QtCoap: Missing SSLCipher TLS_PSK_WITH_AES_128_CCM_8

[Marc_Van_Daele]

I'm trying to run quicksecureclient example from the QtCoap package in 5.13 and connect to an existing Coap server.
Running coap-client -u <identity> -k <psk> coaps://192.168.1.3:5684/<url> works fine (where coap-client comes from libcoap.net)
However, the quicksecureclient doesn't seem to work and fails at the handshake. After comparing the wireshark logs, I noticed that TLS_PSK_WITH_AES_128_CCM_8 is not in the list of Ciphers returned by configuration.supportedCiphers().
Any suggestions on how to add this?
I'm on Ubuntu 16.04, having OpenSSL version 1.0.2g

Thanks in advance,

Marc

[Marc_Van_Daele]

In the meantime, I've upgraded to Openssl 1.1.1c which does support TLS_PSK_WITH_AES_128_CCM_8 . However, configuration.supportedCiphers() does not seem to return this cipher.
Where does Qt gets its list of supported ciphers and how can I add one?

[Marc_Van_Daele]

And I'm one step further: QSslSocket::sslLibraryBuildVersionString() still returns "OpenSSL 1.0.2k-fips 26 Jan 2017".
So somehow I should get Qt to load the 1.1 version. This should be possible according to the docs "By default, an SSL-enabled Qt library dynamically loads any installed OpenSSL library at run-time"
Question now is how to control the dynamic loading and to get Qt to load the OpenSSL 1.1 first

[Christian Ehrlicher]

What Qt version do you use? Support for OpenSsl 1.1 was added in 5.12 afaik.

[Marc_Van_Daele]

I'm using Qt 5.13.0-rc. I have both OpenSSL 1.0.2 and OpenSSL 1.1.1 on my Ubuntu 16.04 system. Somehow, I have to point Qt to the correct version but I've played ao with LD_LIBRARY_PATH but with no success.

[Christian Ehrlicher]

Ok, now the question is if your Qt is compiled with openssl 1.1 support.

[SGaist]

@Christian-Ehrlicher said in QtCoap: Missing SSLCipher TLS_PSK_WITH_AES_128_CCM_8:

What Qt version do you use? Support for OpenSsl 1.1 was added in 5.12 afaik.

Nope, it was added in 5.10. The pre-built package were still built using 1.0 to avoid breaking the work of people relying on that version of OpenSSL.

@Marc_Van_Daele you can't just switch between one and the other, the API/ABI has been broken between OpenSSL 1.0 and 1.1.

You'll have to build your Qt version by hand to make it use OpenSSL 1.1

[Marc_Van_Daele]

Thanks for the clarification!

The docs are a bit misleading when they state "By default, an SSL-enabled Qt library dynamically loads any installed OpenSSL library at run-time"

I've created https://bugreports.qt.io/browse/QTBUG-76290 since I think there is a mismatch between the default packaging in 5.13 (uses 1.0) and the requirements for the (new) QtCoap (needs 1.1)