From: Max Fillinger Date: Tue, 3 Jun 2025 14:06:24 +0000 (+0200) Subject: mbedtls: Allow TLS 1.3 if available X-Git-Tag: v2.7_alpha2~9 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=abed088c9bf3d6ab479dbe815d4d307b21b816b6;p=thirdparty%2Fopenvpn.git mbedtls: Allow TLS 1.3 if available We need mbedtls_ssl_export_keying_material() to support TLS 1.3. The workaround we use for TLS 1.2 does not work for TLS 1.3. Change-Id: If5e832866b312a2f8a1ce6b4e00d40e3dcf63681 Signed-off-by: Max Fillinger Acked-by: Frank Lichtenheld Message-Id: <20250603140631.11696-1-gert@greenie.muc.de> URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg31858.html Signed-off-by: Gert Doering --- diff --git a/README.mbedtls b/README.mbedtls index c4f3924bd..a1012e97b 100644 --- a/README.mbedtls +++ b/README.mbedtls @@ -26,5 +26,9 @@ Plugin/Script features: ************************************************************************* -Mbed TLS 3 has implemented (parts of) the TLS 1.3 protocol, but we have disabled -support in OpenVPN because the TLS-Exporter function is not yet implemented. +Mbed TLS 3 has implemented TLS 1.3, but support in OpenVPN requires the +function mbedtls_ssl_export_keying_material() which is currently not in +any released version. It is available when building mbed TLS from source +(mbedtls-3.6 or development branch). + +Without this function, only TLS 1.2 is available. diff --git a/src/openvpn/ssl_mbedtls.c b/src/openvpn/ssl_mbedtls.c index 7452c300d..ecccc260a 100644 --- a/src/openvpn/ssl_mbedtls.c +++ b/src/openvpn/ssl_mbedtls.c @@ -1048,11 +1048,14 @@ tls_ctx_personalise_random(struct tls_root_ctx *ctx) int tls_version_max(void) { -#if defined(MBEDTLS_SSL_PROTO_TLS1_2) + /* We need mbedtls_ssl_export_keying_material() to support TLS 1.3. */ +#if defined(MBEDTLS_SSL_PROTO_TLS1_3) && defined(MBEDTLS_SSL_KEYING_MATERIAL_EXPORT) + return TLS_VER_1_3; +#elif defined(MBEDTLS_SSL_PROTO_TLS1_2) return TLS_VER_1_2; -#else /* defined(MBEDTLS_SSL_PROTO_TLS1_2) */ - #error "mbedtls is compiled without support for TLS 1.2." -#endif /* defined(MBEDTLS_SSL_PROTO_TLS1_2) */ +#else + #error mbedtls is compiled without support for TLS 1.2 or 1.3 +#endif } /**