wolfSSL 1 FAIL at Raspberry Pi 4 Model B

[mmiyazaki]

Version

wolfssl 5.8.2

Description

I'm running wolfSSL on a Raspberry Pi 4 using the instructions from the following URL, but I'm encountering a failure as shown in the attached file. Could you please advise me on how to resolve this issue? https://github.com/wolfSSL/wolfsm/blob/master/README.md

test-suite.log

[SparkiDev]

Hi @mmiyazaki,

The TLS 1.3 code had changed and wasn't working with SM2/SM3 anymore.
Sorry about this!

I've put up a PR that fixes it (see above).

Let me know if there is any problem with the fix!

Sean

[gojimmypi]

Nice fix @SparkiDev !!

I can confirm I saw an error (from the TLS 1.3 example):

./examples/server/server -v 4 -l TLS13-SM4-GCM-SM3 \
    -c ./certs/sm2/server-sm2.pem -k ./certs/sm2/server-sm2-priv.pem \
    -A ./certs/sm2/client-sm2.pem -V &
./examples/client/client -v 4 -l TLS13-SM4-GCM-SM3 \
    -c ./certs/sm2/client-sm2.pem -k ./certs/sm2/client-sm2-priv.pem \
    -A ./certs/sm2/root-sm2.pem -C

Before:

./examples/server/server -v 4 -l TLS13-SM4-GCM-SM3 \
    -c ./certs/sm2/server-sm2.pem -k ./certs/sm2/server-sm2-priv.pem \
    -A ./certs/sm2/client-sm2.pem -V &
./examples/client/client -v 4 -l TLS13-SM4-GCM-SM3 \
    -c ./certs/sm2/client-sm2.pem -k ./certs/sm2/client-sm2-priv.pem \
    -A ./certs/sm2/root-sm2.pem -C
[1] 61231
wolfSSL_connect error 0, unknown error number
wolfSSL error: wolfSSL_connect failed
SSL_accept error -308, error state on socket
wolfSSL error: SSL_accept failed
[1]+  Exit 1                  ./examples/server/server -v 4 -l TLS13-SM4-GCM-SM3 -c ./certs/sm2/server-sm2.pem -k ./certs/sm2/server-sm2-priv.pem -A ./certs/sm2/client-sm2.pem -V

After applying the patch:

 ./examples/server/server -v 4 -l TLS13-SM4-GCM-SM3 \
    -c ./certs/sm2/server-sm2.pem -k ./certs/sm2/server-sm2-priv.pem \
    -A ./certs/sm2/client-sm2.pem -V &
./examples/client/client -v 4 -l TLS13-SM4-GCM-SM3 \
    -c ./certs/sm2/client-sm2.pem -k ./certs/sm2/client-sm2-priv.pem \
    -A ./certs/sm2/root-sm2.pem -C
[1] 64958
SSL version is TLSv1.3
SSL cipher suite is TLS_SM4_GCM_SM3
SSL curve name is SM2P256V1
SSL version is TLSv1.3
SSL cipher suite is TLS_SM4_GCM_SM3
SSL curve name is SM2P256V1
Client message: hello wolfssl!
I hear you fa shizzle!
[1]+  Done                    ./examples/server/server -v 4 -l TLS13-SM4-GCM-SM3 -c ./certs/sm2/server-sm2.pem -k ./certs/sm2/server-sm2-priv.pem -A ./certs/sm2/client-sm2.pem -V

More importantly: YAY! It fixes this error I was seeing on an embedded ESP32 server.

I (27009) server-tls: Waiting for a connection on port 11111 ...
I (147315) wolfssl: wolfSSL Entering wolfSSL_new
I (147315) wolfssl: wolfSSL Entering ReinitSSL
I (147316) wolfssl: RNG_HEALTH_TEST_CHECK_SIZE = 128
I (147320) wolfssl: sizeof(seedB_data)         = 128
I (147330) wolfssl: wolfSSL Entering SetSSL_CTX
I (147331) wolfssl: wolfSSL Entering wolfSSL_NewSession
I (147337) wolfssl: InitSSL done. return 0 (success)
I (147342) wolfssl: wolfSSL_new InitSSL success
I (147348) wolfssl: wolfSSL Leaving wolfSSL_new InitSSL =, return 0
I (147355) server-tls: 
Created WOLFSSL object:
I (147360) server-tls: tls_smp_client_task heap @ 0x40835db0 = 301116
I (147367) server-tls: WOLFSSL_HAVE_MLKEM is not enabled, not using PQ.
I (147374) wolfssl: wolfSSL Entering wolfSSL_set_verify
I (147380) server-tls: ssl SSL_VERIFY_NONE
I (147385) server-tls: WOLFSSL* ssl using None
I (147390) wolfssl: wolfSSL Entering wolfSSL_set_fd
I (147396) wolfssl: wolfSSL Entering wolfSSL_set_read_fd
I (147402) wolfssl: wolfSSL Leaving wolfSSL_set_read_fd, return 1
I (147408) wolfssl: wolfSSL Entering wolfSSL_set_write_fd
I (147415) wolfssl: wolfSSL Leaving wolfSSL_set_write_fd, return 1
I (147421) wolfssl: wolfSSL Entering wolfSSL_accept
I (147427) wolfssl: wolfSSL Entering ReinitSSL
I (147432) wolfssl: wolfSSL Entering RetrySendAlert
I (147438) wolfssl: wolfSSL Entering RetrySendAlert
I (147444) wolfssl: growing input buffer
I (147448) wolfssl: received record layer msg
I (147453) wolfssl: got HANDSHAKE
I (147457) wolfssl: wolfSSL Entering wolfSSL_get_options
I (147463) wolfssl: wolfSSL Entering DoTls13HandShakeMsg
I (147469) wolfssl: wolfSSL Entering EarlySanityCheckMsgReceived
I (147476) wolfssl: wolfSSL Leaving EarlySanityCheckMsgReceived, return 0
I (147483) wolfssl: wolfSSL Entering DoTls13HandShakeMsgType
I (147489) wolfssl: processing client hello
I (147494) wolfssl: wolfSSL Entering DoTls13ClientHello
I (147500) wolfssl: Supported Versions extension received
I (147506) wolfssl: Adding signature algorithms extension
I (147512) wolfssl: Skipping Supported Versions - already processed
I (147519) wolfssl: Signature Algorithms extension received
I (147525) wolfssl: Supported Groups extension received
I (147531) wolfssl: Unknown TLS extension type
I (147536) wolfssl: Key Share extension received
I (147542) wolfssl: wolfSSL Entering CheckPreSharedKeys
I (147550) wolfssl: wolfSSL Entering MatchSuite
I (147553) wolfssl: wolfSSL Entering VerifyServerSuite
I (147559) wolfssl: Requires AEAD
I (147563) wolfssl: Verified suite validity
I (147568) wolfssl: wolfSSL Entering EccMakeKey
I (147863) wolfssl: wolfSSL Leaving EccMakeKey, return 0
I (147864) wolfssl: Derive Early Secret
I (147864) wolfssl: wolfSSL Leaving DoTls13ClientHello, return 0
I (147869) wolfssl: wolfSSL Leaving DoTls13HandShakeMsgType(), return 0
I (147877) wolfssl: wolfSSL Leaving DoTls13HandShakeMsg, return 0
I (147883) wolfssl: Shrinking input buffer
I (147888) wolfssl: accept state ACCEPT_CLIENT_HELLO_DONE
I (147894) wolfssl: wolfSSL Entering wolfSSL_accept_TLSv13
I (147900) wolfssl: wolfSSL Entering ReinitSSL
I (147906) wolfssl: wolfSSL Entering RetrySendAlert
I (147911) wolfssl: accept state ACCEPT_HELLO_RETRY_REQUEST_DONE
I (147918) wolfssl: accept state ACCEPT_FIRST_REPLY_DONE
I (147924) wolfssl: accept state ACCEPT_SECOND_REPLY_DONE
I (147930) wolfssl: wolfSSL Entering SendTls13ServerHello
I (147936) wolfssl: growing output buffer
I (147941) wolfssl: Key Share extension to write
I (147946) wolfssl: Supported Versions extension to write
I (147955) wolfssl: Shrinking output buffer
I (147957) wolfssl: wolfSSL Leaving SendTls13ServerHello, return 0
I (147964) wolfssl: accept state SERVER_HELLO_SENT
I (147969) wolfssl: accept state ACCEPT_THIRD_REPLY_DONE
I (147975) wolfssl: wolfSSL Entering EccSharedSecret
I (148271) wolfssl: wolfSSL Leaving EccSharedSecret, return 0
I (148271) wolfssl: wolfSSL Entering SendTls13EncryptedExtensions
I (148273) wolfssl: Supported Groups extension free
I (148279) wolfssl: Derive Handshake Secret
I (148284) wolfssl: Derive Client Handshake Secret
I (148289) wolfssl: Derive Server Handshake Secret
I (148295) wolfssl: Derive Client Key
I (148299) wolfssl: Derive Server Key
I (148303) wolfssl: Derive Client IV
I (148308) wolfssl: Derive Server IV
I (148312) wolfssl: growing output buffer
I (148316) wolfssl: wolfSSL Entering BuildTls13Message
I (148323) wolfssl: wolfSSL Entering EncryptTls13
I (148328) wolfssl: wolfSSL Leaving BuildTls13Message, return 0
I (148335) wolfssl: Shrinking output buffer
I (148339) wolfssl: wolfSSL Leaving SendTls13EncryptedExtensions, return 0
I (148347) wolfssl: accept state SERVER_EXTENSIONS_SENT
I (148352) wolfssl: accept state CERT_REQ_SENT
I (148358) wolfssl: wolfSSL Entering SendTls13Certificate
I (148364) wolfssl: growing output buffer
I (148368) wolfssl: wolfSSL Entering BuildTls13Message
I (148379) wolfssl: wolfSSL Entering EncryptTls13
I (148385) wolfssl: wolfSSL Leaving BuildTls13Message, return 0
I (148387) wolfssl: Shrinking output buffer
I (148391) wolfssl: wolfSSL Leaving SendTls13Certificate, return 0
I (148398) wolfssl: accept state CERT_SENT
I (148403) wolfssl: wolfSSL Entering SendTls13CertificateVerify
I (148409) wolfssl: growing output buffer
I (148414) wolfssl: Trying ECC private key, RSA didn't work
I (148421) wolfssl: Using ECC private key
I (148425) wolfssl: wolfSSL Entering Sm2wSm3Sign
I (148726) wolfssl: wolfSSL Leaving Sm2wSm3Sign, return 0
I (148726) wolfssl: wolfSSL Entering BuildTls13Message
I (148728) wolfssl: wolfSSL Entering EncryptTls13
I (148733) wolfssl: wolfSSL Leaving BuildTls13Message, return 0
I (148740) wolfssl: Shrinking output buffer
I (148744) wolfssl: wolfSSL Leaving SendTls13CertificateVerify, return 0
I (148751) wolfssl: accept state CERT_VERIFY_SENT
I (148756) wolfssl: wolfSSL Entering SendTls13Finished
I (148762) wolfssl: growing output buffer
I (148767) wolfssl: Derive Finished Secret
I (148772) wolfssl: Derive Finished Secret
I (148777) wolfssl: wolfSSL Entering BuildTls13Message
I (148782) wolfssl: wolfSSL Entering EncryptTls13
I (148788) wolfssl: wolfSSL Leaving BuildTls13Message, return 0
I (148794) wolfssl: Derive Master Secret
I (148799) wolfssl: Derive Client Traffic Secret
I (148804) wolfssl: Derive Server Traffic Secret
I (148810) wolfssl: Derive Client Key
I (148814) wolfssl: Derive Server Key
I (148818) wolfssl: Derive Client IV
I (148823) wolfssl: Derive Server IV
I (148828) wolfssl: Shrinking output buffer
I (148832) wolfssl: wolfSSL Leaving SendTls13Finished, return 0
I (148838) wolfssl: accept state ACCEPT_FINISHED_SENT
I (148844) wolfssl: accept state  TICKET_SENT
I (148849) wolfssl: wolfSSL Entering RetrySendAlert
I (148855) wolfssl: Embed receive connection closed
I (148860) wolfssl: wolfSSL error occurred, error = -308
I (148866) wolfssl: wolfSSL Entering wolfSSL_get_error
I (148872) wolfssl: wolfSSL Leaving wolfSSL_get_error, return -308
E (148866) server-tls: wolfSSL_accept error -308

From command-line:

CIPHER="ECDHE-ECDSA-SM4-CBC-SM3"
echo "Testing: $CIPHER"
./examples/client/client -v 3 -l  "$CIPHER"  -h 192.168.1.107  -c ./certs/sm2/client-sm2.pem -k ./certs/sm2/client-sm2-priv.pem  -A ./certs/sm2/root-sm2.pem -C

CIPHER="TLS13-SM4-GCM-SM3"
echo "Testing: $CIPHER"
./examples/client/client -v 4  -l  "$CIPHER"  -h 192.168.1.107  -c ./certs/sm2/client-sm2.pem -k ./certs/sm2/client-sm2-priv.pem  -A ./certs/sm2/root-sm2.pem -C

Now working!

Testing: ECDHE-ECDSA-SM4-CBC-SM3
SSL version is TLSv1.2
SSL cipher suite is TLS_ECDHE_ECDSA_WITH_SM4_CBC_SM3
SSL curve name is SM2P256V1
I hear you fa shizzle!
Testing: TLS13-SM4-GCM-SM3
SSL version is TLSv1.3
SSL cipher suite is TLS_SM4_GCM_SM3
SSL curve name is SM2P256V1
I hear you fa shizzle!

See also my #6825 to add SM Cipher certificate test header: certs_test_sm.h