Merge pull request #8273 from dgarske/no_tls

Enable support for no TLS while allowing certificate manager
2026-01-31 02:09:15 +01:00 · 2024-12-17 16:24:57 -06:00
parent fcbea85ded 356889a528
commit 60afdb557d
18 changed files with 445 additions and 261 deletions
--- a/configure.ac
+++ b/configure.ac
@@ -917,6 +917,50 @@ then
    ENABLED_SP_MATH_ALL="no"
 fi

+# wolfCrypt Only Build
+AC_ARG_ENABLE([cryptonly],
+    [AS_HELP_STRING([--enable-cryptonly],[Enable wolfCrypt Only build (default: disabled)])],
+    [ENABLED_CRYPTONLY=$enableval],
+    [ENABLED_CRYPTONLY=no])
+
+AS_IF([test "x$FIPS_VERSION" = "xrand"],[ENABLED_CRYPTONLY="yes"])
+
+# TLS
+AC_ARG_ENABLE([tls],
+    [AS_HELP_STRING([--enable-tls],[Enable TLS support (default: enabled)])],
+    [ ENABLED_TLS=$enableval ],
+    [ ENABLED_TLS=yes ]
+    )
+
+if test "$ENABLED_CRYPTONLY" = "yes"
+then
+    ENABLED_TLS=no
+fi
+if test "$ENABLED_TLS" = "no"
+then
+    AM_CFLAGS="$AM_CFLAGS -DNO_TLS"
+    test "$enable_tls13" = "" && enable_tls13=no
+    test "$enable_tlsv12" = "" && enable_tlsv12=no
+    test "$enable_tlsv10" = "" && enable_tlsv10=no
+    test "$enable_dtls" = "" && enable_dtls=no
+    test "$enable_dtls13" = "" && enable_dtls13=no
+    test "$enable_mcast" = "" && enable_mcast=no
+    test "$enable_srtp" = "" && enable_srtp=no
+    test "$enable_ocsp" = "" && enable_ocsp=no
+    test "$enable_tlsx" = "" && enable_tlsx=no
+    test "$enable_sni" = "" && enable_sni=no
+    test "$enable_sni" = "" && enable_sni=no
+    test "$enable_crl_monitor" = "" && enable_crl_monitor=no
+    test "$enable_alpn" = "" && enable_alpn=no
+    test "$enable_pkcallbacks" = "" && enable_pkcallbacks=no
+    test "$enable_quic" = "" && enable_quic=no
+    test "$enable_ech" = "" && enable_ech=no
+    test "$enable_ocspstapling" = "" && enable_ocspstapling=no
+
+    # Disable all open source compatibility enables that might get set with all
+    test "$enable_all_osp" = "" && enable_all_osp=no
+fi
+

 # All features, except conflicting or experimental:
 AC_ARG_ENABLE([all],
@@ -1751,14 +1795,6 @@ then
    AM_CFLAGS="$AM_CFLAGS -DWOLFSSL_USE_RWLOCK"
 fi

-# wolfCrypt Only Build
-AC_ARG_ENABLE([cryptonly],
-    [AS_HELP_STRING([--enable-cryptonly],[Enable wolfCrypt Only build (default: disabled)])],
-    [ENABLED_CRYPTONLY=$enableval],
-    [ENABLED_CRYPTONLY=no])
-
-AS_IF([test "x$FIPS_VERSION" = "xrand"],[ENABLED_CRYPTONLY="yes"])
-
 # ECH
 AC_ARG_ENABLE([ech],
    [AS_HELP_STRING([--enable-ech],[Enable ECH (default: disabled)])],
--- a/examples/benchmark/tls_bench.c
+++ b/examples/benchmark/tls_bench.c
@@ -72,7 +72,8 @@ Or
 #endif

 /* PTHREAD requires server and client enabled */
-#if defined(NO_WOLFSSL_CLIENT) || defined(NO_WOLFSSL_SERVER)
+#if !defined(NO_TLS) && \
+    (defined(NO_WOLFSSL_CLIENT) || defined(NO_WOLFSSL_SERVER))
    #if !defined(SINGLE_THREADED)
        #ifdef __GNUC__  /* GCC compiler */
            #pragma message "PTHREAD requires server and client enabled."
@@ -140,7 +141,7 @@ platform supports it"
 #define SHOW_VERBOSE        0 /* Default output is tab delimited format */

 #if (!defined(NO_WOLFSSL_CLIENT) || !defined(NO_WOLFSSL_SERVER)) && \
-    !defined(WOLFCRYPT_ONLY) && defined(USE_WOLFSSL_IO)
+    !defined(WOLFCRYPT_ONLY) && !defined(NO_TLS) && defined(USE_WOLFSSL_IO)

 /* shutdown message - nice signal to server, we are done */
 static const char* kShutdown = "shutdown";
@@ -2337,7 +2338,7 @@ int main(int argc, char** argv)
    args.return_code = 0;

 #if (!defined(NO_WOLFSSL_CLIENT) || !defined(NO_WOLFSSL_SERVER)) && \
-    !defined(WOLFCRYPT_ONLY) && defined(USE_WOLFSSL_IO)
+    !defined(WOLFCRYPT_ONLY) && !defined(NO_TLS) && defined(USE_WOLFSSL_IO)
    bench_tls(&args);
 #endif

--- a/examples/client/client.c
+++ b/examples/client/client.c
@@ -56,7 +56,8 @@ static const char *wolfsentry_config_path = NULL;
 #include <examples/client/client.h>
 #include <wolfssl/error-ssl.h>

-#ifndef NO_WOLFSSL_CLIENT
+#if !defined(NO_WOLFSSL_CLIENT) && !defined(NO_TLS)
+

 #ifdef NO_FILESYSTEM
 #ifdef NO_RSA
@@ -4810,7 +4811,7 @@ exit:
    WOLFSSL_RETURN_FROM_THREAD(0);
 }

-#endif /* !NO_WOLFSSL_CLIENT */
+#endif /* !NO_WOLFSSL_CLIENT && !NO_TLS */


 /* so overall tests can pull in test function */
@@ -4836,7 +4837,7 @@ exit:
        wolfSSL_Init();
        ChangeToWolfRoot();

-#ifndef NO_WOLFSSL_CLIENT
+#if !defined(NO_WOLFSSL_CLIENT) && !defined(NO_TLS)
 #ifdef HAVE_STACK_SIZE
        StackSizeCheck(&args, client_test);
 #else
--- a/examples/echoclient/echoclient.c
+++ b/examples/echoclient/echoclient.c
@@ -57,7 +57,7 @@

 #include <examples/echoclient/echoclient.h>

-#ifndef NO_WOLFSSL_CLIENT
+#if !defined(NO_WOLFSSL_CLIENT) && !defined(NO_TLS)


 #ifdef NO_FILESYSTEM
@@ -381,7 +381,7 @@ void echoclient_test(void* args)
    ((func_args*)args)->return_code = 0;
 }

-#endif /* !NO_WOLFSSL_CLIENT */
+#endif /* !NO_WOLFSSL_CLIENT && !NO_TLS */

 /* so overall tests can pull in test function */
 #ifndef NO_MAIN_DRIVER
@@ -408,7 +408,7 @@ void echoclient_test(void* args)
 #ifndef WOLFSSL_TIRTOS
        ChangeToWolfRoot();
 #endif
-#ifndef NO_WOLFSSL_CLIENT
+#if !defined(NO_WOLFSSL_CLIENT) && !defined(NO_TLS)
        echoclient_test(&args);
 #endif

--- a/examples/echoserver/echoserver.c
+++ b/examples/echoserver/echoserver.c
@@ -56,7 +56,7 @@

 #include "examples/echoserver/echoserver.h"

-#ifndef NO_WOLFSSL_SERVER
+#if !defined(NO_WOLFSSL_SERVER) && !defined(NO_TLS)

 #ifdef NO_FILESYSTEM
 #ifdef NO_RSA
@@ -536,7 +536,7 @@ THREAD_RETURN WOLFSSL_THREAD echoserver_test(void* args)
    WOLFSSL_RETURN_FROM_THREAD(0);
 }

-#endif /* !NO_WOLFSSL_SERVER */
+#endif /* !NO_WOLFSSL_SERVER && !NO_TLS */


 /* so overall tests can pull in test function */
@@ -562,7 +562,7 @@ THREAD_RETURN WOLFSSL_THREAD echoserver_test(void* args)
        wolfSSL_Debugging_ON();
 #endif
        ChangeToWolfRoot();
-#ifndef NO_WOLFSSL_SERVER
+#if !defined(NO_WOLFSSL_SERVER) && !defined(NO_TLS)
        echoserver_test(&args);
 #endif
        wolfSSL_Cleanup();
--- a/examples/server/server.c
+++ b/examples/server/server.c
@@ -75,7 +75,7 @@ static const char *wolfsentry_config_path = NULL;

 #include "examples/server/server.h"

-#ifndef NO_WOLFSSL_SERVER
+#if !defined(NO_WOLFSSL_SERVER) && !defined(NO_TLS)

 #if defined(WOLFSSL_TLS13) && ( \
       defined(HAVE_ECC) \
@@ -3986,7 +3986,7 @@ exit:
    WOLFSSL_RETURN_FROM_THREAD(0);
 }

-#endif /* !NO_WOLFSSL_SERVER */
+#endif /* !NO_WOLFSSL_SERVER && !NO_TLS */


 /* so overall tests can pull in test function */
@@ -4017,7 +4017,7 @@ exit:
 #endif
        ChangeToWolfRoot();

-#ifndef NO_WOLFSSL_SERVER
+#if !defined(NO_WOLFSSL_SERVER) && !defined(NO_TLS)
 #ifdef HAVE_STACK_SIZE
        StackSizeCheck(&args, server_test);
 #else
--- a/scripts/crl-revoked.test
+++ b/scripts/crl-revoked.test
@@ -217,8 +217,14 @@ else
   exit_hash_dir_code=0
 fi

-# run the test
-run_test
+# Check that server is enabled
+./examples/server/server -? 2>&1 | grep -- 'Create Ready file'
+if [ $? -eq 0 ]; then
+    # run the test
+    run_test
+else
+    exit_code=0
+fi

 # If we get to this exit, exit_code will be a 1 signaling failure
 echo "exiting with $exit_code certificate was not revoked"
--- a/src/bio.c
+++ b/src/bio.c
@@ -200,6 +200,7 @@ int wolfSSL_BIO_method_type(const WOLFSSL_BIO *b)
 }

 #ifndef WOLFCRYPT_ONLY
+#ifndef NO_TLS
 /* Helper function to read from WOLFSSL_BIO_SSL type
 *
 * returns the number of bytes read on success
@@ -231,6 +232,7 @@ static int wolfSSL_BIO_SSL_read(WOLFSSL_BIO* bio, void* buf,

    return ret;
 }
+#endif /* !NO_TLS */

 static int wolfSSL_BIO_MD_read(WOLFSSL_BIO* bio, void* buf, int sz)
 {
@@ -249,7 +251,7 @@ static int wolfSSL_BIO_MD_read(WOLFSSL_BIO* bio, void* buf, int sz)
    }
    return sz;
 }
-#endif /* WOLFCRYPT_ONLY */
+#endif /* !WOLFCRYPT_ONLY */


 /* Used to read data from a WOLFSSL_BIO structure
@@ -331,7 +333,7 @@ int wolfSSL_BIO_read(WOLFSSL_BIO* bio, void* buf, int len)
            #endif /* !NO_FILESYSTEM */
                break;
            case WOLFSSL_BIO_SSL:
-            #ifndef WOLFCRYPT_ONLY
+            #if !defined(WOLFCRYPT_ONLY) && !defined(NO_TLS)
                ret = wolfSSL_BIO_SSL_read(bio, buf, len, front);
            #else
                WOLFSSL_MSG("WOLFSSL_BIO_SSL used with WOLFCRYPT_ONLY");
@@ -500,7 +502,7 @@ static int wolfSSL_BIO_BASE64_write(WOLFSSL_BIO* bio, const void* data,
 }
 #endif /* WOLFSSL_BASE64_ENCODE */

-#ifndef WOLFCRYPT_ONLY
+#if !defined(WOLFCRYPT_ONLY) && !defined(NO_TLS)
 /* Helper function for writing to a WOLFSSL_BIO_SSL type
 *
 * returns the amount written in bytes on success
@@ -531,7 +533,7 @@ static int wolfSSL_BIO_SSL_write(WOLFSSL_BIO* bio, const void* data,
    }
    return ret;
 }
-#endif /* WOLFCRYPT_ONLY */
+#endif /* !WOLFCRYPT_ONLY && !NO_TLS */

 /* Writes to a WOLFSSL_BIO_BIO type.
 *
@@ -746,7 +748,7 @@ int wolfSSL_BIO_write(WOLFSSL_BIO* bio, const void* data, int len)
            #endif /* !NO_FILESYSTEM */
                break;
            case WOLFSSL_BIO_SSL:
-            #ifndef WOLFCRYPT_ONLY
+            #if !defined(WOLFCRYPT_ONLY) && !defined(NO_TLS)
                /* already got eof, again is error */
                if (front->eof) {
                    ret = WOLFSSL_FATAL_ERROR;
@@ -823,7 +825,7 @@ int wolfSSL_BIO_write(WOLFSSL_BIO* bio, const void* data, int len)
        bio = bio->next;
    }

-#ifndef WOLFCRYPT_ONLY
+#if !defined(WOLFCRYPT_ONLY) && !defined(NO_TLS)
 exit_chain:
 #endif

@@ -2560,6 +2562,7 @@ int wolfSSL_BIO_flush(WOLFSSL_BIO* bio)
        return ret;
    }

+#ifndef NO_TLS
    long wolfSSL_BIO_do_handshake(WOLFSSL_BIO *b)
    {
        WOLFSSL_ENTER("wolfSSL_BIO_do_handshake");
@@ -2605,6 +2608,7 @@ int wolfSSL_BIO_flush(WOLFSSL_BIO* bio)
            WOLFSSL_MSG("BIO has no SSL pointer set.");
        }
    }
+#endif

    long wolfSSL_BIO_set_ssl(WOLFSSL_BIO* b, WOLFSSL* ssl, int closeF)
    {
--- a/src/internal.c
+++ b/src/internal.c
@@ -191,7 +191,7 @@ WOLFSSL_CALLBACKS needs LARGE_STATIC_BUFFERS, please add LARGE_STATIC_BUFFERS
    #else
        #define SSL_TICKET_CTX(ssl) ssl->ctx->ticketEncCtx
    #endif
-    #if !defined(WOLFSSL_NO_DEF_TICKET_ENC_CB)
+    #if !defined(WOLFSSL_NO_DEF_TICKET_ENC_CB) && !defined(NO_TLS)
        static int TicketEncCbCtx_Init(WOLFSSL_CTX* ctx,
                                       TicketEncCbCtx* keyCtx);
        static void TicketEncCbCtx_Free(TicketEncCbCtx* keyCtx);
@@ -2493,7 +2493,7 @@ int InitSSL_Ctx(WOLFSSL_CTX* ctx, WOLFSSL_METHOD* method, void* heap)
 #endif /* HAVE_EXTENDED_MASTER && !NO_WOLFSSL_CLIENT */

 #if defined(HAVE_SESSION_TICKET) && !defined(NO_WOLFSSL_SERVER)
-#ifndef WOLFSSL_NO_DEF_TICKET_ENC_CB
+#if !defined(WOLFSSL_NO_DEF_TICKET_ENC_CB) && !defined(NO_TLS)
    ret = TicketEncCbCtx_Init(ctx, &ctx->ticketKeyCtx);
    if (ret != 0) return ret;
    ctx->ticketEncCb = DefTicketEncCb;
@@ -2614,7 +2614,9 @@ void SSL_CtxResourceFree(WOLFSSL_CTX* ctx)
    wolfEventQueue_Free(&ctx->event_queue);
 #endif /* HAVE_WOLF_EVENT */

+#ifndef NO_TLS /* its a static global see ssl.c "gNoTlsMethod" */
    XFREE(ctx->method, heapAtCTXInit, DYNAMIC_TYPE_METHOD);
+#endif
    ctx->method = NULL;

    XFREE(ctx->suites, ctx->heap, DYNAMIC_TYPE_SUITES);
@@ -2796,7 +2798,7 @@ void FreeSSL_Ctx(WOLFSSL_CTX* ctx)

        SSL_CtxResourceFree(ctx);
 #if defined(HAVE_SESSION_TICKET) && !defined(NO_WOLFSSL_SERVER) && \
-    !defined(WOLFSSL_NO_DEF_TICKET_ENC_CB)
+    !defined(WOLFSSL_NO_DEF_TICKET_ENC_CB) && !defined(NO_TLS)
        TicketEncCbCtx_Free(&ctx->ticketKeyCtx);
 #endif
        wolfSSL_RefFree(&ctx->ref);
@@ -8217,10 +8219,12 @@ void wolfSSL_ResourceFree(WOLFSSL* ssl)
    XFREE(ssl->peerSceTsipEncRsaKeyIndex, ssl->heap, DYNAMIC_TYPE_RSA);
    Renesas_cmn_Cleanup(ssl);
 #endif
+#ifndef NO_TLS
    if (ssl->buffers.inputBuffer.dynamicFlag)
        ShrinkInputBuffer(ssl, FORCED_FREE);
    if (ssl->buffers.outputBuffer.dynamicFlag)
        ShrinkOutputBuffer(ssl);
+#endif
 #ifdef WOLFSSL_THREADED_CRYPT
    {
        int i;
@@ -8540,9 +8544,11 @@ void FreeHandshakeResources(WOLFSSL* ssl)
    }
 #endif

+#ifndef NO_TLS
    /* input buffer */
    if (ssl->buffers.inputBuffer.dynamicFlag)
        ShrinkInputBuffer(ssl, NO_FORCED_FREE);
+#endif

 #if defined(WOLFSSL_TLS13) && defined(WOLFSSL_POST_HANDSHAKE_AUTH)
    if (!ssl->options.tls1_3)
@@ -9993,6 +9999,8 @@ ProtocolVersion MakeDTLSv1_3(void)
     */
 #endif /* !NO_ASN_TIME */

+
+#ifndef NO_TLS
 #if !defined(WOLFSSL_NO_CLIENT_AUTH) && \
               ((defined(WOLFSSL_SM2) && defined(WOLFSSL_SM3)) || \
                (defined(HAVE_ED25519) && !defined(NO_ED25519_CLIENT_AUTH)) || \
@@ -11896,14 +11904,9 @@ static int BuildFinished(WOLFSSL* ssl, Hashes* hashes, const byte* sender)
    if (ssl == NULL)
        return BAD_FUNC_ARG;

-#ifndef NO_TLS
    if (ssl->options.tls) {
        ret = BuildTlsFinished(ssl, hashes, sender);
    }
-#else
-    (void)hashes;
-    (void)sender;
-#endif
 #ifndef NO_OLD_TLS
    if (!ssl->options.tls) {
        ret = BuildMD5(ssl, hashes, sender);
@@ -11927,6 +11930,8 @@ int CipherRequires(byte first, byte second, int requirement)
 {

    (void)requirement;
+    (void)first;
+    (void)second;

 #ifndef WOLFSSL_NO_TLS12

@@ -12568,7 +12573,7 @@ int CipherRequires(byte first, byte second, int requirement)
 }

 #endif /* !NO_WOLFSSL_SERVER && !NO_WOLFSSL_CLIENT */
-
+#endif /* !NO_TLS */

 #ifndef NO_CERTS

@@ -13497,8 +13502,8 @@ int CopyDecodedAcertToX509(WOLFSSL_X509_ACERT* x509, DecodedAcert* dAcert)
 #endif /* WOLFSSL_ACERT */


-#if defined(HAVE_CERTIFICATE_STATUS_REQUEST) || \
-     (defined(HAVE_CERTIFICATE_STATUS_REQUEST_V2) && !defined(WOLFSSL_NO_TLS12))
+#if (defined(HAVE_CERTIFICATE_STATUS_REQUEST) || \
+     defined(HAVE_CERTIFICATE_STATUS_REQUEST_V2)) && !defined(WOLFSSL_NO_TLS12)
 static int ProcessCSR_ex(WOLFSSL* ssl, byte* input, word32* inOutIdx,
                      word32 status_length, int idx)
 {
@@ -13694,7 +13699,6 @@ int InitSigPkCb(WOLFSSL* ssl, SignatureCtx* sigCtx)

 #endif /* HAVE_PK_CALLBACKS */

-
 #if !defined(NO_WOLFSSL_CLIENT) || !defined(WOLFSSL_NO_CLIENT_AUTH)
 void DoCertFatalAlert(WOLFSSL* ssl, int ret)
 {
@@ -13737,12 +13741,15 @@ void DoCertFatalAlert(WOLFSSL* ssl, int ret)
        }
    }

+#ifndef NO_TLS
    /* send fatal alert and mark connection closed */
    SendAlert(ssl, alert_fatal, alertWhy); /* try to send */
+#else
+    (void)alertWhy;
+#endif
    ssl->options.isClosed = 1;
 }

-
 int SetupStoreCtxCallback(WOLFSSL_X509_STORE_CTX** store_pt,
        WOLFSSL* ssl, WOLFSSL_CERT_MANAGER* cm, ProcPeerCertArgs* args,
        int cert_err, void* heap, int* x509Free)
@@ -18626,6 +18633,7 @@ static int DoDtlsHandShakeMsg(WOLFSSL* ssl, byte* input, word32* inOutIdx,
 }
 #endif /* WOLFSSL_DTLS13 */

+#ifndef NO_TLS
 #ifndef WOLFSSL_NO_TLS12

 #ifdef HAVE_AEAD
@@ -22911,11 +22919,12 @@ int BuildMessage(WOLFSSL* ssl, byte* output, int outSz, const byte* input,

    (void)epochOrder;

-#ifndef NO_TLS
 #if defined(WOLFSSL_NO_TLS12) && defined(WOLFSSL_TLS13)
+    /* TLS v1.3 only */
    return BuildTls13Message(ssl, output, outSz, input, inSz, type,
                                               hashOutput, sizeOnly, asyncOkay);
 #else
+    /* TLS v1.2 or v1.3 */
 #ifdef WOLFSSL_TLS13
    if (ssl->options.tls1_3) {
        return BuildTls13Message(ssl, output, outSz, input, inSz, type,
@@ -22923,6 +22932,7 @@ int BuildMessage(WOLFSSL* ssl, byte* output, int outSz, const byte* input,
    }
 #endif

+#ifndef WOLFSSL_NO_TLS12
 #ifdef WOLFSSL_ASYNC_CRYPT
    ret = WC_NO_PENDING_E;
    if (asyncOkay) {
@@ -23435,9 +23445,7 @@ exit_buildmsg:

    /* Final cleanup */
    FreeBuildMsgArgs(ssl, args);
-
    return ret;
-#endif /* !WOLFSSL_NO_TLS12 */
 #else
    (void)outSz;
    (void)inSz;
@@ -23445,8 +23453,8 @@ exit_buildmsg:
    (void)hashOutput;
    (void)asyncOkay;
    return NOT_COMPILED_IN;
-#endif /* NO_TLS */
-
+#endif /* !WOLFSSL_NO_TLS12 */
+#endif
 }

 #ifndef WOLFSSL_NO_TLS12
@@ -23612,6 +23620,7 @@ int SendFinished(WOLFSSL* ssl)
    return ret;
 }
 #endif /* WOLFSSL_NO_TLS12 */
+#endif /* !NO_TLS */

 #ifndef NO_WOLFSSL_SERVER
 #if (!defined(WOLFSSL_NO_TLS12) && \
@@ -24802,6 +24811,8 @@ int SendAsyncData(WOLFSSL* ssl)
 }
 #endif

+#ifndef NO_TLS
+
 /**
 * ssl_in_handshake():
 * Invoked in wolfSSL_read/wolfSSL_write to check if wolfSSL_negotiate() is
@@ -25592,8 +25603,11 @@ static int SendAlert_ex(WOLFSSL* ssl, int severity, int type)
    return ret;
 }

+#endif /* !NO_TLS */
+
 int RetrySendAlert(WOLFSSL* ssl)
 {
+    int ret = 0;
    int type;
    int severity;
    WOLFSSL_ENTER("RetrySendAlert");
@@ -25611,12 +25625,18 @@ int RetrySendAlert(WOLFSSL* ssl)
    ssl->pendingAlert.code = 0;
    ssl->pendingAlert.level = alert_none;

-    return SendAlert_ex(ssl, severity, type);
+#ifndef NO_TLS
+    ret = SendAlert_ex(ssl, severity, type);
+#else
+    (void)type;
+#endif
+    return ret;
 }

 /* send alert message */
 int SendAlert(WOLFSSL* ssl, int severity, int type)
 {
+    int ret = 0;
    WOLFSSL_ENTER("SendAlert");

    if (ssl == NULL) {
@@ -25624,7 +25644,7 @@ int SendAlert(WOLFSSL* ssl, int severity, int type)
    }

    if (ssl->pendingAlert.level != alert_none) {
-        int ret = RetrySendAlert(ssl);
+        ret = RetrySendAlert(ssl);
        if (ret != 0) {
            if (ssl->pendingAlert.level == alert_none ||
                    (ssl->pendingAlert.level != alert_fatal &&
@@ -25637,10 +25657,13 @@ int SendAlert(WOLFSSL* ssl, int severity, int type)
            return ret;
        }
    }
-
-    return SendAlert_ex(ssl, severity, type);
+#ifndef NO_TLS
+    ret = SendAlert_ex(ssl, severity, type);
+#endif /* !NO_TLS */
+    return ret;
 }

+
 #ifdef WOLFSSL_DEBUG_TRACE_ERROR_CODES_H
 #include <wolfssl/debug-untrace-error-codes.h>
 #endif
@@ -29879,7 +29902,7 @@ static int HashSkeData(WOLFSSL* ssl, enum wc_HashType hashType,
 #endif /* !WOLFSSL_NO_TLS12 */

 /* client only parts */
-#ifndef NO_WOLFSSL_CLIENT
+#if !defined(NO_WOLFSSL_CLIENT) && !defined(NO_TLS)

    int HaveUniqueSessionObj(WOLFSSL* ssl)
    {
@@ -34378,7 +34401,9 @@ static int DoSessionTicket(WOLFSSL* ssl, const byte* input, word32* inOutIdx,

 #endif /* HAVE_SESSION_TICKET */

-#endif /* NO_WOLFSSL_CLIENT */
+#endif /* !NO_WOLFSSL_CLIENT && !NO_TLS */
+/* end client only parts */
+

 #ifndef NO_CERTS

@@ -34557,7 +34582,7 @@ static int DoSessionTicket(WOLFSSL* ssl, const byte* input, word32* inOutIdx,
        return MATCH_SUITE_ERROR;
    }

-#ifndef NO_WOLFSSL_SERVER
+#if !defined(NO_WOLFSSL_SERVER) && !defined(NO_TLS)

 #ifndef WOLFSSL_NO_TLS12

@@ -39267,7 +39292,7 @@ cleanup:
        return ret;
    }

-#ifndef WOLFSSL_NO_DEF_TICKET_ENC_CB
+#if !defined(WOLFSSL_NO_DEF_TICKET_ENC_CB) && !defined(NO_TLS)

 /* Initialize the context for session ticket encryption.
 *
@@ -41380,7 +41405,7 @@ static int DefTicketEncCb(WOLFSSL* ssl, byte key_name[WOLFSSL_TICKET_NAME_SZ],
    }
 #endif /* HAVE_SNI */

-#endif /* NO_WOLFSSL_SERVER */
+#endif /* !NO_WOLFSSL_SERVER && !NO_TLS */


 #ifdef WOLFSSL_ASYNC_CRYPT
--- a/src/keys.c
+++ b/src/keys.c
@@ -28,7 +28,7 @@

 #include <wolfssl/wolfcrypt/settings.h>

-#ifndef WOLFCRYPT_ONLY
+#if !defined(WOLFCRYPT_ONLY) && !defined(NO_TLS)

 #include <wolfssl/internal.h>
 #include <wolfssl/error-ssl.h>
@@ -4109,4 +4109,4 @@ int MakeMasterSecret(WOLFSSL* ssl)
 #endif
 }

-#endif /* WOLFCRYPT_ONLY */
+#endif /* !WOLFCRYPT_ONLY && !NO_TLS */
--- a/src/ssl.c
+++ b/src/ssl.c
@@ -1040,6 +1040,10 @@ static WC_THREADSHARED wolfSSL_Mutex inits_count_mutex
 static WC_THREADSHARED volatile int inits_count_mutex_valid = 0;
 #endif

+#ifdef NO_TLS
+static const WOLFSSL_METHOD gNoTlsMethod;
+#endif
+
 /* Create a new WOLFSSL_CTX struct and return the pointer to created struct.
   WOLFSSL_METHOD pointer passed in is given to ctx to manage.
   This function frees the passed in WOLFSSL_METHOD struct on failure and on
@@ -1062,8 +1066,13 @@ WOLFSSL_CTX* wolfSSL_CTX_new_ex(WOLFSSL_METHOD* method, void* heap)
        }
    }

+#ifndef NO_TLS
    if (method == NULL)
        return ctx;
+#else
+    /* a blank TLS method */
+    method = (WOLFSSL_METHOD*)&gNoTlsMethod;
+#endif

    ctx = (WOLFSSL_CTX*)XMALLOC(sizeof(WOLFSSL_CTX), heap, DYNAMIC_TYPE_CTX);
    if (ctx) {
@@ -2432,7 +2441,7 @@ int wolfSSL_mcast_set_highwater_ctx(WOLFSSL* ssl, void* ctx)

 #endif /* WOLFSSL_LEANPSK */

-
+#ifndef NO_TLS
 /* return underlying connect or accept, WOLFSSL_SUCCESS on ok */
 int wolfSSL_negotiate(WOLFSSL* ssl)
 {
@@ -2471,7 +2480,7 @@ int wolfSSL_negotiate(WOLFSSL* ssl)

    return err;
 }
-
+#endif /* !NO_TLS */

 WOLFSSL_ABI
 WC_RNG* wolfSSL_GetRNG(WOLFSSL* ssl)
@@ -2652,7 +2661,7 @@ int wolfSSL_CTX_is_static_memory(WOLFSSL_CTX* ctx, WOLFSSL_MEM_STATS* mem_stats)

 #endif /* WOLFSSL_STATIC_MEMORY */

-
+#ifndef NO_TLS
 /* return max record layer size plaintext input size */
 int wolfSSL_GetMaxOutputSize(WOLFSSL* ssl)
 {
@@ -3012,7 +3021,7 @@ int wolfSSL_mcast_read(WOLFSSL* ssl, word16* id, void* data, int sz)
 }

 #endif /* WOLFSSL_MULTICAST */
-
+#endif /* !NO_TLS */

 /* helpers to set the device id, WOLFSSL_SUCCESS on ok */
 WOLFSSL_ABI
@@ -3059,6 +3068,7 @@ void* wolfSSL_CTX_GetHeap(WOLFSSL_CTX* ctx, WOLFSSL* ssl)
 }


+#ifndef NO_TLS
 #ifdef HAVE_SNI

 WOLFSSL_ABI
@@ -3124,7 +3134,7 @@ int wolfSSL_SNI_GetFromBuffer(const byte* clientHello, word32 helloSz,
    return BAD_FUNC_ARG;
 }

-#endif /* NO_WOLFSSL_SERVER */
+#endif /* !NO_WOLFSSL_SERVER */

 #endif /* HAVE_SNI */

@@ -4126,7 +4136,7 @@ int wolfSSL_shutdown(WOLFSSL* ssl)

    return ret;
 }
-
+#endif /* !NO_TLS */

 /* get current error state value */
 int wolfSSL_state(WOLFSSL* ssl)
@@ -4203,7 +4213,6 @@ int wolfSSL_want_read(WOLFSSL* ssl)
    return 0;
 }

-
 /* return TRUE if current error is want write */
 int wolfSSL_want_write(WOLFSSL* ssl)
 {
@@ -4214,7 +4223,6 @@ int wolfSSL_want_write(WOLFSSL* ssl)
    return 0;
 }

-
 char* wolfSSL_ERR_error_string(unsigned long errNumber, char* data)
 {
    WOLFSSL_ENTER("wolfSSL_ERR_error_string");
@@ -4749,7 +4757,7 @@ int wolfSSL_CTX_set_group_messages(WOLFSSL_CTX* ctx)
 #endif


-#ifndef NO_WOLFSSL_CLIENT
+#if !defined(NO_WOLFSSL_CLIENT) && !defined(NO_TLS)
 /* connect enough to get peer cert chain */
 int wolfSSL_connect_cert(WOLFSSL* ssl)
 {
@@ -4783,9 +4791,7 @@ int wolfSSL_set_group_messages(WOLFSSL* ssl)
 /* make minVersion the internal equivalent SSL version */
 static int SetMinVersionHelper(byte* minVersion, int version)
 {
-#ifdef NO_TLS
    (void)minVersion;
-#endif

    switch (version) {
 #if defined(WOLFSSL_ALLOW_SSLV3) && !defined(NO_OLD_TLS)
@@ -9298,7 +9304,7 @@ int wolfSSL_DTLS_SetCookieSecret(WOLFSSL* ssl,


 /* EITHER SIDE METHODS */
-#if defined(OPENSSL_EXTRA) || defined(WOLFSSL_EITHER_SIDE)
+#if !defined(NO_TLS) && (defined(OPENSSL_EXTRA) || defined(WOLFSSL_EITHER_SIDE))
    WOLFSSL_METHOD* wolfSSLv23_method(void)
    {
        return wolfSSLv23_method_ex(NULL);
@@ -9344,10 +9350,10 @@ int wolfSSL_DTLS_SetCookieSecret(WOLFSSL* ssl,
    }
    #endif
    #endif
-#endif /* OPENSSL_EXTRA || WOLFSSL_EITHER_SIDE */
+#endif /* !NO_TLS && (OPENSSL_EXTRA || WOLFSSL_EITHER_SIDE) */

 /* client only parts */
-#ifndef NO_WOLFSSL_CLIENT
+#if !defined(NO_WOLFSSL_CLIENT) && !defined(NO_TLS)

    #if defined(OPENSSL_EXTRA) && !defined(NO_OLD_TLS)
    WOLFSSL_METHOD* wolfSSLv2_client_method(void)
@@ -9847,11 +9853,11 @@ int wolfSSL_DTLS_SetCookieSecret(WOLFSSL* ssl,
    #endif /* !WOLFSSL_NO_TLS12 || !NO_OLD_TLS || !WOLFSSL_TLS13 */
    }

-#endif /* NO_WOLFSSL_CLIENT */
-
+#endif /* !NO_WOLFSSL_CLIENT && !NO_TLS */
+/* end client only parts */

 /* server only parts */
-#ifndef NO_WOLFSSL_SERVER
+#if !defined(NO_WOLFSSL_SERVER) && !defined(NO_TLS)

    #if defined(OPENSSL_EXTRA) && !defined(NO_OLD_TLS)
    WOLFSSL_METHOD* wolfSSLv2_server_method(void)
@@ -10388,7 +10394,9 @@ int wolfSSL_DTLS_SetCookieSecret(WOLFSSL* ssl,
 #endif /* !WOLFSSL_NO_TLS12 */
    }

-#endif /* NO_WOLFSSL_SERVER */
+#endif /* !NO_WOLFSSL_SERVER && !NO_TLS */
+/* end server only parts */
+

 #if defined(WOLFSSL_DTLS) && !defined(NO_WOLFSSL_SERVER)
 int wolfDTLS_SetChGoodCb(WOLFSSL* ssl, ClientHelloGoodCb cb, void* user_ctx)
@@ -10632,7 +10640,7 @@ int wolfSSL_set_compression(WOLFSSL* ssl)


 #ifndef USE_WINDOWS_API
-    #ifndef NO_WRITEV
+    #if !defined(NO_WRITEV) && !defined(NO_TLS)

        /* simulate writev semantics, doesn't actually do block at a time though
           because of SSL_write behavior and because front adds may be small */
@@ -11398,6 +11406,8 @@ int wolfSSL_set_compression(WOLFSSL* ssl)
        }
        return WOLFSSL_FAILURE;
    }
+
+#ifndef NO_TLS
    WOLFSSL_CIPHERSUITE_INFO wolfSSL_get_ciphersuite_info(byte first,
            byte second)
    {
@@ -11413,6 +11423,7 @@ int wolfSSL_set_compression(WOLFSSL* ssl)
        info.psk = (byte)CipherRequires(first, second, REQUIRES_PSK);
        return info;
    }
+#endif

    /**
     * @param first First byte of the hash and signature algorithm
@@ -15842,6 +15853,7 @@ int wolfSSL_ERR_GET_REASON(unsigned long err)
    return ret;
 }

+#ifndef NO_TLS
 /* returns a string that describes the alert
 *
 * alertID the alert value to look up
@@ -15853,13 +15865,13 @@ const char* wolfSSL_alert_type_string_long(int alertID)
    return AlertTypeToString(alertID);
 }

-
 const char* wolfSSL_alert_desc_string_long(int alertID)
 {
    WOLFSSL_ENTER("wolfSSL_alert_desc_string_long");

    return AlertTypeToString(alertID);
 }
+#endif /* !NO_TLS */

 #define STATE_STRINGS_PROTO(s) \
    {                          \
@@ -16652,7 +16664,7 @@ long wolfSSL_set_tlsext_status_ocsp_resp(WOLFSSL *s, unsigned char *resp,
 #endif /* HAVE_OCSP */

 #ifdef HAVE_MAX_FRAGMENT
-#ifndef NO_WOLFSSL_CLIENT
+#if !defined(NO_WOLFSSL_CLIENT) && !defined(NO_TLS)
 /**
 * Set max fragment tls extension
 * @param c a pointer to WOLFSSL_CTX object
@@ -16680,7 +16692,7 @@ int wolfSSL_set_tlsext_max_fragment_length(WOLFSSL *s, unsigned char mode)

    return wolfSSL_UseMaxFragment(s, mode);
 }
-#endif /* NO_WOLFSSL_CLIENT */
+#endif /* !NO_WOLFSSL_CLIENT && !NO_TLS */
 #endif /* HAVE_MAX_FRAGMENT */

 #endif /* OPENSSL_EXTRA */
@@ -21306,6 +21318,7 @@ WOLFSSL_BIO *wolfSSL_SSL_get_wbio(const WOLFSSL *s)
 }
 #endif /* !NO_BIO */

+#ifndef NO_TLS
 int wolfSSL_SSL_do_handshake_internal(WOLFSSL *s)
 {
    WOLFSSL_ENTER("wolfSSL_SSL_do_handshake_internal");
@@ -21339,6 +21352,7 @@ int wolfSSL_SSL_do_handshake(WOLFSSL *s)
 #endif
    return wolfSSL_SSL_do_handshake_internal(s);
 }
+#endif /* !NO_TLS */

 #if defined(OPENSSL_VERSION_NUMBER) && OPENSSL_VERSION_NUMBER >= 0x10100000L
 int wolfSSL_SSL_in_init(const WOLFSSL *ssl)
@@ -22194,7 +22208,7 @@ int set_curves_list(WOLFSSL* ssl, WOLFSSL_CTX *ctx, const char* names,
        else {
            disabled &= ~(1U << curve);
        }
-    #ifdef HAVE_SUPPORTED_CURVES
+    #if defined(HAVE_SUPPORTED_CURVES) && !defined(NO_TLS)
    #if !defined(WOLFSSL_OLD_SET_CURVES_LIST)
        /* using the wolfSSL API to set the groups, this will populate
         * (ssl|ctx)->groups and reset any TLSX_SUPPORTED_GROUPS.
@@ -22217,7 +22231,7 @@ int set_curves_list(WOLFSSL* ssl, WOLFSSL_CTX *ctx, const char* names,
            goto leave;
        }
    #endif
-    #endif /* HAVE_SUPPORTED_CURVES */
+    #endif /* HAVE_SUPPORTED_CURVES && !NO_TLS */
    }

    if (ssl != NULL)
@@ -22256,6 +22270,7 @@ int wolfSSL_set1_curves_list(WOLFSSL* ssl, const char* names)
 #endif /* (HAVE_ECC || HAVE_CURVE25519 || HAVE_CURVE448) */
 #endif /* OPENSSL_EXTRA || HAVE_CURL */

+
 #ifdef OPENSSL_EXTRA
 /* Sets a callback for when sending and receiving protocol messages.
 * This callback is copied to all WOLFSSL objects created from the ctx.
--- a/src/ssl_certman.c
+++ b/src/ssl_certman.c
@@ -75,6 +75,7 @@ static WC_INLINE WOLFSSL_METHOD* cm_pick_method(void* heap)
    #else
        return NULL;
    #endif
+    (void)heap;
 }

 /* Create a new certificate manager with a heap hint.
--- a/src/ssl_sess.c
+++ b/src/ssl_sess.c
@@ -871,7 +871,7 @@ int wolfSSL_set_timeout(WOLFSSL* ssl, unsigned int to)
    return WOLFSSL_SUCCESS;
 }

-
+#ifndef NO_TLS
 /**
 * Sets ctx session timeout in seconds.
 * The timeout value set here should be reflected in the
@@ -932,7 +932,7 @@ int wolfSSL_CTX_set_timeout(WOLFSSL_CTX* ctx, unsigned int to)
    return ret;
 #endif /* WOLFSSL_ERROR_CODE_OPENSSL */
 }
-
+#endif /* !NO_TLS */

 #ifndef NO_CLIENT_CACHE

--- a/src/tls.c
+++ b/src/tls.c
@@ -13607,7 +13607,8 @@ int TLSX_PopulateExtensions(WOLFSSL* ssl, byte isServer)
            return ret;
 #endif /* HAVE_RPK */

-#if defined(HAVE_ENCRYPT_THEN_MAC) && !defined(WOLFSSL_AEAD_ONLY)
+#if defined(HAVE_ENCRYPT_THEN_MAC) && !defined(WOLFSSL_AEAD_ONLY) && \
+    !defined(WOLFSSL_NO_TLS12)
        if (!ssl->options.disallowEncThenMac) {
            ret = TLSX_EncryptThenMac_Use(ssl);
            if (ret != 0)
@@ -15681,7 +15682,7 @@ int TLSX_Parse(WOLFSSL* ssl, const byte* input, word16 length, byte msgType,
        #elif defined(WOLFSSL_ALLOW_TLSV10)
            InitSSL_Method(method, MakeTLSv1());
        #else
-            #error No TLS version enabled!
+        #error No TLS version enabled! Consider using NO_TLS or WOLFCRYPT_ONLY.
        #endif

            method->downgrade = 1;
@@ -16056,7 +16057,7 @@ int TLSX_Parse(WOLFSSL* ssl, const byte* input, word16 length, byte msgType,
        #elif defined(WOLFSSL_ALLOW_TLSV10)
            InitSSL_Method(method, MakeTLSv1());
        #else
-            #error No TLS version enabled!
+        #error No TLS version enabled! Consider using NO_TLS or WOLFCRYPT_ONLY.
        #endif

            method->downgrade = 1;
--- a/tests/api.c
+++ b/tests/api.c
--- a/tests/suites.c
+++ b/tests/suites.c
@@ -58,7 +58,7 @@
 #include "examples/server/server.h"

 #if !defined(NO_WOLFSSL_SERVER) && !defined(NO_WOLFSSL_CLIENT) && \
-    !defined(SINGLE_THREADED)
+    !defined(NO_TLS) && !defined(SINGLE_THREADED)
 static WOLFSSL_CTX* cipherSuiteCtx = NULL;
 static char nonblockFlag[] = "-N";
 static char noVerifyFlag[] = "-d";
@@ -858,8 +858,8 @@ static void test_harness(void* vargs)
 int SuiteTest(int argc, char** argv)
 {
 #if !defined(NO_WOLFSSL_SERVER) && !defined(NO_WOLFSSL_CLIENT) && \
-    !defined(WOLF_CRYPTO_CB_ONLY_RSA) && !defined(WOLF_CRYPTO_CB_ONLY_ECC) && \
-    !defined(SINGLE_THREADED)
+    !defined(NO_TLS) && !defined(SINGLE_THREADED) && \
+    !defined(WOLF_CRYPTO_CB_ONLY_RSA) && !defined(WOLF_CRYPTO_CB_ONLY_ECC)
    func_args args;
    char argv0[3][80];
    char* myArgv[3];
@@ -1522,5 +1522,5 @@ exit:
    (void)argc;
    (void)argv;
    return NOT_COMPILED_IN;
-#endif /* !NO_WOLFSSL_SERVER && !NO_WOLFSSL_CLIENT */
+#endif /* !NO_WOLFSSL_SERVER && !NO_WOLFSSL_CLIENT && !NO_TLS */
 }
--- a/tests/unit.c
+++ b/tests/unit.c
@@ -249,6 +249,7 @@ int unit_test(int argc, char** argv)

 #if !defined(NO_WOLFSSL_CIPHER_SUITE_TEST) && \
    !defined(NO_WOLFSSL_CLIENT) && !defined(NO_WOLFSSL_SERVER) && \
+    !defined(NO_TLS) && \
    !defined(SINGLE_THREADED)
    if ((ret = SuiteTest(argc, argv)) != 0) {
        fprintf(stderr, "suite test failed with %d\n", ret);
--- a/testsuite/testsuite.c
+++ b/testsuite/testsuite.c
@@ -58,7 +58,8 @@
 void file_test(const char* file, byte* check);
 #endif

-#if !defined(NO_WOLFSSL_SERVER) && !defined(NO_WOLFSSL_CLIENT)
+#if !defined(NO_WOLFSSL_SERVER) && !defined(NO_WOLFSSL_CLIENT) && \
+    !defined(NO_TLS)

 #ifdef HAVE_STACK_SIZE
 static THREAD_RETURN simple_test(func_args *args);
@@ -111,6 +112,7 @@ static void *echoclient_test_wrapper(void* args) {
 int testsuite_test(int argc, char** argv)
 {
 #if !defined(NO_WOLFSSL_SERVER) && !defined(NO_WOLFSSL_CLIENT) && \
+    !defined(NO_TLS) && \
    (!defined(WOLF_CRYPTO_CB_ONLY_RSA) && !defined(WOLF_CRYPTO_CB_ONLY_ECC))
    func_args server_args;

@@ -413,6 +415,7 @@ cleanup:
 #endif

 #if !defined(NO_WOLFSSL_SERVER) && !defined(NO_WOLFSSL_CLIENT) && \
+    !defined(NO_TLS) && \
   (!defined(WOLF_CRYPTO_CB_ONLY_RSA) && !defined(WOLF_CRYPTO_CB_ONLY_ECC))
 /* Perform a basic TLS handshake.
 *