From: Max Fillinger <maximilian.fillin...@foxcrypto.com> We need mbedtls_ssl_export_keying_material() to support TLS 1.3. The workaround we use for TLS 1.2 does not work for TLS 1.3.
Change-Id: If5e832866b312a2f8a1ce6b4e00d40e3dcf63681 Signed-off-by: Max Fillinger <maximilian.fillin...@foxcrypto.com> Acked-by: Gert Doering <g...@greenie.muc.de> Acked-by: Frank Lichtenheld <fr...@lichtenheld.com> --- This change was reviewed on Gerrit and approved by at least one developer. I request to merge it to master. Gerrit URL: https://gerrit.openvpn.net/c/openvpn/+/1042 This mail reflects revision 3 of this Change. Acked-by according to Gerrit (reflected above): Gert Doering <g...@greenie.muc.de> Frank Lichtenheld <fr...@lichtenheld.com> diff --git a/README.mbedtls b/README.mbedtls index c4f3924..a1012e9 100644 --- a/README.mbedtls +++ b/README.mbedtls @@ -26,5 +26,9 @@ ************************************************************************* -Mbed TLS 3 has implemented (parts of) the TLS 1.3 protocol, but we have disabled -support in OpenVPN because the TLS-Exporter function is not yet implemented. +Mbed TLS 3 has implemented TLS 1.3, but support in OpenVPN requires the +function mbedtls_ssl_export_keying_material() which is currently not in +any released version. It is available when building mbed TLS from source +(mbedtls-3.6 or development branch). + +Without this function, only TLS 1.2 is available. diff --git a/src/openvpn/ssl_mbedtls.c b/src/openvpn/ssl_mbedtls.c index 0159166..b78439c 100644 --- a/src/openvpn/ssl_mbedtls.c +++ b/src/openvpn/ssl_mbedtls.c @@ -1048,11 +1048,14 @@ int tls_version_max(void) { -#if defined(MBEDTLS_SSL_PROTO_TLS1_2) + /* We need mbedtls_ssl_export_keying_material() to support TLS 1.3. */ +#if defined(MBEDTLS_SSL_PROTO_TLS1_3) && defined(MBEDTLS_SSL_KEYING_MATERIAL_EXPORT) + return TLS_VER_1_3; +#elif defined(MBEDTLS_SSL_PROTO_TLS1_2) return TLS_VER_1_2; -#else /* defined(MBEDTLS_SSL_PROTO_TLS1_2) */ - #error "mbedtls is compiled without support for TLS 1.2." -#endif /* defined(MBEDTLS_SSL_PROTO_TLS1_2) */ +#else + #error mbedtls is compiled without support for TLS 1.2 or 1.3 +#endif } /** _______________________________________________ Openvpn-devel mailing list Openvpn-devel@lists.sourceforge.net https://lists.sourceforge.net/lists/listinfo/openvpn-devel
