free wolfSSL Entering wolfSSL_X509_NAME_add_entry_by_NID Found place for name entry wolfSSL Entering wolfSSL_sk_push wolfSSL Entering wolfSSL_sk_new_node wolfSSL Entering wolfSSL_X509_NAME_ENTRY_free wolfSSL Entering wolfSSL_X509_NAME_add_entry_by_NID Found place for name entry wolfSSL Entering wolfSSL_sk_push wolfSSL Entering wolfSSL_sk_new_node wolfSSL Entering wolfSSL_X509_NAME_ENTRY_free wolfSSL Entering GetAlgoId wolfSSL Entering DecodeCertExtensions wolfSSL Entering DecodeBasicCaConstraint wolfSSL Entering DecodeKeyUsage Parsed new CA Freeing Parsed CA wolfSSL Entering wolfSSL_X509_NAME_free wolfSSL Entering wolfSSL_sk_free wolfSSL Entering wolfSSL_X509_NAME_free wolfSSL Entering wolfSSL_sk_free Freeing der CA OK Freeing der CA wolfSSL Leaving AddCA, return 0 wolfSSL Leaving ProcessBuffer, return 1 Processed a CA Processed at least one valid CA. Other stuff OK wolfSSL Entering wolfSSL_CTX_trust_peer_cert Processing CA PEM file wolfSSL Entering ProcessBuffer wolfSSL Entering PemToDer Adding a Trusted Peer Cert Getting Cert Name wolfSSL Entering wolfSSL_X509_NAME_new_ex wolfSSL Entering wolfSSL_X509_NAME_add_entry_by_NID Found place for name entry wolfSSL Entering wolfSSL_sk_X509_NAME_new wolfSSL Entering wolfSSL_sk_new_node wolfSSL Entering wolfSSL_sk_push wolfSSL Entering wolfSSL_X509_NAME_ENTRY_free wolfSSL Entering wolfSSL_X509_NAME_add_entry_by_NID Found place for name entry wolfSSL Entering wolfSSL_sk_push wolfSSL Entering wolfSSL_sk_new_node wolfSSL Entering wolfSSL_X509_NAME_ENTRY_free wolfSSL Entering wolfSSL_X509_NAME_add_entry_by_NID Found place for name entry wolfSSL Entering wolfSSL_sk_push wolfSSL Entering wolfSSL_sk_new_node wolfSSL Entering wolfSSL_X509_NAME_ENTRY_free wolfSSL Entering wolfSSL_X509_NAME_add_entry_by_NID Found place for name entry wolfSSL Entering wolfSSL_sk_push wolfSSL Entering wolfSSL_sk_new_node wolfSSL Entering wolfSSL_X509_NAME_ENTRY_free wolfSSL Entering wolfSSL_X509_NAME_add_entry_by_NID Found place for name entry wolfSSL Entering wolfSSL_sk_push wolfSSL Entering wolfSSL_sk_new_node wolfSSL Entering wolfSSL_X509_NAME_ENTRY_free Getting Cert Name wolfSSL Entering wolfSSL_X509_NAME_new_ex wolfSSL Entering wolfSSL_X509_NAME_add_entry_by_NID Found place for name entry wolfSSL Entering wolfSSL_sk_X509_NAME_new wolfSSL Entering wolfSSL_sk_new_node wolfSSL Entering wolfSSL_sk_push wolfSSL Entering wolfSSL_X509_NAME_ENTRY_free wolfSSL Entering wolfSSL_X509_NAME_add_entry_by_NID Found place for name entry wolfSSL Entering wolfSSL_sk_push wolfSSL Entering wolfSSL_sk_new_node wolfSSL Entering wolfSSL_X509_NAME_ENTRY_free wolfSSL Entering wolfSSL_X509_NAME_add_entry_by_NID Found place for name entry wolfSSL Entering wolfSSL_sk_push wolfSSL Entering wolfSSL_sk_new_node wolfSSL Entering wolfSSL_X509_NAME_ENTRY_free wolfSSL Entering wolfSSL_X509_NAME_add_entry_by_NID Found place for name entry wolfSSL Entering wolfSSL_sk_push wolfSSL Entering wolfSSL_sk_new_node wolfSSL Entering wolfSSL_X509_NAME_ENTRY_free wolfSSL Entering wolfSSL_X509_NAME_add_entry_by_NID Found place for name entry wolfSSL Entering wolfSSL_sk_push wolfSSL Entering wolfSSL_sk_new_node wolfSSL Entering wolfSSL_X509_NAME_ENTRY_free wolfSSL Entering GetAlgoId wolfSSL Entering DecodeCertExtensions wolfSSL Entering DecodeBasicCaConstraint wolfSSL Entering DecodeKeyUsage Parsed new trusted peer cert Freeing parsed trusted peer cert wolfSSL Entering wolfSSL_X509_NAME_free wolfSSL Entering wolfSSL_sk_free wolfSSL Entering wolfSSL_X509_NAME_free wolfSSL Entering wolfSSL_sk_free Freeing der trusted peer cert OK Freeing der trusted peer cert wolfSSL Leaving AddTrustedPeer, return 0 wolfSSL Leaving ProcessBuffer, return 1 Processed a CA Processed at least one valid CA. Other stuff OK wolfSSL Entering wolfSSL_new wolfSSL Entering ReinitSSL RNG_HEALTH_TEST_CHECK_SIZE = 128 sizeof(seedB_data) = 128 opened /dev/urandom. rnd read... wolfSSL Entering SetSSL_CTX wolfSSL Entering wolfSSL_DTLS_SetCookieSecret wolfSSL Leaving wolfSSL_DTLS_SetCookieSecret, return 0 wolfSSL Entering wolfSSL_NewSession InitSSL done. return 0 (success) wolfSSL_new InitSSL success wolfSSL Leaving wolfSSL_new InitSSL =, return 0 wolfSSL Entering wolfSSL_set_fd wolfSSL Entering wolfSSL_set_read_fd wolfSSL Leaving wolfSSL_set_read_fd, return 1 wolfSSL Entering wolfSSL_set_write_fd wolfSSL Leaving wolfSSL_set_write_fd, return 1 wolfSSL Entering wolfSSL_accept wolfSSL Entering ReinitSSL wolfSSL Entering RetrySendAlert wolfSSL Entering RetrySendAlert growing input buffer wolfSSL Leaving wolfSSL_dtls_get_current_timeout, return 1 wolfSSL Entering EmbedReceiveFrom wolfSSL Entering wolfSSL_dtls_get_using_nonblock wolfSSL Entering Dtls13CheckWindow received record layer msg got HANDSHAKE wolfSSL Entering EarlySanityCheckMsgReceived wolfSSL Leaving EarlySanityCheckMsgReceived, return 0 wolfSSL Entering Dtls13RtxMsgRecvd wolfSSL Entering DoTls13HandShakeMsgType processing client hello wolfSSL Entering DoTls13ClientHello wolfSSL Entering DoClientHelloStateless wolfSSL Entering MatchSuite wolfSSL Entering VerifyServerSuite Requires AEAD wolfSSL Entering wolfSSL_curve_is_disabled wolfSSL_curve_is_disabled checking for 23 wolfSSL Leaving wolfSSL_curve_is_disabled, return 0 Verified suite validity Key Share extension free wolfSSL Entering SendTls13ServerHello growing output buffer Supported Versions extension to write Cookie extension to write wolfSSL Entering EmbedSendTo Shrinking output buffer wolfSSL Leaving SendTls13ServerHello, return 0 Cookie extension free Supported Groups extension free Supported Versions extension free wolfSSL Leaving DoTls13ClientHello, return 0 wolfSSL Entering Dtls13RtxFlushAcks wolfSSL Entering DtlsMsgPoolReset wolfSSL Entering Dtls13RtxFlushBuffered wolfSSL Entering Dtls13RtxFlushBuffered wolfSSL Leaving DoTls13HandShakeMsgType(), return 0 Shrinking input buffer wolfSSL Entering RetrySendAlert growing input buffer wolfSSL Leaving wolfSSL_dtls_get_current_timeout, return 1 wolfSSL Entering EmbedReceiveFrom wolfSSL Entering wolfSSL_dtls_get_using_nonblock wolfSSL Entering Dtls13CheckWindow received record layer msg got HANDSHAKE wolfSSL Entering EarlySanityCheckMsgReceived wolfSSL Leaving EarlySanityCheckMsgReceived, return 0 wolfSSL Entering Dtls13RtxMsgRecvd wolfSSL Entering DoTls13HandShakeMsgType processing client hello wolfSSL Entering DoTls13ClientHello wolfSSL Entering DoClientHelloStateless wolfSSL Entering MatchSuite wolfSSL Entering VerifyServerSuite Requires AEAD wolfSSL Entering wolfSSL_curve_is_disabled wolfSSL_curve_is_disabled checking for 23 wolfSSL Leaving wolfSSL_curve_is_disabled, return 0 Verified suite validity Key Share extension free wolfSSL Entering SendTls13ServerHello growing output buffer Supported Versions extension to write Cookie extension to write wolfSSL Entering EmbedSendTo Shrinking output buffer wolfSSL Leaving SendTls13ServerHello, return 0 Cookie extension free Supported Groups extension free Supported Versions extension free wolfSSL Leaving DoTls13ClientHello, return 0 wolfSSL Entering Dtls13RtxFlushAcks wolfSSL Entering DtlsMsgPoolReset wolfSSL Entering Dtls13RtxFlushBuffered wolfSSL Entering Dtls13RtxFlushBuffered wolfSSL Leaving DoTls13HandShakeMsgType(), return 0 Shrinking input buffer wolfSSL Entering RetrySendAlert growing input buffer wolfSSL Leaving wolfSSL_dtls_get_current_timeout, return 1 wolfSSL Entering EmbedReceiveFrom wolfSSL Entering wolfSSL_dtls_get_using_nonblock Embed Receive From error Would block wolfSSL Entering wolfSSL_dtls_get_using_nonblock wolfSSL Entering DtlsMsgPoolTimeout wolfSSL Leaving DtlsMsgPoolTimeout(), return 0 wolfSSL Entering Dtls13RtxSendBuffered wolfSSL Leaving wolfSSL_dtls_get_current_timeout, return 2 wolfSSL Entering EmbedReceiveFrom wolfSSL Entering wolfSSL_dtls_get_using_nonblock Embed Receive From error Would block wolfSSL Entering wolfSSL_dtls_get_using_nonblock wolfSSL Entering DtlsMsgPoolTimeout wolfSSL Leaving DtlsMsgPoolTimeout(), return 0 wolfSSL Entering Dtls13RtxSendBuffered wolfSSL Leaving wolfSSL_dtls_get_current_timeout, return 4 wolfSSL Entering EmbedReceiveFrom wolfSSL Entering wolfSSL_dtls_get_using_nonblock Embed Receive From error Would block wolfSSL Entering wolfSSL_dtls_get_using_nonblock wolfSSL Entering DtlsMsgPoolTimeout wolfSSL Leaving DtlsMsgPoolTimeout(), return 0 wolfSSL Entering Dtls13RtxSendBuffered wolfSSL Leaving wolfSSL_dtls_get_current_timeout, return 8 wolfSSL Entering EmbedReceiveFrom wolfSSL Entering wolfSSL_dtls_get_using_nonblock Embed Receive From error Would block wolfSSL Entering wolfSSL_dtls_get_using_nonblock wolfSSL Entering DtlsMsgPoolTimeout wolfSSL Leaving DtlsMsgPoolTimeout(), return 0 wolfSSL Entering Dtls13RtxSendBuffered wolfSSL Leaving wolfSSL_dtls_get_current_timeout, return 16 wolfSSL Entering EmbedReceiveFrom wolfSSL Entering wolfSSL_dtls_get_using_nonblock Embed Receive From error Would block wolfSSL Entering wolfSSL_dtls_get_using_nonblock wolfSSL Entering DtlsMsgPoolTimeout wolfSSL Leaving DtlsMsgPoolTimeout(), return 0 wolfSSL Entering Dtls13RtxSendBuffered wolfSSL Leaving wolfSSL_dtls_get_current_timeout, return 32 wolfSSL Entering EmbedReceiveFrom wolfSSL Entering wolfSSL_dtls_get_using_nonblock Embed Receive From error Would block wolfSSL Entering wolfSSL_dtls_get_using_nonblock wolfSSL Entering DtlsMsgPoolTimeout wolfSSL Leaving DtlsMsgPoolTimeout(), return 0 wolfSSL Entering Dtls13RtxSendBuffered wolfSSL Leaving wolfSSL_dtls_get_current_timeout, return 64 wolfSSL Entering EmbedReceiveFrom wolfSSL Entering wolfSSL_dtls_get_using_nonblock Embed Receive From error Would block wolfSSL Entering wolfSSL_dtls_get_using_nonblock wolfSSL Entering DtlsMsgPoolTimeout wolfSSL Leaving DtlsMsgPoolTimeout(), return -1 Error trying to retransmit DTLS buffered message wolfSSL error occurred, error = 308 line:20837 file:external/wolfssl/src/intern wolfSSL error occurred, error = 308 line:9844 file:external/wolfssl/src/ssl.c wolfSSL Entering wolfSSL_get_error wolfSSL Leaving wolfSSL_get_error, return -308

anhu commented 3 days ago

Hi @EscaVic , My name is Anthony and I am a member of the wolfSSL team. I will be delegating this to one of our team members. In the meantime can you tell us a bit about yourself and your project? For example:

Warm regards, Anthony

EscaVic commented 3 days ago

Hi Anthony,

Thanks for responding quickly.

anhu commented 3 days ago

Hi, Can you please send a message to support@wolfssl.com referencing this ticket. You should be more comfortable if we handle professional questions via our private support window.

Warm regards, Anthony