dtls1.3: Fix issues when --enable-dtls13 enabled

[mrdeep1]

Description

Fixed issue reported by scan-build when DTLS13 is enabled.

Fix compile issue when WOLFSSL_DTLS_CH_FRAG is enabled.

Fix running of scripts/dtlscid.test by removing 'set -e' as bwrap
command may not be there.

Testing

Temporarily make this change

diff --git a/configure.ac b/configure.ac
index 51fa5caa3..9cdc3b099 100644
--- a/configure.ac
+++ b/configure.ac
@@ -794,6 +794,9 @@ then
     then
         test "$enable_tls13" = "" && enable_tls13=yes
         test "$enable_rsapss" = "" && enable_rsapss=yes
+        test "$enable_dtls13" = "" && enable_dtls13=yes
+        test "$enable_dtlscid" = "" && enable_dtlscid=yes
+        test "$enable_dtls_frag_ch" = "" && enable_dtls_frag_ch=yes
     fi

     # this set is also enabled by enable-all-crypto:

Running ./configure --enable-all and reviewed AM_FLAGS in Makefile as well as running scan-build make.

Checklist

• added tests
• updated/added doxygen
• updated appropriate READMEs
• Updated manual and documentation

[wolfSSL-Bot]

Can one of the admins verify this patch?

[mrdeep1]

Fixed issue with running scripts/dtlscid.test. Code pushed.

[SparkiDev]

Please remove this from the default build.
We are looking for interoperability targets before making it part of the distribution.

[mrdeep1]

Understood. However, I assume that you want all 3 additions to be removed rather than just hte single line highlighted.

For reference, using WolfSSL in the libcoap implementation, it interoperates with OpenSSL, GnuTLS and MbedTLS.

There is a change required for TinyDTLS as it is doing a hash across the whole ClientHello (ignoring Cookie) (including Extensions) and needs updating to be following https://datatracker.ietf.org/doc/html/rfc6347#section-4.2.1 where only the (version, random, session_id, cipher_suites, compression_method) should be hashed.

When responding to a HelloVerifyRequest, the client MUST use the same parameter values (version, random, session_id, cipher_suites, compression_method) as it did in the original ClientHello. The server SHOULD use those values to generate its cookie and verify that they are correct upon cookie receipt.

See eclipse-tinydtls/tinydtls#230 for that pending fix.

In all the cases above, DTLS1.3 is not supported, and so there is a WolfSSL downgrade.

Changes to configure.ac removed and code pushed.

[SparkiDev]

Thanks @mrdeep1!
I've approved the code changes.