Add wolfSSL compatibility patches for 12 third-party projects - #362
Open
julek-wolfssl wants to merge 13 commits into
Open
julek-wolfssl wants to merge 13 commits into
julek-wolfssl wants to merge 13 commits into
Conversation
The patch completes TLSCRLCheck under wolfSSL: bindconf_tls_defaults and lloadd gate the CRL check on HAVE_WOLFSSL as well as HAVE_OPENSSL, so syncrepl and proxy targets inherit it; tlso_ctx_init fails when wolfSSL was built without CRL support instead of silently ignoring the option; and the tls-server-end-point channel binding uses OBJ_find_sigid_algs so SHA-384/512 signed certificates get the right digest. Requires wolfSSL built with CRL support, which --enable-openldap now turns on.
wolfSSL verifies the peer certificate during the handshake while OpenSSL leaves that to the application. msmtp does its own checking afterwards, so an account without a tls_trust_file aborted the handshake. Both patches turn the handshake verification off in that case and set SSL_VERIFY_PEER explicitly otherwise, so the result does not depend on the wolfSSL default. msmtp --version reports wolfSSL instead of "none".
wolfSSL is used only when no other TLS library was found. With OpenSSL installed the wolfSSL block no longer injects its defines and include paths into the OpenSSL build, and pkg-config is optional.
net-snmp 5.9.5 and newer ships wolfSSL support upstream, so no patch is needed. Document the build and test steps in the README.
HAVE_EVP_PKEY_NEW_RAW_PRIVATE_KEY is defined for wolfSSL because the configure probe is skipped in the wolfSSL branch, and without it the isc shim rewrote every HMAC key to EVP_PKEY_new_mac_key. A --with-wolfssl=DIR value is rejected like for the other libraries instead of silently building with OpenSSL.
The wolfSSL selection survives a second cmake run (CRYPTO was cached as openssl) and cmake fails early when ENABLE_BINARY_BUILD is not 1. The CSR generator builds the basicConstraints extension with X509V3_EXT_nconf_nid(); wolfSSL only stubs X509V3_EXT_conf_nid().
The subjectAltName check skips IPv6 entries for an IPv4 peer name: wolfSSL returns the stack in reverse order, so a certificate with an IPv6 entry reached socat's IP comparison first, which resolved the IPv4 peer name with an AF_INET6 hint and died on the failed lookup (test 402 whenever testalt.crt carried ::1). An AH_BOTTOM block keeps the derived config.h.in defines (HAVE_TERMIOS_ISPEED/OSPEED/SPEED, WITH_STREAMS, HAVE_HOSTS_DENY_TABLE) through the autoheader run that the configure.ac changes force, so tests 459 and 460 pass.
The SPAKE plugin does not link -lcrypto in the wolfSSL build (LIBS already carries wolfSSL), the KDC only installs the wolfSSL log callback in a DEBUG_WOLFSSL build, and the configure debug leftovers are gone.
The extensions are built with X509V3_EXT_nconf_nid() and, for the subject key identifier "hash", from X509_pubkey_digest() and X509V3_EXT_i2d(); wolfSSL only stubs X509V3_EXT_conf_nid(). The key identifier is the same value an OpenSSL build writes. Requires wolfSSL with ASN1_TIME_set() and an X509_pubkey_digest() that digests the subjectPublicKey.
The patch adds --with-wolfssl=DIR to configure.ac and enables wolfSSL logging in DEBUG_WOLFSSL builds. --without-wolfssl is accepted, a bare --with-wolfssl asks for the directory instead of picking up OpenSSL headers, and --with-crypto warns when ignored. Link the README table to the new version.
Add wolfssl-python-3.14.5.patch, build-wolfssl_py314.sh and the 3.14 section in Python/README.txt. Requires wolfSSL with X509_VERIFY_PARAM_get_hostflags() and an AUTHORITY_INFO_ACCESS_free() that frees the entries. The wolfSSL CRL fallback in load_verify_locations closes the file, frees the CRL and keeps errno for a missing cafile. IPADDR_MISMATCH raises SSLCertVerificationError like DOMAIN_NAME_MISMATCH, so the tests assert CertificateError. _get_aia_uri returns None for a duplicate AIA extension like OpenSSL. test_session keeps the has_ticket assertion for OpenSSL builds.
RSATests skips AsymMech::RSA_SSL under wolfSSL: the implementation compiles the RSA_SSL case out (no NID_md5_sha1), so the test signed with type 0 and produced a DigestInfo with an empty OID that only verified against itself.
There was a problem hiding this comment.
🟡 Changes recommended
Several backend-selection paths break non-wolfSSL builds or fail to honor disable/reconfiguration options, and Python tests lose assertions.
Get a fresh assessment by requesting another Copilot review.
Pull request overview
Adds wolfSSL compatibility patches, build instructions, and test adjustments for multiple third-party projects.
Changes:
- Adds compatibility patches for TLS, crypto backends, certificate handling, and build systems.
- Adds project-specific wolfSSL build and test documentation.
- Updates the project index with newer supported versions.
File summaries
| File | Description |
|---|---|
README.md |
Updates project/version links. |
tcpdump/4.99.6/* |
Adds wolfSSL configure support and documentation. |
socat/1.8.1.1/* |
Adds wolfSSL support and SAN handling fixes. |
Python/* |
Adds Python 3.14 wolfSSL patch, build script, and documentation. |
openldap/2.6.13/* |
Adds wolfSSL TLS and CRL support. |
net-snmp/README.md |
Documents upstream wolfSSL support. |
msmtp/1.8.32/* |
Adds wolfSSL backend support. |
msmtp/1.8.28/* |
Updates the older wolfSSL patch. |
libvncserver/0.9.15.patch |
Adds CMake wolfSSL detection and linking. |
libspdm/3.8.2/* |
Adds wolfSSL backend integration and tests. |
libimobiledevice/1.4.0.patch |
Fixes wolfSSL certificate extension handling. |
krb5/* |
Adds wolfSSL crypto/TLS integration and test changes. |
jwt-cpp/0.7.2.patch |
Updates Ed25519 compatibility tests. |
bind9/9.20.23.patch |
Adds wolfSSL configure support and compatibility definitions. |
softhsm/2.7.0.patch |
Adds wolfSSL backend support and skips unsupported tests. |
Review details
- Files reviewed: 23/24 changed files
- Comments generated: 8
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Comment on lines
+8121
to
+8125
| + #else | ||
| + {"TLSV1_ALERT_DECRYPT_ERROR", 20, 1051}, | ||
| + #endif | ||
| + #ifdef SSL_R_TLSV1_ALERT_EXPORT_RESTRICTION | ||
| + {"TLSV1_ALERT_EXPORT_RESTRICTION", ERR_LIB_SSL, SSL_R_TLSV1_ALERT_EXPORT_RESTRI |
Comment on lines
+249
to
+251
| +#include <wolfssl/wolfcrypt/settings.h> | ||
| +#ifdef DEBUG_WOLFSSL | ||
| +#include <wolfssl/wolfcrypt/logging.h> |
Comment on lines
+591
to
+595
| + LIBS="$LIBS -lwolfssl" | ||
| + CPPFLAGS="$CPPFLAGS -DWOLFSSL_USE_OPTIONS_H" | ||
| + | ||
| + AC_MSG_RESULT([yes]) | ||
| + WITH_WOLFSSL=yes |
Comment on lines
+343
to
+347
| + try: | ||
| sslobj.unwrap() | ||
| + except ssl.SSLWantReadError: | ||
| + pass | ||
| sock.send(outgoing.read()) |
Comment on lines
+616
to
+619
| +check-pytests: check-recurse | ||
| check-pytests: adata conccache etinfo forward gcred hist hooks hrealm | ||
| check-pytests: icinterleave icred kdbtest localauth plugorder rdreq replay | ||
| check-pytests: responder s2p s4u2proxy unlockiter s4u2self |
Comment on lines
+74
to
+76
| +if(CRYPTO STREQUAL "wolfssl" OR IS_WOLFSSL STREQUAL "1") | ||
| + set(IS_WOLFSSL "1" CACHE INTERNAL "wolfSSL selected as the crypto backend") | ||
| + set(CRYPTO "openssl") |
Comment on lines
+150
to
+154
| + else | ||
| + { | ||
| + /* Do not depend on the library default: a tls_trust_file account | ||
| + * must be verified during the handshake. */ | ||
| + SSL_CTX_set_verify(mtls->internals->ssl_ctx, SSL_VERIFY_PEER, NULL); |
Comment on lines
+205
to
+209
| + else | ||
| + { | ||
| + /* Do not depend on the library default: a tls_trust_file account | ||
| + * must be verified during the handshake. */ | ||
| + SSL_CTX_set_verify(mtls->internals->ssl_ctx, SSL_VERIFY_PEER, NULL); |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add patches enabling wolfSSL support (or fixing existing wolfSSL support) across a batch of projects: