diff --git a/Python/README.txt b/Python/README.txt index 7d1d56582..1118b2a23 100644 --- a/Python/README.txt +++ b/Python/README.txt @@ -205,3 +205,40 @@ $ export LD_LIBRARY_PATH=/usr/local/lib Run the ssl tests with: $ make test TESTOPTS="-v test_ssl" + +# 3.14 Patches + +These patches are for the Python 3.14.x series. The actively tested version +is 3.14.5, which can be downloaded from + +https://www.python.org/ftp/python/3.14.5/Python-3.14.5.tar.xz + +The following wolfSSL configuration is required for Python 3.14.x (see +build-wolfssl_py314.sh): + +$ cd wolfssl-master +$ ./configure --enable-all --enable-tlsv10 CPPFLAGS="-DHAVE_SECRET_CALLBACK -DWOLFSSL_PYTHON" +$ make check + +After compiling wolfSSL, install: + +$ sudo make install + +To build Python-3.14.5 with wolfSSL enabled: + +$ tar xvf Python-3.14.5.tar.xz +$ cd Python-3.14.5 +$ patch -p1 < wolfssl-python-3.14.5.patch +$ rm -f aclocal.m4 +$ autoreconf -if +$ ./configure --with-wolfssl=/usr/local +$ make + +If make fails with a shared object error, you may need to update your +LD_LIBRARY_PATH first: + +$ export LD_LIBRARY_PATH=/usr/local/lib + +Run the ssl and crypto related tests with: + +$ make test TESTOPTS="-v test_ssl test.test_asyncio.test_ssl test.test_asyncio.test_sslproto test_hashlib test_hmac test_secrets test_ftplib test_imaplib test_poplib test_smtplib test_httplib test_urllib2_localnet test_xmlrpc test_docxmlrpc" diff --git a/Python/build-wolfssl_py314.sh b/Python/build-wolfssl_py314.sh new file mode 100755 index 000000000..440db87f4 --- /dev/null +++ b/Python/build-wolfssl_py314.sh @@ -0,0 +1,41 @@ +#!/bin/bash + +echo "Cloning wolfssl master to directory wolfssl-master" +git clone --depth=1 https://github.com/wolfssl/wolfssl wolfssl-master +if [ "${PIPESTATUS[0]}" != 0 ]; then + echo "clone failed!" + exit 1 +fi +pushd wolfssl-master + +echo "Running ./autogen.sh" +./autogen.sh +if [ "${PIPESTATUS[0]}" != 0 ]; then + echo "autogen.sh failed" + popd + exit 1 +fi + +echo "Running ./configure" +./configure --enable-all --enable-tlsv10 CPPFLAGS="-DHAVE_SECRET_CALLBACK -DWOLFSSL_PYTHON" +if [ "${PIPESTATUS[0]}" != 0 ]; then + echo "./configure failed" + popd + exit 1 +fi + +echo "Compiling wolfSSL" +make check +if [ "${PIPESTATUS[0]}" != 0 ]; then + echo "make failed" + popd + exit 1 +fi + +popd + +echo "wolfSSL compiled, please install with:" +echo "" +echo "$ cd wolfssl-master" +echo "$ sudo make install" + diff --git a/Python/wolfssl-python-3.14.5.patch b/Python/wolfssl-python-3.14.5.patch new file mode 100644 index 000000000..dd6ce5d2a --- /dev/null +++ b/Python/wolfssl-python-3.14.5.patch @@ -0,0 +1,8181 @@ +From f6bbfe97527c449e99212825e316db6ebc06e57b Mon Sep 17 00:00:00 2001 +From: Juliusz Sosinowicz +Date: Fri, 4 Sep 2026 09:30:42 +0000 +Subject: [PATCH] wolfSSL Patch for Python 3.14.5 + +This patch adds wolfSSL support to CPython 3.14.5 (_ssl and _hashlib +modules and the associated tests). + +Compile wolfSSL with: + ./configure --enable-all --enable-tlsv10 CPPFLAGS="-DHAVE_SECRET_CALLBACK -DWOLFSSL_PYTHON" + make + make install + +Apply the patch and build CPython with (from a clean v3.14.5 checkout or +Python-3.14.5.tar.xz): + patch -p1 < wolfssl-python-3.14.5.patch + export LD_LIBRARY_PATH=/usr/local/lib:$LD_LIBRARY_PATH + rm -f aclocal.m4 + autoreconf -if + ./configure --with-wolfssl=/usr/local + make -j + +Note: upstream configure.ac requires Autoconf 2.72. The patch lowers +AC_PREREQ to 2.71 so that configure can be regenerated with the Autoconf +shipped by Ubuntu 24.04. Autoconf 2.71 generates a working configure. + +Run the tests with: + make test TESTOPTS="-v test_ssl test.test_asyncio.test_ssl test.test_asyncio.test_sslproto test_hashlib test_hmac test_secrets test_ftplib test_imaplib test_poplib test_smtplib test_httplib test_urllib2_localnet test_xmlrpc test_docxmlrpc" + +All of the listed test modules pass. Notes on the expected skips and on +tests that depend on the environment: + +- test_ssl: 25 tests are skipped. wolfSSL specific skips: test_unwrap + (read ahead behaviour on shutdown), test_get_ciphers (AESGCM cipher + string rule not supported), test_get_default_verify_paths and + test_load_default_certs_env (no default verify paths / env vars), + test_dh_params (kEDH cipher string not supported). The remaining skips + are the same as with OpenSSL (TLS 1.0/1.1/SSLv3 not enabled in the + context, Windows only, IPv6, locale, free-threading, RFC 5280 strict + verification). +- test_ssl test_sni_callback_on_dead_references: wolfSSL sends a fatal + alert from the failing SNI callback and fails the handshake with + ALERT_FATAL_ERROR instead of OpenSSL's "callback failed" reason; the + test accepts that reason under wolfSSL. +- test_httplib: test_networked_good_cert is skipped (the remote cert has + only a CN, wolfSSL requires a SAN). test_networked and + test_networked_noverification need a direct connection to + self-signed.pythontest.net; they fail on hosts where outgoing TLS is + intercepted by a proxy with a locally trusted CA. Run with + TESTOPTS="-u=-network ..." to skip them. + +Changes compared to the 3.13.7 patch: + +- Modules/_ssl.c: wolfSSL error table is selected before the new + _ssl_data_35.h/_ssl_data_340.h include ladder. +- X509_VERIFY_PARAM_get_hostflags() is now used by _ssl.c and requires + wolfSSL with wolfSSL_X509_VERIFY_PARAM_get_hostflags(). +- Lib/test/certdata/capath-2048-plus: the copies of the "our-ca-server" + CA are refreshed to match the regenerated pycacert.pem of 3.14.5. +- configure.ac: AC_PREREQ lowered to 2.71 (see above). +--- + Lib/ssl.py | 1 + + Lib/test/certdata/capath-2048-plus/5ed36f99.0 | 41 + + Lib/test/certdata/capath-2048-plus/99d0fa06.0 | 41 + + Lib/test/certdata/capath-2048-plus/b1930218.0 | 27 + + Lib/test/certdata/capath-2048-plus/ceff1710.0 | 27 + + Lib/test/support/__init__.py | 3 +- + Lib/test/test_asyncio/test_events.py | 29 +- + Lib/test/test_asyncio/test_ssl.py | 14 +- + Lib/test/test_httplib.py | 18 +- + Lib/test/test_imaplib.py | 4 + + Lib/test/test_poplib.py | 3 +- + Lib/test/test_ssl.py | 421 +- + Makefile.pre.in | 1 + + Modules/_hashopenssl.c | 9 + + Modules/_ssl.c | 186 +- + Modules/_ssl.h | 4 + + Modules/_ssl_data_wolfssl.h | 6358 +++++++++++++++++ + configure.ac | 48 +- + 18 files changed, 7095 insertions(+), 140 deletions(-) + create mode 100644 Lib/test/certdata/capath-2048-plus/5ed36f99.0 + create mode 100644 Lib/test/certdata/capath-2048-plus/99d0fa06.0 + create mode 100644 Lib/test/certdata/capath-2048-plus/b1930218.0 + create mode 100644 Lib/test/certdata/capath-2048-plus/ceff1710.0 + create mode 100644 Modules/_ssl_data_wolfssl.h + +diff --git a/Lib/ssl.py b/Lib/ssl.py +index 8889aff..554ff9f 100644 +--- a/Lib/ssl.py ++++ b/Lib/ssl.py +@@ -119,6 +119,7 @@ + HAS_TLSv1_1, HAS_TLSv1_2, HAS_TLSv1_3, HAS_PSK, HAS_PHA + ) + from _ssl import _DEFAULT_CIPHERS, _OPENSSL_API_VERSION ++from _ssl import IS_WOLFSSL + + _IntEnum._convert_( + '_SSLMethod', __name__, +diff --git a/Lib/test/certdata/capath-2048-plus/5ed36f99.0 b/Lib/test/certdata/capath-2048-plus/5ed36f99.0 +new file mode 100644 +index 0000000..e7dfc82 +--- /dev/null ++++ b/Lib/test/certdata/capath-2048-plus/5ed36f99.0 +@@ -0,0 +1,41 @@ ++-----BEGIN CERTIFICATE----- ++MIIHPTCCBSWgAwIBAgIBADANBgkqhkiG9w0BAQQFADB5MRAwDgYDVQQKEwdSb290 ++IENBMR4wHAYDVQQLExVodHRwOi8vd3d3LmNhY2VydC5vcmcxIjAgBgNVBAMTGUNB ++IENlcnQgU2lnbmluZyBBdXRob3JpdHkxITAfBgkqhkiG9w0BCQEWEnN1cHBvcnRA ++Y2FjZXJ0Lm9yZzAeFw0wMzAzMzAxMjI5NDlaFw0zMzAzMjkxMjI5NDlaMHkxEDAO ++BgNVBAoTB1Jvb3QgQ0ExHjAcBgNVBAsTFWh0dHA6Ly93d3cuY2FjZXJ0Lm9yZzEi ++MCAGA1UEAxMZQ0EgQ2VydCBTaWduaW5nIEF1dGhvcml0eTEhMB8GCSqGSIb3DQEJ ++ARYSc3VwcG9ydEBjYWNlcnQub3JnMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIIC ++CgKCAgEAziLA4kZ97DYoB1CW8qAzQIxL8TtmPzHlawI229Z89vGIj053NgVBlfkJ ++8BLPRoZzYLdufujAWGSuzbCtRRcMY/pnCujW0r8+55jE8Ez64AO7NV1sId6eINm6 ++zWYyN3L69wj1x81YyY7nDl7qPv4coRQKFWyGhFtkZip6qUtTefWIonvuLwphK42y ++fk1WpRPs6tqSnqxEQR5YYGUFZvjARL3LlPdCfgv3ZWiYUQXw8wWRBB0bF4LsyFe7 ++w2t6iPGwcswlWyCR7BYCEo8y6RcYSNDHBS4CMEK4JZwFaz+qOqfrU0j36NK2B5jc ++G8Y0f3/JHIJ6BVgrCFvzOKKrF11myZjXnhCLotLddJr3cQxyYN/Nb5gznZY0dj4k ++epKwDpUeb+agRThHqtdB7Uq3EvbXG4OKDy7YCbZZ16oE/9KTfWgu3YtLq1i6L43q ++laegw1SJpfvbi1EinbLDvhG+LJGGi5Z4rSDTii8aP8bQUWWHIbEZAWV/RRyH9XzQ ++QUxPKZgh/TMfdQwEUfoZd9vUFBzugcMd9Zi3aQaRIt0AUMyBMawSB3s42mhb5ivU ++fslfrejrckzzAeVLIL+aplfKkQABi6F1ITe1Yw1nPkZPcCBnzsXWWdsC4PDSy826 ++YreQQejdIOQpvGQpQsgi3Hia/0PsmBsJUUtaWsJx8cTLc6nloQsCAwEAAaOCAc4w ++ggHKMB0GA1UdDgQWBBQWtTIb1Mfz4OaO873SsDrusjkY0TCBowYDVR0jBIGbMIGY ++gBQWtTIb1Mfz4OaO873SsDrusjkY0aF9pHsweTEQMA4GA1UEChMHUm9vdCBDQTEe ++MBwGA1UECxMVaHR0cDovL3d3dy5jYWNlcnQub3JnMSIwIAYDVQQDExlDQSBDZXJ0 ++IFNpZ25pbmcgQXV0aG9yaXR5MSEwHwYJKoZIhvcNAQkBFhJzdXBwb3J0QGNhY2Vy ++dC5vcmeCAQAwDwYDVR0TAQH/BAUwAwEB/zAyBgNVHR8EKzApMCegJaAjhiFodHRw ++czovL3d3dy5jYWNlcnQub3JnL3Jldm9rZS5jcmwwMAYJYIZIAYb4QgEEBCMWIWh0 ++dHBzOi8vd3d3LmNhY2VydC5vcmcvcmV2b2tlLmNybDA0BglghkgBhvhCAQgEJxYl ++aHR0cDovL3d3dy5jYWNlcnQub3JnL2luZGV4LnBocD9pZD0xMDBWBglghkgBhvhC ++AQ0ESRZHVG8gZ2V0IHlvdXIgb3duIGNlcnRpZmljYXRlIGZvciBGUkVFIGhlYWQg ++b3ZlciB0byBodHRwOi8vd3d3LmNhY2VydC5vcmcwDQYJKoZIhvcNAQEEBQADggIB ++ACjH7pyCArpcgBLKNQodgW+JapnM8mgPf6fhjViVPr3yBsOQWqy1YPaZQwGjiHCc ++nWKdpIevZ1gNMDY75q1I08t0AoZxPuIrA2jxNGJARjtT6ij0rPtmlVOKTV39O9lg ++18p5aTuxZZKmxoGCXJzN600BiqXfEVWqFcofN8CCmHBh22p8lqOOLlQ+TyGpkO/c ++gr/c6EWtTZBzCDyUZbAEmXZ/4rzCahWqlwQ3JNgelE5tDlG+1sSPypZt90Pf6DBl ++Jzt7u0NDY8RD97LsaMzhGY4i+5jhe1o+ATc7iwiwovOVThrLm82asduycPAtStvY ++sONvRUgzEv/+PDIqVPfE94rwiCPCR/5kenHA0R6mY7AHfqQv0wGP3J8rtsYIqQ+T ++SCX8Ev2fQtzzxD72V7DX3WnRBnc0CkvSyqD/HMaMyRa+xMwyN2hzXwj7UfdJUzYF ++CpUCTPJ5GhD22Dp1nPMd8aINcGeGG7MW9S/lpOt5hvk9C8JzC6WZrG/8Z7jlLwum ++GCSNe9FINSkYQKyTYOGWhlC0elnYjyELn8+CkcY7v2vcB5G5l1YjqrZslMZIBjzk ++zk6q5PYvCdxTby78dOs6Y5nCpqyJvKeyRKANihDjbPIky/qbn3BHLt4Ui9SyIAmW ++omTxJBzcoTWcFbLUvFUufQb1nA5V9FrWk9p2rSVzTMVD ++-----END CERTIFICATE----- +diff --git a/Lib/test/certdata/capath-2048-plus/99d0fa06.0 b/Lib/test/certdata/capath-2048-plus/99d0fa06.0 +new file mode 100644 +index 0000000..e7dfc82 +--- /dev/null ++++ b/Lib/test/certdata/capath-2048-plus/99d0fa06.0 +@@ -0,0 +1,41 @@ ++-----BEGIN CERTIFICATE----- ++MIIHPTCCBSWgAwIBAgIBADANBgkqhkiG9w0BAQQFADB5MRAwDgYDVQQKEwdSb290 ++IENBMR4wHAYDVQQLExVodHRwOi8vd3d3LmNhY2VydC5vcmcxIjAgBgNVBAMTGUNB ++IENlcnQgU2lnbmluZyBBdXRob3JpdHkxITAfBgkqhkiG9w0BCQEWEnN1cHBvcnRA ++Y2FjZXJ0Lm9yZzAeFw0wMzAzMzAxMjI5NDlaFw0zMzAzMjkxMjI5NDlaMHkxEDAO ++BgNVBAoTB1Jvb3QgQ0ExHjAcBgNVBAsTFWh0dHA6Ly93d3cuY2FjZXJ0Lm9yZzEi ++MCAGA1UEAxMZQ0EgQ2VydCBTaWduaW5nIEF1dGhvcml0eTEhMB8GCSqGSIb3DQEJ ++ARYSc3VwcG9ydEBjYWNlcnQub3JnMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIIC ++CgKCAgEAziLA4kZ97DYoB1CW8qAzQIxL8TtmPzHlawI229Z89vGIj053NgVBlfkJ ++8BLPRoZzYLdufujAWGSuzbCtRRcMY/pnCujW0r8+55jE8Ez64AO7NV1sId6eINm6 ++zWYyN3L69wj1x81YyY7nDl7qPv4coRQKFWyGhFtkZip6qUtTefWIonvuLwphK42y ++fk1WpRPs6tqSnqxEQR5YYGUFZvjARL3LlPdCfgv3ZWiYUQXw8wWRBB0bF4LsyFe7 ++w2t6iPGwcswlWyCR7BYCEo8y6RcYSNDHBS4CMEK4JZwFaz+qOqfrU0j36NK2B5jc ++G8Y0f3/JHIJ6BVgrCFvzOKKrF11myZjXnhCLotLddJr3cQxyYN/Nb5gznZY0dj4k ++epKwDpUeb+agRThHqtdB7Uq3EvbXG4OKDy7YCbZZ16oE/9KTfWgu3YtLq1i6L43q ++laegw1SJpfvbi1EinbLDvhG+LJGGi5Z4rSDTii8aP8bQUWWHIbEZAWV/RRyH9XzQ ++QUxPKZgh/TMfdQwEUfoZd9vUFBzugcMd9Zi3aQaRIt0AUMyBMawSB3s42mhb5ivU ++fslfrejrckzzAeVLIL+aplfKkQABi6F1ITe1Yw1nPkZPcCBnzsXWWdsC4PDSy826 ++YreQQejdIOQpvGQpQsgi3Hia/0PsmBsJUUtaWsJx8cTLc6nloQsCAwEAAaOCAc4w ++ggHKMB0GA1UdDgQWBBQWtTIb1Mfz4OaO873SsDrusjkY0TCBowYDVR0jBIGbMIGY ++gBQWtTIb1Mfz4OaO873SsDrusjkY0aF9pHsweTEQMA4GA1UEChMHUm9vdCBDQTEe ++MBwGA1UECxMVaHR0cDovL3d3dy5jYWNlcnQub3JnMSIwIAYDVQQDExlDQSBDZXJ0 ++IFNpZ25pbmcgQXV0aG9yaXR5MSEwHwYJKoZIhvcNAQkBFhJzdXBwb3J0QGNhY2Vy ++dC5vcmeCAQAwDwYDVR0TAQH/BAUwAwEB/zAyBgNVHR8EKzApMCegJaAjhiFodHRw ++czovL3d3dy5jYWNlcnQub3JnL3Jldm9rZS5jcmwwMAYJYIZIAYb4QgEEBCMWIWh0 ++dHBzOi8vd3d3LmNhY2VydC5vcmcvcmV2b2tlLmNybDA0BglghkgBhvhCAQgEJxYl ++aHR0cDovL3d3dy5jYWNlcnQub3JnL2luZGV4LnBocD9pZD0xMDBWBglghkgBhvhC ++AQ0ESRZHVG8gZ2V0IHlvdXIgb3duIGNlcnRpZmljYXRlIGZvciBGUkVFIGhlYWQg ++b3ZlciB0byBodHRwOi8vd3d3LmNhY2VydC5vcmcwDQYJKoZIhvcNAQEEBQADggIB ++ACjH7pyCArpcgBLKNQodgW+JapnM8mgPf6fhjViVPr3yBsOQWqy1YPaZQwGjiHCc ++nWKdpIevZ1gNMDY75q1I08t0AoZxPuIrA2jxNGJARjtT6ij0rPtmlVOKTV39O9lg ++18p5aTuxZZKmxoGCXJzN600BiqXfEVWqFcofN8CCmHBh22p8lqOOLlQ+TyGpkO/c ++gr/c6EWtTZBzCDyUZbAEmXZ/4rzCahWqlwQ3JNgelE5tDlG+1sSPypZt90Pf6DBl ++Jzt7u0NDY8RD97LsaMzhGY4i+5jhe1o+ATc7iwiwovOVThrLm82asduycPAtStvY ++sONvRUgzEv/+PDIqVPfE94rwiCPCR/5kenHA0R6mY7AHfqQv0wGP3J8rtsYIqQ+T ++SCX8Ev2fQtzzxD72V7DX3WnRBnc0CkvSyqD/HMaMyRa+xMwyN2hzXwj7UfdJUzYF ++CpUCTPJ5GhD22Dp1nPMd8aINcGeGG7MW9S/lpOt5hvk9C8JzC6WZrG/8Z7jlLwum ++GCSNe9FINSkYQKyTYOGWhlC0elnYjyELn8+CkcY7v2vcB5G5l1YjqrZslMZIBjzk ++zk6q5PYvCdxTby78dOs6Y5nCpqyJvKeyRKANihDjbPIky/qbn3BHLt4Ui9SyIAmW ++omTxJBzcoTWcFbLUvFUufQb1nA5V9FrWk9p2rSVzTMVD ++-----END CERTIFICATE----- +diff --git a/Lib/test/certdata/capath-2048-plus/b1930218.0 b/Lib/test/certdata/capath-2048-plus/b1930218.0 +new file mode 100644 +index 0000000..6d773ee +--- /dev/null ++++ b/Lib/test/certdata/capath-2048-plus/b1930218.0 +@@ -0,0 +1,27 @@ ++-----BEGIN CERTIFICATE----- ++MIIEgjCCAuqgAwIBAgIJAMstgJlaaVJbMA0GCSqGSIb3DQEBCwUAME0xCzAJBgNV ++BAYTAlhZMSYwJAYDVQQKDB1QeXRob24gU29mdHdhcmUgRm91bmRhdGlvbiBDQTEW ++MBQGA1UEAwwNb3VyLWNhLXNlcnZlcjAgFw0xODA4MjkxNDIzMTZaGA8yNTI1MTAy ++ODE0MjMxNlowTTELMAkGA1UEBhMCWFkxJjAkBgNVBAoMHVB5dGhvbiBTb2Z0d2Fy ++ZSBGb3VuZGF0aW9uIENBMRYwFAYDVQQDDA1vdXItY2Etc2VydmVyMIIBojANBgkq ++hkiG9w0BAQEFAAOCAY8AMIIBigKCAYEA5rri5MHCDBw+Yti5XFcuUriDxYg65pp6 ++9WQWM+s3bi9782gDRWVHXXEQWcorGwBsgRRh9IZZP+r9eDcWnUPxxPZpjMUpBoie ++JiIErATYhzRIOetr8guSqsNuY1FRa8Kt/1zIL7IbnCCKQD6iL2rqyNk3Q1zc7ZLi ++2UDSYZ9xivXtObqoXj61IWMQ2G+04hEBCxDou/ti70hVvPXSnKtorpUlGfKXfRrc ++ZuqIXobky8tpTV6wo/tsMeQoYF6Q8dQuEFDhhfANXL3dRSQIGT4ck2aPK9pTfQQc ++DkLEaF6mzakY7afNatDRhrqQ/7dM3sdDJG3HHGucgefhG1clkKkOyVbz9mteLbQu ++QFCbQmPS1pkcONzPKyyncvHHXmM0dkj0PogTnoYWUy90+4cBjSKkaDPuE2x6BhRU ++VhdXV5g00AtmCeOICfilFRwQc9CIUJleGGU7/zEnG17GqkH9LS8Yp8Dyq8citQtp ++0nPRu9AcPfqkNWLNM4bHoCMPuWrV0m2NAgMBAAGjYzBhMB0GA1UdDgQWBBTACiso ++Q95fyX1H5UebNvJljGc74jAfBgNVHSMEGDAWgBTACisoQ95fyX1H5UebNvJljGc7 ++4jAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBhjANBgkqhkiG9w0BAQsF ++AAOCAYEAvONWIgPkXLln/5S8dZwAhbDVnMTDKWZei7KppjCGcRpr8gDFgqtfUAQq ++++24TLkAG0lXkhHNorzLD6i0YfgUyqDsQBe6VaHEvKayWu/0IBB3R9CgxVi5bLUQ ++e4VKQ6P7LAG5dxewvqDurq5NZ4ZIiVeGeOo87fBBNY1xaFX58umsMtTGou/sVObE ++jiz9vapgVmUzleoQxnQE6ypumxH2YQCq/ezyC7FLEc2T69+Yrky0BwRK5e//Ulh1 ++9T6kceFKclypj9SqiPBqcbTDAF+ZbteRr2yYDWTCJMeeBRFoXiRi4y5F7KM08qOd ++TeUyGC90/BHxNlBPoEApaFxDTCNsXXLE7FJ269yyvB+mxAZmm1zHzMry0SVP3qUf ++jeQMSbbPhUChuR/GxxkVB2M0k9BXoFpw7K9KHHIXHXSjbDFFCzN6obhG28cOZExv ++t5kEgkMf4FnWmSEnKAlArvzEI6qgDAgFKpIc2yOe0dVjrjkToxKIWkM8Sm4y8ISf +++QkMkee4 ++-----END CERTIFICATE----- +diff --git a/Lib/test/certdata/capath-2048-plus/ceff1710.0 b/Lib/test/certdata/capath-2048-plus/ceff1710.0 +new file mode 100644 +index 0000000..6d773ee +--- /dev/null ++++ b/Lib/test/certdata/capath-2048-plus/ceff1710.0 +@@ -0,0 +1,27 @@ ++-----BEGIN CERTIFICATE----- ++MIIEgjCCAuqgAwIBAgIJAMstgJlaaVJbMA0GCSqGSIb3DQEBCwUAME0xCzAJBgNV ++BAYTAlhZMSYwJAYDVQQKDB1QeXRob24gU29mdHdhcmUgRm91bmRhdGlvbiBDQTEW ++MBQGA1UEAwwNb3VyLWNhLXNlcnZlcjAgFw0xODA4MjkxNDIzMTZaGA8yNTI1MTAy ++ODE0MjMxNlowTTELMAkGA1UEBhMCWFkxJjAkBgNVBAoMHVB5dGhvbiBTb2Z0d2Fy ++ZSBGb3VuZGF0aW9uIENBMRYwFAYDVQQDDA1vdXItY2Etc2VydmVyMIIBojANBgkq ++hkiG9w0BAQEFAAOCAY8AMIIBigKCAYEA5rri5MHCDBw+Yti5XFcuUriDxYg65pp6 ++9WQWM+s3bi9782gDRWVHXXEQWcorGwBsgRRh9IZZP+r9eDcWnUPxxPZpjMUpBoie ++JiIErATYhzRIOetr8guSqsNuY1FRa8Kt/1zIL7IbnCCKQD6iL2rqyNk3Q1zc7ZLi ++2UDSYZ9xivXtObqoXj61IWMQ2G+04hEBCxDou/ti70hVvPXSnKtorpUlGfKXfRrc ++ZuqIXobky8tpTV6wo/tsMeQoYF6Q8dQuEFDhhfANXL3dRSQIGT4ck2aPK9pTfQQc ++DkLEaF6mzakY7afNatDRhrqQ/7dM3sdDJG3HHGucgefhG1clkKkOyVbz9mteLbQu ++QFCbQmPS1pkcONzPKyyncvHHXmM0dkj0PogTnoYWUy90+4cBjSKkaDPuE2x6BhRU ++VhdXV5g00AtmCeOICfilFRwQc9CIUJleGGU7/zEnG17GqkH9LS8Yp8Dyq8citQtp ++0nPRu9AcPfqkNWLNM4bHoCMPuWrV0m2NAgMBAAGjYzBhMB0GA1UdDgQWBBTACiso ++Q95fyX1H5UebNvJljGc74jAfBgNVHSMEGDAWgBTACisoQ95fyX1H5UebNvJljGc7 ++4jAPBgNVHRMBAf8EBTADAQH/MA4GA1UdDwEB/wQEAwIBhjANBgkqhkiG9w0BAQsF ++AAOCAYEAvONWIgPkXLln/5S8dZwAhbDVnMTDKWZei7KppjCGcRpr8gDFgqtfUAQq ++++24TLkAG0lXkhHNorzLD6i0YfgUyqDsQBe6VaHEvKayWu/0IBB3R9CgxVi5bLUQ ++e4VKQ6P7LAG5dxewvqDurq5NZ4ZIiVeGeOo87fBBNY1xaFX58umsMtTGou/sVObE ++jiz9vapgVmUzleoQxnQE6ypumxH2YQCq/ezyC7FLEc2T69+Yrky0BwRK5e//Ulh1 ++9T6kceFKclypj9SqiPBqcbTDAF+ZbteRr2yYDWTCJMeeBRFoXiRi4y5F7KM08qOd ++TeUyGC90/BHxNlBPoEApaFxDTCNsXXLE7FJ269yyvB+mxAZmm1zHzMry0SVP3qUf ++jeQMSbbPhUChuR/GxxkVB2M0k9BXoFpw7K9KHHIXHXSjbDFFCzN6obhG28cOZExv ++t5kEgkMf4FnWmSEnKAlArvzEI6qgDAgFKpIc2yOe0dVjrjkToxKIWkM8Sm4y8ISf +++QkMkee4 ++-----END CERTIFICATE----- +diff --git a/Lib/test/support/__init__.py b/Lib/test/support/__init__.py +index 6635ec3..3b93688 100644 +--- a/Lib/test/support/__init__.py ++++ b/Lib/test/support/__init__.py +@@ -497,7 +497,8 @@ def dec(*args, **kwargs): + try: + f(*args, **kwargs) + except OSError as e: +- if "CERTIFICATE_VERIFY_FAILED" in str(e): ++ if ("CERTIFICATE_VERIFY_FAILED" in str(e)) or \ ++ ("ASN no signer error" in str(e)): + raise unittest.SkipTest("system does not contain " + "necessary certificates") + raise +diff --git a/Lib/test/test_asyncio/test_events.py b/Lib/test/test_asyncio/test_events.py +index 919d543..49a646f 100644 +--- a/Lib/test/test_asyncio/test_events.py ++++ b/Lib/test/test_asyncio/test_events.py +@@ -749,7 +749,10 @@ def _dummy_ssl_create_context(purpose=ssl.Purpose.SERVER_AUTH, *, + self._basetest_create_ssl_connection(conn_fut, check_sockname, + peername) + +- self.assertEqual(cm.exception.reason, 'CERTIFICATE_VERIFY_FAILED') ++ if ssl.IS_WOLFSSL: ++ self.assertIn(cm.exception.reason, ('ASN_NO_SIGNER_E', 'ASN_SELF_SIGNED_E')) ++ else: ++ self.assertEqual(cm.exception.reason, 'CERTIFICATE_VERIFY_FAILED') + + @unittest.skipIf(ssl is None, 'No ssl module') + def test_create_ssl_connection(self): +@@ -1184,9 +1187,14 @@ def test_create_server_ssl_verify_failed(self): + ssl=sslcontext_client) + with mock.patch.object(self.loop, 'call_exception_handler'): + with test_utils.disable_logger(): +- with self.assertRaisesRegex(ssl.SSLError, +- '(?i)certificate.verify.failed'): +- self.loop.run_until_complete(f_c) ++ if ssl.IS_WOLFSSL: ++ with self.assertRaisesRegex(ssl.SSLError, ++ 'ASN_NO_SIGNER_E'): ++ self.loop.run_until_complete(f_c) ++ else: ++ with self.assertRaisesRegex(ssl.SSLError, ++ '(?i)certificate.verify.failed'): ++ self.loop.run_until_complete(f_c) + + # execute the loop to log the connection error + test_utils.run_briefly(self.loop) +@@ -1214,9 +1222,14 @@ def test_create_unix_server_ssl_verify_failed(self): + server_hostname='invalid') + with mock.patch.object(self.loop, 'call_exception_handler'): + with test_utils.disable_logger(): +- with self.assertRaisesRegex(ssl.SSLError, +- '(?i)certificate.verify.failed'): +- self.loop.run_until_complete(f_c) ++ if ssl.IS_WOLFSSL: ++ with self.assertRaisesRegex(ssl.SSLError, ++ 'ASN_NO_SIGNER_E'): ++ self.loop.run_until_complete(f_c) ++ else: ++ with self.assertRaisesRegex(ssl.SSLError, ++ '(?i)certificate.verify.failed'): ++ self.loop.run_until_complete(f_c) + + # execute the loop to log the connection error + test_utils.run_briefly(self.loop) +@@ -1247,6 +1260,8 @@ def test_create_server_ssl_match_failed(self): + regex = re.compile(r"""( + IP address mismatch, certificate is not valid for '127.0.0.1' # OpenSSL + | ++ IPADDR_MISMATCH # wolfSSL ++ | + CERTIFICATE_VERIFY_FAILED # AWS-LC + )""", re.X) + with mock.patch.object(self.loop, 'call_exception_handler'): +diff --git a/Lib/test/test_asyncio/test_ssl.py b/Lib/test/test_asyncio/test_ssl.py +index ca15fc3..ceb28e2 100644 +--- a/Lib/test/test_asyncio/test_ssl.py ++++ b/Lib/test/test_asyncio/test_ssl.py +@@ -1345,8 +1345,10 @@ def server(sock): + time.sleep(0.2) # wait for the peer to fill its backlog + + # send close_notify but don't wait for response +- with self.assertRaises(ssl.SSLWantReadError): ++ try: + sslobj.unwrap() ++ except ssl.SSLWantReadError: ++ pass + sock.send(outgoing.read()) + + # should receive all data +@@ -1363,7 +1365,8 @@ def server(sock): + self.assertEqual(data_len, CHUNK * SIZE) + + # verify that close_notify is received +- sslobj.unwrap() ++ if not ssl.IS_WOLFSSL: ++ sslobj.unwrap() + + sock.close() + +@@ -1477,8 +1480,10 @@ def server(sock): + time.sleep(0.2) # wait for the peer to fill its backlog + + # send close_notify but don't wait for response +- with self.assertRaises(ssl.SSLWantReadError): ++ try: + sslobj.unwrap() ++ except ssl.SSLWantReadError: ++ pass + sock.send(outgoing.read()) + + # should receive all data +@@ -1495,7 +1500,8 @@ def server(sock): + self.assertEqual(data_len, CHUNK * SIZE*2) + + # verify that close_notify is received +- sslobj.unwrap() ++ if not ssl.IS_WOLFSSL: ++ sslobj.unwrap() + + sock.close() + +diff --git a/Lib/test/test_httplib.py b/Lib/test/test_httplib.py +index 6f3eac6..3835cd1 100644 +--- a/Lib/test/test_httplib.py ++++ b/Lib/test/test_httplib.py +@@ -7,6 +7,7 @@ + import array + import re + import socket ++from ssl import IS_WOLFSSL + import threading + + import unittest +@@ -2069,7 +2070,10 @@ def test_networked(self): + h = client.HTTPSConnection('self-signed.pythontest.net', 443) + with self.assertRaises(ssl.SSLError) as exc_info: + h.request('GET', '/') +- self.assertEqual(exc_info.exception.reason, 'CERTIFICATE_VERIFY_FAILED') ++ if ssl.IS_WOLFSSL: ++ self.assertIn(exc_info.exception.reason, ('ASN_NO_SIGNER_E', 'ASN_SELF_SIGNED_E')) ++ else: ++ self.assertEqual(exc_info.exception.reason, 'CERTIFICATE_VERIFY_FAILED') + + def test_networked_noverification(self): + # Switch off cert verification +@@ -2098,6 +2102,8 @@ def test_networked_trusted_by_default_cert(self): + h.close() + self.assertIn('text/html', content_type) + ++ @unittest.skipIf(IS_WOLFSSL, "wolfSSL requires SAN for domain name " ++ "validation, the cert used here only has CN") + def test_networked_good_cert(self): + # We feed the server's cert as a validating cert + import ssl +@@ -2142,7 +2148,10 @@ def test_networked_bad_cert(self): + h = client.HTTPSConnection('self-signed.pythontest.net', 443, context=context) + with self.assertRaises(ssl.SSLError) as exc_info: + h.request('GET', '/') +- self.assertEqual(exc_info.exception.reason, 'CERTIFICATE_VERIFY_FAILED') ++ if ssl.IS_WOLFSSL: ++ self.assertIn(exc_info.exception.reason, ('ASN_NO_SIGNER_E', 'ASN_SELF_SIGNED_E')) ++ else: ++ self.assertEqual(exc_info.exception.reason, 'CERTIFICATE_VERIFY_FAILED') + + def test_local_unknown_cert(self): + # The custom cert isn't known to the default trust bundle +@@ -2151,7 +2160,10 @@ def test_local_unknown_cert(self): + h = client.HTTPSConnection('localhost', server.port) + with self.assertRaises(ssl.SSLError) as exc_info: + h.request('GET', '/') +- self.assertEqual(exc_info.exception.reason, 'CERTIFICATE_VERIFY_FAILED') ++ if ssl.IS_WOLFSSL: ++ self.assertIn(exc_info.exception.reason, ('ASN_NO_SIGNER_E', 'ASN_SELF_SIGNED_E')) ++ else: ++ self.assertEqual(exc_info.exception.reason, 'CERTIFICATE_VERIFY_FAILED') + + def test_local_good_hostname(self): + # The (valid) cert validates the HTTPS hostname +diff --git a/Lib/test/test_imaplib.py b/Lib/test/test_imaplib.py +index a03d7b8..b8d9344 100644 +--- a/Lib/test/test_imaplib.py ++++ b/Lib/test/test_imaplib.py +@@ -692,6 +692,8 @@ def test_ssl_raises(self): + regex = re.compile(r"""( + IP address mismatch, certificate is not valid for '127.0.0.1' # OpenSSL + | ++ IPADDR_MISMATCH # wolfSSL ++ | + CERTIFICATE_VERIFY_FAILED # AWS-LC + )""", re.X) + with self.assertRaisesRegex(ssl.CertificateError, regex): +@@ -1109,6 +1111,8 @@ def test_ssl_verified(self): + regex = re.compile(r"""( + IP address mismatch, certificate is not valid for '127.0.0.1' # OpenSSL + | ++ IPADDR_MISMATCH # wolfSSL ++ | + CERTIFICATE_VERIFY_FAILED # AWS-LC + )""", re.X) + with self.assertRaisesRegex(ssl.CertificateError, regex): +diff --git a/Lib/test/test_poplib.py b/Lib/test/test_poplib.py +index ef2da97..77b883a 100644 +--- a/Lib/test/test_poplib.py ++++ b/Lib/test/test_poplib.py +@@ -185,7 +185,8 @@ def _do_tls_handshake(self): + return self.handle_close() + # TODO: SSLError does not expose alert information + elif ("SSLV3_ALERT_BAD_CERTIFICATE" in err.args[1] or +- "SSLV3_ALERT_CERTIFICATE_UNKNOWN" in err.args[1]): ++ "SSLV3_ALERT_CERTIFICATE_UNKNOWN" in err.args[1] or ++ (ssl.IS_WOLFSSL and "ALERT_FATAL_ERROR" in err.args[1])): + return self.handle_close() + raise + except OSError as err: +diff --git a/Lib/test/test_ssl.py b/Lib/test/test_ssl.py +index 1061536..079e7e0 100644 +--- a/Lib/test/test_ssl.py ++++ b/Lib/test/test_ssl.py +@@ -92,9 +92,17 @@ def data_file(*name): + CERTFILE_PROTECTED = data_file("keycert.passwd.pem") + ONLYKEY_PROTECTED = data_file("ssl_key.passwd.pem") + KEY_PASSWORD = "somepass" +-CAPATH = data_file("capath") ++ ++# for FIPS and wolfSSL there is a minimum RSA size, use 2048 bits and higher ++if ssl.IS_WOLFSSL: ++ # Substitute alternate CA. neuronio CA is RSA 512, which is below ++ # wolfSSL's default minimum allowed RSA key size ++ CAFILE_NEURONIO = data_file("capath", "b1930218.0") ++ CAPATH = data_file("capath-2048-plus") ++else: ++ CAFILE_NEURONIO = data_file("capath", "4e1295a3.0") ++ CAPATH = data_file("capath") + BYTES_CAPATH = os.fsencode(CAPATH) +-CAFILE_NEURONIO = data_file("capath", "4e1295a3.0") + CAFILE_CACERT = data_file("capath", "5ed36f99.0") + + with open(data_file('keycert.pem.reference')) as file: +@@ -483,10 +491,16 @@ def test_parse_cert(self): + p = ssl._ssl._test_decode_cert(NOKIACERT) + if support.verbose: + sys.stdout.write("\n" + pprint.pformat(p) + "\n") +- self.assertEqual(p['subjectAltName'], +- (('DNS', 'projects.developer.nokia.com'), +- ('DNS', 'projects.forum.nokia.com')) +- ) ++ if ssl.IS_WOLFSSL: ++ self.assertEqual(p['subjectAltName'], ++ (('DNS', 'projects.forum.nokia.com'), ++ ('DNS', 'projects.developer.nokia.com')) ++ ) ++ else: ++ self.assertEqual(p['subjectAltName'], ++ (('DNS', 'projects.developer.nokia.com'), ++ ('DNS', 'projects.forum.nokia.com')) ++ ) + # extra OCSP and AIA fields + self.assertEqual(p['OCSP'], ('http://ocsp.verisign.com',)) + self.assertEqual(p['caIssuers'], +@@ -528,7 +542,14 @@ def test_parse_cert_CVE_2013_4238(self): + (('emailAddress', 'python-dev@python.org'),)) + self.assertEqual(p['subject'], subject) + self.assertEqual(p['issuer'], subject) +- if ssl._OPENSSL_API_VERSION >= (0, 9, 8): ++ if ssl.IS_WOLFSSL: ++ # wolfSSL preserves the embedded NULs and lists SAN entries in a different order. ++ san = (('IP Address', '2001:DB8:0:0:0:0:0:1'), ++ ('IP Address', '192.0.2.1'), ++ ('URI', 'http://null.python.org\x00http://example.org'), ++ ('DNS', 'altnull.python.org\x00example.com'), ++ ('email', 'null@python.org\x00user@example.org')) ++ elif ssl._OPENSSL_API_VERSION >= (0, 9, 8): + san = (('DNS', 'altnull.python.org\x00example.com'), + ('email', 'null@python.org\x00user@example.org'), + ('URI', 'http://null.python.org\x00http://example.org'), +@@ -546,23 +567,45 @@ def test_parse_cert_CVE_2013_4238(self): + + def test_parse_all_sans(self): + p = ssl._ssl._test_decode_cert(ALLSANFILE) +- self.assertEqual(p['subjectAltName'], +- ( +- ('DNS', 'allsans'), +- ('othername', ''), +- ('othername', ''), +- ('email', 'user@example.org'), +- ('DNS', 'www.example.org'), +- ('DirName', +- ((('countryName', 'XY'),), +- (('localityName', 'Castle Anthrax'),), +- (('organizationName', 'Python Software Foundation'),), +- (('commonName', 'dirname example'),))), +- ('URI', 'https://www.python.org/'), +- ('IP Address', '127.0.0.1'), +- ('IP Address', '0:0:0:0:0:0:0:1'), +- ('Registered ID', '1.2.3.4.5') ++ if ssl.IS_WOLFSSL: ++ # wolfSSL currently had a slightly different order of how the ++ # entries are listed in struct ++ self.assertEqual(p['subjectAltName'], ++ ( ++ ('Registered ID', '1.2.3.4.5'), ++ ('IP Address', '0:0:0:0:0:0:0:1'), ++ ('IP Address', '127.0.0.1'), ++ ('URI', 'https://www.python.org/'), ++ ('DNS', 'www.example.org'), ++ ('othername', ''), ++ ('othername', ''), ++ ('DNS', 'allsans'), ++ ('email', 'user@example.org'), ++ ('DirName', ++ ((('countryName', 'XY'),), ++ (('localityName', 'Castle Anthrax'),), ++ (('organizationName', 'Python Software Foundation'),), ++ (('commonName', 'dirname example'),))) ++ ) + ) ++ else: ++ self.assertEqual(p['subjectAltName'], ++ ( ++ ('DNS', 'allsans'), ++ ('othername', ''), ++ ('othername', ''), ++ ('email', 'user@example.org'), ++ ('DNS', 'www.example.org'), ++ ('DirName', ++ ((('countryName', 'XY'),), ++ (('localityName', 'Castle Anthrax'),), ++ (('organizationName', 'Python Software Foundation'),), ++ (('commonName', 'dirname example'),))), ++ ('URI', 'https://www.python.org/'), ++ ('IP Address', '127.0.0.1'), ++ ('IP Address', '0:0:0:0:0:0:0:1'), ++ ('Registered ID', '1.2.3.4.5') ++ ) + ) + + def test_DER_to_PEM(self): +@@ -607,10 +650,11 @@ def test_openssl_version(self): + openssl_ver = f"OpenSSL {major:d}.{minor:d}.{patch:d}" + else: + openssl_ver = f"OpenSSL {major:d}.{minor:d}.{fix:d}" +- self.assertStartsWith( +- s, (openssl_ver, libressl_ver, "AWS-LC"), +- (t, hex(n)) +- ) ++ if not ssl.IS_WOLFSSL: ++ self.assertStartsWith( ++ s, (openssl_ver, libressl_ver, "AWS-LC"), ++ (t, hex(n)) ++ ) + + @support.cpython_only + def test_refcycle(self): +@@ -672,6 +716,8 @@ def test_openssl111_deprecations(self): + for option in options: + with self.subTest(option=option): + ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT) ++ if ctx.options & option: ++ self.skipTest("option is already in SSL context") + with self.assertWarns(DeprecationWarning) as cm: + ctx.options |= option + self.assertEqual( +@@ -762,6 +808,7 @@ def test_dealloc_warn(self): + support.gc_collect() + self.assertIn(r, str(cm.warning.args[0])) + ++ @unittest.skipIf(ssl.IS_WOLFSSL, "wolfSSL does not support default verify paths") + def test_get_default_verify_paths(self): + paths = ssl.get_default_verify_paths() + self.assertEqual(len(paths), 6) +@@ -815,34 +862,49 @@ def test_enum_crls(self): + + + def test_asn1object(self): +- expected = (129, 'serverAuth', 'TLS Web Server Authentication', +- '1.3.6.1.5.5.7.3.1') ++ if ssl.IS_WOLFSSL: ++ expected = (67240238, 'serverAuth', 'TLS Web Server Authentication', ++ '1.3.6.1.5.5.7.3.1') ++ else: ++ expected = (129, 'serverAuth', 'TLS Web Server Authentication', ++ '1.3.6.1.5.5.7.3.1') + + val = ssl._ASN1Object('1.3.6.1.5.5.7.3.1') + self.assertEqual(val, expected) +- self.assertEqual(val.nid, 129) ++ ++ if ssl.IS_WOLFSSL: ++ self.assertEqual(val.nid, 67240238) ++ else: ++ self.assertEqual(val.nid, 129) ++ + self.assertEqual(val.shortname, 'serverAuth') + self.assertEqual(val.longname, 'TLS Web Server Authentication') + self.assertEqual(val.oid, '1.3.6.1.5.5.7.3.1') + self.assertIsInstance(val, ssl._ASN1Object) + self.assertRaises(ValueError, ssl._ASN1Object, 'serverAuth') + +- val = ssl._ASN1Object.fromnid(129) ++ if ssl.IS_WOLFSSL: ++ val = ssl._ASN1Object.fromnid(67240238) ++ else: ++ val = ssl._ASN1Object.fromnid(129) + self.assertEqual(val, expected) ++ + self.assertIsInstance(val, ssl._ASN1Object) + self.assertRaises(ValueError, ssl._ASN1Object.fromnid, -1) + with self.assertRaisesRegex(ValueError, "unknown NID 100000"): + ssl._ASN1Object.fromnid(100000) +- for i in range(1000): +- try: +- obj = ssl._ASN1Object.fromnid(i) +- except ValueError: +- pass +- else: +- self.assertIsInstance(obj.nid, int) +- self.assertIsInstance(obj.shortname, str) +- self.assertIsInstance(obj.longname, str) +- self.assertIsInstance(obj.oid, (str, type(None))) ++ ++ if not ssl.IS_WOLFSSL: ++ for i in range(1000): ++ try: ++ obj = ssl._ASN1Object.fromnid(i) ++ except ValueError: ++ pass ++ else: ++ self.assertIsInstance(obj.nid, int) ++ self.assertIsInstance(obj.shortname, str) ++ self.assertIsInstance(obj.longname, str) ++ self.assertIsInstance(obj.oid, (str, type(None))) + + val = ssl._ASN1Object.fromname('TLS Web Server Authentication') + self.assertEqual(val, expected) +@@ -857,7 +919,10 @@ def test_purpose_enum(self): + val = ssl._ASN1Object('1.3.6.1.5.5.7.3.1') + self.assertIsInstance(ssl.Purpose.SERVER_AUTH, ssl._ASN1Object) + self.assertEqual(ssl.Purpose.SERVER_AUTH, val) +- self.assertEqual(ssl.Purpose.SERVER_AUTH.nid, 129) ++ if ssl.IS_WOLFSSL: ++ self.assertEqual(ssl.Purpose.SERVER_AUTH.nid, 67240238) ++ else: ++ self.assertEqual(ssl.Purpose.SERVER_AUTH.nid, 129) + self.assertEqual(ssl.Purpose.SERVER_AUTH.shortname, 'serverAuth') + self.assertEqual(ssl.Purpose.SERVER_AUTH.oid, + '1.3.6.1.5.5.7.3.1') +@@ -865,7 +930,10 @@ def test_purpose_enum(self): + val = ssl._ASN1Object('1.3.6.1.5.5.7.3.2') + self.assertIsInstance(ssl.Purpose.CLIENT_AUTH, ssl._ASN1Object) + self.assertEqual(ssl.Purpose.CLIENT_AUTH, val) +- self.assertEqual(ssl.Purpose.CLIENT_AUTH.nid, 130) ++ if ssl.IS_WOLFSSL: ++ self.assertEqual(ssl.Purpose.CLIENT_AUTH.nid, 117571886) ++ else: ++ self.assertEqual(ssl.Purpose.CLIENT_AUTH.nid, 130) + self.assertEqual(ssl.Purpose.CLIENT_AUTH.shortname, 'clientAuth') + self.assertEqual(ssl.Purpose.CLIENT_AUTH.oid, + '1.3.6.1.5.5.7.3.2') +@@ -1008,6 +1076,8 @@ def test_python_ciphers(self): + self.assertNotIn("RC4", name) + self.assertNotIn("3DES", name) + ++ # @TODO support AESGCM cipher string ++ @unittest.skipIf(ssl.IS_WOLFSSL, "cipher suite AESGCM string not supported") + def test_get_ciphers(self): + ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT) + ctx.set_ciphers('AESGCM') +@@ -1032,6 +1102,9 @@ def test_options(self): + ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT) + # OP_ALL | OP_NO_SSLv2 | OP_NO_SSLv3 is the default value + default = (ssl.OP_ALL | ssl.OP_NO_SSLv2 | ssl.OP_NO_SSLv3) ++ if ssl.IS_WOLFSSL: ++ # wolfSSL by default has TLS 1.1 and 1.0 off ++ default |= (ssl.OP_NO_TLSv1_1 | ssl.OP_NO_TLSv1) + # SSLContext also enables these by default + default |= (OP_NO_COMPRESSION | OP_CIPHER_SERVER_PREFERENCE | + OP_SINGLE_DH_USE | OP_SINGLE_ECDH_USE | +@@ -1041,17 +1114,24 @@ def test_options(self): + # disallow TLSv1 + with warnings_helper.check_warnings(): + ctx.options |= ssl.OP_NO_TLSv1 +- self.assertEqual(default | ssl.OP_NO_TLSv1, ctx.options) ++ if ssl.IS_WOLFSSL: ++ self.assertEqual(default, ctx.options) ++ else: ++ self.assertEqual(default | ssl.OP_NO_TLSv1, ctx.options) + + # allow TLSv1 + with warnings_helper.check_warnings(): + ctx.options = (ctx.options & ~ssl.OP_NO_TLSv1) +- self.assertEqual(default, ctx.options) ++ if ssl.IS_WOLFSSL: ++ self.assertEqual(default & ~ssl.OP_NO_TLSv1, ctx.options) ++ else: ++ self.assertEqual(default, ctx.options) + + # clear all options + ctx.options = 0 +- # Ubuntu has OP_NO_SSLv3 forced on by default +- self.assertEqual(0, ctx.options & ~ssl.OP_NO_SSLv3) ++ if not ssl.IS_WOLFSSL: ++ # Ubuntu has OP_NO_SSLv3 forced on by default ++ self.assertEqual(0, ctx.options & ~ssl.OP_NO_SSLv3) + + # invalid options + with self.assertRaises(ValueError): +@@ -1115,7 +1195,7 @@ def test_min_max_version(self): + maximum_range = { + # stock OpenSSL + ssl.TLSVersion.MAXIMUM_SUPPORTED, +- # Fedora 32 uses TLS 1.3 by default ++ # Fedora 32 and wolfSSL use TLS 1.3 by default + ssl.TLSVersion.TLSv1_3 + } + +@@ -1175,8 +1255,8 @@ def test_min_max_version(self): + self.assertIn( + ctx.minimum_version, minimum_range + ) +- self.assertEqual( +- ctx.maximum_version, ssl.TLSVersion.MAXIMUM_SUPPORTED ++ self.assertIn( ++ ctx.maximum_version, maximum_range + ) + with self.assertRaises(ValueError): + ctx.minimum_version = ssl.TLSVersion.MINIMUM_SUPPORTED +@@ -1231,20 +1311,20 @@ def test_load_cert_chain(self): + with self.assertRaises(OSError) as cm: + ctx.load_cert_chain(NONEXISTINGCERT) + self.assertEqual(cm.exception.errno, errno.ENOENT) +- with self.assertRaisesRegex(ssl.SSLError, "PEM (lib|routines)"): ++ with self.assertRaisesRegex(ssl.SSLError, "PEM (lib|routines)|BUFFER_E"): + ctx.load_cert_chain(BADCERT) +- with self.assertRaisesRegex(ssl.SSLError, "PEM (lib|routines)"): ++ with self.assertRaisesRegex(ssl.SSLError, "PEM (lib|routines)|unknown error"): + ctx.load_cert_chain(EMPTYCERT) + # Separate key and cert + ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER) + ctx.load_cert_chain(ONLYCERT, ONLYKEY) + ctx.load_cert_chain(certfile=ONLYCERT, keyfile=ONLYKEY) + ctx.load_cert_chain(certfile=BYTES_ONLYCERT, keyfile=BYTES_ONLYKEY) +- with self.assertRaisesRegex(ssl.SSLError, "PEM (lib|routines)"): ++ with self.assertRaisesRegex(ssl.SSLError, "PEM (lib|routines)|NO_START_LINE"): + ctx.load_cert_chain(ONLYCERT) +- with self.assertRaisesRegex(ssl.SSLError, "PEM (lib|routines)"): ++ with self.assertRaisesRegex(ssl.SSLError, "PEM (lib|routines)|NO_START_LINE"): + ctx.load_cert_chain(ONLYKEY) +- with self.assertRaisesRegex(ssl.SSLError, "PEM (lib|routines)"): ++ with self.assertRaisesRegex(ssl.SSLError, "PEM (lib|routines)|NO_START_LINE"): + ctx.load_cert_chain(certfile=ONLYKEY, keyfile=ONLYCERT) + # Mismatching key and cert + ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER) +@@ -1252,6 +1332,8 @@ def test_load_cert_chain(self): + regex = re.compile(r"""( + key values mismatch # OpenSSL + | ++ WC_KEY_MISMATCH_E # wolfSSL ++ | + KEY_VALUES_MISMATCH # AWS-LC + )""", re.X) + with self.assertRaisesRegex(ssl.SSLError, regex): +@@ -1341,7 +1423,7 @@ def test_load_verify_locations(self): + with self.assertRaises(OSError) as cm: + ctx.load_verify_locations(NONEXISTINGCERT) + self.assertEqual(cm.exception.errno, errno.ENOENT) +- with self.assertRaisesRegex(ssl.SSLError, "PEM (lib|routines)"): ++ with self.assertRaisesRegex(ssl.SSLError, "PEM (lib|routines)|PEM: NO_START_LINE"): + ctx.load_verify_locations(BADCERT) + ctx.load_verify_locations(CERTFILE, CAPATH) + ctx.load_verify_locations(CERTFILE, capath=BYTES_CAPATH) +@@ -1383,19 +1465,21 @@ def test_load_verify_cadata(self): + self.assertEqual(ctx.cert_store_stats()["x509_ca"], 2) + + # test DER +- ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT) +- ctx.load_verify_locations(cadata=cacert_der) +- ctx.load_verify_locations(cadata=neuronio_der) +- self.assertEqual(ctx.cert_store_stats()["x509_ca"], 2) +- # cert already in hash table +- ctx.load_verify_locations(cadata=cacert_der) +- self.assertEqual(ctx.cert_store_stats()["x509_ca"], 2) +- +- # combined +- ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT) +- combined = b"".join((cacert_der, neuronio_der)) +- ctx.load_verify_locations(cadata=combined) +- self.assertEqual(ctx.cert_store_stats()["x509_ca"], 2) ++ # wolfSSL_CTX_load_verify_locations() works with PEM ++ if not ssl.IS_WOLFSSL: ++ ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT) ++ ctx.load_verify_locations(cadata=cacert_der) ++ ctx.load_verify_locations(cadata=neuronio_der) ++ self.assertEqual(ctx.cert_store_stats()["x509_ca"], 2) ++ # cert already in hash table ++ ctx.load_verify_locations(cadata=cacert_der) ++ self.assertEqual(ctx.cert_store_stats()["x509_ca"], 2) ++ ++ # combined ++ ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT) ++ combined = b"".join((cacert_der, neuronio_der)) ++ ctx.load_verify_locations(cadata=combined) ++ self.assertEqual(ctx.cert_store_stats()["x509_ca"], 2) + + # error cases + ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT) +@@ -1411,8 +1495,10 @@ def test_load_verify_cadata(self): + "not enough data: cadata does not contain a certificate" + ): + ctx.load_verify_locations(cadata=b"broken") +- with self.assertRaises(ssl.SSLError): +- ctx.load_verify_locations(cadata=cacert_der + b"A") ++ # wolfSSL_CTX_load_verify_locations() works with PEM ++ if not ssl.IS_WOLFSSL: ++ with self.assertRaises(ssl.SSLError): ++ ctx.load_verify_locations(cadata=cacert_der + b"A") + + def test_load_dh_params(self): + ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER) +@@ -1516,6 +1602,9 @@ def sni_callback(sock, servername, ctx): pass + # while OpenSSL uses SSL_R_CALLBACK_FAILED on SNI callback failures. + if IS_AWS_LC: + libssl_error_reason = "PARSE_TLSEXT" ++ elif ssl.IS_WOLFSSL: ++ # wolfSSL sends the alert and fails with FATAL_ERROR ++ libssl_error_reason = "ALERT_FATAL_ERROR" + else: + libssl_error_reason = "callback failed" + self.assertIn(libssl_error_reason, str(cm.exception)) +@@ -1591,6 +1680,7 @@ def test_load_default_certs(self): + self.assertRaises(TypeError, ctx.load_default_certs, 'SERVER_AUTH') + + @unittest.skipIf(sys.platform == "win32", "not-Windows specific") ++ @unittest.skipIf(ssl.IS_WOLFSSL, "wolfSSL doesn't support env vars") + def test_load_default_certs_env(self): + ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT) + with os_helper.EnvironmentVarGuard() as env: +@@ -1750,6 +1840,9 @@ class MySSLObject(ssl.SSLObject): + pass + + ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER) ++ if ssl.IS_WOLFSSL: ++ # requires loading CERT and KEY in advance ++ ctx.load_cert_chain(CERTFILE, keyfile=CERTFILE) + ctx.sslsocket_class = MySSLSocket + ctx.sslobject_class = MySSLObject + +@@ -1760,7 +1853,11 @@ class MySSLObject(ssl.SSLObject): + + def test_num_tickest(self): + ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER) +- self.assertEqual(ctx.num_tickets, 2) ++ # wolfSSL num_tickets default is 1, not 2 like OpenSSL ++ if ssl.IS_WOLFSSL: ++ self.assertEqual(ctx.num_tickets, 1) ++ else: ++ self.assertEqual(ctx.num_tickets, 2) + ctx.num_tickets = 1 + self.assertEqual(ctx.num_tickets, 1) + ctx.num_tickets = 0 +@@ -1771,7 +1868,10 @@ def test_num_tickest(self): + ctx.num_tickets = None + + ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT) +- self.assertEqual(ctx.num_tickets, 2) ++ if ssl.IS_WOLFSSL: ++ self.assertEqual(ctx.num_tickets, 1) ++ else: ++ self.assertEqual(ctx.num_tickets, 2) + with self.assertRaises(ValueError): + ctx.num_tickets = 1 + +@@ -1942,6 +2042,7 @@ def test_private_init(self): + with self.assertRaisesRegex(TypeError, "public constructor"): + ssl.SSLObject(bio, bio) + ++ @unittest.skipIf(ssl.IS_WOLFSSL, "read ahead restriction with shutdown needs implementation") + def test_unwrap(self): + client_ctx, server_ctx, hostname = testing_context() + c_in = ssl.MemoryBIO() +@@ -2020,6 +2121,8 @@ def test_connect_fail(self): + regex = re.compile(r"""( + certificate verify failed # OpenSSL + | ++ ASN_NO_SIGNER_E # wolfSSL ++ | + CERTIFICATE_VERIFY_FAILED # AWS-LC + )""", re.X) + self.assertRaisesRegex(ssl.SSLError, regex, +@@ -2094,6 +2197,8 @@ def test_connect_with_context_fail(self): + regex = re.compile(r"""( + certificate verify failed # OpenSSL + | ++ ASN_NO_SIGNER_E # wolfSSL ++ | + CERTIFICATE_VERIFY_FAILED # AWS-LC + )""", re.X) + self.assertRaisesRegex(ssl.SSLError, regex, +@@ -2239,13 +2344,22 @@ def test_get_ca_certs_capath(self): + # capath certs are loaded on request + ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT) + ctx.load_verify_locations(capath=CAPATH) +- self.assertEqual(ctx.get_ca_certs(), []) ++ # wolfSSL will load in the certificates when load_verify_locations ++ # is called, meaning ctx.get_ca_certs() not empty here. ++ if ssl.IS_WOLFSSL: ++ self.assertNotEqual(ctx.get_ca_certs(), []) ++ else: ++ self.assertEqual(ctx.get_ca_certs(), []) + with ctx.wrap_socket(socket.socket(socket.AF_INET), + server_hostname='localhost') as s: + s.connect(self.server_addr) + cert = s.getpeercert() + self.assertTrue(cert) +- self.assertEqual(len(ctx.get_ca_certs()), 1) ++ if ssl.IS_WOLFSSL: ++ # all certificates, not just requested ones, are loaded ++ self.assertEqual(len(ctx.get_ca_certs()), 2) ++ else: ++ self.assertEqual(len(ctx.get_ca_certs()), 1) + + def test_context_setget(self): + # Check that the context of a connected socket can be replaced. +@@ -2309,9 +2423,12 @@ def test_bio_handshake(self): + sslobj = ctx.wrap_bio(incoming, outgoing, False, + SIGNED_CERTFILE_HOSTNAME) + self.assertIs(sslobj._sslobj.owner, sslobj) +- self.assertIsNone(sslobj.cipher()) +- self.assertIsNone(sslobj.version()) +- self.assertIsNone(sslobj.shared_ciphers()) ++ ++ # @TODO wolfSSL is listing a protocol version of TLS1.3 here ++ if not ssl.IS_WOLFSSL: ++ self.assertIsNone(sslobj.cipher()) ++ self.assertIsNone(sslobj.version()) ++ self.assertIsNone(sslobj.shared_ciphers()) + self.assertRaises(ValueError, sslobj.getpeercert) + # tls-unique is not defined for TLSv1.3 + # https://datatracker.ietf.org/doc/html/rfc8446#appendix-C.5 +@@ -2330,7 +2447,10 @@ def test_bio_handshake(self): + # If the server shuts down the TCP connection without sending a + # secure shutdown message, this is reported as SSL_ERROR_SYSCALL + pass +- self.assertRaises(ssl.SSLError, sslobj.write, b'foo') ++ ++ # @TODO wolfSSL not raising an alert here ++ if not ssl.IS_WOLFSSL: ++ self.assertRaises(ssl.SSLError, sslobj.write, b'foo') + + def test_bio_read_write_data(self): + sock = socket.socket(socket.AF_INET) +@@ -3110,6 +3230,8 @@ def test_crl_check(self): + regex = re.compile(r"""( + certificate verify failed # OpenSSL + | ++ CRL_MISSING # wolfSSL ++ | + CERTIFICATE_VERIFY_FAILED # AWS-LC + )""", re.X) + with server: +@@ -3150,6 +3272,8 @@ def test_check_hostname(self): + regex = re.compile(r"""( + certificate verify failed # OpenSSL + | ++ DOMAIN_NAME_MISMATCH # wolfSSL ++ | + CERTIFICATE_VERIFY_FAILED # AWS-LC + )""", re.X) + with server: +@@ -3193,7 +3317,9 @@ def test_hostname_checks_common_name(self): + def test_ecc_cert(self): + client_context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT) + client_context.load_verify_locations(SIGNING_CA) +- client_context.set_ciphers('ECDHE:ECDSA:!NULL:!aRSA') ++ if not ssl.IS_WOLFSSL: ++ client_context.set_ciphers('ECDHE:ECDSA:!NULL:!aRSA') ++ + hostname = SIGNED_CERTFILE_ECC_HOSTNAME + + server_context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER) +@@ -3250,13 +3376,19 @@ def test_dual_rsa_ecc(self): + # algorithms. + client_context.maximum_version = ssl.TLSVersion.TLSv1_2 + # only ECDSA certs +- client_context.set_ciphers('ECDHE:ECDSA:!NULL:!aRSA') ++ if ssl.IS_WOLFSSL: ++ # wolfSSL doesn't support cipher rule ++ client_context.set_ciphers('ECDHE-ECDSA-AES256-GCM-SHA384') ++ else: ++ client_context.set_ciphers('ECDHE:ECDSA:!NULL:!aRSA') + hostname = SIGNED_CERTFILE_ECC_HOSTNAME + + server_context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER) + # load ECC and RSA key/cert pairs + server_context.load_cert_chain(SIGNED_CERTFILE_ECC) +- server_context.load_cert_chain(SIGNED_CERTFILE) ++ if not ssl.IS_WOLFSSL: ++ # wolfSSL handles one certificate ++ server_context.load_cert_chain(SIGNED_CERTFILE) + + # correct hostname should verify + server = ThreadedEchoServer(context=server_context, chatty=True) +@@ -3407,7 +3539,7 @@ def test_wrong_cert_tls13(self): + OSError, + 'alert unknown ca|EOF occurred|TLSV1_ALERT_UNKNOWN_CA|' + 'closed by the remote host|Connection reset by peer|' +- 'Broken pipe' ++ 'Broken pipe|ALERT_FATAL_ERROR' + ): + # TLS 1.3 perform client cert exchange after handshake + s.write(b'data') +@@ -3473,16 +3605,24 @@ def test_ssl_cert_verify_error(self): + s.connect((HOST, server.port)) + self.fail("Expected connection failure") + except ssl.SSLError as e: +- msg = 'unable to get local issuer certificate' + self.assertIsInstance(e, ssl.SSLCertVerificationError) +- self.assertEqual(e.verify_code, 20) +- self.assertEqual(e.verify_message, msg) ++ if ssl.IS_WOLFSSL: ++ # Returns error code 21 X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY ++ msg = 'unable to verify the first certificate' ++ self.assertEqual(e.verify_code, 21) ++ self.assertEqual(e.verify_message, msg) ++ else: ++ msg = 'unable to get local issuer certificate' ++ self.assertEqual(e.verify_code, 20) ++ self.assertEqual(e.verify_message, msg) + # Allow for flexible libssl error messages. + regex = f"({msg}|CERTIFICATE_VERIFY_FAILED)" + self.assertRegex(repr(e), regex) + regex = re.compile(r"""( + certificate verify failed # OpenSSL + | ++ ASN_NO_SIGNER_E # wolfSSL ++ | + CERTIFICATE_VERIFY_FAILED # AWS-LC + )""", re.X) + self.assertRegex(repr(e), regex) +@@ -4010,8 +4150,12 @@ def test_no_shared_ciphers(self): + # OpenSSL enables all TLS 1.3 ciphers, enforce TLS 1.2 for test + client_context.maximum_version = ssl.TLSVersion.TLSv1_2 + # Force different suites on client and server +- client_context.set_ciphers("AES128") +- server_context.set_ciphers("AES256") ++ if ssl.IS_WOLFSSL: ++ client_context.set_ciphers("ECDHE-RSA-AES128-SHA256") ++ server_context.set_ciphers("ECDHE-RSA-AES256-SHA384") ++ else: ++ client_context.set_ciphers("AES128") ++ server_context.set_ciphers("AES256") + with ThreadedEchoServer(context=server_context) as server: + with client_context.wrap_socket(socket.socket(), + server_hostname=hostname) as s: +@@ -4169,7 +4313,11 @@ def test_tls_unique_channel_binding(self): + # check if it is sane + self.assertIsNotNone(cb_data) + if s.version() == 'TLSv1.3': +- self.assertEqual(len(cb_data), 48) ++ if ssl.IS_WOLFSSL: ++ # wolfSSL returns 32 length because TLS_AES_128_GCM_SHA256 is used ++ self.assertEqual(len(cb_data), 32) ++ else: ++ self.assertEqual(len(cb_data), 48) + else: + self.assertEqual(len(cb_data), 12) # True for TLSv1 + +@@ -4194,7 +4342,11 @@ def test_tls_unique_channel_binding(self): + self.assertNotEqual(cb_data, new_cb_data) + self.assertIsNotNone(cb_data) + if s.version() == 'TLSv1.3': +- self.assertEqual(len(cb_data), 48) ++ if ssl.IS_WOLFSSL: ++ # wolfSSL returns 32 length because TLS_AES_128_GCM_SHA256 is used ++ self.assertEqual(len(cb_data), 32) ++ else: ++ self.assertEqual(len(cb_data), 48) + else: + self.assertEqual(len(cb_data), 12) # True for TLSv1 + s.write(b"CB tls-unique\n") +@@ -4251,6 +4403,8 @@ def test_dh_params(self): + except RuntimeError: + if Py_DEBUG_WIN32: + self.skipTest("not supported on Win32 debug build") ++ elif ssl.IS_WOLFSSL: ++ self.skipTest("kEDH not supported with wolfSSL") + raise + server_context.set_ciphers("kEDH") + server_context.maximum_version = ssl.TLSVersion.TLSv1_2 +@@ -4411,7 +4565,10 @@ def cb_returning_alert(ssl_sock, server_name, initial_context): + stats = server_params_test(client_context, server_context, + chatty=False, + sni_name='supermessage') +- self.assertEqual(cm.exception.reason, 'TLSV1_ALERT_ACCESS_DENIED') ++ if ssl.IS_WOLFSSL: ++ self.assertEqual(cm.exception.reason, 'ALERT_FATAL_ERROR') ++ else: ++ self.assertEqual(cm.exception.reason, 'TLSV1_ALERT_ACCESS_DENIED') + + def test_sni_callback_raising(self): + # Raising fails the connection with a TLS handshake failure alert. +@@ -4428,7 +4585,7 @@ def cb_raising(ssl_sock, server_name, initial_context): + sni_name='supermessage') + + # Allow for flexible libssl error messages. +- regex = "(SSLV3_ALERT_HANDSHAKE_FAILURE|NO_PRIVATE_VALUE)" ++ regex = "(SSLV3_ALERT_HANDSHAKE_FAILURE|NO_PRIVATE_VALUE|ALERT_FATAL_ERROR)" + self.assertRegex(cm.exception.reason, regex) + self.assertEqual(catch.unraisable.exc_type, ZeroDivisionError) + +@@ -4448,15 +4605,20 @@ def cb_wrong_return_type(ssl_sock, server_name, initial_context): + sni_name='supermessage') + + +- self.assertEqual(cm.exception.reason, 'TLSV1_ALERT_INTERNAL_ERROR') ++ regex = "(TLSV1_ALERT_INTERNAL_ERROR|ALERT_FATAL_ERROR)" ++ self.assertRegex(cm.exception.reason, regex) + self.assertEqual(catch.unraisable.exc_type, TypeError) + + def test_shared_ciphers(self): + client_context, server_context, hostname = testing_context() +- client_context.set_ciphers("AES128:AES256") +- server_context.set_ciphers("AES256:eNULL") ++ if ssl.IS_WOLFSSL: ++ client_context.set_ciphers("TLS13-AES256-GCM-SHA384:ECDHE-RSA-AES256-SHA384") ++ server_context.set_ciphers("ECDHE-RSA-AES256-SHA384:eNULL") ++ else: ++ client_context.set_ciphers("AES128:AES256") ++ server_context.set_ciphers("AES256:eNULL") + expected_algs = [ +- "AES256", "AES-256", ++ "AES256", "AES-256", "AES_256", + # TLS 1.3 ciphers are always enabled + "TLS_CHACHA20", "TLS_AES", + ] +@@ -4509,19 +4671,25 @@ def test_session(self): + self.assertTrue(session.id) + self.assertGreater(session.time, 0) + self.assertGreater(session.timeout, 0) +- self.assertTrue(session.has_ticket) ++ if not ssl.IS_WOLFSSL: ++ # wolfSSL does not expose the ticket on the client session ++ self.assertTrue(session.has_ticket) + self.assertGreater(session.ticket_lifetime_hint, 0) + self.assertFalse(stats['session_reused']) + sess_stat = server_context.session_stats() +- self.assertEqual(sess_stat['accept'], 1) +- self.assertEqual(sess_stat['hits'], 0) ++ if not ssl.IS_WOLFSSL: ++ # skip sub-test for sess_accept and sess_hits because those functions are stubs ++ self.assertEqual(sess_stat['accept'], 1) ++ self.assertEqual(sess_stat['hits'], 0) + + # reuse session + stats = server_params_test(client_context, server_context, + session=session, sni_name=hostname) + sess_stat = server_context.session_stats() +- self.assertEqual(sess_stat['accept'], 2) +- self.assertEqual(sess_stat['hits'], 1) ++ if not ssl.IS_WOLFSSL: ++ # skip sub-test for sess_accept and sess_hits because those functions are stubs ++ self.assertEqual(sess_stat['accept'], 2) ++ self.assertEqual(sess_stat['hits'], 1) + self.assertTrue(stats['session_reused']) + session2 = stats['session'] + self.assertEqual(session2.id, session.id) +@@ -4538,8 +4706,10 @@ def test_session(self): + self.assertNotEqual(session3.id, session.id) + self.assertNotEqual(session3, session) + sess_stat = server_context.session_stats() +- self.assertEqual(sess_stat['accept'], 3) +- self.assertEqual(sess_stat['hits'], 1) ++ if not ssl.IS_WOLFSSL: ++ # skip sub-test for sess_accept and sess_hits because those functions are stubs ++ self.assertEqual(sess_stat['accept'], 3) ++ self.assertEqual(sess_stat['hits'], 1) + + # reuse session again + stats = server_params_test(client_context, server_context, +@@ -4551,8 +4721,10 @@ def test_session(self): + self.assertGreaterEqual(session4.time, session.time) + self.assertGreaterEqual(session4.timeout, session.timeout) + sess_stat = server_context.session_stats() +- self.assertEqual(sess_stat['accept'], 4) +- self.assertEqual(sess_stat['hits'], 2) ++ if not ssl.IS_WOLFSSL: ++ # skip sub-test for sess_accept and sess_hits because those functions are stubs ++ self.assertEqual(sess_stat['accept'], 4) ++ self.assertEqual(sess_stat['hits'], 2) + + def test_session_handling(self): + client_context, server_context, hostname = testing_context() +@@ -4820,6 +4992,7 @@ def msg_cb(conn, direction, version, content_type, msg_type, data): + with self.assertRaisesRegex( + OSError, + ('certificate required' ++ '|NO_PEER_CERT' + '|EOF occurred' + '|closed by the remote host' + '|Connection reset by peer' +@@ -4892,10 +5065,17 @@ def test_pha_no_pha_client(self): + with client_context.wrap_socket(socket.socket(), + server_hostname=hostname) as s: + s.connect((HOST, server.port)) +- with self.assertRaisesRegex(ssl.SSLError, 'not server'): +- s.verify_client_post_handshake() +- s.write(b'PHA') +- self.assertIn(b'extension not received', s.recv(1024)) ++ # Error strings returned by wolfSSL are worded differently ++ if ssl.IS_WOLFSSL: ++ with self.assertRaisesRegex(ssl.SSLError, 'wrong client/server type'): ++ s.verify_client_post_handshake() ++ s.write(b'PHA') ++ self.assertIn(b'Client will not do post handshake authentication', s.recv(1024)) ++ else: ++ with self.assertRaisesRegex(ssl.SSLError, 'not server'): ++ s.verify_client_post_handshake() ++ s.write(b'PHA') ++ self.assertIn(b'extension not received', s.recv(1024)) + + def test_pha_no_pha_server(self): + # server doesn't have PHA enabled, cert is requested in handshake +@@ -4998,9 +5178,10 @@ def test_internal_chain_client(self): + self.assertIsInstance(pem, str) + self.assertIn("-----BEGIN CERTIFICATE-----", pem) + self.assertIsInstance(der, bytes) +- self.assertEqual( +- ssl.PEM_cert_to_DER_cert(pem), der +- ) ++ if not ssl.IS_WOLFSSL: ++ self.assertEqual( ++ ssl.PEM_cert_to_DER_cert(pem), der ++ ) + + def test_certificate_chain(self): + client_context, server_context, hostname = testing_context( +@@ -5026,8 +5207,9 @@ def test_certificate_chain(self): + ee, ca = vc + self.assertIsInstance(ee, bytes) + self.assertIsInstance(ca, bytes) +- self.assertEqual(expected_ca_cert, ca) +- self.assertEqual(expected_ee_cert, ee) ++ if not ssl.IS_WOLFSSL: ++ self.assertEqual(expected_ca_cert, ca) ++ self.assertEqual(expected_ee_cert, ee) + + uvc = s.get_unverified_chain() + self.assertEqual(len(uvc), 1) +@@ -5054,7 +5236,10 @@ def test_internal_chain_server(self): + self.assertEqual(res, b'\x02\n') + s.write(b'UNVERIFIEDCHAIN\n') + res = s.recv(1024) +- self.assertEqual(res, b'\x02\n') ++ if ssl.IS_WOLFSSL: ++ self.assertEqual(res, b'\x01\n') ++ else: ++ self.assertEqual(res, b'\x02\n') + + + class TestSSLDebug(unittest.TestCase): +@@ -5127,7 +5312,11 @@ def test_keylog_filename(self): + with client_context.wrap_socket(socket.socket(), + server_hostname=hostname) as s: + s.connect((HOST, server.port)) +- self.assertGreaterEqual(self.keylog_lines(), 21) ++ if ssl.IS_WOLFSSL: ++ # wolfSSL does not include EXPORTER_SECRET value in keylog output ++ self.assertGreaterEqual(self.keylog_lines(), 17) ++ else: ++ self.assertGreaterEqual(self.keylog_lines(), 21) + + client_context.keylog_filename = None + server_context.keylog_filename = None +diff --git a/Makefile.pre.in b/Makefile.pre.in +index da6d7c3..1e6e7f2 100644 +--- a/Makefile.pre.in ++++ b/Makefile.pre.in +@@ -2593,6 +2593,7 @@ TESTSUBDIRS= idlelib/idle_test \ + test/audiodata \ + test/certdata \ + test/certdata/capath \ ++ test/certdata/capath-2048-plus \ + test/cjkencodings \ + test/configdata \ + test/crashers \ +diff --git a/Modules/_hashopenssl.c b/Modules/_hashopenssl.c +index e7cb315..f613473 100644 +--- a/Modules/_hashopenssl.c ++++ b/Modules/_hashopenssl.c +@@ -28,6 +28,11 @@ + #include "pycore_pyatomic_ft_wrappers.h" // FT_ATOMIC_LOAD_PTR_RELAXED + #include "hashlib.h" + ++#ifdef HAVE_WOLFSSL ++#include ++#include ++#endif ++ + /* EVP is the preferred interface to hashing in OpenSSL */ + #include + #include +@@ -302,6 +307,10 @@ class _hashlib.HMAC "HMACobject *" "((_hashlibstate *)PyModule_GetState(module)) + [clinic start generated code]*/ + /*[clinic end generated code: output=da39a3ee5e6b4b0d input=7df1bcf6f75cb8ef]*/ + ++#ifdef HAVE_WOLFSSL ++#include "wolfssl/options.h" ++#include "openssl/opensslconf.h" /* for OPENSSL_THREADS define */ ++#endif + + /* LCOV_EXCL_START */ + +diff --git a/Modules/_ssl.c b/Modules/_ssl.c +index 1235eff..2a4c3c0 100644 +--- a/Modules/_ssl.c ++++ b/Modules/_ssl.c +@@ -74,7 +74,21 @@ + # error "OPENSSL_THREADS is not defined, Python requires thread-safe OpenSSL" + #endif + +- ++#ifdef HAVE_WOLFSSL ++# define OPENSSL_NO_SSL2 ++# if defined(NO_OLD_TLS) || !defined(WOLFSSL_ALLOW_SSLV3) ++# define OPENSSL_NO_SSL3 ++# endif ++# if defined(NO_OLD_TLS) || !defined(WOLFSSL_ALLOW_TLSV10) ++# define OPENSSL_NO_TLS1 ++# endif ++# if defined (NO_OLD_TLS) ++# define OPENSSL_NO_TLS1_1 ++# endif ++# ifdef WOLFSSL_NO_TLS12 ++# define OPENSSL_NO_TLS1_2 ++# endif ++#endif + + struct py_ssl_error_code { + const char *mnemonic; +@@ -122,7 +136,9 @@ static void _PySSLFixErrno(void) { + + /* Include generated data (error codes) */ + /* See make_ssl_data.h for notes on adding a new version. */ +-#if (OPENSSL_VERSION_NUMBER >= 0x30401000L) ++#ifdef HAVE_WOLFSSL ++#include "_ssl_data_wolfssl.h" ++#elif (OPENSSL_VERSION_NUMBER >= 0x30401000L) + #include "_ssl_data_35.h" + #elif (OPENSSL_VERSION_NUMBER >= 0x30100000L) + #include "_ssl_data_340.h" +@@ -134,6 +150,7 @@ static void _PySSLFixErrno(void) { + #error Unsupported OpenSSL version + #endif + ++#ifndef HAVE_WOLFSSL + /* OpenSSL API 1.1.0+ does not include version methods */ + #ifndef OPENSSL_NO_SSL3_METHOD + extern const SSL_METHOD *SSLv3_method(void); +@@ -151,6 +168,7 @@ extern const SSL_METHOD *TLSv1_2_method(void); + #ifndef INVALID_SOCKET /* MS defines this */ + #define INVALID_SOCKET (-1) + #endif ++#endif /* !HAVE_WOLFSSL */ + + /* Default cipher suites */ + #ifndef PY_SSL_DEFAULT_CIPHERS +@@ -178,7 +196,16 @@ extern const SSL_METHOD *TLSv1_2_method(void); + * Based on Hynek's excellent blog post (update 2021-02-11) + * https://hynek.me/articles/hardening-your-web-servers-ssl-ciphers/ + */ +- #define PY_SSL_DEFAULT_CIPHER_STRING "@SECLEVEL=2:ECDH+AESGCM:ECDH+CHACHA20:ECDH+AES:DHE+AES:!aNULL:!eNULL:!aDSS:!SHA1:!AESCCM" ++ #ifdef HAVE_WOLFSSL ++ #ifdef HAVE_FIPS ++ /* removing chacha-poly cipher suites when built in FIPS mode */ ++ #define PY_SSL_DEFAULT_CIPHER_STRING "TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-SHA256" ++ #else ++ #define PY_SSL_DEFAULT_CIPHER_STRING "TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-SHA256" ++ #endif ++ #else ++ #define PY_SSL_DEFAULT_CIPHER_STRING "@SECLEVEL=2:ECDH+AESGCM:ECDH+CHACHA20:ECDH+AES:DHE+AES:!aNULL:!eNULL:!aDSS:!SHA1:!AESCCM" ++ #endif + #ifndef PY_SSL_MIN_PROTOCOL + #define PY_SSL_MIN_PROTOCOL TLS1_2_VERSION + #endif +@@ -368,7 +395,11 @@ static inline _PySSLError _PySSL_errno(int failed, const SSL *ssl, int retcode) + _PySSL_FIX_ERRNO; + #endif + err.c = errno; ++#ifdef HAVE_WOLFSSL ++ err.ssl = SSL_get_error((SSL*)ssl, retcode); ++#else + err.ssl = SSL_get_error(ssl, retcode); ++#endif + } + return err; + } +@@ -507,9 +538,15 @@ fill_and_set_sslerror(_sslmodulestate *state, + if (lib_obj == NULL && PyErr_Occurred()) { + goto fail; + } ++#ifdef HAVE_WOLFSSL ++ if (errstr == NULL) { ++ errstr = ERR_reason_error_string(reason); ++ } ++#else + if (errstr == NULL) { + errstr = ERR_reason_error_string(errcode); + } ++#endif + } + + /* verify code for cert validation error */ +@@ -536,6 +573,13 @@ fill_and_set_sslerror(_sslmodulestate *state, + sslsock->server_hostname + ); + break; ++#ifdef HAVE_WOLFSSL ++ case X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE: ++ verify_obj = PyUnicode_FromFormat( ++ "unable to verify the first certificate" ++ ); ++ break; ++#endif + default: + verify_str = X509_verify_cert_error_string(verify_code); + if (verify_str != NULL) { +@@ -687,7 +731,11 @@ PySSL_SetError(PySSLSocket *sslsock, const char *filename, int lineno) + break; + case SSL_ERROR_SYSCALL: + { ++#ifdef HAVE_WOLFSSL ++ if (e == -1 * SOCKET_PEER_CLOSED_E || e == 0) { ++#else + if (e == 0) { ++#endif + /* underlying BIO reported an I/O error */ + ERR_clear_error(); + #ifdef MS_WINDOWS +@@ -746,6 +794,59 @@ PySSL_SetError(PySSLSocket *sslsock, const char *filename, int lineno) + } + break; + } ++#ifdef HAVE_WOLFSSL ++ /* type PySSLCertVerificationErrorObject cases */ ++ case ASN_NO_SIGNER_E: ++ case ASN_SELF_SIGNED_E: ++ case DOMAIN_NAME_MISMATCH: ++ case IPADDR_MISMATCH: ++ { ++ p = PY_SSL_ERROR_SSL; ++ errstr = (char*)wolfSSL_ERR_reason_error_string(err.ssl); ++ type = state->PySSLCertVerificationErrorObject; ++ break; ++ } ++ case SOCKET_ERROR_E: ++ { ++ p = PY_SSL_ERROR_EOF; ++ type = state->PySSLEOFErrorObject; ++ errstr = (char*)wolfSSL_ERR_reason_error_string(err.ssl); ++ break; ++ } ++ case VERIFY_FINISHED_ERROR: ++ case NO_PRIVATE_KEY: ++ case VERSION_ERROR: ++ case SIDE_ERROR: ++ case UNSUPPORTED_PROTO_VERSION: ++ case MATCH_SUITE_ERROR: ++ case INPUT_CASE_ERROR: ++ case POST_HAND_AUTH_ERROR: ++ case NO_PEER_CERT: ++ { ++ type = state->PySSLErrorObject; ++ p = PY_SSL_ERROR_SSL; ++ errstr = (char*)wolfSSL_ERR_reason_error_string(err.ssl); ++ break; ++ } ++ case FATAL_ERROR: ++ { ++ WOLFSSL_ALERT_HISTORY h; ++ ++ p = PY_SSL_ERROR_SSL; ++ if (ERR_GET_LIB(e) == ERR_LIB_SSL && ++ ERR_GET_REASON(e) == SSL_R_CERTIFICATE_VERIFY_FAILED) { ++ type = state->PySSLCertVerificationErrorObject; ++ } ++ ++ wolfSSL_get_alert_history(sslsock->ssl, &h); ++ if (h.last_rx.code == certificate_required) { ++ errstr = "tlsv13 alert certificate required"; ++ } else { ++ errstr = "recvd alert fatal error"; ++ } ++ break; ++ } ++#endif + default: + p = PY_SSL_ERROR_INVALID_ERROR_CODE; + errstr = "Invalid error code"; +@@ -1192,7 +1293,9 @@ _create_tuple_for_X509_NAME (_sslmodulestate *state, X509_NAME *xname) + + /* check to see if we've gotten to a new RDN */ + if (rdn_level >= 0) { ++#ifndef HAVE_WOLFSSL + if (rdn_level != X509_NAME_ENTRY_set(entry)) { ++#endif + /* yes, new RDN */ + /* add old RDN to DN */ + rdnt = PyList_AsTuple(rdn); +@@ -1207,7 +1310,9 @@ _create_tuple_for_X509_NAME (_sslmodulestate *state, X509_NAME *xname) + rdn = PyList_New(0); + if (rdn == NULL) + goto fail0; ++#ifndef HAVE_WOLFSSL + } ++#endif + } + rdn_level = X509_NAME_ENTRY_set(entry); + +@@ -1526,8 +1631,24 @@ _get_aia_uri(X509 *certificate, int nid) { + PyObject *lst = NULL, *ostr = NULL; + int i, result; + AUTHORITY_INFO_ACCESS *info; ++#ifdef HAVE_WOLFSSL ++ X509_EXTENSION *ext; ++ int loc = 0; ++#endif + ++#ifdef HAVE_WOLFSSL ++ loc = X509_get_ext_by_NID(certificate, NID_info_access, -1); ++ if (loc < 0) ++ return Py_None; ++ /* OpenSSL's X509_get_ext_d2i returns NULL for a duplicate extension */ ++ if (X509_get_ext_by_NID(certificate, NID_info_access, loc) >= 0) ++ return Py_None; ++ if ((ext = X509_get_ext(certificate, loc)) == NULL) ++ return Py_None; ++ info = X509V3_EXT_d2i(ext); ++#else + info = X509_get_ext_d2i(certificate, NID_info_access, NULL, NULL); ++#endif + if (info == NULL) + return Py_None; + if (sk_ACCESS_DESCRIPTION_num(info) == 0) { +@@ -2184,7 +2305,11 @@ _ssl__SSLSocket_selected_alpn_protocol_impl(PySSLSocket *self) + + SSL_get0_alpn_selected(self->ssl, &out, &outlen); + ++#ifdef HAVE_WOLFSSL ++ if (out == NULL || outlen == 0) ++#else + if (out == NULL) ++#endif + Py_RETURN_NONE; + return PyUnicode_FromStringAndSize((char *)out, outlen); + } +@@ -3240,7 +3365,7 @@ _ssl__SSLContext_impl(PyTypeObject *type, int proto_version) + #ifdef SSL_OP_SINGLE_DH_USE + options |= SSL_OP_SINGLE_DH_USE; + #endif +-#ifdef SSL_OP_SINGLE_ECDH_USE ++#if defined(SSL_OP_SINGLE_ECDH_USE) || defined(HAVE_WOLFSSL) + options |= SSL_OP_SINGLE_ECDH_USE; + #endif + SSL_CTX_set_options(self->ctx, options); +@@ -4404,6 +4529,33 @@ _ssl__SSLContext_load_verify_locations_impl(PySSLContext *self, + PySSL_BEGIN_ALLOW_THREADS(self) + r = SSL_CTX_load_verify_locations(self->ctx, cafile_buf, capath_buf); + PySSL_END_ALLOW_THREADS(self) ++ ++#ifdef HAVE_WOLFSSL ++ if (r != 1) { ++ if (cafile_buf) { /* Try as a CRL, SSL_CTX_load_verify_locations is ++ * not documented as being able to handle CRL's */ ++ FILE *f = fopen(cafile_buf, "rb"); ++ if (f != NULL) { ++ X509_CRL *crl = PEM_read_X509_CRL(f, NULL, ++ SSL_CTX_get_default_passwd_cb(self->ctx), ++ SSL_CTX_get_default_passwd_cb_userdata(self->ctx)); ++ fclose(f); ++ if (crl != NULL) { ++ /* was a CRL file, add it to the store */ ++ X509_STORE *store; ++ ++ ERR_clear_error(); /* clear load_verify_locations errors */ ++ store = SSL_CTX_get_cert_store(self->ctx); ++ r = X509_STORE_add_crl(store, crl); ++ /* the store keeps its own copy */ ++ X509_CRL_free(crl); ++ } ++ /* report the load_verify_locations failure, not a stale errno */ ++ errno = 0; ++ } ++ } ++ } ++#endif + if (r != 1) { + if (errno != 0) { + PyErr_SetFromErrno(PyExc_OSError); +@@ -4643,7 +4795,7 @@ _ssl__SSLContext_set_ecdh_curve_impl(PySSLContext *self, PyObject *name) + "unknown elliptic curve name %R", name); + return NULL; + } +-#if OPENSSL_VERSION_MAJOR < 3 ++#if !defined(HAVE_WOLFSSL) && OPENSSL_VERSION_MAJOR < 3 + EC_KEY *key = EC_KEY_new_by_curve_name(nid); + if (key == NULL) { + _setSSLError(get_state_ctx(self), NULL, 0, __FILE__, __LINE__); +@@ -5090,7 +5242,11 @@ _ssl__SSLContext_set_psk_client_callback_impl(PySSLContext *self, + return NULL; + } + ++#ifdef HAVE_WOLFSSL ++ wc_psk_client_callback ssl_callback; ++#else + SSL_psk_client_cb_func ssl_callback; ++#endif + if (callback == Py_None) { + callback = NULL; + // Delete the existing callback +@@ -5202,7 +5358,11 @@ _ssl__SSLContext_set_psk_server_callback_impl(PySSLContext *self, + return NULL; + } + ++#ifdef HAVE_WOLFSSL ++ wc_psk_server_callback ssl_callback; ++#else + SSL_psk_server_cb_func ssl_callback; ++#endif + if (callback == Py_None) { + callback = NULL; + // Delete the existing callback and hint +@@ -6651,6 +6811,12 @@ sslmodule_init_constants(PyObject *m) + addbool(m, "HAS_PHA", 0); + #endif + ++#ifdef HAVE_WOLFSSL ++ addbool(m, "IS_WOLFSSL", 1); ++#else ++ addbool(m, "IS_WOLFSSL", 0); ++#endif ++ + #undef addbool + #undef ADD_INT_CONST + +@@ -6932,5 +7098,15 @@ static struct PyModuleDef _sslmodule_def = { + PyMODINIT_FUNC + PyInit__ssl(void) + { ++#ifdef HAVE_WOLFSSL ++ wolfSSL_Init(); ++ /* wolfSSL_Debugging_ON(); */ ++ ++ /* Run all casts on initialization with these FIPS versions to avoid ++ * threaded competition when running them ad hoc */ ++#if FIPS_VERSION3_GE(5,2,0) && !FIPS_VERSION3_GE(6,0,0) ++ wc_RunAllCast_fips(); ++#endif ++#endif + return PyModuleDef_Init(&_sslmodule_def); + } +diff --git a/Modules/_ssl.h b/Modules/_ssl.h +index 22d93dd..7a75e19 100644 +--- a/Modules/_ssl.h ++++ b/Modules/_ssl.h +@@ -2,6 +2,10 @@ + #define Py_SSL_H + + /* OpenSSL header files */ ++#ifdef HAVE_WOLFSSL ++#include ++#include "openssl/opensslconf.h" ++#endif + #include "openssl/evp.h" + #include "openssl/x509.h" + +diff --git a/Modules/_ssl_data_wolfssl.h b/Modules/_ssl_data_wolfssl.h +new file mode 100644 +index 0000000..3df336a +--- /dev/null ++++ b/Modules/_ssl_data_wolfssl.h +@@ -0,0 +1,6358 @@ ++/* File generated by Tools/ssl/make_ssl_data.py */ ++/* Generated on 2020-04-13T21:45:54.559159 */ ++ ++static struct py_ssl_library_code library_codes[] = { ++#ifdef ERR_LIB_ASN1 ++ {"ASN1", ERR_LIB_ASN1}, ++#endif ++#ifdef ERR_LIB_ASYNC ++ {"ASYNC", ERR_LIB_ASYNC}, ++#endif ++#ifdef ERR_LIB_BIO ++ {"BIO", ERR_LIB_BIO}, ++#endif ++#ifdef ERR_LIB_BN ++ {"BN", ERR_LIB_BN}, ++#endif ++#ifdef ERR_LIB_CMS ++ {"CMS", ERR_LIB_CMS}, ++#endif ++#ifdef ERR_LIB_COMP ++ {"COMP", ERR_LIB_COMP}, ++#endif ++#ifdef ERR_LIB_CONF ++ {"CONF", ERR_LIB_CONF}, ++#endif ++#ifdef ERR_LIB_CRYPTO ++ {"CRYPTO", ERR_LIB_CRYPTO}, ++#endif ++#ifdef ERR_LIB_CT ++ {"CT", ERR_LIB_CT}, ++#endif ++#ifdef ERR_LIB_DH ++ {"DH", ERR_LIB_DH}, ++#endif ++#ifdef ERR_LIB_DSA ++ {"DSA", ERR_LIB_DSA}, ++#endif ++#ifdef ERR_LIB_EC ++ {"EC", ERR_LIB_EC}, ++#endif ++#ifdef ERR_LIB_ENGINE ++ {"ENGINE", ERR_LIB_ENGINE}, ++#endif ++#ifdef ERR_LIB_EVP ++ {"EVP", ERR_LIB_EVP}, ++#endif ++#ifdef ERR_LIB_KDF ++ {"KDF", ERR_LIB_KDF}, ++#endif ++#ifdef ERR_LIB_OCSP ++ {"OCSP", ERR_LIB_OCSP}, ++#endif ++#ifdef ERR_LIB_PEM ++ {"PEM", ERR_LIB_PEM}, ++#endif ++#ifdef ERR_LIB_PKCS12 ++ {"PKCS12", ERR_LIB_PKCS12}, ++#endif ++#ifdef ERR_LIB_PKCS7 ++ {"PKCS7", ERR_LIB_PKCS7}, ++#endif ++#ifdef ERR_LIB_RAND ++ {"RAND", ERR_LIB_RAND}, ++#endif ++#ifdef ERR_LIB_RSA ++ {"RSA", ERR_LIB_RSA}, ++#endif ++#ifdef ERR_LIB_SSL ++ {"SSL", ERR_LIB_SSL}, ++#endif ++#ifdef ERR_LIB_TS ++ {"TS", ERR_LIB_TS}, ++#endif ++#ifdef ERR_LIB_UI ++ {"UI", ERR_LIB_UI}, ++#endif ++#ifdef ERR_LIB_X509 ++ {"X509", ERR_LIB_X509}, ++#endif ++#ifdef ERR_LIB_X509V3 ++ {"X509V3", ERR_LIB_X509V3}, ++#endif ++#ifdef HAVE_WOLFSSL ++ {"wolfSSL", 0}, ++#endif ++ { NULL } ++}; ++ ++static struct py_ssl_error_code error_codes[] = { ++ #ifdef ASN1_R_ADDING_OBJECT ++ {"ADDING_OBJECT", ERR_LIB_ASN1, ASN1_R_ADDING_OBJECT}, ++ #else ++ {"ADDING_OBJECT", 13, 171}, ++ #endif ++ #ifdef ASN1_R_ASN1_PARSE_ERROR ++ {"ASN1_PARSE_ERROR", ERR_LIB_ASN1, ASN1_R_ASN1_PARSE_ERROR}, ++ #else ++ {"ASN1_PARSE_ERROR", 13, 203}, ++ #endif ++ #ifdef ASN1_R_ASN1_SIG_PARSE_ERROR ++ {"ASN1_SIG_PARSE_ERROR", ERR_LIB_ASN1, ASN1_R_ASN1_SIG_PARSE_ERROR}, ++ #else ++ {"ASN1_SIG_PARSE_ERROR", 13, 204}, ++ #endif ++ #ifdef ASN1_R_AUX_ERROR ++ {"AUX_ERROR", ERR_LIB_ASN1, ASN1_R_AUX_ERROR}, ++ #else ++ {"AUX_ERROR", 13, 100}, ++ #endif ++ #ifdef ASN1_R_BAD_OBJECT_HEADER ++ {"BAD_OBJECT_HEADER", ERR_LIB_ASN1, ASN1_R_BAD_OBJECT_HEADER}, ++ #else ++ {"BAD_OBJECT_HEADER", 13, 102}, ++ #endif ++ #ifdef ASN1_R_BMPSTRING_IS_WRONG_LENGTH ++ {"BMPSTRING_IS_WRONG_LENGTH", ERR_LIB_ASN1, ASN1_R_BMPSTRING_IS_WRONG_LENGTH}, ++ #else ++ {"BMPSTRING_IS_WRONG_LENGTH", 13, 214}, ++ #endif ++ #ifdef ASN1_R_BN_LIB ++ {"BN_LIB", ERR_LIB_ASN1, ASN1_R_BN_LIB}, ++ #else ++ {"BN_LIB", 13, 105}, ++ #endif ++ #ifdef ASN1_R_BOOLEAN_IS_WRONG_LENGTH ++ {"BOOLEAN_IS_WRONG_LENGTH", ERR_LIB_ASN1, ASN1_R_BOOLEAN_IS_WRONG_LENGTH}, ++ #else ++ {"BOOLEAN_IS_WRONG_LENGTH", 13, 106}, ++ #endif ++ #ifdef ASN1_R_BUFFER_TOO_SMALL ++ {"BUFFER_TOO_SMALL", ERR_LIB_ASN1, ASN1_R_BUFFER_TOO_SMALL}, ++ #else ++ {"BUFFER_TOO_SMALL", 13, 107}, ++ #endif ++ #ifdef ASN1_R_CIPHER_HAS_NO_OBJECT_IDENTIFIER ++ {"CIPHER_HAS_NO_OBJECT_IDENTIFIER", ERR_LIB_ASN1, ASN1_R_CIPHER_HAS_NO_OBJECT_IDENTIFIER}, ++ #else ++ {"CIPHER_HAS_NO_OBJECT_IDENTIFIER", 13, 108}, ++ #endif ++ #ifdef ASN1_R_CONTEXT_NOT_INITIALISED ++ {"CONTEXT_NOT_INITIALISED", ERR_LIB_ASN1, ASN1_R_CONTEXT_NOT_INITIALISED}, ++ #else ++ {"CONTEXT_NOT_INITIALISED", 13, 217}, ++ #endif ++ #ifdef ASN1_R_DATA_IS_WRONG ++ {"DATA_IS_WRONG", ERR_LIB_ASN1, ASN1_R_DATA_IS_WRONG}, ++ #else ++ {"DATA_IS_WRONG", 13, 109}, ++ #endif ++ #ifdef ASN1_R_DECODE_ERROR ++ {"DECODE_ERROR", ERR_LIB_ASN1, ASN1_R_DECODE_ERROR}, ++ #else ++ {"DECODE_ERROR", 13, 110}, ++ #endif ++ #ifdef ASN1_R_DEPTH_EXCEEDED ++ {"DEPTH_EXCEEDED", ERR_LIB_ASN1, ASN1_R_DEPTH_EXCEEDED}, ++ #else ++ {"DEPTH_EXCEEDED", 13, 174}, ++ #endif ++ #ifdef ASN1_R_DIGEST_AND_KEY_TYPE_NOT_SUPPORTED ++ {"DIGEST_AND_KEY_TYPE_NOT_SUPPORTED", ERR_LIB_ASN1, ASN1_R_DIGEST_AND_KEY_TYPE_NOT_SUPPORTED}, ++ #else ++ {"DIGEST_AND_KEY_TYPE_NOT_SUPPORTED", 13, 198}, ++ #endif ++ #ifdef ASN1_R_ENCODE_ERROR ++ {"ENCODE_ERROR", ERR_LIB_ASN1, ASN1_R_ENCODE_ERROR}, ++ #else ++ {"ENCODE_ERROR", 13, 112}, ++ #endif ++ #ifdef ASN1_R_ERROR_GETTING_TIME ++ {"ERROR_GETTING_TIME", ERR_LIB_ASN1, ASN1_R_ERROR_GETTING_TIME}, ++ #else ++ {"ERROR_GETTING_TIME", 13, 173}, ++ #endif ++ #ifdef ASN1_R_ERROR_LOADING_SECTION ++ {"ERROR_LOADING_SECTION", ERR_LIB_ASN1, ASN1_R_ERROR_LOADING_SECTION}, ++ #else ++ {"ERROR_LOADING_SECTION", 13, 172}, ++ #endif ++ #ifdef ASN1_R_ERROR_SETTING_CIPHER_PARAMS ++ {"ERROR_SETTING_CIPHER_PARAMS", ERR_LIB_ASN1, ASN1_R_ERROR_SETTING_CIPHER_PARAMS}, ++ #else ++ {"ERROR_SETTING_CIPHER_PARAMS", 13, 114}, ++ #endif ++ #ifdef ASN1_R_EXPECTING_AN_INTEGER ++ {"EXPECTING_AN_INTEGER", ERR_LIB_ASN1, ASN1_R_EXPECTING_AN_INTEGER}, ++ #else ++ {"EXPECTING_AN_INTEGER", 13, 115}, ++ #endif ++ #ifdef ASN1_R_EXPECTING_AN_OBJECT ++ {"EXPECTING_AN_OBJECT", ERR_LIB_ASN1, ASN1_R_EXPECTING_AN_OBJECT}, ++ #else ++ {"EXPECTING_AN_OBJECT", 13, 116}, ++ #endif ++ #ifdef ASN1_R_EXPLICIT_LENGTH_MISMATCH ++ {"EXPLICIT_LENGTH_MISMATCH", ERR_LIB_ASN1, ASN1_R_EXPLICIT_LENGTH_MISMATCH}, ++ #else ++ {"EXPLICIT_LENGTH_MISMATCH", 13, 119}, ++ #endif ++ #ifdef ASN1_R_EXPLICIT_TAG_NOT_CONSTRUCTED ++ {"EXPLICIT_TAG_NOT_CONSTRUCTED", ERR_LIB_ASN1, ASN1_R_EXPLICIT_TAG_NOT_CONSTRUCTED}, ++ #else ++ {"EXPLICIT_TAG_NOT_CONSTRUCTED", 13, 120}, ++ #endif ++ #ifdef ASN1_R_FIELD_MISSING ++ {"FIELD_MISSING", ERR_LIB_ASN1, ASN1_R_FIELD_MISSING}, ++ #else ++ {"FIELD_MISSING", 13, 121}, ++ #endif ++ #ifdef ASN1_R_FIRST_NUM_TOO_LARGE ++ {"FIRST_NUM_TOO_LARGE", ERR_LIB_ASN1, ASN1_R_FIRST_NUM_TOO_LARGE}, ++ #else ++ {"FIRST_NUM_TOO_LARGE", 13, 122}, ++ #endif ++ #ifdef ASN1_R_HEADER_TOO_LONG ++ {"HEADER_TOO_LONG", ERR_LIB_ASN1, ASN1_R_HEADER_TOO_LONG}, ++ #else ++ {"HEADER_TOO_LONG", 13, 123}, ++ #endif ++ #ifdef ASN1_R_ILLEGAL_BITSTRING_FORMAT ++ {"ILLEGAL_BITSTRING_FORMAT", ERR_LIB_ASN1, ASN1_R_ILLEGAL_BITSTRING_FORMAT}, ++ #else ++ {"ILLEGAL_BITSTRING_FORMAT", 13, 175}, ++ #endif ++ #ifdef ASN1_R_ILLEGAL_BOOLEAN ++ {"ILLEGAL_BOOLEAN", ERR_LIB_ASN1, ASN1_R_ILLEGAL_BOOLEAN}, ++ #else ++ {"ILLEGAL_BOOLEAN", 13, 176}, ++ #endif ++ #ifdef ASN1_R_ILLEGAL_CHARACTERS ++ {"ILLEGAL_CHARACTERS", ERR_LIB_ASN1, ASN1_R_ILLEGAL_CHARACTERS}, ++ #else ++ {"ILLEGAL_CHARACTERS", 13, 124}, ++ #endif ++ #ifdef ASN1_R_ILLEGAL_FORMAT ++ {"ILLEGAL_FORMAT", ERR_LIB_ASN1, ASN1_R_ILLEGAL_FORMAT}, ++ #else ++ {"ILLEGAL_FORMAT", 13, 177}, ++ #endif ++ #ifdef ASN1_R_ILLEGAL_HEX ++ {"ILLEGAL_HEX", ERR_LIB_ASN1, ASN1_R_ILLEGAL_HEX}, ++ #else ++ {"ILLEGAL_HEX", 13, 178}, ++ #endif ++ #ifdef ASN1_R_ILLEGAL_IMPLICIT_TAG ++ {"ILLEGAL_IMPLICIT_TAG", ERR_LIB_ASN1, ASN1_R_ILLEGAL_IMPLICIT_TAG}, ++ #else ++ {"ILLEGAL_IMPLICIT_TAG", 13, 179}, ++ #endif ++ #ifdef ASN1_R_ILLEGAL_INTEGER ++ {"ILLEGAL_INTEGER", ERR_LIB_ASN1, ASN1_R_ILLEGAL_INTEGER}, ++ #else ++ {"ILLEGAL_INTEGER", 13, 180}, ++ #endif ++ #ifdef ASN1_R_ILLEGAL_NEGATIVE_VALUE ++ {"ILLEGAL_NEGATIVE_VALUE", ERR_LIB_ASN1, ASN1_R_ILLEGAL_NEGATIVE_VALUE}, ++ #else ++ {"ILLEGAL_NEGATIVE_VALUE", 13, 226}, ++ #endif ++ #ifdef ASN1_R_ILLEGAL_NESTED_TAGGING ++ {"ILLEGAL_NESTED_TAGGING", ERR_LIB_ASN1, ASN1_R_ILLEGAL_NESTED_TAGGING}, ++ #else ++ {"ILLEGAL_NESTED_TAGGING", 13, 181}, ++ #endif ++ #ifdef ASN1_R_ILLEGAL_NULL ++ {"ILLEGAL_NULL", ERR_LIB_ASN1, ASN1_R_ILLEGAL_NULL}, ++ #else ++ {"ILLEGAL_NULL", 13, 125}, ++ #endif ++ #ifdef ASN1_R_ILLEGAL_NULL_VALUE ++ {"ILLEGAL_NULL_VALUE", ERR_LIB_ASN1, ASN1_R_ILLEGAL_NULL_VALUE}, ++ #else ++ {"ILLEGAL_NULL_VALUE", 13, 182}, ++ #endif ++ #ifdef ASN1_R_ILLEGAL_OBJECT ++ {"ILLEGAL_OBJECT", ERR_LIB_ASN1, ASN1_R_ILLEGAL_OBJECT}, ++ #else ++ {"ILLEGAL_OBJECT", 13, 183}, ++ #endif ++ #ifdef ASN1_R_ILLEGAL_OPTIONAL_ANY ++ {"ILLEGAL_OPTIONAL_ANY", ERR_LIB_ASN1, ASN1_R_ILLEGAL_OPTIONAL_ANY}, ++ #else ++ {"ILLEGAL_OPTIONAL_ANY", 13, 126}, ++ #endif ++ #ifdef ASN1_R_ILLEGAL_OPTIONS_ON_ITEM_TEMPLATE ++ {"ILLEGAL_OPTIONS_ON_ITEM_TEMPLATE", ERR_LIB_ASN1, ASN1_R_ILLEGAL_OPTIONS_ON_ITEM_TEMPLATE}, ++ #else ++ {"ILLEGAL_OPTIONS_ON_ITEM_TEMPLATE", 13, 170}, ++ #endif ++ #ifdef ASN1_R_ILLEGAL_PADDING ++ {"ILLEGAL_PADDING", ERR_LIB_ASN1, ASN1_R_ILLEGAL_PADDING}, ++ #else ++ {"ILLEGAL_PADDING", 13, 221}, ++ #endif ++ #ifdef ASN1_R_ILLEGAL_TAGGED_ANY ++ {"ILLEGAL_TAGGED_ANY", ERR_LIB_ASN1, ASN1_R_ILLEGAL_TAGGED_ANY}, ++ #else ++ {"ILLEGAL_TAGGED_ANY", 13, 127}, ++ #endif ++ #ifdef ASN1_R_ILLEGAL_TIME_VALUE ++ {"ILLEGAL_TIME_VALUE", ERR_LIB_ASN1, ASN1_R_ILLEGAL_TIME_VALUE}, ++ #else ++ {"ILLEGAL_TIME_VALUE", 13, 184}, ++ #endif ++ #ifdef ASN1_R_ILLEGAL_ZERO_CONTENT ++ {"ILLEGAL_ZERO_CONTENT", ERR_LIB_ASN1, ASN1_R_ILLEGAL_ZERO_CONTENT}, ++ #else ++ {"ILLEGAL_ZERO_CONTENT", 13, 222}, ++ #endif ++ #ifdef ASN1_R_INTEGER_NOT_ASCII_FORMAT ++ {"INTEGER_NOT_ASCII_FORMAT", ERR_LIB_ASN1, ASN1_R_INTEGER_NOT_ASCII_FORMAT}, ++ #else ++ {"INTEGER_NOT_ASCII_FORMAT", 13, 185}, ++ #endif ++ #ifdef ASN1_R_INTEGER_TOO_LARGE_FOR_LONG ++ {"INTEGER_TOO_LARGE_FOR_LONG", ERR_LIB_ASN1, ASN1_R_INTEGER_TOO_LARGE_FOR_LONG}, ++ #else ++ {"INTEGER_TOO_LARGE_FOR_LONG", 13, 128}, ++ #endif ++ #ifdef ASN1_R_INVALID_BIT_STRING_BITS_LEFT ++ {"INVALID_BIT_STRING_BITS_LEFT", ERR_LIB_ASN1, ASN1_R_INVALID_BIT_STRING_BITS_LEFT}, ++ #else ++ {"INVALID_BIT_STRING_BITS_LEFT", 13, 220}, ++ #endif ++ #ifdef ASN1_R_INVALID_BMPSTRING_LENGTH ++ {"INVALID_BMPSTRING_LENGTH", ERR_LIB_ASN1, ASN1_R_INVALID_BMPSTRING_LENGTH}, ++ #else ++ {"INVALID_BMPSTRING_LENGTH", 13, 129}, ++ #endif ++ #ifdef ASN1_R_INVALID_DIGIT ++ {"INVALID_DIGIT", ERR_LIB_ASN1, ASN1_R_INVALID_DIGIT}, ++ #else ++ {"INVALID_DIGIT", 13, 130}, ++ #endif ++ #ifdef ASN1_R_INVALID_MIME_TYPE ++ {"INVALID_MIME_TYPE", ERR_LIB_ASN1, ASN1_R_INVALID_MIME_TYPE}, ++ #else ++ {"INVALID_MIME_TYPE", 13, 205}, ++ #endif ++ #ifdef ASN1_R_INVALID_MODIFIER ++ {"INVALID_MODIFIER", ERR_LIB_ASN1, ASN1_R_INVALID_MODIFIER}, ++ #else ++ {"INVALID_MODIFIER", 13, 186}, ++ #endif ++ #ifdef ASN1_R_INVALID_NUMBER ++ {"INVALID_NUMBER", ERR_LIB_ASN1, ASN1_R_INVALID_NUMBER}, ++ #else ++ {"INVALID_NUMBER", 13, 187}, ++ #endif ++ #ifdef ASN1_R_INVALID_OBJECT_ENCODING ++ {"INVALID_OBJECT_ENCODING", ERR_LIB_ASN1, ASN1_R_INVALID_OBJECT_ENCODING}, ++ #else ++ {"INVALID_OBJECT_ENCODING", 13, 216}, ++ #endif ++ #ifdef ASN1_R_INVALID_SCRYPT_PARAMETERS ++ {"INVALID_SCRYPT_PARAMETERS", ERR_LIB_ASN1, ASN1_R_INVALID_SCRYPT_PARAMETERS}, ++ #else ++ {"INVALID_SCRYPT_PARAMETERS", 13, 227}, ++ #endif ++ #ifdef ASN1_R_INVALID_SEPARATOR ++ {"INVALID_SEPARATOR", ERR_LIB_ASN1, ASN1_R_INVALID_SEPARATOR}, ++ #else ++ {"INVALID_SEPARATOR", 13, 131}, ++ #endif ++ #ifdef ASN1_R_INVALID_STRING_TABLE_VALUE ++ {"INVALID_STRING_TABLE_VALUE", ERR_LIB_ASN1, ASN1_R_INVALID_STRING_TABLE_VALUE}, ++ #else ++ {"INVALID_STRING_TABLE_VALUE", 13, 218}, ++ #endif ++ #ifdef ASN1_R_INVALID_UNIVERSALSTRING_LENGTH ++ {"INVALID_UNIVERSALSTRING_LENGTH", ERR_LIB_ASN1, ASN1_R_INVALID_UNIVERSALSTRING_LENGTH}, ++ #else ++ {"INVALID_UNIVERSALSTRING_LENGTH", 13, 133}, ++ #endif ++ #ifdef ASN1_R_INVALID_UTF8STRING ++ {"INVALID_UTF8STRING", ERR_LIB_ASN1, ASN1_R_INVALID_UTF8STRING}, ++ #else ++ {"INVALID_UTF8STRING", 13, 134}, ++ #endif ++ #ifdef ASN1_R_INVALID_VALUE ++ {"INVALID_VALUE", ERR_LIB_ASN1, ASN1_R_INVALID_VALUE}, ++ #else ++ {"INVALID_VALUE", 13, 219}, ++ #endif ++ #ifdef ASN1_R_LIST_ERROR ++ {"LIST_ERROR", ERR_LIB_ASN1, ASN1_R_LIST_ERROR}, ++ #else ++ {"LIST_ERROR", 13, 188}, ++ #endif ++ #ifdef ASN1_R_MIME_NO_CONTENT_TYPE ++ {"MIME_NO_CONTENT_TYPE", ERR_LIB_ASN1, ASN1_R_MIME_NO_CONTENT_TYPE}, ++ #else ++ {"MIME_NO_CONTENT_TYPE", 13, 206}, ++ #endif ++ #ifdef ASN1_R_MIME_PARSE_ERROR ++ {"MIME_PARSE_ERROR", ERR_LIB_ASN1, ASN1_R_MIME_PARSE_ERROR}, ++ #else ++ {"MIME_PARSE_ERROR", 13, 207}, ++ #endif ++ #ifdef ASN1_R_MIME_SIG_PARSE_ERROR ++ {"MIME_SIG_PARSE_ERROR", ERR_LIB_ASN1, ASN1_R_MIME_SIG_PARSE_ERROR}, ++ #else ++ {"MIME_SIG_PARSE_ERROR", 13, 208}, ++ #endif ++ #ifdef ASN1_R_MISSING_EOC ++ {"MISSING_EOC", ERR_LIB_ASN1, ASN1_R_MISSING_EOC}, ++ #else ++ {"MISSING_EOC", 13, 137}, ++ #endif ++ #ifdef ASN1_R_MISSING_SECOND_NUMBER ++ {"MISSING_SECOND_NUMBER", ERR_LIB_ASN1, ASN1_R_MISSING_SECOND_NUMBER}, ++ #else ++ {"MISSING_SECOND_NUMBER", 13, 138}, ++ #endif ++ #ifdef ASN1_R_MISSING_VALUE ++ {"MISSING_VALUE", ERR_LIB_ASN1, ASN1_R_MISSING_VALUE}, ++ #else ++ {"MISSING_VALUE", 13, 189}, ++ #endif ++ #ifdef ASN1_R_MSTRING_NOT_UNIVERSAL ++ {"MSTRING_NOT_UNIVERSAL", ERR_LIB_ASN1, ASN1_R_MSTRING_NOT_UNIVERSAL}, ++ #else ++ {"MSTRING_NOT_UNIVERSAL", 13, 139}, ++ #endif ++ #ifdef ASN1_R_MSTRING_WRONG_TAG ++ {"MSTRING_WRONG_TAG", ERR_LIB_ASN1, ASN1_R_MSTRING_WRONG_TAG}, ++ #else ++ {"MSTRING_WRONG_TAG", 13, 140}, ++ #endif ++ #ifdef ASN1_R_NESTED_ASN1_STRING ++ {"NESTED_ASN1_STRING", ERR_LIB_ASN1, ASN1_R_NESTED_ASN1_STRING}, ++ #else ++ {"NESTED_ASN1_STRING", 13, 197}, ++ #endif ++ #ifdef ASN1_R_NESTED_TOO_DEEP ++ {"NESTED_TOO_DEEP", ERR_LIB_ASN1, ASN1_R_NESTED_TOO_DEEP}, ++ #else ++ {"NESTED_TOO_DEEP", 13, 201}, ++ #endif ++ #ifdef ASN1_R_NON_HEX_CHARACTERS ++ {"NON_HEX_CHARACTERS", ERR_LIB_ASN1, ASN1_R_NON_HEX_CHARACTERS}, ++ #else ++ {"NON_HEX_CHARACTERS", 13, 141}, ++ #endif ++ #ifdef ASN1_R_NOT_ASCII_FORMAT ++ {"NOT_ASCII_FORMAT", ERR_LIB_ASN1, ASN1_R_NOT_ASCII_FORMAT}, ++ #else ++ {"NOT_ASCII_FORMAT", 13, 190}, ++ #endif ++ #ifdef ASN1_R_NOT_ENOUGH_DATA ++ {"NOT_ENOUGH_DATA", ERR_LIB_ASN1, ASN1_R_NOT_ENOUGH_DATA}, ++ #else ++ {"NOT_ENOUGH_DATA", 13, 142}, ++ #endif ++ #ifdef ASN1_R_NO_CONTENT_TYPE ++ {"NO_CONTENT_TYPE", ERR_LIB_ASN1, ASN1_R_NO_CONTENT_TYPE}, ++ #else ++ {"NO_CONTENT_TYPE", 13, 209}, ++ #endif ++ #ifdef ASN1_R_NO_MATCHING_CHOICE_TYPE ++ {"NO_MATCHING_CHOICE_TYPE", ERR_LIB_ASN1, ASN1_R_NO_MATCHING_CHOICE_TYPE}, ++ #else ++ {"NO_MATCHING_CHOICE_TYPE", 13, 143}, ++ #endif ++ #ifdef ASN1_R_NO_MULTIPART_BODY_FAILURE ++ {"NO_MULTIPART_BODY_FAILURE", ERR_LIB_ASN1, ASN1_R_NO_MULTIPART_BODY_FAILURE}, ++ #else ++ {"NO_MULTIPART_BODY_FAILURE", 13, 210}, ++ #endif ++ #ifdef ASN1_R_NO_MULTIPART_BOUNDARY ++ {"NO_MULTIPART_BOUNDARY", ERR_LIB_ASN1, ASN1_R_NO_MULTIPART_BOUNDARY}, ++ #else ++ {"NO_MULTIPART_BOUNDARY", 13, 211}, ++ #endif ++ #ifdef ASN1_R_NO_SIG_CONTENT_TYPE ++ {"NO_SIG_CONTENT_TYPE", ERR_LIB_ASN1, ASN1_R_NO_SIG_CONTENT_TYPE}, ++ #else ++ {"NO_SIG_CONTENT_TYPE", 13, 212}, ++ #endif ++ #ifdef ASN1_R_NULL_IS_WRONG_LENGTH ++ {"NULL_IS_WRONG_LENGTH", ERR_LIB_ASN1, ASN1_R_NULL_IS_WRONG_LENGTH}, ++ #else ++ {"NULL_IS_WRONG_LENGTH", 13, 144}, ++ #endif ++ #ifdef ASN1_R_OBJECT_NOT_ASCII_FORMAT ++ {"OBJECT_NOT_ASCII_FORMAT", ERR_LIB_ASN1, ASN1_R_OBJECT_NOT_ASCII_FORMAT}, ++ #else ++ {"OBJECT_NOT_ASCII_FORMAT", 13, 191}, ++ #endif ++ #ifdef ASN1_R_ODD_NUMBER_OF_CHARS ++ {"ODD_NUMBER_OF_CHARS", ERR_LIB_ASN1, ASN1_R_ODD_NUMBER_OF_CHARS}, ++ #else ++ {"ODD_NUMBER_OF_CHARS", 13, 145}, ++ #endif ++ #ifdef ASN1_R_SECOND_NUMBER_TOO_LARGE ++ {"SECOND_NUMBER_TOO_LARGE", ERR_LIB_ASN1, ASN1_R_SECOND_NUMBER_TOO_LARGE}, ++ #else ++ {"SECOND_NUMBER_TOO_LARGE", 13, 147}, ++ #endif ++ #ifdef ASN1_R_SEQUENCE_LENGTH_MISMATCH ++ {"SEQUENCE_LENGTH_MISMATCH", ERR_LIB_ASN1, ASN1_R_SEQUENCE_LENGTH_MISMATCH}, ++ #else ++ {"SEQUENCE_LENGTH_MISMATCH", 13, 148}, ++ #endif ++ #ifdef ASN1_R_SEQUENCE_NOT_CONSTRUCTED ++ {"SEQUENCE_NOT_CONSTRUCTED", ERR_LIB_ASN1, ASN1_R_SEQUENCE_NOT_CONSTRUCTED}, ++ #else ++ {"SEQUENCE_NOT_CONSTRUCTED", 13, 149}, ++ #endif ++ #ifdef ASN1_R_SEQUENCE_OR_SET_NEEDS_CONFIG ++ {"SEQUENCE_OR_SET_NEEDS_CONFIG", ERR_LIB_ASN1, ASN1_R_SEQUENCE_OR_SET_NEEDS_CONFIG}, ++ #else ++ {"SEQUENCE_OR_SET_NEEDS_CONFIG", 13, 192}, ++ #endif ++ #ifdef ASN1_R_SHORT_LINE ++ {"SHORT_LINE", ERR_LIB_ASN1, ASN1_R_SHORT_LINE}, ++ #else ++ {"SHORT_LINE", 13, 150}, ++ #endif ++ #ifdef ASN1_R_SIG_INVALID_MIME_TYPE ++ {"SIG_INVALID_MIME_TYPE", ERR_LIB_ASN1, ASN1_R_SIG_INVALID_MIME_TYPE}, ++ #else ++ {"SIG_INVALID_MIME_TYPE", 13, 213}, ++ #endif ++ #ifdef ASN1_R_STREAMING_NOT_SUPPORTED ++ {"STREAMING_NOT_SUPPORTED", ERR_LIB_ASN1, ASN1_R_STREAMING_NOT_SUPPORTED}, ++ #else ++ {"STREAMING_NOT_SUPPORTED", 13, 202}, ++ #endif ++ #ifdef ASN1_R_STRING_TOO_LONG ++ {"STRING_TOO_LONG", ERR_LIB_ASN1, ASN1_R_STRING_TOO_LONG}, ++ #else ++ {"STRING_TOO_LONG", 13, 151}, ++ #endif ++ #ifdef ASN1_R_STRING_TOO_SHORT ++ {"STRING_TOO_SHORT", ERR_LIB_ASN1, ASN1_R_STRING_TOO_SHORT}, ++ #else ++ {"STRING_TOO_SHORT", 13, 152}, ++ #endif ++ #ifdef ASN1_R_THE_ASN1_OBJECT_IDENTIFIER_IS_NOT_KNOWN_FOR_THIS_MD ++ {"THE_ASN1_OBJECT_IDENTIFIER_IS_NOT_KNOWN_FOR_THIS_MD", ERR_LIB_ASN1, ASN1_R_THE_ASN1_OBJECT_IDENTIFIER_IS_NOT_KNOWN_FOR_THIS_MD}, ++ #else ++ {"THE_ASN1_OBJECT_IDENTIFIER_IS_NOT_KNOWN_FOR_THIS_MD", 13, 154}, ++ #endif ++ #ifdef ASN1_R_TIME_NOT_ASCII_FORMAT ++ {"TIME_NOT_ASCII_FORMAT", ERR_LIB_ASN1, ASN1_R_TIME_NOT_ASCII_FORMAT}, ++ #else ++ {"TIME_NOT_ASCII_FORMAT", 13, 193}, ++ #endif ++ #ifdef ASN1_R_TOO_LARGE ++ {"TOO_LARGE", ERR_LIB_ASN1, ASN1_R_TOO_LARGE}, ++ #else ++ {"TOO_LARGE", 13, 223}, ++ #endif ++ #ifdef ASN1_R_TOO_LONG ++ {"TOO_LONG", ERR_LIB_ASN1, ASN1_R_TOO_LONG}, ++ #else ++ {"TOO_LONG", 13, 155}, ++ #endif ++ #ifdef ASN1_R_TOO_SMALL ++ {"TOO_SMALL", ERR_LIB_ASN1, ASN1_R_TOO_SMALL}, ++ #else ++ {"TOO_SMALL", 13, 224}, ++ #endif ++ #ifdef ASN1_R_TYPE_NOT_CONSTRUCTED ++ {"TYPE_NOT_CONSTRUCTED", ERR_LIB_ASN1, ASN1_R_TYPE_NOT_CONSTRUCTED}, ++ #else ++ {"TYPE_NOT_CONSTRUCTED", 13, 156}, ++ #endif ++ #ifdef ASN1_R_TYPE_NOT_PRIMITIVE ++ {"TYPE_NOT_PRIMITIVE", ERR_LIB_ASN1, ASN1_R_TYPE_NOT_PRIMITIVE}, ++ #else ++ {"TYPE_NOT_PRIMITIVE", 13, 195}, ++ #endif ++ #ifdef ASN1_R_UNEXPECTED_EOC ++ {"UNEXPECTED_EOC", ERR_LIB_ASN1, ASN1_R_UNEXPECTED_EOC}, ++ #else ++ {"UNEXPECTED_EOC", 13, 159}, ++ #endif ++ #ifdef ASN1_R_UNIVERSALSTRING_IS_WRONG_LENGTH ++ {"UNIVERSALSTRING_IS_WRONG_LENGTH", ERR_LIB_ASN1, ASN1_R_UNIVERSALSTRING_IS_WRONG_LENGTH}, ++ #else ++ {"UNIVERSALSTRING_IS_WRONG_LENGTH", 13, 215}, ++ #endif ++ #ifdef ASN1_R_UNKNOWN_FORMAT ++ {"UNKNOWN_FORMAT", ERR_LIB_ASN1, ASN1_R_UNKNOWN_FORMAT}, ++ #else ++ {"UNKNOWN_FORMAT", 13, 160}, ++ #endif ++ #ifdef ASN1_R_UNKNOWN_MESSAGE_DIGEST_ALGORITHM ++ {"UNKNOWN_MESSAGE_DIGEST_ALGORITHM", ERR_LIB_ASN1, ASN1_R_UNKNOWN_MESSAGE_DIGEST_ALGORITHM}, ++ #else ++ {"UNKNOWN_MESSAGE_DIGEST_ALGORITHM", 13, 161}, ++ #endif ++ #ifdef ASN1_R_UNKNOWN_OBJECT_TYPE ++ {"UNKNOWN_OBJECT_TYPE", ERR_LIB_ASN1, ASN1_R_UNKNOWN_OBJECT_TYPE}, ++ #else ++ {"UNKNOWN_OBJECT_TYPE", 13, 162}, ++ #endif ++ #ifdef ASN1_R_UNKNOWN_PUBLIC_KEY_TYPE ++ {"UNKNOWN_PUBLIC_KEY_TYPE", ERR_LIB_ASN1, ASN1_R_UNKNOWN_PUBLIC_KEY_TYPE}, ++ #else ++ {"UNKNOWN_PUBLIC_KEY_TYPE", 13, 163}, ++ #endif ++ #ifdef ASN1_R_UNKNOWN_SIGNATURE_ALGORITHM ++ {"UNKNOWN_SIGNATURE_ALGORITHM", ERR_LIB_ASN1, ASN1_R_UNKNOWN_SIGNATURE_ALGORITHM}, ++ #else ++ {"UNKNOWN_SIGNATURE_ALGORITHM", 13, 199}, ++ #endif ++ #ifdef ASN1_R_UNKNOWN_TAG ++ {"UNKNOWN_TAG", ERR_LIB_ASN1, ASN1_R_UNKNOWN_TAG}, ++ #else ++ {"UNKNOWN_TAG", 13, 194}, ++ #endif ++ #ifdef ASN1_R_UNSUPPORTED_ANY_DEFINED_BY_TYPE ++ {"UNSUPPORTED_ANY_DEFINED_BY_TYPE", ERR_LIB_ASN1, ASN1_R_UNSUPPORTED_ANY_DEFINED_BY_TYPE}, ++ #else ++ {"UNSUPPORTED_ANY_DEFINED_BY_TYPE", 13, 164}, ++ #endif ++ #ifdef ASN1_R_UNSUPPORTED_CIPHER ++ {"UNSUPPORTED_CIPHER", ERR_LIB_ASN1, ASN1_R_UNSUPPORTED_CIPHER}, ++ #else ++ {"UNSUPPORTED_CIPHER", 13, 228}, ++ #endif ++ #ifdef ASN1_R_UNSUPPORTED_PUBLIC_KEY_TYPE ++ {"UNSUPPORTED_PUBLIC_KEY_TYPE", ERR_LIB_ASN1, ASN1_R_UNSUPPORTED_PUBLIC_KEY_TYPE}, ++ #else ++ {"UNSUPPORTED_PUBLIC_KEY_TYPE", 13, 167}, ++ #endif ++ #ifdef ASN1_R_UNSUPPORTED_TYPE ++ {"UNSUPPORTED_TYPE", ERR_LIB_ASN1, ASN1_R_UNSUPPORTED_TYPE}, ++ #else ++ {"UNSUPPORTED_TYPE", 13, 196}, ++ #endif ++ #ifdef ASN1_R_WRONG_INTEGER_TYPE ++ {"WRONG_INTEGER_TYPE", ERR_LIB_ASN1, ASN1_R_WRONG_INTEGER_TYPE}, ++ #else ++ {"WRONG_INTEGER_TYPE", 13, 225}, ++ #endif ++ #ifdef ASN1_R_WRONG_PUBLIC_KEY_TYPE ++ {"WRONG_PUBLIC_KEY_TYPE", ERR_LIB_ASN1, ASN1_R_WRONG_PUBLIC_KEY_TYPE}, ++ #else ++ {"WRONG_PUBLIC_KEY_TYPE", 13, 200}, ++ #endif ++ #ifdef ASN1_R_WRONG_TAG ++ {"WRONG_TAG", ERR_LIB_ASN1, ASN1_R_WRONG_TAG}, ++ #else ++ {"WRONG_TAG", 13, 168}, ++ #endif ++ #ifdef ASYNC_R_FAILED_TO_SET_POOL ++ {"FAILED_TO_SET_POOL", ERR_LIB_ASYNC, ASYNC_R_FAILED_TO_SET_POOL}, ++ #else ++ {"FAILED_TO_SET_POOL", 51, 101}, ++ #endif ++ #ifdef ASYNC_R_FAILED_TO_SWAP_CONTEXT ++ {"FAILED_TO_SWAP_CONTEXT", ERR_LIB_ASYNC, ASYNC_R_FAILED_TO_SWAP_CONTEXT}, ++ #else ++ {"FAILED_TO_SWAP_CONTEXT", 51, 102}, ++ #endif ++ #ifdef ASYNC_R_INIT_FAILED ++ {"INIT_FAILED", ERR_LIB_ASYNC, ASYNC_R_INIT_FAILED}, ++ #else ++ {"INIT_FAILED", 51, 105}, ++ #endif ++ #ifdef ASYNC_R_INVALID_POOL_SIZE ++ {"INVALID_POOL_SIZE", ERR_LIB_ASYNC, ASYNC_R_INVALID_POOL_SIZE}, ++ #else ++ {"INVALID_POOL_SIZE", 51, 103}, ++ #endif ++ #ifdef BIO_R_ACCEPT_ERROR ++ {"ACCEPT_ERROR", ERR_LIB_BIO, BIO_R_ACCEPT_ERROR}, ++ #else ++ {"ACCEPT_ERROR", 32, 100}, ++ #endif ++ #ifdef BIO_R_ADDRINFO_ADDR_IS_NOT_AF_INET ++ {"ADDRINFO_ADDR_IS_NOT_AF_INET", ERR_LIB_BIO, BIO_R_ADDRINFO_ADDR_IS_NOT_AF_INET}, ++ #else ++ {"ADDRINFO_ADDR_IS_NOT_AF_INET", 32, 141}, ++ #endif ++ #ifdef BIO_R_AMBIGUOUS_HOST_OR_SERVICE ++ {"AMBIGUOUS_HOST_OR_SERVICE", ERR_LIB_BIO, BIO_R_AMBIGUOUS_HOST_OR_SERVICE}, ++ #else ++ {"AMBIGUOUS_HOST_OR_SERVICE", 32, 129}, ++ #endif ++ #ifdef BIO_R_BAD_FOPEN_MODE ++ {"BAD_FOPEN_MODE", ERR_LIB_BIO, BIO_R_BAD_FOPEN_MODE}, ++ #else ++ {"BAD_FOPEN_MODE", 32, 101}, ++ #endif ++ #ifdef BIO_R_BROKEN_PIPE ++ {"BROKEN_PIPE", ERR_LIB_BIO, BIO_R_BROKEN_PIPE}, ++ #else ++ {"BROKEN_PIPE", 32, 124}, ++ #endif ++ #ifdef BIO_R_CONNECT_ERROR ++ {"CONNECT_ERROR", ERR_LIB_BIO, BIO_R_CONNECT_ERROR}, ++ #else ++ {"CONNECT_ERROR", 32, 103}, ++ #endif ++ #ifdef BIO_R_GETHOSTBYNAME_ADDR_IS_NOT_AF_INET ++ {"GETHOSTBYNAME_ADDR_IS_NOT_AF_INET", ERR_LIB_BIO, BIO_R_GETHOSTBYNAME_ADDR_IS_NOT_AF_INET}, ++ #else ++ {"GETHOSTBYNAME_ADDR_IS_NOT_AF_INET", 32, 107}, ++ #endif ++ #ifdef BIO_R_GETSOCKNAME_ERROR ++ {"GETSOCKNAME_ERROR", ERR_LIB_BIO, BIO_R_GETSOCKNAME_ERROR}, ++ #else ++ {"GETSOCKNAME_ERROR", 32, 132}, ++ #endif ++ #ifdef BIO_R_GETSOCKNAME_TRUNCATED_ADDRESS ++ {"GETSOCKNAME_TRUNCATED_ADDRESS", ERR_LIB_BIO, BIO_R_GETSOCKNAME_TRUNCATED_ADDRESS}, ++ #else ++ {"GETSOCKNAME_TRUNCATED_ADDRESS", 32, 133}, ++ #endif ++ #ifdef BIO_R_GETTING_SOCKTYPE ++ {"GETTING_SOCKTYPE", ERR_LIB_BIO, BIO_R_GETTING_SOCKTYPE}, ++ #else ++ {"GETTING_SOCKTYPE", 32, 134}, ++ #endif ++ #ifdef BIO_R_INVALID_ARGUMENT ++ {"INVALID_ARGUMENT", ERR_LIB_BIO, BIO_R_INVALID_ARGUMENT}, ++ #else ++ {"INVALID_ARGUMENT", 32, 125}, ++ #endif ++ #ifdef BIO_R_INVALID_SOCKET ++ {"INVALID_SOCKET", ERR_LIB_BIO, BIO_R_INVALID_SOCKET}, ++ #else ++ {"INVALID_SOCKET", 32, 135}, ++ #endif ++ #ifdef BIO_R_IN_USE ++ {"IN_USE", ERR_LIB_BIO, BIO_R_IN_USE}, ++ #else ++ {"IN_USE", 32, 123}, ++ #endif ++ #ifdef BIO_R_LENGTH_TOO_LONG ++ {"LENGTH_TOO_LONG", ERR_LIB_BIO, BIO_R_LENGTH_TOO_LONG}, ++ #else ++ {"LENGTH_TOO_LONG", 32, 102}, ++ #endif ++ #ifdef BIO_R_LISTEN_V6_ONLY ++ {"LISTEN_V6_ONLY", ERR_LIB_BIO, BIO_R_LISTEN_V6_ONLY}, ++ #else ++ {"LISTEN_V6_ONLY", 32, 136}, ++ #endif ++ #ifdef BIO_R_LOOKUP_RETURNED_NOTHING ++ {"LOOKUP_RETURNED_NOTHING", ERR_LIB_BIO, BIO_R_LOOKUP_RETURNED_NOTHING}, ++ #else ++ {"LOOKUP_RETURNED_NOTHING", 32, 142}, ++ #endif ++ #ifdef BIO_R_MALFORMED_HOST_OR_SERVICE ++ {"MALFORMED_HOST_OR_SERVICE", ERR_LIB_BIO, BIO_R_MALFORMED_HOST_OR_SERVICE}, ++ #else ++ {"MALFORMED_HOST_OR_SERVICE", 32, 130}, ++ #endif ++ #ifdef BIO_R_NBIO_CONNECT_ERROR ++ {"NBIO_CONNECT_ERROR", ERR_LIB_BIO, BIO_R_NBIO_CONNECT_ERROR}, ++ #else ++ {"NBIO_CONNECT_ERROR", 32, 110}, ++ #endif ++ #ifdef BIO_R_NO_ACCEPT_ADDR_OR_SERVICE_SPECIFIED ++ {"NO_ACCEPT_ADDR_OR_SERVICE_SPECIFIED", ERR_LIB_BIO, BIO_R_NO_ACCEPT_ADDR_OR_SERVICE_SPECIFIED}, ++ #else ++ {"NO_ACCEPT_ADDR_OR_SERVICE_SPECIFIED", 32, 143}, ++ #endif ++ #ifdef BIO_R_NO_HOSTNAME_OR_SERVICE_SPECIFIED ++ {"NO_HOSTNAME_OR_SERVICE_SPECIFIED", ERR_LIB_BIO, BIO_R_NO_HOSTNAME_OR_SERVICE_SPECIFIED}, ++ #else ++ {"NO_HOSTNAME_OR_SERVICE_SPECIFIED", 32, 144}, ++ #endif ++ #ifdef BIO_R_NO_PORT_DEFINED ++ {"NO_PORT_DEFINED", ERR_LIB_BIO, BIO_R_NO_PORT_DEFINED}, ++ #else ++ {"NO_PORT_DEFINED", 32, 113}, ++ #endif ++ #ifdef BIO_R_NO_SUCH_FILE ++ {"NO_SUCH_FILE", ERR_LIB_BIO, BIO_R_NO_SUCH_FILE}, ++ #else ++ {"NO_SUCH_FILE", 32, 128}, ++ #endif ++ #ifdef BIO_R_NULL_PARAMETER ++ {"NULL_PARAMETER", ERR_LIB_BIO, BIO_R_NULL_PARAMETER}, ++ #else ++ {"NULL_PARAMETER", 32, 115}, ++ #endif ++ #ifdef BIO_R_UNABLE_TO_BIND_SOCKET ++ {"UNABLE_TO_BIND_SOCKET", ERR_LIB_BIO, BIO_R_UNABLE_TO_BIND_SOCKET}, ++ #else ++ {"UNABLE_TO_BIND_SOCKET", 32, 117}, ++ #endif ++ #ifdef BIO_R_UNABLE_TO_CREATE_SOCKET ++ {"UNABLE_TO_CREATE_SOCKET", ERR_LIB_BIO, BIO_R_UNABLE_TO_CREATE_SOCKET}, ++ #else ++ {"UNABLE_TO_CREATE_SOCKET", 32, 118}, ++ #endif ++ #ifdef BIO_R_UNABLE_TO_KEEPALIVE ++ {"UNABLE_TO_KEEPALIVE", ERR_LIB_BIO, BIO_R_UNABLE_TO_KEEPALIVE}, ++ #else ++ {"UNABLE_TO_KEEPALIVE", 32, 137}, ++ #endif ++ #ifdef BIO_R_UNABLE_TO_LISTEN_SOCKET ++ {"UNABLE_TO_LISTEN_SOCKET", ERR_LIB_BIO, BIO_R_UNABLE_TO_LISTEN_SOCKET}, ++ #else ++ {"UNABLE_TO_LISTEN_SOCKET", 32, 119}, ++ #endif ++ #ifdef BIO_R_UNABLE_TO_NODELAY ++ {"UNABLE_TO_NODELAY", ERR_LIB_BIO, BIO_R_UNABLE_TO_NODELAY}, ++ #else ++ {"UNABLE_TO_NODELAY", 32, 138}, ++ #endif ++ #ifdef BIO_R_UNABLE_TO_REUSEADDR ++ {"UNABLE_TO_REUSEADDR", ERR_LIB_BIO, BIO_R_UNABLE_TO_REUSEADDR}, ++ #else ++ {"UNABLE_TO_REUSEADDR", 32, 139}, ++ #endif ++ #ifdef BIO_R_UNAVAILABLE_IP_FAMILY ++ {"UNAVAILABLE_IP_FAMILY", ERR_LIB_BIO, BIO_R_UNAVAILABLE_IP_FAMILY}, ++ #else ++ {"UNAVAILABLE_IP_FAMILY", 32, 145}, ++ #endif ++ #ifdef BIO_R_UNINITIALIZED ++ {"UNINITIALIZED", ERR_LIB_BIO, BIO_R_UNINITIALIZED}, ++ #else ++ {"UNINITIALIZED", 32, 120}, ++ #endif ++ #ifdef BIO_R_UNKNOWN_INFO_TYPE ++ {"UNKNOWN_INFO_TYPE", ERR_LIB_BIO, BIO_R_UNKNOWN_INFO_TYPE}, ++ #else ++ {"UNKNOWN_INFO_TYPE", 32, 140}, ++ #endif ++ #ifdef BIO_R_UNSUPPORTED_IP_FAMILY ++ {"UNSUPPORTED_IP_FAMILY", ERR_LIB_BIO, BIO_R_UNSUPPORTED_IP_FAMILY}, ++ #else ++ {"UNSUPPORTED_IP_FAMILY", 32, 146}, ++ #endif ++ #ifdef BIO_R_UNSUPPORTED_METHOD ++ {"UNSUPPORTED_METHOD", ERR_LIB_BIO, BIO_R_UNSUPPORTED_METHOD}, ++ #else ++ {"UNSUPPORTED_METHOD", 32, 121}, ++ #endif ++ #ifdef BIO_R_UNSUPPORTED_PROTOCOL_FAMILY ++ {"UNSUPPORTED_PROTOCOL_FAMILY", ERR_LIB_BIO, BIO_R_UNSUPPORTED_PROTOCOL_FAMILY}, ++ #else ++ {"UNSUPPORTED_PROTOCOL_FAMILY", 32, 131}, ++ #endif ++ #ifdef BIO_R_WRITE_TO_READ_ONLY_BIO ++ {"WRITE_TO_READ_ONLY_BIO", ERR_LIB_BIO, BIO_R_WRITE_TO_READ_ONLY_BIO}, ++ #else ++ {"WRITE_TO_READ_ONLY_BIO", 32, 126}, ++ #endif ++ #ifdef BIO_R_WSASTARTUP ++ {"WSASTARTUP", ERR_LIB_BIO, BIO_R_WSASTARTUP}, ++ #else ++ {"WSASTARTUP", 32, 122}, ++ #endif ++ #ifdef BN_R_ARG2_LT_ARG3 ++ {"ARG2_LT_ARG3", ERR_LIB_BN, BN_R_ARG2_LT_ARG3}, ++ #else ++ {"ARG2_LT_ARG3", 3, 100}, ++ #endif ++ #ifdef BN_R_BAD_RECIPROCAL ++ {"BAD_RECIPROCAL", ERR_LIB_BN, BN_R_BAD_RECIPROCAL}, ++ #else ++ {"BAD_RECIPROCAL", 3, 101}, ++ #endif ++ #ifdef BN_R_BIGNUM_TOO_LONG ++ {"BIGNUM_TOO_LONG", ERR_LIB_BN, BN_R_BIGNUM_TOO_LONG}, ++ #else ++ {"BIGNUM_TOO_LONG", 3, 114}, ++ #endif ++ #ifdef BN_R_BITS_TOO_SMALL ++ {"BITS_TOO_SMALL", ERR_LIB_BN, BN_R_BITS_TOO_SMALL}, ++ #else ++ {"BITS_TOO_SMALL", 3, 118}, ++ #endif ++ #ifdef BN_R_CALLED_WITH_EVEN_MODULUS ++ {"CALLED_WITH_EVEN_MODULUS", ERR_LIB_BN, BN_R_CALLED_WITH_EVEN_MODULUS}, ++ #else ++ {"CALLED_WITH_EVEN_MODULUS", 3, 102}, ++ #endif ++ #ifdef BN_R_DIV_BY_ZERO ++ {"DIV_BY_ZERO", ERR_LIB_BN, BN_R_DIV_BY_ZERO}, ++ #else ++ {"DIV_BY_ZERO", 3, 103}, ++ #endif ++ #ifdef BN_R_ENCODING_ERROR ++ {"ENCODING_ERROR", ERR_LIB_BN, BN_R_ENCODING_ERROR}, ++ #else ++ {"ENCODING_ERROR", 3, 104}, ++ #endif ++ #ifdef BN_R_EXPAND_ON_STATIC_BIGNUM_DATA ++ {"EXPAND_ON_STATIC_BIGNUM_DATA", ERR_LIB_BN, BN_R_EXPAND_ON_STATIC_BIGNUM_DATA}, ++ #else ++ {"EXPAND_ON_STATIC_BIGNUM_DATA", 3, 105}, ++ #endif ++ #ifdef BN_R_INPUT_NOT_REDUCED ++ {"INPUT_NOT_REDUCED", ERR_LIB_BN, BN_R_INPUT_NOT_REDUCED}, ++ #else ++ {"INPUT_NOT_REDUCED", 3, 110}, ++ #endif ++ #ifdef BN_R_INVALID_LENGTH ++ {"INVALID_LENGTH", ERR_LIB_BN, BN_R_INVALID_LENGTH}, ++ #else ++ {"INVALID_LENGTH", 3, 106}, ++ #endif ++ #ifdef BN_R_INVALID_RANGE ++ {"INVALID_RANGE", ERR_LIB_BN, BN_R_INVALID_RANGE}, ++ #else ++ {"INVALID_RANGE", 3, 115}, ++ #endif ++ #ifdef BN_R_INVALID_SHIFT ++ {"INVALID_SHIFT", ERR_LIB_BN, BN_R_INVALID_SHIFT}, ++ #else ++ {"INVALID_SHIFT", 3, 119}, ++ #endif ++ #ifdef BN_R_NOT_A_SQUARE ++ {"NOT_A_SQUARE", ERR_LIB_BN, BN_R_NOT_A_SQUARE}, ++ #else ++ {"NOT_A_SQUARE", 3, 111}, ++ #endif ++ #ifdef BN_R_NOT_INITIALIZED ++ {"NOT_INITIALIZED", ERR_LIB_BN, BN_R_NOT_INITIALIZED}, ++ #else ++ {"NOT_INITIALIZED", 3, 107}, ++ #endif ++ #ifdef BN_R_NO_INVERSE ++ {"NO_INVERSE", ERR_LIB_BN, BN_R_NO_INVERSE}, ++ #else ++ {"NO_INVERSE", 3, 108}, ++ #endif ++ #ifdef BN_R_NO_SOLUTION ++ {"NO_SOLUTION", ERR_LIB_BN, BN_R_NO_SOLUTION}, ++ #else ++ {"NO_SOLUTION", 3, 116}, ++ #endif ++ #ifdef BN_R_PRIVATE_KEY_TOO_LARGE ++ {"PRIVATE_KEY_TOO_LARGE", ERR_LIB_BN, BN_R_PRIVATE_KEY_TOO_LARGE}, ++ #else ++ {"PRIVATE_KEY_TOO_LARGE", 3, 117}, ++ #endif ++ #ifdef BN_R_P_IS_NOT_PRIME ++ {"P_IS_NOT_PRIME", ERR_LIB_BN, BN_R_P_IS_NOT_PRIME}, ++ #else ++ {"P_IS_NOT_PRIME", 3, 112}, ++ #endif ++ #ifdef BN_R_TOO_MANY_ITERATIONS ++ {"TOO_MANY_ITERATIONS", ERR_LIB_BN, BN_R_TOO_MANY_ITERATIONS}, ++ #else ++ {"TOO_MANY_ITERATIONS", 3, 113}, ++ #endif ++ #ifdef BN_R_TOO_MANY_TEMPORARY_VARIABLES ++ {"TOO_MANY_TEMPORARY_VARIABLES", ERR_LIB_BN, BN_R_TOO_MANY_TEMPORARY_VARIABLES}, ++ #else ++ {"TOO_MANY_TEMPORARY_VARIABLES", 3, 109}, ++ #endif ++ #ifdef CMS_R_ADD_SIGNER_ERROR ++ {"ADD_SIGNER_ERROR", ERR_LIB_CMS, CMS_R_ADD_SIGNER_ERROR}, ++ #else ++ {"ADD_SIGNER_ERROR", 46, 99}, ++ #endif ++ #ifdef CMS_R_ATTRIBUTE_ERROR ++ {"ATTRIBUTE_ERROR", ERR_LIB_CMS, CMS_R_ATTRIBUTE_ERROR}, ++ #else ++ {"ATTRIBUTE_ERROR", 46, 161}, ++ #endif ++ #ifdef CMS_R_CERTIFICATE_ALREADY_PRESENT ++ {"CERTIFICATE_ALREADY_PRESENT", ERR_LIB_CMS, CMS_R_CERTIFICATE_ALREADY_PRESENT}, ++ #else ++ {"CERTIFICATE_ALREADY_PRESENT", 46, 175}, ++ #endif ++ #ifdef CMS_R_CERTIFICATE_HAS_NO_KEYID ++ {"CERTIFICATE_HAS_NO_KEYID", ERR_LIB_CMS, CMS_R_CERTIFICATE_HAS_NO_KEYID}, ++ #else ++ {"CERTIFICATE_HAS_NO_KEYID", 46, 160}, ++ #endif ++ #ifdef CMS_R_CERTIFICATE_VERIFY_ERROR ++ {"CERTIFICATE_VERIFY_ERROR", ERR_LIB_CMS, CMS_R_CERTIFICATE_VERIFY_ERROR}, ++ #else ++ {"CERTIFICATE_VERIFY_ERROR", 46, 100}, ++ #endif ++ #ifdef CMS_R_CIPHER_INITIALISATION_ERROR ++ {"CIPHER_INITIALISATION_ERROR", ERR_LIB_CMS, CMS_R_CIPHER_INITIALISATION_ERROR}, ++ #else ++ {"CIPHER_INITIALISATION_ERROR", 46, 101}, ++ #endif ++ #ifdef CMS_R_CIPHER_PARAMETER_INITIALISATION_ERROR ++ {"CIPHER_PARAMETER_INITIALISATION_ERROR", ERR_LIB_CMS, CMS_R_CIPHER_PARAMETER_INITIALISATION_ERROR}, ++ #else ++ {"CIPHER_PARAMETER_INITIALISATION_ERROR", 46, 102}, ++ #endif ++ #ifdef CMS_R_CMS_DATAFINAL_ERROR ++ {"CMS_DATAFINAL_ERROR", ERR_LIB_CMS, CMS_R_CMS_DATAFINAL_ERROR}, ++ #else ++ {"CMS_DATAFINAL_ERROR", 46, 103}, ++ #endif ++ #ifdef CMS_R_CMS_LIB ++ {"CMS_LIB", ERR_LIB_CMS, CMS_R_CMS_LIB}, ++ #else ++ {"CMS_LIB", 46, 104}, ++ #endif ++ #ifdef CMS_R_CONTENTIDENTIFIER_MISMATCH ++ {"CONTENTIDENTIFIER_MISMATCH", ERR_LIB_CMS, CMS_R_CONTENTIDENTIFIER_MISMATCH}, ++ #else ++ {"CONTENTIDENTIFIER_MISMATCH", 46, 170}, ++ #endif ++ #ifdef CMS_R_CONTENT_NOT_FOUND ++ {"CONTENT_NOT_FOUND", ERR_LIB_CMS, CMS_R_CONTENT_NOT_FOUND}, ++ #else ++ {"CONTENT_NOT_FOUND", 46, 105}, ++ #endif ++ #ifdef CMS_R_CONTENT_TYPE_MISMATCH ++ {"CONTENT_TYPE_MISMATCH", ERR_LIB_CMS, CMS_R_CONTENT_TYPE_MISMATCH}, ++ #else ++ {"CONTENT_TYPE_MISMATCH", 46, 171}, ++ #endif ++ #ifdef CMS_R_CONTENT_TYPE_NOT_COMPRESSED_DATA ++ {"CONTENT_TYPE_NOT_COMPRESSED_DATA", ERR_LIB_CMS, CMS_R_CONTENT_TYPE_NOT_COMPRESSED_DATA}, ++ #else ++ {"CONTENT_TYPE_NOT_COMPRESSED_DATA", 46, 106}, ++ #endif ++ #ifdef CMS_R_CONTENT_TYPE_NOT_ENVELOPED_DATA ++ {"CONTENT_TYPE_NOT_ENVELOPED_DATA", ERR_LIB_CMS, CMS_R_CONTENT_TYPE_NOT_ENVELOPED_DATA}, ++ #else ++ {"CONTENT_TYPE_NOT_ENVELOPED_DATA", 46, 107}, ++ #endif ++ #ifdef CMS_R_CONTENT_TYPE_NOT_SIGNED_DATA ++ {"CONTENT_TYPE_NOT_SIGNED_DATA", ERR_LIB_CMS, CMS_R_CONTENT_TYPE_NOT_SIGNED_DATA}, ++ #else ++ {"CONTENT_TYPE_NOT_SIGNED_DATA", 46, 108}, ++ #endif ++ #ifdef CMS_R_CONTENT_VERIFY_ERROR ++ {"CONTENT_VERIFY_ERROR", ERR_LIB_CMS, CMS_R_CONTENT_VERIFY_ERROR}, ++ #else ++ {"CONTENT_VERIFY_ERROR", 46, 109}, ++ #endif ++ #ifdef CMS_R_CTRL_ERROR ++ {"CTRL_ERROR", ERR_LIB_CMS, CMS_R_CTRL_ERROR}, ++ #else ++ {"CTRL_ERROR", 46, 110}, ++ #endif ++ #ifdef CMS_R_CTRL_FAILURE ++ {"CTRL_FAILURE", ERR_LIB_CMS, CMS_R_CTRL_FAILURE}, ++ #else ++ {"CTRL_FAILURE", 46, 111}, ++ #endif ++ #ifdef CMS_R_DECRYPT_ERROR ++ {"DECRYPT_ERROR", ERR_LIB_CMS, CMS_R_DECRYPT_ERROR}, ++ #else ++ {"DECRYPT_ERROR", 46, 112}, ++ #endif ++ #ifdef CMS_R_ERROR_GETTING_PUBLIC_KEY ++ {"ERROR_GETTING_PUBLIC_KEY", ERR_LIB_CMS, CMS_R_ERROR_GETTING_PUBLIC_KEY}, ++ #else ++ {"ERROR_GETTING_PUBLIC_KEY", 46, 113}, ++ #endif ++ #ifdef CMS_R_ERROR_READING_MESSAGEDIGEST_ATTRIBUTE ++ {"ERROR_READING_MESSAGEDIGEST_ATTRIBUTE", ERR_LIB_CMS, CMS_R_ERROR_READING_MESSAGEDIGEST_ATTRIBUTE}, ++ #else ++ {"ERROR_READING_MESSAGEDIGEST_ATTRIBUTE", 46, 114}, ++ #endif ++ #ifdef CMS_R_ERROR_SETTING_KEY ++ {"ERROR_SETTING_KEY", ERR_LIB_CMS, CMS_R_ERROR_SETTING_KEY}, ++ #else ++ {"ERROR_SETTING_KEY", 46, 115}, ++ #endif ++ #ifdef CMS_R_ERROR_SETTING_RECIPIENTINFO ++ {"ERROR_SETTING_RECIPIENTINFO", ERR_LIB_CMS, CMS_R_ERROR_SETTING_RECIPIENTINFO}, ++ #else ++ {"ERROR_SETTING_RECIPIENTINFO", 46, 116}, ++ #endif ++ #ifdef CMS_R_INVALID_ENCRYPTED_KEY_LENGTH ++ {"INVALID_ENCRYPTED_KEY_LENGTH", ERR_LIB_CMS, CMS_R_INVALID_ENCRYPTED_KEY_LENGTH}, ++ #else ++ {"INVALID_ENCRYPTED_KEY_LENGTH", 46, 117}, ++ #endif ++ #ifdef CMS_R_INVALID_KEY_ENCRYPTION_PARAMETER ++ {"INVALID_KEY_ENCRYPTION_PARAMETER", ERR_LIB_CMS, CMS_R_INVALID_KEY_ENCRYPTION_PARAMETER}, ++ #else ++ {"INVALID_KEY_ENCRYPTION_PARAMETER", 46, 176}, ++ #endif ++ #ifdef CMS_R_INVALID_KEY_LENGTH ++ {"INVALID_KEY_LENGTH", ERR_LIB_CMS, CMS_R_INVALID_KEY_LENGTH}, ++ #else ++ {"INVALID_KEY_LENGTH", 46, 118}, ++ #endif ++ #ifdef CMS_R_MD_BIO_INIT_ERROR ++ {"MD_BIO_INIT_ERROR", ERR_LIB_CMS, CMS_R_MD_BIO_INIT_ERROR}, ++ #else ++ {"MD_BIO_INIT_ERROR", 46, 119}, ++ #endif ++ #ifdef CMS_R_MESSAGEDIGEST_ATTRIBUTE_WRONG_LENGTH ++ {"MESSAGEDIGEST_ATTRIBUTE_WRONG_LENGTH", ERR_LIB_CMS, CMS_R_MESSAGEDIGEST_ATTRIBUTE_WRONG_LENGTH}, ++ #else ++ {"MESSAGEDIGEST_ATTRIBUTE_WRONG_LENGTH", 46, 120}, ++ #endif ++ #ifdef CMS_R_MESSAGEDIGEST_WRONG_LENGTH ++ {"MESSAGEDIGEST_WRONG_LENGTH", ERR_LIB_CMS, CMS_R_MESSAGEDIGEST_WRONG_LENGTH}, ++ #else ++ {"MESSAGEDIGEST_WRONG_LENGTH", 46, 121}, ++ #endif ++ #ifdef CMS_R_MSGSIGDIGEST_ERROR ++ {"MSGSIGDIGEST_ERROR", ERR_LIB_CMS, CMS_R_MSGSIGDIGEST_ERROR}, ++ #else ++ {"MSGSIGDIGEST_ERROR", 46, 172}, ++ #endif ++ #ifdef CMS_R_MSGSIGDIGEST_VERIFICATION_FAILURE ++ {"MSGSIGDIGEST_VERIFICATION_FAILURE", ERR_LIB_CMS, CMS_R_MSGSIGDIGEST_VERIFICATION_FAILURE}, ++ #else ++ {"MSGSIGDIGEST_VERIFICATION_FAILURE", 46, 162}, ++ #endif ++ #ifdef CMS_R_MSGSIGDIGEST_WRONG_LENGTH ++ {"MSGSIGDIGEST_WRONG_LENGTH", ERR_LIB_CMS, CMS_R_MSGSIGDIGEST_WRONG_LENGTH}, ++ #else ++ {"MSGSIGDIGEST_WRONG_LENGTH", 46, 163}, ++ #endif ++ #ifdef CMS_R_NEED_ONE_SIGNER ++ {"NEED_ONE_SIGNER", ERR_LIB_CMS, CMS_R_NEED_ONE_SIGNER}, ++ #else ++ {"NEED_ONE_SIGNER", 46, 164}, ++ #endif ++ #ifdef CMS_R_NOT_A_SIGNED_RECEIPT ++ {"NOT_A_SIGNED_RECEIPT", ERR_LIB_CMS, CMS_R_NOT_A_SIGNED_RECEIPT}, ++ #else ++ {"NOT_A_SIGNED_RECEIPT", 46, 165}, ++ #endif ++ #ifdef CMS_R_NOT_ENCRYPTED_DATA ++ {"NOT_ENCRYPTED_DATA", ERR_LIB_CMS, CMS_R_NOT_ENCRYPTED_DATA}, ++ #else ++ {"NOT_ENCRYPTED_DATA", 46, 122}, ++ #endif ++ #ifdef CMS_R_NOT_KEK ++ {"NOT_KEK", ERR_LIB_CMS, CMS_R_NOT_KEK}, ++ #else ++ {"NOT_KEK", 46, 123}, ++ #endif ++ #ifdef CMS_R_NOT_KEY_AGREEMENT ++ {"NOT_KEY_AGREEMENT", ERR_LIB_CMS, CMS_R_NOT_KEY_AGREEMENT}, ++ #else ++ {"NOT_KEY_AGREEMENT", 46, 181}, ++ #endif ++ #ifdef CMS_R_NOT_KEY_TRANSPORT ++ {"NOT_KEY_TRANSPORT", ERR_LIB_CMS, CMS_R_NOT_KEY_TRANSPORT}, ++ #else ++ {"NOT_KEY_TRANSPORT", 46, 124}, ++ #endif ++ #ifdef CMS_R_NOT_PWRI ++ {"NOT_PWRI", ERR_LIB_CMS, CMS_R_NOT_PWRI}, ++ #else ++ {"NOT_PWRI", 46, 177}, ++ #endif ++ #ifdef CMS_R_NOT_SUPPORTED_FOR_THIS_KEY_TYPE ++ {"NOT_SUPPORTED_FOR_THIS_KEY_TYPE", ERR_LIB_CMS, CMS_R_NOT_SUPPORTED_FOR_THIS_KEY_TYPE}, ++ #else ++ {"NOT_SUPPORTED_FOR_THIS_KEY_TYPE", 46, 125}, ++ #endif ++ #ifdef CMS_R_NO_CIPHER ++ {"NO_CIPHER", ERR_LIB_CMS, CMS_R_NO_CIPHER}, ++ #else ++ {"NO_CIPHER", 46, 126}, ++ #endif ++ #ifdef CMS_R_NO_CONTENT ++ {"NO_CONTENT", ERR_LIB_CMS, CMS_R_NO_CONTENT}, ++ #else ++ {"NO_CONTENT", 46, 127}, ++ #endif ++ #ifdef CMS_R_NO_CONTENT_TYPE ++ {"NO_CONTENT_TYPE", ERR_LIB_CMS, CMS_R_NO_CONTENT_TYPE}, ++ #else ++ {"NO_CONTENT_TYPE", 46, 173}, ++ #endif ++ #ifdef CMS_R_NO_DEFAULT_DIGEST ++ {"NO_DEFAULT_DIGEST", ERR_LIB_CMS, CMS_R_NO_DEFAULT_DIGEST}, ++ #else ++ {"NO_DEFAULT_DIGEST", 46, 128}, ++ #endif ++ #ifdef CMS_R_NO_DIGEST_SET ++ {"NO_DIGEST_SET", ERR_LIB_CMS, CMS_R_NO_DIGEST_SET}, ++ #else ++ {"NO_DIGEST_SET", 46, 129}, ++ #endif ++ #ifdef CMS_R_NO_KEY ++ {"NO_KEY", ERR_LIB_CMS, CMS_R_NO_KEY}, ++ #else ++ {"NO_KEY", 46, 130}, ++ #endif ++ #ifdef CMS_R_NO_KEY_OR_CERT ++ {"NO_KEY_OR_CERT", ERR_LIB_CMS, CMS_R_NO_KEY_OR_CERT}, ++ #else ++ {"NO_KEY_OR_CERT", 46, 174}, ++ #endif ++ #ifdef CMS_R_NO_MATCHING_DIGEST ++ {"NO_MATCHING_DIGEST", ERR_LIB_CMS, CMS_R_NO_MATCHING_DIGEST}, ++ #else ++ {"NO_MATCHING_DIGEST", 46, 131}, ++ #endif ++ #ifdef CMS_R_NO_MATCHING_RECIPIENT ++ {"NO_MATCHING_RECIPIENT", ERR_LIB_CMS, CMS_R_NO_MATCHING_RECIPIENT}, ++ #else ++ {"NO_MATCHING_RECIPIENT", 46, 132}, ++ #endif ++ #ifdef CMS_R_NO_MATCHING_SIGNATURE ++ {"NO_MATCHING_SIGNATURE", ERR_LIB_CMS, CMS_R_NO_MATCHING_SIGNATURE}, ++ #else ++ {"NO_MATCHING_SIGNATURE", 46, 166}, ++ #endif ++ #ifdef CMS_R_NO_MSGSIGDIGEST ++ {"NO_MSGSIGDIGEST", ERR_LIB_CMS, CMS_R_NO_MSGSIGDIGEST}, ++ #else ++ {"NO_MSGSIGDIGEST", 46, 167}, ++ #endif ++ #ifdef CMS_R_NO_PASSWORD ++ {"NO_PASSWORD", ERR_LIB_CMS, CMS_R_NO_PASSWORD}, ++ #else ++ {"NO_PASSWORD", 46, 178}, ++ #endif ++ #ifdef CMS_R_NO_PRIVATE_KEY ++ {"NO_PRIVATE_KEY", ERR_LIB_CMS, CMS_R_NO_PRIVATE_KEY}, ++ #else ++ {"NO_PRIVATE_KEY", 46, 133}, ++ #endif ++ #ifdef CMS_R_NO_PUBLIC_KEY ++ {"NO_PUBLIC_KEY", ERR_LIB_CMS, CMS_R_NO_PUBLIC_KEY}, ++ #else ++ {"NO_PUBLIC_KEY", 46, 134}, ++ #endif ++ #ifdef CMS_R_NO_RECEIPT_REQUEST ++ {"NO_RECEIPT_REQUEST", ERR_LIB_CMS, CMS_R_NO_RECEIPT_REQUEST}, ++ #else ++ {"NO_RECEIPT_REQUEST", 46, 168}, ++ #endif ++ #ifdef CMS_R_NO_SIGNERS ++ {"NO_SIGNERS", ERR_LIB_CMS, CMS_R_NO_SIGNERS}, ++ #else ++ {"NO_SIGNERS", 46, 135}, ++ #endif ++ #ifdef CMS_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE ++ {"PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE", ERR_LIB_CMS, CMS_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE}, ++ #else ++ {"PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE", 46, 136}, ++ #endif ++ #ifdef CMS_R_RECEIPT_DECODE_ERROR ++ {"RECEIPT_DECODE_ERROR", ERR_LIB_CMS, CMS_R_RECEIPT_DECODE_ERROR}, ++ #else ++ {"RECEIPT_DECODE_ERROR", 46, 169}, ++ #endif ++ #ifdef CMS_R_RECIPIENT_ERROR ++ {"RECIPIENT_ERROR", ERR_LIB_CMS, CMS_R_RECIPIENT_ERROR}, ++ #else ++ {"RECIPIENT_ERROR", 46, 137}, ++ #endif ++ #ifdef CMS_R_SIGNER_CERTIFICATE_NOT_FOUND ++ {"SIGNER_CERTIFICATE_NOT_FOUND", ERR_LIB_CMS, CMS_R_SIGNER_CERTIFICATE_NOT_FOUND}, ++ #else ++ {"SIGNER_CERTIFICATE_NOT_FOUND", 46, 138}, ++ #endif ++ #ifdef CMS_R_SIGNFINAL_ERROR ++ {"SIGNFINAL_ERROR", ERR_LIB_CMS, CMS_R_SIGNFINAL_ERROR}, ++ #else ++ {"SIGNFINAL_ERROR", 46, 139}, ++ #endif ++ #ifdef CMS_R_SMIME_TEXT_ERROR ++ {"SMIME_TEXT_ERROR", ERR_LIB_CMS, CMS_R_SMIME_TEXT_ERROR}, ++ #else ++ {"SMIME_TEXT_ERROR", 46, 140}, ++ #endif ++ #ifdef CMS_R_STORE_INIT_ERROR ++ {"STORE_INIT_ERROR", ERR_LIB_CMS, CMS_R_STORE_INIT_ERROR}, ++ #else ++ {"STORE_INIT_ERROR", 46, 141}, ++ #endif ++ #ifdef CMS_R_TYPE_NOT_COMPRESSED_DATA ++ {"TYPE_NOT_COMPRESSED_DATA", ERR_LIB_CMS, CMS_R_TYPE_NOT_COMPRESSED_DATA}, ++ #else ++ {"TYPE_NOT_COMPRESSED_DATA", 46, 142}, ++ #endif ++ #ifdef CMS_R_TYPE_NOT_DATA ++ {"TYPE_NOT_DATA", ERR_LIB_CMS, CMS_R_TYPE_NOT_DATA}, ++ #else ++ {"TYPE_NOT_DATA", 46, 143}, ++ #endif ++ #ifdef CMS_R_TYPE_NOT_DIGESTED_DATA ++ {"TYPE_NOT_DIGESTED_DATA", ERR_LIB_CMS, CMS_R_TYPE_NOT_DIGESTED_DATA}, ++ #else ++ {"TYPE_NOT_DIGESTED_DATA", 46, 144}, ++ #endif ++ #ifdef CMS_R_TYPE_NOT_ENCRYPTED_DATA ++ {"TYPE_NOT_ENCRYPTED_DATA", ERR_LIB_CMS, CMS_R_TYPE_NOT_ENCRYPTED_DATA}, ++ #else ++ {"TYPE_NOT_ENCRYPTED_DATA", 46, 145}, ++ #endif ++ #ifdef CMS_R_TYPE_NOT_ENVELOPED_DATA ++ {"TYPE_NOT_ENVELOPED_DATA", ERR_LIB_CMS, CMS_R_TYPE_NOT_ENVELOPED_DATA}, ++ #else ++ {"TYPE_NOT_ENVELOPED_DATA", 46, 146}, ++ #endif ++ #ifdef CMS_R_UNABLE_TO_FINALIZE_CONTEXT ++ {"UNABLE_TO_FINALIZE_CONTEXT", ERR_LIB_CMS, CMS_R_UNABLE_TO_FINALIZE_CONTEXT}, ++ #else ++ {"UNABLE_TO_FINALIZE_CONTEXT", 46, 147}, ++ #endif ++ #ifdef CMS_R_UNKNOWN_CIPHER ++ {"UNKNOWN_CIPHER", ERR_LIB_CMS, CMS_R_UNKNOWN_CIPHER}, ++ #else ++ {"UNKNOWN_CIPHER", 46, 148}, ++ #endif ++ #ifdef CMS_R_UNKNOWN_DIGEST_ALGORITHM ++ {"UNKNOWN_DIGEST_ALGORITHM", ERR_LIB_CMS, CMS_R_UNKNOWN_DIGEST_ALGORITHM}, ++ #else ++ {"UNKNOWN_DIGEST_ALGORITHM", 46, 149}, ++ #endif ++ #ifdef CMS_R_UNKNOWN_ID ++ {"UNKNOWN_ID", ERR_LIB_CMS, CMS_R_UNKNOWN_ID}, ++ #else ++ {"UNKNOWN_ID", 46, 150}, ++ #endif ++ #ifdef CMS_R_UNSUPPORTED_COMPRESSION_ALGORITHM ++ {"UNSUPPORTED_COMPRESSION_ALGORITHM", ERR_LIB_CMS, CMS_R_UNSUPPORTED_COMPRESSION_ALGORITHM}, ++ #else ++ {"UNSUPPORTED_COMPRESSION_ALGORITHM", 46, 151}, ++ #endif ++ #ifdef CMS_R_UNSUPPORTED_CONTENT_TYPE ++ {"UNSUPPORTED_CONTENT_TYPE", ERR_LIB_CMS, CMS_R_UNSUPPORTED_CONTENT_TYPE}, ++ #else ++ {"UNSUPPORTED_CONTENT_TYPE", 46, 152}, ++ #endif ++ #ifdef CMS_R_UNSUPPORTED_KEK_ALGORITHM ++ {"UNSUPPORTED_KEK_ALGORITHM", ERR_LIB_CMS, CMS_R_UNSUPPORTED_KEK_ALGORITHM}, ++ #else ++ {"UNSUPPORTED_KEK_ALGORITHM", 46, 153}, ++ #endif ++ #ifdef CMS_R_UNSUPPORTED_KEY_ENCRYPTION_ALGORITHM ++ {"UNSUPPORTED_KEY_ENCRYPTION_ALGORITHM", ERR_LIB_CMS, CMS_R_UNSUPPORTED_KEY_ENCRYPTION_ALGORITHM}, ++ #else ++ {"UNSUPPORTED_KEY_ENCRYPTION_ALGORITHM", 46, 179}, ++ #endif ++ #ifdef CMS_R_UNSUPPORTED_RECIPIENTINFO_TYPE ++ {"UNSUPPORTED_RECIPIENTINFO_TYPE", ERR_LIB_CMS, CMS_R_UNSUPPORTED_RECIPIENTINFO_TYPE}, ++ #else ++ {"UNSUPPORTED_RECIPIENTINFO_TYPE", 46, 155}, ++ #endif ++ #ifdef CMS_R_UNSUPPORTED_RECIPIENT_TYPE ++ {"UNSUPPORTED_RECIPIENT_TYPE", ERR_LIB_CMS, CMS_R_UNSUPPORTED_RECIPIENT_TYPE}, ++ #else ++ {"UNSUPPORTED_RECIPIENT_TYPE", 46, 154}, ++ #endif ++ #ifdef CMS_R_UNSUPPORTED_TYPE ++ {"UNSUPPORTED_TYPE", ERR_LIB_CMS, CMS_R_UNSUPPORTED_TYPE}, ++ #else ++ {"UNSUPPORTED_TYPE", 46, 156}, ++ #endif ++ #ifdef CMS_R_UNWRAP_ERROR ++ {"UNWRAP_ERROR", ERR_LIB_CMS, CMS_R_UNWRAP_ERROR}, ++ #else ++ {"UNWRAP_ERROR", 46, 157}, ++ #endif ++ #ifdef CMS_R_UNWRAP_FAILURE ++ {"UNWRAP_FAILURE", ERR_LIB_CMS, CMS_R_UNWRAP_FAILURE}, ++ #else ++ {"UNWRAP_FAILURE", 46, 180}, ++ #endif ++ #ifdef CMS_R_VERIFICATION_FAILURE ++ {"VERIFICATION_FAILURE", ERR_LIB_CMS, CMS_R_VERIFICATION_FAILURE}, ++ #else ++ {"VERIFICATION_FAILURE", 46, 158}, ++ #endif ++ #ifdef CMS_R_WRAP_ERROR ++ {"WRAP_ERROR", ERR_LIB_CMS, CMS_R_WRAP_ERROR}, ++ #else ++ {"WRAP_ERROR", 46, 159}, ++ #endif ++ #ifdef COMP_R_ZLIB_DEFLATE_ERROR ++ {"ZLIB_DEFLATE_ERROR", ERR_LIB_COMP, COMP_R_ZLIB_DEFLATE_ERROR}, ++ #else ++ {"ZLIB_DEFLATE_ERROR", 41, 99}, ++ #endif ++ #ifdef COMP_R_ZLIB_INFLATE_ERROR ++ {"ZLIB_INFLATE_ERROR", ERR_LIB_COMP, COMP_R_ZLIB_INFLATE_ERROR}, ++ #else ++ {"ZLIB_INFLATE_ERROR", 41, 100}, ++ #endif ++ #ifdef COMP_R_ZLIB_NOT_SUPPORTED ++ {"ZLIB_NOT_SUPPORTED", ERR_LIB_COMP, COMP_R_ZLIB_NOT_SUPPORTED}, ++ #else ++ {"ZLIB_NOT_SUPPORTED", 41, 101}, ++ #endif ++ #ifdef CONF_R_ERROR_LOADING_DSO ++ {"ERROR_LOADING_DSO", ERR_LIB_CONF, CONF_R_ERROR_LOADING_DSO}, ++ #else ++ {"ERROR_LOADING_DSO", 14, 110}, ++ #endif ++ #ifdef CONF_R_LIST_CANNOT_BE_NULL ++ {"LIST_CANNOT_BE_NULL", ERR_LIB_CONF, CONF_R_LIST_CANNOT_BE_NULL}, ++ #else ++ {"LIST_CANNOT_BE_NULL", 14, 115}, ++ #endif ++ #ifdef CONF_R_MISSING_CLOSE_SQUARE_BRACKET ++ {"MISSING_CLOSE_SQUARE_BRACKET", ERR_LIB_CONF, CONF_R_MISSING_CLOSE_SQUARE_BRACKET}, ++ #else ++ {"MISSING_CLOSE_SQUARE_BRACKET", 14, 100}, ++ #endif ++ #ifdef CONF_R_MISSING_EQUAL_SIGN ++ {"MISSING_EQUAL_SIGN", ERR_LIB_CONF, CONF_R_MISSING_EQUAL_SIGN}, ++ #else ++ {"MISSING_EQUAL_SIGN", 14, 101}, ++ #endif ++ #ifdef CONF_R_MISSING_INIT_FUNCTION ++ {"MISSING_INIT_FUNCTION", ERR_LIB_CONF, CONF_R_MISSING_INIT_FUNCTION}, ++ #else ++ {"MISSING_INIT_FUNCTION", 14, 112}, ++ #endif ++ #ifdef CONF_R_MODULE_INITIALIZATION_ERROR ++ {"MODULE_INITIALIZATION_ERROR", ERR_LIB_CONF, CONF_R_MODULE_INITIALIZATION_ERROR}, ++ #else ++ {"MODULE_INITIALIZATION_ERROR", 14, 109}, ++ #endif ++ #ifdef CONF_R_NO_CLOSE_BRACE ++ {"NO_CLOSE_BRACE", ERR_LIB_CONF, CONF_R_NO_CLOSE_BRACE}, ++ #else ++ {"NO_CLOSE_BRACE", 14, 102}, ++ #endif ++ #ifdef CONF_R_NO_CONF ++ {"NO_CONF", ERR_LIB_CONF, CONF_R_NO_CONF}, ++ #else ++ {"NO_CONF", 14, 105}, ++ #endif ++ #ifdef CONF_R_NO_CONF_OR_ENVIRONMENT_VARIABLE ++ {"NO_CONF_OR_ENVIRONMENT_VARIABLE", ERR_LIB_CONF, CONF_R_NO_CONF_OR_ENVIRONMENT_VARIABLE}, ++ #else ++ {"NO_CONF_OR_ENVIRONMENT_VARIABLE", 14, 106}, ++ #endif ++ #ifdef CONF_R_NO_SECTION ++ {"NO_SECTION", ERR_LIB_CONF, CONF_R_NO_SECTION}, ++ #else ++ {"NO_SECTION", 14, 107}, ++ #endif ++ #ifdef CONF_R_NO_SUCH_FILE ++ {"NO_SUCH_FILE", ERR_LIB_CONF, CONF_R_NO_SUCH_FILE}, ++ #else ++ {"NO_SUCH_FILE", 14, 114}, ++ #endif ++ #ifdef CONF_R_NO_VALUE ++ {"NO_VALUE", ERR_LIB_CONF, CONF_R_NO_VALUE}, ++ #else ++ {"NO_VALUE", 14, 108}, ++ #endif ++ #ifdef CONF_R_NUMBER_TOO_LARGE ++ {"NUMBER_TOO_LARGE", ERR_LIB_CONF, CONF_R_NUMBER_TOO_LARGE}, ++ #else ++ {"NUMBER_TOO_LARGE", 14, 121}, ++ #endif ++ #ifdef CONF_R_RECURSIVE_DIRECTORY_INCLUDE ++ {"RECURSIVE_DIRECTORY_INCLUDE", ERR_LIB_CONF, CONF_R_RECURSIVE_DIRECTORY_INCLUDE}, ++ #else ++ {"RECURSIVE_DIRECTORY_INCLUDE", 14, 111}, ++ #endif ++ #ifdef CONF_R_SSL_COMMAND_SECTION_EMPTY ++ {"SSL_COMMAND_SECTION_EMPTY", ERR_LIB_CONF, CONF_R_SSL_COMMAND_SECTION_EMPTY}, ++ #else ++ {"SSL_COMMAND_SECTION_EMPTY", 14, 117}, ++ #endif ++ #ifdef CONF_R_SSL_COMMAND_SECTION_NOT_FOUND ++ {"SSL_COMMAND_SECTION_NOT_FOUND", ERR_LIB_CONF, CONF_R_SSL_COMMAND_SECTION_NOT_FOUND}, ++ #else ++ {"SSL_COMMAND_SECTION_NOT_FOUND", 14, 118}, ++ #endif ++ #ifdef CONF_R_SSL_SECTION_EMPTY ++ {"SSL_SECTION_EMPTY", ERR_LIB_CONF, CONF_R_SSL_SECTION_EMPTY}, ++ #else ++ {"SSL_SECTION_EMPTY", 14, 119}, ++ #endif ++ #ifdef CONF_R_SSL_SECTION_NOT_FOUND ++ {"SSL_SECTION_NOT_FOUND", ERR_LIB_CONF, CONF_R_SSL_SECTION_NOT_FOUND}, ++ #else ++ {"SSL_SECTION_NOT_FOUND", 14, 120}, ++ #endif ++ #ifdef CONF_R_UNABLE_TO_CREATE_NEW_SECTION ++ {"UNABLE_TO_CREATE_NEW_SECTION", ERR_LIB_CONF, CONF_R_UNABLE_TO_CREATE_NEW_SECTION}, ++ #else ++ {"UNABLE_TO_CREATE_NEW_SECTION", 14, 103}, ++ #endif ++ #ifdef CONF_R_UNKNOWN_MODULE_NAME ++ {"UNKNOWN_MODULE_NAME", ERR_LIB_CONF, CONF_R_UNKNOWN_MODULE_NAME}, ++ #else ++ {"UNKNOWN_MODULE_NAME", 14, 113}, ++ #endif ++ #ifdef CONF_R_VARIABLE_EXPANSION_TOO_LONG ++ {"VARIABLE_EXPANSION_TOO_LONG", ERR_LIB_CONF, CONF_R_VARIABLE_EXPANSION_TOO_LONG}, ++ #else ++ {"VARIABLE_EXPANSION_TOO_LONG", 14, 116}, ++ #endif ++ #ifdef CONF_R_VARIABLE_HAS_NO_VALUE ++ {"VARIABLE_HAS_NO_VALUE", ERR_LIB_CONF, CONF_R_VARIABLE_HAS_NO_VALUE}, ++ #else ++ {"VARIABLE_HAS_NO_VALUE", 14, 104}, ++ #endif ++ #ifdef CRYPTO_R_FIPS_MODE_NOT_SUPPORTED ++ {"FIPS_MODE_NOT_SUPPORTED", ERR_LIB_CRYPTO, CRYPTO_R_FIPS_MODE_NOT_SUPPORTED}, ++ #else ++ {"FIPS_MODE_NOT_SUPPORTED", 15, 101}, ++ #endif ++ #ifdef CRYPTO_R_ILLEGAL_HEX_DIGIT ++ {"ILLEGAL_HEX_DIGIT", ERR_LIB_CRYPTO, CRYPTO_R_ILLEGAL_HEX_DIGIT}, ++ #else ++ {"ILLEGAL_HEX_DIGIT", 15, 102}, ++ #endif ++ #ifdef CRYPTO_R_ODD_NUMBER_OF_DIGITS ++ {"ODD_NUMBER_OF_DIGITS", ERR_LIB_CRYPTO, CRYPTO_R_ODD_NUMBER_OF_DIGITS}, ++ #else ++ {"ODD_NUMBER_OF_DIGITS", 15, 103}, ++ #endif ++ #ifdef CT_R_BASE64_DECODE_ERROR ++ {"BASE64_DECODE_ERROR", ERR_LIB_CT, CT_R_BASE64_DECODE_ERROR}, ++ #else ++ {"BASE64_DECODE_ERROR", 50, 108}, ++ #endif ++ #ifdef CT_R_INVALID_LOG_ID_LENGTH ++ {"INVALID_LOG_ID_LENGTH", ERR_LIB_CT, CT_R_INVALID_LOG_ID_LENGTH}, ++ #else ++ {"INVALID_LOG_ID_LENGTH", 50, 100}, ++ #endif ++ #ifdef CT_R_LOG_CONF_INVALID ++ {"LOG_CONF_INVALID", ERR_LIB_CT, CT_R_LOG_CONF_INVALID}, ++ #else ++ {"LOG_CONF_INVALID", 50, 109}, ++ #endif ++ #ifdef CT_R_LOG_CONF_INVALID_KEY ++ {"LOG_CONF_INVALID_KEY", ERR_LIB_CT, CT_R_LOG_CONF_INVALID_KEY}, ++ #else ++ {"LOG_CONF_INVALID_KEY", 50, 110}, ++ #endif ++ #ifdef CT_R_LOG_CONF_MISSING_DESCRIPTION ++ {"LOG_CONF_MISSING_DESCRIPTION", ERR_LIB_CT, CT_R_LOG_CONF_MISSING_DESCRIPTION}, ++ #else ++ {"LOG_CONF_MISSING_DESCRIPTION", 50, 111}, ++ #endif ++ #ifdef CT_R_LOG_CONF_MISSING_KEY ++ {"LOG_CONF_MISSING_KEY", ERR_LIB_CT, CT_R_LOG_CONF_MISSING_KEY}, ++ #else ++ {"LOG_CONF_MISSING_KEY", 50, 112}, ++ #endif ++ #ifdef CT_R_LOG_KEY_INVALID ++ {"LOG_KEY_INVALID", ERR_LIB_CT, CT_R_LOG_KEY_INVALID}, ++ #else ++ {"LOG_KEY_INVALID", 50, 113}, ++ #endif ++ #ifdef CT_R_SCT_FUTURE_TIMESTAMP ++ {"SCT_FUTURE_TIMESTAMP", ERR_LIB_CT, CT_R_SCT_FUTURE_TIMESTAMP}, ++ #else ++ {"SCT_FUTURE_TIMESTAMP", 50, 116}, ++ #endif ++ #ifdef CT_R_SCT_INVALID ++ {"SCT_INVALID", ERR_LIB_CT, CT_R_SCT_INVALID}, ++ #else ++ {"SCT_INVALID", 50, 104}, ++ #endif ++ #ifdef CT_R_SCT_INVALID_SIGNATURE ++ {"SCT_INVALID_SIGNATURE", ERR_LIB_CT, CT_R_SCT_INVALID_SIGNATURE}, ++ #else ++ {"SCT_INVALID_SIGNATURE", 50, 107}, ++ #endif ++ #ifdef CT_R_SCT_LIST_INVALID ++ {"SCT_LIST_INVALID", ERR_LIB_CT, CT_R_SCT_LIST_INVALID}, ++ #else ++ {"SCT_LIST_INVALID", 50, 105}, ++ #endif ++ #ifdef CT_R_SCT_LOG_ID_MISMATCH ++ {"SCT_LOG_ID_MISMATCH", ERR_LIB_CT, CT_R_SCT_LOG_ID_MISMATCH}, ++ #else ++ {"SCT_LOG_ID_MISMATCH", 50, 114}, ++ #endif ++ #ifdef CT_R_SCT_NOT_SET ++ {"SCT_NOT_SET", ERR_LIB_CT, CT_R_SCT_NOT_SET}, ++ #else ++ {"SCT_NOT_SET", 50, 106}, ++ #endif ++ #ifdef CT_R_SCT_UNSUPPORTED_VERSION ++ {"SCT_UNSUPPORTED_VERSION", ERR_LIB_CT, CT_R_SCT_UNSUPPORTED_VERSION}, ++ #else ++ {"SCT_UNSUPPORTED_VERSION", 50, 115}, ++ #endif ++ #ifdef CT_R_UNRECOGNIZED_SIGNATURE_NID ++ {"UNRECOGNIZED_SIGNATURE_NID", ERR_LIB_CT, CT_R_UNRECOGNIZED_SIGNATURE_NID}, ++ #else ++ {"UNRECOGNIZED_SIGNATURE_NID", 50, 101}, ++ #endif ++ #ifdef CT_R_UNSUPPORTED_ENTRY_TYPE ++ {"UNSUPPORTED_ENTRY_TYPE", ERR_LIB_CT, CT_R_UNSUPPORTED_ENTRY_TYPE}, ++ #else ++ {"UNSUPPORTED_ENTRY_TYPE", 50, 102}, ++ #endif ++ #ifdef CT_R_UNSUPPORTED_VERSION ++ {"UNSUPPORTED_VERSION", ERR_LIB_CT, CT_R_UNSUPPORTED_VERSION}, ++ #else ++ {"UNSUPPORTED_VERSION", 50, 103}, ++ #endif ++ #ifdef DH_R_BAD_GENERATOR ++ {"BAD_GENERATOR", ERR_LIB_DH, DH_R_BAD_GENERATOR}, ++ #else ++ {"BAD_GENERATOR", 5, 101}, ++ #endif ++ #ifdef DH_R_BN_DECODE_ERROR ++ {"BN_DECODE_ERROR", ERR_LIB_DH, DH_R_BN_DECODE_ERROR}, ++ #else ++ {"BN_DECODE_ERROR", 5, 109}, ++ #endif ++ #ifdef DH_R_BN_ERROR ++ {"BN_ERROR", ERR_LIB_DH, DH_R_BN_ERROR}, ++ #else ++ {"BN_ERROR", 5, 106}, ++ #endif ++ #ifdef DH_R_CHECK_INVALID_J_VALUE ++ {"CHECK_INVALID_J_VALUE", ERR_LIB_DH, DH_R_CHECK_INVALID_J_VALUE}, ++ #else ++ {"CHECK_INVALID_J_VALUE", 5, 115}, ++ #endif ++ #ifdef DH_R_CHECK_INVALID_Q_VALUE ++ {"CHECK_INVALID_Q_VALUE", ERR_LIB_DH, DH_R_CHECK_INVALID_Q_VALUE}, ++ #else ++ {"CHECK_INVALID_Q_VALUE", 5, 116}, ++ #endif ++ #ifdef DH_R_CHECK_PUBKEY_INVALID ++ {"CHECK_PUBKEY_INVALID", ERR_LIB_DH, DH_R_CHECK_PUBKEY_INVALID}, ++ #else ++ {"CHECK_PUBKEY_INVALID", 5, 122}, ++ #endif ++ #ifdef DH_R_CHECK_PUBKEY_TOO_LARGE ++ {"CHECK_PUBKEY_TOO_LARGE", ERR_LIB_DH, DH_R_CHECK_PUBKEY_TOO_LARGE}, ++ #else ++ {"CHECK_PUBKEY_TOO_LARGE", 5, 123}, ++ #endif ++ #ifdef DH_R_CHECK_PUBKEY_TOO_SMALL ++ {"CHECK_PUBKEY_TOO_SMALL", ERR_LIB_DH, DH_R_CHECK_PUBKEY_TOO_SMALL}, ++ #else ++ {"CHECK_PUBKEY_TOO_SMALL", 5, 124}, ++ #endif ++ #ifdef DH_R_CHECK_P_NOT_PRIME ++ {"CHECK_P_NOT_PRIME", ERR_LIB_DH, DH_R_CHECK_P_NOT_PRIME}, ++ #else ++ {"CHECK_P_NOT_PRIME", 5, 117}, ++ #endif ++ #ifdef DH_R_CHECK_P_NOT_SAFE_PRIME ++ {"CHECK_P_NOT_SAFE_PRIME", ERR_LIB_DH, DH_R_CHECK_P_NOT_SAFE_PRIME}, ++ #else ++ {"CHECK_P_NOT_SAFE_PRIME", 5, 118}, ++ #endif ++ #ifdef DH_R_CHECK_Q_NOT_PRIME ++ {"CHECK_Q_NOT_PRIME", ERR_LIB_DH, DH_R_CHECK_Q_NOT_PRIME}, ++ #else ++ {"CHECK_Q_NOT_PRIME", 5, 119}, ++ #endif ++ #ifdef DH_R_DECODE_ERROR ++ {"DECODE_ERROR", ERR_LIB_DH, DH_R_DECODE_ERROR}, ++ #else ++ {"DECODE_ERROR", 5, 104}, ++ #endif ++ #ifdef DH_R_INVALID_PARAMETER_NAME ++ {"INVALID_PARAMETER_NAME", ERR_LIB_DH, DH_R_INVALID_PARAMETER_NAME}, ++ #else ++ {"INVALID_PARAMETER_NAME", 5, 110}, ++ #endif ++ #ifdef DH_R_INVALID_PARAMETER_NID ++ {"INVALID_PARAMETER_NID", ERR_LIB_DH, DH_R_INVALID_PARAMETER_NID}, ++ #else ++ {"INVALID_PARAMETER_NID", 5, 114}, ++ #endif ++ #ifdef DH_R_INVALID_PUBKEY ++ {"INVALID_PUBKEY", ERR_LIB_DH, DH_R_INVALID_PUBKEY}, ++ #else ++ {"INVALID_PUBKEY", 5, 102}, ++ #endif ++ #ifdef DH_R_KDF_PARAMETER_ERROR ++ {"KDF_PARAMETER_ERROR", ERR_LIB_DH, DH_R_KDF_PARAMETER_ERROR}, ++ #else ++ {"KDF_PARAMETER_ERROR", 5, 112}, ++ #endif ++ #ifdef DH_R_KEYS_NOT_SET ++ {"KEYS_NOT_SET", ERR_LIB_DH, DH_R_KEYS_NOT_SET}, ++ #else ++ {"KEYS_NOT_SET", 5, 108}, ++ #endif ++ #ifdef DH_R_MISSING_PUBKEY ++ {"MISSING_PUBKEY", ERR_LIB_DH, DH_R_MISSING_PUBKEY}, ++ #else ++ {"MISSING_PUBKEY", 5, 125}, ++ #endif ++ #ifdef DH_R_MODULUS_TOO_LARGE ++ {"MODULUS_TOO_LARGE", ERR_LIB_DH, DH_R_MODULUS_TOO_LARGE}, ++ #else ++ {"MODULUS_TOO_LARGE", 5, 103}, ++ #endif ++ #ifdef DH_R_NOT_SUITABLE_GENERATOR ++ {"NOT_SUITABLE_GENERATOR", ERR_LIB_DH, DH_R_NOT_SUITABLE_GENERATOR}, ++ #else ++ {"NOT_SUITABLE_GENERATOR", 5, 120}, ++ #endif ++ #ifdef DH_R_NO_PARAMETERS_SET ++ {"NO_PARAMETERS_SET", ERR_LIB_DH, DH_R_NO_PARAMETERS_SET}, ++ #else ++ {"NO_PARAMETERS_SET", 5, 107}, ++ #endif ++ #ifdef DH_R_NO_PRIVATE_VALUE ++ {"NO_PRIVATE_VALUE", ERR_LIB_DH, DH_R_NO_PRIVATE_VALUE}, ++ #else ++ {"NO_PRIVATE_VALUE", 5, 100}, ++ #endif ++ #ifdef DH_R_PARAMETER_ENCODING_ERROR ++ {"PARAMETER_ENCODING_ERROR", ERR_LIB_DH, DH_R_PARAMETER_ENCODING_ERROR}, ++ #else ++ {"PARAMETER_ENCODING_ERROR", 5, 105}, ++ #endif ++ #ifdef DH_R_PEER_KEY_ERROR ++ {"PEER_KEY_ERROR", ERR_LIB_DH, DH_R_PEER_KEY_ERROR}, ++ #else ++ {"PEER_KEY_ERROR", 5, 111}, ++ #endif ++ #ifdef DH_R_SHARED_INFO_ERROR ++ {"SHARED_INFO_ERROR", ERR_LIB_DH, DH_R_SHARED_INFO_ERROR}, ++ #else ++ {"SHARED_INFO_ERROR", 5, 113}, ++ #endif ++ #ifdef DH_R_UNABLE_TO_CHECK_GENERATOR ++ {"UNABLE_TO_CHECK_GENERATOR", ERR_LIB_DH, DH_R_UNABLE_TO_CHECK_GENERATOR}, ++ #else ++ {"UNABLE_TO_CHECK_GENERATOR", 5, 121}, ++ #endif ++ #ifdef DSA_R_BAD_Q_VALUE ++ {"BAD_Q_VALUE", ERR_LIB_DSA, DSA_R_BAD_Q_VALUE}, ++ #else ++ {"BAD_Q_VALUE", 10, 102}, ++ #endif ++ #ifdef DSA_R_BN_DECODE_ERROR ++ {"BN_DECODE_ERROR", ERR_LIB_DSA, DSA_R_BN_DECODE_ERROR}, ++ #else ++ {"BN_DECODE_ERROR", 10, 108}, ++ #endif ++ #ifdef DSA_R_BN_ERROR ++ {"BN_ERROR", ERR_LIB_DSA, DSA_R_BN_ERROR}, ++ #else ++ {"BN_ERROR", 10, 109}, ++ #endif ++ #ifdef DSA_R_DECODE_ERROR ++ {"DECODE_ERROR", ERR_LIB_DSA, DSA_R_DECODE_ERROR}, ++ #else ++ {"DECODE_ERROR", 10, 104}, ++ #endif ++ #ifdef DSA_R_INVALID_DIGEST_TYPE ++ {"INVALID_DIGEST_TYPE", ERR_LIB_DSA, DSA_R_INVALID_DIGEST_TYPE}, ++ #else ++ {"INVALID_DIGEST_TYPE", 10, 106}, ++ #endif ++ #ifdef DSA_R_INVALID_PARAMETERS ++ {"INVALID_PARAMETERS", ERR_LIB_DSA, DSA_R_INVALID_PARAMETERS}, ++ #else ++ {"INVALID_PARAMETERS", 10, 112}, ++ #endif ++ #ifdef DSA_R_MISSING_PARAMETERS ++ {"MISSING_PARAMETERS", ERR_LIB_DSA, DSA_R_MISSING_PARAMETERS}, ++ #else ++ {"MISSING_PARAMETERS", 10, 101}, ++ #endif ++ #ifdef DSA_R_MISSING_PRIVATE_KEY ++ {"MISSING_PRIVATE_KEY", ERR_LIB_DSA, DSA_R_MISSING_PRIVATE_KEY}, ++ #else ++ {"MISSING_PRIVATE_KEY", 10, 111}, ++ #endif ++ #ifdef DSA_R_MODULUS_TOO_LARGE ++ {"MODULUS_TOO_LARGE", ERR_LIB_DSA, DSA_R_MODULUS_TOO_LARGE}, ++ #else ++ {"MODULUS_TOO_LARGE", 10, 103}, ++ #endif ++ #ifdef DSA_R_NO_PARAMETERS_SET ++ {"NO_PARAMETERS_SET", ERR_LIB_DSA, DSA_R_NO_PARAMETERS_SET}, ++ #else ++ {"NO_PARAMETERS_SET", 10, 107}, ++ #endif ++ #ifdef DSA_R_PARAMETER_ENCODING_ERROR ++ {"PARAMETER_ENCODING_ERROR", ERR_LIB_DSA, DSA_R_PARAMETER_ENCODING_ERROR}, ++ #else ++ {"PARAMETER_ENCODING_ERROR", 10, 105}, ++ #endif ++ #ifdef DSA_R_Q_NOT_PRIME ++ {"Q_NOT_PRIME", ERR_LIB_DSA, DSA_R_Q_NOT_PRIME}, ++ #else ++ {"Q_NOT_PRIME", 10, 113}, ++ #endif ++ #ifdef DSA_R_SEED_LEN_SMALL ++ {"SEED_LEN_SMALL", ERR_LIB_DSA, DSA_R_SEED_LEN_SMALL}, ++ #else ++ {"SEED_LEN_SMALL", 10, 110}, ++ #endif ++ #ifdef EC_R_ASN1_ERROR ++ {"ASN1_ERROR", ERR_LIB_EC, EC_R_ASN1_ERROR}, ++ #else ++ {"ASN1_ERROR", 16, 115}, ++ #endif ++ #ifdef EC_R_BAD_SIGNATURE ++ {"BAD_SIGNATURE", ERR_LIB_EC, EC_R_BAD_SIGNATURE}, ++ #else ++ {"BAD_SIGNATURE", 16, 156}, ++ #endif ++ #ifdef EC_R_BIGNUM_OUT_OF_RANGE ++ {"BIGNUM_OUT_OF_RANGE", ERR_LIB_EC, EC_R_BIGNUM_OUT_OF_RANGE}, ++ #else ++ {"BIGNUM_OUT_OF_RANGE", 16, 144}, ++ #endif ++ #ifdef EC_R_BUFFER_TOO_SMALL ++ {"BUFFER_TOO_SMALL", ERR_LIB_EC, EC_R_BUFFER_TOO_SMALL}, ++ #else ++ {"BUFFER_TOO_SMALL", 16, 100}, ++ #endif ++ #ifdef EC_R_CANNOT_INVERT ++ {"CANNOT_INVERT", ERR_LIB_EC, EC_R_CANNOT_INVERT}, ++ #else ++ {"CANNOT_INVERT", 16, 165}, ++ #endif ++ #ifdef EC_R_COORDINATES_OUT_OF_RANGE ++ {"COORDINATES_OUT_OF_RANGE", ERR_LIB_EC, EC_R_COORDINATES_OUT_OF_RANGE}, ++ #else ++ {"COORDINATES_OUT_OF_RANGE", 16, 146}, ++ #endif ++ #ifdef EC_R_CURVE_DOES_NOT_SUPPORT_ECDH ++ {"CURVE_DOES_NOT_SUPPORT_ECDH", ERR_LIB_EC, EC_R_CURVE_DOES_NOT_SUPPORT_ECDH}, ++ #else ++ {"CURVE_DOES_NOT_SUPPORT_ECDH", 16, 160}, ++ #endif ++ #ifdef EC_R_CURVE_DOES_NOT_SUPPORT_SIGNING ++ {"CURVE_DOES_NOT_SUPPORT_SIGNING", ERR_LIB_EC, EC_R_CURVE_DOES_NOT_SUPPORT_SIGNING}, ++ #else ++ {"CURVE_DOES_NOT_SUPPORT_SIGNING", 16, 159}, ++ #endif ++ #ifdef EC_R_D2I_ECPKPARAMETERS_FAILURE ++ {"D2I_ECPKPARAMETERS_FAILURE", ERR_LIB_EC, EC_R_D2I_ECPKPARAMETERS_FAILURE}, ++ #else ++ {"D2I_ECPKPARAMETERS_FAILURE", 16, 117}, ++ #endif ++ #ifdef EC_R_DECODE_ERROR ++ {"DECODE_ERROR", ERR_LIB_EC, EC_R_DECODE_ERROR}, ++ #else ++ {"DECODE_ERROR", 16, 142}, ++ #endif ++ #ifdef EC_R_DISCRIMINANT_IS_ZERO ++ {"DISCRIMINANT_IS_ZERO", ERR_LIB_EC, EC_R_DISCRIMINANT_IS_ZERO}, ++ #else ++ {"DISCRIMINANT_IS_ZERO", 16, 118}, ++ #endif ++ #ifdef EC_R_EC_GROUP_NEW_BY_NAME_FAILURE ++ {"EC_GROUP_NEW_BY_NAME_FAILURE", ERR_LIB_EC, EC_R_EC_GROUP_NEW_BY_NAME_FAILURE}, ++ #else ++ {"EC_GROUP_NEW_BY_NAME_FAILURE", 16, 119}, ++ #endif ++ #ifdef EC_R_FIELD_TOO_LARGE ++ {"FIELD_TOO_LARGE", ERR_LIB_EC, EC_R_FIELD_TOO_LARGE}, ++ #else ++ {"FIELD_TOO_LARGE", 16, 143}, ++ #endif ++ #ifdef EC_R_GF2M_NOT_SUPPORTED ++ {"GF2M_NOT_SUPPORTED", ERR_LIB_EC, EC_R_GF2M_NOT_SUPPORTED}, ++ #else ++ {"GF2M_NOT_SUPPORTED", 16, 147}, ++ #endif ++ #ifdef EC_R_GROUP2PKPARAMETERS_FAILURE ++ {"GROUP2PKPARAMETERS_FAILURE", ERR_LIB_EC, EC_R_GROUP2PKPARAMETERS_FAILURE}, ++ #else ++ {"GROUP2PKPARAMETERS_FAILURE", 16, 120}, ++ #endif ++ #ifdef EC_R_I2D_ECPKPARAMETERS_FAILURE ++ {"I2D_ECPKPARAMETERS_FAILURE", ERR_LIB_EC, EC_R_I2D_ECPKPARAMETERS_FAILURE}, ++ #else ++ {"I2D_ECPKPARAMETERS_FAILURE", 16, 121}, ++ #endif ++ #ifdef EC_R_INCOMPATIBLE_OBJECTS ++ {"INCOMPATIBLE_OBJECTS", ERR_LIB_EC, EC_R_INCOMPATIBLE_OBJECTS}, ++ #else ++ {"INCOMPATIBLE_OBJECTS", 16, 101}, ++ #endif ++ #ifdef EC_R_INVALID_ARGUMENT ++ {"INVALID_ARGUMENT", ERR_LIB_EC, EC_R_INVALID_ARGUMENT}, ++ #else ++ {"INVALID_ARGUMENT", 16, 112}, ++ #endif ++ #ifdef EC_R_INVALID_COMPRESSED_POINT ++ {"INVALID_COMPRESSED_POINT", ERR_LIB_EC, EC_R_INVALID_COMPRESSED_POINT}, ++ #else ++ {"INVALID_COMPRESSED_POINT", 16, 110}, ++ #endif ++ #ifdef EC_R_INVALID_COMPRESSION_BIT ++ {"INVALID_COMPRESSION_BIT", ERR_LIB_EC, EC_R_INVALID_COMPRESSION_BIT}, ++ #else ++ {"INVALID_COMPRESSION_BIT", 16, 109}, ++ #endif ++ #ifdef EC_R_INVALID_CURVE ++ {"INVALID_CURVE", ERR_LIB_EC, EC_R_INVALID_CURVE}, ++ #else ++ {"INVALID_CURVE", 16, 141}, ++ #endif ++ #ifdef EC_R_INVALID_DIGEST ++ {"INVALID_DIGEST", ERR_LIB_EC, EC_R_INVALID_DIGEST}, ++ #else ++ {"INVALID_DIGEST", 16, 151}, ++ #endif ++ #ifdef EC_R_INVALID_DIGEST_TYPE ++ {"INVALID_DIGEST_TYPE", ERR_LIB_EC, EC_R_INVALID_DIGEST_TYPE}, ++ #else ++ {"INVALID_DIGEST_TYPE", 16, 138}, ++ #endif ++ #ifdef EC_R_INVALID_ENCODING ++ {"INVALID_ENCODING", ERR_LIB_EC, EC_R_INVALID_ENCODING}, ++ #else ++ {"INVALID_ENCODING", 16, 102}, ++ #endif ++ #ifdef EC_R_INVALID_FIELD ++ {"INVALID_FIELD", ERR_LIB_EC, EC_R_INVALID_FIELD}, ++ #else ++ {"INVALID_FIELD", 16, 103}, ++ #endif ++ #ifdef EC_R_INVALID_FORM ++ {"INVALID_FORM", ERR_LIB_EC, EC_R_INVALID_FORM}, ++ #else ++ {"INVALID_FORM", 16, 104}, ++ #endif ++ #ifdef EC_R_INVALID_GROUP_ORDER ++ {"INVALID_GROUP_ORDER", ERR_LIB_EC, EC_R_INVALID_GROUP_ORDER}, ++ #else ++ {"INVALID_GROUP_ORDER", 16, 122}, ++ #endif ++ #ifdef EC_R_INVALID_KEY ++ {"INVALID_KEY", ERR_LIB_EC, EC_R_INVALID_KEY}, ++ #else ++ {"INVALID_KEY", 16, 116}, ++ #endif ++ #ifdef EC_R_INVALID_OUTPUT_LENGTH ++ {"INVALID_OUTPUT_LENGTH", ERR_LIB_EC, EC_R_INVALID_OUTPUT_LENGTH}, ++ #else ++ {"INVALID_OUTPUT_LENGTH", 16, 161}, ++ #endif ++ #ifdef EC_R_INVALID_PEER_KEY ++ {"INVALID_PEER_KEY", ERR_LIB_EC, EC_R_INVALID_PEER_KEY}, ++ #else ++ {"INVALID_PEER_KEY", 16, 133}, ++ #endif ++ #ifdef EC_R_INVALID_PENTANOMIAL_BASIS ++ {"INVALID_PENTANOMIAL_BASIS", ERR_LIB_EC, EC_R_INVALID_PENTANOMIAL_BASIS}, ++ #else ++ {"INVALID_PENTANOMIAL_BASIS", 16, 132}, ++ #endif ++ #ifdef EC_R_INVALID_PRIVATE_KEY ++ {"INVALID_PRIVATE_KEY", ERR_LIB_EC, EC_R_INVALID_PRIVATE_KEY}, ++ #else ++ {"INVALID_PRIVATE_KEY", 16, 123}, ++ #endif ++ #ifdef EC_R_INVALID_TRINOMIAL_BASIS ++ {"INVALID_TRINOMIAL_BASIS", ERR_LIB_EC, EC_R_INVALID_TRINOMIAL_BASIS}, ++ #else ++ {"INVALID_TRINOMIAL_BASIS", 16, 137}, ++ #endif ++ #ifdef EC_R_KDF_PARAMETER_ERROR ++ {"KDF_PARAMETER_ERROR", ERR_LIB_EC, EC_R_KDF_PARAMETER_ERROR}, ++ #else ++ {"KDF_PARAMETER_ERROR", 16, 148}, ++ #endif ++ #ifdef EC_R_KEYS_NOT_SET ++ {"KEYS_NOT_SET", ERR_LIB_EC, EC_R_KEYS_NOT_SET}, ++ #else ++ {"KEYS_NOT_SET", 16, 140}, ++ #endif ++ #ifdef EC_R_LADDER_POST_FAILURE ++ {"LADDER_POST_FAILURE", ERR_LIB_EC, EC_R_LADDER_POST_FAILURE}, ++ #else ++ {"LADDER_POST_FAILURE", 16, 136}, ++ #endif ++ #ifdef EC_R_LADDER_PRE_FAILURE ++ {"LADDER_PRE_FAILURE", ERR_LIB_EC, EC_R_LADDER_PRE_FAILURE}, ++ #else ++ {"LADDER_PRE_FAILURE", 16, 153}, ++ #endif ++ #ifdef EC_R_LADDER_STEP_FAILURE ++ {"LADDER_STEP_FAILURE", ERR_LIB_EC, EC_R_LADDER_STEP_FAILURE}, ++ #else ++ {"LADDER_STEP_FAILURE", 16, 162}, ++ #endif ++ #ifdef EC_R_MISSING_PARAMETERS ++ {"MISSING_PARAMETERS", ERR_LIB_EC, EC_R_MISSING_PARAMETERS}, ++ #else ++ {"MISSING_PARAMETERS", 16, 124}, ++ #endif ++ #ifdef EC_R_MISSING_PRIVATE_KEY ++ {"MISSING_PRIVATE_KEY", ERR_LIB_EC, EC_R_MISSING_PRIVATE_KEY}, ++ #else ++ {"MISSING_PRIVATE_KEY", 16, 125}, ++ #endif ++ #ifdef EC_R_NEED_NEW_SETUP_VALUES ++ {"NEED_NEW_SETUP_VALUES", ERR_LIB_EC, EC_R_NEED_NEW_SETUP_VALUES}, ++ #else ++ {"NEED_NEW_SETUP_VALUES", 16, 157}, ++ #endif ++ #ifdef EC_R_NOT_A_NIST_PRIME ++ {"NOT_A_NIST_PRIME", ERR_LIB_EC, EC_R_NOT_A_NIST_PRIME}, ++ #else ++ {"NOT_A_NIST_PRIME", 16, 135}, ++ #endif ++ #ifdef EC_R_NOT_IMPLEMENTED ++ {"NOT_IMPLEMENTED", ERR_LIB_EC, EC_R_NOT_IMPLEMENTED}, ++ #else ++ {"NOT_IMPLEMENTED", 16, 126}, ++ #endif ++ #ifdef EC_R_NOT_INITIALIZED ++ {"NOT_INITIALIZED", ERR_LIB_EC, EC_R_NOT_INITIALIZED}, ++ #else ++ {"NOT_INITIALIZED", 16, 111}, ++ #endif ++ #ifdef EC_R_NO_PARAMETERS_SET ++ {"NO_PARAMETERS_SET", ERR_LIB_EC, EC_R_NO_PARAMETERS_SET}, ++ #else ++ {"NO_PARAMETERS_SET", 16, 139}, ++ #endif ++ #ifdef EC_R_NO_PRIVATE_VALUE ++ {"NO_PRIVATE_VALUE", ERR_LIB_EC, EC_R_NO_PRIVATE_VALUE}, ++ #else ++ {"NO_PRIVATE_VALUE", 16, 154}, ++ #endif ++ #ifdef EC_R_OPERATION_NOT_SUPPORTED ++ {"OPERATION_NOT_SUPPORTED", ERR_LIB_EC, EC_R_OPERATION_NOT_SUPPORTED}, ++ #else ++ {"OPERATION_NOT_SUPPORTED", 16, 152}, ++ #endif ++ #ifdef EC_R_PASSED_NULL_PARAMETER ++ {"PASSED_NULL_PARAMETER", ERR_LIB_EC, EC_R_PASSED_NULL_PARAMETER}, ++ #else ++ {"PASSED_NULL_PARAMETER", 16, 134}, ++ #endif ++ #ifdef EC_R_PEER_KEY_ERROR ++ {"PEER_KEY_ERROR", ERR_LIB_EC, EC_R_PEER_KEY_ERROR}, ++ #else ++ {"PEER_KEY_ERROR", 16, 149}, ++ #endif ++ #ifdef EC_R_PKPARAMETERS2GROUP_FAILURE ++ {"PKPARAMETERS2GROUP_FAILURE", ERR_LIB_EC, EC_R_PKPARAMETERS2GROUP_FAILURE}, ++ #else ++ {"PKPARAMETERS2GROUP_FAILURE", 16, 127}, ++ #endif ++ #ifdef EC_R_POINT_ARITHMETIC_FAILURE ++ {"POINT_ARITHMETIC_FAILURE", ERR_LIB_EC, EC_R_POINT_ARITHMETIC_FAILURE}, ++ #else ++ {"POINT_ARITHMETIC_FAILURE", 16, 155}, ++ #endif ++ #ifdef EC_R_POINT_AT_INFINITY ++ {"POINT_AT_INFINITY", ERR_LIB_EC, EC_R_POINT_AT_INFINITY}, ++ #else ++ {"POINT_AT_INFINITY", 16, 106}, ++ #endif ++ #ifdef EC_R_POINT_COORDINATES_BLIND_FAILURE ++ {"POINT_COORDINATES_BLIND_FAILURE", ERR_LIB_EC, EC_R_POINT_COORDINATES_BLIND_FAILURE}, ++ #else ++ {"POINT_COORDINATES_BLIND_FAILURE", 16, 163}, ++ #endif ++ #ifdef EC_R_POINT_IS_NOT_ON_CURVE ++ {"POINT_IS_NOT_ON_CURVE", ERR_LIB_EC, EC_R_POINT_IS_NOT_ON_CURVE}, ++ #else ++ {"POINT_IS_NOT_ON_CURVE", 16, 107}, ++ #endif ++ #ifdef EC_R_RANDOM_NUMBER_GENERATION_FAILED ++ {"RANDOM_NUMBER_GENERATION_FAILED", ERR_LIB_EC, EC_R_RANDOM_NUMBER_GENERATION_FAILED}, ++ #else ++ {"RANDOM_NUMBER_GENERATION_FAILED", 16, 158}, ++ #endif ++ #ifdef EC_R_SHARED_INFO_ERROR ++ {"SHARED_INFO_ERROR", ERR_LIB_EC, EC_R_SHARED_INFO_ERROR}, ++ #else ++ {"SHARED_INFO_ERROR", 16, 150}, ++ #endif ++ #ifdef EC_R_SLOT_FULL ++ {"SLOT_FULL", ERR_LIB_EC, EC_R_SLOT_FULL}, ++ #else ++ {"SLOT_FULL", 16, 108}, ++ #endif ++ #ifdef EC_R_UNDEFINED_GENERATOR ++ {"UNDEFINED_GENERATOR", ERR_LIB_EC, EC_R_UNDEFINED_GENERATOR}, ++ #else ++ {"UNDEFINED_GENERATOR", 16, 113}, ++ #endif ++ #ifdef EC_R_UNDEFINED_ORDER ++ {"UNDEFINED_ORDER", ERR_LIB_EC, EC_R_UNDEFINED_ORDER}, ++ #else ++ {"UNDEFINED_ORDER", 16, 128}, ++ #endif ++ #ifdef EC_R_UNKNOWN_COFACTOR ++ {"UNKNOWN_COFACTOR", ERR_LIB_EC, EC_R_UNKNOWN_COFACTOR}, ++ #else ++ {"UNKNOWN_COFACTOR", 16, 164}, ++ #endif ++ #ifdef EC_R_UNKNOWN_GROUP ++ {"UNKNOWN_GROUP", ERR_LIB_EC, EC_R_UNKNOWN_GROUP}, ++ #else ++ {"UNKNOWN_GROUP", 16, 129}, ++ #endif ++ #ifdef EC_R_UNKNOWN_ORDER ++ {"UNKNOWN_ORDER", ERR_LIB_EC, EC_R_UNKNOWN_ORDER}, ++ #else ++ {"UNKNOWN_ORDER", 16, 114}, ++ #endif ++ #ifdef EC_R_UNSUPPORTED_FIELD ++ {"UNSUPPORTED_FIELD", ERR_LIB_EC, EC_R_UNSUPPORTED_FIELD}, ++ #else ++ {"UNSUPPORTED_FIELD", 16, 131}, ++ #endif ++ #ifdef EC_R_WRONG_CURVE_PARAMETERS ++ {"WRONG_CURVE_PARAMETERS", ERR_LIB_EC, EC_R_WRONG_CURVE_PARAMETERS}, ++ #else ++ {"WRONG_CURVE_PARAMETERS", 16, 145}, ++ #endif ++ #ifdef EC_R_WRONG_ORDER ++ {"WRONG_ORDER", ERR_LIB_EC, EC_R_WRONG_ORDER}, ++ #else ++ {"WRONG_ORDER", 16, 130}, ++ #endif ++ #ifdef ENGINE_R_ALREADY_LOADED ++ {"ALREADY_LOADED", ERR_LIB_ENGINE, ENGINE_R_ALREADY_LOADED}, ++ #else ++ {"ALREADY_LOADED", 38, 100}, ++ #endif ++ #ifdef ENGINE_R_ARGUMENT_IS_NOT_A_NUMBER ++ {"ARGUMENT_IS_NOT_A_NUMBER", ERR_LIB_ENGINE, ENGINE_R_ARGUMENT_IS_NOT_A_NUMBER}, ++ #else ++ {"ARGUMENT_IS_NOT_A_NUMBER", 38, 133}, ++ #endif ++ #ifdef ENGINE_R_CMD_NOT_EXECUTABLE ++ {"CMD_NOT_EXECUTABLE", ERR_LIB_ENGINE, ENGINE_R_CMD_NOT_EXECUTABLE}, ++ #else ++ {"CMD_NOT_EXECUTABLE", 38, 134}, ++ #endif ++ #ifdef ENGINE_R_COMMAND_TAKES_INPUT ++ {"COMMAND_TAKES_INPUT", ERR_LIB_ENGINE, ENGINE_R_COMMAND_TAKES_INPUT}, ++ #else ++ {"COMMAND_TAKES_INPUT", 38, 135}, ++ #endif ++ #ifdef ENGINE_R_COMMAND_TAKES_NO_INPUT ++ {"COMMAND_TAKES_NO_INPUT", ERR_LIB_ENGINE, ENGINE_R_COMMAND_TAKES_NO_INPUT}, ++ #else ++ {"COMMAND_TAKES_NO_INPUT", 38, 136}, ++ #endif ++ #ifdef ENGINE_R_CONFLICTING_ENGINE_ID ++ {"CONFLICTING_ENGINE_ID", ERR_LIB_ENGINE, ENGINE_R_CONFLICTING_ENGINE_ID}, ++ #else ++ {"CONFLICTING_ENGINE_ID", 38, 103}, ++ #endif ++ #ifdef ENGINE_R_CTRL_COMMAND_NOT_IMPLEMENTED ++ {"CTRL_COMMAND_NOT_IMPLEMENTED", ERR_LIB_ENGINE, ENGINE_R_CTRL_COMMAND_NOT_IMPLEMENTED}, ++ #else ++ {"CTRL_COMMAND_NOT_IMPLEMENTED", 38, 119}, ++ #endif ++ #ifdef ENGINE_R_DSO_FAILURE ++ {"DSO_FAILURE", ERR_LIB_ENGINE, ENGINE_R_DSO_FAILURE}, ++ #else ++ {"DSO_FAILURE", 38, 104}, ++ #endif ++ #ifdef ENGINE_R_DSO_NOT_FOUND ++ {"DSO_NOT_FOUND", ERR_LIB_ENGINE, ENGINE_R_DSO_NOT_FOUND}, ++ #else ++ {"DSO_NOT_FOUND", 38, 132}, ++ #endif ++ #ifdef ENGINE_R_ENGINES_SECTION_ERROR ++ {"ENGINES_SECTION_ERROR", ERR_LIB_ENGINE, ENGINE_R_ENGINES_SECTION_ERROR}, ++ #else ++ {"ENGINES_SECTION_ERROR", 38, 148}, ++ #endif ++ #ifdef ENGINE_R_ENGINE_CONFIGURATION_ERROR ++ {"ENGINE_CONFIGURATION_ERROR", ERR_LIB_ENGINE, ENGINE_R_ENGINE_CONFIGURATION_ERROR}, ++ #else ++ {"ENGINE_CONFIGURATION_ERROR", 38, 102}, ++ #endif ++ #ifdef ENGINE_R_ENGINE_IS_NOT_IN_LIST ++ {"ENGINE_IS_NOT_IN_LIST", ERR_LIB_ENGINE, ENGINE_R_ENGINE_IS_NOT_IN_LIST}, ++ #else ++ {"ENGINE_IS_NOT_IN_LIST", 38, 105}, ++ #endif ++ #ifdef ENGINE_R_ENGINE_SECTION_ERROR ++ {"ENGINE_SECTION_ERROR", ERR_LIB_ENGINE, ENGINE_R_ENGINE_SECTION_ERROR}, ++ #else ++ {"ENGINE_SECTION_ERROR", 38, 149}, ++ #endif ++ #ifdef ENGINE_R_FAILED_LOADING_PRIVATE_KEY ++ {"FAILED_LOADING_PRIVATE_KEY", ERR_LIB_ENGINE, ENGINE_R_FAILED_LOADING_PRIVATE_KEY}, ++ #else ++ {"FAILED_LOADING_PRIVATE_KEY", 38, 128}, ++ #endif ++ #ifdef ENGINE_R_FAILED_LOADING_PUBLIC_KEY ++ {"FAILED_LOADING_PUBLIC_KEY", ERR_LIB_ENGINE, ENGINE_R_FAILED_LOADING_PUBLIC_KEY}, ++ #else ++ {"FAILED_LOADING_PUBLIC_KEY", 38, 129}, ++ #endif ++ #ifdef ENGINE_R_FINISH_FAILED ++ {"FINISH_FAILED", ERR_LIB_ENGINE, ENGINE_R_FINISH_FAILED}, ++ #else ++ {"FINISH_FAILED", 38, 106}, ++ #endif ++ #ifdef ENGINE_R_ID_OR_NAME_MISSING ++ {"ID_OR_NAME_MISSING", ERR_LIB_ENGINE, ENGINE_R_ID_OR_NAME_MISSING}, ++ #else ++ {"ID_OR_NAME_MISSING", 38, 108}, ++ #endif ++ #ifdef ENGINE_R_INIT_FAILED ++ {"INIT_FAILED", ERR_LIB_ENGINE, ENGINE_R_INIT_FAILED}, ++ #else ++ {"INIT_FAILED", 38, 109}, ++ #endif ++ #ifdef ENGINE_R_INTERNAL_LIST_ERROR ++ {"INTERNAL_LIST_ERROR", ERR_LIB_ENGINE, ENGINE_R_INTERNAL_LIST_ERROR}, ++ #else ++ {"INTERNAL_LIST_ERROR", 38, 110}, ++ #endif ++ #ifdef ENGINE_R_INVALID_ARGUMENT ++ {"INVALID_ARGUMENT", ERR_LIB_ENGINE, ENGINE_R_INVALID_ARGUMENT}, ++ #else ++ {"INVALID_ARGUMENT", 38, 143}, ++ #endif ++ #ifdef ENGINE_R_INVALID_CMD_NAME ++ {"INVALID_CMD_NAME", ERR_LIB_ENGINE, ENGINE_R_INVALID_CMD_NAME}, ++ #else ++ {"INVALID_CMD_NAME", 38, 137}, ++ #endif ++ #ifdef ENGINE_R_INVALID_CMD_NUMBER ++ {"INVALID_CMD_NUMBER", ERR_LIB_ENGINE, ENGINE_R_INVALID_CMD_NUMBER}, ++ #else ++ {"INVALID_CMD_NUMBER", 38, 138}, ++ #endif ++ #ifdef ENGINE_R_INVALID_INIT_VALUE ++ {"INVALID_INIT_VALUE", ERR_LIB_ENGINE, ENGINE_R_INVALID_INIT_VALUE}, ++ #else ++ {"INVALID_INIT_VALUE", 38, 151}, ++ #endif ++ #ifdef ENGINE_R_INVALID_STRING ++ {"INVALID_STRING", ERR_LIB_ENGINE, ENGINE_R_INVALID_STRING}, ++ #else ++ {"INVALID_STRING", 38, 150}, ++ #endif ++ #ifdef ENGINE_R_NOT_INITIALISED ++ {"NOT_INITIALISED", ERR_LIB_ENGINE, ENGINE_R_NOT_INITIALISED}, ++ #else ++ {"NOT_INITIALISED", 38, 117}, ++ #endif ++ #ifdef ENGINE_R_NOT_LOADED ++ {"NOT_LOADED", ERR_LIB_ENGINE, ENGINE_R_NOT_LOADED}, ++ #else ++ {"NOT_LOADED", 38, 112}, ++ #endif ++ #ifdef ENGINE_R_NO_CONTROL_FUNCTION ++ {"NO_CONTROL_FUNCTION", ERR_LIB_ENGINE, ENGINE_R_NO_CONTROL_FUNCTION}, ++ #else ++ {"NO_CONTROL_FUNCTION", 38, 120}, ++ #endif ++ #ifdef ENGINE_R_NO_INDEX ++ {"NO_INDEX", ERR_LIB_ENGINE, ENGINE_R_NO_INDEX}, ++ #else ++ {"NO_INDEX", 38, 144}, ++ #endif ++ #ifdef ENGINE_R_NO_LOAD_FUNCTION ++ {"NO_LOAD_FUNCTION", ERR_LIB_ENGINE, ENGINE_R_NO_LOAD_FUNCTION}, ++ #else ++ {"NO_LOAD_FUNCTION", 38, 125}, ++ #endif ++ #ifdef ENGINE_R_NO_REFERENCE ++ {"NO_REFERENCE", ERR_LIB_ENGINE, ENGINE_R_NO_REFERENCE}, ++ #else ++ {"NO_REFERENCE", 38, 130}, ++ #endif ++ #ifdef ENGINE_R_NO_SUCH_ENGINE ++ {"NO_SUCH_ENGINE", ERR_LIB_ENGINE, ENGINE_R_NO_SUCH_ENGINE}, ++ #else ++ {"NO_SUCH_ENGINE", 38, 116}, ++ #endif ++ #ifdef ENGINE_R_UNIMPLEMENTED_CIPHER ++ {"UNIMPLEMENTED_CIPHER", ERR_LIB_ENGINE, ENGINE_R_UNIMPLEMENTED_CIPHER}, ++ #else ++ {"UNIMPLEMENTED_CIPHER", 38, 146}, ++ #endif ++ #ifdef ENGINE_R_UNIMPLEMENTED_DIGEST ++ {"UNIMPLEMENTED_DIGEST", ERR_LIB_ENGINE, ENGINE_R_UNIMPLEMENTED_DIGEST}, ++ #else ++ {"UNIMPLEMENTED_DIGEST", 38, 147}, ++ #endif ++ #ifdef ENGINE_R_UNIMPLEMENTED_PUBLIC_KEY_METHOD ++ {"UNIMPLEMENTED_PUBLIC_KEY_METHOD", ERR_LIB_ENGINE, ENGINE_R_UNIMPLEMENTED_PUBLIC_KEY_METHOD}, ++ #else ++ {"UNIMPLEMENTED_PUBLIC_KEY_METHOD", 38, 101}, ++ #endif ++ #ifdef ENGINE_R_VERSION_INCOMPATIBILITY ++ {"VERSION_INCOMPATIBILITY", ERR_LIB_ENGINE, ENGINE_R_VERSION_INCOMPATIBILITY}, ++ #else ++ {"VERSION_INCOMPATIBILITY", 38, 145}, ++ #endif ++ #ifdef EVP_R_AES_KEY_SETUP_FAILED ++ {"AES_KEY_SETUP_FAILED", ERR_LIB_EVP, EVP_R_AES_KEY_SETUP_FAILED}, ++ #else ++ {"AES_KEY_SETUP_FAILED", 6, 143}, ++ #endif ++ #ifdef EVP_R_ARIA_KEY_SETUP_FAILED ++ {"ARIA_KEY_SETUP_FAILED", ERR_LIB_EVP, EVP_R_ARIA_KEY_SETUP_FAILED}, ++ #else ++ {"ARIA_KEY_SETUP_FAILED", 6, 176}, ++ #endif ++ #ifdef EVP_R_BAD_DECRYPT ++ {"BAD_DECRYPT", ERR_LIB_EVP, EVP_R_BAD_DECRYPT}, ++ #else ++ {"BAD_DECRYPT", 6, 100}, ++ #endif ++ #ifdef EVP_R_BAD_KEY_LENGTH ++ {"BAD_KEY_LENGTH", ERR_LIB_EVP, EVP_R_BAD_KEY_LENGTH}, ++ #else ++ {"BAD_KEY_LENGTH", 6, 195}, ++ #endif ++ #ifdef EVP_R_BUFFER_TOO_SMALL ++ {"BUFFER_TOO_SMALL", ERR_LIB_EVP, EVP_R_BUFFER_TOO_SMALL}, ++ #else ++ {"BUFFER_TOO_SMALL", 6, 155}, ++ #endif ++ #ifdef EVP_R_CAMELLIA_KEY_SETUP_FAILED ++ {"CAMELLIA_KEY_SETUP_FAILED", ERR_LIB_EVP, EVP_R_CAMELLIA_KEY_SETUP_FAILED}, ++ #else ++ {"CAMELLIA_KEY_SETUP_FAILED", 6, 157}, ++ #endif ++ #ifdef EVP_R_CIPHER_PARAMETER_ERROR ++ {"CIPHER_PARAMETER_ERROR", ERR_LIB_EVP, EVP_R_CIPHER_PARAMETER_ERROR}, ++ #else ++ {"CIPHER_PARAMETER_ERROR", 6, 122}, ++ #endif ++ #ifdef EVP_R_COMMAND_NOT_SUPPORTED ++ {"COMMAND_NOT_SUPPORTED", ERR_LIB_EVP, EVP_R_COMMAND_NOT_SUPPORTED}, ++ #else ++ {"COMMAND_NOT_SUPPORTED", 6, 147}, ++ #endif ++ #ifdef EVP_R_COPY_ERROR ++ {"COPY_ERROR", ERR_LIB_EVP, EVP_R_COPY_ERROR}, ++ #else ++ {"COPY_ERROR", 6, 173}, ++ #endif ++ #ifdef EVP_R_CTRL_NOT_IMPLEMENTED ++ {"CTRL_NOT_IMPLEMENTED", ERR_LIB_EVP, EVP_R_CTRL_NOT_IMPLEMENTED}, ++ #else ++ {"CTRL_NOT_IMPLEMENTED", 6, 132}, ++ #endif ++ #ifdef EVP_R_CTRL_OPERATION_NOT_IMPLEMENTED ++ {"CTRL_OPERATION_NOT_IMPLEMENTED", ERR_LIB_EVP, EVP_R_CTRL_OPERATION_NOT_IMPLEMENTED}, ++ #else ++ {"CTRL_OPERATION_NOT_IMPLEMENTED", 6, 133}, ++ #endif ++ #ifdef EVP_R_DATA_NOT_MULTIPLE_OF_BLOCK_LENGTH ++ {"DATA_NOT_MULTIPLE_OF_BLOCK_LENGTH", ERR_LIB_EVP, EVP_R_DATA_NOT_MULTIPLE_OF_BLOCK_LENGTH}, ++ #else ++ {"DATA_NOT_MULTIPLE_OF_BLOCK_LENGTH", 6, 138}, ++ #endif ++ #ifdef EVP_R_DECODE_ERROR ++ {"DECODE_ERROR", ERR_LIB_EVP, EVP_R_DECODE_ERROR}, ++ #else ++ {"DECODE_ERROR", 6, 114}, ++ #endif ++ #ifdef EVP_R_DIFFERENT_KEY_TYPES ++ {"DIFFERENT_KEY_TYPES", ERR_LIB_EVP, EVP_R_DIFFERENT_KEY_TYPES}, ++ #else ++ {"DIFFERENT_KEY_TYPES", 6, 101}, ++ #endif ++ #ifdef EVP_R_DIFFERENT_PARAMETERS ++ {"DIFFERENT_PARAMETERS", ERR_LIB_EVP, EVP_R_DIFFERENT_PARAMETERS}, ++ #else ++ {"DIFFERENT_PARAMETERS", 6, 153}, ++ #endif ++ #ifdef EVP_R_ERROR_LOADING_SECTION ++ {"ERROR_LOADING_SECTION", ERR_LIB_EVP, EVP_R_ERROR_LOADING_SECTION}, ++ #else ++ {"ERROR_LOADING_SECTION", 6, 165}, ++ #endif ++ #ifdef EVP_R_ERROR_SETTING_FIPS_MODE ++ {"ERROR_SETTING_FIPS_MODE", ERR_LIB_EVP, EVP_R_ERROR_SETTING_FIPS_MODE}, ++ #else ++ {"ERROR_SETTING_FIPS_MODE", 6, 166}, ++ #endif ++ #ifdef EVP_R_EXPECTING_AN_HMAC_KEY ++ {"EXPECTING_AN_HMAC_KEY", ERR_LIB_EVP, EVP_R_EXPECTING_AN_HMAC_KEY}, ++ #else ++ {"EXPECTING_AN_HMAC_KEY", 6, 174}, ++ #endif ++ #ifdef EVP_R_EXPECTING_AN_RSA_KEY ++ {"EXPECTING_AN_RSA_KEY", ERR_LIB_EVP, EVP_R_EXPECTING_AN_RSA_KEY}, ++ #else ++ {"EXPECTING_AN_RSA_KEY", 6, 127}, ++ #endif ++ #ifdef EVP_R_EXPECTING_A_DH_KEY ++ {"EXPECTING_A_DH_KEY", ERR_LIB_EVP, EVP_R_EXPECTING_A_DH_KEY}, ++ #else ++ {"EXPECTING_A_DH_KEY", 6, 128}, ++ #endif ++ #ifdef EVP_R_EXPECTING_A_DSA_KEY ++ {"EXPECTING_A_DSA_KEY", ERR_LIB_EVP, EVP_R_EXPECTING_A_DSA_KEY}, ++ #else ++ {"EXPECTING_A_DSA_KEY", 6, 129}, ++ #endif ++ #ifdef EVP_R_EXPECTING_A_EC_KEY ++ {"EXPECTING_A_EC_KEY", ERR_LIB_EVP, EVP_R_EXPECTING_A_EC_KEY}, ++ #else ++ {"EXPECTING_A_EC_KEY", 6, 142}, ++ #endif ++ #ifdef EVP_R_EXPECTING_A_POLY1305_KEY ++ {"EXPECTING_A_POLY1305_KEY", ERR_LIB_EVP, EVP_R_EXPECTING_A_POLY1305_KEY}, ++ #else ++ {"EXPECTING_A_POLY1305_KEY", 6, 164}, ++ #endif ++ #ifdef EVP_R_EXPECTING_A_SIPHASH_KEY ++ {"EXPECTING_A_SIPHASH_KEY", ERR_LIB_EVP, EVP_R_EXPECTING_A_SIPHASH_KEY}, ++ #else ++ {"EXPECTING_A_SIPHASH_KEY", 6, 175}, ++ #endif ++ #ifdef EVP_R_FIPS_MODE_NOT_SUPPORTED ++ {"FIPS_MODE_NOT_SUPPORTED", ERR_LIB_EVP, EVP_R_FIPS_MODE_NOT_SUPPORTED}, ++ #else ++ {"FIPS_MODE_NOT_SUPPORTED", 6, 167}, ++ #endif ++ #ifdef EVP_R_GET_RAW_KEY_FAILED ++ {"GET_RAW_KEY_FAILED", ERR_LIB_EVP, EVP_R_GET_RAW_KEY_FAILED}, ++ #else ++ {"GET_RAW_KEY_FAILED", 6, 182}, ++ #endif ++ #ifdef EVP_R_ILLEGAL_SCRYPT_PARAMETERS ++ {"ILLEGAL_SCRYPT_PARAMETERS", ERR_LIB_EVP, EVP_R_ILLEGAL_SCRYPT_PARAMETERS}, ++ #else ++ {"ILLEGAL_SCRYPT_PARAMETERS", 6, 171}, ++ #endif ++ #ifdef EVP_R_INITIALIZATION_ERROR ++ {"INITIALIZATION_ERROR", ERR_LIB_EVP, EVP_R_INITIALIZATION_ERROR}, ++ #else ++ {"INITIALIZATION_ERROR", 6, 134}, ++ #endif ++ #ifdef EVP_R_INPUT_NOT_INITIALIZED ++ {"INPUT_NOT_INITIALIZED", ERR_LIB_EVP, EVP_R_INPUT_NOT_INITIALIZED}, ++ #else ++ {"INPUT_NOT_INITIALIZED", 6, 111}, ++ #endif ++ #ifdef EVP_R_INVALID_DIGEST ++ {"INVALID_DIGEST", ERR_LIB_EVP, EVP_R_INVALID_DIGEST}, ++ #else ++ {"INVALID_DIGEST", 6, 152}, ++ #endif ++ #ifdef EVP_R_INVALID_FIPS_MODE ++ {"INVALID_FIPS_MODE", ERR_LIB_EVP, EVP_R_INVALID_FIPS_MODE}, ++ #else ++ {"INVALID_FIPS_MODE", 6, 168}, ++ #endif ++ #ifdef EVP_R_INVALID_IV_LENGTH ++ {"INVALID_IV_LENGTH", ERR_LIB_EVP, EVP_R_INVALID_IV_LENGTH}, ++ #else ++ {"INVALID_IV_LENGTH", 6, 194}, ++ #endif ++ #ifdef EVP_R_INVALID_KEY ++ {"INVALID_KEY", ERR_LIB_EVP, EVP_R_INVALID_KEY}, ++ #else ++ {"INVALID_KEY", 6, 163}, ++ #endif ++ #ifdef EVP_R_INVALID_KEY_LENGTH ++ {"INVALID_KEY_LENGTH", ERR_LIB_EVP, EVP_R_INVALID_KEY_LENGTH}, ++ #else ++ {"INVALID_KEY_LENGTH", 6, 130}, ++ #endif ++ #ifdef EVP_R_INVALID_OPERATION ++ {"INVALID_OPERATION", ERR_LIB_EVP, EVP_R_INVALID_OPERATION}, ++ #else ++ {"INVALID_OPERATION", 6, 148}, ++ #endif ++ #ifdef EVP_R_KEYGEN_FAILURE ++ {"KEYGEN_FAILURE", ERR_LIB_EVP, EVP_R_KEYGEN_FAILURE}, ++ #else ++ {"KEYGEN_FAILURE", 6, 120}, ++ #endif ++ #ifdef EVP_R_KEY_SETUP_FAILED ++ {"KEY_SETUP_FAILED", ERR_LIB_EVP, EVP_R_KEY_SETUP_FAILED}, ++ #else ++ {"KEY_SETUP_FAILED", 6, 180}, ++ #endif ++ #ifdef EVP_R_MEMORY_LIMIT_EXCEEDED ++ {"MEMORY_LIMIT_EXCEEDED", ERR_LIB_EVP, EVP_R_MEMORY_LIMIT_EXCEEDED}, ++ #else ++ {"MEMORY_LIMIT_EXCEEDED", 6, 172}, ++ #endif ++ #ifdef EVP_R_MESSAGE_DIGEST_IS_NULL ++ {"MESSAGE_DIGEST_IS_NULL", ERR_LIB_EVP, EVP_R_MESSAGE_DIGEST_IS_NULL}, ++ #else ++ {"MESSAGE_DIGEST_IS_NULL", 6, 159}, ++ #endif ++ #ifdef EVP_R_METHOD_NOT_SUPPORTED ++ {"METHOD_NOT_SUPPORTED", ERR_LIB_EVP, EVP_R_METHOD_NOT_SUPPORTED}, ++ #else ++ {"METHOD_NOT_SUPPORTED", 6, 144}, ++ #endif ++ #ifdef EVP_R_MISSING_PARAMETERS ++ {"MISSING_PARAMETERS", ERR_LIB_EVP, EVP_R_MISSING_PARAMETERS}, ++ #else ++ {"MISSING_PARAMETERS", 6, 103}, ++ #endif ++ #ifdef EVP_R_NOT_XOF_OR_INVALID_LENGTH ++ {"NOT_XOF_OR_INVALID_LENGTH", ERR_LIB_EVP, EVP_R_NOT_XOF_OR_INVALID_LENGTH}, ++ #else ++ {"NOT_XOF_OR_INVALID_LENGTH", 6, 178}, ++ #endif ++ #ifdef EVP_R_NO_CIPHER_SET ++ {"NO_CIPHER_SET", ERR_LIB_EVP, EVP_R_NO_CIPHER_SET}, ++ #else ++ {"NO_CIPHER_SET", 6, 131}, ++ #endif ++ #ifdef EVP_R_NO_DEFAULT_DIGEST ++ {"NO_DEFAULT_DIGEST", ERR_LIB_EVP, EVP_R_NO_DEFAULT_DIGEST}, ++ #else ++ {"NO_DEFAULT_DIGEST", 6, 158}, ++ #endif ++ #ifdef EVP_R_NO_DIGEST_SET ++ {"NO_DIGEST_SET", ERR_LIB_EVP, EVP_R_NO_DIGEST_SET}, ++ #else ++ {"NO_DIGEST_SET", 6, 139}, ++ #endif ++ #ifdef EVP_R_NO_KEY_SET ++ {"NO_KEY_SET", ERR_LIB_EVP, EVP_R_NO_KEY_SET}, ++ #else ++ {"NO_KEY_SET", 6, 154}, ++ #endif ++ #ifdef EVP_R_NO_OPERATION_SET ++ {"NO_OPERATION_SET", ERR_LIB_EVP, EVP_R_NO_OPERATION_SET}, ++ #else ++ {"NO_OPERATION_SET", 6, 149}, ++ #endif ++ #ifdef EVP_R_ONLY_ONESHOT_SUPPORTED ++ {"ONLY_ONESHOT_SUPPORTED", ERR_LIB_EVP, EVP_R_ONLY_ONESHOT_SUPPORTED}, ++ #else ++ {"ONLY_ONESHOT_SUPPORTED", 6, 177}, ++ #endif ++ #ifdef EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE ++ {"OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE", ERR_LIB_EVP, EVP_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE}, ++ #else ++ {"OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE", 6, 150}, ++ #endif ++ #ifdef EVP_R_OPERATON_NOT_INITIALIZED ++ {"OPERATON_NOT_INITIALIZED", ERR_LIB_EVP, EVP_R_OPERATON_NOT_INITIALIZED}, ++ #else ++ {"OPERATON_NOT_INITIALIZED", 6, 151}, ++ #endif ++ #ifdef EVP_R_PARTIALLY_OVERLAPPING ++ {"PARTIALLY_OVERLAPPING", ERR_LIB_EVP, EVP_R_PARTIALLY_OVERLAPPING}, ++ #else ++ {"PARTIALLY_OVERLAPPING", 6, 162}, ++ #endif ++ #ifdef EVP_R_PBKDF2_ERROR ++ {"PBKDF2_ERROR", ERR_LIB_EVP, EVP_R_PBKDF2_ERROR}, ++ #else ++ {"PBKDF2_ERROR", 6, 181}, ++ #endif ++ #ifdef EVP_R_PKEY_APPLICATION_ASN1_METHOD_ALREADY_REGISTERED ++ {"PKEY_APPLICATION_ASN1_METHOD_ALREADY_REGISTERED", ERR_LIB_EVP, EVP_R_PKEY_APPLICATION_ASN1_METHOD_ALREADY_REGISTERED}, ++ #else ++ {"PKEY_APPLICATION_ASN1_METHOD_ALREADY_REGISTERED", 6, 179}, ++ #endif ++ #ifdef EVP_R_PRIVATE_KEY_DECODE_ERROR ++ {"PRIVATE_KEY_DECODE_ERROR", ERR_LIB_EVP, EVP_R_PRIVATE_KEY_DECODE_ERROR}, ++ #else ++ {"PRIVATE_KEY_DECODE_ERROR", 6, 145}, ++ #endif ++ #ifdef EVP_R_PRIVATE_KEY_ENCODE_ERROR ++ {"PRIVATE_KEY_ENCODE_ERROR", ERR_LIB_EVP, EVP_R_PRIVATE_KEY_ENCODE_ERROR}, ++ #else ++ {"PRIVATE_KEY_ENCODE_ERROR", 6, 146}, ++ #endif ++ #ifdef EVP_R_PUBLIC_KEY_NOT_RSA ++ {"PUBLIC_KEY_NOT_RSA", ERR_LIB_EVP, EVP_R_PUBLIC_KEY_NOT_RSA}, ++ #else ++ {"PUBLIC_KEY_NOT_RSA", 6, 106}, ++ #endif ++ #ifdef EVP_R_UNKNOWN_CIPHER ++ {"UNKNOWN_CIPHER", ERR_LIB_EVP, EVP_R_UNKNOWN_CIPHER}, ++ #else ++ {"UNKNOWN_CIPHER", 6, 160}, ++ #endif ++ #ifdef EVP_R_UNKNOWN_DIGEST ++ {"UNKNOWN_DIGEST", ERR_LIB_EVP, EVP_R_UNKNOWN_DIGEST}, ++ #else ++ {"UNKNOWN_DIGEST", 6, 161}, ++ #endif ++ #ifdef EVP_R_UNKNOWN_OPTION ++ {"UNKNOWN_OPTION", ERR_LIB_EVP, EVP_R_UNKNOWN_OPTION}, ++ #else ++ {"UNKNOWN_OPTION", 6, 169}, ++ #endif ++ #ifdef EVP_R_UNKNOWN_PBE_ALGORITHM ++ {"UNKNOWN_PBE_ALGORITHM", ERR_LIB_EVP, EVP_R_UNKNOWN_PBE_ALGORITHM}, ++ #else ++ {"UNKNOWN_PBE_ALGORITHM", 6, 121}, ++ #endif ++ #ifdef EVP_R_UNSUPPORTED_ALGORITHM ++ {"UNSUPPORTED_ALGORITHM", ERR_LIB_EVP, EVP_R_UNSUPPORTED_ALGORITHM}, ++ #else ++ {"UNSUPPORTED_ALGORITHM", 6, 156}, ++ #endif ++ #ifdef EVP_R_UNSUPPORTED_CIPHER ++ {"UNSUPPORTED_CIPHER", ERR_LIB_EVP, EVP_R_UNSUPPORTED_CIPHER}, ++ #else ++ {"UNSUPPORTED_CIPHER", 6, 107}, ++ #endif ++ #ifdef EVP_R_UNSUPPORTED_KEYLENGTH ++ {"UNSUPPORTED_KEYLENGTH", ERR_LIB_EVP, EVP_R_UNSUPPORTED_KEYLENGTH}, ++ #else ++ {"UNSUPPORTED_KEYLENGTH", 6, 123}, ++ #endif ++ #ifdef EVP_R_UNSUPPORTED_KEY_DERIVATION_FUNCTION ++ {"UNSUPPORTED_KEY_DERIVATION_FUNCTION", ERR_LIB_EVP, EVP_R_UNSUPPORTED_KEY_DERIVATION_FUNCTION}, ++ #else ++ {"UNSUPPORTED_KEY_DERIVATION_FUNCTION", 6, 124}, ++ #endif ++ #ifdef EVP_R_UNSUPPORTED_KEY_SIZE ++ {"UNSUPPORTED_KEY_SIZE", ERR_LIB_EVP, EVP_R_UNSUPPORTED_KEY_SIZE}, ++ #else ++ {"UNSUPPORTED_KEY_SIZE", 6, 108}, ++ #endif ++ #ifdef EVP_R_UNSUPPORTED_NUMBER_OF_ROUNDS ++ {"UNSUPPORTED_NUMBER_OF_ROUNDS", ERR_LIB_EVP, EVP_R_UNSUPPORTED_NUMBER_OF_ROUNDS}, ++ #else ++ {"UNSUPPORTED_NUMBER_OF_ROUNDS", 6, 135}, ++ #endif ++ #ifdef EVP_R_UNSUPPORTED_PRF ++ {"UNSUPPORTED_PRF", ERR_LIB_EVP, EVP_R_UNSUPPORTED_PRF}, ++ #else ++ {"UNSUPPORTED_PRF", 6, 125}, ++ #endif ++ #ifdef EVP_R_UNSUPPORTED_PRIVATE_KEY_ALGORITHM ++ {"UNSUPPORTED_PRIVATE_KEY_ALGORITHM", ERR_LIB_EVP, EVP_R_UNSUPPORTED_PRIVATE_KEY_ALGORITHM}, ++ #else ++ {"UNSUPPORTED_PRIVATE_KEY_ALGORITHM", 6, 118}, ++ #endif ++ #ifdef EVP_R_UNSUPPORTED_SALT_TYPE ++ {"UNSUPPORTED_SALT_TYPE", ERR_LIB_EVP, EVP_R_UNSUPPORTED_SALT_TYPE}, ++ #else ++ {"UNSUPPORTED_SALT_TYPE", 6, 126}, ++ #endif ++ #ifdef EVP_R_WRAP_MODE_NOT_ALLOWED ++ {"WRAP_MODE_NOT_ALLOWED", ERR_LIB_EVP, EVP_R_WRAP_MODE_NOT_ALLOWED}, ++ #else ++ {"WRAP_MODE_NOT_ALLOWED", 6, 170}, ++ #endif ++ #ifdef EVP_R_WRONG_FINAL_BLOCK_LENGTH ++ {"WRONG_FINAL_BLOCK_LENGTH", ERR_LIB_EVP, EVP_R_WRONG_FINAL_BLOCK_LENGTH}, ++ #else ++ {"WRONG_FINAL_BLOCK_LENGTH", 6, 109}, ++ #endif ++ #ifdef EVP_R_XTS_DUPLICATED_KEYS ++ {"XTS_DUPLICATED_KEYS", ERR_LIB_EVP, EVP_R_XTS_DUPLICATED_KEYS}, ++ #else ++ {"XTS_DUPLICATED_KEYS", 6, 183}, ++ #endif ++ #ifdef KDF_R_INVALID_DIGEST ++ {"INVALID_DIGEST", ERR_LIB_KDF, KDF_R_INVALID_DIGEST}, ++ #else ++ {"INVALID_DIGEST", 52, 100}, ++ #endif ++ #ifdef KDF_R_MISSING_ITERATION_COUNT ++ {"MISSING_ITERATION_COUNT", ERR_LIB_KDF, KDF_R_MISSING_ITERATION_COUNT}, ++ #else ++ {"MISSING_ITERATION_COUNT", 52, 109}, ++ #endif ++ #ifdef KDF_R_MISSING_KEY ++ {"MISSING_KEY", ERR_LIB_KDF, KDF_R_MISSING_KEY}, ++ #else ++ {"MISSING_KEY", 52, 104}, ++ #endif ++ #ifdef KDF_R_MISSING_MESSAGE_DIGEST ++ {"MISSING_MESSAGE_DIGEST", ERR_LIB_KDF, KDF_R_MISSING_MESSAGE_DIGEST}, ++ #else ++ {"MISSING_MESSAGE_DIGEST", 52, 105}, ++ #endif ++ #ifdef KDF_R_MISSING_PARAMETER ++ {"MISSING_PARAMETER", ERR_LIB_KDF, KDF_R_MISSING_PARAMETER}, ++ #else ++ {"MISSING_PARAMETER", 52, 101}, ++ #endif ++ #ifdef KDF_R_MISSING_PASS ++ {"MISSING_PASS", ERR_LIB_KDF, KDF_R_MISSING_PASS}, ++ #else ++ {"MISSING_PASS", 52, 110}, ++ #endif ++ #ifdef KDF_R_MISSING_SALT ++ {"MISSING_SALT", ERR_LIB_KDF, KDF_R_MISSING_SALT}, ++ #else ++ {"MISSING_SALT", 52, 111}, ++ #endif ++ #ifdef KDF_R_MISSING_SECRET ++ {"MISSING_SECRET", ERR_LIB_KDF, KDF_R_MISSING_SECRET}, ++ #else ++ {"MISSING_SECRET", 52, 107}, ++ #endif ++ #ifdef KDF_R_MISSING_SEED ++ {"MISSING_SEED", ERR_LIB_KDF, KDF_R_MISSING_SEED}, ++ #else ++ {"MISSING_SEED", 52, 106}, ++ #endif ++ #ifdef KDF_R_UNKNOWN_PARAMETER_TYPE ++ {"UNKNOWN_PARAMETER_TYPE", ERR_LIB_KDF, KDF_R_UNKNOWN_PARAMETER_TYPE}, ++ #else ++ {"UNKNOWN_PARAMETER_TYPE", 52, 103}, ++ #endif ++ #ifdef KDF_R_VALUE_ERROR ++ {"VALUE_ERROR", ERR_LIB_KDF, KDF_R_VALUE_ERROR}, ++ #else ++ {"VALUE_ERROR", 52, 108}, ++ #endif ++ #ifdef KDF_R_VALUE_MISSING ++ {"VALUE_MISSING", ERR_LIB_KDF, KDF_R_VALUE_MISSING}, ++ #else ++ {"VALUE_MISSING", 52, 102}, ++ #endif ++ #ifdef OCSP_R_CERTIFICATE_VERIFY_ERROR ++ {"CERTIFICATE_VERIFY_ERROR", ERR_LIB_OCSP, OCSP_R_CERTIFICATE_VERIFY_ERROR}, ++ #else ++ {"CERTIFICATE_VERIFY_ERROR", 39, 101}, ++ #endif ++ #ifdef OCSP_R_DIGEST_ERR ++ {"DIGEST_ERR", ERR_LIB_OCSP, OCSP_R_DIGEST_ERR}, ++ #else ++ {"DIGEST_ERR", 39, 102}, ++ #endif ++ #ifdef OCSP_R_ERROR_IN_NEXTUPDATE_FIELD ++ {"ERROR_IN_NEXTUPDATE_FIELD", ERR_LIB_OCSP, OCSP_R_ERROR_IN_NEXTUPDATE_FIELD}, ++ #else ++ {"ERROR_IN_NEXTUPDATE_FIELD", 39, 122}, ++ #endif ++ #ifdef OCSP_R_ERROR_IN_THISUPDATE_FIELD ++ {"ERROR_IN_THISUPDATE_FIELD", ERR_LIB_OCSP, OCSP_R_ERROR_IN_THISUPDATE_FIELD}, ++ #else ++ {"ERROR_IN_THISUPDATE_FIELD", 39, 123}, ++ #endif ++ #ifdef OCSP_R_ERROR_PARSING_URL ++ {"ERROR_PARSING_URL", ERR_LIB_OCSP, OCSP_R_ERROR_PARSING_URL}, ++ #else ++ {"ERROR_PARSING_URL", 39, 121}, ++ #endif ++ #ifdef OCSP_R_MISSING_OCSPSIGNING_USAGE ++ {"MISSING_OCSPSIGNING_USAGE", ERR_LIB_OCSP, OCSP_R_MISSING_OCSPSIGNING_USAGE}, ++ #else ++ {"MISSING_OCSPSIGNING_USAGE", 39, 103}, ++ #endif ++ #ifdef OCSP_R_NEXTUPDATE_BEFORE_THISUPDATE ++ {"NEXTUPDATE_BEFORE_THISUPDATE", ERR_LIB_OCSP, OCSP_R_NEXTUPDATE_BEFORE_THISUPDATE}, ++ #else ++ {"NEXTUPDATE_BEFORE_THISUPDATE", 39, 124}, ++ #endif ++ #ifdef OCSP_R_NOT_BASIC_RESPONSE ++ {"NOT_BASIC_RESPONSE", ERR_LIB_OCSP, OCSP_R_NOT_BASIC_RESPONSE}, ++ #else ++ {"NOT_BASIC_RESPONSE", 39, 104}, ++ #endif ++ #ifdef OCSP_R_NO_CERTIFICATES_IN_CHAIN ++ {"NO_CERTIFICATES_IN_CHAIN", ERR_LIB_OCSP, OCSP_R_NO_CERTIFICATES_IN_CHAIN}, ++ #else ++ {"NO_CERTIFICATES_IN_CHAIN", 39, 105}, ++ #endif ++ #ifdef OCSP_R_NO_RESPONSE_DATA ++ {"NO_RESPONSE_DATA", ERR_LIB_OCSP, OCSP_R_NO_RESPONSE_DATA}, ++ #else ++ {"NO_RESPONSE_DATA", 39, 108}, ++ #endif ++ #ifdef OCSP_R_NO_REVOKED_TIME ++ {"NO_REVOKED_TIME", ERR_LIB_OCSP, OCSP_R_NO_REVOKED_TIME}, ++ #else ++ {"NO_REVOKED_TIME", 39, 109}, ++ #endif ++ #ifdef OCSP_R_NO_SIGNER_KEY ++ {"NO_SIGNER_KEY", ERR_LIB_OCSP, OCSP_R_NO_SIGNER_KEY}, ++ #else ++ {"NO_SIGNER_KEY", 39, 130}, ++ #endif ++ #ifdef OCSP_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE ++ {"PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE", ERR_LIB_OCSP, OCSP_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE}, ++ #else ++ {"PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE", 39, 110}, ++ #endif ++ #ifdef OCSP_R_REQUEST_NOT_SIGNED ++ {"REQUEST_NOT_SIGNED", ERR_LIB_OCSP, OCSP_R_REQUEST_NOT_SIGNED}, ++ #else ++ {"REQUEST_NOT_SIGNED", 39, 128}, ++ #endif ++ #ifdef OCSP_R_RESPONSE_CONTAINS_NO_REVOCATION_DATA ++ {"RESPONSE_CONTAINS_NO_REVOCATION_DATA", ERR_LIB_OCSP, OCSP_R_RESPONSE_CONTAINS_NO_REVOCATION_DATA}, ++ #else ++ {"RESPONSE_CONTAINS_NO_REVOCATION_DATA", 39, 111}, ++ #endif ++ #ifdef OCSP_R_ROOT_CA_NOT_TRUSTED ++ {"ROOT_CA_NOT_TRUSTED", ERR_LIB_OCSP, OCSP_R_ROOT_CA_NOT_TRUSTED}, ++ #else ++ {"ROOT_CA_NOT_TRUSTED", 39, 112}, ++ #endif ++ #ifdef OCSP_R_SERVER_RESPONSE_ERROR ++ {"SERVER_RESPONSE_ERROR", ERR_LIB_OCSP, OCSP_R_SERVER_RESPONSE_ERROR}, ++ #else ++ {"SERVER_RESPONSE_ERROR", 39, 114}, ++ #endif ++ #ifdef OCSP_R_SERVER_RESPONSE_PARSE_ERROR ++ {"SERVER_RESPONSE_PARSE_ERROR", ERR_LIB_OCSP, OCSP_R_SERVER_RESPONSE_PARSE_ERROR}, ++ #else ++ {"SERVER_RESPONSE_PARSE_ERROR", 39, 115}, ++ #endif ++ #ifdef OCSP_R_SIGNATURE_FAILURE ++ {"SIGNATURE_FAILURE", ERR_LIB_OCSP, OCSP_R_SIGNATURE_FAILURE}, ++ #else ++ {"SIGNATURE_FAILURE", 39, 117}, ++ #endif ++ #ifdef OCSP_R_SIGNER_CERTIFICATE_NOT_FOUND ++ {"SIGNER_CERTIFICATE_NOT_FOUND", ERR_LIB_OCSP, OCSP_R_SIGNER_CERTIFICATE_NOT_FOUND}, ++ #else ++ {"SIGNER_CERTIFICATE_NOT_FOUND", 39, 118}, ++ #endif ++ #ifdef OCSP_R_STATUS_EXPIRED ++ {"STATUS_EXPIRED", ERR_LIB_OCSP, OCSP_R_STATUS_EXPIRED}, ++ #else ++ {"STATUS_EXPIRED", 39, 125}, ++ #endif ++ #ifdef OCSP_R_STATUS_NOT_YET_VALID ++ {"STATUS_NOT_YET_VALID", ERR_LIB_OCSP, OCSP_R_STATUS_NOT_YET_VALID}, ++ #else ++ {"STATUS_NOT_YET_VALID", 39, 126}, ++ #endif ++ #ifdef OCSP_R_STATUS_TOO_OLD ++ {"STATUS_TOO_OLD", ERR_LIB_OCSP, OCSP_R_STATUS_TOO_OLD}, ++ #else ++ {"STATUS_TOO_OLD", 39, 127}, ++ #endif ++ #ifdef OCSP_R_UNKNOWN_MESSAGE_DIGEST ++ {"UNKNOWN_MESSAGE_DIGEST", ERR_LIB_OCSP, OCSP_R_UNKNOWN_MESSAGE_DIGEST}, ++ #else ++ {"UNKNOWN_MESSAGE_DIGEST", 39, 119}, ++ #endif ++ #ifdef OCSP_R_UNKNOWN_NID ++ {"UNKNOWN_NID", ERR_LIB_OCSP, OCSP_R_UNKNOWN_NID}, ++ #else ++ {"UNKNOWN_NID", 39, 120}, ++ #endif ++ #ifdef OCSP_R_UNSUPPORTED_REQUESTORNAME_TYPE ++ {"UNSUPPORTED_REQUESTORNAME_TYPE", ERR_LIB_OCSP, OCSP_R_UNSUPPORTED_REQUESTORNAME_TYPE}, ++ #else ++ {"UNSUPPORTED_REQUESTORNAME_TYPE", 39, 129}, ++ #endif ++ #ifdef PEM_R_BAD_BASE64_DECODE ++ {"BAD_BASE64_DECODE", ERR_LIB_PEM, PEM_R_BAD_BASE64_DECODE}, ++ #else ++ {"BAD_BASE64_DECODE", 9, 100}, ++ #endif ++ #ifdef PEM_R_BAD_DECRYPT ++ {"BAD_DECRYPT", ERR_LIB_PEM, PEM_R_BAD_DECRYPT}, ++ #else ++ {"BAD_DECRYPT", 9, 101}, ++ #endif ++ #ifdef PEM_R_BAD_END_LINE ++ {"BAD_END_LINE", ERR_LIB_PEM, PEM_R_BAD_END_LINE}, ++ #else ++ {"BAD_END_LINE", 9, 102}, ++ #endif ++ #ifdef PEM_R_BAD_IV_CHARS ++ {"BAD_IV_CHARS", ERR_LIB_PEM, PEM_R_BAD_IV_CHARS}, ++ #else ++ {"BAD_IV_CHARS", 9, 103}, ++ #endif ++ #ifdef PEM_R_BAD_MAGIC_NUMBER ++ {"BAD_MAGIC_NUMBER", ERR_LIB_PEM, PEM_R_BAD_MAGIC_NUMBER}, ++ #else ++ {"BAD_MAGIC_NUMBER", 9, 116}, ++ #endif ++ #ifdef PEM_R_BAD_PASSWORD_READ ++ {"BAD_PASSWORD_READ", ERR_LIB_PEM, PEM_R_BAD_PASSWORD_READ}, ++ #else ++ {"BAD_PASSWORD_READ", 9, 104}, ++ #endif ++ #ifdef PEM_R_BAD_VERSION_NUMBER ++ {"BAD_VERSION_NUMBER", ERR_LIB_PEM, PEM_R_BAD_VERSION_NUMBER}, ++ #else ++ {"BAD_VERSION_NUMBER", 9, 117}, ++ #endif ++ #ifdef PEM_R_BIO_WRITE_FAILURE ++ {"BIO_WRITE_FAILURE", ERR_LIB_PEM, PEM_R_BIO_WRITE_FAILURE}, ++ #else ++ {"BIO_WRITE_FAILURE", 9, 118}, ++ #endif ++ #ifdef PEM_R_CIPHER_IS_NULL ++ {"CIPHER_IS_NULL", ERR_LIB_PEM, PEM_R_CIPHER_IS_NULL}, ++ #else ++ {"CIPHER_IS_NULL", 9, 127}, ++ #endif ++ #ifdef PEM_R_ERROR_CONVERTING_PRIVATE_KEY ++ {"ERROR_CONVERTING_PRIVATE_KEY", ERR_LIB_PEM, PEM_R_ERROR_CONVERTING_PRIVATE_KEY}, ++ #else ++ {"ERROR_CONVERTING_PRIVATE_KEY", 9, 115}, ++ #endif ++ #ifdef PEM_R_EXPECTING_PRIVATE_KEY_BLOB ++ {"EXPECTING_PRIVATE_KEY_BLOB", ERR_LIB_PEM, PEM_R_EXPECTING_PRIVATE_KEY_BLOB}, ++ #else ++ {"EXPECTING_PRIVATE_KEY_BLOB", 9, 119}, ++ #endif ++ #ifdef PEM_R_EXPECTING_PUBLIC_KEY_BLOB ++ {"EXPECTING_PUBLIC_KEY_BLOB", ERR_LIB_PEM, PEM_R_EXPECTING_PUBLIC_KEY_BLOB}, ++ #else ++ {"EXPECTING_PUBLIC_KEY_BLOB", 9, 120}, ++ #endif ++ #ifdef PEM_R_HEADER_TOO_LONG ++ {"HEADER_TOO_LONG", ERR_LIB_PEM, PEM_R_HEADER_TOO_LONG}, ++ #else ++ {"HEADER_TOO_LONG", 9, 128}, ++ #endif ++ #ifdef PEM_R_INCONSISTENT_HEADER ++ {"INCONSISTENT_HEADER", ERR_LIB_PEM, PEM_R_INCONSISTENT_HEADER}, ++ #else ++ {"INCONSISTENT_HEADER", 9, 121}, ++ #endif ++ #ifdef PEM_R_KEYBLOB_HEADER_PARSE_ERROR ++ {"KEYBLOB_HEADER_PARSE_ERROR", ERR_LIB_PEM, PEM_R_KEYBLOB_HEADER_PARSE_ERROR}, ++ #else ++ {"KEYBLOB_HEADER_PARSE_ERROR", 9, 122}, ++ #endif ++ #ifdef PEM_R_KEYBLOB_TOO_SHORT ++ {"KEYBLOB_TOO_SHORT", ERR_LIB_PEM, PEM_R_KEYBLOB_TOO_SHORT}, ++ #else ++ {"KEYBLOB_TOO_SHORT", 9, 123}, ++ #endif ++ #ifdef PEM_R_MISSING_DEK_IV ++ {"MISSING_DEK_IV", ERR_LIB_PEM, PEM_R_MISSING_DEK_IV}, ++ #else ++ {"MISSING_DEK_IV", 9, 129}, ++ #endif ++ #ifdef PEM_R_NOT_DEK_INFO ++ {"NOT_DEK_INFO", ERR_LIB_PEM, PEM_R_NOT_DEK_INFO}, ++ #else ++ {"NOT_DEK_INFO", 9, 105}, ++ #endif ++ #ifdef PEM_R_NOT_ENCRYPTED ++ {"NOT_ENCRYPTED", ERR_LIB_PEM, PEM_R_NOT_ENCRYPTED}, ++ #else ++ {"NOT_ENCRYPTED", 9, 106}, ++ #endif ++ #ifdef PEM_R_NOT_PROC_TYPE ++ {"NOT_PROC_TYPE", ERR_LIB_PEM, PEM_R_NOT_PROC_TYPE}, ++ #else ++ {"NOT_PROC_TYPE", 9, 107}, ++ #endif ++ #ifdef PEM_R_NO_START_LINE ++ {"NO_START_LINE", ERR_LIB_PEM, PEM_R_NO_START_LINE}, ++ #else ++ {"NO_START_LINE", 9, 108}, ++ #endif ++ #ifdef PEM_R_PROBLEMS_GETTING_PASSWORD ++ {"PROBLEMS_GETTING_PASSWORD", ERR_LIB_PEM, PEM_R_PROBLEMS_GETTING_PASSWORD}, ++ #else ++ {"PROBLEMS_GETTING_PASSWORD", 9, 109}, ++ #endif ++ #ifdef PEM_R_PUBLIC_KEY_NO_RSA ++ {"PUBLIC_KEY_NO_RSA", ERR_LIB_PEM, PEM_R_PUBLIC_KEY_NO_RSA}, ++ #else ++ {"PUBLIC_KEY_NO_RSA", 9, 110}, ++ #endif ++ #ifdef PEM_R_PVK_DATA_TOO_SHORT ++ {"PVK_DATA_TOO_SHORT", ERR_LIB_PEM, PEM_R_PVK_DATA_TOO_SHORT}, ++ #else ++ {"PVK_DATA_TOO_SHORT", 9, 124}, ++ #endif ++ #ifdef PEM_R_PVK_TOO_SHORT ++ {"PVK_TOO_SHORT", ERR_LIB_PEM, PEM_R_PVK_TOO_SHORT}, ++ #else ++ {"PVK_TOO_SHORT", 9, 125}, ++ #endif ++ #ifdef PEM_R_READ_KEY ++ {"READ_KEY", ERR_LIB_PEM, PEM_R_READ_KEY}, ++ #else ++ {"READ_KEY", 9, 111}, ++ #endif ++ #ifdef PEM_R_SHORT_HEADER ++ {"SHORT_HEADER", ERR_LIB_PEM, PEM_R_SHORT_HEADER}, ++ #else ++ {"SHORT_HEADER", 9, 112}, ++ #endif ++ #ifdef PEM_R_UNEXPECTED_DEK_IV ++ {"UNEXPECTED_DEK_IV", ERR_LIB_PEM, PEM_R_UNEXPECTED_DEK_IV}, ++ #else ++ {"UNEXPECTED_DEK_IV", 9, 130}, ++ #endif ++ #ifdef PEM_R_UNSUPPORTED_CIPHER ++ {"UNSUPPORTED_CIPHER", ERR_LIB_PEM, PEM_R_UNSUPPORTED_CIPHER}, ++ #else ++ {"UNSUPPORTED_CIPHER", 9, 113}, ++ #endif ++ #ifdef PEM_R_UNSUPPORTED_ENCRYPTION ++ {"UNSUPPORTED_ENCRYPTION", ERR_LIB_PEM, PEM_R_UNSUPPORTED_ENCRYPTION}, ++ #else ++ {"UNSUPPORTED_ENCRYPTION", 9, 114}, ++ #endif ++ #ifdef PEM_R_UNSUPPORTED_KEY_COMPONENTS ++ {"UNSUPPORTED_KEY_COMPONENTS", ERR_LIB_PEM, PEM_R_UNSUPPORTED_KEY_COMPONENTS}, ++ #else ++ {"UNSUPPORTED_KEY_COMPONENTS", 9, 126}, ++ #endif ++ #ifdef PKCS12_R_CANT_PACK_STRUCTURE ++ {"CANT_PACK_STRUCTURE", ERR_LIB_PKCS12, PKCS12_R_CANT_PACK_STRUCTURE}, ++ #else ++ {"CANT_PACK_STRUCTURE", 35, 100}, ++ #endif ++ #ifdef PKCS12_R_CONTENT_TYPE_NOT_DATA ++ {"CONTENT_TYPE_NOT_DATA", ERR_LIB_PKCS12, PKCS12_R_CONTENT_TYPE_NOT_DATA}, ++ #else ++ {"CONTENT_TYPE_NOT_DATA", 35, 121}, ++ #endif ++ #ifdef PKCS12_R_DECODE_ERROR ++ {"DECODE_ERROR", ERR_LIB_PKCS12, PKCS12_R_DECODE_ERROR}, ++ #else ++ {"DECODE_ERROR", 35, 101}, ++ #endif ++ #ifdef PKCS12_R_ENCODE_ERROR ++ {"ENCODE_ERROR", ERR_LIB_PKCS12, PKCS12_R_ENCODE_ERROR}, ++ #else ++ {"ENCODE_ERROR", 35, 102}, ++ #endif ++ #ifdef PKCS12_R_ENCRYPT_ERROR ++ {"ENCRYPT_ERROR", ERR_LIB_PKCS12, PKCS12_R_ENCRYPT_ERROR}, ++ #else ++ {"ENCRYPT_ERROR", 35, 103}, ++ #endif ++ #ifdef PKCS12_R_ERROR_SETTING_ENCRYPTED_DATA_TYPE ++ {"ERROR_SETTING_ENCRYPTED_DATA_TYPE", ERR_LIB_PKCS12, PKCS12_R_ERROR_SETTING_ENCRYPTED_DATA_TYPE}, ++ #else ++ {"ERROR_SETTING_ENCRYPTED_DATA_TYPE", 35, 120}, ++ #endif ++ #ifdef PKCS12_R_INVALID_NULL_ARGUMENT ++ {"INVALID_NULL_ARGUMENT", ERR_LIB_PKCS12, PKCS12_R_INVALID_NULL_ARGUMENT}, ++ #else ++ {"INVALID_NULL_ARGUMENT", 35, 104}, ++ #endif ++ #ifdef PKCS12_R_INVALID_NULL_PKCS12_POINTER ++ {"INVALID_NULL_PKCS12_POINTER", ERR_LIB_PKCS12, PKCS12_R_INVALID_NULL_PKCS12_POINTER}, ++ #else ++ {"INVALID_NULL_PKCS12_POINTER", 35, 105}, ++ #endif ++ #ifdef PKCS12_R_IV_GEN_ERROR ++ {"IV_GEN_ERROR", ERR_LIB_PKCS12, PKCS12_R_IV_GEN_ERROR}, ++ #else ++ {"IV_GEN_ERROR", 35, 106}, ++ #endif ++ #ifdef PKCS12_R_KEY_GEN_ERROR ++ {"KEY_GEN_ERROR", ERR_LIB_PKCS12, PKCS12_R_KEY_GEN_ERROR}, ++ #else ++ {"KEY_GEN_ERROR", 35, 107}, ++ #endif ++ #ifdef PKCS12_R_MAC_ABSENT ++ {"MAC_ABSENT", ERR_LIB_PKCS12, PKCS12_R_MAC_ABSENT}, ++ #else ++ {"MAC_ABSENT", 35, 108}, ++ #endif ++ #ifdef PKCS12_R_MAC_GENERATION_ERROR ++ {"MAC_GENERATION_ERROR", ERR_LIB_PKCS12, PKCS12_R_MAC_GENERATION_ERROR}, ++ #else ++ {"MAC_GENERATION_ERROR", 35, 109}, ++ #endif ++ #ifdef PKCS12_R_MAC_SETUP_ERROR ++ {"MAC_SETUP_ERROR", ERR_LIB_PKCS12, PKCS12_R_MAC_SETUP_ERROR}, ++ #else ++ {"MAC_SETUP_ERROR", 35, 110}, ++ #endif ++ #ifdef PKCS12_R_MAC_STRING_SET_ERROR ++ {"MAC_STRING_SET_ERROR", ERR_LIB_PKCS12, PKCS12_R_MAC_STRING_SET_ERROR}, ++ #else ++ {"MAC_STRING_SET_ERROR", 35, 111}, ++ #endif ++ #ifdef PKCS12_R_MAC_VERIFY_FAILURE ++ {"MAC_VERIFY_FAILURE", ERR_LIB_PKCS12, PKCS12_R_MAC_VERIFY_FAILURE}, ++ #else ++ {"MAC_VERIFY_FAILURE", 35, 113}, ++ #endif ++ #ifdef PKCS12_R_PARSE_ERROR ++ {"PARSE_ERROR", ERR_LIB_PKCS12, PKCS12_R_PARSE_ERROR}, ++ #else ++ {"PARSE_ERROR", 35, 114}, ++ #endif ++ #ifdef PKCS12_R_PKCS12_ALGOR_CIPHERINIT_ERROR ++ {"PKCS12_ALGOR_CIPHERINIT_ERROR", ERR_LIB_PKCS12, PKCS12_R_PKCS12_ALGOR_CIPHERINIT_ERROR}, ++ #else ++ {"PKCS12_ALGOR_CIPHERINIT_ERROR", 35, 115}, ++ #endif ++ #ifdef PKCS12_R_PKCS12_CIPHERFINAL_ERROR ++ {"PKCS12_CIPHERFINAL_ERROR", ERR_LIB_PKCS12, PKCS12_R_PKCS12_CIPHERFINAL_ERROR}, ++ #else ++ {"PKCS12_CIPHERFINAL_ERROR", 35, 116}, ++ #endif ++ #ifdef PKCS12_R_PKCS12_PBE_CRYPT_ERROR ++ {"PKCS12_PBE_CRYPT_ERROR", ERR_LIB_PKCS12, PKCS12_R_PKCS12_PBE_CRYPT_ERROR}, ++ #else ++ {"PKCS12_PBE_CRYPT_ERROR", 35, 117}, ++ #endif ++ #ifdef PKCS12_R_UNKNOWN_DIGEST_ALGORITHM ++ {"UNKNOWN_DIGEST_ALGORITHM", ERR_LIB_PKCS12, PKCS12_R_UNKNOWN_DIGEST_ALGORITHM}, ++ #else ++ {"UNKNOWN_DIGEST_ALGORITHM", 35, 118}, ++ #endif ++ #ifdef PKCS12_R_UNSUPPORTED_PKCS12_MODE ++ {"UNSUPPORTED_PKCS12_MODE", ERR_LIB_PKCS12, PKCS12_R_UNSUPPORTED_PKCS12_MODE}, ++ #else ++ {"UNSUPPORTED_PKCS12_MODE", 35, 119}, ++ #endif ++ #ifdef PKCS7_R_CERTIFICATE_VERIFY_ERROR ++ {"CERTIFICATE_VERIFY_ERROR", ERR_LIB_PKCS7, PKCS7_R_CERTIFICATE_VERIFY_ERROR}, ++ #else ++ {"CERTIFICATE_VERIFY_ERROR", 33, 117}, ++ #endif ++ #ifdef PKCS7_R_CIPHER_HAS_NO_OBJECT_IDENTIFIER ++ {"CIPHER_HAS_NO_OBJECT_IDENTIFIER", ERR_LIB_PKCS7, PKCS7_R_CIPHER_HAS_NO_OBJECT_IDENTIFIER}, ++ #else ++ {"CIPHER_HAS_NO_OBJECT_IDENTIFIER", 33, 144}, ++ #endif ++ #ifdef PKCS7_R_CIPHER_NOT_INITIALIZED ++ {"CIPHER_NOT_INITIALIZED", ERR_LIB_PKCS7, PKCS7_R_CIPHER_NOT_INITIALIZED}, ++ #else ++ {"CIPHER_NOT_INITIALIZED", 33, 116}, ++ #endif ++ #ifdef PKCS7_R_CONTENT_AND_DATA_PRESENT ++ {"CONTENT_AND_DATA_PRESENT", ERR_LIB_PKCS7, PKCS7_R_CONTENT_AND_DATA_PRESENT}, ++ #else ++ {"CONTENT_AND_DATA_PRESENT", 33, 118}, ++ #endif ++ #ifdef PKCS7_R_CTRL_ERROR ++ {"CTRL_ERROR", ERR_LIB_PKCS7, PKCS7_R_CTRL_ERROR}, ++ #else ++ {"CTRL_ERROR", 33, 152}, ++ #endif ++ #ifdef PKCS7_R_DECRYPT_ERROR ++ {"DECRYPT_ERROR", ERR_LIB_PKCS7, PKCS7_R_DECRYPT_ERROR}, ++ #else ++ {"DECRYPT_ERROR", 33, 119}, ++ #endif ++ #ifdef PKCS7_R_DIGEST_FAILURE ++ {"DIGEST_FAILURE", ERR_LIB_PKCS7, PKCS7_R_DIGEST_FAILURE}, ++ #else ++ {"DIGEST_FAILURE", 33, 101}, ++ #endif ++ #ifdef PKCS7_R_ENCRYPTION_CTRL_FAILURE ++ {"ENCRYPTION_CTRL_FAILURE", ERR_LIB_PKCS7, PKCS7_R_ENCRYPTION_CTRL_FAILURE}, ++ #else ++ {"ENCRYPTION_CTRL_FAILURE", 33, 149}, ++ #endif ++ #ifdef PKCS7_R_ENCRYPTION_NOT_SUPPORTED_FOR_THIS_KEY_TYPE ++ {"ENCRYPTION_NOT_SUPPORTED_FOR_THIS_KEY_TYPE", ERR_LIB_PKCS7, PKCS7_R_ENCRYPTION_NOT_SUPPORTED_FOR_THIS_KEY_TYPE}, ++ #else ++ {"ENCRYPTION_NOT_SUPPORTED_FOR_THIS_KEY_TYPE", 33, 150}, ++ #endif ++ #ifdef PKCS7_R_ERROR_ADDING_RECIPIENT ++ {"ERROR_ADDING_RECIPIENT", ERR_LIB_PKCS7, PKCS7_R_ERROR_ADDING_RECIPIENT}, ++ #else ++ {"ERROR_ADDING_RECIPIENT", 33, 120}, ++ #endif ++ #ifdef PKCS7_R_ERROR_SETTING_CIPHER ++ {"ERROR_SETTING_CIPHER", ERR_LIB_PKCS7, PKCS7_R_ERROR_SETTING_CIPHER}, ++ #else ++ {"ERROR_SETTING_CIPHER", 33, 121}, ++ #endif ++ #ifdef PKCS7_R_INVALID_NULL_POINTER ++ {"INVALID_NULL_POINTER", ERR_LIB_PKCS7, PKCS7_R_INVALID_NULL_POINTER}, ++ #else ++ {"INVALID_NULL_POINTER", 33, 143}, ++ #endif ++ #ifdef PKCS7_R_INVALID_SIGNED_DATA_TYPE ++ {"INVALID_SIGNED_DATA_TYPE", ERR_LIB_PKCS7, PKCS7_R_INVALID_SIGNED_DATA_TYPE}, ++ #else ++ {"INVALID_SIGNED_DATA_TYPE", 33, 155}, ++ #endif ++ #ifdef PKCS7_R_NO_CONTENT ++ {"NO_CONTENT", ERR_LIB_PKCS7, PKCS7_R_NO_CONTENT}, ++ #else ++ {"NO_CONTENT", 33, 122}, ++ #endif ++ #ifdef PKCS7_R_NO_DEFAULT_DIGEST ++ {"NO_DEFAULT_DIGEST", ERR_LIB_PKCS7, PKCS7_R_NO_DEFAULT_DIGEST}, ++ #else ++ {"NO_DEFAULT_DIGEST", 33, 151}, ++ #endif ++ #ifdef PKCS7_R_NO_MATCHING_DIGEST_TYPE_FOUND ++ {"NO_MATCHING_DIGEST_TYPE_FOUND", ERR_LIB_PKCS7, PKCS7_R_NO_MATCHING_DIGEST_TYPE_FOUND}, ++ #else ++ {"NO_MATCHING_DIGEST_TYPE_FOUND", 33, 154}, ++ #endif ++ #ifdef PKCS7_R_NO_RECIPIENT_MATCHES_CERTIFICATE ++ {"NO_RECIPIENT_MATCHES_CERTIFICATE", ERR_LIB_PKCS7, PKCS7_R_NO_RECIPIENT_MATCHES_CERTIFICATE}, ++ #else ++ {"NO_RECIPIENT_MATCHES_CERTIFICATE", 33, 115}, ++ #endif ++ #ifdef PKCS7_R_NO_SIGNATURES_ON_DATA ++ {"NO_SIGNATURES_ON_DATA", ERR_LIB_PKCS7, PKCS7_R_NO_SIGNATURES_ON_DATA}, ++ #else ++ {"NO_SIGNATURES_ON_DATA", 33, 123}, ++ #endif ++ #ifdef PKCS7_R_NO_SIGNERS ++ {"NO_SIGNERS", ERR_LIB_PKCS7, PKCS7_R_NO_SIGNERS}, ++ #else ++ {"NO_SIGNERS", 33, 142}, ++ #endif ++ #ifdef PKCS7_R_OPERATION_NOT_SUPPORTED_ON_THIS_TYPE ++ {"OPERATION_NOT_SUPPORTED_ON_THIS_TYPE", ERR_LIB_PKCS7, PKCS7_R_OPERATION_NOT_SUPPORTED_ON_THIS_TYPE}, ++ #else ++ {"OPERATION_NOT_SUPPORTED_ON_THIS_TYPE", 33, 104}, ++ #endif ++ #ifdef PKCS7_R_PKCS7_ADD_SIGNATURE_ERROR ++ {"PKCS7_ADD_SIGNATURE_ERROR", ERR_LIB_PKCS7, PKCS7_R_PKCS7_ADD_SIGNATURE_ERROR}, ++ #else ++ {"PKCS7_ADD_SIGNATURE_ERROR", 33, 124}, ++ #endif ++ #ifdef PKCS7_R_PKCS7_ADD_SIGNER_ERROR ++ {"PKCS7_ADD_SIGNER_ERROR", ERR_LIB_PKCS7, PKCS7_R_PKCS7_ADD_SIGNER_ERROR}, ++ #else ++ {"PKCS7_ADD_SIGNER_ERROR", 33, 153}, ++ #endif ++ #ifdef PKCS7_R_PKCS7_DATASIGN ++ {"PKCS7_DATASIGN", ERR_LIB_PKCS7, PKCS7_R_PKCS7_DATASIGN}, ++ #else ++ {"PKCS7_DATASIGN", 33, 145}, ++ #endif ++ #ifdef PKCS7_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE ++ {"PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE", ERR_LIB_PKCS7, PKCS7_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE}, ++ #else ++ {"PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE", 33, 127}, ++ #endif ++ #ifdef PKCS7_R_SIGNATURE_FAILURE ++ {"SIGNATURE_FAILURE", ERR_LIB_PKCS7, PKCS7_R_SIGNATURE_FAILURE}, ++ #else ++ {"SIGNATURE_FAILURE", 33, 105}, ++ #endif ++ #ifdef PKCS7_R_SIGNER_CERTIFICATE_NOT_FOUND ++ {"SIGNER_CERTIFICATE_NOT_FOUND", ERR_LIB_PKCS7, PKCS7_R_SIGNER_CERTIFICATE_NOT_FOUND}, ++ #else ++ {"SIGNER_CERTIFICATE_NOT_FOUND", 33, 128}, ++ #endif ++ #ifdef PKCS7_R_SIGNING_CTRL_FAILURE ++ {"SIGNING_CTRL_FAILURE", ERR_LIB_PKCS7, PKCS7_R_SIGNING_CTRL_FAILURE}, ++ #else ++ {"SIGNING_CTRL_FAILURE", 33, 147}, ++ #endif ++ #ifdef PKCS7_R_SIGNING_NOT_SUPPORTED_FOR_THIS_KEY_TYPE ++ {"SIGNING_NOT_SUPPORTED_FOR_THIS_KEY_TYPE", ERR_LIB_PKCS7, PKCS7_R_SIGNING_NOT_SUPPORTED_FOR_THIS_KEY_TYPE}, ++ #else ++ {"SIGNING_NOT_SUPPORTED_FOR_THIS_KEY_TYPE", 33, 148}, ++ #endif ++ #ifdef PKCS7_R_SMIME_TEXT_ERROR ++ {"SMIME_TEXT_ERROR", ERR_LIB_PKCS7, PKCS7_R_SMIME_TEXT_ERROR}, ++ #else ++ {"SMIME_TEXT_ERROR", 33, 129}, ++ #endif ++ #ifdef PKCS7_R_UNABLE_TO_FIND_CERTIFICATE ++ {"UNABLE_TO_FIND_CERTIFICATE", ERR_LIB_PKCS7, PKCS7_R_UNABLE_TO_FIND_CERTIFICATE}, ++ #else ++ {"UNABLE_TO_FIND_CERTIFICATE", 33, 106}, ++ #endif ++ #ifdef PKCS7_R_UNABLE_TO_FIND_MEM_BIO ++ {"UNABLE_TO_FIND_MEM_BIO", ERR_LIB_PKCS7, PKCS7_R_UNABLE_TO_FIND_MEM_BIO}, ++ #else ++ {"UNABLE_TO_FIND_MEM_BIO", 33, 107}, ++ #endif ++ #ifdef PKCS7_R_UNABLE_TO_FIND_MESSAGE_DIGEST ++ {"UNABLE_TO_FIND_MESSAGE_DIGEST", ERR_LIB_PKCS7, PKCS7_R_UNABLE_TO_FIND_MESSAGE_DIGEST}, ++ #else ++ {"UNABLE_TO_FIND_MESSAGE_DIGEST", 33, 108}, ++ #endif ++ #ifdef PKCS7_R_UNKNOWN_DIGEST_TYPE ++ {"UNKNOWN_DIGEST_TYPE", ERR_LIB_PKCS7, PKCS7_R_UNKNOWN_DIGEST_TYPE}, ++ #else ++ {"UNKNOWN_DIGEST_TYPE", 33, 109}, ++ #endif ++ #ifdef PKCS7_R_UNKNOWN_OPERATION ++ {"UNKNOWN_OPERATION", ERR_LIB_PKCS7, PKCS7_R_UNKNOWN_OPERATION}, ++ #else ++ {"UNKNOWN_OPERATION", 33, 110}, ++ #endif ++ #ifdef PKCS7_R_UNSUPPORTED_CIPHER_TYPE ++ {"UNSUPPORTED_CIPHER_TYPE", ERR_LIB_PKCS7, PKCS7_R_UNSUPPORTED_CIPHER_TYPE}, ++ #else ++ {"UNSUPPORTED_CIPHER_TYPE", 33, 111}, ++ #endif ++ #ifdef PKCS7_R_UNSUPPORTED_CONTENT_TYPE ++ {"UNSUPPORTED_CONTENT_TYPE", ERR_LIB_PKCS7, PKCS7_R_UNSUPPORTED_CONTENT_TYPE}, ++ #else ++ {"UNSUPPORTED_CONTENT_TYPE", 33, 112}, ++ #endif ++ #ifdef PKCS7_R_WRONG_CONTENT_TYPE ++ {"WRONG_CONTENT_TYPE", ERR_LIB_PKCS7, PKCS7_R_WRONG_CONTENT_TYPE}, ++ #else ++ {"WRONG_CONTENT_TYPE", 33, 113}, ++ #endif ++ #ifdef PKCS7_R_WRONG_PKCS7_TYPE ++ {"WRONG_PKCS7_TYPE", ERR_LIB_PKCS7, PKCS7_R_WRONG_PKCS7_TYPE}, ++ #else ++ {"WRONG_PKCS7_TYPE", 33, 114}, ++ #endif ++ #ifdef RAND_R_ADDITIONAL_INPUT_TOO_LONG ++ {"ADDITIONAL_INPUT_TOO_LONG", ERR_LIB_RAND, RAND_R_ADDITIONAL_INPUT_TOO_LONG}, ++ #else ++ {"ADDITIONAL_INPUT_TOO_LONG", 36, 102}, ++ #endif ++ #ifdef RAND_R_ALREADY_INSTANTIATED ++ {"ALREADY_INSTANTIATED", ERR_LIB_RAND, RAND_R_ALREADY_INSTANTIATED}, ++ #else ++ {"ALREADY_INSTANTIATED", 36, 103}, ++ #endif ++ #ifdef RAND_R_ARGUMENT_OUT_OF_RANGE ++ {"ARGUMENT_OUT_OF_RANGE", ERR_LIB_RAND, RAND_R_ARGUMENT_OUT_OF_RANGE}, ++ #else ++ {"ARGUMENT_OUT_OF_RANGE", 36, 105}, ++ #endif ++ #ifdef RAND_R_CANNOT_OPEN_FILE ++ {"CANNOT_OPEN_FILE", ERR_LIB_RAND, RAND_R_CANNOT_OPEN_FILE}, ++ #else ++ {"CANNOT_OPEN_FILE", 36, 121}, ++ #endif ++ #ifdef RAND_R_DRBG_ALREADY_INITIALIZED ++ {"DRBG_ALREADY_INITIALIZED", ERR_LIB_RAND, RAND_R_DRBG_ALREADY_INITIALIZED}, ++ #else ++ {"DRBG_ALREADY_INITIALIZED", 36, 129}, ++ #endif ++ #ifdef RAND_R_DRBG_NOT_INITIALISED ++ {"DRBG_NOT_INITIALISED", ERR_LIB_RAND, RAND_R_DRBG_NOT_INITIALISED}, ++ #else ++ {"DRBG_NOT_INITIALISED", 36, 104}, ++ #endif ++ #ifdef RAND_R_ENTROPY_INPUT_TOO_LONG ++ {"ENTROPY_INPUT_TOO_LONG", ERR_LIB_RAND, RAND_R_ENTROPY_INPUT_TOO_LONG}, ++ #else ++ {"ENTROPY_INPUT_TOO_LONG", 36, 106}, ++ #endif ++ #ifdef RAND_R_ENTROPY_OUT_OF_RANGE ++ {"ENTROPY_OUT_OF_RANGE", ERR_LIB_RAND, RAND_R_ENTROPY_OUT_OF_RANGE}, ++ #else ++ {"ENTROPY_OUT_OF_RANGE", 36, 124}, ++ #endif ++ #ifdef RAND_R_ERROR_ENTROPY_POOL_WAS_IGNORED ++ {"ERROR_ENTROPY_POOL_WAS_IGNORED", ERR_LIB_RAND, RAND_R_ERROR_ENTROPY_POOL_WAS_IGNORED}, ++ #else ++ {"ERROR_ENTROPY_POOL_WAS_IGNORED", 36, 127}, ++ #endif ++ #ifdef RAND_R_ERROR_INITIALISING_DRBG ++ {"ERROR_INITIALISING_DRBG", ERR_LIB_RAND, RAND_R_ERROR_INITIALISING_DRBG}, ++ #else ++ {"ERROR_INITIALISING_DRBG", 36, 107}, ++ #endif ++ #ifdef RAND_R_ERROR_INSTANTIATING_DRBG ++ {"ERROR_INSTANTIATING_DRBG", ERR_LIB_RAND, RAND_R_ERROR_INSTANTIATING_DRBG}, ++ #else ++ {"ERROR_INSTANTIATING_DRBG", 36, 108}, ++ #endif ++ #ifdef RAND_R_ERROR_RETRIEVING_ADDITIONAL_INPUT ++ {"ERROR_RETRIEVING_ADDITIONAL_INPUT", ERR_LIB_RAND, RAND_R_ERROR_RETRIEVING_ADDITIONAL_INPUT}, ++ #else ++ {"ERROR_RETRIEVING_ADDITIONAL_INPUT", 36, 109}, ++ #endif ++ #ifdef RAND_R_ERROR_RETRIEVING_ENTROPY ++ {"ERROR_RETRIEVING_ENTROPY", ERR_LIB_RAND, RAND_R_ERROR_RETRIEVING_ENTROPY}, ++ #else ++ {"ERROR_RETRIEVING_ENTROPY", 36, 110}, ++ #endif ++ #ifdef RAND_R_ERROR_RETRIEVING_NONCE ++ {"ERROR_RETRIEVING_NONCE", ERR_LIB_RAND, RAND_R_ERROR_RETRIEVING_NONCE}, ++ #else ++ {"ERROR_RETRIEVING_NONCE", 36, 111}, ++ #endif ++ #ifdef RAND_R_FAILED_TO_CREATE_LOCK ++ {"FAILED_TO_CREATE_LOCK", ERR_LIB_RAND, RAND_R_FAILED_TO_CREATE_LOCK}, ++ #else ++ {"FAILED_TO_CREATE_LOCK", 36, 126}, ++ #endif ++ #ifdef RAND_R_FUNC_NOT_IMPLEMENTED ++ {"FUNC_NOT_IMPLEMENTED", ERR_LIB_RAND, RAND_R_FUNC_NOT_IMPLEMENTED}, ++ #else ++ {"FUNC_NOT_IMPLEMENTED", 36, 101}, ++ #endif ++ #ifdef RAND_R_FWRITE_ERROR ++ {"FWRITE_ERROR", ERR_LIB_RAND, RAND_R_FWRITE_ERROR}, ++ #else ++ {"FWRITE_ERROR", 36, 123}, ++ #endif ++ #ifdef RAND_R_GENERATE_ERROR ++ {"GENERATE_ERROR", ERR_LIB_RAND, RAND_R_GENERATE_ERROR}, ++ #else ++ {"GENERATE_ERROR", 36, 112}, ++ #endif ++ #ifdef RAND_R_INTERNAL_ERROR ++ {"INTERNAL_ERROR", ERR_LIB_RAND, RAND_R_INTERNAL_ERROR}, ++ #else ++ {"INTERNAL_ERROR", 36, 113}, ++ #endif ++ #ifdef RAND_R_IN_ERROR_STATE ++ {"IN_ERROR_STATE", ERR_LIB_RAND, RAND_R_IN_ERROR_STATE}, ++ #else ++ {"IN_ERROR_STATE", 36, 114}, ++ #endif ++ #ifdef RAND_R_NOT_A_REGULAR_FILE ++ {"NOT_A_REGULAR_FILE", ERR_LIB_RAND, RAND_R_NOT_A_REGULAR_FILE}, ++ #else ++ {"NOT_A_REGULAR_FILE", 36, 122}, ++ #endif ++ #ifdef RAND_R_NOT_INSTANTIATED ++ {"NOT_INSTANTIATED", ERR_LIB_RAND, RAND_R_NOT_INSTANTIATED}, ++ #else ++ {"NOT_INSTANTIATED", 36, 115}, ++ #endif ++ #ifdef RAND_R_NO_DRBG_IMPLEMENTATION_SELECTED ++ {"NO_DRBG_IMPLEMENTATION_SELECTED", ERR_LIB_RAND, RAND_R_NO_DRBG_IMPLEMENTATION_SELECTED}, ++ #else ++ {"NO_DRBG_IMPLEMENTATION_SELECTED", 36, 128}, ++ #endif ++ #ifdef RAND_R_PARENT_LOCKING_NOT_ENABLED ++ {"PARENT_LOCKING_NOT_ENABLED", ERR_LIB_RAND, RAND_R_PARENT_LOCKING_NOT_ENABLED}, ++ #else ++ {"PARENT_LOCKING_NOT_ENABLED", 36, 130}, ++ #endif ++ #ifdef RAND_R_PARENT_STRENGTH_TOO_WEAK ++ {"PARENT_STRENGTH_TOO_WEAK", ERR_LIB_RAND, RAND_R_PARENT_STRENGTH_TOO_WEAK}, ++ #else ++ {"PARENT_STRENGTH_TOO_WEAK", 36, 131}, ++ #endif ++ #ifdef RAND_R_PERSONALISATION_STRING_TOO_LONG ++ {"PERSONALISATION_STRING_TOO_LONG", ERR_LIB_RAND, RAND_R_PERSONALISATION_STRING_TOO_LONG}, ++ #else ++ {"PERSONALISATION_STRING_TOO_LONG", 36, 116}, ++ #endif ++ #ifdef RAND_R_PREDICTION_RESISTANCE_NOT_SUPPORTED ++ {"PREDICTION_RESISTANCE_NOT_SUPPORTED", ERR_LIB_RAND, RAND_R_PREDICTION_RESISTANCE_NOT_SUPPORTED}, ++ #else ++ {"PREDICTION_RESISTANCE_NOT_SUPPORTED", 36, 133}, ++ #endif ++ #ifdef RAND_R_PRNG_NOT_SEEDED ++ {"PRNG_NOT_SEEDED", ERR_LIB_RAND, RAND_R_PRNG_NOT_SEEDED}, ++ #else ++ {"PRNG_NOT_SEEDED", 36, 100}, ++ #endif ++ #ifdef RAND_R_RANDOM_POOL_OVERFLOW ++ {"RANDOM_POOL_OVERFLOW", ERR_LIB_RAND, RAND_R_RANDOM_POOL_OVERFLOW}, ++ #else ++ {"RANDOM_POOL_OVERFLOW", 36, 125}, ++ #endif ++ #ifdef RAND_R_RANDOM_POOL_UNDERFLOW ++ {"RANDOM_POOL_UNDERFLOW", ERR_LIB_RAND, RAND_R_RANDOM_POOL_UNDERFLOW}, ++ #else ++ {"RANDOM_POOL_UNDERFLOW", 36, 134}, ++ #endif ++ #ifdef RAND_R_REQUEST_TOO_LARGE_FOR_DRBG ++ {"REQUEST_TOO_LARGE_FOR_DRBG", ERR_LIB_RAND, RAND_R_REQUEST_TOO_LARGE_FOR_DRBG}, ++ #else ++ {"REQUEST_TOO_LARGE_FOR_DRBG", 36, 117}, ++ #endif ++ #ifdef RAND_R_RESEED_ERROR ++ {"RESEED_ERROR", ERR_LIB_RAND, RAND_R_RESEED_ERROR}, ++ #else ++ {"RESEED_ERROR", 36, 118}, ++ #endif ++ #ifdef RAND_R_SELFTEST_FAILURE ++ {"SELFTEST_FAILURE", ERR_LIB_RAND, RAND_R_SELFTEST_FAILURE}, ++ #else ++ {"SELFTEST_FAILURE", 36, 119}, ++ #endif ++ #ifdef RAND_R_TOO_LITTLE_NONCE_REQUESTED ++ {"TOO_LITTLE_NONCE_REQUESTED", ERR_LIB_RAND, RAND_R_TOO_LITTLE_NONCE_REQUESTED}, ++ #else ++ {"TOO_LITTLE_NONCE_REQUESTED", 36, 135}, ++ #endif ++ #ifdef RAND_R_TOO_MUCH_NONCE_REQUESTED ++ {"TOO_MUCH_NONCE_REQUESTED", ERR_LIB_RAND, RAND_R_TOO_MUCH_NONCE_REQUESTED}, ++ #else ++ {"TOO_MUCH_NONCE_REQUESTED", 36, 136}, ++ #endif ++ #ifdef RAND_R_UNSUPPORTED_DRBG_FLAGS ++ {"UNSUPPORTED_DRBG_FLAGS", ERR_LIB_RAND, RAND_R_UNSUPPORTED_DRBG_FLAGS}, ++ #else ++ {"UNSUPPORTED_DRBG_FLAGS", 36, 132}, ++ #endif ++ #ifdef RAND_R_UNSUPPORTED_DRBG_TYPE ++ {"UNSUPPORTED_DRBG_TYPE", ERR_LIB_RAND, RAND_R_UNSUPPORTED_DRBG_TYPE}, ++ #else ++ {"UNSUPPORTED_DRBG_TYPE", 36, 120}, ++ #endif ++ #ifdef RSA_R_ALGORITHM_MISMATCH ++ {"ALGORITHM_MISMATCH", ERR_LIB_RSA, RSA_R_ALGORITHM_MISMATCH}, ++ #else ++ {"ALGORITHM_MISMATCH", 4, 100}, ++ #endif ++ #ifdef RSA_R_BAD_E_VALUE ++ {"BAD_E_VALUE", ERR_LIB_RSA, RSA_R_BAD_E_VALUE}, ++ #else ++ {"BAD_E_VALUE", 4, 101}, ++ #endif ++ #ifdef RSA_R_BAD_FIXED_HEADER_DECRYPT ++ {"BAD_FIXED_HEADER_DECRYPT", ERR_LIB_RSA, RSA_R_BAD_FIXED_HEADER_DECRYPT}, ++ #else ++ {"BAD_FIXED_HEADER_DECRYPT", 4, 102}, ++ #endif ++ #ifdef RSA_R_BAD_PAD_BYTE_COUNT ++ {"BAD_PAD_BYTE_COUNT", ERR_LIB_RSA, RSA_R_BAD_PAD_BYTE_COUNT}, ++ #else ++ {"BAD_PAD_BYTE_COUNT", 4, 103}, ++ #endif ++ #ifdef RSA_R_BAD_SIGNATURE ++ {"BAD_SIGNATURE", ERR_LIB_RSA, RSA_R_BAD_SIGNATURE}, ++ #else ++ {"BAD_SIGNATURE", 4, 104}, ++ #endif ++ #ifdef RSA_R_BLOCK_TYPE_IS_NOT_01 ++ {"BLOCK_TYPE_IS_NOT_01", ERR_LIB_RSA, RSA_R_BLOCK_TYPE_IS_NOT_01}, ++ #else ++ {"BLOCK_TYPE_IS_NOT_01", 4, 106}, ++ #endif ++ #ifdef RSA_R_BLOCK_TYPE_IS_NOT_02 ++ {"BLOCK_TYPE_IS_NOT_02", ERR_LIB_RSA, RSA_R_BLOCK_TYPE_IS_NOT_02}, ++ #else ++ {"BLOCK_TYPE_IS_NOT_02", 4, 107}, ++ #endif ++ #ifdef RSA_R_DATA_GREATER_THAN_MOD_LEN ++ {"DATA_GREATER_THAN_MOD_LEN", ERR_LIB_RSA, RSA_R_DATA_GREATER_THAN_MOD_LEN}, ++ #else ++ {"DATA_GREATER_THAN_MOD_LEN", 4, 108}, ++ #endif ++ #ifdef RSA_R_DATA_TOO_LARGE ++ {"DATA_TOO_LARGE", ERR_LIB_RSA, RSA_R_DATA_TOO_LARGE}, ++ #else ++ {"DATA_TOO_LARGE", 4, 109}, ++ #endif ++ #ifdef RSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE ++ {"DATA_TOO_LARGE_FOR_KEY_SIZE", ERR_LIB_RSA, RSA_R_DATA_TOO_LARGE_FOR_KEY_SIZE}, ++ #else ++ {"DATA_TOO_LARGE_FOR_KEY_SIZE", 4, 110}, ++ #endif ++ #ifdef RSA_R_DATA_TOO_LARGE_FOR_MODULUS ++ {"DATA_TOO_LARGE_FOR_MODULUS", ERR_LIB_RSA, RSA_R_DATA_TOO_LARGE_FOR_MODULUS}, ++ #else ++ {"DATA_TOO_LARGE_FOR_MODULUS", 4, 132}, ++ #endif ++ #ifdef RSA_R_DATA_TOO_SMALL ++ {"DATA_TOO_SMALL", ERR_LIB_RSA, RSA_R_DATA_TOO_SMALL}, ++ #else ++ {"DATA_TOO_SMALL", 4, 111}, ++ #endif ++ #ifdef RSA_R_DATA_TOO_SMALL_FOR_KEY_SIZE ++ {"DATA_TOO_SMALL_FOR_KEY_SIZE", ERR_LIB_RSA, RSA_R_DATA_TOO_SMALL_FOR_KEY_SIZE}, ++ #else ++ {"DATA_TOO_SMALL_FOR_KEY_SIZE", 4, 122}, ++ #endif ++ #ifdef RSA_R_DIGEST_DOES_NOT_MATCH ++ {"DIGEST_DOES_NOT_MATCH", ERR_LIB_RSA, RSA_R_DIGEST_DOES_NOT_MATCH}, ++ #else ++ {"DIGEST_DOES_NOT_MATCH", 4, 158}, ++ #endif ++ #ifdef RSA_R_DIGEST_NOT_ALLOWED ++ {"DIGEST_NOT_ALLOWED", ERR_LIB_RSA, RSA_R_DIGEST_NOT_ALLOWED}, ++ #else ++ {"DIGEST_NOT_ALLOWED", 4, 145}, ++ #endif ++ #ifdef RSA_R_DIGEST_TOO_BIG_FOR_RSA_KEY ++ {"DIGEST_TOO_BIG_FOR_RSA_KEY", ERR_LIB_RSA, RSA_R_DIGEST_TOO_BIG_FOR_RSA_KEY}, ++ #else ++ {"DIGEST_TOO_BIG_FOR_RSA_KEY", 4, 112}, ++ #endif ++ #ifdef RSA_R_DMP1_NOT_CONGRUENT_TO_D ++ {"DMP1_NOT_CONGRUENT_TO_D", ERR_LIB_RSA, RSA_R_DMP1_NOT_CONGRUENT_TO_D}, ++ #else ++ {"DMP1_NOT_CONGRUENT_TO_D", 4, 124}, ++ #endif ++ #ifdef RSA_R_DMQ1_NOT_CONGRUENT_TO_D ++ {"DMQ1_NOT_CONGRUENT_TO_D", ERR_LIB_RSA, RSA_R_DMQ1_NOT_CONGRUENT_TO_D}, ++ #else ++ {"DMQ1_NOT_CONGRUENT_TO_D", 4, 125}, ++ #endif ++ #ifdef RSA_R_D_E_NOT_CONGRUENT_TO_1 ++ {"D_E_NOT_CONGRUENT_TO_1", ERR_LIB_RSA, RSA_R_D_E_NOT_CONGRUENT_TO_1}, ++ #else ++ {"D_E_NOT_CONGRUENT_TO_1", 4, 123}, ++ #endif ++ #ifdef RSA_R_FIRST_OCTET_INVALID ++ {"FIRST_OCTET_INVALID", ERR_LIB_RSA, RSA_R_FIRST_OCTET_INVALID}, ++ #else ++ {"FIRST_OCTET_INVALID", 4, 133}, ++ #endif ++ #ifdef RSA_R_ILLEGAL_OR_UNSUPPORTED_PADDING_MODE ++ {"ILLEGAL_OR_UNSUPPORTED_PADDING_MODE", ERR_LIB_RSA, RSA_R_ILLEGAL_OR_UNSUPPORTED_PADDING_MODE}, ++ #else ++ {"ILLEGAL_OR_UNSUPPORTED_PADDING_MODE", 4, 144}, ++ #endif ++ #ifdef RSA_R_INVALID_DIGEST ++ {"INVALID_DIGEST", ERR_LIB_RSA, RSA_R_INVALID_DIGEST}, ++ #else ++ {"INVALID_DIGEST", 4, 157}, ++ #endif ++ #ifdef RSA_R_INVALID_DIGEST_LENGTH ++ {"INVALID_DIGEST_LENGTH", ERR_LIB_RSA, RSA_R_INVALID_DIGEST_LENGTH}, ++ #else ++ {"INVALID_DIGEST_LENGTH", 4, 143}, ++ #endif ++ #ifdef RSA_R_INVALID_HEADER ++ {"INVALID_HEADER", ERR_LIB_RSA, RSA_R_INVALID_HEADER}, ++ #else ++ {"INVALID_HEADER", 4, 137}, ++ #endif ++ #ifdef RSA_R_INVALID_LABEL ++ {"INVALID_LABEL", ERR_LIB_RSA, RSA_R_INVALID_LABEL}, ++ #else ++ {"INVALID_LABEL", 4, 160}, ++ #endif ++ #ifdef RSA_R_INVALID_MESSAGE_LENGTH ++ {"INVALID_MESSAGE_LENGTH", ERR_LIB_RSA, RSA_R_INVALID_MESSAGE_LENGTH}, ++ #else ++ {"INVALID_MESSAGE_LENGTH", 4, 131}, ++ #endif ++ #ifdef RSA_R_INVALID_MGF1_MD ++ {"INVALID_MGF1_MD", ERR_LIB_RSA, RSA_R_INVALID_MGF1_MD}, ++ #else ++ {"INVALID_MGF1_MD", 4, 156}, ++ #endif ++ #ifdef RSA_R_INVALID_MULTI_PRIME_KEY ++ {"INVALID_MULTI_PRIME_KEY", ERR_LIB_RSA, RSA_R_INVALID_MULTI_PRIME_KEY}, ++ #else ++ {"INVALID_MULTI_PRIME_KEY", 4, 167}, ++ #endif ++ #ifdef RSA_R_INVALID_OAEP_PARAMETERS ++ {"INVALID_OAEP_PARAMETERS", ERR_LIB_RSA, RSA_R_INVALID_OAEP_PARAMETERS}, ++ #else ++ {"INVALID_OAEP_PARAMETERS", 4, 161}, ++ #endif ++ #ifdef RSA_R_INVALID_PADDING ++ {"INVALID_PADDING", ERR_LIB_RSA, RSA_R_INVALID_PADDING}, ++ #else ++ {"INVALID_PADDING", 4, 138}, ++ #endif ++ #ifdef RSA_R_INVALID_PADDING_MODE ++ {"INVALID_PADDING_MODE", ERR_LIB_RSA, RSA_R_INVALID_PADDING_MODE}, ++ #else ++ {"INVALID_PADDING_MODE", 4, 141}, ++ #endif ++ #ifdef RSA_R_INVALID_PSS_PARAMETERS ++ {"INVALID_PSS_PARAMETERS", ERR_LIB_RSA, RSA_R_INVALID_PSS_PARAMETERS}, ++ #else ++ {"INVALID_PSS_PARAMETERS", 4, 149}, ++ #endif ++ #ifdef RSA_R_INVALID_PSS_SALTLEN ++ {"INVALID_PSS_SALTLEN", ERR_LIB_RSA, RSA_R_INVALID_PSS_SALTLEN}, ++ #else ++ {"INVALID_PSS_SALTLEN", 4, 146}, ++ #endif ++ #ifdef RSA_R_INVALID_SALT_LENGTH ++ {"INVALID_SALT_LENGTH", ERR_LIB_RSA, RSA_R_INVALID_SALT_LENGTH}, ++ #else ++ {"INVALID_SALT_LENGTH", 4, 150}, ++ #endif ++ #ifdef RSA_R_INVALID_TRAILER ++ {"INVALID_TRAILER", ERR_LIB_RSA, RSA_R_INVALID_TRAILER}, ++ #else ++ {"INVALID_TRAILER", 4, 139}, ++ #endif ++ #ifdef RSA_R_INVALID_X931_DIGEST ++ {"INVALID_X931_DIGEST", ERR_LIB_RSA, RSA_R_INVALID_X931_DIGEST}, ++ #else ++ {"INVALID_X931_DIGEST", 4, 142}, ++ #endif ++ #ifdef RSA_R_IQMP_NOT_INVERSE_OF_Q ++ {"IQMP_NOT_INVERSE_OF_Q", ERR_LIB_RSA, RSA_R_IQMP_NOT_INVERSE_OF_Q}, ++ #else ++ {"IQMP_NOT_INVERSE_OF_Q", 4, 126}, ++ #endif ++ #ifdef RSA_R_KEY_PRIME_NUM_INVALID ++ {"KEY_PRIME_NUM_INVALID", ERR_LIB_RSA, RSA_R_KEY_PRIME_NUM_INVALID}, ++ #else ++ {"KEY_PRIME_NUM_INVALID", 4, 165}, ++ #endif ++ #ifdef RSA_R_KEY_SIZE_TOO_SMALL ++ {"KEY_SIZE_TOO_SMALL", ERR_LIB_RSA, RSA_R_KEY_SIZE_TOO_SMALL}, ++ #else ++ {"KEY_SIZE_TOO_SMALL", 4, 120}, ++ #endif ++ #ifdef RSA_R_LAST_OCTET_INVALID ++ {"LAST_OCTET_INVALID", ERR_LIB_RSA, RSA_R_LAST_OCTET_INVALID}, ++ #else ++ {"LAST_OCTET_INVALID", 4, 134}, ++ #endif ++ #ifdef RSA_R_MGF1_DIGEST_NOT_ALLOWED ++ {"MGF1_DIGEST_NOT_ALLOWED", ERR_LIB_RSA, RSA_R_MGF1_DIGEST_NOT_ALLOWED}, ++ #else ++ {"MGF1_DIGEST_NOT_ALLOWED", 4, 152}, ++ #endif ++ #ifdef RSA_R_MISSING_PRIVATE_KEY ++ {"MISSING_PRIVATE_KEY", ERR_LIB_RSA, RSA_R_MISSING_PRIVATE_KEY}, ++ #else ++ {"MISSING_PRIVATE_KEY", 4, 179}, ++ #endif ++ #ifdef RSA_R_MODULUS_TOO_LARGE ++ {"MODULUS_TOO_LARGE", ERR_LIB_RSA, RSA_R_MODULUS_TOO_LARGE}, ++ #else ++ {"MODULUS_TOO_LARGE", 4, 105}, ++ #endif ++ #ifdef RSA_R_MP_COEFFICIENT_NOT_INVERSE_OF_R ++ {"MP_COEFFICIENT_NOT_INVERSE_OF_R", ERR_LIB_RSA, RSA_R_MP_COEFFICIENT_NOT_INVERSE_OF_R}, ++ #else ++ {"MP_COEFFICIENT_NOT_INVERSE_OF_R", 4, 168}, ++ #endif ++ #ifdef RSA_R_MP_EXPONENT_NOT_CONGRUENT_TO_D ++ {"MP_EXPONENT_NOT_CONGRUENT_TO_D", ERR_LIB_RSA, RSA_R_MP_EXPONENT_NOT_CONGRUENT_TO_D}, ++ #else ++ {"MP_EXPONENT_NOT_CONGRUENT_TO_D", 4, 169}, ++ #endif ++ #ifdef RSA_R_MP_R_NOT_PRIME ++ {"MP_R_NOT_PRIME", ERR_LIB_RSA, RSA_R_MP_R_NOT_PRIME}, ++ #else ++ {"MP_R_NOT_PRIME", 4, 170}, ++ #endif ++ #ifdef RSA_R_NO_PUBLIC_EXPONENT ++ {"NO_PUBLIC_EXPONENT", ERR_LIB_RSA, RSA_R_NO_PUBLIC_EXPONENT}, ++ #else ++ {"NO_PUBLIC_EXPONENT", 4, 140}, ++ #endif ++ #ifdef RSA_R_NULL_BEFORE_BLOCK_MISSING ++ {"NULL_BEFORE_BLOCK_MISSING", ERR_LIB_RSA, RSA_R_NULL_BEFORE_BLOCK_MISSING}, ++ #else ++ {"NULL_BEFORE_BLOCK_MISSING", 4, 113}, ++ #endif ++ #ifdef RSA_R_N_DOES_NOT_EQUAL_PRODUCT_OF_PRIMES ++ {"N_DOES_NOT_EQUAL_PRODUCT_OF_PRIMES", ERR_LIB_RSA, RSA_R_N_DOES_NOT_EQUAL_PRODUCT_OF_PRIMES}, ++ #else ++ {"N_DOES_NOT_EQUAL_PRODUCT_OF_PRIMES", 4, 172}, ++ #endif ++ #ifdef RSA_R_N_DOES_NOT_EQUAL_P_Q ++ {"N_DOES_NOT_EQUAL_P_Q", ERR_LIB_RSA, RSA_R_N_DOES_NOT_EQUAL_P_Q}, ++ #else ++ {"N_DOES_NOT_EQUAL_P_Q", 4, 127}, ++ #endif ++ #ifdef RSA_R_OAEP_DECODING_ERROR ++ {"OAEP_DECODING_ERROR", ERR_LIB_RSA, RSA_R_OAEP_DECODING_ERROR}, ++ #else ++ {"OAEP_DECODING_ERROR", 4, 121}, ++ #endif ++ #ifdef RSA_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE ++ {"OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE", ERR_LIB_RSA, RSA_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE}, ++ #else ++ {"OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE", 4, 148}, ++ #endif ++ #ifdef RSA_R_PADDING_CHECK_FAILED ++ {"PADDING_CHECK_FAILED", ERR_LIB_RSA, RSA_R_PADDING_CHECK_FAILED}, ++ #else ++ {"PADDING_CHECK_FAILED", 4, 114}, ++ #endif ++ #ifdef RSA_R_PKCS_DECODING_ERROR ++ {"PKCS_DECODING_ERROR", ERR_LIB_RSA, RSA_R_PKCS_DECODING_ERROR}, ++ #else ++ {"PKCS_DECODING_ERROR", 4, 159}, ++ #endif ++ #ifdef RSA_R_PSS_SALTLEN_TOO_SMALL ++ {"PSS_SALTLEN_TOO_SMALL", ERR_LIB_RSA, RSA_R_PSS_SALTLEN_TOO_SMALL}, ++ #else ++ {"PSS_SALTLEN_TOO_SMALL", 4, 164}, ++ #endif ++ #ifdef RSA_R_P_NOT_PRIME ++ {"P_NOT_PRIME", ERR_LIB_RSA, RSA_R_P_NOT_PRIME}, ++ #else ++ {"P_NOT_PRIME", 4, 128}, ++ #endif ++ #ifdef RSA_R_Q_NOT_PRIME ++ {"Q_NOT_PRIME", ERR_LIB_RSA, RSA_R_Q_NOT_PRIME}, ++ #else ++ {"Q_NOT_PRIME", 4, 129}, ++ #endif ++ #ifdef RSA_R_RSA_OPERATIONS_NOT_SUPPORTED ++ {"RSA_OPERATIONS_NOT_SUPPORTED", ERR_LIB_RSA, RSA_R_RSA_OPERATIONS_NOT_SUPPORTED}, ++ #else ++ {"RSA_OPERATIONS_NOT_SUPPORTED", 4, 130}, ++ #endif ++ #ifdef RSA_R_SLEN_CHECK_FAILED ++ {"SLEN_CHECK_FAILED", ERR_LIB_RSA, RSA_R_SLEN_CHECK_FAILED}, ++ #else ++ {"SLEN_CHECK_FAILED", 4, 136}, ++ #endif ++ #ifdef RSA_R_SLEN_RECOVERY_FAILED ++ {"SLEN_RECOVERY_FAILED", ERR_LIB_RSA, RSA_R_SLEN_RECOVERY_FAILED}, ++ #else ++ {"SLEN_RECOVERY_FAILED", 4, 135}, ++ #endif ++ #ifdef RSA_R_SSLV3_ROLLBACK_ATTACK ++ {"SSLV3_ROLLBACK_ATTACK", ERR_LIB_RSA, RSA_R_SSLV3_ROLLBACK_ATTACK}, ++ #else ++ {"SSLV3_ROLLBACK_ATTACK", 4, 115}, ++ #endif ++ #ifdef RSA_R_THE_ASN1_OBJECT_IDENTIFIER_IS_NOT_KNOWN_FOR_THIS_MD ++ {"THE_ASN1_OBJECT_IDENTIFIER_IS_NOT_KNOWN_FOR_THIS_MD", ERR_LIB_RSA, RSA_R_THE_ASN1_OBJECT_IDENTIFIER_IS_NOT_KNOWN_FOR_THIS_MD}, ++ #else ++ {"THE_ASN1_OBJECT_IDENTIFIER_IS_NOT_KNOWN_FOR_THIS_MD", 4, 116}, ++ #endif ++ #ifdef RSA_R_UNKNOWN_ALGORITHM_TYPE ++ {"UNKNOWN_ALGORITHM_TYPE", ERR_LIB_RSA, RSA_R_UNKNOWN_ALGORITHM_TYPE}, ++ #else ++ {"UNKNOWN_ALGORITHM_TYPE", 4, 117}, ++ #endif ++ #ifdef RSA_R_UNKNOWN_DIGEST ++ {"UNKNOWN_DIGEST", ERR_LIB_RSA, RSA_R_UNKNOWN_DIGEST}, ++ #else ++ {"UNKNOWN_DIGEST", 4, 166}, ++ #endif ++ #ifdef RSA_R_UNKNOWN_MASK_DIGEST ++ {"UNKNOWN_MASK_DIGEST", ERR_LIB_RSA, RSA_R_UNKNOWN_MASK_DIGEST}, ++ #else ++ {"UNKNOWN_MASK_DIGEST", 4, 151}, ++ #endif ++ #ifdef RSA_R_UNKNOWN_PADDING_TYPE ++ {"UNKNOWN_PADDING_TYPE", ERR_LIB_RSA, RSA_R_UNKNOWN_PADDING_TYPE}, ++ #else ++ {"UNKNOWN_PADDING_TYPE", 4, 118}, ++ #endif ++ #ifdef RSA_R_UNSUPPORTED_ENCRYPTION_TYPE ++ {"UNSUPPORTED_ENCRYPTION_TYPE", ERR_LIB_RSA, RSA_R_UNSUPPORTED_ENCRYPTION_TYPE}, ++ #else ++ {"UNSUPPORTED_ENCRYPTION_TYPE", 4, 162}, ++ #endif ++ #ifdef RSA_R_UNSUPPORTED_LABEL_SOURCE ++ {"UNSUPPORTED_LABEL_SOURCE", ERR_LIB_RSA, RSA_R_UNSUPPORTED_LABEL_SOURCE}, ++ #else ++ {"UNSUPPORTED_LABEL_SOURCE", 4, 163}, ++ #endif ++ #ifdef RSA_R_UNSUPPORTED_MASK_ALGORITHM ++ {"UNSUPPORTED_MASK_ALGORITHM", ERR_LIB_RSA, RSA_R_UNSUPPORTED_MASK_ALGORITHM}, ++ #else ++ {"UNSUPPORTED_MASK_ALGORITHM", 4, 153}, ++ #endif ++ #ifdef RSA_R_UNSUPPORTED_MASK_PARAMETER ++ {"UNSUPPORTED_MASK_PARAMETER", ERR_LIB_RSA, RSA_R_UNSUPPORTED_MASK_PARAMETER}, ++ #else ++ {"UNSUPPORTED_MASK_PARAMETER", 4, 154}, ++ #endif ++ #ifdef RSA_R_UNSUPPORTED_SIGNATURE_TYPE ++ {"UNSUPPORTED_SIGNATURE_TYPE", ERR_LIB_RSA, RSA_R_UNSUPPORTED_SIGNATURE_TYPE}, ++ #else ++ {"UNSUPPORTED_SIGNATURE_TYPE", 4, 155}, ++ #endif ++ #ifdef RSA_R_VALUE_MISSING ++ {"VALUE_MISSING", ERR_LIB_RSA, RSA_R_VALUE_MISSING}, ++ #else ++ {"VALUE_MISSING", 4, 147}, ++ #endif ++ #ifdef RSA_R_WRONG_SIGNATURE_LENGTH ++ {"WRONG_SIGNATURE_LENGTH", ERR_LIB_RSA, RSA_R_WRONG_SIGNATURE_LENGTH}, ++ #else ++ {"WRONG_SIGNATURE_LENGTH", 4, 119}, ++ #endif ++ #ifdef SSL_R_APPLICATION_DATA_AFTER_CLOSE_NOTIFY ++ {"APPLICATION_DATA_AFTER_CLOSE_NOTIFY", ERR_LIB_SSL, SSL_R_APPLICATION_DATA_AFTER_CLOSE_NOTIFY}, ++ #else ++ {"APPLICATION_DATA_AFTER_CLOSE_NOTIFY", 20, 291}, ++ #endif ++ #ifdef SSL_R_APP_DATA_IN_HANDSHAKE ++ {"APP_DATA_IN_HANDSHAKE", ERR_LIB_SSL, SSL_R_APP_DATA_IN_HANDSHAKE}, ++ #else ++ {"APP_DATA_IN_HANDSHAKE", 20, 100}, ++ #endif ++ #ifdef SSL_R_ATTEMPT_TO_REUSE_SESSION_IN_DIFFERENT_CONTEXT ++ {"ATTEMPT_TO_REUSE_SESSION_IN_DIFFERENT_CONTEXT", ERR_LIB_SSL, SSL_R_ATTEMPT_TO_REUSE_SESSION_IN_DIFFERENT_CONTEXT}, ++ #else ++ {"ATTEMPT_TO_REUSE_SESSION_IN_DIFFERENT_CONTEXT", 20, 272}, ++ #endif ++ #ifdef SSL_R_AT_LEAST_TLS_1_0_NEEDED_IN_FIPS_MODE ++ {"AT_LEAST_TLS_1_0_NEEDED_IN_FIPS_MODE", ERR_LIB_SSL, SSL_R_AT_LEAST_TLS_1_0_NEEDED_IN_FIPS_MODE}, ++ #else ++ {"AT_LEAST_TLS_1_0_NEEDED_IN_FIPS_MODE", 20, 143}, ++ #endif ++ #ifdef SSL_R_AT_LEAST_TLS_1_2_NEEDED_IN_SUITEB_MODE ++ {"AT_LEAST_TLS_1_2_NEEDED_IN_SUITEB_MODE", ERR_LIB_SSL, SSL_R_AT_LEAST_TLS_1_2_NEEDED_IN_SUITEB_MODE}, ++ #else ++ {"AT_LEAST_TLS_1_2_NEEDED_IN_SUITEB_MODE", 20, 158}, ++ #endif ++ #ifdef SSL_R_BAD_CHANGE_CIPHER_SPEC ++ {"BAD_CHANGE_CIPHER_SPEC", ERR_LIB_SSL, SSL_R_BAD_CHANGE_CIPHER_SPEC}, ++ #else ++ {"BAD_CHANGE_CIPHER_SPEC", 20, 103}, ++ #endif ++ #ifdef SSL_R_BAD_CIPHER ++ {"BAD_CIPHER", ERR_LIB_SSL, SSL_R_BAD_CIPHER}, ++ #else ++ {"BAD_CIPHER", 20, 186}, ++ #endif ++ #ifdef SSL_R_BAD_DATA ++ {"BAD_DATA", ERR_LIB_SSL, SSL_R_BAD_DATA}, ++ #else ++ {"BAD_DATA", 20, 390}, ++ #endif ++ #ifdef SSL_R_BAD_DATA_RETURNED_BY_CALLBACK ++ {"BAD_DATA_RETURNED_BY_CALLBACK", ERR_LIB_SSL, SSL_R_BAD_DATA_RETURNED_BY_CALLBACK}, ++ #else ++ {"BAD_DATA_RETURNED_BY_CALLBACK", 20, 106}, ++ #endif ++ #ifdef SSL_R_BAD_DECOMPRESSION ++ {"BAD_DECOMPRESSION", ERR_LIB_SSL, SSL_R_BAD_DECOMPRESSION}, ++ #else ++ {"BAD_DECOMPRESSION", 20, 107}, ++ #endif ++ #ifdef SSL_R_BAD_DH_VALUE ++ {"BAD_DH_VALUE", ERR_LIB_SSL, SSL_R_BAD_DH_VALUE}, ++ #else ++ {"BAD_DH_VALUE", 20, 102}, ++ #endif ++ #ifdef SSL_R_BAD_DIGEST_LENGTH ++ {"BAD_DIGEST_LENGTH", ERR_LIB_SSL, SSL_R_BAD_DIGEST_LENGTH}, ++ #else ++ {"BAD_DIGEST_LENGTH", 20, 111}, ++ #endif ++ #ifdef SSL_R_BAD_EARLY_DATA ++ {"BAD_EARLY_DATA", ERR_LIB_SSL, SSL_R_BAD_EARLY_DATA}, ++ #else ++ {"BAD_EARLY_DATA", 20, 233}, ++ #endif ++ #ifdef SSL_R_BAD_ECC_CERT ++ {"BAD_ECC_CERT", ERR_LIB_SSL, SSL_R_BAD_ECC_CERT}, ++ #else ++ {"BAD_ECC_CERT", 20, 304}, ++ #endif ++ #ifdef SSL_R_BAD_ECDSA_SIGNATURE ++ {"BAD_ECDSA_SIGNATURE", ERR_LIB_SSL, SSL_R_BAD_ECDSA_SIGNATURE}, ++ #else ++ {"BAD_ECDSA_SIGNATURE", 20, 305}, ++ #endif ++ #ifdef SSL_R_BAD_ECPOINT ++ {"BAD_ECPOINT", ERR_LIB_SSL, SSL_R_BAD_ECPOINT}, ++ #else ++ {"BAD_ECPOINT", 20, 306}, ++ #endif ++ #ifdef SSL_R_BAD_EXTENSION ++ {"BAD_EXTENSION", ERR_LIB_SSL, SSL_R_BAD_EXTENSION}, ++ #else ++ {"BAD_EXTENSION", 20, 110}, ++ #endif ++ #ifdef SSL_R_BAD_HANDSHAKE_LENGTH ++ {"BAD_HANDSHAKE_LENGTH", ERR_LIB_SSL, SSL_R_BAD_HANDSHAKE_LENGTH}, ++ #else ++ {"BAD_HANDSHAKE_LENGTH", 20, 332}, ++ #endif ++ #ifdef SSL_R_BAD_HANDSHAKE_STATE ++ {"BAD_HANDSHAKE_STATE", ERR_LIB_SSL, SSL_R_BAD_HANDSHAKE_STATE}, ++ #else ++ {"BAD_HANDSHAKE_STATE", 20, 236}, ++ #endif ++ #ifdef SSL_R_BAD_HELLO_REQUEST ++ {"BAD_HELLO_REQUEST", ERR_LIB_SSL, SSL_R_BAD_HELLO_REQUEST}, ++ #else ++ {"BAD_HELLO_REQUEST", 20, 105}, ++ #endif ++ #ifdef SSL_R_BAD_HRR_VERSION ++ {"BAD_HRR_VERSION", ERR_LIB_SSL, SSL_R_BAD_HRR_VERSION}, ++ #else ++ {"BAD_HRR_VERSION", 20, 263}, ++ #endif ++ #ifdef SSL_R_BAD_KEY_SHARE ++ {"BAD_KEY_SHARE", ERR_LIB_SSL, SSL_R_BAD_KEY_SHARE}, ++ #else ++ {"BAD_KEY_SHARE", 20, 108}, ++ #endif ++ #ifdef SSL_R_BAD_KEY_UPDATE ++ {"BAD_KEY_UPDATE", ERR_LIB_SSL, SSL_R_BAD_KEY_UPDATE}, ++ #else ++ {"BAD_KEY_UPDATE", 20, 122}, ++ #endif ++ #ifdef SSL_R_BAD_LEGACY_VERSION ++ {"BAD_LEGACY_VERSION", ERR_LIB_SSL, SSL_R_BAD_LEGACY_VERSION}, ++ #else ++ {"BAD_LEGACY_VERSION", 20, 292}, ++ #endif ++ #ifdef SSL_R_BAD_LENGTH ++ {"BAD_LENGTH", ERR_LIB_SSL, SSL_R_BAD_LENGTH}, ++ #else ++ {"BAD_LENGTH", 20, 271}, ++ #endif ++ #ifdef SSL_R_BAD_MAC_LENGTH ++ {"BAD_MAC_LENGTH", ERR_LIB_SSL, SSL_R_BAD_MAC_LENGTH}, ++ #else ++ {"BAD_MAC_LENGTH", 20, 333}, ++ #endif ++ #ifdef SSL_R_BAD_PACKET ++ {"BAD_PACKET", ERR_LIB_SSL, SSL_R_BAD_PACKET}, ++ #else ++ {"BAD_PACKET", 20, 240}, ++ #endif ++ #ifdef SSL_R_BAD_PACKET_LENGTH ++ {"BAD_PACKET_LENGTH", ERR_LIB_SSL, SSL_R_BAD_PACKET_LENGTH}, ++ #else ++ {"BAD_PACKET_LENGTH", 20, 115}, ++ #endif ++ #ifdef SSL_R_BAD_PROTOCOL_VERSION_NUMBER ++ {"BAD_PROTOCOL_VERSION_NUMBER", ERR_LIB_SSL, SSL_R_BAD_PROTOCOL_VERSION_NUMBER}, ++ #else ++ {"BAD_PROTOCOL_VERSION_NUMBER", 20, 116}, ++ #endif ++ #ifdef SSL_R_BAD_PSK ++ {"BAD_PSK", ERR_LIB_SSL, SSL_R_BAD_PSK}, ++ #else ++ {"BAD_PSK", 20, 219}, ++ #endif ++ #ifdef SSL_R_BAD_PSK_IDENTITY ++ {"BAD_PSK_IDENTITY", ERR_LIB_SSL, SSL_R_BAD_PSK_IDENTITY}, ++ #else ++ {"BAD_PSK_IDENTITY", 20, 114}, ++ #endif ++ #ifdef SSL_R_BAD_PSK_IDENTITY_HINT_LENGTH ++ {"BAD_PSK_IDENTITY_HINT_LENGTH", ERR_LIB_SSL, SSL_R_BAD_PSK_IDENTITY_HINT_LENGTH}, ++ #else ++ {"BAD_PSK_IDENTITY_HINT_LENGTH", 20, 316}, ++ #endif ++ #ifdef SSL_R_BAD_RECORD_TYPE ++ {"BAD_RECORD_TYPE", ERR_LIB_SSL, SSL_R_BAD_RECORD_TYPE}, ++ #else ++ {"BAD_RECORD_TYPE", 20, 443}, ++ #endif ++ #ifdef SSL_R_BAD_RSA_ENCRYPT ++ {"BAD_RSA_ENCRYPT", ERR_LIB_SSL, SSL_R_BAD_RSA_ENCRYPT}, ++ #else ++ {"BAD_RSA_ENCRYPT", 20, 119}, ++ #endif ++ #ifdef SSL_R_BAD_SIGNATURE ++ {"BAD_SIGNATURE", ERR_LIB_SSL, SSL_R_BAD_SIGNATURE}, ++ #else ++ {"BAD_SIGNATURE", 20, 123}, ++ #endif ++ #ifdef SSL_R_BAD_SRP_A_LENGTH ++ {"BAD_SRP_A_LENGTH", ERR_LIB_SSL, SSL_R_BAD_SRP_A_LENGTH}, ++ #else ++ {"BAD_SRP_A_LENGTH", 20, 347}, ++ #endif ++ #ifdef SSL_R_BAD_SRP_B_LENGTH ++ {"BAD_SRP_B_LENGTH", ERR_LIB_SSL, SSL_R_BAD_SRP_B_LENGTH}, ++ #else ++ {"BAD_SRP_B_LENGTH", 20, 348}, ++ #endif ++ #ifdef SSL_R_BAD_SRP_G_LENGTH ++ {"BAD_SRP_G_LENGTH", ERR_LIB_SSL, SSL_R_BAD_SRP_G_LENGTH}, ++ #else ++ {"BAD_SRP_G_LENGTH", 20, 349}, ++ #endif ++ #ifdef SSL_R_BAD_SRP_N_LENGTH ++ {"BAD_SRP_N_LENGTH", ERR_LIB_SSL, SSL_R_BAD_SRP_N_LENGTH}, ++ #else ++ {"BAD_SRP_N_LENGTH", 20, 350}, ++ #endif ++ #ifdef SSL_R_BAD_SRP_PARAMETERS ++ {"BAD_SRP_PARAMETERS", ERR_LIB_SSL, SSL_R_BAD_SRP_PARAMETERS}, ++ #else ++ {"BAD_SRP_PARAMETERS", 20, 371}, ++ #endif ++ #ifdef SSL_R_BAD_SRP_S_LENGTH ++ {"BAD_SRP_S_LENGTH", ERR_LIB_SSL, SSL_R_BAD_SRP_S_LENGTH}, ++ #else ++ {"BAD_SRP_S_LENGTH", 20, 351}, ++ #endif ++ #ifdef SSL_R_BAD_SRTP_MKI_VALUE ++ {"BAD_SRTP_MKI_VALUE", ERR_LIB_SSL, SSL_R_BAD_SRTP_MKI_VALUE}, ++ #else ++ {"BAD_SRTP_MKI_VALUE", 20, 352}, ++ #endif ++ #ifdef SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST ++ {"BAD_SRTP_PROTECTION_PROFILE_LIST", ERR_LIB_SSL, SSL_R_BAD_SRTP_PROTECTION_PROFILE_LIST}, ++ #else ++ {"BAD_SRTP_PROTECTION_PROFILE_LIST", 20, 353}, ++ #endif ++ #ifdef SSL_R_BAD_SSL_FILETYPE ++ {"BAD_SSL_FILETYPE", ERR_LIB_SSL, SSL_R_BAD_SSL_FILETYPE}, ++ #else ++ {"BAD_SSL_FILETYPE", 20, 124}, ++ #endif ++ #ifdef SSL_R_BAD_VALUE ++ {"BAD_VALUE", ERR_LIB_SSL, SSL_R_BAD_VALUE}, ++ #else ++ {"BAD_VALUE", 20, 384}, ++ #endif ++ #ifdef SSL_R_BAD_WRITE_RETRY ++ {"BAD_WRITE_RETRY", ERR_LIB_SSL, SSL_R_BAD_WRITE_RETRY}, ++ #else ++ {"BAD_WRITE_RETRY", 20, 127}, ++ #endif ++ #ifdef SSL_R_BINDER_DOES_NOT_VERIFY ++ {"BINDER_DOES_NOT_VERIFY", ERR_LIB_SSL, SSL_R_BINDER_DOES_NOT_VERIFY}, ++ #else ++ {"BINDER_DOES_NOT_VERIFY", 20, 253}, ++ #endif ++ #ifdef SSL_R_BIO_NOT_SET ++ {"BIO_NOT_SET", ERR_LIB_SSL, SSL_R_BIO_NOT_SET}, ++ #else ++ {"BIO_NOT_SET", 20, 128}, ++ #endif ++ #ifdef SSL_R_BLOCK_CIPHER_PAD_IS_WRONG ++ {"BLOCK_CIPHER_PAD_IS_WRONG", ERR_LIB_SSL, SSL_R_BLOCK_CIPHER_PAD_IS_WRONG}, ++ #else ++ {"BLOCK_CIPHER_PAD_IS_WRONG", 20, 129}, ++ #endif ++ #ifdef SSL_R_BN_LIB ++ {"BN_LIB", ERR_LIB_SSL, SSL_R_BN_LIB}, ++ #else ++ {"BN_LIB", 20, 130}, ++ #endif ++ #ifdef SSL_R_CALLBACK_FAILED ++ {"CALLBACK_FAILED", ERR_LIB_SSL, SSL_R_CALLBACK_FAILED}, ++ #else ++ {"CALLBACK_FAILED", 20, 234}, ++ #endif ++ #ifdef SSL_R_CANNOT_CHANGE_CIPHER ++ {"CANNOT_CHANGE_CIPHER", ERR_LIB_SSL, SSL_R_CANNOT_CHANGE_CIPHER}, ++ #else ++ {"CANNOT_CHANGE_CIPHER", 20, 109}, ++ #endif ++ #ifdef SSL_R_CA_DN_LENGTH_MISMATCH ++ {"CA_DN_LENGTH_MISMATCH", ERR_LIB_SSL, SSL_R_CA_DN_LENGTH_MISMATCH}, ++ #else ++ {"CA_DN_LENGTH_MISMATCH", 20, 131}, ++ #endif ++ #ifdef SSL_R_CA_KEY_TOO_SMALL ++ {"CA_KEY_TOO_SMALL", ERR_LIB_SSL, SSL_R_CA_KEY_TOO_SMALL}, ++ #else ++ {"CA_KEY_TOO_SMALL", 20, 397}, ++ #endif ++ #ifdef SSL_R_CA_MD_TOO_WEAK ++ {"CA_MD_TOO_WEAK", ERR_LIB_SSL, SSL_R_CA_MD_TOO_WEAK}, ++ #else ++ {"CA_MD_TOO_WEAK", 20, 398}, ++ #endif ++ #ifdef SSL_R_CCS_RECEIVED_EARLY ++ {"CCS_RECEIVED_EARLY", ERR_LIB_SSL, SSL_R_CCS_RECEIVED_EARLY}, ++ #else ++ {"CCS_RECEIVED_EARLY", 20, 133}, ++ #endif ++ #ifdef SSL_R_CERTIFICATE_VERIFY_FAILED ++ {"CERTIFICATE_VERIFY_FAILED", ERR_LIB_SSL, SSL_R_CERTIFICATE_VERIFY_FAILED}, ++ #else ++ {"CERTIFICATE_VERIFY_FAILED", 20, 134}, ++ #endif ++ #ifdef SSL_R_CERT_CB_ERROR ++ {"CERT_CB_ERROR", ERR_LIB_SSL, SSL_R_CERT_CB_ERROR}, ++ #else ++ {"CERT_CB_ERROR", 20, 377}, ++ #endif ++ #ifdef SSL_R_CERT_LENGTH_MISMATCH ++ {"CERT_LENGTH_MISMATCH", ERR_LIB_SSL, SSL_R_CERT_LENGTH_MISMATCH}, ++ #else ++ {"CERT_LENGTH_MISMATCH", 20, 135}, ++ #endif ++ #ifdef SSL_R_CIPHERSUITE_DIGEST_HAS_CHANGED ++ {"CIPHERSUITE_DIGEST_HAS_CHANGED", ERR_LIB_SSL, SSL_R_CIPHERSUITE_DIGEST_HAS_CHANGED}, ++ #else ++ {"CIPHERSUITE_DIGEST_HAS_CHANGED", 20, 218}, ++ #endif ++ #ifdef SSL_R_CIPHER_CODE_WRONG_LENGTH ++ {"CIPHER_CODE_WRONG_LENGTH", ERR_LIB_SSL, SSL_R_CIPHER_CODE_WRONG_LENGTH}, ++ #else ++ {"CIPHER_CODE_WRONG_LENGTH", 20, 137}, ++ #endif ++ #ifdef SSL_R_CIPHER_OR_HASH_UNAVAILABLE ++ {"CIPHER_OR_HASH_UNAVAILABLE", ERR_LIB_SSL, SSL_R_CIPHER_OR_HASH_UNAVAILABLE}, ++ #else ++ {"CIPHER_OR_HASH_UNAVAILABLE", 20, 138}, ++ #endif ++ #ifdef SSL_R_CLIENTHELLO_TLSEXT ++ {"CLIENTHELLO_TLSEXT", ERR_LIB_SSL, SSL_R_CLIENTHELLO_TLSEXT}, ++ #else ++ {"CLIENTHELLO_TLSEXT", 20, 226}, ++ #endif ++ #ifdef SSL_R_COMPRESSED_LENGTH_TOO_LONG ++ {"COMPRESSED_LENGTH_TOO_LONG", ERR_LIB_SSL, SSL_R_COMPRESSED_LENGTH_TOO_LONG}, ++ #else ++ {"COMPRESSED_LENGTH_TOO_LONG", 20, 140}, ++ #endif ++ #ifdef SSL_R_COMPRESSION_DISABLED ++ {"COMPRESSION_DISABLED", ERR_LIB_SSL, SSL_R_COMPRESSION_DISABLED}, ++ #else ++ {"COMPRESSION_DISABLED", 20, 343}, ++ #endif ++ #ifdef SSL_R_COMPRESSION_FAILURE ++ {"COMPRESSION_FAILURE", ERR_LIB_SSL, SSL_R_COMPRESSION_FAILURE}, ++ #else ++ {"COMPRESSION_FAILURE", 20, 141}, ++ #endif ++ #ifdef SSL_R_COMPRESSION_ID_NOT_WITHIN_PRIVATE_RANGE ++ {"COMPRESSION_ID_NOT_WITHIN_PRIVATE_RANGE", ERR_LIB_SSL, SSL_R_COMPRESSION_ID_NOT_WITHIN_PRIVATE_RANGE}, ++ #else ++ {"COMPRESSION_ID_NOT_WITHIN_PRIVATE_RANGE", 20, 307}, ++ #endif ++ #ifdef SSL_R_COMPRESSION_LIBRARY_ERROR ++ {"COMPRESSION_LIBRARY_ERROR", ERR_LIB_SSL, SSL_R_COMPRESSION_LIBRARY_ERROR}, ++ #else ++ {"COMPRESSION_LIBRARY_ERROR", 20, 142}, ++ #endif ++ #ifdef SSL_R_CONNECTION_TYPE_NOT_SET ++ {"CONNECTION_TYPE_NOT_SET", ERR_LIB_SSL, SSL_R_CONNECTION_TYPE_NOT_SET}, ++ #else ++ {"CONNECTION_TYPE_NOT_SET", 20, 144}, ++ #endif ++ #ifdef SSL_R_CONTEXT_NOT_DANE_ENABLED ++ {"CONTEXT_NOT_DANE_ENABLED", ERR_LIB_SSL, SSL_R_CONTEXT_NOT_DANE_ENABLED}, ++ #else ++ {"CONTEXT_NOT_DANE_ENABLED", 20, 167}, ++ #endif ++ #ifdef SSL_R_COOKIE_GEN_CALLBACK_FAILURE ++ {"COOKIE_GEN_CALLBACK_FAILURE", ERR_LIB_SSL, SSL_R_COOKIE_GEN_CALLBACK_FAILURE}, ++ #else ++ {"COOKIE_GEN_CALLBACK_FAILURE", 20, 400}, ++ #endif ++ #ifdef SSL_R_COOKIE_MISMATCH ++ {"COOKIE_MISMATCH", ERR_LIB_SSL, SSL_R_COOKIE_MISMATCH}, ++ #else ++ {"COOKIE_MISMATCH", 20, 308}, ++ #endif ++ #ifdef SSL_R_CUSTOM_EXT_HANDLER_ALREADY_INSTALLED ++ {"CUSTOM_EXT_HANDLER_ALREADY_INSTALLED", ERR_LIB_SSL, SSL_R_CUSTOM_EXT_HANDLER_ALREADY_INSTALLED}, ++ #else ++ {"CUSTOM_EXT_HANDLER_ALREADY_INSTALLED", 20, 206}, ++ #endif ++ #ifdef SSL_R_DANE_ALREADY_ENABLED ++ {"DANE_ALREADY_ENABLED", ERR_LIB_SSL, SSL_R_DANE_ALREADY_ENABLED}, ++ #else ++ {"DANE_ALREADY_ENABLED", 20, 172}, ++ #endif ++ #ifdef SSL_R_DANE_CANNOT_OVERRIDE_MTYPE_FULL ++ {"DANE_CANNOT_OVERRIDE_MTYPE_FULL", ERR_LIB_SSL, SSL_R_DANE_CANNOT_OVERRIDE_MTYPE_FULL}, ++ #else ++ {"DANE_CANNOT_OVERRIDE_MTYPE_FULL", 20, 173}, ++ #endif ++ #ifdef SSL_R_DANE_NOT_ENABLED ++ {"DANE_NOT_ENABLED", ERR_LIB_SSL, SSL_R_DANE_NOT_ENABLED}, ++ #else ++ {"DANE_NOT_ENABLED", 20, 175}, ++ #endif ++ #ifdef SSL_R_DANE_TLSA_BAD_CERTIFICATE ++ {"DANE_TLSA_BAD_CERTIFICATE", ERR_LIB_SSL, SSL_R_DANE_TLSA_BAD_CERTIFICATE}, ++ #else ++ {"DANE_TLSA_BAD_CERTIFICATE", 20, 180}, ++ #endif ++ #ifdef SSL_R_DANE_TLSA_BAD_CERTIFICATE_USAGE ++ {"DANE_TLSA_BAD_CERTIFICATE_USAGE", ERR_LIB_SSL, SSL_R_DANE_TLSA_BAD_CERTIFICATE_USAGE}, ++ #else ++ {"DANE_TLSA_BAD_CERTIFICATE_USAGE", 20, 184}, ++ #endif ++ #ifdef SSL_R_DANE_TLSA_BAD_DATA_LENGTH ++ {"DANE_TLSA_BAD_DATA_LENGTH", ERR_LIB_SSL, SSL_R_DANE_TLSA_BAD_DATA_LENGTH}, ++ #else ++ {"DANE_TLSA_BAD_DATA_LENGTH", 20, 189}, ++ #endif ++ #ifdef SSL_R_DANE_TLSA_BAD_DIGEST_LENGTH ++ {"DANE_TLSA_BAD_DIGEST_LENGTH", ERR_LIB_SSL, SSL_R_DANE_TLSA_BAD_DIGEST_LENGTH}, ++ #else ++ {"DANE_TLSA_BAD_DIGEST_LENGTH", 20, 192}, ++ #endif ++ #ifdef SSL_R_DANE_TLSA_BAD_MATCHING_TYPE ++ {"DANE_TLSA_BAD_MATCHING_TYPE", ERR_LIB_SSL, SSL_R_DANE_TLSA_BAD_MATCHING_TYPE}, ++ #else ++ {"DANE_TLSA_BAD_MATCHING_TYPE", 20, 200}, ++ #endif ++ #ifdef SSL_R_DANE_TLSA_BAD_PUBLIC_KEY ++ {"DANE_TLSA_BAD_PUBLIC_KEY", ERR_LIB_SSL, SSL_R_DANE_TLSA_BAD_PUBLIC_KEY}, ++ #else ++ {"DANE_TLSA_BAD_PUBLIC_KEY", 20, 201}, ++ #endif ++ #ifdef SSL_R_DANE_TLSA_BAD_SELECTOR ++ {"DANE_TLSA_BAD_SELECTOR", ERR_LIB_SSL, SSL_R_DANE_TLSA_BAD_SELECTOR}, ++ #else ++ {"DANE_TLSA_BAD_SELECTOR", 20, 202}, ++ #endif ++ #ifdef SSL_R_DANE_TLSA_NULL_DATA ++ {"DANE_TLSA_NULL_DATA", ERR_LIB_SSL, SSL_R_DANE_TLSA_NULL_DATA}, ++ #else ++ {"DANE_TLSA_NULL_DATA", 20, 203}, ++ #endif ++ #ifdef SSL_R_DATA_BETWEEN_CCS_AND_FINISHED ++ {"DATA_BETWEEN_CCS_AND_FINISHED", ERR_LIB_SSL, SSL_R_DATA_BETWEEN_CCS_AND_FINISHED}, ++ #else ++ {"DATA_BETWEEN_CCS_AND_FINISHED", 20, 145}, ++ #endif ++ #ifdef SSL_R_DATA_LENGTH_TOO_LONG ++ {"DATA_LENGTH_TOO_LONG", ERR_LIB_SSL, SSL_R_DATA_LENGTH_TOO_LONG}, ++ #else ++ {"DATA_LENGTH_TOO_LONG", 20, 146}, ++ #endif ++ #ifdef SSL_R_DECRYPTION_FAILED ++ {"DECRYPTION_FAILED", ERR_LIB_SSL, SSL_R_DECRYPTION_FAILED}, ++ #else ++ {"DECRYPTION_FAILED", 20, 147}, ++ #endif ++ #ifdef SSL_R_DECRYPTION_FAILED_OR_BAD_RECORD_MAC ++ {"DECRYPTION_FAILED_OR_BAD_RECORD_MAC", ERR_LIB_SSL, SSL_R_DECRYPTION_FAILED_OR_BAD_RECORD_MAC}, ++ #else ++ {"DECRYPTION_FAILED_OR_BAD_RECORD_MAC", 20, 281}, ++ #endif ++ #ifdef SSL_R_DH_KEY_TOO_SMALL ++ {"DH_KEY_TOO_SMALL", ERR_LIB_SSL, SSL_R_DH_KEY_TOO_SMALL}, ++ #else ++ {"DH_KEY_TOO_SMALL", 20, 394}, ++ #endif ++ #ifdef SSL_R_DH_PUBLIC_VALUE_LENGTH_IS_WRONG ++ {"DH_PUBLIC_VALUE_LENGTH_IS_WRONG", ERR_LIB_SSL, SSL_R_DH_PUBLIC_VALUE_LENGTH_IS_WRONG}, ++ #else ++ {"DH_PUBLIC_VALUE_LENGTH_IS_WRONG", 20, 148}, ++ #endif ++ #ifdef SSL_R_DIGEST_CHECK_FAILED ++ {"DIGEST_CHECK_FAILED", ERR_LIB_SSL, SSL_R_DIGEST_CHECK_FAILED}, ++ #else ++ {"DIGEST_CHECK_FAILED", 20, 149}, ++ #endif ++ #ifdef SSL_R_DTLS_MESSAGE_TOO_BIG ++ {"DTLS_MESSAGE_TOO_BIG", ERR_LIB_SSL, SSL_R_DTLS_MESSAGE_TOO_BIG}, ++ #else ++ {"DTLS_MESSAGE_TOO_BIG", 20, 334}, ++ #endif ++ #ifdef SSL_R_DUPLICATE_COMPRESSION_ID ++ {"DUPLICATE_COMPRESSION_ID", ERR_LIB_SSL, SSL_R_DUPLICATE_COMPRESSION_ID}, ++ #else ++ {"DUPLICATE_COMPRESSION_ID", 20, 309}, ++ #endif ++ #ifdef SSL_R_ECC_CERT_NOT_FOR_KEY_AGREEMENT ++ {"ECC_CERT_NOT_FOR_KEY_AGREEMENT", ERR_LIB_SSL, SSL_R_ECC_CERT_NOT_FOR_KEY_AGREEMENT}, ++ #else ++ {"ECC_CERT_NOT_FOR_KEY_AGREEMENT", 20, 317}, ++ #endif ++ #ifdef SSL_R_ECC_CERT_NOT_FOR_SIGNING ++ {"ECC_CERT_NOT_FOR_SIGNING", ERR_LIB_SSL, SSL_R_ECC_CERT_NOT_FOR_SIGNING}, ++ #else ++ {"ECC_CERT_NOT_FOR_SIGNING", 20, 318}, ++ #endif ++ #ifdef SSL_R_ECC_CERT_SHOULD_HAVE_RSA_SIGNATURE ++ {"ECC_CERT_SHOULD_HAVE_RSA_SIGNATURE", ERR_LIB_SSL, SSL_R_ECC_CERT_SHOULD_HAVE_RSA_SIGNATURE}, ++ #else ++ {"ECC_CERT_SHOULD_HAVE_RSA_SIGNATURE", 20, 322}, ++ #endif ++ #ifdef SSL_R_ECC_CERT_SHOULD_HAVE_SHA1_SIGNATURE ++ {"ECC_CERT_SHOULD_HAVE_SHA1_SIGNATURE", ERR_LIB_SSL, SSL_R_ECC_CERT_SHOULD_HAVE_SHA1_SIGNATURE}, ++ #else ++ {"ECC_CERT_SHOULD_HAVE_SHA1_SIGNATURE", 20, 323}, ++ #endif ++ #ifdef SSL_R_ECDH_REQUIRED_FOR_SUITEB_MODE ++ {"ECDH_REQUIRED_FOR_SUITEB_MODE", ERR_LIB_SSL, SSL_R_ECDH_REQUIRED_FOR_SUITEB_MODE}, ++ #else ++ {"ECDH_REQUIRED_FOR_SUITEB_MODE", 20, 374}, ++ #endif ++ #ifdef SSL_R_ECGROUP_TOO_LARGE_FOR_CIPHER ++ {"ECGROUP_TOO_LARGE_FOR_CIPHER", ERR_LIB_SSL, SSL_R_ECGROUP_TOO_LARGE_FOR_CIPHER}, ++ #else ++ {"ECGROUP_TOO_LARGE_FOR_CIPHER", 20, 310}, ++ #endif ++ #ifdef SSL_R_EE_KEY_TOO_SMALL ++ {"EE_KEY_TOO_SMALL", ERR_LIB_SSL, SSL_R_EE_KEY_TOO_SMALL}, ++ #else ++ {"EE_KEY_TOO_SMALL", 20, 399}, ++ #endif ++ #ifdef SSL_R_EMPTY_SRTP_PROTECTION_PROFILE_LIST ++ {"EMPTY_SRTP_PROTECTION_PROFILE_LIST", ERR_LIB_SSL, SSL_R_EMPTY_SRTP_PROTECTION_PROFILE_LIST}, ++ #else ++ {"EMPTY_SRTP_PROTECTION_PROFILE_LIST", 20, 354}, ++ #endif ++ #ifdef SSL_R_ENCRYPTED_LENGTH_TOO_LONG ++ {"ENCRYPTED_LENGTH_TOO_LONG", ERR_LIB_SSL, SSL_R_ENCRYPTED_LENGTH_TOO_LONG}, ++ #else ++ {"ENCRYPTED_LENGTH_TOO_LONG", 20, 150}, ++ #endif ++ #ifdef SSL_R_ERROR_IN_RECEIVED_CIPHER_LIST ++ {"ERROR_IN_RECEIVED_CIPHER_LIST", ERR_LIB_SSL, SSL_R_ERROR_IN_RECEIVED_CIPHER_LIST}, ++ #else ++ {"ERROR_IN_RECEIVED_CIPHER_LIST", 20, 151}, ++ #endif ++ #ifdef SSL_R_ERROR_SETTING_TLSA_BASE_DOMAIN ++ {"ERROR_SETTING_TLSA_BASE_DOMAIN", ERR_LIB_SSL, SSL_R_ERROR_SETTING_TLSA_BASE_DOMAIN}, ++ #else ++ {"ERROR_SETTING_TLSA_BASE_DOMAIN", 20, 204}, ++ #endif ++ #ifdef SSL_R_EXCEEDS_MAX_FRAGMENT_SIZE ++ {"EXCEEDS_MAX_FRAGMENT_SIZE", ERR_LIB_SSL, SSL_R_EXCEEDS_MAX_FRAGMENT_SIZE}, ++ #else ++ {"EXCEEDS_MAX_FRAGMENT_SIZE", 20, 194}, ++ #endif ++ #ifdef SSL_R_EXCESSIVE_MESSAGE_SIZE ++ {"EXCESSIVE_MESSAGE_SIZE", ERR_LIB_SSL, SSL_R_EXCESSIVE_MESSAGE_SIZE}, ++ #else ++ {"EXCESSIVE_MESSAGE_SIZE", 20, 152}, ++ #endif ++ #ifdef SSL_R_EXTENSION_NOT_RECEIVED ++ {"EXTENSION_NOT_RECEIVED", ERR_LIB_SSL, SSL_R_EXTENSION_NOT_RECEIVED}, ++ #else ++ {"EXTENSION_NOT_RECEIVED", 20, 279}, ++ #endif ++ #ifdef SSL_R_EXTRA_DATA_IN_MESSAGE ++ {"EXTRA_DATA_IN_MESSAGE", ERR_LIB_SSL, SSL_R_EXTRA_DATA_IN_MESSAGE}, ++ #else ++ {"EXTRA_DATA_IN_MESSAGE", 20, 153}, ++ #endif ++ #ifdef SSL_R_EXT_LENGTH_MISMATCH ++ {"EXT_LENGTH_MISMATCH", ERR_LIB_SSL, SSL_R_EXT_LENGTH_MISMATCH}, ++ #else ++ {"EXT_LENGTH_MISMATCH", 20, 163}, ++ #endif ++ #ifdef SSL_R_FAILED_TO_INIT_ASYNC ++ {"FAILED_TO_INIT_ASYNC", ERR_LIB_SSL, SSL_R_FAILED_TO_INIT_ASYNC}, ++ #else ++ {"FAILED_TO_INIT_ASYNC", 20, 405}, ++ #endif ++ #ifdef SSL_R_FRAGMENTED_CLIENT_HELLO ++ {"FRAGMENTED_CLIENT_HELLO", ERR_LIB_SSL, SSL_R_FRAGMENTED_CLIENT_HELLO}, ++ #else ++ {"FRAGMENTED_CLIENT_HELLO", 20, 401}, ++ #endif ++ #ifdef SSL_R_GOT_A_FIN_BEFORE_A_CCS ++ {"GOT_A_FIN_BEFORE_A_CCS", ERR_LIB_SSL, SSL_R_GOT_A_FIN_BEFORE_A_CCS}, ++ #else ++ {"GOT_A_FIN_BEFORE_A_CCS", 20, 154}, ++ #endif ++ #ifdef SSL_R_GOT_NEXT_PROTO_BEFORE_A_CCS ++ {"GOT_NEXT_PROTO_BEFORE_A_CCS", ERR_LIB_SSL, SSL_R_GOT_NEXT_PROTO_BEFORE_A_CCS}, ++ #else ++ {"GOT_NEXT_PROTO_BEFORE_A_CCS", 20, 355}, ++ #endif ++ #ifdef SSL_R_GOT_NEXT_PROTO_WITHOUT_EXTENSION ++ {"GOT_NEXT_PROTO_WITHOUT_EXTENSION", ERR_LIB_SSL, SSL_R_GOT_NEXT_PROTO_WITHOUT_EXTENSION}, ++ #else ++ {"GOT_NEXT_PROTO_WITHOUT_EXTENSION", 20, 356}, ++ #endif ++ #ifdef SSL_R_HTTPS_PROXY_REQUEST ++ {"HTTPS_PROXY_REQUEST", ERR_LIB_SSL, SSL_R_HTTPS_PROXY_REQUEST}, ++ #else ++ {"HTTPS_PROXY_REQUEST", 20, 155}, ++ #endif ++ #ifdef SSL_R_HTTP_REQUEST ++ {"HTTP_REQUEST", ERR_LIB_SSL, SSL_R_HTTP_REQUEST}, ++ #else ++ {"HTTP_REQUEST", 20, 156}, ++ #endif ++ #ifdef SSL_R_ILLEGAL_POINT_COMPRESSION ++ {"ILLEGAL_POINT_COMPRESSION", ERR_LIB_SSL, SSL_R_ILLEGAL_POINT_COMPRESSION}, ++ #else ++ {"ILLEGAL_POINT_COMPRESSION", 20, 162}, ++ #endif ++ #ifdef SSL_R_ILLEGAL_SUITEB_DIGEST ++ {"ILLEGAL_SUITEB_DIGEST", ERR_LIB_SSL, SSL_R_ILLEGAL_SUITEB_DIGEST}, ++ #else ++ {"ILLEGAL_SUITEB_DIGEST", 20, 380}, ++ #endif ++ #ifdef SSL_R_INAPPROPRIATE_FALLBACK ++ {"INAPPROPRIATE_FALLBACK", ERR_LIB_SSL, SSL_R_INAPPROPRIATE_FALLBACK}, ++ #else ++ {"INAPPROPRIATE_FALLBACK", 20, 373}, ++ #endif ++ #ifdef SSL_R_INCONSISTENT_COMPRESSION ++ {"INCONSISTENT_COMPRESSION", ERR_LIB_SSL, SSL_R_INCONSISTENT_COMPRESSION}, ++ #else ++ {"INCONSISTENT_COMPRESSION", 20, 340}, ++ #endif ++ #ifdef SSL_R_INCONSISTENT_EARLY_DATA_ALPN ++ {"INCONSISTENT_EARLY_DATA_ALPN", ERR_LIB_SSL, SSL_R_INCONSISTENT_EARLY_DATA_ALPN}, ++ #else ++ {"INCONSISTENT_EARLY_DATA_ALPN", 20, 222}, ++ #endif ++ #ifdef SSL_R_INCONSISTENT_EARLY_DATA_SNI ++ {"INCONSISTENT_EARLY_DATA_SNI", ERR_LIB_SSL, SSL_R_INCONSISTENT_EARLY_DATA_SNI}, ++ #else ++ {"INCONSISTENT_EARLY_DATA_SNI", 20, 231}, ++ #endif ++ #ifdef SSL_R_INCONSISTENT_EXTMS ++ {"INCONSISTENT_EXTMS", ERR_LIB_SSL, SSL_R_INCONSISTENT_EXTMS}, ++ #else ++ {"INCONSISTENT_EXTMS", 20, 104}, ++ #endif ++ #ifdef SSL_R_INSUFFICIENT_SECURITY ++ {"INSUFFICIENT_SECURITY", ERR_LIB_SSL, SSL_R_INSUFFICIENT_SECURITY}, ++ #else ++ {"INSUFFICIENT_SECURITY", 20, 241}, ++ #endif ++ #ifdef SSL_R_INVALID_ALERT ++ {"INVALID_ALERT", ERR_LIB_SSL, SSL_R_INVALID_ALERT}, ++ #else ++ {"INVALID_ALERT", 20, 205}, ++ #endif ++ #ifdef SSL_R_INVALID_CCS_MESSAGE ++ {"INVALID_CCS_MESSAGE", ERR_LIB_SSL, SSL_R_INVALID_CCS_MESSAGE}, ++ #else ++ {"INVALID_CCS_MESSAGE", 20, 260}, ++ #endif ++ #ifdef SSL_R_INVALID_CERTIFICATE_OR_ALG ++ {"INVALID_CERTIFICATE_OR_ALG", ERR_LIB_SSL, SSL_R_INVALID_CERTIFICATE_OR_ALG}, ++ #else ++ {"INVALID_CERTIFICATE_OR_ALG", 20, 238}, ++ #endif ++ #ifdef SSL_R_INVALID_COMMAND ++ {"INVALID_COMMAND", ERR_LIB_SSL, SSL_R_INVALID_COMMAND}, ++ #else ++ {"INVALID_COMMAND", 20, 280}, ++ #endif ++ #ifdef SSL_R_INVALID_COMPRESSION_ALGORITHM ++ {"INVALID_COMPRESSION_ALGORITHM", ERR_LIB_SSL, SSL_R_INVALID_COMPRESSION_ALGORITHM}, ++ #else ++ {"INVALID_COMPRESSION_ALGORITHM", 20, 341}, ++ #endif ++ #ifdef SSL_R_INVALID_CONFIG ++ {"INVALID_CONFIG", ERR_LIB_SSL, SSL_R_INVALID_CONFIG}, ++ #else ++ {"INVALID_CONFIG", 20, 283}, ++ #endif ++ #ifdef SSL_R_INVALID_CONFIGURATION_NAME ++ {"INVALID_CONFIGURATION_NAME", ERR_LIB_SSL, SSL_R_INVALID_CONFIGURATION_NAME}, ++ #else ++ {"INVALID_CONFIGURATION_NAME", 20, 113}, ++ #endif ++ #ifdef SSL_R_INVALID_CONTEXT ++ {"INVALID_CONTEXT", ERR_LIB_SSL, SSL_R_INVALID_CONTEXT}, ++ #else ++ {"INVALID_CONTEXT", 20, 282}, ++ #endif ++ #ifdef SSL_R_INVALID_CT_VALIDATION_TYPE ++ {"INVALID_CT_VALIDATION_TYPE", ERR_LIB_SSL, SSL_R_INVALID_CT_VALIDATION_TYPE}, ++ #else ++ {"INVALID_CT_VALIDATION_TYPE", 20, 212}, ++ #endif ++ #ifdef SSL_R_INVALID_KEY_UPDATE_TYPE ++ {"INVALID_KEY_UPDATE_TYPE", ERR_LIB_SSL, SSL_R_INVALID_KEY_UPDATE_TYPE}, ++ #else ++ {"INVALID_KEY_UPDATE_TYPE", 20, 120}, ++ #endif ++ #ifdef SSL_R_INVALID_MAX_EARLY_DATA ++ {"INVALID_MAX_EARLY_DATA", ERR_LIB_SSL, SSL_R_INVALID_MAX_EARLY_DATA}, ++ #else ++ {"INVALID_MAX_EARLY_DATA", 20, 174}, ++ #endif ++ #ifdef SSL_R_INVALID_NULL_CMD_NAME ++ {"INVALID_NULL_CMD_NAME", ERR_LIB_SSL, SSL_R_INVALID_NULL_CMD_NAME}, ++ #else ++ {"INVALID_NULL_CMD_NAME", 20, 385}, ++ #endif ++ #ifdef SSL_R_INVALID_SEQUENCE_NUMBER ++ {"INVALID_SEQUENCE_NUMBER", ERR_LIB_SSL, SSL_R_INVALID_SEQUENCE_NUMBER}, ++ #else ++ {"INVALID_SEQUENCE_NUMBER", 20, 402}, ++ #endif ++ #ifdef SSL_R_INVALID_SERVERINFO_DATA ++ {"INVALID_SERVERINFO_DATA", ERR_LIB_SSL, SSL_R_INVALID_SERVERINFO_DATA}, ++ #else ++ {"INVALID_SERVERINFO_DATA", 20, 388}, ++ #endif ++ #ifdef SSL_R_INVALID_SESSION_ID ++ {"INVALID_SESSION_ID", ERR_LIB_SSL, SSL_R_INVALID_SESSION_ID}, ++ #else ++ {"INVALID_SESSION_ID", 20, 999}, ++ #endif ++ #ifdef SSL_R_INVALID_SRP_USERNAME ++ {"INVALID_SRP_USERNAME", ERR_LIB_SSL, SSL_R_INVALID_SRP_USERNAME}, ++ #else ++ {"INVALID_SRP_USERNAME", 20, 357}, ++ #endif ++ #ifdef SSL_R_INVALID_STATUS_RESPONSE ++ {"INVALID_STATUS_RESPONSE", ERR_LIB_SSL, SSL_R_INVALID_STATUS_RESPONSE}, ++ #else ++ {"INVALID_STATUS_RESPONSE", 20, 328}, ++ #endif ++ #ifdef SSL_R_INVALID_TICKET_KEYS_LENGTH ++ {"INVALID_TICKET_KEYS_LENGTH", ERR_LIB_SSL, SSL_R_INVALID_TICKET_KEYS_LENGTH}, ++ #else ++ {"INVALID_TICKET_KEYS_LENGTH", 20, 325}, ++ #endif ++ #ifdef SSL_R_KRB5_S_TKT_NYV ++ {"KRB5_S_TKT_NYV", ERR_LIB_SSL, SSL_R_KRB5_S_TKT_NYV}, ++ #else ++ {"KRB5_S_TKT_NYV", 20, 294}, ++ #endif ++ #ifdef SSL_R_KRB5_S_TKT_SKEW ++ {"KRB5_S_TKT_SKEW", ERR_LIB_SSL, SSL_R_KRB5_S_TKT_SKEW}, ++ #else ++ {"KRB5_S_TKT_SKEW", 20, 295}, ++ #endif ++ #ifdef SSL_R_LENGTH_MISMATCH ++ {"LENGTH_MISMATCH", ERR_LIB_SSL, SSL_R_LENGTH_MISMATCH}, ++ #else ++ {"LENGTH_MISMATCH", 20, 159}, ++ #endif ++ #ifdef SSL_R_LENGTH_TOO_LONG ++ {"LENGTH_TOO_LONG", ERR_LIB_SSL, SSL_R_LENGTH_TOO_LONG}, ++ #else ++ {"LENGTH_TOO_LONG", 20, 404}, ++ #endif ++ #ifdef SSL_R_LENGTH_TOO_SHORT ++ {"LENGTH_TOO_SHORT", ERR_LIB_SSL, SSL_R_LENGTH_TOO_SHORT}, ++ #else ++ {"LENGTH_TOO_SHORT", 20, 160}, ++ #endif ++ #ifdef SSL_R_LIBRARY_BUG ++ {"LIBRARY_BUG", ERR_LIB_SSL, SSL_R_LIBRARY_BUG}, ++ #else ++ {"LIBRARY_BUG", 20, 274}, ++ #endif ++ #ifdef SSL_R_LIBRARY_HAS_NO_CIPHERS ++ {"LIBRARY_HAS_NO_CIPHERS", ERR_LIB_SSL, SSL_R_LIBRARY_HAS_NO_CIPHERS}, ++ #else ++ {"LIBRARY_HAS_NO_CIPHERS", 20, 161}, ++ #endif ++ #ifdef SSL_R_MESSAGE_TOO_LONG ++ {"MESSAGE_TOO_LONG", ERR_LIB_SSL, SSL_R_MESSAGE_TOO_LONG}, ++ #else ++ {"MESSAGE_TOO_LONG", 20, 296}, ++ #endif ++ #ifdef SSL_R_MISSING_DSA_SIGNING_CERT ++ {"MISSING_DSA_SIGNING_CERT", ERR_LIB_SSL, SSL_R_MISSING_DSA_SIGNING_CERT}, ++ #else ++ {"MISSING_DSA_SIGNING_CERT", 20, 165}, ++ #endif ++ #ifdef SSL_R_MISSING_ECDH_CERT ++ {"MISSING_ECDH_CERT", ERR_LIB_SSL, SSL_R_MISSING_ECDH_CERT}, ++ #else ++ {"MISSING_ECDH_CERT", 20, 382}, ++ #endif ++ #ifdef SSL_R_MISSING_ECDSA_SIGNING_CERT ++ {"MISSING_ECDSA_SIGNING_CERT", ERR_LIB_SSL, SSL_R_MISSING_ECDSA_SIGNING_CERT}, ++ #else ++ {"MISSING_ECDSA_SIGNING_CERT", 20, 381}, ++ #endif ++ #ifdef SSL_R_MISSING_FATAL ++ {"MISSING_FATAL", ERR_LIB_SSL, SSL_R_MISSING_FATAL}, ++ #else ++ {"MISSING_FATAL", 20, 256}, ++ #endif ++ #ifdef SSL_R_MISSING_PARAMETERS ++ {"MISSING_PARAMETERS", ERR_LIB_SSL, SSL_R_MISSING_PARAMETERS}, ++ #else ++ {"MISSING_PARAMETERS", 20, 290}, ++ #endif ++ #ifdef SSL_R_MISSING_RSA_CERTIFICATE ++ {"MISSING_RSA_CERTIFICATE", ERR_LIB_SSL, SSL_R_MISSING_RSA_CERTIFICATE}, ++ #else ++ {"MISSING_RSA_CERTIFICATE", 20, 168}, ++ #endif ++ #ifdef SSL_R_MISSING_RSA_ENCRYPTING_CERT ++ {"MISSING_RSA_ENCRYPTING_CERT", ERR_LIB_SSL, SSL_R_MISSING_RSA_ENCRYPTING_CERT}, ++ #else ++ {"MISSING_RSA_ENCRYPTING_CERT", 20, 169}, ++ #endif ++ #ifdef SSL_R_MISSING_RSA_SIGNING_CERT ++ {"MISSING_RSA_SIGNING_CERT", ERR_LIB_SSL, SSL_R_MISSING_RSA_SIGNING_CERT}, ++ #else ++ {"MISSING_RSA_SIGNING_CERT", 20, 170}, ++ #endif ++ #ifdef SSL_R_MISSING_SIGALGS_EXTENSION ++ {"MISSING_SIGALGS_EXTENSION", ERR_LIB_SSL, SSL_R_MISSING_SIGALGS_EXTENSION}, ++ #else ++ {"MISSING_SIGALGS_EXTENSION", 20, 112}, ++ #endif ++ #ifdef SSL_R_MISSING_SIGNING_CERT ++ {"MISSING_SIGNING_CERT", ERR_LIB_SSL, SSL_R_MISSING_SIGNING_CERT}, ++ #else ++ {"MISSING_SIGNING_CERT", 20, 221}, ++ #endif ++ #ifdef SSL_R_MISSING_SRP_PARAM ++ {"MISSING_SRP_PARAM", ERR_LIB_SSL, SSL_R_MISSING_SRP_PARAM}, ++ #else ++ {"MISSING_SRP_PARAM", 20, 358}, ++ #endif ++ #ifdef SSL_R_MISSING_SUPPORTED_GROUPS_EXTENSION ++ {"MISSING_SUPPORTED_GROUPS_EXTENSION", ERR_LIB_SSL, SSL_R_MISSING_SUPPORTED_GROUPS_EXTENSION}, ++ #else ++ {"MISSING_SUPPORTED_GROUPS_EXTENSION", 20, 209}, ++ #endif ++ #ifdef SSL_R_MISSING_TMP_DH_KEY ++ {"MISSING_TMP_DH_KEY", ERR_LIB_SSL, SSL_R_MISSING_TMP_DH_KEY}, ++ #else ++ {"MISSING_TMP_DH_KEY", 20, 171}, ++ #endif ++ #ifdef SSL_R_MISSING_TMP_ECDH_KEY ++ {"MISSING_TMP_ECDH_KEY", ERR_LIB_SSL, SSL_R_MISSING_TMP_ECDH_KEY}, ++ #else ++ {"MISSING_TMP_ECDH_KEY", 20, 311}, ++ #endif ++ #ifdef SSL_R_MIXED_HANDSHAKE_AND_NON_HANDSHAKE_DATA ++ {"MIXED_HANDSHAKE_AND_NON_HANDSHAKE_DATA", ERR_LIB_SSL, SSL_R_MIXED_HANDSHAKE_AND_NON_HANDSHAKE_DATA}, ++ #else ++ {"MIXED_HANDSHAKE_AND_NON_HANDSHAKE_DATA", 20, 293}, ++ #endif ++ #ifdef SSL_R_MULTIPLE_SGC_RESTARTS ++ {"MULTIPLE_SGC_RESTARTS", ERR_LIB_SSL, SSL_R_MULTIPLE_SGC_RESTARTS}, ++ #else ++ {"MULTIPLE_SGC_RESTARTS", 20, 346}, ++ #endif ++ #ifdef SSL_R_NOT_ON_RECORD_BOUNDARY ++ {"NOT_ON_RECORD_BOUNDARY", ERR_LIB_SSL, SSL_R_NOT_ON_RECORD_BOUNDARY}, ++ #else ++ {"NOT_ON_RECORD_BOUNDARY", 20, 182}, ++ #endif ++ #ifdef SSL_R_NOT_REPLACING_CERTIFICATE ++ {"NOT_REPLACING_CERTIFICATE", ERR_LIB_SSL, SSL_R_NOT_REPLACING_CERTIFICATE}, ++ #else ++ {"NOT_REPLACING_CERTIFICATE", 20, 289}, ++ #endif ++ #ifdef SSL_R_NOT_SERVER ++ {"NOT_SERVER", ERR_LIB_SSL, SSL_R_NOT_SERVER}, ++ #else ++ {"NOT_SERVER", 20, 284}, ++ #endif ++ #ifdef SSL_R_NO_APPLICATION_PROTOCOL ++ {"NO_APPLICATION_PROTOCOL", ERR_LIB_SSL, SSL_R_NO_APPLICATION_PROTOCOL}, ++ #else ++ {"NO_APPLICATION_PROTOCOL", 20, 235}, ++ #endif ++ #ifdef SSL_R_NO_CERTIFICATES_RETURNED ++ {"NO_CERTIFICATES_RETURNED", ERR_LIB_SSL, SSL_R_NO_CERTIFICATES_RETURNED}, ++ #else ++ {"NO_CERTIFICATES_RETURNED", 20, 176}, ++ #endif ++ #ifdef SSL_R_NO_CERTIFICATE_ASSIGNED ++ {"NO_CERTIFICATE_ASSIGNED", ERR_LIB_SSL, SSL_R_NO_CERTIFICATE_ASSIGNED}, ++ #else ++ {"NO_CERTIFICATE_ASSIGNED", 20, 177}, ++ #endif ++ #ifdef SSL_R_NO_CERTIFICATE_SET ++ {"NO_CERTIFICATE_SET", ERR_LIB_SSL, SSL_R_NO_CERTIFICATE_SET}, ++ #else ++ {"NO_CERTIFICATE_SET", 20, 179}, ++ #endif ++ #ifdef SSL_R_NO_CHANGE_FOLLOWING_HRR ++ {"NO_CHANGE_FOLLOWING_HRR", ERR_LIB_SSL, SSL_R_NO_CHANGE_FOLLOWING_HRR}, ++ #else ++ {"NO_CHANGE_FOLLOWING_HRR", 20, 214}, ++ #endif ++ #ifdef SSL_R_NO_CIPHERS_AVAILABLE ++ {"NO_CIPHERS_AVAILABLE", ERR_LIB_SSL, SSL_R_NO_CIPHERS_AVAILABLE}, ++ #else ++ {"NO_CIPHERS_AVAILABLE", 20, 181}, ++ #endif ++ #ifdef SSL_R_NO_CIPHERS_SPECIFIED ++ {"NO_CIPHERS_SPECIFIED", ERR_LIB_SSL, SSL_R_NO_CIPHERS_SPECIFIED}, ++ #else ++ {"NO_CIPHERS_SPECIFIED", 20, 183}, ++ #endif ++ #ifdef SSL_R_NO_CIPHER_MATCH ++ {"NO_CIPHER_MATCH", ERR_LIB_SSL, SSL_R_NO_CIPHER_MATCH}, ++ #else ++ {"NO_CIPHER_MATCH", 20, 185}, ++ #endif ++ #ifdef SSL_R_NO_CLIENT_CERT_METHOD ++ {"NO_CLIENT_CERT_METHOD", ERR_LIB_SSL, SSL_R_NO_CLIENT_CERT_METHOD}, ++ #else ++ {"NO_CLIENT_CERT_METHOD", 20, 331}, ++ #endif ++ #ifdef SSL_R_NO_COMPRESSION_SPECIFIED ++ {"NO_COMPRESSION_SPECIFIED", ERR_LIB_SSL, SSL_R_NO_COMPRESSION_SPECIFIED}, ++ #else ++ {"NO_COMPRESSION_SPECIFIED", 20, 187}, ++ #endif ++ #ifdef SSL_R_NO_COOKIE_CALLBACK_SET ++ {"NO_COOKIE_CALLBACK_SET", ERR_LIB_SSL, SSL_R_NO_COOKIE_CALLBACK_SET}, ++ #else ++ {"NO_COOKIE_CALLBACK_SET", 20, 287}, ++ #endif ++ #ifdef SSL_R_NO_GOST_CERTIFICATE_SENT_BY_PEER ++ {"NO_GOST_CERTIFICATE_SENT_BY_PEER", ERR_LIB_SSL, SSL_R_NO_GOST_CERTIFICATE_SENT_BY_PEER}, ++ #else ++ {"NO_GOST_CERTIFICATE_SENT_BY_PEER", 20, 330}, ++ #endif ++ #ifdef SSL_R_NO_METHOD_SPECIFIED ++ {"NO_METHOD_SPECIFIED", ERR_LIB_SSL, SSL_R_NO_METHOD_SPECIFIED}, ++ #else ++ {"NO_METHOD_SPECIFIED", 20, 188}, ++ #endif ++ #ifdef SSL_R_NO_PEM_EXTENSIONS ++ {"NO_PEM_EXTENSIONS", ERR_LIB_SSL, SSL_R_NO_PEM_EXTENSIONS}, ++ #else ++ {"NO_PEM_EXTENSIONS", 20, 389}, ++ #endif ++ #ifdef SSL_R_NO_PRIVATE_KEY_ASSIGNED ++ {"NO_PRIVATE_KEY_ASSIGNED", ERR_LIB_SSL, SSL_R_NO_PRIVATE_KEY_ASSIGNED}, ++ #else ++ {"NO_PRIVATE_KEY_ASSIGNED", 20, 190}, ++ #endif ++ #ifdef SSL_R_NO_PROTOCOLS_AVAILABLE ++ {"NO_PROTOCOLS_AVAILABLE", ERR_LIB_SSL, SSL_R_NO_PROTOCOLS_AVAILABLE}, ++ #else ++ {"NO_PROTOCOLS_AVAILABLE", 20, 191}, ++ #endif ++ #ifdef SSL_R_NO_RENEGOTIATION ++ {"NO_RENEGOTIATION", ERR_LIB_SSL, SSL_R_NO_RENEGOTIATION}, ++ #else ++ {"NO_RENEGOTIATION", 20, 339}, ++ #endif ++ #ifdef SSL_R_NO_REQUIRED_DIGEST ++ {"NO_REQUIRED_DIGEST", ERR_LIB_SSL, SSL_R_NO_REQUIRED_DIGEST}, ++ #else ++ {"NO_REQUIRED_DIGEST", 20, 324}, ++ #endif ++ #ifdef SSL_R_NO_SHARED_CIPHER ++ {"NO_SHARED_CIPHER", ERR_LIB_SSL, SSL_R_NO_SHARED_CIPHER}, ++ #else ++ {"NO_SHARED_CIPHER", 20, 193}, ++ #endif ++ #ifdef SSL_R_NO_SHARED_GROUPS ++ {"NO_SHARED_GROUPS", ERR_LIB_SSL, SSL_R_NO_SHARED_GROUPS}, ++ #else ++ {"NO_SHARED_GROUPS", 20, 410}, ++ #endif ++ #ifdef SSL_R_NO_SHARED_SIGNATURE_ALGORITHMS ++ {"NO_SHARED_SIGNATURE_ALGORITHMS", ERR_LIB_SSL, SSL_R_NO_SHARED_SIGNATURE_ALGORITHMS}, ++ #else ++ {"NO_SHARED_SIGNATURE_ALGORITHMS", 20, 376}, ++ #endif ++ #ifdef SSL_R_NO_SRTP_PROFILES ++ {"NO_SRTP_PROFILES", ERR_LIB_SSL, SSL_R_NO_SRTP_PROFILES}, ++ #else ++ {"NO_SRTP_PROFILES", 20, 359}, ++ #endif ++ #ifdef SSL_R_NO_SUITABLE_KEY_SHARE ++ {"NO_SUITABLE_KEY_SHARE", ERR_LIB_SSL, SSL_R_NO_SUITABLE_KEY_SHARE}, ++ #else ++ {"NO_SUITABLE_KEY_SHARE", 20, 101}, ++ #endif ++ #ifdef SSL_R_NO_SUITABLE_SIGNATURE_ALGORITHM ++ {"NO_SUITABLE_SIGNATURE_ALGORITHM", ERR_LIB_SSL, SSL_R_NO_SUITABLE_SIGNATURE_ALGORITHM}, ++ #else ++ {"NO_SUITABLE_SIGNATURE_ALGORITHM", 20, 118}, ++ #endif ++ #ifdef SSL_R_NO_VALID_SCTS ++ {"NO_VALID_SCTS", ERR_LIB_SSL, SSL_R_NO_VALID_SCTS}, ++ #else ++ {"NO_VALID_SCTS", 20, 216}, ++ #endif ++ #ifdef SSL_R_NO_VERIFY_COOKIE_CALLBACK ++ {"NO_VERIFY_COOKIE_CALLBACK", ERR_LIB_SSL, SSL_R_NO_VERIFY_COOKIE_CALLBACK}, ++ #else ++ {"NO_VERIFY_COOKIE_CALLBACK", 20, 403}, ++ #endif ++ #ifdef SSL_R_NULL_SSL_CTX ++ {"NULL_SSL_CTX", ERR_LIB_SSL, SSL_R_NULL_SSL_CTX}, ++ #else ++ {"NULL_SSL_CTX", 20, 195}, ++ #endif ++ #ifdef SSL_R_NULL_SSL_METHOD_PASSED ++ {"NULL_SSL_METHOD_PASSED", ERR_LIB_SSL, SSL_R_NULL_SSL_METHOD_PASSED}, ++ #else ++ {"NULL_SSL_METHOD_PASSED", 20, 196}, ++ #endif ++ #ifdef SSL_R_OLD_SESSION_CIPHER_NOT_RETURNED ++ {"OLD_SESSION_CIPHER_NOT_RETURNED", ERR_LIB_SSL, SSL_R_OLD_SESSION_CIPHER_NOT_RETURNED}, ++ #else ++ {"OLD_SESSION_CIPHER_NOT_RETURNED", 20, 197}, ++ #endif ++ #ifdef SSL_R_OLD_SESSION_COMPRESSION_ALGORITHM_NOT_RETURNED ++ {"OLD_SESSION_COMPRESSION_ALGORITHM_NOT_RETURNED", ERR_LIB_SSL, SSL_R_OLD_SESSION_COMPRESSION_ALGORITHM_NOT_RETURNED}, ++ #else ++ {"OLD_SESSION_COMPRESSION_ALGORITHM_NOT_RETURNED", 20, 344}, ++ #endif ++ #ifdef SSL_R_ONLY_DTLS_1_2_ALLOWED_IN_SUITEB_MODE ++ {"ONLY_DTLS_1_2_ALLOWED_IN_SUITEB_MODE", ERR_LIB_SSL, SSL_R_ONLY_DTLS_1_2_ALLOWED_IN_SUITEB_MODE}, ++ #else ++ {"ONLY_DTLS_1_2_ALLOWED_IN_SUITEB_MODE", 20, 387}, ++ #endif ++ #ifdef SSL_R_ONLY_TLS_1_2_ALLOWED_IN_SUITEB_MODE ++ {"ONLY_TLS_1_2_ALLOWED_IN_SUITEB_MODE", ERR_LIB_SSL, SSL_R_ONLY_TLS_1_2_ALLOWED_IN_SUITEB_MODE}, ++ #else ++ {"ONLY_TLS_1_2_ALLOWED_IN_SUITEB_MODE", 20, 379}, ++ #endif ++ #ifdef SSL_R_ONLY_TLS_ALLOWED_IN_FIPS_MODE ++ {"ONLY_TLS_ALLOWED_IN_FIPS_MODE", ERR_LIB_SSL, SSL_R_ONLY_TLS_ALLOWED_IN_FIPS_MODE}, ++ #else ++ {"ONLY_TLS_ALLOWED_IN_FIPS_MODE", 20, 297}, ++ #endif ++ #ifdef SSL_R_OPAQUE_PRF_INPUT_TOO_LONG ++ {"OPAQUE_PRF_INPUT_TOO_LONG", ERR_LIB_SSL, SSL_R_OPAQUE_PRF_INPUT_TOO_LONG}, ++ #else ++ {"OPAQUE_PRF_INPUT_TOO_LONG", 20, 327}, ++ #endif ++ #ifdef SSL_R_OVERFLOW_ERROR ++ {"OVERFLOW_ERROR", ERR_LIB_SSL, SSL_R_OVERFLOW_ERROR}, ++ #else ++ {"OVERFLOW_ERROR", 20, 237}, ++ #endif ++ #ifdef SSL_R_PACKET_LENGTH_TOO_LONG ++ {"PACKET_LENGTH_TOO_LONG", ERR_LIB_SSL, SSL_R_PACKET_LENGTH_TOO_LONG}, ++ #else ++ {"PACKET_LENGTH_TOO_LONG", 20, 198}, ++ #endif ++ #ifdef SSL_R_PARSE_TLSEXT ++ {"PARSE_TLSEXT", ERR_LIB_SSL, SSL_R_PARSE_TLSEXT}, ++ #else ++ {"PARSE_TLSEXT", 20, 227}, ++ #endif ++ #ifdef SSL_R_PATH_TOO_LONG ++ {"PATH_TOO_LONG", ERR_LIB_SSL, SSL_R_PATH_TOO_LONG}, ++ #else ++ {"PATH_TOO_LONG", 20, 270}, ++ #endif ++ #ifdef SSL_R_PEER_DID_NOT_RETURN_A_CERTIFICATE ++ {"PEER_DID_NOT_RETURN_A_CERTIFICATE", ERR_LIB_SSL, SSL_R_PEER_DID_NOT_RETURN_A_CERTIFICATE}, ++ #else ++ {"PEER_DID_NOT_RETURN_A_CERTIFICATE", 20, 199}, ++ #endif ++ #ifdef SSL_R_PEM_NAME_BAD_PREFIX ++ {"PEM_NAME_BAD_PREFIX", ERR_LIB_SSL, SSL_R_PEM_NAME_BAD_PREFIX}, ++ #else ++ {"PEM_NAME_BAD_PREFIX", 20, 391}, ++ #endif ++ #ifdef SSL_R_PEM_NAME_TOO_SHORT ++ {"PEM_NAME_TOO_SHORT", ERR_LIB_SSL, SSL_R_PEM_NAME_TOO_SHORT}, ++ #else ++ {"PEM_NAME_TOO_SHORT", 20, 392}, ++ #endif ++ #ifdef SSL_R_PIPELINE_FAILURE ++ {"PIPELINE_FAILURE", ERR_LIB_SSL, SSL_R_PIPELINE_FAILURE}, ++ #else ++ {"PIPELINE_FAILURE", 20, 406}, ++ #endif ++ #ifdef SSL_R_POST_HANDSHAKE_AUTH_ENCODING_ERR ++ {"POST_HANDSHAKE_AUTH_ENCODING_ERR", ERR_LIB_SSL, SSL_R_POST_HANDSHAKE_AUTH_ENCODING_ERR}, ++ #else ++ {"POST_HANDSHAKE_AUTH_ENCODING_ERR", 20, 278}, ++ #endif ++ #ifdef SSL_R_PRIVATE_KEY_MISMATCH ++ {"PRIVATE_KEY_MISMATCH", ERR_LIB_SSL, SSL_R_PRIVATE_KEY_MISMATCH}, ++ #else ++ {"PRIVATE_KEY_MISMATCH", 20, 288}, ++ #endif ++ #ifdef SSL_R_PROTOCOL_IS_SHUTDOWN ++ {"PROTOCOL_IS_SHUTDOWN", ERR_LIB_SSL, SSL_R_PROTOCOL_IS_SHUTDOWN}, ++ #else ++ {"PROTOCOL_IS_SHUTDOWN", 20, 207}, ++ #endif ++ #ifdef SSL_R_PSK_IDENTITY_NOT_FOUND ++ {"PSK_IDENTITY_NOT_FOUND", ERR_LIB_SSL, SSL_R_PSK_IDENTITY_NOT_FOUND}, ++ #else ++ {"PSK_IDENTITY_NOT_FOUND", 20, 223}, ++ #endif ++ #ifdef SSL_R_PSK_NO_CLIENT_CB ++ {"PSK_NO_CLIENT_CB", ERR_LIB_SSL, SSL_R_PSK_NO_CLIENT_CB}, ++ #else ++ {"PSK_NO_CLIENT_CB", 20, 224}, ++ #endif ++ #ifdef SSL_R_PSK_NO_SERVER_CB ++ {"PSK_NO_SERVER_CB", ERR_LIB_SSL, SSL_R_PSK_NO_SERVER_CB}, ++ #else ++ {"PSK_NO_SERVER_CB", 20, 225}, ++ #endif ++ #ifdef SSL_R_READ_BIO_NOT_SET ++ {"READ_BIO_NOT_SET", ERR_LIB_SSL, SSL_R_READ_BIO_NOT_SET}, ++ #else ++ {"READ_BIO_NOT_SET", 20, 211}, ++ #endif ++ #ifdef SSL_R_READ_TIMEOUT_EXPIRED ++ {"READ_TIMEOUT_EXPIRED", ERR_LIB_SSL, SSL_R_READ_TIMEOUT_EXPIRED}, ++ #else ++ {"READ_TIMEOUT_EXPIRED", 20, 312}, ++ #endif ++ #ifdef SSL_R_RECORD_LENGTH_MISMATCH ++ {"RECORD_LENGTH_MISMATCH", ERR_LIB_SSL, SSL_R_RECORD_LENGTH_MISMATCH}, ++ #else ++ {"RECORD_LENGTH_MISMATCH", 20, 213}, ++ #endif ++ #ifdef SSL_R_RECORD_TOO_SMALL ++ {"RECORD_TOO_SMALL", ERR_LIB_SSL, SSL_R_RECORD_TOO_SMALL}, ++ #else ++ {"RECORD_TOO_SMALL", 20, 298}, ++ #endif ++ #ifdef SSL_R_RENEGOTIATE_EXT_TOO_LONG ++ {"RENEGOTIATE_EXT_TOO_LONG", ERR_LIB_SSL, SSL_R_RENEGOTIATE_EXT_TOO_LONG}, ++ #else ++ {"RENEGOTIATE_EXT_TOO_LONG", 20, 335}, ++ #endif ++ #ifdef SSL_R_RENEGOTIATION_ENCODING_ERR ++ {"RENEGOTIATION_ENCODING_ERR", ERR_LIB_SSL, SSL_R_RENEGOTIATION_ENCODING_ERR}, ++ #else ++ {"RENEGOTIATION_ENCODING_ERR", 20, 336}, ++ #endif ++ #ifdef SSL_R_RENEGOTIATION_MISMATCH ++ {"RENEGOTIATION_MISMATCH", ERR_LIB_SSL, SSL_R_RENEGOTIATION_MISMATCH}, ++ #else ++ {"RENEGOTIATION_MISMATCH", 20, 337}, ++ #endif ++ #ifdef SSL_R_REQUEST_PENDING ++ {"REQUEST_PENDING", ERR_LIB_SSL, SSL_R_REQUEST_PENDING}, ++ #else ++ {"REQUEST_PENDING", 20, 285}, ++ #endif ++ #ifdef SSL_R_REQUEST_SENT ++ {"REQUEST_SENT", ERR_LIB_SSL, SSL_R_REQUEST_SENT}, ++ #else ++ {"REQUEST_SENT", 20, 286}, ++ #endif ++ #ifdef SSL_R_REQUIRED_CIPHER_MISSING ++ {"REQUIRED_CIPHER_MISSING", ERR_LIB_SSL, SSL_R_REQUIRED_CIPHER_MISSING}, ++ #else ++ {"REQUIRED_CIPHER_MISSING", 20, 215}, ++ #endif ++ #ifdef SSL_R_REQUIRED_COMPRESSION_ALGORITHM_MISSING ++ {"REQUIRED_COMPRESSION_ALGORITHM_MISSING", ERR_LIB_SSL, SSL_R_REQUIRED_COMPRESSION_ALGORITHM_MISSING}, ++ #else ++ {"REQUIRED_COMPRESSION_ALGORITHM_MISSING", 20, 342}, ++ #endif ++ #ifdef SSL_R_SCSV_RECEIVED_WHEN_RENEGOTIATING ++ {"SCSV_RECEIVED_WHEN_RENEGOTIATING", ERR_LIB_SSL, SSL_R_SCSV_RECEIVED_WHEN_RENEGOTIATING}, ++ #else ++ {"SCSV_RECEIVED_WHEN_RENEGOTIATING", 20, 345}, ++ #endif ++ #ifdef SSL_R_SCT_VERIFICATION_FAILED ++ {"SCT_VERIFICATION_FAILED", ERR_LIB_SSL, SSL_R_SCT_VERIFICATION_FAILED}, ++ #else ++ {"SCT_VERIFICATION_FAILED", 20, 208}, ++ #endif ++ #ifdef SSL_R_SERVERHELLO_TLSEXT ++ {"SERVERHELLO_TLSEXT", ERR_LIB_SSL, SSL_R_SERVERHELLO_TLSEXT}, ++ #else ++ {"SERVERHELLO_TLSEXT", 20, 275}, ++ #endif ++ #ifdef SSL_R_SESSION_ID_CONTEXT_UNINITIALIZED ++ {"SESSION_ID_CONTEXT_UNINITIALIZED", ERR_LIB_SSL, SSL_R_SESSION_ID_CONTEXT_UNINITIALIZED}, ++ #else ++ {"SESSION_ID_CONTEXT_UNINITIALIZED", 20, 277}, ++ #endif ++ #ifdef SSL_R_SHUTDOWN_WHILE_IN_INIT ++ {"SHUTDOWN_WHILE_IN_INIT", ERR_LIB_SSL, SSL_R_SHUTDOWN_WHILE_IN_INIT}, ++ #else ++ {"SHUTDOWN_WHILE_IN_INIT", 20, 407}, ++ #endif ++ #ifdef SSL_R_SIGNATURE_ALGORITHMS_ERROR ++ {"SIGNATURE_ALGORITHMS_ERROR", ERR_LIB_SSL, SSL_R_SIGNATURE_ALGORITHMS_ERROR}, ++ #else ++ {"SIGNATURE_ALGORITHMS_ERROR", 20, 360}, ++ #endif ++ #ifdef SSL_R_SIGNATURE_FOR_NON_SIGNING_CERTIFICATE ++ {"SIGNATURE_FOR_NON_SIGNING_CERTIFICATE", ERR_LIB_SSL, SSL_R_SIGNATURE_FOR_NON_SIGNING_CERTIFICATE}, ++ #else ++ {"SIGNATURE_FOR_NON_SIGNING_CERTIFICATE", 20, 220}, ++ #endif ++ #ifdef SSL_R_SRP_A_CALC ++ {"SRP_A_CALC", ERR_LIB_SSL, SSL_R_SRP_A_CALC}, ++ #else ++ {"SRP_A_CALC", 20, 361}, ++ #endif ++ #ifdef SSL_R_SRTP_COULD_NOT_ALLOCATE_PROFILES ++ {"SRTP_COULD_NOT_ALLOCATE_PROFILES", ERR_LIB_SSL, SSL_R_SRTP_COULD_NOT_ALLOCATE_PROFILES}, ++ #else ++ {"SRTP_COULD_NOT_ALLOCATE_PROFILES", 20, 362}, ++ #endif ++ #ifdef SSL_R_SRTP_PROTECTION_PROFILE_LIST_TOO_LONG ++ {"SRTP_PROTECTION_PROFILE_LIST_TOO_LONG", ERR_LIB_SSL, SSL_R_SRTP_PROTECTION_PROFILE_LIST_TOO_LONG}, ++ #else ++ {"SRTP_PROTECTION_PROFILE_LIST_TOO_LONG", 20, 363}, ++ #endif ++ #ifdef SSL_R_SRTP_UNKNOWN_PROTECTION_PROFILE ++ {"SRTP_UNKNOWN_PROTECTION_PROFILE", ERR_LIB_SSL, SSL_R_SRTP_UNKNOWN_PROTECTION_PROFILE}, ++ #else ++ {"SRTP_UNKNOWN_PROTECTION_PROFILE", 20, 364}, ++ #endif ++ #ifdef SSL_R_SSL2_CONNECTION_ID_TOO_LONG ++ {"SSL2_CONNECTION_ID_TOO_LONG", ERR_LIB_SSL, SSL_R_SSL2_CONNECTION_ID_TOO_LONG}, ++ #else ++ {"SSL2_CONNECTION_ID_TOO_LONG", 20, 299}, ++ #endif ++ #ifdef SSL_R_SSL3_EXT_INVALID_ECPOINTFORMAT ++ {"SSL3_EXT_INVALID_ECPOINTFORMAT", ERR_LIB_SSL, SSL_R_SSL3_EXT_INVALID_ECPOINTFORMAT}, ++ #else ++ {"SSL3_EXT_INVALID_ECPOINTFORMAT", 20, 321}, ++ #endif ++ #ifdef SSL_R_SSL3_EXT_INVALID_MAX_FRAGMENT_LENGTH ++ {"SSL3_EXT_INVALID_MAX_FRAGMENT_LENGTH", ERR_LIB_SSL, SSL_R_SSL3_EXT_INVALID_MAX_FRAGMENT_LENGTH}, ++ #else ++ {"SSL3_EXT_INVALID_MAX_FRAGMENT_LENGTH", 20, 232}, ++ #endif ++ #ifdef SSL_R_SSL3_EXT_INVALID_SERVERNAME ++ {"SSL3_EXT_INVALID_SERVERNAME", ERR_LIB_SSL, SSL_R_SSL3_EXT_INVALID_SERVERNAME}, ++ #else ++ {"SSL3_EXT_INVALID_SERVERNAME", 20, 319}, ++ #endif ++ #ifdef SSL_R_SSL3_EXT_INVALID_SERVERNAME_TYPE ++ {"SSL3_EXT_INVALID_SERVERNAME_TYPE", ERR_LIB_SSL, SSL_R_SSL3_EXT_INVALID_SERVERNAME_TYPE}, ++ #else ++ {"SSL3_EXT_INVALID_SERVERNAME_TYPE", 20, 320}, ++ #endif ++ #ifdef SSL_R_SSL3_SESSION_ID_TOO_LONG ++ {"SSL3_SESSION_ID_TOO_LONG", ERR_LIB_SSL, SSL_R_SSL3_SESSION_ID_TOO_LONG}, ++ #else ++ {"SSL3_SESSION_ID_TOO_LONG", 20, 300}, ++ #endif ++ #ifdef SSL_R_SSLV3_ALERT_BAD_CERTIFICATE ++ {"SSLV3_ALERT_BAD_CERTIFICATE", ERR_LIB_SSL, SSL_R_SSLV3_ALERT_BAD_CERTIFICATE}, ++ #else ++ {"SSLV3_ALERT_BAD_CERTIFICATE", 20, 1042}, ++ #endif ++ #ifdef SSL_R_SSLV3_ALERT_BAD_RECORD_MAC ++ {"SSLV3_ALERT_BAD_RECORD_MAC", ERR_LIB_SSL, SSL_R_SSLV3_ALERT_BAD_RECORD_MAC}, ++ #else ++ {"SSLV3_ALERT_BAD_RECORD_MAC", 20, 1020}, ++ #endif ++ #ifdef SSL_R_SSLV3_ALERT_CERTIFICATE_EXPIRED ++ {"SSLV3_ALERT_CERTIFICATE_EXPIRED", ERR_LIB_SSL, SSL_R_SSLV3_ALERT_CERTIFICATE_EXPIRED}, ++ #else ++ {"SSLV3_ALERT_CERTIFICATE_EXPIRED", 20, 1045}, ++ #endif ++ #ifdef SSL_R_SSLV3_ALERT_CERTIFICATE_REVOKED ++ {"SSLV3_ALERT_CERTIFICATE_REVOKED", ERR_LIB_SSL, SSL_R_SSLV3_ALERT_CERTIFICATE_REVOKED}, ++ #else ++ {"SSLV3_ALERT_CERTIFICATE_REVOKED", 20, 1044}, ++ #endif ++ #ifdef SSL_R_SSLV3_ALERT_CERTIFICATE_UNKNOWN ++ {"SSLV3_ALERT_CERTIFICATE_UNKNOWN", ERR_LIB_SSL, SSL_R_SSLV3_ALERT_CERTIFICATE_UNKNOWN}, ++ #else ++ {"SSLV3_ALERT_CERTIFICATE_UNKNOWN", 20, 1046}, ++ #endif ++ #ifdef SSL_R_SSLV3_ALERT_DECOMPRESSION_FAILURE ++ {"SSLV3_ALERT_DECOMPRESSION_FAILURE", ERR_LIB_SSL, SSL_R_SSLV3_ALERT_DECOMPRESSION_FAILURE}, ++ #else ++ {"SSLV3_ALERT_DECOMPRESSION_FAILURE", 20, 1030}, ++ #endif ++ #ifdef SSL_R_SSLV3_ALERT_HANDSHAKE_FAILURE ++ {"SSLV3_ALERT_HANDSHAKE_FAILURE", ERR_LIB_SSL, SSL_R_SSLV3_ALERT_HANDSHAKE_FAILURE}, ++ #else ++ {"SSLV3_ALERT_HANDSHAKE_FAILURE", 20, 1040}, ++ #endif ++ #ifdef SSL_R_SSLV3_ALERT_ILLEGAL_PARAMETER ++ {"SSLV3_ALERT_ILLEGAL_PARAMETER", ERR_LIB_SSL, SSL_R_SSLV3_ALERT_ILLEGAL_PARAMETER}, ++ #else ++ {"SSLV3_ALERT_ILLEGAL_PARAMETER", 20, 1047}, ++ #endif ++ #ifdef SSL_R_SSLV3_ALERT_NO_CERTIFICATE ++ {"SSLV3_ALERT_NO_CERTIFICATE", ERR_LIB_SSL, SSL_R_SSLV3_ALERT_NO_CERTIFICATE}, ++ #else ++ {"SSLV3_ALERT_NO_CERTIFICATE", 20, 1041}, ++ #endif ++ #ifdef SSL_R_SSLV3_ALERT_UNEXPECTED_MESSAGE ++ {"SSLV3_ALERT_UNEXPECTED_MESSAGE", ERR_LIB_SSL, SSL_R_SSLV3_ALERT_UNEXPECTED_MESSAGE}, ++ #else ++ {"SSLV3_ALERT_UNEXPECTED_MESSAGE", 20, 1010}, ++ #endif ++ #ifdef SSL_R_SSLV3_ALERT_UNSUPPORTED_CERTIFICATE ++ {"SSLV3_ALERT_UNSUPPORTED_CERTIFICATE", ERR_LIB_SSL, SSL_R_SSLV3_ALERT_UNSUPPORTED_CERTIFICATE}, ++ #else ++ {"SSLV3_ALERT_UNSUPPORTED_CERTIFICATE", 20, 1043}, ++ #endif ++ #ifdef SSL_R_SSL_COMMAND_SECTION_EMPTY ++ {"SSL_COMMAND_SECTION_EMPTY", ERR_LIB_SSL, SSL_R_SSL_COMMAND_SECTION_EMPTY}, ++ #else ++ {"SSL_COMMAND_SECTION_EMPTY", 20, 117}, ++ #endif ++ #ifdef SSL_R_SSL_COMMAND_SECTION_NOT_FOUND ++ {"SSL_COMMAND_SECTION_NOT_FOUND", ERR_LIB_SSL, SSL_R_SSL_COMMAND_SECTION_NOT_FOUND}, ++ #else ++ {"SSL_COMMAND_SECTION_NOT_FOUND", 20, 125}, ++ #endif ++ #ifdef SSL_R_SSL_CTX_HAS_NO_DEFAULT_SSL_VERSION ++ {"SSL_CTX_HAS_NO_DEFAULT_SSL_VERSION", ERR_LIB_SSL, SSL_R_SSL_CTX_HAS_NO_DEFAULT_SSL_VERSION}, ++ #else ++ {"SSL_CTX_HAS_NO_DEFAULT_SSL_VERSION", 20, 228}, ++ #endif ++ #ifdef SSL_R_SSL_HANDSHAKE_FAILURE ++ {"SSL_HANDSHAKE_FAILURE", ERR_LIB_SSL, SSL_R_SSL_HANDSHAKE_FAILURE}, ++ #else ++ {"SSL_HANDSHAKE_FAILURE", 20, 229}, ++ #endif ++ #ifdef SSL_R_SSL_LIBRARY_HAS_NO_CIPHERS ++ {"SSL_LIBRARY_HAS_NO_CIPHERS", ERR_LIB_SSL, SSL_R_SSL_LIBRARY_HAS_NO_CIPHERS}, ++ #else ++ {"SSL_LIBRARY_HAS_NO_CIPHERS", 20, 230}, ++ #endif ++ #ifdef SSL_R_SSL_NEGATIVE_LENGTH ++ {"SSL_NEGATIVE_LENGTH", ERR_LIB_SSL, SSL_R_SSL_NEGATIVE_LENGTH}, ++ #else ++ {"SSL_NEGATIVE_LENGTH", 20, 372}, ++ #endif ++ #ifdef SSL_R_SSL_SECTION_EMPTY ++ {"SSL_SECTION_EMPTY", ERR_LIB_SSL, SSL_R_SSL_SECTION_EMPTY}, ++ #else ++ {"SSL_SECTION_EMPTY", 20, 126}, ++ #endif ++ #ifdef SSL_R_SSL_SECTION_NOT_FOUND ++ {"SSL_SECTION_NOT_FOUND", ERR_LIB_SSL, SSL_R_SSL_SECTION_NOT_FOUND}, ++ #else ++ {"SSL_SECTION_NOT_FOUND", 20, 136}, ++ #endif ++ #ifdef SSL_R_SSL_SESSION_ID_CALLBACK_FAILED ++ {"SSL_SESSION_ID_CALLBACK_FAILED", ERR_LIB_SSL, SSL_R_SSL_SESSION_ID_CALLBACK_FAILED}, ++ #else ++ {"SSL_SESSION_ID_CALLBACK_FAILED", 20, 301}, ++ #endif ++ #ifdef SSL_R_SSL_SESSION_ID_CONFLICT ++ {"SSL_SESSION_ID_CONFLICT", ERR_LIB_SSL, SSL_R_SSL_SESSION_ID_CONFLICT}, ++ #else ++ {"SSL_SESSION_ID_CONFLICT", 20, 302}, ++ #endif ++ #ifdef SSL_R_SSL_SESSION_ID_CONTEXT_TOO_LONG ++ {"SSL_SESSION_ID_CONTEXT_TOO_LONG", ERR_LIB_SSL, SSL_R_SSL_SESSION_ID_CONTEXT_TOO_LONG}, ++ #else ++ {"SSL_SESSION_ID_CONTEXT_TOO_LONG", 20, 273}, ++ #endif ++ #ifdef SSL_R_SSL_SESSION_ID_HAS_BAD_LENGTH ++ {"SSL_SESSION_ID_HAS_BAD_LENGTH", ERR_LIB_SSL, SSL_R_SSL_SESSION_ID_HAS_BAD_LENGTH}, ++ #else ++ {"SSL_SESSION_ID_HAS_BAD_LENGTH", 20, 303}, ++ #endif ++ #ifdef SSL_R_SSL_SESSION_ID_TOO_LONG ++ {"SSL_SESSION_ID_TOO_LONG", ERR_LIB_SSL, SSL_R_SSL_SESSION_ID_TOO_LONG}, ++ #else ++ {"SSL_SESSION_ID_TOO_LONG", 20, 408}, ++ #endif ++ #ifdef SSL_R_SSL_SESSION_VERSION_MISMATCH ++ {"SSL_SESSION_VERSION_MISMATCH", ERR_LIB_SSL, SSL_R_SSL_SESSION_VERSION_MISMATCH}, ++ #else ++ {"SSL_SESSION_VERSION_MISMATCH", 20, 210}, ++ #endif ++ #ifdef SSL_R_STILL_IN_INIT ++ {"STILL_IN_INIT", ERR_LIB_SSL, SSL_R_STILL_IN_INIT}, ++ #else ++ {"STILL_IN_INIT", 20, 121}, ++ #endif ++ #ifdef SSL_R_TLSV13_ALERT_CERTIFICATE_REQUIRED ++ {"TLSV13_ALERT_CERTIFICATE_REQUIRED", ERR_LIB_SSL, SSL_R_TLSV13_ALERT_CERTIFICATE_REQUIRED}, ++ #else ++ {"TLSV13_ALERT_CERTIFICATE_REQUIRED", 20, 1116}, ++ #endif ++ #ifdef SSL_R_TLSV13_ALERT_MISSING_EXTENSION ++ {"TLSV13_ALERT_MISSING_EXTENSION", ERR_LIB_SSL, SSL_R_TLSV13_ALERT_MISSING_EXTENSION}, ++ #else ++ {"TLSV13_ALERT_MISSING_EXTENSION", 20, 1109}, ++ #endif ++ #ifdef SSL_R_TLSV1_ALERT_ACCESS_DENIED ++ {"TLSV1_ALERT_ACCESS_DENIED", ERR_LIB_SSL, SSL_R_TLSV1_ALERT_ACCESS_DENIED}, ++ #else ++ {"TLSV1_ALERT_ACCESS_DENIED", 20, 1049}, ++ #endif ++ #ifdef SSL_R_TLSV1_ALERT_DECODE_ERROR ++ {"TLSV1_ALERT_DECODE_ERROR", ERR_LIB_SSL, SSL_R_TLSV1_ALERT_DECODE_ERROR}, ++ #else ++ {"TLSV1_ALERT_DECODE_ERROR", 20, 1050}, ++ #endif ++ #ifdef SSL_R_TLSV1_ALERT_DECRYPTION_FAILED ++ {"TLSV1_ALERT_DECRYPTION_FAILED", ERR_LIB_SSL, SSL_R_TLSV1_ALERT_DECRYPTION_FAILED}, ++ #else ++ {"TLSV1_ALERT_DECRYPTION_FAILED", 20, 1021}, ++ #endif ++ #ifdef SSL_R_TLSV1_ALERT_DECRYPT_ERROR ++ {"TLSV1_ALERT_DECRYPT_ERROR", ERR_LIB_SSL, SSL_R_TLSV1_ALERT_DECRYPT_ERROR}, ++ #else ++ {"TLSV1_ALERT_DECRYPT_ERROR", 20, 1051}, ++ #endif ++ #ifdef SSL_R_TLSV1_ALERT_EXPORT_RESTRICTION ++ {"TLSV1_ALERT_EXPORT_RESTRICTION", ERR_LIB_SSL, SSL_R_TLSV1_ALERT_EXPORT_RESTRICTION}, ++ #else ++ {"TLSV1_ALERT_EXPORT_RESTRICTION", 20, 1060}, ++ #endif ++ #ifdef SSL_R_TLSV1_ALERT_INAPPROPRIATE_FALLBACK ++ {"TLSV1_ALERT_INAPPROPRIATE_FALLBACK", ERR_LIB_SSL, SSL_R_TLSV1_ALERT_INAPPROPRIATE_FALLBACK}, ++ #else ++ {"TLSV1_ALERT_INAPPROPRIATE_FALLBACK", 20, 1086}, ++ #endif ++ #ifdef SSL_R_TLSV1_ALERT_INSUFFICIENT_SECURITY ++ {"TLSV1_ALERT_INSUFFICIENT_SECURITY", ERR_LIB_SSL, SSL_R_TLSV1_ALERT_INSUFFICIENT_SECURITY}, ++ #else ++ {"TLSV1_ALERT_INSUFFICIENT_SECURITY", 20, 1071}, ++ #endif ++ #ifdef SSL_R_TLSV1_ALERT_INTERNAL_ERROR ++ {"TLSV1_ALERT_INTERNAL_ERROR", ERR_LIB_SSL, SSL_R_TLSV1_ALERT_INTERNAL_ERROR}, ++ #else ++ {"TLSV1_ALERT_INTERNAL_ERROR", 20, 1080}, ++ #endif ++ #ifdef SSL_R_TLSV1_ALERT_NO_RENEGOTIATION ++ {"TLSV1_ALERT_NO_RENEGOTIATION", ERR_LIB_SSL, SSL_R_TLSV1_ALERT_NO_RENEGOTIATION}, ++ #else ++ {"TLSV1_ALERT_NO_RENEGOTIATION", 20, 1100}, ++ #endif ++ #ifdef SSL_R_TLSV1_ALERT_PROTOCOL_VERSION ++ {"TLSV1_ALERT_PROTOCOL_VERSION", ERR_LIB_SSL, SSL_R_TLSV1_ALERT_PROTOCOL_VERSION}, ++ #else ++ {"TLSV1_ALERT_PROTOCOL_VERSION", 20, 1070}, ++ #endif ++ #ifdef SSL_R_TLSV1_ALERT_RECORD_OVERFLOW ++ {"TLSV1_ALERT_RECORD_OVERFLOW", ERR_LIB_SSL, SSL_R_TLSV1_ALERT_RECORD_OVERFLOW}, ++ #else ++ {"TLSV1_ALERT_RECORD_OVERFLOW", 20, 1022}, ++ #endif ++ #ifdef SSL_R_TLSV1_ALERT_UNKNOWN_CA ++ {"TLSV1_ALERT_UNKNOWN_CA", ERR_LIB_SSL, SSL_R_TLSV1_ALERT_UNKNOWN_CA}, ++ #else ++ {"TLSV1_ALERT_UNKNOWN_CA", 20, 1048}, ++ #endif ++ #ifdef SSL_R_TLSV1_ALERT_USER_CANCELLED ++ {"TLSV1_ALERT_USER_CANCELLED", ERR_LIB_SSL, SSL_R_TLSV1_ALERT_USER_CANCELLED}, ++ #else ++ {"TLSV1_ALERT_USER_CANCELLED", 20, 1090}, ++ #endif ++ #ifdef SSL_R_TLSV1_BAD_CERTIFICATE_HASH_VALUE ++ {"TLSV1_BAD_CERTIFICATE_HASH_VALUE", ERR_LIB_SSL, SSL_R_TLSV1_BAD_CERTIFICATE_HASH_VALUE}, ++ #else ++ {"TLSV1_BAD_CERTIFICATE_HASH_VALUE", 20, 1114}, ++ #endif ++ #ifdef SSL_R_TLSV1_BAD_CERTIFICATE_STATUS_RESPONSE ++ {"TLSV1_BAD_CERTIFICATE_STATUS_RESPONSE", ERR_LIB_SSL, SSL_R_TLSV1_BAD_CERTIFICATE_STATUS_RESPONSE}, ++ #else ++ {"TLSV1_BAD_CERTIFICATE_STATUS_RESPONSE", 20, 1113}, ++ #endif ++ #ifdef SSL_R_TLSV1_CERTIFICATE_UNOBTAINABLE ++ {"TLSV1_CERTIFICATE_UNOBTAINABLE", ERR_LIB_SSL, SSL_R_TLSV1_CERTIFICATE_UNOBTAINABLE}, ++ #else ++ {"TLSV1_CERTIFICATE_UNOBTAINABLE", 20, 1111}, ++ #endif ++ #ifdef SSL_R_TLSV1_UNRECOGNIZED_NAME ++ {"TLSV1_UNRECOGNIZED_NAME", ERR_LIB_SSL, SSL_R_TLSV1_UNRECOGNIZED_NAME}, ++ #else ++ {"TLSV1_UNRECOGNIZED_NAME", 20, 1112}, ++ #endif ++ #ifdef SSL_R_TLSV1_UNSUPPORTED_EXTENSION ++ {"TLSV1_UNSUPPORTED_EXTENSION", ERR_LIB_SSL, SSL_R_TLSV1_UNSUPPORTED_EXTENSION}, ++ #else ++ {"TLSV1_UNSUPPORTED_EXTENSION", 20, 1110}, ++ #endif ++ #ifdef SSL_R_TLS_HEARTBEAT_PEER_DOESNT_ACCEPT ++ {"TLS_HEARTBEAT_PEER_DOESNT_ACCEPT", ERR_LIB_SSL, SSL_R_TLS_HEARTBEAT_PEER_DOESNT_ACCEPT}, ++ #else ++ {"TLS_HEARTBEAT_PEER_DOESNT_ACCEPT", 20, 365}, ++ #endif ++ #ifdef SSL_R_TLS_HEARTBEAT_PENDING ++ {"TLS_HEARTBEAT_PENDING", ERR_LIB_SSL, SSL_R_TLS_HEARTBEAT_PENDING}, ++ #else ++ {"TLS_HEARTBEAT_PENDING", 20, 366}, ++ #endif ++ #ifdef SSL_R_TLS_ILLEGAL_EXPORTER_LABEL ++ {"TLS_ILLEGAL_EXPORTER_LABEL", ERR_LIB_SSL, SSL_R_TLS_ILLEGAL_EXPORTER_LABEL}, ++ #else ++ {"TLS_ILLEGAL_EXPORTER_LABEL", 20, 367}, ++ #endif ++ #ifdef SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST ++ {"TLS_INVALID_ECPOINTFORMAT_LIST", ERR_LIB_SSL, SSL_R_TLS_INVALID_ECPOINTFORMAT_LIST}, ++ #else ++ {"TLS_INVALID_ECPOINTFORMAT_LIST", 20, 157}, ++ #endif ++ #ifdef SSL_R_TOO_MANY_KEY_UPDATES ++ {"TOO_MANY_KEY_UPDATES", ERR_LIB_SSL, SSL_R_TOO_MANY_KEY_UPDATES}, ++ #else ++ {"TOO_MANY_KEY_UPDATES", 20, 132}, ++ #endif ++ #ifdef SSL_R_TOO_MANY_WARN_ALERTS ++ {"TOO_MANY_WARN_ALERTS", ERR_LIB_SSL, SSL_R_TOO_MANY_WARN_ALERTS}, ++ #else ++ {"TOO_MANY_WARN_ALERTS", 20, 409}, ++ #endif ++ #ifdef SSL_R_TOO_MUCH_EARLY_DATA ++ {"TOO_MUCH_EARLY_DATA", ERR_LIB_SSL, SSL_R_TOO_MUCH_EARLY_DATA}, ++ #else ++ {"TOO_MUCH_EARLY_DATA", 20, 164}, ++ #endif ++ #ifdef SSL_R_UNABLE_TO_DECODE_ECDH_CERTS ++ {"UNABLE_TO_DECODE_ECDH_CERTS", ERR_LIB_SSL, SSL_R_UNABLE_TO_DECODE_ECDH_CERTS}, ++ #else ++ {"UNABLE_TO_DECODE_ECDH_CERTS", 20, 313}, ++ #endif ++ #ifdef SSL_R_UNABLE_TO_FIND_ECDH_PARAMETERS ++ {"UNABLE_TO_FIND_ECDH_PARAMETERS", ERR_LIB_SSL, SSL_R_UNABLE_TO_FIND_ECDH_PARAMETERS}, ++ #else ++ {"UNABLE_TO_FIND_ECDH_PARAMETERS", 20, 314}, ++ #endif ++ #ifdef SSL_R_UNABLE_TO_FIND_PUBLIC_KEY_PARAMETERS ++ {"UNABLE_TO_FIND_PUBLIC_KEY_PARAMETERS", ERR_LIB_SSL, SSL_R_UNABLE_TO_FIND_PUBLIC_KEY_PARAMETERS}, ++ #else ++ {"UNABLE_TO_FIND_PUBLIC_KEY_PARAMETERS", 20, 239}, ++ #endif ++ #ifdef SSL_R_UNABLE_TO_LOAD_SSL3_MD5_ROUTINES ++ {"UNABLE_TO_LOAD_SSL3_MD5_ROUTINES", ERR_LIB_SSL, SSL_R_UNABLE_TO_LOAD_SSL3_MD5_ROUTINES}, ++ #else ++ {"UNABLE_TO_LOAD_SSL3_MD5_ROUTINES", 20, 242}, ++ #endif ++ #ifdef SSL_R_UNABLE_TO_LOAD_SSL3_SHA1_ROUTINES ++ {"UNABLE_TO_LOAD_SSL3_SHA1_ROUTINES", ERR_LIB_SSL, SSL_R_UNABLE_TO_LOAD_SSL3_SHA1_ROUTINES}, ++ #else ++ {"UNABLE_TO_LOAD_SSL3_SHA1_ROUTINES", 20, 243}, ++ #endif ++ #ifdef SSL_R_UNEXPECTED_CCS_MESSAGE ++ {"UNEXPECTED_CCS_MESSAGE", ERR_LIB_SSL, SSL_R_UNEXPECTED_CCS_MESSAGE}, ++ #else ++ {"UNEXPECTED_CCS_MESSAGE", 20, 262}, ++ #endif ++ #ifdef SSL_R_UNEXPECTED_END_OF_EARLY_DATA ++ {"UNEXPECTED_END_OF_EARLY_DATA", ERR_LIB_SSL, SSL_R_UNEXPECTED_END_OF_EARLY_DATA}, ++ #else ++ {"UNEXPECTED_END_OF_EARLY_DATA", 20, 178}, ++ #endif ++ #ifdef SSL_R_UNEXPECTED_MESSAGE ++ {"UNEXPECTED_MESSAGE", ERR_LIB_SSL, SSL_R_UNEXPECTED_MESSAGE}, ++ #else ++ {"UNEXPECTED_MESSAGE", 20, 244}, ++ #endif ++ #ifdef SSL_R_UNEXPECTED_RECORD ++ {"UNEXPECTED_RECORD", ERR_LIB_SSL, SSL_R_UNEXPECTED_RECORD}, ++ #else ++ {"UNEXPECTED_RECORD", 20, 245}, ++ #endif ++ #ifdef SSL_R_UNINITIALIZED ++ {"UNINITIALIZED", ERR_LIB_SSL, SSL_R_UNINITIALIZED}, ++ #else ++ {"UNINITIALIZED", 20, 276}, ++ #endif ++ #ifdef SSL_R_UNKNOWN_ALERT_TYPE ++ {"UNKNOWN_ALERT_TYPE", ERR_LIB_SSL, SSL_R_UNKNOWN_ALERT_TYPE}, ++ #else ++ {"UNKNOWN_ALERT_TYPE", 20, 246}, ++ #endif ++ #ifdef SSL_R_UNKNOWN_CERTIFICATE_TYPE ++ {"UNKNOWN_CERTIFICATE_TYPE", ERR_LIB_SSL, SSL_R_UNKNOWN_CERTIFICATE_TYPE}, ++ #else ++ {"UNKNOWN_CERTIFICATE_TYPE", 20, 247}, ++ #endif ++ #ifdef SSL_R_UNKNOWN_CIPHER_RETURNED ++ {"UNKNOWN_CIPHER_RETURNED", ERR_LIB_SSL, SSL_R_UNKNOWN_CIPHER_RETURNED}, ++ #else ++ {"UNKNOWN_CIPHER_RETURNED", 20, 248}, ++ #endif ++ #ifdef SSL_R_UNKNOWN_CIPHER_TYPE ++ {"UNKNOWN_CIPHER_TYPE", ERR_LIB_SSL, SSL_R_UNKNOWN_CIPHER_TYPE}, ++ #else ++ {"UNKNOWN_CIPHER_TYPE", 20, 249}, ++ #endif ++ #ifdef SSL_R_UNKNOWN_CMD_NAME ++ {"UNKNOWN_CMD_NAME", ERR_LIB_SSL, SSL_R_UNKNOWN_CMD_NAME}, ++ #else ++ {"UNKNOWN_CMD_NAME", 20, 386}, ++ #endif ++ #ifdef SSL_R_UNKNOWN_COMMAND ++ {"UNKNOWN_COMMAND", ERR_LIB_SSL, SSL_R_UNKNOWN_COMMAND}, ++ #else ++ {"UNKNOWN_COMMAND", 20, 139}, ++ #endif ++ #ifdef SSL_R_UNKNOWN_DIGEST ++ {"UNKNOWN_DIGEST", ERR_LIB_SSL, SSL_R_UNKNOWN_DIGEST}, ++ #else ++ {"UNKNOWN_DIGEST", 20, 368}, ++ #endif ++ #ifdef SSL_R_UNKNOWN_KEY_EXCHANGE_TYPE ++ {"UNKNOWN_KEY_EXCHANGE_TYPE", ERR_LIB_SSL, SSL_R_UNKNOWN_KEY_EXCHANGE_TYPE}, ++ #else ++ {"UNKNOWN_KEY_EXCHANGE_TYPE", 20, 250}, ++ #endif ++ #ifdef SSL_R_UNKNOWN_PKEY_TYPE ++ {"UNKNOWN_PKEY_TYPE", ERR_LIB_SSL, SSL_R_UNKNOWN_PKEY_TYPE}, ++ #else ++ {"UNKNOWN_PKEY_TYPE", 20, 251}, ++ #endif ++ #ifdef SSL_R_UNKNOWN_PROTOCOL ++ {"UNKNOWN_PROTOCOL", ERR_LIB_SSL, SSL_R_UNKNOWN_PROTOCOL}, ++ #else ++ {"UNKNOWN_PROTOCOL", 20, 252}, ++ #endif ++ #ifdef SSL_R_UNKNOWN_SSL_VERSION ++ {"UNKNOWN_SSL_VERSION", ERR_LIB_SSL, SSL_R_UNKNOWN_SSL_VERSION}, ++ #else ++ {"UNKNOWN_SSL_VERSION", 20, 254}, ++ #endif ++ #ifdef SSL_R_UNKNOWN_STATE ++ {"UNKNOWN_STATE", ERR_LIB_SSL, SSL_R_UNKNOWN_STATE}, ++ #else ++ {"UNKNOWN_STATE", 20, 255}, ++ #endif ++ #ifdef SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED ++ {"UNSAFE_LEGACY_RENEGOTIATION_DISABLED", ERR_LIB_SSL, SSL_R_UNSAFE_LEGACY_RENEGOTIATION_DISABLED}, ++ #else ++ {"UNSAFE_LEGACY_RENEGOTIATION_DISABLED", 20, 338}, ++ #endif ++ #ifdef SSL_R_UNSOLICITED_EXTENSION ++ {"UNSOLICITED_EXTENSION", ERR_LIB_SSL, SSL_R_UNSOLICITED_EXTENSION}, ++ #else ++ {"UNSOLICITED_EXTENSION", 20, 217}, ++ #endif ++ #ifdef SSL_R_UNSUPPORTED_COMPRESSION_ALGORITHM ++ {"UNSUPPORTED_COMPRESSION_ALGORITHM", ERR_LIB_SSL, SSL_R_UNSUPPORTED_COMPRESSION_ALGORITHM}, ++ #else ++ {"UNSUPPORTED_COMPRESSION_ALGORITHM", 20, 257}, ++ #endif ++ #ifdef SSL_R_UNSUPPORTED_DIGEST_TYPE ++ {"UNSUPPORTED_DIGEST_TYPE", ERR_LIB_SSL, SSL_R_UNSUPPORTED_DIGEST_TYPE}, ++ #else ++ {"UNSUPPORTED_DIGEST_TYPE", 20, 326}, ++ #endif ++ #ifdef SSL_R_UNSUPPORTED_ELLIPTIC_CURVE ++ {"UNSUPPORTED_ELLIPTIC_CURVE", ERR_LIB_SSL, SSL_R_UNSUPPORTED_ELLIPTIC_CURVE}, ++ #else ++ {"UNSUPPORTED_ELLIPTIC_CURVE", 20, 315}, ++ #endif ++ #ifdef SSL_R_UNSUPPORTED_PROTOCOL ++ {"UNSUPPORTED_PROTOCOL", ERR_LIB_SSL, SSL_R_UNSUPPORTED_PROTOCOL}, ++ #else ++ {"UNSUPPORTED_PROTOCOL", 20, 258}, ++ #endif ++ #ifdef SSL_R_UNSUPPORTED_SSL_VERSION ++ {"UNSUPPORTED_SSL_VERSION", ERR_LIB_SSL, SSL_R_UNSUPPORTED_SSL_VERSION}, ++ #else ++ {"UNSUPPORTED_SSL_VERSION", 20, 259}, ++ #endif ++ #ifdef SSL_R_UNSUPPORTED_STATUS_TYPE ++ {"UNSUPPORTED_STATUS_TYPE", ERR_LIB_SSL, SSL_R_UNSUPPORTED_STATUS_TYPE}, ++ #else ++ {"UNSUPPORTED_STATUS_TYPE", 20, 329}, ++ #endif ++ #ifdef SSL_R_USE_SRTP_NOT_NEGOTIATED ++ {"USE_SRTP_NOT_NEGOTIATED", ERR_LIB_SSL, SSL_R_USE_SRTP_NOT_NEGOTIATED}, ++ #else ++ {"USE_SRTP_NOT_NEGOTIATED", 20, 369}, ++ #endif ++ #ifdef SSL_R_VERSION_TOO_HIGH ++ {"VERSION_TOO_HIGH", ERR_LIB_SSL, SSL_R_VERSION_TOO_HIGH}, ++ #else ++ {"VERSION_TOO_HIGH", 20, 166}, ++ #endif ++ #ifdef SSL_R_VERSION_TOO_LOW ++ {"VERSION_TOO_LOW", ERR_LIB_SSL, SSL_R_VERSION_TOO_LOW}, ++ #else ++ {"VERSION_TOO_LOW", 20, 396}, ++ #endif ++ #ifdef SSL_R_WRONG_CERTIFICATE_TYPE ++ {"WRONG_CERTIFICATE_TYPE", ERR_LIB_SSL, SSL_R_WRONG_CERTIFICATE_TYPE}, ++ #else ++ {"WRONG_CERTIFICATE_TYPE", 20, 383}, ++ #endif ++ #ifdef SSL_R_WRONG_CIPHER_RETURNED ++ {"WRONG_CIPHER_RETURNED", ERR_LIB_SSL, SSL_R_WRONG_CIPHER_RETURNED}, ++ #else ++ {"WRONG_CIPHER_RETURNED", 20, 261}, ++ #endif ++ #ifdef SSL_R_WRONG_CURVE ++ {"WRONG_CURVE", ERR_LIB_SSL, SSL_R_WRONG_CURVE}, ++ #else ++ {"WRONG_CURVE", 20, 378}, ++ #endif ++ #ifdef SSL_R_WRONG_SIGNATURE_LENGTH ++ {"WRONG_SIGNATURE_LENGTH", ERR_LIB_SSL, SSL_R_WRONG_SIGNATURE_LENGTH}, ++ #else ++ {"WRONG_SIGNATURE_LENGTH", 20, 264}, ++ #endif ++ #ifdef SSL_R_WRONG_SIGNATURE_SIZE ++ {"WRONG_SIGNATURE_SIZE", ERR_LIB_SSL, SSL_R_WRONG_SIGNATURE_SIZE}, ++ #else ++ {"WRONG_SIGNATURE_SIZE", 20, 265}, ++ #endif ++ #ifdef SSL_R_WRONG_SIGNATURE_TYPE ++ {"WRONG_SIGNATURE_TYPE", ERR_LIB_SSL, SSL_R_WRONG_SIGNATURE_TYPE}, ++ #else ++ {"WRONG_SIGNATURE_TYPE", 20, 370}, ++ #endif ++ #ifdef SSL_R_WRONG_SSL_VERSION ++ {"WRONG_SSL_VERSION", ERR_LIB_SSL, SSL_R_WRONG_SSL_VERSION}, ++ #else ++ {"WRONG_SSL_VERSION", 20, 266}, ++ #endif ++ #ifdef SSL_R_WRONG_VERSION_NUMBER ++ {"WRONG_VERSION_NUMBER", ERR_LIB_SSL, SSL_R_WRONG_VERSION_NUMBER}, ++ #else ++ {"WRONG_VERSION_NUMBER", 20, 267}, ++ #endif ++ #ifdef SSL_R_X509_LIB ++ {"X509_LIB", ERR_LIB_SSL, SSL_R_X509_LIB}, ++ #else ++ {"X509_LIB", 20, 268}, ++ #endif ++ #ifdef SSL_R_X509_VERIFICATION_SETUP_PROBLEMS ++ {"X509_VERIFICATION_SETUP_PROBLEMS", ERR_LIB_SSL, SSL_R_X509_VERIFICATION_SETUP_PROBLEMS}, ++ #else ++ {"X509_VERIFICATION_SETUP_PROBLEMS", 20, 269}, ++ #endif ++ #ifdef TS_R_BAD_PKCS7_TYPE ++ {"BAD_PKCS7_TYPE", ERR_LIB_TS, TS_R_BAD_PKCS7_TYPE}, ++ #else ++ {"BAD_PKCS7_TYPE", 47, 132}, ++ #endif ++ #ifdef TS_R_BAD_TYPE ++ {"BAD_TYPE", ERR_LIB_TS, TS_R_BAD_TYPE}, ++ #else ++ {"BAD_TYPE", 47, 133}, ++ #endif ++ #ifdef TS_R_CANNOT_LOAD_CERT ++ {"CANNOT_LOAD_CERT", ERR_LIB_TS, TS_R_CANNOT_LOAD_CERT}, ++ #else ++ {"CANNOT_LOAD_CERT", 47, 137}, ++ #endif ++ #ifdef TS_R_CANNOT_LOAD_KEY ++ {"CANNOT_LOAD_KEY", ERR_LIB_TS, TS_R_CANNOT_LOAD_KEY}, ++ #else ++ {"CANNOT_LOAD_KEY", 47, 138}, ++ #endif ++ #ifdef TS_R_CERTIFICATE_VERIFY_ERROR ++ {"CERTIFICATE_VERIFY_ERROR", ERR_LIB_TS, TS_R_CERTIFICATE_VERIFY_ERROR}, ++ #else ++ {"CERTIFICATE_VERIFY_ERROR", 47, 100}, ++ #endif ++ #ifdef TS_R_COULD_NOT_SET_ENGINE ++ {"COULD_NOT_SET_ENGINE", ERR_LIB_TS, TS_R_COULD_NOT_SET_ENGINE}, ++ #else ++ {"COULD_NOT_SET_ENGINE", 47, 127}, ++ #endif ++ #ifdef TS_R_COULD_NOT_SET_TIME ++ {"COULD_NOT_SET_TIME", ERR_LIB_TS, TS_R_COULD_NOT_SET_TIME}, ++ #else ++ {"COULD_NOT_SET_TIME", 47, 115}, ++ #endif ++ #ifdef TS_R_DETACHED_CONTENT ++ {"DETACHED_CONTENT", ERR_LIB_TS, TS_R_DETACHED_CONTENT}, ++ #else ++ {"DETACHED_CONTENT", 47, 134}, ++ #endif ++ #ifdef TS_R_ESS_ADD_SIGNING_CERT_ERROR ++ {"ESS_ADD_SIGNING_CERT_ERROR", ERR_LIB_TS, TS_R_ESS_ADD_SIGNING_CERT_ERROR}, ++ #else ++ {"ESS_ADD_SIGNING_CERT_ERROR", 47, 116}, ++ #endif ++ #ifdef TS_R_ESS_ADD_SIGNING_CERT_V2_ERROR ++ {"ESS_ADD_SIGNING_CERT_V2_ERROR", ERR_LIB_TS, TS_R_ESS_ADD_SIGNING_CERT_V2_ERROR}, ++ #else ++ {"ESS_ADD_SIGNING_CERT_V2_ERROR", 47, 139}, ++ #endif ++ #ifdef TS_R_ESS_SIGNING_CERTIFICATE_ERROR ++ {"ESS_SIGNING_CERTIFICATE_ERROR", ERR_LIB_TS, TS_R_ESS_SIGNING_CERTIFICATE_ERROR}, ++ #else ++ {"ESS_SIGNING_CERTIFICATE_ERROR", 47, 101}, ++ #endif ++ #ifdef TS_R_INVALID_NULL_POINTER ++ {"INVALID_NULL_POINTER", ERR_LIB_TS, TS_R_INVALID_NULL_POINTER}, ++ #else ++ {"INVALID_NULL_POINTER", 47, 102}, ++ #endif ++ #ifdef TS_R_INVALID_SIGNER_CERTIFICATE_PURPOSE ++ {"INVALID_SIGNER_CERTIFICATE_PURPOSE", ERR_LIB_TS, TS_R_INVALID_SIGNER_CERTIFICATE_PURPOSE}, ++ #else ++ {"INVALID_SIGNER_CERTIFICATE_PURPOSE", 47, 117}, ++ #endif ++ #ifdef TS_R_MESSAGE_IMPRINT_MISMATCH ++ {"MESSAGE_IMPRINT_MISMATCH", ERR_LIB_TS, TS_R_MESSAGE_IMPRINT_MISMATCH}, ++ #else ++ {"MESSAGE_IMPRINT_MISMATCH", 47, 103}, ++ #endif ++ #ifdef TS_R_NONCE_MISMATCH ++ {"NONCE_MISMATCH", ERR_LIB_TS, TS_R_NONCE_MISMATCH}, ++ #else ++ {"NONCE_MISMATCH", 47, 104}, ++ #endif ++ #ifdef TS_R_NONCE_NOT_RETURNED ++ {"NONCE_NOT_RETURNED", ERR_LIB_TS, TS_R_NONCE_NOT_RETURNED}, ++ #else ++ {"NONCE_NOT_RETURNED", 47, 105}, ++ #endif ++ #ifdef TS_R_NO_CONTENT ++ {"NO_CONTENT", ERR_LIB_TS, TS_R_NO_CONTENT}, ++ #else ++ {"NO_CONTENT", 47, 106}, ++ #endif ++ #ifdef TS_R_NO_TIME_STAMP_TOKEN ++ {"NO_TIME_STAMP_TOKEN", ERR_LIB_TS, TS_R_NO_TIME_STAMP_TOKEN}, ++ #else ++ {"NO_TIME_STAMP_TOKEN", 47, 107}, ++ #endif ++ #ifdef TS_R_PKCS7_ADD_SIGNATURE_ERROR ++ {"PKCS7_ADD_SIGNATURE_ERROR", ERR_LIB_TS, TS_R_PKCS7_ADD_SIGNATURE_ERROR}, ++ #else ++ {"PKCS7_ADD_SIGNATURE_ERROR", 47, 118}, ++ #endif ++ #ifdef TS_R_PKCS7_ADD_SIGNED_ATTR_ERROR ++ {"PKCS7_ADD_SIGNED_ATTR_ERROR", ERR_LIB_TS, TS_R_PKCS7_ADD_SIGNED_ATTR_ERROR}, ++ #else ++ {"PKCS7_ADD_SIGNED_ATTR_ERROR", 47, 119}, ++ #endif ++ #ifdef TS_R_PKCS7_TO_TS_TST_INFO_FAILED ++ {"PKCS7_TO_TS_TST_INFO_FAILED", ERR_LIB_TS, TS_R_PKCS7_TO_TS_TST_INFO_FAILED}, ++ #else ++ {"PKCS7_TO_TS_TST_INFO_FAILED", 47, 129}, ++ #endif ++ #ifdef TS_R_POLICY_MISMATCH ++ {"POLICY_MISMATCH", ERR_LIB_TS, TS_R_POLICY_MISMATCH}, ++ #else ++ {"POLICY_MISMATCH", 47, 108}, ++ #endif ++ #ifdef TS_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE ++ {"PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE", ERR_LIB_TS, TS_R_PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE}, ++ #else ++ {"PRIVATE_KEY_DOES_NOT_MATCH_CERTIFICATE", 47, 120}, ++ #endif ++ #ifdef TS_R_RESPONSE_SETUP_ERROR ++ {"RESPONSE_SETUP_ERROR", ERR_LIB_TS, TS_R_RESPONSE_SETUP_ERROR}, ++ #else ++ {"RESPONSE_SETUP_ERROR", 47, 121}, ++ #endif ++ #ifdef TS_R_SIGNATURE_FAILURE ++ {"SIGNATURE_FAILURE", ERR_LIB_TS, TS_R_SIGNATURE_FAILURE}, ++ #else ++ {"SIGNATURE_FAILURE", 47, 109}, ++ #endif ++ #ifdef TS_R_THERE_MUST_BE_ONE_SIGNER ++ {"THERE_MUST_BE_ONE_SIGNER", ERR_LIB_TS, TS_R_THERE_MUST_BE_ONE_SIGNER}, ++ #else ++ {"THERE_MUST_BE_ONE_SIGNER", 47, 110}, ++ #endif ++ #ifdef TS_R_TIME_SYSCALL_ERROR ++ {"TIME_SYSCALL_ERROR", ERR_LIB_TS, TS_R_TIME_SYSCALL_ERROR}, ++ #else ++ {"TIME_SYSCALL_ERROR", 47, 122}, ++ #endif ++ #ifdef TS_R_TOKEN_NOT_PRESENT ++ {"TOKEN_NOT_PRESENT", ERR_LIB_TS, TS_R_TOKEN_NOT_PRESENT}, ++ #else ++ {"TOKEN_NOT_PRESENT", 47, 130}, ++ #endif ++ #ifdef TS_R_TOKEN_PRESENT ++ {"TOKEN_PRESENT", ERR_LIB_TS, TS_R_TOKEN_PRESENT}, ++ #else ++ {"TOKEN_PRESENT", 47, 131}, ++ #endif ++ #ifdef TS_R_TSA_NAME_MISMATCH ++ {"TSA_NAME_MISMATCH", ERR_LIB_TS, TS_R_TSA_NAME_MISMATCH}, ++ #else ++ {"TSA_NAME_MISMATCH", 47, 111}, ++ #endif ++ #ifdef TS_R_TSA_UNTRUSTED ++ {"TSA_UNTRUSTED", ERR_LIB_TS, TS_R_TSA_UNTRUSTED}, ++ #else ++ {"TSA_UNTRUSTED", 47, 112}, ++ #endif ++ #ifdef TS_R_TST_INFO_SETUP_ERROR ++ {"TST_INFO_SETUP_ERROR", ERR_LIB_TS, TS_R_TST_INFO_SETUP_ERROR}, ++ #else ++ {"TST_INFO_SETUP_ERROR", 47, 123}, ++ #endif ++ #ifdef TS_R_TS_DATASIGN ++ {"TS_DATASIGN", ERR_LIB_TS, TS_R_TS_DATASIGN}, ++ #else ++ {"TS_DATASIGN", 47, 124}, ++ #endif ++ #ifdef TS_R_UNACCEPTABLE_POLICY ++ {"UNACCEPTABLE_POLICY", ERR_LIB_TS, TS_R_UNACCEPTABLE_POLICY}, ++ #else ++ {"UNACCEPTABLE_POLICY", 47, 125}, ++ #endif ++ #ifdef TS_R_UNSUPPORTED_MD_ALGORITHM ++ {"UNSUPPORTED_MD_ALGORITHM", ERR_LIB_TS, TS_R_UNSUPPORTED_MD_ALGORITHM}, ++ #else ++ {"UNSUPPORTED_MD_ALGORITHM", 47, 126}, ++ #endif ++ #ifdef TS_R_UNSUPPORTED_VERSION ++ {"UNSUPPORTED_VERSION", ERR_LIB_TS, TS_R_UNSUPPORTED_VERSION}, ++ #else ++ {"UNSUPPORTED_VERSION", 47, 113}, ++ #endif ++ #ifdef TS_R_VAR_BAD_VALUE ++ {"VAR_BAD_VALUE", ERR_LIB_TS, TS_R_VAR_BAD_VALUE}, ++ #else ++ {"VAR_BAD_VALUE", 47, 135}, ++ #endif ++ #ifdef TS_R_VAR_LOOKUP_FAILURE ++ {"VAR_LOOKUP_FAILURE", ERR_LIB_TS, TS_R_VAR_LOOKUP_FAILURE}, ++ #else ++ {"VAR_LOOKUP_FAILURE", 47, 136}, ++ #endif ++ #ifdef TS_R_WRONG_CONTENT_TYPE ++ {"WRONG_CONTENT_TYPE", ERR_LIB_TS, TS_R_WRONG_CONTENT_TYPE}, ++ #else ++ {"WRONG_CONTENT_TYPE", 47, 114}, ++ #endif ++ #ifdef UI_R_COMMON_OK_AND_CANCEL_CHARACTERS ++ {"COMMON_OK_AND_CANCEL_CHARACTERS", ERR_LIB_UI, UI_R_COMMON_OK_AND_CANCEL_CHARACTERS}, ++ #else ++ {"COMMON_OK_AND_CANCEL_CHARACTERS", 40, 104}, ++ #endif ++ #ifdef UI_R_INDEX_TOO_LARGE ++ {"INDEX_TOO_LARGE", ERR_LIB_UI, UI_R_INDEX_TOO_LARGE}, ++ #else ++ {"INDEX_TOO_LARGE", 40, 102}, ++ #endif ++ #ifdef UI_R_INDEX_TOO_SMALL ++ {"INDEX_TOO_SMALL", ERR_LIB_UI, UI_R_INDEX_TOO_SMALL}, ++ #else ++ {"INDEX_TOO_SMALL", 40, 103}, ++ #endif ++ #ifdef UI_R_NO_RESULT_BUFFER ++ {"NO_RESULT_BUFFER", ERR_LIB_UI, UI_R_NO_RESULT_BUFFER}, ++ #else ++ {"NO_RESULT_BUFFER", 40, 105}, ++ #endif ++ #ifdef UI_R_PROCESSING_ERROR ++ {"PROCESSING_ERROR", ERR_LIB_UI, UI_R_PROCESSING_ERROR}, ++ #else ++ {"PROCESSING_ERROR", 40, 107}, ++ #endif ++ #ifdef UI_R_RESULT_TOO_LARGE ++ {"RESULT_TOO_LARGE", ERR_LIB_UI, UI_R_RESULT_TOO_LARGE}, ++ #else ++ {"RESULT_TOO_LARGE", 40, 100}, ++ #endif ++ #ifdef UI_R_RESULT_TOO_SMALL ++ {"RESULT_TOO_SMALL", ERR_LIB_UI, UI_R_RESULT_TOO_SMALL}, ++ #else ++ {"RESULT_TOO_SMALL", 40, 101}, ++ #endif ++ #ifdef UI_R_SYSASSIGN_ERROR ++ {"SYSASSIGN_ERROR", ERR_LIB_UI, UI_R_SYSASSIGN_ERROR}, ++ #else ++ {"SYSASSIGN_ERROR", 40, 109}, ++ #endif ++ #ifdef UI_R_SYSDASSGN_ERROR ++ {"SYSDASSGN_ERROR", ERR_LIB_UI, UI_R_SYSDASSGN_ERROR}, ++ #else ++ {"SYSDASSGN_ERROR", 40, 110}, ++ #endif ++ #ifdef UI_R_SYSQIOW_ERROR ++ {"SYSQIOW_ERROR", ERR_LIB_UI, UI_R_SYSQIOW_ERROR}, ++ #else ++ {"SYSQIOW_ERROR", 40, 111}, ++ #endif ++ #ifdef UI_R_UNKNOWN_CONTROL_COMMAND ++ {"UNKNOWN_CONTROL_COMMAND", ERR_LIB_UI, UI_R_UNKNOWN_CONTROL_COMMAND}, ++ #else ++ {"UNKNOWN_CONTROL_COMMAND", 40, 106}, ++ #endif ++ #ifdef UI_R_UNKNOWN_TTYGET_ERRNO_VALUE ++ {"UNKNOWN_TTYGET_ERRNO_VALUE", ERR_LIB_UI, UI_R_UNKNOWN_TTYGET_ERRNO_VALUE}, ++ #else ++ {"UNKNOWN_TTYGET_ERRNO_VALUE", 40, 108}, ++ #endif ++ #ifdef UI_R_USER_DATA_DUPLICATION_UNSUPPORTED ++ {"USER_DATA_DUPLICATION_UNSUPPORTED", ERR_LIB_UI, UI_R_USER_DATA_DUPLICATION_UNSUPPORTED}, ++ #else ++ {"USER_DATA_DUPLICATION_UNSUPPORTED", 40, 112}, ++ #endif ++ #ifdef X509V3_R_BAD_IP_ADDRESS ++ {"BAD_IP_ADDRESS", ERR_LIB_X509V3, X509V3_R_BAD_IP_ADDRESS}, ++ #else ++ {"BAD_IP_ADDRESS", 34, 118}, ++ #endif ++ #ifdef X509V3_R_BAD_OBJECT ++ {"BAD_OBJECT", ERR_LIB_X509V3, X509V3_R_BAD_OBJECT}, ++ #else ++ {"BAD_OBJECT", 34, 119}, ++ #endif ++ #ifdef X509V3_R_BN_DEC2BN_ERROR ++ {"BN_DEC2BN_ERROR", ERR_LIB_X509V3, X509V3_R_BN_DEC2BN_ERROR}, ++ #else ++ {"BN_DEC2BN_ERROR", 34, 100}, ++ #endif ++ #ifdef X509V3_R_BN_TO_ASN1_INTEGER_ERROR ++ {"BN_TO_ASN1_INTEGER_ERROR", ERR_LIB_X509V3, X509V3_R_BN_TO_ASN1_INTEGER_ERROR}, ++ #else ++ {"BN_TO_ASN1_INTEGER_ERROR", 34, 101}, ++ #endif ++ #ifdef X509V3_R_DIRNAME_ERROR ++ {"DIRNAME_ERROR", ERR_LIB_X509V3, X509V3_R_DIRNAME_ERROR}, ++ #else ++ {"DIRNAME_ERROR", 34, 149}, ++ #endif ++ #ifdef X509V3_R_DISTPOINT_ALREADY_SET ++ {"DISTPOINT_ALREADY_SET", ERR_LIB_X509V3, X509V3_R_DISTPOINT_ALREADY_SET}, ++ #else ++ {"DISTPOINT_ALREADY_SET", 34, 160}, ++ #endif ++ #ifdef X509V3_R_DUPLICATE_ZONE_ID ++ {"DUPLICATE_ZONE_ID", ERR_LIB_X509V3, X509V3_R_DUPLICATE_ZONE_ID}, ++ #else ++ {"DUPLICATE_ZONE_ID", 34, 133}, ++ #endif ++ #ifdef X509V3_R_ERROR_CONVERTING_ZONE ++ {"ERROR_CONVERTING_ZONE", ERR_LIB_X509V3, X509V3_R_ERROR_CONVERTING_ZONE}, ++ #else ++ {"ERROR_CONVERTING_ZONE", 34, 131}, ++ #endif ++ #ifdef X509V3_R_ERROR_CREATING_EXTENSION ++ {"ERROR_CREATING_EXTENSION", ERR_LIB_X509V3, X509V3_R_ERROR_CREATING_EXTENSION}, ++ #else ++ {"ERROR_CREATING_EXTENSION", 34, 144}, ++ #endif ++ #ifdef X509V3_R_ERROR_IN_EXTENSION ++ {"ERROR_IN_EXTENSION", ERR_LIB_X509V3, X509V3_R_ERROR_IN_EXTENSION}, ++ #else ++ {"ERROR_IN_EXTENSION", 34, 128}, ++ #endif ++ #ifdef X509V3_R_EXPECTED_A_SECTION_NAME ++ {"EXPECTED_A_SECTION_NAME", ERR_LIB_X509V3, X509V3_R_EXPECTED_A_SECTION_NAME}, ++ #else ++ {"EXPECTED_A_SECTION_NAME", 34, 137}, ++ #endif ++ #ifdef X509V3_R_EXTENSION_EXISTS ++ {"EXTENSION_EXISTS", ERR_LIB_X509V3, X509V3_R_EXTENSION_EXISTS}, ++ #else ++ {"EXTENSION_EXISTS", 34, 145}, ++ #endif ++ #ifdef X509V3_R_EXTENSION_NAME_ERROR ++ {"EXTENSION_NAME_ERROR", ERR_LIB_X509V3, X509V3_R_EXTENSION_NAME_ERROR}, ++ #else ++ {"EXTENSION_NAME_ERROR", 34, 115}, ++ #endif ++ #ifdef X509V3_R_EXTENSION_NOT_FOUND ++ {"EXTENSION_NOT_FOUND", ERR_LIB_X509V3, X509V3_R_EXTENSION_NOT_FOUND}, ++ #else ++ {"EXTENSION_NOT_FOUND", 34, 102}, ++ #endif ++ #ifdef X509V3_R_EXTENSION_SETTING_NOT_SUPPORTED ++ {"EXTENSION_SETTING_NOT_SUPPORTED", ERR_LIB_X509V3, X509V3_R_EXTENSION_SETTING_NOT_SUPPORTED}, ++ #else ++ {"EXTENSION_SETTING_NOT_SUPPORTED", 34, 103}, ++ #endif ++ #ifdef X509V3_R_EXTENSION_VALUE_ERROR ++ {"EXTENSION_VALUE_ERROR", ERR_LIB_X509V3, X509V3_R_EXTENSION_VALUE_ERROR}, ++ #else ++ {"EXTENSION_VALUE_ERROR", 34, 116}, ++ #endif ++ #ifdef X509V3_R_ILLEGAL_EMPTY_EXTENSION ++ {"ILLEGAL_EMPTY_EXTENSION", ERR_LIB_X509V3, X509V3_R_ILLEGAL_EMPTY_EXTENSION}, ++ #else ++ {"ILLEGAL_EMPTY_EXTENSION", 34, 151}, ++ #endif ++ #ifdef X509V3_R_INCORRECT_POLICY_SYNTAX_TAG ++ {"INCORRECT_POLICY_SYNTAX_TAG", ERR_LIB_X509V3, X509V3_R_INCORRECT_POLICY_SYNTAX_TAG}, ++ #else ++ {"INCORRECT_POLICY_SYNTAX_TAG", 34, 152}, ++ #endif ++ #ifdef X509V3_R_INVALID_ASNUMBER ++ {"INVALID_ASNUMBER", ERR_LIB_X509V3, X509V3_R_INVALID_ASNUMBER}, ++ #else ++ {"INVALID_ASNUMBER", 34, 162}, ++ #endif ++ #ifdef X509V3_R_INVALID_ASRANGE ++ {"INVALID_ASRANGE", ERR_LIB_X509V3, X509V3_R_INVALID_ASRANGE}, ++ #else ++ {"INVALID_ASRANGE", 34, 163}, ++ #endif ++ #ifdef X509V3_R_INVALID_BOOLEAN_STRING ++ {"INVALID_BOOLEAN_STRING", ERR_LIB_X509V3, X509V3_R_INVALID_BOOLEAN_STRING}, ++ #else ++ {"INVALID_BOOLEAN_STRING", 34, 104}, ++ #endif ++ #ifdef X509V3_R_INVALID_EXTENSION_STRING ++ {"INVALID_EXTENSION_STRING", ERR_LIB_X509V3, X509V3_R_INVALID_EXTENSION_STRING}, ++ #else ++ {"INVALID_EXTENSION_STRING", 34, 105}, ++ #endif ++ #ifdef X509V3_R_INVALID_INHERITANCE ++ {"INVALID_INHERITANCE", ERR_LIB_X509V3, X509V3_R_INVALID_INHERITANCE}, ++ #else ++ {"INVALID_INHERITANCE", 34, 165}, ++ #endif ++ #ifdef X509V3_R_INVALID_IPADDRESS ++ {"INVALID_IPADDRESS", ERR_LIB_X509V3, X509V3_R_INVALID_IPADDRESS}, ++ #else ++ {"INVALID_IPADDRESS", 34, 166}, ++ #endif ++ #ifdef X509V3_R_INVALID_MULTIPLE_RDNS ++ {"INVALID_MULTIPLE_RDNS", ERR_LIB_X509V3, X509V3_R_INVALID_MULTIPLE_RDNS}, ++ #else ++ {"INVALID_MULTIPLE_RDNS", 34, 161}, ++ #endif ++ #ifdef X509V3_R_INVALID_NAME ++ {"INVALID_NAME", ERR_LIB_X509V3, X509V3_R_INVALID_NAME}, ++ #else ++ {"INVALID_NAME", 34, 106}, ++ #endif ++ #ifdef X509V3_R_INVALID_NULL_ARGUMENT ++ {"INVALID_NULL_ARGUMENT", ERR_LIB_X509V3, X509V3_R_INVALID_NULL_ARGUMENT}, ++ #else ++ {"INVALID_NULL_ARGUMENT", 34, 107}, ++ #endif ++ #ifdef X509V3_R_INVALID_NULL_NAME ++ {"INVALID_NULL_NAME", ERR_LIB_X509V3, X509V3_R_INVALID_NULL_NAME}, ++ #else ++ {"INVALID_NULL_NAME", 34, 108}, ++ #endif ++ #ifdef X509V3_R_INVALID_NULL_VALUE ++ {"INVALID_NULL_VALUE", ERR_LIB_X509V3, X509V3_R_INVALID_NULL_VALUE}, ++ #else ++ {"INVALID_NULL_VALUE", 34, 109}, ++ #endif ++ #ifdef X509V3_R_INVALID_NUMBER ++ {"INVALID_NUMBER", ERR_LIB_X509V3, X509V3_R_INVALID_NUMBER}, ++ #else ++ {"INVALID_NUMBER", 34, 140}, ++ #endif ++ #ifdef X509V3_R_INVALID_NUMBERS ++ {"INVALID_NUMBERS", ERR_LIB_X509V3, X509V3_R_INVALID_NUMBERS}, ++ #else ++ {"INVALID_NUMBERS", 34, 141}, ++ #endif ++ #ifdef X509V3_R_INVALID_OBJECT_IDENTIFIER ++ {"INVALID_OBJECT_IDENTIFIER", ERR_LIB_X509V3, X509V3_R_INVALID_OBJECT_IDENTIFIER}, ++ #else ++ {"INVALID_OBJECT_IDENTIFIER", 34, 110}, ++ #endif ++ #ifdef X509V3_R_INVALID_OPTION ++ {"INVALID_OPTION", ERR_LIB_X509V3, X509V3_R_INVALID_OPTION}, ++ #else ++ {"INVALID_OPTION", 34, 138}, ++ #endif ++ #ifdef X509V3_R_INVALID_POLICY_IDENTIFIER ++ {"INVALID_POLICY_IDENTIFIER", ERR_LIB_X509V3, X509V3_R_INVALID_POLICY_IDENTIFIER}, ++ #else ++ {"INVALID_POLICY_IDENTIFIER", 34, 134}, ++ #endif ++ #ifdef X509V3_R_INVALID_PROXY_POLICY_SETTING ++ {"INVALID_PROXY_POLICY_SETTING", ERR_LIB_X509V3, X509V3_R_INVALID_PROXY_POLICY_SETTING}, ++ #else ++ {"INVALID_PROXY_POLICY_SETTING", 34, 153}, ++ #endif ++ #ifdef X509V3_R_INVALID_PURPOSE ++ {"INVALID_PURPOSE", ERR_LIB_X509V3, X509V3_R_INVALID_PURPOSE}, ++ #else ++ {"INVALID_PURPOSE", 34, 146}, ++ #endif ++ #ifdef X509V3_R_INVALID_SAFI ++ {"INVALID_SAFI", ERR_LIB_X509V3, X509V3_R_INVALID_SAFI}, ++ #else ++ {"INVALID_SAFI", 34, 164}, ++ #endif ++ #ifdef X509V3_R_INVALID_SECTION ++ {"INVALID_SECTION", ERR_LIB_X509V3, X509V3_R_INVALID_SECTION}, ++ #else ++ {"INVALID_SECTION", 34, 135}, ++ #endif ++ #ifdef X509V3_R_INVALID_SYNTAX ++ {"INVALID_SYNTAX", ERR_LIB_X509V3, X509V3_R_INVALID_SYNTAX}, ++ #else ++ {"INVALID_SYNTAX", 34, 143}, ++ #endif ++ #ifdef X509V3_R_ISSUER_DECODE_ERROR ++ {"ISSUER_DECODE_ERROR", ERR_LIB_X509V3, X509V3_R_ISSUER_DECODE_ERROR}, ++ #else ++ {"ISSUER_DECODE_ERROR", 34, 126}, ++ #endif ++ #ifdef X509V3_R_MISSING_VALUE ++ {"MISSING_VALUE", ERR_LIB_X509V3, X509V3_R_MISSING_VALUE}, ++ #else ++ {"MISSING_VALUE", 34, 124}, ++ #endif ++ #ifdef X509V3_R_NEED_ORGANIZATION_AND_NUMBERS ++ {"NEED_ORGANIZATION_AND_NUMBERS", ERR_LIB_X509V3, X509V3_R_NEED_ORGANIZATION_AND_NUMBERS}, ++ #else ++ {"NEED_ORGANIZATION_AND_NUMBERS", 34, 142}, ++ #endif ++ #ifdef X509V3_R_NO_CONFIG_DATABASE ++ {"NO_CONFIG_DATABASE", ERR_LIB_X509V3, X509V3_R_NO_CONFIG_DATABASE}, ++ #else ++ {"NO_CONFIG_DATABASE", 34, 136}, ++ #endif ++ #ifdef X509V3_R_NO_ISSUER_CERTIFICATE ++ {"NO_ISSUER_CERTIFICATE", ERR_LIB_X509V3, X509V3_R_NO_ISSUER_CERTIFICATE}, ++ #else ++ {"NO_ISSUER_CERTIFICATE", 34, 121}, ++ #endif ++ #ifdef X509V3_R_NO_ISSUER_DETAILS ++ {"NO_ISSUER_DETAILS", ERR_LIB_X509V3, X509V3_R_NO_ISSUER_DETAILS}, ++ #else ++ {"NO_ISSUER_DETAILS", 34, 127}, ++ #endif ++ #ifdef X509V3_R_NO_POLICY_IDENTIFIER ++ {"NO_POLICY_IDENTIFIER", ERR_LIB_X509V3, X509V3_R_NO_POLICY_IDENTIFIER}, ++ #else ++ {"NO_POLICY_IDENTIFIER", 34, 139}, ++ #endif ++ #ifdef X509V3_R_NO_PROXY_CERT_POLICY_LANGUAGE_DEFINED ++ {"NO_PROXY_CERT_POLICY_LANGUAGE_DEFINED", ERR_LIB_X509V3, X509V3_R_NO_PROXY_CERT_POLICY_LANGUAGE_DEFINED}, ++ #else ++ {"NO_PROXY_CERT_POLICY_LANGUAGE_DEFINED", 34, 154}, ++ #endif ++ #ifdef X509V3_R_NO_PUBLIC_KEY ++ {"NO_PUBLIC_KEY", ERR_LIB_X509V3, X509V3_R_NO_PUBLIC_KEY}, ++ #else ++ {"NO_PUBLIC_KEY", 34, 114}, ++ #endif ++ #ifdef X509V3_R_NO_SUBJECT_DETAILS ++ {"NO_SUBJECT_DETAILS", ERR_LIB_X509V3, X509V3_R_NO_SUBJECT_DETAILS}, ++ #else ++ {"NO_SUBJECT_DETAILS", 34, 125}, ++ #endif ++ #ifdef X509V3_R_OPERATION_NOT_DEFINED ++ {"OPERATION_NOT_DEFINED", ERR_LIB_X509V3, X509V3_R_OPERATION_NOT_DEFINED}, ++ #else ++ {"OPERATION_NOT_DEFINED", 34, 148}, ++ #endif ++ #ifdef X509V3_R_OTHERNAME_ERROR ++ {"OTHERNAME_ERROR", ERR_LIB_X509V3, X509V3_R_OTHERNAME_ERROR}, ++ #else ++ {"OTHERNAME_ERROR", 34, 147}, ++ #endif ++ #ifdef X509V3_R_POLICY_LANGUAGE_ALREADY_DEFINED ++ {"POLICY_LANGUAGE_ALREADY_DEFINED", ERR_LIB_X509V3, X509V3_R_POLICY_LANGUAGE_ALREADY_DEFINED}, ++ #else ++ {"POLICY_LANGUAGE_ALREADY_DEFINED", 34, 155}, ++ #endif ++ #ifdef X509V3_R_POLICY_PATH_LENGTH ++ {"POLICY_PATH_LENGTH", ERR_LIB_X509V3, X509V3_R_POLICY_PATH_LENGTH}, ++ #else ++ {"POLICY_PATH_LENGTH", 34, 156}, ++ #endif ++ #ifdef X509V3_R_POLICY_PATH_LENGTH_ALREADY_DEFINED ++ {"POLICY_PATH_LENGTH_ALREADY_DEFINED", ERR_LIB_X509V3, X509V3_R_POLICY_PATH_LENGTH_ALREADY_DEFINED}, ++ #else ++ {"POLICY_PATH_LENGTH_ALREADY_DEFINED", 34, 157}, ++ #endif ++ #ifdef X509V3_R_POLICY_WHEN_PROXY_LANGUAGE_REQUIRES_NO_POLICY ++ {"POLICY_WHEN_PROXY_LANGUAGE_REQUIRES_NO_POLICY", ERR_LIB_X509V3, X509V3_R_POLICY_WHEN_PROXY_LANGUAGE_REQUIRES_NO_POLICY}, ++ #else ++ {"POLICY_WHEN_PROXY_LANGUAGE_REQUIRES_NO_POLICY", 34, 159}, ++ #endif ++ #ifdef X509V3_R_SECTION_NOT_FOUND ++ {"SECTION_NOT_FOUND", ERR_LIB_X509V3, X509V3_R_SECTION_NOT_FOUND}, ++ #else ++ {"SECTION_NOT_FOUND", 34, 150}, ++ #endif ++ #ifdef X509V3_R_UNABLE_TO_GET_ISSUER_DETAILS ++ {"UNABLE_TO_GET_ISSUER_DETAILS", ERR_LIB_X509V3, X509V3_R_UNABLE_TO_GET_ISSUER_DETAILS}, ++ #else ++ {"UNABLE_TO_GET_ISSUER_DETAILS", 34, 122}, ++ #endif ++ #ifdef X509V3_R_UNABLE_TO_GET_ISSUER_KEYID ++ {"UNABLE_TO_GET_ISSUER_KEYID", ERR_LIB_X509V3, X509V3_R_UNABLE_TO_GET_ISSUER_KEYID}, ++ #else ++ {"UNABLE_TO_GET_ISSUER_KEYID", 34, 123}, ++ #endif ++ #ifdef X509V3_R_UNKNOWN_BIT_STRING_ARGUMENT ++ {"UNKNOWN_BIT_STRING_ARGUMENT", ERR_LIB_X509V3, X509V3_R_UNKNOWN_BIT_STRING_ARGUMENT}, ++ #else ++ {"UNKNOWN_BIT_STRING_ARGUMENT", 34, 111}, ++ #endif ++ #ifdef X509V3_R_UNKNOWN_EXTENSION ++ {"UNKNOWN_EXTENSION", ERR_LIB_X509V3, X509V3_R_UNKNOWN_EXTENSION}, ++ #else ++ {"UNKNOWN_EXTENSION", 34, 129}, ++ #endif ++ #ifdef X509V3_R_UNKNOWN_EXTENSION_NAME ++ {"UNKNOWN_EXTENSION_NAME", ERR_LIB_X509V3, X509V3_R_UNKNOWN_EXTENSION_NAME}, ++ #else ++ {"UNKNOWN_EXTENSION_NAME", 34, 130}, ++ #endif ++ #ifdef X509V3_R_UNKNOWN_OPTION ++ {"UNKNOWN_OPTION", ERR_LIB_X509V3, X509V3_R_UNKNOWN_OPTION}, ++ #else ++ {"UNKNOWN_OPTION", 34, 120}, ++ #endif ++ #ifdef X509V3_R_UNSUPPORTED_OPTION ++ {"UNSUPPORTED_OPTION", ERR_LIB_X509V3, X509V3_R_UNSUPPORTED_OPTION}, ++ #else ++ {"UNSUPPORTED_OPTION", 34, 117}, ++ #endif ++ #ifdef X509V3_R_UNSUPPORTED_TYPE ++ {"UNSUPPORTED_TYPE", ERR_LIB_X509V3, X509V3_R_UNSUPPORTED_TYPE}, ++ #else ++ {"UNSUPPORTED_TYPE", 34, 167}, ++ #endif ++ #ifdef X509V3_R_USER_TOO_LONG ++ {"USER_TOO_LONG", ERR_LIB_X509V3, X509V3_R_USER_TOO_LONG}, ++ #else ++ {"USER_TOO_LONG", 34, 132}, ++ #endif ++ #ifdef X509_R_AKID_MISMATCH ++ {"AKID_MISMATCH", ERR_LIB_X509, X509_R_AKID_MISMATCH}, ++ #else ++ {"AKID_MISMATCH", 11, 110}, ++ #endif ++ #ifdef X509_R_BAD_SELECTOR ++ {"BAD_SELECTOR", ERR_LIB_X509, X509_R_BAD_SELECTOR}, ++ #else ++ {"BAD_SELECTOR", 11, 133}, ++ #endif ++ #ifdef X509_R_BAD_X509_FILETYPE ++ {"BAD_X509_FILETYPE", ERR_LIB_X509, X509_R_BAD_X509_FILETYPE}, ++ #else ++ {"BAD_X509_FILETYPE", 11, 100}, ++ #endif ++ #ifdef X509_R_BASE64_DECODE_ERROR ++ {"BASE64_DECODE_ERROR", ERR_LIB_X509, X509_R_BASE64_DECODE_ERROR}, ++ #else ++ {"BASE64_DECODE_ERROR", 11, 118}, ++ #endif ++ #ifdef X509_R_CANT_CHECK_DH_KEY ++ {"CANT_CHECK_DH_KEY", ERR_LIB_X509, X509_R_CANT_CHECK_DH_KEY}, ++ #else ++ {"CANT_CHECK_DH_KEY", 11, 114}, ++ #endif ++ #ifdef X509_R_CERT_ALREADY_IN_HASH_TABLE ++ {"CERT_ALREADY_IN_HASH_TABLE", ERR_LIB_X509, X509_R_CERT_ALREADY_IN_HASH_TABLE}, ++ #else ++ {"CERT_ALREADY_IN_HASH_TABLE", 11, 101}, ++ #endif ++ #ifdef X509_R_CRL_ALREADY_DELTA ++ {"CRL_ALREADY_DELTA", ERR_LIB_X509, X509_R_CRL_ALREADY_DELTA}, ++ #else ++ {"CRL_ALREADY_DELTA", 11, 127}, ++ #endif ++ #ifdef X509_R_CRL_VERIFY_FAILURE ++ {"CRL_VERIFY_FAILURE", ERR_LIB_X509, X509_R_CRL_VERIFY_FAILURE}, ++ #else ++ {"CRL_VERIFY_FAILURE", 11, 131}, ++ #endif ++ #ifdef X509_R_ERR_ASN1_LIB ++ {"ERR_ASN1_LIB", ERR_LIB_X509, X509_R_ERR_ASN1_LIB}, ++ #else ++ {"ERR_ASN1_LIB", 11, 102}, ++ #endif ++ #ifdef X509_R_IDP_MISMATCH ++ {"IDP_MISMATCH", ERR_LIB_X509, X509_R_IDP_MISMATCH}, ++ #else ++ {"IDP_MISMATCH", 11, 128}, ++ #endif ++ #ifdef X509_R_INVALID_ATTRIBUTES ++ {"INVALID_ATTRIBUTES", ERR_LIB_X509, X509_R_INVALID_ATTRIBUTES}, ++ #else ++ {"INVALID_ATTRIBUTES", 11, 138}, ++ #endif ++ #ifdef X509_R_INVALID_DIRECTORY ++ {"INVALID_DIRECTORY", ERR_LIB_X509, X509_R_INVALID_DIRECTORY}, ++ #else ++ {"INVALID_DIRECTORY", 11, 113}, ++ #endif ++ #ifdef X509_R_INVALID_FIELD_NAME ++ {"INVALID_FIELD_NAME", ERR_LIB_X509, X509_R_INVALID_FIELD_NAME}, ++ #else ++ {"INVALID_FIELD_NAME", 11, 119}, ++ #endif ++ #ifdef X509_R_INVALID_TRUST ++ {"INVALID_TRUST", ERR_LIB_X509, X509_R_INVALID_TRUST}, ++ #else ++ {"INVALID_TRUST", 11, 123}, ++ #endif ++ #ifdef X509_R_ISSUER_MISMATCH ++ {"ISSUER_MISMATCH", ERR_LIB_X509, X509_R_ISSUER_MISMATCH}, ++ #else ++ {"ISSUER_MISMATCH", 11, 129}, ++ #endif ++ #ifdef X509_R_KEY_TYPE_MISMATCH ++ {"KEY_TYPE_MISMATCH", ERR_LIB_X509, X509_R_KEY_TYPE_MISMATCH}, ++ #else ++ {"KEY_TYPE_MISMATCH", 11, 115}, ++ #endif ++ #ifdef X509_R_KEY_VALUES_MISMATCH ++ {"KEY_VALUES_MISMATCH", ERR_LIB_X509, X509_R_KEY_VALUES_MISMATCH}, ++ #else ++ {"KEY_VALUES_MISMATCH", 11, 116}, ++ #endif ++ #ifdef X509_R_LOADING_CERT_DIR ++ {"LOADING_CERT_DIR", ERR_LIB_X509, X509_R_LOADING_CERT_DIR}, ++ #else ++ {"LOADING_CERT_DIR", 11, 103}, ++ #endif ++ #ifdef X509_R_LOADING_DEFAULTS ++ {"LOADING_DEFAULTS", ERR_LIB_X509, X509_R_LOADING_DEFAULTS}, ++ #else ++ {"LOADING_DEFAULTS", 11, 104}, ++ #endif ++ #ifdef X509_R_METHOD_NOT_SUPPORTED ++ {"METHOD_NOT_SUPPORTED", ERR_LIB_X509, X509_R_METHOD_NOT_SUPPORTED}, ++ #else ++ {"METHOD_NOT_SUPPORTED", 11, 124}, ++ #endif ++ #ifdef X509_R_NAME_TOO_LONG ++ {"NAME_TOO_LONG", ERR_LIB_X509, X509_R_NAME_TOO_LONG}, ++ #else ++ {"NAME_TOO_LONG", 11, 134}, ++ #endif ++ #ifdef X509_R_NEWER_CRL_NOT_NEWER ++ {"NEWER_CRL_NOT_NEWER", ERR_LIB_X509, X509_R_NEWER_CRL_NOT_NEWER}, ++ #else ++ {"NEWER_CRL_NOT_NEWER", 11, 132}, ++ #endif ++ #ifdef X509_R_NO_CERTIFICATE_FOUND ++ {"NO_CERTIFICATE_FOUND", ERR_LIB_X509, X509_R_NO_CERTIFICATE_FOUND}, ++ #else ++ {"NO_CERTIFICATE_FOUND", 11, 135}, ++ #endif ++ #ifdef X509_R_NO_CERTIFICATE_OR_CRL_FOUND ++ {"NO_CERTIFICATE_OR_CRL_FOUND", ERR_LIB_X509, X509_R_NO_CERTIFICATE_OR_CRL_FOUND}, ++ #else ++ {"NO_CERTIFICATE_OR_CRL_FOUND", 11, 136}, ++ #endif ++ #ifdef X509_R_NO_CERT_SET_FOR_US_TO_VERIFY ++ {"NO_CERT_SET_FOR_US_TO_VERIFY", ERR_LIB_X509, X509_R_NO_CERT_SET_FOR_US_TO_VERIFY}, ++ #else ++ {"NO_CERT_SET_FOR_US_TO_VERIFY", 11, 105}, ++ #endif ++ #ifdef X509_R_NO_CRL_FOUND ++ {"NO_CRL_FOUND", ERR_LIB_X509, X509_R_NO_CRL_FOUND}, ++ #else ++ {"NO_CRL_FOUND", 11, 137}, ++ #endif ++ #ifdef X509_R_NO_CRL_NUMBER ++ {"NO_CRL_NUMBER", ERR_LIB_X509, X509_R_NO_CRL_NUMBER}, ++ #else ++ {"NO_CRL_NUMBER", 11, 130}, ++ #endif ++ #ifdef X509_R_PUBLIC_KEY_DECODE_ERROR ++ {"PUBLIC_KEY_DECODE_ERROR", ERR_LIB_X509, X509_R_PUBLIC_KEY_DECODE_ERROR}, ++ #else ++ {"PUBLIC_KEY_DECODE_ERROR", 11, 125}, ++ #endif ++ #ifdef X509_R_PUBLIC_KEY_ENCODE_ERROR ++ {"PUBLIC_KEY_ENCODE_ERROR", ERR_LIB_X509, X509_R_PUBLIC_KEY_ENCODE_ERROR}, ++ #else ++ {"PUBLIC_KEY_ENCODE_ERROR", 11, 126}, ++ #endif ++ #ifdef X509_R_SHOULD_RETRY ++ {"SHOULD_RETRY", ERR_LIB_X509, X509_R_SHOULD_RETRY}, ++ #else ++ {"SHOULD_RETRY", 11, 106}, ++ #endif ++ #ifdef X509_R_UNABLE_TO_FIND_PARAMETERS_IN_CHAIN ++ {"UNABLE_TO_FIND_PARAMETERS_IN_CHAIN", ERR_LIB_X509, X509_R_UNABLE_TO_FIND_PARAMETERS_IN_CHAIN}, ++ #else ++ {"UNABLE_TO_FIND_PARAMETERS_IN_CHAIN", 11, 107}, ++ #endif ++ #ifdef X509_R_UNABLE_TO_GET_CERTS_PUBLIC_KEY ++ {"UNABLE_TO_GET_CERTS_PUBLIC_KEY", ERR_LIB_X509, X509_R_UNABLE_TO_GET_CERTS_PUBLIC_KEY}, ++ #else ++ {"UNABLE_TO_GET_CERTS_PUBLIC_KEY", 11, 108}, ++ #endif ++ #ifdef X509_R_UNKNOWN_KEY_TYPE ++ {"UNKNOWN_KEY_TYPE", ERR_LIB_X509, X509_R_UNKNOWN_KEY_TYPE}, ++ #else ++ {"UNKNOWN_KEY_TYPE", 11, 117}, ++ #endif ++ #ifdef X509_R_UNKNOWN_NID ++ {"UNKNOWN_NID", ERR_LIB_X509, X509_R_UNKNOWN_NID}, ++ #else ++ {"UNKNOWN_NID", 11, 109}, ++ #endif ++ #ifdef X509_R_UNKNOWN_PURPOSE_ID ++ {"UNKNOWN_PURPOSE_ID", ERR_LIB_X509, X509_R_UNKNOWN_PURPOSE_ID}, ++ #else ++ {"UNKNOWN_PURPOSE_ID", 11, 121}, ++ #endif ++ #ifdef X509_R_UNKNOWN_TRUST_ID ++ {"UNKNOWN_TRUST_ID", ERR_LIB_X509, X509_R_UNKNOWN_TRUST_ID}, ++ #else ++ {"UNKNOWN_TRUST_ID", 11, 120}, ++ #endif ++ #ifdef X509_R_UNSUPPORTED_ALGORITHM ++ {"UNSUPPORTED_ALGORITHM", ERR_LIB_X509, X509_R_UNSUPPORTED_ALGORITHM}, ++ #else ++ {"UNSUPPORTED_ALGORITHM", 11, 111}, ++ #endif ++ #ifdef X509_R_WRONG_LOOKUP_TYPE ++ {"WRONG_LOOKUP_TYPE", ERR_LIB_X509, X509_R_WRONG_LOOKUP_TYPE}, ++ #else ++ {"WRONG_LOOKUP_TYPE", 11, 112}, ++ #endif ++ #ifdef X509_R_WRONG_TYPE ++ {"WRONG_TYPE", ERR_LIB_X509, X509_R_WRONG_TYPE}, ++ #else ++ {"WRONG_TYPE", 11, 122}, ++ #endif ++ #ifdef HAVE_WOLFSSL ++ #if LIBWOLFSSL_VERSION_HEX > 0x05007002 ++ #define WOLFSSL_ERRORCODE(x) x ++ #else ++ #define WOLFSSL_ERRORCODE(x) x<0?(-1*x):x ++ #endif ++ /* wolfCrypt-level error codes. Reason should be negative for ++ * wolfCrypt codes, as wolfSSL_ERR_GET_REASON() returns them as ++ * negative when in wolfCrypt range. */ ++ {"BUFFER_E", 0, BUFFER_E}, ++ {"ASN_NO_SIGNER_E", 0, ASN_NO_SIGNER_E}, ++ {"ASN_SELF_SIGNED_E", 0, ASN_SELF_SIGNED_E}, ++ {"ALERT_FATAL_ERROR", 0, FATAL_ERROR}, ++ {"WC_KEY_MISMATCH_E", 0, WC_KEY_MISMATCH_E}, ++ ++ /* wolfSSL-level error codes */ ++ {"INPUT_CASE_ERROR", 0, WOLFSSL_ERRORCODE(INPUT_CASE_ERROR)}, ++ {"CRL_MISSING", 0, WOLFSSL_ERRORCODE(CRL_MISSING)}, ++ {"VERIFY_FINISHED_ERROR", 0, WOLFSSL_ERRORCODE(VERIFY_FINISHED_ERROR)}, ++ {"error state on socket", 0, WOLFSSL_ERRORCODE(SOCKET_ERROR_E)}, ++ {"ALERT_FATAL_ERROR", 0, WOLFSSL_ERRORCODE(FATAL_ERROR)}, ++ {"NO_PRIVATE_KEY", 0, WOLFSSL_ERRORCODE(NO_PRIVATE_KEY)}, ++ {"DOMAIN_NAME_MISMATCH", 0, WOLFSSL_ERRORCODE(DOMAIN_NAME_MISMATCH)}, ++ {"IPADDR_MISMATCH", 0, WOLFSSL_ERRORCODE(IPADDR_MISMATCH)}, ++ {"VERSION_ERROR", 0, WOLFSSL_ERRORCODE(VERSION_ERROR)}, ++ {"SIDE_ERROR", 0, WOLFSSL_ERRORCODE(SIDE_ERROR)}, ++ {"NO_PEER_CERT", 0, WOLFSSL_ERRORCODE(NO_PEER_CERT)}, ++ {"SOCKET_PEER_CLOSED_E", 0, WOLFSSL_ERRORCODE(SOCKET_PEER_CLOSED_E)}, ++ {"UNSUPPORTED_PROTO_VERSION", 0, WOLFSSL_ERRORCODE(UNSUPPORTED_PROTO_VERSION)}, ++ {"NO_SHARED_CIPHER", 0, WOLFSSL_ERRORCODE(MATCH_SUITE_ERROR)}, ++ {"POST_HAND_AUTH_ERROR", 0, WOLFSSL_ERRORCODE(POST_HAND_AUTH_ERROR)}, ++ #endif ++ { NULL } ++}; +diff --git a/configure.ac b/configure.ac +index 87c0ead..f006fb3 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -12,7 +12,7 @@ dnl + # Set VERSION so we only need to edit in one place (i.e., here) + m4_define([PYTHON_VERSION], [3.14]) + +-AC_PREREQ([2.72]) ++AC_PREREQ([2.71]) + + AC_INIT([python],[PYTHON_VERSION],[https://github.com/python/cpython/issues/]) + +@@ -7449,8 +7449,47 @@ WITH_SAVE_ENV([ + _RESTORE_VAR([ac_includes_default]) + ]) + +-# Check for usable OpenSSL +-AX_CHECK_OPENSSL([have_openssl=yes],[have_openssl=no]) ++AC_ARG_WITH(wolfssl, ++ AS_HELP_STRING([--with-wolfssl=DIR], ++ [build with wolfSSL at DIR instead of OpenSSL]), ++[ ++ OPENSSL_INCLUDES="-I${withval}/include/wolfssl -I${withval}/include/" ++ OPENSSL_LDFLAGS="-L${withval}/lib" ++ OPENSSL_LIBS="-lwolfssl" ++ # AC_SUBST calls required to substitute other uses of OPENSSL_* vars ++ AC_SUBST([OPENSSL_INCLUDES]) ++ AC_SUBST([OPENSSL_LIBS]) ++ AC_SUBST([OPENSSL_LDFLAGS]) ++ ++ CPPFLAGS="$CPPFLAGS $OPENSSL_INCLUDES" ++ LDFLAGS="$LDFLAGS $OPENSSL_LDFLAGS" ++ LIBS="$LIBS $OPENSSL_LIBS" ++ ++ USE_WOLFSSL=yes], ++[ ++ USE_WOLFSSL=no ++]) ++ ++if test $USE_WOLFSSL = yes ++then ++ AC_CHECK_HEADER([wolfssl/options.h]) ++ if test $ac_cv_header_wolfssl_options_h = yes ++ then ++ AC_DEFINE(HAVE_WOLFSSL, 1, [define if you are using wolfSSL]) ++ AC_DEFINE(HAVE_X509_VERIFY_PARAM_SET1_HOST, 1, [define or verify param set]) ++ ++ # Note we are disabling compression when using wolfSSL ++ AC_DEFINE([OPENSSL_NO_COMP], 1, [define to disable compression]) ++ else ++ AC_MSG_ERROR([Unable to find wolfSSL]) ++ fi ++ ac_cv_working_openssl_ssl=yes ++ ac_cv_working_openssl_hashlib=yes ++ LIBCRYPTO_LIBS="-lwolfssl" ++else ++ # Check for usable OpenSSL ++ AX_CHECK_OPENSSL([have_openssl=yes],[have_openssl=no]) ++fi + + # rpath to libssl and libcrypto + AS_VAR_IF([GNULD], [yes], [ +@@ -7518,6 +7557,8 @@ AS_VAR_IF([PY_UNSUPPORTED_OPENSSL_BUILD], [static], [ + AC_MSG_RESULT([$OPENSSL_LIBS]) + ]) + ++if test $USE_WOLFSSL = no ++then + dnl AX_CHECK_OPENSSL does not export libcrypto-only libs + LIBCRYPTO_LIBS= + for arg in $OPENSSL_LIBS; do +@@ -7574,6 +7615,7 @@ WITH_SAVE_ENV([ + ])], [ac_cv_working_openssl_hashlib=yes], [ac_cv_working_openssl_hashlib=no]) + ]) + ]) ++fi # !HAVE_WOLFSSL + + # ssl module default cipher suite string + AH_TEMPLATE([PY_SSL_DEFAULT_CIPHERS], +-- +2.43.0 + diff --git a/README.md b/README.md index cd6bde3e9..127146a01 100644 --- a/README.md +++ b/README.md @@ -32,7 +32,7 @@ Each project port included in this repository is contained in its own subdirecto | libest | Cisco EST stack written in C | [Link](https://github.com/cisco/libest) | [Link](https://www.wolfssl.com/wolfssl-cisco-libest-port/) | [README](./libest/README) | | libimobiledevice | Library to communicate with services on iOS devices | [Link](https://libimobiledevice.org/) | | [README](./libimobiledevice/README) | | libsignal-protocol-c | Signal Protocol C Library | [Link](https://github.com/signalapp/libsignal-protocol-c) | [Link](https://www.wolfssl.com/wolfssl-use-with-signal/) | [README](./libsignal-protocol-c/README.md) | -| libspdm | Security Protocol and Data Model implementation | [Link](https://github.com/DMTF/libspdm) | | [README](./libspdm/1.0.0/README.md) | +| libspdm | Security Protocol and Data Model implementation | [Link](https://github.com/DMTF/libspdm) | | [README](./libspdm/3.8.2/README.md) | | libssh2 | client-side C library for SSH2 | [Link](https://www.libssh2.org/) | [Link](https://www.wolfssl.com/open-source-project-ports-libssh2/) | [README](./libssh2/1.9.0/README.md) | | lighttpd | lighttpd web server | [Link](https://www.lighttpd.net/) | [Link](https://www.wolfssl.com/lighttpd-support-wolfssl/) | [README](./lighttpd/README) | | mariadb | MariaDB relational database | [Link](https://mariadb.org/) | | [README](./mariadb/10.5.11/README.md) | @@ -40,7 +40,7 @@ Each project port included in this repository is contained in its own subdirecto | net-snmp | Simple Network Management Protocol | [Link](http://www.net-snmp.org/) | | [README](./net-snmp/README.md) | | ntp | Network Time Protocol | [Link](http://www.ntp.org/) | [Link](https://www.wolfssl.com/open-source-project-ports-ntp/) | [README](./ntp/4.2.8p15/README.md) | | NXP SE05X Middleware | wolfSSL HostCrypto support patch | [Link](https://www.nxp.com/products/security-and-authentication/authentication/edgelock-se050-plug-trust-secure-element-family-enhanced-iot-security-with-high-flexibility:SE050) | | [README](./nxp-se05x-middleware/README.md) | -| openldap | Open source lightweight directory access protocol | [Link](https://www.openldap.org/) | [Link](https://www.wolfssl.com/open-source-project-ports-openldap/) | [README](./openldap/2.4.47/README.md) | +| openldap | Open source lightweight directory access protocol | [Link](https://www.openldap.org/) | [Link](https://www.wolfssl.com/open-source-project-ports-openldap/) | [README](./openldap/2.6.13/README.md) | | openpegasus | Open source DMTF CIM and WBEM | [Link](https://collaboration.opengroup.org/pegasus/) | [Link](https://www.wolfssl.com/openpegasus-port-support-added-wolfssl/) | [README](./openpegasus/2.14.1/README.md) | | openresty | Nginx and LuaJIT-based web platform | [Link](https://openresty.org/en/) | | [README](./openresty/INSTRUCTIONS.md) | | openssh-patches | OpenSSH | [Link](https://www.openssh.com/) | [Link](https://www.wolfssl.com/wolfssl-openssh-expanded-openssl-compatibility/) | [README](./openssh-patches/README) | @@ -50,9 +50,9 @@ Each project port included in this repository is contained in its own subdirecto | rsyslog | rocket-fast Syslog Server | [Link](https://www.rsyslog.com/) | [Link](https://www.wolfssl.com/wolfssl-ported-rsyslog-8-2106-0/) | [README](./rsyslog/8.2106.0/README.md) | | realm-core | Database that runs on phones, tablets or wearables | [Link](https://github.com/realm/realm-core/) | | [README](./realm/README.md) | | sblim-sfcb | SBLIM Small-footprint CIM Broker | [Link](http://sblim.sourceforge.net/wiki/index.php/Sfcb) | | [README](./sblim-sfcb/1.4.9/README.md) | -| socat | socat Multipurpose relay | [Link](http://www.dest-unreach.org/socat/) | [Link](https://www.wolfssl.com/open-source-project-ports-socat/) | 1.7.3.4 [README](./socat/1.7.3.4/README.md)
1.7.4.1 [README](./socat/1.7.4.1/README.md) | +| socat | socat Multipurpose relay | [Link](http://www.dest-unreach.org/socat/) | [Link](https://www.wolfssl.com/open-source-project-ports-socat/) | 1.7.3.4 [README](./socat/1.7.3.4/README.md)
1.7.4.1 [README](./socat/1.7.4.1/README.md)
1.8.1.1 [README](./socat/1.8.1.1/README.md) | | stunnel | stunnel Proxy | [Link](https://www.stunnel.org/) | [Link](https://www.wolfssl.com/securing-stunnel-tls-1-3/) | 5.57 Unix [README](./stunnel/5.57/README_UNIX.md)
5.57 Windows [README](./stunnel/5.57/README_WIN.md) | -| tcpdump | command-line packet analyzer | [Link](https://www.tcpdump.org/) | [Link](https://www.wolfssl.com/open-source-project-ports-tcpdump/) | [README](./tcpdump/4.9.3/README.md) | +| tcpdump | command-line packet analyzer | [Link](https://www.tcpdump.org/) | [Link](https://www.wolfssl.com/open-source-project-ports-tcpdump/) | [README](./tcpdump/4.99.6/README.md) | | urllib3 | urllib3 HTTP client for Python | [Link](https://github.com/urllib3/urllib3) | | [README](./urllib3/README.rst) | | websocket-client | WebSocket client for python | [Link](https://github.com/websocket-client/websocket-client) | | [README](./websocket-client/README.rst) | | websocketpp | WebSocket++ | [Link](https://www.zaphoyd.com/projects/websocketpp/) | [Link](https://www.wolfssl.com/building-websocket-wolfssl-support/) | [README](websocketpp/readme.md) | diff --git a/bind9/9.20.23.patch b/bind9/9.20.23.patch new file mode 100644 index 000000000..0e91d3c2b --- /dev/null +++ b/bind9/9.20.23.patch @@ -0,0 +1,470 @@ +From d124c78ca2e91a0006fe7a6f3bfb61c4c5e63184 Mon Sep 17 00:00:00 2001 +From: Juliusz Sosinowicz +Date: Fri, 4 Sep 2026 12:19:49 +0000 +Subject: [PATCH] Patch for wolfSSL + +- `--with-wolfssl` configure option added. Uses `PKG_CHECK_MODULES` and `PKG_CHECK_VAR` to find the install location of the wolfSSL module. +- `FATAL_ERROR` changed to `BIND_FATAL_ERROR` to avoid collision with wolfSSL `FATAL_ERROR`. +- `BN_GENCB_*` not supported so uses are macro'd out. +- `ssl_ctx_st`, `ssl_st` and `x509_store_st` equivalents are `WOLFSSL_CTX`, `WOLFSSL` and `WOLFSSL_X509_STORE`. +- `` included where the wolfSSL compatibility headers need it. + +Tested with bind9 v9.20.23 and wolfSSL master. + +Build wolfSSL: + ./configure --enable-all --prefix= + make + make install + +Apply the patch and build bind9: + git clone --depth 1 --branch v9.20.23 https://github.com/isc-projects/bind9 + cd bind9 + patch -p1 < /bind9/9.20.23.patch + export PKG_CONFIG_PATH=/lib/pkgconfig + autoreconf -ivf + ./configure --with-wolfssl + sed -i 's/SUBDIRS = system//g' bin/tests/Makefile + make -j V=1 + +Run the tests: + make -j V=1 check + +The system tests (bin/tests/system) are removed from the check target by the +sed above because they need a full named/dig setup with reserved IP aliases +and are not part of the CI run. + +`make check` runs 100 unit tests: 46 in tests/isc, 36 in tests/dns, 11 in +fuzz, 4 in tests/ns and 3 in tests/isccfg. tests/libtest and tests/bench +define no tests. All 100 pass on a host with an IPv6 loopback, such as the +GitHub runner the wolfSSL bind9 workflow uses. + +Nine of them need ::1 and fail with "Address family not supported by +protocol" on a kernel without IPv6: tcp_test, tcpdns_test, tls_test, +tlsdns_test, doh_test, udp_test, proxystream_test and proxyudp_test in +tests/isc, and dispatch_test in tests/dns. That leaves 91 passing. The same +nine fail the same way when the same tree is built against the system +OpenSSL, so the failures are environmental and not related to wolfSSL. +--- + bin/tests/system/dyndb/driver/syncptr.c | 2 +- + configure.ac | 79 +++++++++++++++++++++++++ + fuzz/old.c | 2 +- + lib/dns/name.c | 6 +- + lib/dns/openssl_shim.h | 5 +- + lib/dns/opensslrsa_link.c | 11 ++++ + lib/dns/rpz.c | 2 +- + lib/isc/include/isc/tls.h | 8 ++- + lib/isc/include/isc/util.h | 4 +- + lib/isc/include/isc/uv.h | 2 +- + lib/isc/iterated_hash.c | 1 + + lib/isc/lex.c | 2 +- + lib/isc/netmgr/netmgr.c | 4 +- + lib/isc/sockaddr.c | 6 +- + lib/isc/tls.c | 2 +- + 15 files changed, 117 insertions(+), 19 deletions(-) + +diff --git a/bin/tests/system/dyndb/driver/syncptr.c b/bin/tests/system/dyndb/driver/syncptr.c +index 7703321..f227184 100644 +--- a/bin/tests/system/dyndb/driver/syncptr.c ++++ b/bin/tests/system/dyndb/driver/syncptr.c +@@ -147,7 +147,7 @@ syncptr_find_zone(sample_instance_t *inst, dns_rdata_t *rdata, dns_name_t *name, + break; + + default: +- FATAL_ERROR("unsupported address type 0x%x", rdata->type); ++ BIND_FATAL_ERROR("unsupported address type 0x%x", rdata->type); + break; + } + +diff --git a/configure.ac b/configure.ac +index b0a5372..1f452e3 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -657,6 +657,83 @@ AM_CONDITIONAL([USE_ISC_RWLOCK], [test "$enable_pthread_rwlock" != "yes"]) + + CRYPTO=OpenSSL + ++AC_ARG_WITH([wolfssl], ++ [AS_HELP_STRING([--with-wolfssl], ++ [Use wolfSSL TLS [default=no]])], ++ [], []) ++ ++AS_CASE([$with_wolfssl], ++ [yes|no|""], [], ++ [AC_MSG_ERROR([Specifying wolfSSL installation path is not supported, adjust PKG_CONFIG_PATH instead])]) ++ ++if test "$with_wolfssl" = "yes"; then ++ ++ # ++ # wolfSSL is mandatory ++ # ++ PKG_CHECK_MODULES( ++ [WOLFSSL], ++ [wolfssl], ++ [], ++ [AC_MSG_ERROR([Could not find wolfSSL.])] ++ ) ++ PKG_CHECK_VAR( ++ [WOLFSSL_INCLUDEDIR], ++ [wolfssl], ++ [includedir], ++ [], ++ [AC_MSG_ERROR([Could not find wolfSSL includedir variable.])] ++ ) ++ WOLFSSL_CFLAGS="${WOLFSSL_CFLAGS} -I${WOLFSSL_INCLUDEDIR} -I${WOLFSSL_INCLUDEDIR}/wolfssl" ++ ++ OPENSSL_CFLAGS="$WOLFSSL_CFLAGS" ++ OPENSSL_LIBS="$WOLFSSL_LIBS" ++ ++ AX_SAVE_FLAGS([openssl]) ++ ++ CFLAGS="$CFLAGS $WOLFSSL_CFLAGS" ++ LIBS="$LIBS $WOLFSSL_LIBS" ++ ++ AC_DEFINE([HAVE_WOLFSSL], [1], [Use the wolfSSL TLS library]) ++ AC_DEFINE([EXTERNAL_OPTS_OPENVPN], [1], [Instruct wolfSSL to self include the options header]) ++ ++ # ++ # Building wolfSSL with --enable-all takes care of making ++ # everything necessary available. ++ # ++ ++ AC_DEFINE([HAVE_ECDSA_SIGN], [1], [wolfSSL includes]) ++ AC_DEFINE([HAVE_ECDSA_VERIFY], [1], [wolfSSL includes]) ++ AC_DEFINE([HAVE_EVP_CIPHER_CTX_FREE], [1], [wolfSSL includes]) ++ AC_DEFINE([HAVE_EVP_CIPHER_CTX_NEW], [1], [wolfSSL includes]) ++ AC_DEFINE([HAVE_EVP_MD_CTX_RESET], [1], [wolfSSL includes]) ++ AC_DEFINE([HAVE_EVP_MD_CTX_FREE], [1], [wolfSSL includes]) ++ AC_DEFINE([HAVE_EVP_MD_CTX_NEW], [1], [wolfSSL includes]) ++ AC_DEFINE([HAVE_EVP_PKEY_NEW_RAW_PRIVATE_KEY], [1], [wolfSSL includes]) ++ AC_DEFINE([HAVE_EVP_SHA1], [1], [wolfSSL includes]) ++ AC_DEFINE([HAVE_EVP_SHA224], [1], [wolfSSL includes]) ++ AC_DEFINE([HAVE_EVP_SHA256], [1], [wolfSSL includes]) ++ AC_DEFINE([HAVE_EVP_SHA384], [1], [wolfSSL includes]) ++ AC_DEFINE([HAVE_EVP_SHA512], [1], [wolfSSL includes]) ++ AC_DEFINE([HAVE_RSA_SET0_KEY], [1], [wolfSSL includes]) ++ AC_DEFINE([HAVE_TLS_SERVER_METHOD], [1], [wolfSSL includes]) ++ AC_DEFINE([HAVE_TLS_CLIENT_METHOD], [1], [wolfSSL includes]) ++ AC_DEFINE([HAVE_HMAC_CTX_NEW], [1], [wolfSSL includes]) ++ AC_DEFINE([HAVE_HMAC_CTX_FREE], [1], [wolfSSL includes]) ++ AC_DEFINE([HAVE_HMAC_CTX_RESET], [1], [wolfSSL includes]) ++ AC_DEFINE([HAVE_HMAC_CTX_GET_MD], [1], [wolfSSL includes]) ++ AC_DEFINE([HAVE_DH_GET0_KEY], [1], [wolfSSL includes]) ++ AC_DEFINE([HAVE_ECDSA_SIG_GET0], [1], [wolfSSL includes]) ++ AC_DEFINE([HAVE_ECDSA_SIG_SET0], [1], [wolfSSL includes]) ++ AC_DEFINE([HAVE_OPENSSL_INIT_CRYPTO], [1], [wolfSSL includes]) ++ AC_DEFINE([HAVE_OPENSSL_INIT_SSL], [1], [wolfSSL includes]) ++ AC_DEFINE([HAVE_OPENSSL_CLEANUP], [1], [wolfSSL includes]) ++ AC_DEFINE([HAVE_EVP_PKEY_GET0_EC_KEY], [1], [wolfSSL includes]) ++ AC_DEFINE([HAVE_SSL_CTX_UP_REF], [1], [wolfSSL includes]) ++ AC_DEFINE([HAVE_X509_STORE_UP_REF], [1], [wolfSSL includes]) ++ ++else ++ + # + # OpenSSL/LibreSSL is mandatory + # +@@ -757,6 +834,8 @@ AC_CHECK_FUNCS([RSA_set0_key EVP_PKEY_get0_RSA]) + + AC_CHECK_FUNCS([TLS_server_method TLS_client_method]) + ++fi ++ + # + # Check whether FIPS mode is available and whether we should enable it + # +diff --git a/fuzz/old.c b/fuzz/old.c +index 9ee32a5..8c361f5 100644 +--- a/fuzz/old.c ++++ b/fuzz/old.c +@@ -187,7 +187,7 @@ old_name_fromwire(dns_name_t *name, isc_buffer_t *source, dns_decompress_t dctx, + state = fw_start; + break; + default: +- FATAL_ERROR("Unknown state %d", state); ++ BIND_FATAL_ERROR("Unknown state %d", state); + /* Does not return. */ + } + } +diff --git a/lib/dns/name.c b/lib/dns/name.c +index aede7da..e317f70 100644 +--- a/lib/dns/name.c ++++ b/lib/dns/name.c +@@ -954,7 +954,7 @@ dns_name_fromtext(dns_name_t *name, isc_buffer_t *source, + } + break; + default: +- FATAL_ERROR("Unexpected state %d", state); ++ BIND_FATAL_ERROR("Unexpected state %d", state); + /* Does not return. */ + } + } +@@ -1158,7 +1158,7 @@ dns_name_totext(const dns_name_t *name, unsigned int options, + count--; + } + } else { +- FATAL_ERROR("Unexpected label type %02x", count); ++ BIND_FATAL_ERROR("Unexpected label type %02x", count); + UNREACHABLE(); + } + +@@ -1280,7 +1280,7 @@ dns_name_tofilenametext(const dns_name_t *name, bool omit_final_dot, + count--; + } + } else { +- FATAL_ERROR("Unexpected label type %02x", count); ++ BIND_FATAL_ERROR("Unexpected label type %02x", count); + UNREACHABLE(); + } + +diff --git a/lib/dns/openssl_shim.h b/lib/dns/openssl_shim.h +index 39c8f6c..bcd5ab8 100644 +--- a/lib/dns/openssl_shim.h ++++ b/lib/dns/openssl_shim.h +@@ -13,6 +13,7 @@ + + #pragma once + ++#include + #include + #include + #include +@@ -28,7 +29,7 @@ + #define RSA_MAX_PUBEXP_BITS 35 + #endif /* ifndef RSA_MAX_PUBEXP_BITS */ + +-#if !HAVE_BN_GENCB_NEW ++#if !HAVE_BN_GENCB_NEW && !defined(HAVE_WOLFSSL) + /* These are new in OpenSSL 1.1.0. */ + static inline BN_GENCB * + BN_GENCB_new(void) { +@@ -47,7 +48,7 @@ static inline void * + BN_GENCB_get_arg(BN_GENCB *cb) { + return cb->arg; + } +-#endif /* !HAVE_BN_GENCB_NEW */ ++#endif /* !HAVE_BN_GENCB_NEW && !defined(HAVE_WOLFSSL) */ + + #if !HAVE_EVP_PKEY_GET0_RSA && OPENSSL_VERSION_NUMBER < 0x10100000L + static inline const RSA * +diff --git a/lib/dns/opensslrsa_link.c b/lib/dns/opensslrsa_link.c +index 9c6559d..7259c46 100644 +--- a/lib/dns/opensslrsa_link.c ++++ b/lib/dns/opensslrsa_link.c +@@ -351,6 +351,7 @@ opensslrsa_verify(dst_context_t *dctx, const isc_region_t *sig) { + } + + #if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 ++#ifndef HAVE_WOLFSSL + static int + progress_cb(int p, int n, BN_GENCB *cb) { + void (*fptr)(int); +@@ -363,13 +364,16 @@ progress_cb(int p, int n, BN_GENCB *cb) { + } + return 1; + } ++#endif /* !HAVE_WOLFSSL */ + + static isc_result_t + opensslrsa_generate_pkey(unsigned int key_size, const char *label, BIGNUM *e, + void (*callback)(int), EVP_PKEY **retkey) { + RSA *rsa = NULL; + EVP_PKEY *pkey = NULL; ++#ifndef HAVE_WOLFSSL + BN_GENCB *cb = NULL; ++#endif + isc_result_t result; + + UNUSED(label); +@@ -384,6 +388,7 @@ opensslrsa_generate_pkey(unsigned int key_size, const char *label, BIGNUM *e, + DST_RET(dst__openssl_toresult(DST_R_OPENSSLFAILURE)); + } + ++#ifndef HAVE_WOLFSSL + if (callback != NULL) { + cb = BN_GENCB_new(); + if (cb == NULL) { +@@ -393,6 +398,10 @@ opensslrsa_generate_pkey(unsigned int key_size, const char *label, BIGNUM *e, + } + + if (RSA_generate_key_ex(rsa, key_size, e, cb) != 1) { ++#else ++ UNUSED(callback); ++ if (RSA_generate_key_ex(rsa, key_size, e, NULL) != 1) { ++#endif + DST_RET(dst__openssl_toresult2("RSA_generate_key_ex", + DST_R_OPENSSLFAILURE)); + } +@@ -403,7 +412,9 @@ opensslrsa_generate_pkey(unsigned int key_size, const char *label, BIGNUM *e, + cleanup: + EVP_PKEY_free(pkey); + RSA_free(rsa); ++#ifndef HAVE_WOLFSSL + BN_GENCB_free(cb); ++#endif + return result; + } + +diff --git a/lib/dns/rpz.c b/lib/dns/rpz.c +index 5fea098..44d371b 100644 +--- a/lib/dns/rpz.c ++++ b/lib/dns/rpz.c +@@ -234,7 +234,7 @@ dns_rpz_type2str(dns_rpz_type_t type) { + case DNS_RPZ_TYPE_BAD: + break; + } +- FATAL_ERROR("impossible rpz type %d", type); ++ BIND_FATAL_ERROR("impossible rpz type %d", type); + return "impossible"; + } + +diff --git a/lib/isc/include/isc/tls.h b/lib/isc/include/isc/tls.h +index 23b92c7..4087910 100644 +--- a/lib/isc/include/isc/tls.h ++++ b/lib/isc/include/isc/tls.h +@@ -18,10 +18,16 @@ + #include + #include + ++#ifndef HAVE_WOLFSSL + typedef struct ssl_ctx_st isc_tlsctx_t; + typedef struct ssl_st isc_tls_t; +- + typedef struct x509_store_st isc_tls_cert_store_t; ++#else ++typedef struct WOLFSSL_CTX isc_tlsctx_t; ++typedef struct WOLFSSL isc_tls_t; ++typedef struct WOLFSSL_X509_STORE isc_tls_cert_store_t; ++#endif ++ + + void + isc_tlsctx_free(isc_tlsctx_t **ctpx); +diff --git a/lib/isc/include/isc/util.h b/lib/isc/include/isc/util.h +index 0a92afe..151e654 100644 +--- a/lib/isc/include/isc/util.h ++++ b/lib/isc/include/isc/util.h +@@ -361,7 +361,7 @@ mock_assert(const int result, const char *const expression, + #define UNEXPECTED_ERROR(...) \ + isc_error_unexpected(__FILE__, __LINE__, __func__, __VA_ARGS__) + +-#define FATAL_ERROR(...) \ ++#define BIND_FATAL_ERROR(...) \ + isc_error_fatal(__FILE__, __LINE__, __func__, __VA_ARGS__) + + #define REPORT_SYSERROR(report, err, fmt, ...) \ +@@ -387,7 +387,7 @@ mock_assert(const int result, const char *const expression, + #else /* UNIT_TESTING */ + + #define RUNTIME_CHECK(cond) \ +- ((cond) ? (void)0 : FATAL_ERROR("RUNTIME_CHECK(%s) failed", #cond)) ++ ((cond) ? (void)0 : BIND_FATAL_ERROR("RUNTIME_CHECK(%s) failed", #cond)) + + #endif /* UNIT_TESTING */ + +diff --git a/lib/isc/include/isc/uv.h b/lib/isc/include/isc/uv.h +index 541f697..2763447 100644 +--- a/lib/isc/include/isc/uv.h ++++ b/lib/isc/include/isc/uv.h +@@ -48,7 +48,7 @@ + + #define UV_RUNTIME_CHECK(func, ret) \ + if (ret != 0) { \ +- FATAL_ERROR("%s failed: %s\n", #func, uv_strerror(ret)); \ ++ BIND_FATAL_ERROR("%s failed: %s\n", #func, uv_strerror(ret)); \ + } + + #define isc_uverr2result(x) \ +diff --git a/lib/isc/iterated_hash.c b/lib/isc/iterated_hash.c +index 6ca86e5..1f23b57 100644 +--- a/lib/isc/iterated_hash.c ++++ b/lib/isc/iterated_hash.c +@@ -24,6 +24,7 @@ + #if OPENSSL_VERSION_NUMBER < 0x30000000L || OPENSSL_API_LEVEL < 30000 + + #include ++#include + + int + isc_iterated_hash(unsigned char *out, const unsigned int hashalg, +diff --git a/lib/isc/lex.c b/lib/isc/lex.c +index aa3beaa..98c64e5 100644 +--- a/lib/isc/lex.c ++++ b/lib/isc/lex.c +@@ -914,7 +914,7 @@ isc_lex_gettoken(isc_lex_t *lex, unsigned int options, isc_token_t *tokenp) { + remaining--; + break; + default: +- FATAL_ERROR("Unexpected state %d", state); ++ BIND_FATAL_ERROR("Unexpected state %d", state); + } + } while (!done); + +diff --git a/lib/isc/netmgr/netmgr.c b/lib/isc/netmgr/netmgr.c +index 3f3be46..afb8409 100644 +--- a/lib/isc/netmgr/netmgr.c ++++ b/lib/isc/netmgr/netmgr.c +@@ -159,7 +159,7 @@ isc_netmgr_create(isc_mem_t *mctx, isc_loopmgr_t *loopmgr, isc_nm_t **netmgrp) { + + #ifdef MAXIMAL_UV_VERSION + if (uv_version() > MAXIMAL_UV_VERSION) { +- FATAL_ERROR("libuv version too new: running with libuv %s " ++ BIND_FATAL_ERROR("libuv version too new: running with libuv %s " + "when compiled with libuv %s will lead to " + "libuv failures", + uv_version_string(), UV_VERSION_STRING); +@@ -167,7 +167,7 @@ isc_netmgr_create(isc_mem_t *mctx, isc_loopmgr_t *loopmgr, isc_nm_t **netmgrp) { + #endif /* MAXIMAL_UV_VERSION */ + + if (uv_version() < MINIMAL_UV_VERSION) { +- FATAL_ERROR("libuv version too old: running with libuv %s " ++ BIND_FATAL_ERROR("libuv version too old: running with libuv %s " + "when compiled with libuv %s will lead to " + "libuv failures", + uv_version_string(), UV_VERSION_STRING); +diff --git a/lib/isc/sockaddr.c b/lib/isc/sockaddr.c +index f09d8aa..1e23484 100644 +--- a/lib/isc/sockaddr.c ++++ b/lib/isc/sockaddr.c +@@ -326,7 +326,7 @@ isc_sockaddr_pf(const isc_sockaddr_t *sockaddr) { + case AF_INET6: + return PF_INET6; + default: +- FATAL_ERROR("unknown address family: %d", ++ BIND_FATAL_ERROR("unknown address family: %d", + (int)sockaddr->type.sa.sa_family); + } + #endif /* if (AF_INET == PF_INET && AF_INET6 == PF_INET6) */ +@@ -365,7 +365,7 @@ isc_sockaddr_setport(isc_sockaddr_t *sockaddr, in_port_t port) { + sockaddr->type.sin6.sin6_port = htons(port); + break; + default: +- FATAL_ERROR("unknown address family: %d", ++ BIND_FATAL_ERROR("unknown address family: %d", + (int)sockaddr->type.sa.sa_family); + } + } +@@ -382,7 +382,7 @@ isc_sockaddr_getport(const isc_sockaddr_t *sockaddr) { + port = ntohs(sockaddr->type.sin6.sin6_port); + break; + default: +- FATAL_ERROR("unknown address family: %d", ++ BIND_FATAL_ERROR("unknown address family: %d", + (int)sockaddr->type.sa.sa_family); + } + +diff --git a/lib/isc/tls.c b/lib/isc/tls.c +index d564998..d6d2e79 100644 +--- a/lib/isc/tls.c ++++ b/lib/isc/tls.c +@@ -119,7 +119,7 @@ isc__tls_initialize(void) { + + /* Protect ourselves against unseeded PRNG */ + if (RAND_status() != 1) { +- FATAL_ERROR("OpenSSL pseudorandom number generator " ++ BIND_FATAL_ERROR("OpenSSL pseudorandom number generator " + "cannot be initialized (see the `PRNG not " + "seeded' message in the OpenSSL FAQ)"); + } +-- +2.43.0 + diff --git a/jwt-cpp/0.7.2.patch b/jwt-cpp/0.7.2.patch new file mode 100644 index 000000000..5291c4e6d --- /dev/null +++ b/jwt-cpp/0.7.2.patch @@ -0,0 +1,61 @@ +From 0a9e068c8e31de9ec10aa0813bea200d3983ce87 Mon Sep 17 00:00:00 2001 +From: Juliusz Sosinowicz +Date: Fri, 4 Sep 2026 11:04:53 +0000 +Subject: [PATCH] wolfSSL Patch + +Adjust the Ed25519 certificate tests for wolfSSL 5.9.2 and newer. Since +5.9.2 wolfSSL decodes Ed25519 certificates in the OpenSSL compatibility +layer, so the tests now expect the same error codes as with OpenSSL and +the PEM reference test is enabled. wolfSSL does not use BIO_ctrl in +BIO_get_mem_data, so that entry is dropped like in the other tests. + +Compile wolfSSL with: + ./configure --enable-all + make + make install + +Compile jwt-cpp with: + patch -p1 < /jwt-cpp/0.7.2.patch + PKG_CONFIG_PATH=/lib/pkgconfig \ + cmake -DCMAKE_POLICY_VERSION_MINIMUM=3.5 -B build \ + -DJWT_SSL_LIBRARY:STRING=wolfSSL -DJWT_BUILD_TESTS=ON . + make -C build + +Run the tests with: + ./build/tests/jwt-cpp-test + +All 146 tests pass. The tests already disabled upstream for wolfSSL +(ed25519 traits, HMAC mock for wolfSSL <= 5.7.0) are unchanged. +--- + tests/OpenSSLErrorTest.cpp | 7 ++++++- + 1 file changed, 6 insertions(+), 1 deletion(-) + +diff --git a/tests/OpenSSLErrorTest.cpp b/tests/OpenSSLErrorTest.cpp +index 71440b3..74f0932 100644 +--- a/tests/OpenSSLErrorTest.cpp ++++ b/tests/OpenSSLErrorTest.cpp +@@ -692,7 +692,8 @@ TEST(OpenSSLErrorTest, ConvertCertBase64DerToPemReference) { + } + #endif + +-#ifndef LIBWOLFSSL_VERSION_HEX /* wolfSSL: limited ed support in compatibility layer */ ++/* wolfSSL: Ed25519 certificates are supported in the compatibility layer since 5.9.2 */ ++#if !defined(LIBWOLFSSL_VERSION_HEX) || LIBWOLFSSL_VERSION_HEX >= 0x05009002 + TEST(OpenSSLErrorTest, ConvertEcdsaCertBase64DerToPemReference) { + std::error_code ec; + auto res = jwt::helper::convert_base64_der_to_pem(ed25519_certificate_base64_der, ec); +@@ -918,7 +919,11 @@ TEST(OpenSSLErrorTest, ConvertEcdsaCertBase64DerToPem) { + #ifndef LIBWOLFSSL_VERSION_HEX + {&fail_PEM_write_bio_cert, 1, jwt::error::rsa_error::write_cert_failed}, + {&fail_BIO_ctrl, 1, jwt::error::rsa_error::convert_to_pem_failed} ++#elif LIBWOLFSSL_VERSION_HEX >= 0x05009002 ++ /* wolfSSL does not use BIO_ctrl in BIO_get_mem_data */ ++ {&fail_PEM_write_bio_cert, 1, jwt::error::rsa_error::write_cert_failed} + #else ++ /* Ed25519 certificate can not be decoded */ + {&fail_PEM_write_bio_cert, 1, jwt::error::rsa_error::create_mem_bio_failed}, + {&fail_BIO_ctrl, 1, jwt::error::rsa_error::create_mem_bio_failed} + #endif +-- +2.43.0 + diff --git a/krb5/Patch-for-Kerberos-5-1.22.2.patch b/krb5/Patch-for-Kerberos-5-1.22.2.patch new file mode 100644 index 000000000..f2c9059ad --- /dev/null +++ b/krb5/Patch-for-Kerberos-5-1.22.2.patch @@ -0,0 +1,660 @@ +From 6313467ba6147073cdbdcd6494240baca6a8cd41 Mon Sep 17 00:00:00 2001 +From: Juliusz Sosinowicz +Date: Fri, 4 Sep 2026 10:08:22 +0000 +Subject: [PATCH] Patch for Kerberos 5 1.22.2 + +- Use `PKG_CHECK_MODULES` and `PKG_CHECK_VAR` to find wolfSSL and configure compilation options +- Rename `WANT_READ` and `WANT_WRITE` to `K5_WANT_READ` and `K5_WANT_WRITE` respectively to avoid conflicts with wolfSSL +- Remove Camellia tests as wolfSSL does not support it in the EVP layer +- Run the `tests/gssapi` tests before the `tests` python tests so that `make -j check` does not start two KDCs on the same ports + +Compile wolfSSL with: +``` +./autogen.sh +./configure --enable-krb +make +make install +``` + +Kerberos 1.22.2 may be downloaded and extracted with: +``` +wget https://web.mit.edu/kerberos/dist/krb5/1.22/krb5-1.22.2.tar.gz +tar -xvf krb5-1.22.2.tar.gz +``` + +or checked out with: +``` +git clone --depth 1 --branch krb5-1.22.2-final https://github.com/krb5/krb5 +``` + +Compile krb5 with: +``` +patch -p1 < +cd src +autoreconf -ivf +export WOLFSSL_CFLAGS="-I/include -I/include/wolfssl -Wl,-rpath=/lib" +export WOLFSSL_LIBS="-lwolfssl -L/lib -Wl,-rpath=/lib" +./configure --with-crypto-impl=wolfssl --with-tls-impl=wolfssl --disable-pkinit --with-spake-openssl +make +``` + +`WOLFSSL_CFLAGS` and `WOLFSSL_LIBS` may be omitted when wolfSSL is installed in a location known to pkg-config. + +wolfSSL does not support using the `pkinit` plugin for Kerberos 5. wolfSSL also does not support the camellia cipher in the compatibility layer for Kerberos 5. + +The tests should all pass with: +``` +make check +``` + +Tests that skip do so for reasons unrelated to wolfSSL: PKINIT, OTP (python pyrad), LDAP KDB, HTTP proxy (python kdcproxy), keyring ccache, t_locate_kdc (DNS), URI discovery (resolv_wrapper) and socket activation (systemd-socket-activate). The Camellia parts of the crypto tests are compiled out. +--- + src/clients/kvno/t_kvno.py | 6 -- + src/configure.ac | 86 +++++++++++++++++++-- + src/include/k5-tls.h | 2 +- + src/kdc/main.c | 15 ++++ + src/lib/crypto/crypto_tests/Makefile.in | 2 - + src/lib/crypto/crypto_tests/camellia-test.c | 6 ++ + src/lib/crypto/crypto_tests/t_cksums.c | 2 + + src/lib/crypto/crypto_tests/t_cmac.c | 6 ++ + src/lib/crypto/crypto_tests/t_decrypt.c | 2 + + src/lib/crypto/crypto_tests/t_derive.c | 4 + + src/lib/crypto/crypto_tests/t_encrypt.c | 3 + + src/lib/crypto/crypto_tests/t_short.c | 2 + + src/lib/crypto/crypto_tests/t_str2key.c | 2 + + src/lib/crypto/krb/cksumtypes.c | 2 + + src/lib/crypto/krb/crypto_int.h | 4 + + src/lib/crypto/krb/etypes.c | 2 + + src/lib/krb5/krb/t_etypes.c | 2 + + src/lib/krb5/os/sendto_kdc.c | 8 +- + src/plugins/tls/k5tls/openssl.c | 8 +- + src/tests/Makefile.in | 3 + + src/tests/gssapi/t_prf.c | 2 + + src/util/k5test.py | 7 -- + 22 files changed, 147 insertions(+), 29 deletions(-) + +diff --git a/src/clients/kvno/t_kvno.py b/src/clients/kvno/t_kvno.py +index e98b90e..b95f976 100644 +--- a/src/clients/kvno/t_kvno.py ++++ b/src/clients/kvno/t_kvno.py +@@ -26,12 +26,6 @@ mark('no options') + realm.run([kvno, realm.user_princ], expected_msg='user@KRBTEST.COM: kvno = 1') + check_cache(realm.ccache, [realm.krbtgt_princ, realm.user_princ]) + +-mark('-e') +-msgs = ('etypes requested in TGS request: camellia128-cts', +- '/KDC has no support for encryption type') +-realm.run([kvno, '-e', 'camellia128-cts', realm.host_princ], +- expected_code=1, expected_trace=msgs) +- + mark('--cached-only') + realm.run([kvno, '--cached-only', realm.user_princ], expected_msg='kvno = 1') + realm.run([kvno, '--cached-only', realm.host_princ], +diff --git a/src/configure.ac b/src/configure.ac +index 4325fae..f39214e 100644 +--- a/src/configure.ac ++++ b/src/configure.ac +@@ -263,7 +263,8 @@ AC_SUBST(audit_plugin) + + # WITH_CRYPTO_IMPL + +-CRYPTO_IMPL=builtin ++CRYPTO_IMPL_WOLFSSL=no ++CRYPTO_IMPL="builtin" + AC_ARG_WITH([crypto-impl], + [AS_HELP_STRING([--with-crypto-impl=IMPL], + [use specified crypto implementation @<:@builtin@:>@])], +@@ -279,12 +280,45 @@ openssl) + AC_CHECK_LIB(crypto, PKCS7_get_signer_info) + AC_DEFINE([CRYPTO_OPENSSL], 1, [Define to use OpenSSL crypto library]) + ;; ++wolfssl) ++ CRYPTO_IMPL=openssl ++ CRYPTO_IMPL_WOLFSSL=yes ++ if test -z "${WOLFSSL_CFLAGS}" -a -z "${WOLFSSL_LIBS}"; then ++ # If the user did not explicitly specify flags, try to autodetect. ++ PKG_CHECK_MODULES( ++ [WOLFSSL], ++ [wolfssl], ++ [WOLFSSL_FOUND=yes], ++ [WOLFSSL_FOUND=no] ++ ) ++ PKG_CHECK_VAR( ++ [WOLFSSL_INCLUDEDIR], ++ [wolfssl], ++ [includedir], ++ [WOLFSSL_FOUND=yes], ++ [WOLFSSL_FOUND=no] ++ ) ++ if test "x$WOLFSSL_FOUND" = "xno" ; then ++ AC_MSG_ERROR([wolfSSL not found!]) ++ fi ++ WOLFSSL_CFLAGS="${WOLFSSL_CFLAGS} -I${WOLFSSL_INCLUDEDIR}/wolfssl" ++ fi ++ CFLAGS="${CFLAGS} ${WOLFSSL_CFLAGS}" ++ LIBS="${LIBS} ${WOLFSSL_LIBS}" ++ AC_CHECK_LIB(wolfssl, PKCS7_get_signer_info) ++ AC_DEFINE([CRYPTO_OPENSSL], 1, [Define to use wolfSSL compatibility layer]) ++ AC_DEFINE([CRYPTO_WOLFSSL], 1, [Define to use wolfSSL compatibility layer]) ++ AC_DEFINE(HAVE_LIBCRYPTO, 1, [wolfSSL]) ++ AC_DEFINE(EXTERNAL_OPTS_OPENVPN, 1, [wolfSSL options.h include]) ++ ;; + *) + AC_MSG_ERROR([Unknown crypto implementation $withval]) + ;; + esac +-AC_SUBST([CRYPTO_IMPL_CFLAGS]) +-AC_SUBST([CRYPTO_IMPL_LIBS]) ++AC_SUBST(CRYPTO_IMPL) ++AC_SUBST(CRYPTO_IMPL_CFLAGS) ++AC_SUBST(CRYPTO_IMPL_LIBS) ++AC_SUBST(CRYPTO_IMPL_WOLFSSL) + AC_SUBST([CRYPTO_BUILTIN_TESTS]) + + # WITH_TLS_IMPL +@@ -294,6 +328,36 @@ AC_ARG_WITH([tls-impl], + [use specified TLS implementation @<:@auto@:>@])], + [TLS_IMPL=$withval], [TLS_IMPL=auto]) + case "$TLS_IMPL" in ++wolfssl) ++ if test -z "${WOLFSSL_CFLAGS}" -a -z "${WOLFSSL_LIBS}"; then ++ # If the user did not explicitly specify flags, try to autodetect. ++ PKG_CHECK_MODULES( ++ [WOLFSSL], ++ [wolfssl], ++ [WOLFSSL_FOUND=yes], ++ [WOLFSSL_FOUND=no] ++ ) ++ PKG_CHECK_VAR( ++ [WOLFSSL_INCLUDEDIR], ++ [wolfssl], ++ [includedir], ++ [WOLFSSL_FOUND=yes], ++ [WOLFSSL_FOUND=no] ++ ) ++ if test "x$WOLFSSL_FOUND" = "xno" ; then ++ AC_MSG_ERROR([wolfSSL not found!]) ++ fi ++ WOLFSSL_CFLAGS="${WOLFSSL_CFLAGS} -I${WOLFSSL_INCLUDEDIR}/wolfssl" ++ fi ++ CFLAGS="${CFLAGS} ${WOLFSSL_CFLAGS}" ++ LIBS="${LIBS} ${WOLFSSL_LIBS}" ++ TLS_IMPL_LIBS="${WOLFSSL_LIBS}" ++ TLS_IMPL=openssl ++ AC_CHECK_LIB(wolfssl, wolfSSL_CTX_new) ++ AC_MSG_NOTICE([TLS module will use wolfSSL]) ++ AC_DEFINE(TLS_IMPL_OPENSSL, 1, [wolfSSL]) ++ AC_DEFINE(EXTERNAL_OPTS_OPENVPN, 1, [wolfSSL options.h include]) ++ ;; + openssl|auto) + AC_CHECK_LIB(ssl,SSL_CTX_new,[have_lib_ssl=true],[have_lib_ssl=false], + -lcrypto) +@@ -359,10 +423,18 @@ AC_ARG_WITH([spake-openssl], + [use OpenSSL for SPAKE preauth @<:@auto@:>@])], + [], [withval=auto]) + if test "$withval" = auto -o "$withval" = yes; then +- AC_CHECK_LIB([crypto],[EC_POINT_new],[have_crypto=true],[have_crypto=false]) ++ if test "$CRYPTO_IMPL_WOLFSSL" = yes; then ++ AC_CHECK_LIB([wolfssl],[wolfSSL_EC_POINT_new],[have_crypto=true],[have_crypto=false]) ++ else ++ AC_CHECK_LIB([crypto],[EC_POINT_new],[have_crypto=true],[have_crypto=false]) ++ fi + if test "$have_crypto" = true; then + AC_DEFINE(SPAKE_OPENSSL,1,[Define to use OpenSSL for SPAKE preauth]) +- SPAKE_OPENSSL_LIBS=-lcrypto ++ if test "$CRYPTO_IMPL_WOLFSSL" = yes; then ++ SPAKE_OPENSSL_LIBS= ++ else ++ SPAKE_OPENSSL_LIBS=-lcrypto ++ fi + HAVE_SPAKE_OPENSSL=yes + elif test "$withval" = yes; then + AC_MSG_ERROR([OpenSSL libcrypto not found]) +@@ -1146,6 +1218,9 @@ if test "$enable_pkinit" = yes || test "$enable_pkinit" = try; then + #endif + int i = 1; + ])], k5_cv_openssl_version_okay=yes, k5_cv_openssl_version_okay=no)]) ++ if test "$CRYPTO_IMPL_WOLFSSL" = yes; then ++ AC_MSG_ERROR([No CMS API support with wolfSSL.]) ++ fi + old_LIBS="$LIBS" + AC_CHECK_LIB(crypto, PKCS7_get_signer_info) + AC_CHECK_FUNCS(EVP_PKEY_get_bn_param) +@@ -1579,3 +1654,4 @@ V5_AC_OUTPUT_MAKEFILE(. + tests tests/asn.1 tests/create tests/hammer tests/verify tests/gssapi + tests/threads tests/shlib tests/gss-threads tests/misc + ) ++ +diff --git a/src/include/k5-tls.h b/src/include/k5-tls.h +index 0661c05..a5597eb 100644 +--- a/src/include/k5-tls.h ++++ b/src/include/k5-tls.h +@@ -47,7 +47,7 @@ + typedef struct k5_tls_handle_st *k5_tls_handle; + + typedef enum { +- DATA_READ, DONE, WANT_READ, WANT_WRITE, ERROR_TLS ++ DATA_READ, DONE, K5_WANT_READ, K5_WANT_WRITE, ERROR_TLS + } k5_tls_status; + + /* +diff --git a/src/kdc/main.c b/src/kdc/main.c +index 1052766..203cc89 100644 +--- a/src/kdc/main.c ++++ b/src/kdc/main.c +@@ -884,6 +884,16 @@ finish_realms(void) + exit + */ + ++#include ++#ifdef DEBUG_WOLFSSL ++#include ++static void wolf_log_cb(const int logLevel, const char *const logMessage) ++{ ++ (void)logLevel; ++ kdc_err(shandle.kdc_err_context, 0, "%s", logMessage); ++} ++#endif ++ + int main(int argc, char **argv) + { + krb5_error_code retval; +@@ -927,6 +937,11 @@ int main(int argc, char **argv) + com_err to ensure that the error state exists in the context + known to the krb5_klog callback. */ + ++#ifdef DEBUG_WOLFSSL ++ wolfSSL_Debugging_ON(); ++ wolfSSL_SetLoggingCb(wolf_log_cb); ++#endif ++ + /* + * Scan through the argument list + */ +diff --git a/src/lib/crypto/crypto_tests/Makefile.in b/src/lib/crypto/crypto_tests/Makefile.in +index 9944631..c52dec4 100644 +--- a/src/lib/crypto/crypto_tests/Makefile.in ++++ b/src/lib/crypto/crypto_tests/Makefile.in +@@ -44,8 +44,6 @@ check-unix: t_nfold t_encrypt t_decrypt t_prf t_cmac t_hmac \ + cmp vk.txt $(srcdir)/expect-vk.txt + $(RUN_TEST) ./aes-test > vt.txt + cmp vt.txt $(srcdir)/expect-vt.txt +- $(RUN_TEST) ./camellia-test > camellia-vt.txt +- cmp camellia-vt.txt $(srcdir)/camellia-expect-vt.txt + $(RUN_TEST) $(C)t_mddriver4 -x + $(RUN_TEST) $(C)t_mddriver -x + $(RUN_TEST) ./t_sha2 +diff --git a/src/lib/crypto/crypto_tests/camellia-test.c b/src/lib/crypto/crypto_tests/camellia-test.c +index ca6579f..7a6a7de 100644 +--- a/src/lib/crypto/crypto_tests/camellia-test.c ++++ b/src/lib/crypto/crypto_tests/camellia-test.c +@@ -30,6 +30,7 @@ + #include + #include "crypto_int.h" + ++#ifndef HAVE_LIBWOLFSSL + static char key[32]; + static char plain[16], cipher[16], zero[16]; + +@@ -122,6 +123,7 @@ static void vt_test(void) + vt_test_1(16, ENCTYPE_CAMELLIA128_CTS_CMAC); + vt_test_1(32, ENCTYPE_CAMELLIA256_CTS_CMAC); + } ++#endif + + int main (int argc, char *argv[]) + { +@@ -132,10 +134,14 @@ int main (int argc, char *argv[]) + argv[0], argv[0]); + return 1; + } ++#ifdef HAVE_LIBWOLFSSL ++ printf("No Camellia support in wolfSSL EVP layer\n"); ++#else + init(); + if (argc == 2) + vk_test(); + else + vt_test(); ++#endif + return 0; + } +diff --git a/src/lib/crypto/crypto_tests/t_cksums.c b/src/lib/crypto/crypto_tests/t_cksums.c +index 557340e..8ad8a51 100644 +--- a/src/lib/crypto/crypto_tests/t_cksums.c ++++ b/src/lib/crypto/crypto_tests/t_cksums.c +@@ -102,6 +102,7 @@ struct test { + { KV5M_DATA, 16, + "\xEB\x38\xCC\x97\xE2\x23\x0F\x59\xDA\x41\x17\xDC\x58\x59\xD7\xEC" } + }, ++#ifndef HAVE_LIBWOLFSSL + { + { KV5M_DATA, 11, "abcdefghijk" }, + CKSUMTYPE_CMAC_CAMELLIA128, ENCTYPE_CAMELLIA128_CTS_CMAC, 7, +@@ -136,6 +137,7 @@ struct test { + { KV5M_DATA, 16, + "\x3F\xA0\xB4\x23\x55\xE5\x2B\x18\x91\x87\x29\x4A\xA2\x52\xAB\x64" } + }, ++#endif + { + { KV5M_DATA, 21, + "\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0A\x0B\x0C\x0D\x0E\x0F" +diff --git a/src/lib/crypto/crypto_tests/t_cmac.c b/src/lib/crypto/crypto_tests/t_cmac.c +index 565c35d..1a8deb9 100644 +--- a/src/lib/crypto/crypto_tests/t_cmac.c ++++ b/src/lib/crypto/crypto_tests/t_cmac.c +@@ -99,6 +99,7 @@ check_result(const char *name, const unsigned char *result, + int + main(int argc, char **argv) + { ++#ifndef HAVE_LIBWOLFSSL + krb5_error_code ret; + krb5_context context = NULL; + krb5_keyblock keyblock; +@@ -144,4 +145,9 @@ main(int argc, char **argv) + printf("All CMAC tests passed.\n"); + krb5_k_free_key(context, key); + return 0; ++#else ++ printf("All CMAC tests skipped. wolfSSL does not have Camellia support " ++ "in the EVP layer.\n"); ++ return 0; ++#endif + } +diff --git a/src/lib/crypto/crypto_tests/t_decrypt.c b/src/lib/crypto/crypto_tests/t_decrypt.c +index a40a855..792e651 100644 +--- a/src/lib/crypto/crypto_tests/t_decrypt.c ++++ b/src/lib/crypto/crypto_tests/t_decrypt.c +@@ -300,6 +300,7 @@ struct test { + "\xB7\x34\xD4\xD4\x98\xB6\x71\x4F\x1C\x1D" } + }, + ++#ifndef HAVE_LIBWOLFSSL + { + ENCTYPE_CAMELLIA128_CTS_CMAC, + { KV5M_DATA, 0, "", }, 0, +@@ -406,6 +407,7 @@ struct test { + "\xF3\x4A\xD1\x25\x5A\x34\x49\x99\xAD\x37\x14\x68\x87\xA6\xC6\x84" + "\x57\x31\xAC\x7F\x46\x37\x6A\x05\x04\xCD\x06\x57\x14\x74" } + }, ++#endif + + { + ENCTYPE_AES128_CTS_HMAC_SHA256_128, +diff --git a/src/lib/crypto/crypto_tests/t_derive.c b/src/lib/crypto/crypto_tests/t_derive.c +index afbf747..ad5af47 100644 +--- a/src/lib/crypto/crypto_tests/t_derive.c ++++ b/src/lib/crypto/crypto_tests/t_derive.c +@@ -137,6 +137,7 @@ struct test { + "\xD7\xBB\xA9\x07\x76\xD8\x12\x6D\x91\xF3\x4F\x31\x01\xAE\xA8\xBA" } + }, + ++#ifndef HAVE_LIBWOLFSSL + /* Kc, Ke, Ki for a Camellia-128 key */ + { + ENCTYPE_CAMELLIA128_CTS_CMAC, +@@ -200,6 +201,7 @@ struct test { + "\xFA\x62\x4F\xA0\xE5\x23\x99\x3F\xA3\x88\xAE\xFD\xC6\x7E\x67\xEB" + "\xCD\x8C\x08\xE8\xA0\x24\x6B\x1D\x73\xB0\xD1\xDD\x9F\xC5\x82\xB0" } + }, ++#endif + + /* Kc, Ke, Ki for an aes128-sha2 key. */ + { +@@ -289,8 +291,10 @@ get_enc_provider(krb5_enctype enctype) + case ENCTYPE_DES3_CBC_SHA1: return &krb5int_enc_des3; + case ENCTYPE_AES128_CTS_HMAC_SHA1_96: return &krb5int_enc_aes128; + case ENCTYPE_AES256_CTS_HMAC_SHA1_96: return &krb5int_enc_aes256; ++#ifndef HAVE_LIBWOLFSSL + case ENCTYPE_CAMELLIA128_CTS_CMAC: return &krb5int_enc_camellia128; + case ENCTYPE_CAMELLIA256_CTS_CMAC: return &krb5int_enc_camellia256; ++#endif + case ENCTYPE_AES128_CTS_HMAC_SHA256_128: return &krb5int_enc_aes128; + case ENCTYPE_AES256_CTS_HMAC_SHA384_192: return &krb5int_enc_aes256; + } +diff --git a/src/lib/crypto/crypto_tests/t_encrypt.c b/src/lib/crypto/crypto_tests/t_encrypt.c +index 64092ef..7a2299b 100644 +--- a/src/lib/crypto/crypto_tests/t_encrypt.c ++++ b/src/lib/crypto/crypto_tests/t_encrypt.c +@@ -42,8 +42,11 @@ krb5_enctype interesting_enctypes[] = { + ENCTYPE_ARCFOUR_HMAC_EXP, + ENCTYPE_AES256_CTS_HMAC_SHA1_96, + ENCTYPE_AES128_CTS_HMAC_SHA1_96, ++#ifndef HAVE_LIBWOLFSSL ++ /* No Camellia support in EVP wolfSSL layer */ + ENCTYPE_CAMELLIA128_CTS_CMAC, + ENCTYPE_CAMELLIA256_CTS_CMAC, ++#endif + ENCTYPE_AES128_CTS_HMAC_SHA256_128, + ENCTYPE_AES256_CTS_HMAC_SHA384_192, + 0 +diff --git a/src/lib/crypto/crypto_tests/t_short.c b/src/lib/crypto/crypto_tests/t_short.c +index d4c2b97..d1ba53a 100644 +--- a/src/lib/crypto/crypto_tests/t_short.c ++++ b/src/lib/crypto/crypto_tests/t_short.c +@@ -39,8 +39,10 @@ krb5_enctype interesting_enctypes[] = { + ENCTYPE_ARCFOUR_HMAC_EXP, + ENCTYPE_AES256_CTS_HMAC_SHA1_96, + ENCTYPE_AES128_CTS_HMAC_SHA1_96, ++#ifndef HAVE_LIBWOLFSSL + ENCTYPE_CAMELLIA128_CTS_CMAC, + ENCTYPE_CAMELLIA256_CTS_CMAC, ++#endif + ENCTYPE_AES128_CTS_HMAC_SHA256_128, + ENCTYPE_AES256_CTS_HMAC_SHA384_192, + 0 +diff --git a/src/lib/crypto/crypto_tests/t_str2key.c b/src/lib/crypto/crypto_tests/t_str2key.c +index cdb1acc..82e207f 100644 +--- a/src/lib/crypto/crypto_tests/t_str2key.c ++++ b/src/lib/crypto/crypto_tests/t_str2key.c +@@ -249,6 +249,7 @@ struct test { + FALSE + }, + ++#ifndef HAVE_LIBWOLFSSL + /* The same inputs applied to Camellia enctypes. */ + { + ENCTYPE_CAMELLIA128_CTS_CMAC, +@@ -410,6 +411,7 @@ struct test { + KRB5_ERR_BAD_S2K_PARAMS, + FALSE + }, ++#endif + + { + ENCTYPE_AES128_CTS_HMAC_SHA256_128, +diff --git a/src/lib/crypto/krb/cksumtypes.c b/src/lib/crypto/krb/cksumtypes.c +index f7ba322..c0840ac 100644 +--- a/src/lib/crypto/krb/cksumtypes.c ++++ b/src/lib/crypto/krb/cksumtypes.c +@@ -83,6 +83,7 @@ const struct krb5_cksumtypes krb5int_cksumtypes_list[] = { + krb5int_hmacmd5_checksum, NULL, + 16, 16, 0 }, + ++#ifndef HAVE_LIBWOLFSSL + { CKSUMTYPE_CMAC_CAMELLIA128, + "cmac-camellia128", { 0 }, "CMAC Camellia128 key", + &krb5int_enc_camellia128, NULL, +@@ -94,6 +95,7 @@ const struct krb5_cksumtypes krb5int_cksumtypes_list[] = { + &krb5int_enc_camellia256, NULL, + krb5int_dk_cmac_checksum, NULL, + 16, 16, 0 }, ++#endif + + { CKSUMTYPE_HMAC_SHA256_128_AES128, + "hmac-sha256-128-aes128", { 0 }, "HMAC-SHA256 AES128 key", +diff --git a/src/lib/crypto/krb/crypto_int.h b/src/lib/crypto/krb/crypto_int.h +index 3629616..a14fbd2 100644 +--- a/src/lib/crypto/krb/crypto_int.h ++++ b/src/lib/crypto/krb/crypto_int.h +@@ -62,7 +62,9 @@ + #endif + + #define K5_OPENSSL_AES ++#ifndef HAVE_LIBWOLFSSL + #define K5_OPENSSL_CAMELLIA ++#endif + #define K5_OPENSSL_DES + #define K5_OPENSSL_HMAC + #define K5_OPENSSL_MD5 +@@ -474,8 +476,10 @@ extern const struct krb5_enc_provider krb5int_enc_aes128; + extern const struct krb5_enc_provider krb5int_enc_aes256; + extern const struct krb5_enc_provider krb5int_enc_aes128_ctr; + extern const struct krb5_enc_provider krb5int_enc_aes256_ctr; ++#ifndef HAVE_LIBWOLFSSL + extern const struct krb5_enc_provider krb5int_enc_camellia128; + extern const struct krb5_enc_provider krb5int_enc_camellia256; ++#endif + + extern const struct krb5_hash_provider krb5int_hash_md4; + extern const struct krb5_hash_provider krb5int_hash_md5; +diff --git a/src/lib/crypto/krb/etypes.c b/src/lib/crypto/krb/etypes.c +index fc27878..9f7854f 100644 +--- a/src/lib/crypto/krb/etypes.c ++++ b/src/lib/crypto/krb/etypes.c +@@ -103,6 +103,7 @@ const struct krb5_keytypes krb5int_enctypes_list[] = { + CKSUMTYPE_HMAC_SHA1_96_AES256, + 0 /*flags*/, 256 }, + ++#ifndef HAVE_LIBWOLFSSL + { ENCTYPE_CAMELLIA128_CTS_CMAC, + "camellia128-cts-cmac", { "camellia128-cts" }, + "Camellia-128 CTS mode with CMAC", +@@ -125,6 +126,7 @@ const struct krb5_keytypes krb5int_enctypes_list[] = { + krb5int_dk_cmac_prf, + CKSUMTYPE_CMAC_CAMELLIA256, + 0 /*flags */, 256 }, ++#endif + + { ENCTYPE_AES128_CTS_HMAC_SHA256_128, + "aes128-cts-hmac-sha256-128", { "aes128-sha2" }, +diff --git a/src/lib/krb5/krb/t_etypes.c b/src/lib/krb5/krb/t_etypes.c +index 90c9f62..cc43d0b 100644 +--- a/src/lib/krb5/krb/t_etypes.c ++++ b/src/lib/krb5/krb/t_etypes.c +@@ -61,12 +61,14 @@ static struct { + ENCTYPE_DES3_CBC_SHA1, 0 }, + 0, 0 + }, ++#ifndef HAVE_LIBWOLFSSL + /* Family with enctype removed */ + { "camellia -camellia256-cts-cmac", + { 0 }, + { ENCTYPE_CAMELLIA128_CTS_CMAC, 0 }, + { ENCTYPE_CAMELLIA128_CTS_CMAC, 0 } + }, ++#endif + /* Default set with family added and enctype removed */ + { "DEFAULT +aes -arcfour-hmac-md5", + { ENCTYPE_ARCFOUR_HMAC, ENCTYPE_DES3_CBC_SHA1, 0 }, +diff --git a/src/lib/krb5/os/sendto_kdc.c b/src/lib/krb5/os/sendto_kdc.c +index 9b51e95..2e2818e 100644 +--- a/src/lib/krb5/os/sendto_kdc.c ++++ b/src/lib/krb5/os/sendto_kdc.c +@@ -1276,9 +1276,9 @@ service_https_write(krb5_context context, const krb5_data *realm, + TRACE_SENDTO_KDC_HTTPS_SEND(context, &conn->addr); + cm_read(selstate, conn->fd); + conn->state = READING; +- } else if (st == WANT_READ) { ++ } else if (st == K5_WANT_READ) { + cm_read(selstate, conn->fd); +- } else if (st == WANT_WRITE) { ++ } else if (st == K5_WANT_WRITE) { + cm_write(selstate, conn->fd); + } else if (st == ERROR_TLS) { + TRACE_SENDTO_KDC_HTTPS_ERROR_SEND(context, &conn->addr); +@@ -1327,9 +1327,9 @@ https_read_bytes(krb5_context context, struct conn_state *conn, + if (st == DONE) + return TRUE; + +- if (st == WANT_READ) { ++ if (st == K5_WANT_READ) { + cm_read(selstate, conn->fd); +- } else if (st == WANT_WRITE) { ++ } else if (st == K5_WANT_WRITE) { + cm_write(selstate, conn->fd); + } else if (st == ERROR_TLS) { + TRACE_SENDTO_KDC_HTTPS_ERROR_RECV(context, &conn->addr); +diff --git a/src/plugins/tls/k5tls/openssl.c b/src/plugins/tls/k5tls/openssl.c +index aab67c0..1b01fb9 100644 +--- a/src/plugins/tls/k5tls/openssl.c ++++ b/src/plugins/tls/k5tls/openssl.c +@@ -517,9 +517,9 @@ write_tls(krb5_context context, k5_tls_handle handle, const void *data, + + e = SSL_get_error(handle->ssl, nwritten); + if (e == SSL_ERROR_WANT_READ) +- return WANT_READ; ++ return K5_WANT_READ; + else if (e == SSL_ERROR_WANT_WRITE) +- return WANT_WRITE; ++ return K5_WANT_WRITE; + flush_errors(context); + return ERROR_TLS; + } +@@ -545,9 +545,9 @@ read_tls(krb5_context context, k5_tls_handle handle, void *data, + + e = SSL_get_error(handle->ssl, nread); + if (e == SSL_ERROR_WANT_READ) +- return WANT_READ; ++ return K5_WANT_READ; + else if (e == SSL_ERROR_WANT_WRITE) +- return WANT_WRITE; ++ return K5_WANT_WRITE; + + if (e == SSL_ERROR_ZERO_RETURN || (e == SSL_ERROR_SYSCALL && nread == 0)) + return DONE; +diff --git a/src/tests/Makefile.in b/src/tests/Makefile.in +index 41ac0d3..657acc7 100644 +--- a/src/tests/Makefile.in ++++ b/src/tests/Makefile.in +@@ -128,6 +128,9 @@ kdb_check: kdc.conf krb5.conf + $(RUN_DB_TEST) ../kadmin/dbutil/kdb5_util $(KADMIN_OPTS) destroy -f + $(RM) $(TEST_DB)* stash_file + ++# Run subdir tests (gssapi) first so their KDCs do not collide with ++# ours when make runs in parallel. ++check-pytests: check-recurse + check-pytests: adata conccache etinfo forward gcred hist hooks hrealm + check-pytests: icinterleave icred kdbtest localauth plugorder rdreq replay + check-pytests: responder s2p s4u2proxy unlockiter s4u2self +diff --git a/src/tests/gssapi/t_prf.c b/src/tests/gssapi/t_prf.c +index f71774c..eebe976 100644 +--- a/src/tests/gssapi/t_prf.c ++++ b/src/tests/gssapi/t_prf.c +@@ -69,6 +69,7 @@ static struct { + "F5B68B7823D8944F33F41541B4E4D38C9B2934F8D16334A796645B066152B4BE", + "112F2B2D878590653CCC7DE278E9F0AA46FA5A380B62" + "59F774CB7C134FCD37F61A50FD0D9F89BF8FE1A6B593" }, ++#ifndef HAVE_LIBWOLFSSL + { ENCTYPE_CAMELLIA128_CTS_CMAC, + "866E0466A178279A32AC0BDA92B72AEB", + "97FBB354BF341C3A160DCC86A7A910FDA824601DF677" +@@ -83,6 +84,7 @@ static struct { + "A171AD582C1AFBBAD52ABD622EE6B6A14D19BF95C6914B2BA40FFD99A88EC660", + "A47CBB6E104DCC77E4DB48A7A474B977F2FB6A7A1AB6" + "52317D50508AE72B7BE2E4E4BA24164E029CBACF786B" }, ++#endif + { ENCTYPE_AES128_CTS_HMAC_SHA256_128, + "089BCA48B105EA6EA77CA5D2F39DC5E7", + "ED1736209B7C59C9F6A3AE8CCC8A7C97ADFDD11688AD" +diff --git a/src/util/k5test.py b/src/util/k5test.py +index d22cb5c..ece1cd4 100644 +--- a/src/util/k5test.py ++++ b/src/util/k5test.py +@@ -1409,13 +1409,6 @@ _passes = [ + 'supported_enctypes': 'aes128-cts:normal', + 'master_key_type': 'aes128-cts'}}}), + +- # Exercise the camellia256-cts enctype. +- ('camellia256', None, +- {'libdefaults': {'permitted_enctypes': 'camellia256-cts'}}, +- {'realms': {'$realm': { +- 'supported_enctypes': 'camellia256-cts:normal', +- 'master_key_type': 'camellia256-cts'}}}), +- + # Exercise the aes128-sha2 enctype. + ('aes128-sha2', None, + {'libdefaults': {'permitted_enctypes': 'aes128-sha2'}}, +-- +2.43.0 + diff --git a/krb5/README b/krb5/README index 4ac46da60..86727a5b2 100644 --- a/krb5/README +++ b/krb5/README @@ -2,3 +2,7 @@ This folder contains patches for Kerberos 5 to work with wolfSSL. Patches make i easier to add support for newer versions of a target library. Instructions for applying each patch are included in the patch commit message. + +The newest patch, Patch-for-Kerberos-5-1.22.2.patch, is tested by the +wolfSSL krb5 GitHub workflow (.github/workflows/krb5.yml) against +krb5-1.22.2-final. diff --git a/libimobiledevice/1.4.0.patch b/libimobiledevice/1.4.0.patch new file mode 100644 index 000000000..0321bcb46 --- /dev/null +++ b/libimobiledevice/1.4.0.patch @@ -0,0 +1,268 @@ +From 14a9a96a71994fa5873b4e701cb246e5682148bc Mon Sep 17 00:00:00 2001 +From: Juliusz Sosinowicz +Date: Fri, 4 Sep 2026 10:05:13 +0000 +Subject: [PATCH] Support for wolfSSL + +Compile wolfSSL with +``` +./configure --enable-all +make +make install +``` + +libimobiledevice 1.4.0 needs libplist >= 2.6.0, libimobiledevice-glue +>= 1.3.0, libusbmuxd >= 2.0.2 and libtatsu >= 1.0.3. The Ubuntu 24.04 +packages are too old (or missing), so build them from source into the +same prefix as wolfSSL. None of them use OpenSSL or wolfSSL. Tested with +libplist 2.7.0, libimobiledevice-glue 1.3.2, libusbmuxd 2.1.1 and +libtatsu 1.0.5 (apt: libusb-1.0-0-dev libcurl4-openssl-dev). +``` +export PKG_CONFIG_PATH=/lib/pkgconfig +for dep in libplist libimobiledevice-glue libusbmuxd libtatsu; do + (cd $dep && ./autogen.sh --prefix= --without-cython && make && make install) +done +``` + +Compile libimobiledevice with +``` +patch -p1 < +./autogen.sh --prefix= --enable-wolfssl --without-cython +make +make install +``` + +libimobiledevice has no test suite (`make check` is a no-op) and +pairing needs a real device. The wolfSSL CI workflow +(.github/workflows/libimobiledevice.yml in the wolfSSL repository) +checks that the library and tools link against wolfSSL, runs the tools +without a device (with the usbmuxd daemon running so `idevice_id -l` +succeeds with an empty list) and drives +pair_record_generate_keys_and_certs() directly to verify that the +generated RSA keys and X509 certificates are correct. + +Notes: +- OPENSSL_VERSION_NUMBER is set to 0x10100000L (accepted by wolfSSL's + opensslv.h) so that the OpenSSL >= 1.1.0 code paths are used: the + chacha20-poly1305 EVP code in src/lockdown-cu.c (wireless pairing) + refuses to build with older version numbers, and src/idevice.c would + otherwise use TLSv1_method(). +- Serial number 0 is not allowed by wolfSSL (RFC 5280 4.1.2.2), so the + generated certificates use serial numbers 1-3. +- X509V3_EXT_conf_nid() is a stub in wolfSSL, so X509_add_ext_helper() + builds the extensions with X509V3_EXT_nconf_nid(), which takes the same + value strings without the "critical" prefix. The subjectKeyIdentifier + "hash" has no configuration context to come from and is built from + X509_pubkey_digest() and X509V3_EXT_i2d(). That is the same key + identifier OpenSSL's "hash" produces: the SHA-1 of the subjectPublicKey + (RFC 5280 4.2.1.2 method 1). +- Requires the wolfSSL implementation of ASN1_TIME_set() (previously a + stub), otherwise the generated certificates only have the default + validity period. +--- + 3rd_party/libsrp6a-sha512/Makefile.am | 4 ++ + common/userpref.c | 66 ++++++++++++++++++++++++++- + configure.ac | 33 ++++++++++++++ + 3 files changed, 101 insertions(+), 2 deletions(-) + +diff --git a/3rd_party/libsrp6a-sha512/Makefile.am b/3rd_party/libsrp6a-sha512/Makefile.am +index bdacb5f..4c538ea 100644 +--- a/3rd_party/libsrp6a-sha512/Makefile.am ++++ b/3rd_party/libsrp6a-sha512/Makefile.am +@@ -6,6 +6,9 @@ AM_CPPFLAGS = \ + -Wno-incompatible-pointer-types + + AM_CFLAGS = -DHAVE_CONFIG_H ++if HAVE_WOLFSSL ++AM_CFLAGS += -DOPENSSL=1 $(ssl_lib_CFLAGS) ++else + if HAVE_OPENSSL + AM_CFLAGS += -DOPENSSL=1 $(openssl_CFLAGS) + else +@@ -17,6 +20,7 @@ AM_CFLAGS += -DMBEDTLS=1 $(mbedtls_CFLAGS) + endif + endif + endif ++endif + + noinst_LTLIBRARIES = libsrp6a-sha512.la + +diff --git a/common/userpref.c b/common/userpref.c +index 76945e1..08e0612 100644 +--- a/common/userpref.c ++++ b/common/userpref.c +@@ -48,7 +48,7 @@ + #include + #include + #include +-#if OPENSSL_VERSION_NUMBER < 0x1010000fL || \ ++#if (!defined(HAVE_WOLFSSL) && OPENSSL_VERSION_NUMBER < 0x1010000fL) || \ + (defined(LIBRESSL_VERSION_NUMBER) && (LIBRESSL_VERSION_NUMBER < 0x20700000L)) + #define X509_set1_notBefore X509_set_notBefore + #define X509_set1_notAfter X509_set_notAfter +@@ -364,9 +364,53 @@ userpref_error_t userpref_delete_pair_record(const char *udid) + } + + #if defined(HAVE_OPENSSL) ++#ifdef HAVE_WOLFSSL ++/* subjectKeyIdentifier "hash": the digest of the certificate public key. */ ++static X509_EXTENSION *X509_skid_hash_ext(X509 *cert) ++{ ++ unsigned char md[EVP_MAX_MD_SIZE]; ++ unsigned int mdlen = sizeof(md); ++ ASN1_OCTET_STRING *os; ++ X509_EXTENSION *ex = NULL; ++ ++ if (!X509_pubkey_digest(cert, EVP_sha1(), md, &mdlen)) { ++ return NULL; ++ } ++ os = ASN1_OCTET_STRING_new(); ++ if (!os) { ++ return NULL; ++ } ++ if (ASN1_OCTET_STRING_set(os, md, mdlen)) { ++ ex = X509V3_EXT_i2d(NID_subject_key_identifier, 0, os); ++ } ++ ASN1_OCTET_STRING_free(os); ++ ++ return ex; ++} ++#endif ++ + static int X509_add_ext_helper(X509 *cert, int nid, char *value) + { + X509_EXTENSION *ex; ++#ifdef HAVE_WOLFSSL ++ int crit = 0; ++ ++ /* wolfSSL only stubs X509V3_EXT_conf_nid(). X509V3_EXT_nconf_nid() takes ++ * the same values without the "critical" prefix and has no context to ++ * compute the subjectKeyIdentifier hash from. */ ++ if (!strncmp(value, "critical,", 9)) { ++ crit = 1; ++ value += 9; ++ } ++ if (nid == NID_subject_key_identifier && !strcmp(value, "hash")) { ++ ex = X509_skid_hash_ext(cert); ++ } else { ++ ex = X509V3_EXT_nconf_nid(NULL, NULL, nid, value); ++ } ++ if (ex && crit) { ++ X509_EXTENSION_set_critical(ex, 1); ++ } ++#else + X509V3_CTX ctx; + + /* No configuration database */ +@@ -374,8 +418,9 @@ static int X509_add_ext_helper(X509 *cert, int nid, char *value) + + X509V3_set_ctx(&ctx, NULL, cert, NULL, NULL, 0); + ex = X509V3_EXT_conf_nid(NULL, &ctx, nid, value); ++#endif + if (!ex) { +- debug_info("ERROR: X509V3_EXT_conf_nid(%d, %s) failed", nid, value); ++ debug_info("ERROR: extension %d (%s) failed", nid, value); + return 0; + } + +@@ -463,7 +508,14 @@ userpref_error_t pair_record_generate_keys_and_certs(plist_t pair_record, key_da + { + /* set serial number */ + ASN1_INTEGER* sn = ASN1_INTEGER_new(); ++#ifdef HAVE_WOLFSSL ++ /* wolfSSL doesn't permit using 0 for serial numbers, in accordance with ++ * RFC 5280: ++ * https://datatracker.ietf.org/doc/html/rfc5280#section-4.1.2.2. */ ++ ASN1_INTEGER_set(sn, 1); ++#else + ASN1_INTEGER_set(sn, 0); ++#endif + X509_set_serialNumber(root_cert, sn); + ASN1_INTEGER_free(sn); + +@@ -493,7 +545,12 @@ userpref_error_t pair_record_generate_keys_and_certs(plist_t pair_record, key_da + { + /* set serial number */ + ASN1_INTEGER* sn = ASN1_INTEGER_new(); ++#ifdef HAVE_WOLFSSL ++ /* See note above on 0 serial numbers. */ ++ ASN1_INTEGER_set(sn, 2); ++#else + ASN1_INTEGER_set(sn, 0); ++#endif + X509_set_serialNumber(host_cert, sn); + ASN1_INTEGER_free(sn); + +@@ -590,7 +647,12 @@ userpref_error_t pair_record_generate_keys_and_certs(plist_t pair_record, key_da + if (pubkey && dev_cert) { + /* generate device certificate */ + ASN1_INTEGER* sn = ASN1_INTEGER_new(); ++#ifdef HAVE_WOLFSSL ++ /* See note above on 0 serial numbers. */ ++ ASN1_INTEGER_set(sn, 3); ++#else + ASN1_INTEGER_set(sn, 0); ++#endif + X509_set_serialNumber(dev_cert, sn); + ASN1_INTEGER_free(sn); + X509_set_version(dev_cert, 2); +diff --git a/configure.ac b/configure.ac +index 055fe04..83fb09c 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -173,6 +173,14 @@ AC_SUBST([CYTHON_SUB]) + + default_openssl=yes + ++AC_ARG_ENABLE([wolfssl], ++ [AS_HELP_STRING([--enable-wolfssl], ++ [Use wolfSSL crypto])], ++ [use_wolfssl=$enableval], ++ [use_wolfssl=no]) ++if test "x$use_wolfssl" = "xyes"; then ++ default_openssl=no ++fi + AC_ARG_WITH([mbedtls], + [AS_HELP_STRING([--without-mbedtls], + [Do not look for mbedtls])], +@@ -221,6 +229,30 @@ if test "x$use_mbedtls" = "xyes"; then + ssl_provider="MbedTLS"; + ssl_requires="" + AC_SUBST(ssl_requires) ++elif test "x$use_wolfssl" = "xyes"; then ++ AC_DEFINE(HAVE_WOLFSSL, 1, [Define if you have wolfSSL support]) ++ AC_DEFINE(HAVE_OPENSSL, 1, [Defined to use wolfSSL compatibility layer]) ++ PKG_CHECK_MODULES( ++ [wolfssl], ++ [wolfssl], ++ [], ++ [AC_MSG_ERROR([Could not find wolfSSL.])] ++ ) ++ PKG_CHECK_VAR( ++ [wolfssl_includedir], ++ [wolfssl], ++ [includedir], ++ [], ++ [AC_MSG_ERROR([Could not find wolfSSL includedir variable.])] ++ ) ++ wolfssl_CFLAGS="${wolfssl_CFLAGS} -DWOLFSSL_USE_OPTIONS_H -DEXTERNAL_OPTS_OPENVPN -DOPENSSL_VERSION_NUMBER=0x10100000L -I${wolfssl_includedir}/wolfssl" ++ ssl_lib_CFLAGS="$wolfssl_CFLAGS" ++ ssl_lib_LIBS="$wolfssl_LIBS" ++ AC_SUBST(ssl_lib_CFLAGS) ++ AC_SUBST(ssl_lib_LIBS) ++ ssl_provider="wolfSSL" ++ ssl_requires="wolfssl" ++ AC_SUBST(ssl_requires) + else + if test "x$use_openssl" = "xyes"; then + pkg_req_openssl="openssl >= 0.9.8" +@@ -291,6 +323,7 @@ else + fi + AM_CONDITIONAL(HAVE_MBEDTLS, test "x$use_mbedtls" = "xyes") + AM_CONDITIONAL(HAVE_OPENSSL, test "x$use_openssl" = "xyes") ++AM_CONDITIONAL(HAVE_WOLFSSL, test "x$use_wolfssl" = "xyes") + AM_CONDITIONAL(HAVE_GCRYPT, test "x$use_gnutls" = "xyes") + + AC_ARG_ENABLE([wireless-pairing], +-- +2.43.0 + diff --git a/libspdm/3.8.2/README.md b/libspdm/3.8.2/README.md new file mode 100644 index 000000000..fac6036bd --- /dev/null +++ b/libspdm/3.8.2/README.md @@ -0,0 +1,31 @@ +# Building libspdm 3.8.2 with wolfSSL + +This folder contains the patch to build libspdm 3.8.2 against wolfSSL. The +patch is named `libspdm-.patch` and its commit message documents the +exact build and test steps. Summary: + ++ Configure wolfSSL with + `./configure --enable-all --enable-static CFLAGS='-DRSA_MIN_SIZE=512'` + (wolfSSL master or a release that provides `EVP_PKEY_dup`). Add + `--enable-debug` for debugging. ++ `make` and `sudo make install` wolfSSL into /usr/local. ++ Clone libspdm with `git clone --branch 3.8.2 https://github.com/DMTF/libspdm.git` + and `cd libspdm`. ++ Apply the patch with `patch -p1 < /libspdm/3.8.2/libspdm-3.8.2.patch`. ++ Set up the git submodules with `git submodule update --init --recursive`. ++ `mkdir build && cd build`. ++ Run cmake with + `cmake -DARCH=x64 -DTOOLCHAIN=GCC -DTARGET=Debug -DCRYPTO=wolfssl -DENABLE_BINARY_BUILD=1 -DCOMPILED_LIBWOLFSSL_PATH=/usr/local/lib/libwolfssl.a -DWOLFSSL_INCDIR=/usr/local/include ..` + (settings for a Linux x64 GCC build). ++ Compile with `make`. ++ Run the tests from `unit_test/sample_key`: + `../../build/bin/test_crypt`, `../../build/bin/test_spdm_secured_message` + and `../../build/bin/test_spdm_crypt`. They should all pass. + +The patch also adds the `spdm_unit_test.h` include that upstream's +`unit_test/test_spdm_secured_message/test_spdm_secured_message.c` is missing. +Without it `LIBSPDM_AEAD_AES_256_GCM_SUPPORT` is 0 in `main()` and the binary +runs none of its 12 cmocka cases. + +SM2/SM3/SM4 and EdDSA (Ed25519/Ed448) are disabled for the wolfSSL build +(see the patch commit message). diff --git a/libspdm/3.8.2/libspdm-3.8.2.patch b/libspdm/3.8.2/libspdm-3.8.2.patch new file mode 100644 index 000000000..4aad90de6 --- /dev/null +++ b/libspdm/3.8.2/libspdm-3.8.2.patch @@ -0,0 +1,535 @@ +From 56d0eaca0b590835883d1a79721e5cc4b6fa7633 Mon Sep 17 00:00:00 2001 +From: Juliusz Sosinowicz +Date: Fri, 4 Sep 2026 12:03:56 +0000 +Subject: [PATCH] wolfSSL Patch + +This patch implements wolfSSL support in libspdm 3.8.2. + +Compile wolfSSL with (master, or a release that has EVP_PKEY_dup): + ./configure --enable-all --enable-static CFLAGS='-DRSA_MIN_SIZE=512' + make + make install + +Compile libspdm with: + patch -p1 < libspdm-3.8.2.patch + git submodule update --init --recursive + mkdir build + cd build + cmake -DARCH=x64 -DTOOLCHAIN=GCC -DTARGET=Debug -DCRYPTO=wolfssl -DENABLE_BINARY_BUILD=1 -DCOMPILED_LIBWOLFSSL_PATH=/usr/local/lib/libwolfssl.a -DWOLFSSL_INCDIR=/usr/local/include .. + make + +Run the tests from unit_test/sample_key: + cd ../unit_test/sample_key + ../../build/bin/test_crypt + ../../build/bin/test_spdm_secured_message + ../../build/bin/test_spdm_crypt + +All three binaries pass. + +unit_test/test_spdm_secured_message/test_spdm_secured_message.c includes no +libspdm header upstream, so LIBSPDM_AEAD_AES_256_GCM_SUPPORT is 0 in main() +and none of its 12 cmocka cases ever run. The patch adds the missing +spdm_unit_test.h include so the binary really exercises AES-256-GCM. + +SM2 DSA/key exchange, SM3 and SM4-GCM are disabled for the wolfSSL build +(SPDM_USING_WOLFSSL) because wolfSSL has no EVP layer support for ShangMi. +EdDSA (Ed25519/Ed448) is disabled by ENABLE_BINARY_BUILD=1 (upstream +behaviour) and the EdDSA PEM/X509 loaders return false under wolfSSL. The +corresponding test_crypt cases are compiled out. + +The CSR generator builds the basicConstraints extension with +X509V3_EXT_nconf_nid() instead of X509V3_EXT_conf_nid(), which wolfSSL only +stubs. Both take the same value string and neither needs a configuration +database or an X509V3_CTX, so the call is not guarded and the OpenSSL build +is unchanged. + +When building for FIPS or with wolfSSL releases 5.7.2 and older add +`CPPFLAGS=-DRSA_LOW_MEM` to the wolfSSL configuration: + ./configure --enable-all CPPFLAGS=-DRSA_LOW_MEM + +To debug the binary, configure wolfSSL with `--enable-debug` and libspdm with +`-DTARGET=Debug` +--- + CMakeLists.txt | 39 +++++++++++++++- + include/library/spdm_lib_config.h | 16 +++++++ + os_stub/cryptlib_openssl/CMakeLists.txt | 27 ++++++++--- + os_stub/cryptlib_openssl/hmac/hmac_sha.c | 2 + + os_stub/cryptlib_openssl/hmac/hmac_sha3.c | 1 + + os_stub/cryptlib_openssl/internal_crypt_lib.h | 2 + + os_stub/cryptlib_openssl/pem/pem.c | 5 +++ + os_stub/cryptlib_openssl/pk/ec.c | 1 + + os_stub/cryptlib_openssl/pk/rsa_ext.c | 6 +++ + os_stub/cryptlib_openssl/pk/x509.c | 45 ++++++++++++++++--- + .../test_spdm_secured_message.c | 2 + + 11 files changed, 134 insertions(+), 12 deletions(-) + +diff --git a/CMakeLists.txt b/CMakeLists.txt +index 6363199..ee3f928 100644 +--- a/CMakeLists.txt ++++ b/CMakeLists.txt +@@ -11,11 +11,20 @@ message("#########################") + message("## Build Configuration ##") + message("#########################") + ++if(CRYPTO STREQUAL "wolfssl" OR IS_WOLFSSL STREQUAL "1") ++ set(IS_WOLFSSL "1" CACHE INTERNAL "wolfSSL selected as the crypto backend") ++ set(CRYPTO "openssl") ++ add_definitions(-DSPDM_USING_WOLFSSL) ++ if(NOT ENABLE_BINARY_BUILD STREQUAL "1") ++ message(FATAL_ERROR "CRYPTO=wolfssl needs ENABLE_BINARY_BUILD=1 with COMPILED_LIBWOLFSSL_PATH and WOLFSSL_INCDIR") ++ endif() ++endif() ++ + set(CMAKE_GENERATOR ${CMAKE_GENERATOR} CACHE STRING "Choose the generator of cmake") + set(ARCH ${ARCH} CACHE STRING "Choose the arch of build: ia32 x64 arm aarch64 riscv32 riscv64 arc" FORCE) + set(TOOLCHAIN ${TOOLCHAIN} CACHE STRING "Choose the toolchain of build: Windows: VS2015 VS2019 VS2022 CLANG ARM_DS2022 LIBFUZZER Linux: GCC ARM_DS2022 ARM_GNU ARM_GNU_BARE_METAL ARM_GCC AARCH64_GCC RISCV_GNU RISCV64_GCC RISCV_XPACK ARC_GCC CLANG CBMC AFL KLEE LIBFUZZER" FORCE) + set(CMAKE_BUILD_TYPE ${TARGET} CACHE STRING "Choose the target of build: Debug Release" FORCE) +-set(CRYPTO ${CRYPTO} CACHE STRING "Choose the crypto of build: mbedtls openssl" FORCE) ++set(CRYPTO ${CRYPTO} CACHE STRING "Choose the crypto of build: mbedtls openssl wolfssl" FORCE) + set(GCOV ${GCOV} CACHE STRING "Choose the target of Gcov: ON OFF, and default is OFF" FORCE) + set(STACK_USAGE ${STACK_USAGE} CACHE STRING "Choose the target of STACK_USAGE: ON OFF, and default is OFF" FORCE) + set(BUILD_LINUX_SHARED_LIB ${BUILD_LINUX_SHARED_LIB} CACHE STRING "Choose if libspdm shared library should be built for linux: ON OFF, and default is OFF" FORCE) +@@ -179,9 +188,14 @@ endif() + + if(ENABLE_BINARY_BUILD STREQUAL "1") + if(NOT CRYPTO STREQUAL "openssl") +- message(FATAL_ERROR "enabling binary build not supported for non-openssl") ++ message(FATAL_ERROR "enabling binary build not supported for non-(openssl|wolfssl)") + endif() + ++ if(IS_WOLFSSL STREQUAL "1") ++ if(NOT COMPILED_LIBWOLFSSL_PATH) ++ message(FATAL_ERROR "enabling binary build requires path to libwolfssl.") ++ endif() ++ else() + if(NOT COMPILED_LIBCRYPTO_PATH) + message(FATAL_ERROR "enabling binary build requires path to libcrypto.") + endif() +@@ -189,6 +203,9 @@ if(ENABLE_BINARY_BUILD STREQUAL "1") + if(NOT COMPILED_LIBSSL_PATH) + message(FATAL_ERROR "enabling binary build requires path to libssl.") + endif() ++ endif() ++ ++ set(WOLFSSL_INCDIR ${WOLFSSL_INCDIR} CACHE STRING "Optionally provide a path to the wolfssl header directory" FORCE) + + # Disable EDDSA when binary builds are enabled. EDDSA may be enabled in the future. + add_definitions(-DLIBSPDM_EDDSA_ED25519_SUPPORT=0) +@@ -197,9 +214,14 @@ if(ENABLE_BINARY_BUILD STREQUAL "1") + message("ENABLE_BINARY_BUILD=1") + message("COMPILED_LIBCRYPTO_PATH=${COMPILED_LIBCRYPTO_PATH}") + message("COMPILED_LIBSSL_PATH=${COMPILED_LIBSSL_PATH}") ++ message("COMPILED_LIBWOLFSSL_PATH=${COMPILED_LIBWOLFSSL_PATH}") + message("Disabling EDDSA support due to ENABLE_BINARY_BUILD=1") + ++ if(IS_WOLFSSL STREQUAL "1") ++ set(CRYPTO_LIB_PATHS ${COMPILED_LIBWOLFSSL_PATH} -lm) ++ else() + set(CRYPTO_LIB_PATHS ${COMPILED_LIBCRYPTO_PATH} ${COMPILED_LIBSSL_PATH}) ++ endif() + + else() + set(CRYPTO_LIB_PATHS ${CRYPTO}lib) +@@ -1103,6 +1125,18 @@ else() + PUBLIC mbedcrypto + ) + elseif(CRYPTO STREQUAL "openssl") ++ if(IS_WOLFSSL STREQUAL "1") ++ set(CRYPTO_DEPS "-lwolfssl -lm") ++ if(TOOLCHAIN STREQUAL "NONE") ++ target_link_libraries(${LIB_NAME}_crypto ++ PUBLIC cryptlib_openssl ++ ) ++ else() ++ target_link_libraries(${LIB_NAME}_crypto ++ PUBLIC wolfssl ++ ) ++ endif() ++ else() + set(CRYPTO_DEPS "-lssl -lcrypto") + if(TOOLCHAIN STREQUAL "NONE") + target_link_libraries(${LIB_NAME}_crypto +@@ -1115,6 +1149,7 @@ else() + PUBLIC crypto + ) + endif() ++ endif() + endif() + + target_link_libraries(${LIB_NAME} +diff --git a/include/library/spdm_lib_config.h b/include/library/spdm_lib_config.h +index c79239a..5e82483 100644 +--- a/include/library/spdm_lib_config.h ++++ b/include/library/spdm_lib_config.h +@@ -286,8 +286,12 @@ + #endif + + #ifndef LIBSPDM_SM2_DSA_P256_SUPPORT ++#ifdef SPDM_USING_WOLFSSL /* No SM support in EVP layer */ ++#define LIBSPDM_SM2_DSA_P256_SUPPORT 0 ++#else + #define LIBSPDM_SM2_DSA_P256_SUPPORT 1 + #endif ++#endif + + #ifndef LIBSPDM_EDDSA_ED25519_SUPPORT + #define LIBSPDM_EDDSA_ED25519_SUPPORT 1 +@@ -317,8 +321,12 @@ + #endif + + #ifndef LIBSPDM_SM2_KEY_EXCHANGE_P256_SUPPORT ++#ifdef SPDM_USING_WOLFSSL ++#define LIBSPDM_SM2_KEY_EXCHANGE_P256_SUPPORT 0 ++#else + #define LIBSPDM_SM2_KEY_EXCHANGE_P256_SUPPORT 1 + #endif ++#endif + + #ifndef LIBSPDM_AEAD_AES_128_GCM_SUPPORT + #define LIBSPDM_AEAD_AES_128_GCM_SUPPORT 1 +@@ -332,8 +340,12 @@ + #endif + + #ifndef LIBSPDM_AEAD_SM4_128_GCM_SUPPORT ++#ifdef SPDM_USING_WOLFSSL ++#define LIBSPDM_AEAD_SM4_128_GCM_SUPPORT 0 ++#else + #define LIBSPDM_AEAD_SM4_128_GCM_SUPPORT 1 + #endif ++#endif + + #ifndef LIBSPDM_SHA256_SUPPORT + #define LIBSPDM_SHA256_SUPPORT 1 +@@ -356,8 +368,12 @@ + #endif + + #ifndef LIBSPDM_SM3_256_SUPPORT ++#ifdef SPDM_USING_WOLFSSL ++#define LIBSPDM_SM3_256_SUPPORT 0 ++#else + #define LIBSPDM_SM3_256_SUPPORT 1 + #endif ++#endif + + /* If 1 then endpoint supports parsing X.509 certificate chains. */ + #ifndef LIBSPDM_CERT_PARSE_SUPPORT +diff --git a/os_stub/cryptlib_openssl/CMakeLists.txt b/os_stub/cryptlib_openssl/CMakeLists.txt +index cad55ae..df08fae 100644 +--- a/os_stub/cryptlib_openssl/CMakeLists.txt ++++ b/os_stub/cryptlib_openssl/CMakeLists.txt +@@ -2,6 +2,19 @@ cmake_minimum_required(VERSION 3.5) + + add_library(cryptlib_openssl STATIC "") + ++if (IS_WOLFSSL STREQUAL "1") ++message("WOLFSSL_INCDIR = ${WOLFSSL_INCDIR}") ++add_definitions(-DWOLFSSL_USE_OPTIONS_H) ++target_include_directories(cryptlib_openssl ++ PRIVATE ++ ${LIBSPDM_DIR}/include ++ ${LIBSPDM_DIR}/include/hal ++ ${LIBSPDM_DIR}/os_stub/include ++ ${LIBSPDM_DIR}/os_stub/cryptlib_openssl ++ ${WOLFSSL_INCDIR} ++ ${WOLFSSL_INCDIR}/wolfssl ++) ++else() + target_include_directories(cryptlib_openssl + PRIVATE + ${LIBSPDM_DIR}/include +@@ -14,27 +27,31 @@ target_include_directories(cryptlib_openssl + ${LIBSPDM_DIR}/os_stub/openssllib/openssl/crypto/include + ${LIBSPDM_DIR}/os_stub/openssllib/openssl + ) ++target_sources(cryptlib_openssl ++ PRIVATE ++ cipher/aead_sm4_gcm.c ++ hash/sm3.c ++ kdf/hkdf_sm3.c ++ hmac/hmac_sm3.c ++ pk/sm2.c ++) ++endif() + + target_sources(cryptlib_openssl + PRIVATE + cipher/aead_aes_gcm.c + cipher/aead_chacha20_poly1305.c +- cipher/aead_sm4_gcm.c + der/der.c + hash/sha.c + hash/sha3.c +- hash/sm3.c + hmac/hmac_sha.c + hmac/hmac_sha3.c +- hmac/hmac_sm3.c + kdf/hkdf_sha.c + kdf/hkdf_sha3.c +- kdf/hkdf_sm3.c + pem/pem.c + pk/ec.c + pk/ecd.c + pk/dh.c +- pk/sm2.c + pk/rsa_basic.c + pk/rsa_ext.c + pk/x509.c +diff --git a/os_stub/cryptlib_openssl/hmac/hmac_sha.c b/os_stub/cryptlib_openssl/hmac/hmac_sha.c +index 12d5d6c..229271d 100644 +--- a/os_stub/cryptlib_openssl/hmac/hmac_sha.c ++++ b/os_stub/cryptlib_openssl/hmac/hmac_sha.c +@@ -10,6 +10,8 @@ + + #include "internal_crypt_lib.h" + #include ++#include ++#include + + /** + * Allocates and initializes one HMAC_CTX context for subsequent HMAC-MD use. +diff --git a/os_stub/cryptlib_openssl/hmac/hmac_sha3.c b/os_stub/cryptlib_openssl/hmac/hmac_sha3.c +index ed2fdda..7eca0c5 100644 +--- a/os_stub/cryptlib_openssl/hmac/hmac_sha3.c ++++ b/os_stub/cryptlib_openssl/hmac/hmac_sha3.c +@@ -10,6 +10,7 @@ + + #include "internal_crypt_lib.h" + #include ++#include + + void *hmac_md_new(void); + void hmac_md_free(void *hmac_md_ctx); +diff --git a/os_stub/cryptlib_openssl/internal_crypt_lib.h b/os_stub/cryptlib_openssl/internal_crypt_lib.h +index d7a4fdf..dc3830c 100644 +--- a/os_stub/cryptlib_openssl/internal_crypt_lib.h ++++ b/os_stub/cryptlib_openssl/internal_crypt_lib.h +@@ -18,7 +18,9 @@ + #include "library/cryptlib.h" + #include "library/spdm_crypt_lib.h" + ++#ifndef SPDM_USING_WOLFSSL + #include "crt_support.h" ++#endif + + #include + +diff --git a/os_stub/cryptlib_openssl/pem/pem.c b/os_stub/cryptlib_openssl/pem/pem.c +index 0f9a28e..922d368 100644 +--- a/os_stub/cryptlib_openssl/pem/pem.c ++++ b/os_stub/cryptlib_openssl/pem/pem.c +@@ -232,6 +232,10 @@ bool libspdm_ecd_get_private_key_from_pem(const uint8_t *pem_data, + const char *password, + void **ecd_context) + { ++#ifdef SPDM_USING_WOLFSSL ++ /* No ED support in EVP layer */ ++ return false; ++#else + bool status; + BIO *pem_bio; + EVP_PKEY *pkey; +@@ -292,6 +296,7 @@ done: + BIO_free(pem_bio); + + return status; ++#endif + } + + /** +diff --git a/os_stub/cryptlib_openssl/pk/ec.c b/os_stub/cryptlib_openssl/pk/ec.c +index c540dac..1d8f3cc 100644 +--- a/os_stub/cryptlib_openssl/pk/ec.c ++++ b/os_stub/cryptlib_openssl/pk/ec.c +@@ -15,6 +15,7 @@ + #include + #include + #include ++#include + + /** + * Allocates and Initializes one Elliptic Curve context for subsequent use +diff --git a/os_stub/cryptlib_openssl/pk/rsa_ext.c b/os_stub/cryptlib_openssl/pk/rsa_ext.c +index ae3c8d8..8f0ecd7 100644 +--- a/os_stub/cryptlib_openssl/pk/rsa_ext.c ++++ b/os_stub/cryptlib_openssl/pk/rsa_ext.c +@@ -247,6 +247,7 @@ bool libspdm_rsa_check_key(void *rsa_context) + } + + if (RSA_check_key((RSA *)rsa_context) != 1) { ++#ifndef SPDM_USING_WOLFSSL + reason = ERR_GET_REASON(ERR_peek_last_error()); + if (reason == RSA_R_P_NOT_PRIME || + reason == RSA_R_Q_NOT_PRIME || +@@ -254,6 +255,11 @@ bool libspdm_rsa_check_key(void *rsa_context) + reason == RSA_R_D_E_NOT_CONGRUENT_TO_1) { + return false; + } ++#else ++ /* wolfSSL does not set a reason */ ++ (void)reason; ++ return false; ++#endif + } + + return true; +diff --git a/os_stub/cryptlib_openssl/pk/x509.c b/os_stub/cryptlib_openssl/pk/x509.c +index ee2659e..db416a3 100644 +--- a/os_stub/cryptlib_openssl/pk/x509.c ++++ b/os_stub/cryptlib_openssl/pk/x509.c +@@ -74,6 +74,19 @@ bool libspdm_x509_construct_certificate(const uint8_t *cert, size_t cert_size, + return true; + } + ++#ifndef LIBSPDM_VA_LIST ++#define LIBSPDM_VA_LIST va_list ++#endif ++#ifndef LIBSPDM_VA_ARG ++#define LIBSPDM_VA_ARG va_arg ++#endif ++#ifndef LIBSPDM_VA_START ++#define LIBSPDM_VA_START va_start ++#endif ++#ifndef LIBSPDM_VA_END ++#define LIBSPDM_VA_END va_end ++#endif ++ + /** + * Construct a X509 stack object from a list of DER-encoded certificate data. + * +@@ -1128,7 +1141,12 @@ bool libspdm_x509_get_validity(const uint8_t *cert, size_t cert_size, + goto done; + } + +- f_size = sizeof(ASN1_TIME) + f_time->length; ++ /* WOLFSSL_ASN1_TIME has not pointer so it can be directly copied */ ++ f_size = sizeof(ASN1_TIME) ++#ifndef SPDM_USING_WOLFSSL ++ + f_time->length ++#endif ++ ; + if (*from_size < f_size) { + *from_size = f_size; + res = false; +@@ -1136,14 +1154,20 @@ bool libspdm_x509_get_validity(const uint8_t *cert, size_t cert_size, + } + if (from != NULL) { + libspdm_copy_mem(from, *from_size, f_time, sizeof(ASN1_TIME)); ++#ifndef SPDM_USING_WOLFSSL + ((ASN1_TIME *)from)->data = from + sizeof(ASN1_TIME); + libspdm_copy_mem(from + sizeof(ASN1_TIME), + *from_size - sizeof(ASN1_TIME), + f_time->data, f_time->length); ++#endif + } + *from_size = f_size; + +- t_size = sizeof(ASN1_TIME) + t_time->length; ++ t_size = sizeof(ASN1_TIME) ++#ifndef SPDM_USING_WOLFSSL ++ + t_time->length ++#endif ++ ; + if (*to_size < t_size) { + *to_size = t_size; + res = false; +@@ -1151,10 +1175,12 @@ bool libspdm_x509_get_validity(const uint8_t *cert, size_t cert_size, + } + if (to != NULL) { + libspdm_copy_mem(to, *to_size, t_time, sizeof(ASN1_TIME)); ++#ifndef SPDM_USING_WOLFSSL + ((ASN1_TIME *)to)->data = to + sizeof(ASN1_TIME); + libspdm_copy_mem(to + sizeof(ASN1_TIME), + *to_size - sizeof(ASN1_TIME), + t_time->data, t_time->length); ++#endif + } + *to_size = t_size; + +@@ -1223,11 +1249,13 @@ bool libspdm_x509_set_date_time(const char *date_time_str, void *date_time, size + } + if (date_time != NULL) { + libspdm_copy_mem(date_time, *date_time_size, dt, sizeof(ASN1_TIME)); ++#ifndef SPDM_USING_WOLFSSL + ((ASN1_TIME *)date_time)->data = + (uint8_t *)date_time + sizeof(ASN1_TIME); + libspdm_copy_mem((uint8_t *)date_time + sizeof(ASN1_TIME), + *date_time_size - sizeof(ASN1_TIME), + dt->data, dt->length); ++#endif + } + *date_time_size = d_size; + status = true; +@@ -1365,7 +1393,7 @@ bool libspdm_x509_get_extension_data(const uint8_t *cert, size_t cert_size, + /* Retrieve extensions from certificate object.*/ + + extensions = X509_get0_extensions(x509_cert); +- if (sk_X509_EXTENSION_num(extensions) <= 0) { ++ if (sk_X509_EXTENSION_num((STACK_OF(X509_EXTENSION)*)extensions) <= 0) { + *extension_data_size = 0; + goto cleanup; + } +@@ -1375,7 +1403,7 @@ bool libspdm_x509_get_extension_data(const uint8_t *cert, size_t cert_size, + status = false; + asn1_oct = NULL; + oct_length = 0; +- for (i = 0; i < sk_X509_EXTENSION_num(extensions); i++) { ++ for (i = 0; i < sk_X509_EXTENSION_num((STACK_OF(X509_EXTENSION)*)extensions); i++) { + ext = sk_X509_EXTENSION_value(extensions, (int)i); + if (ext == NULL) { + continue; +@@ -1661,6 +1689,10 @@ done: + bool libspdm_ecd_get_public_key_from_x509(const uint8_t *cert, size_t cert_size, + void **ecd_context) + { ++#ifdef SPDM_USING_WOLFSSL ++ /* No ED support in EVP layer */ ++ return false; ++#else + bool res; + EVP_PKEY *pkey; + X509 *x509_cert; +@@ -1711,6 +1743,7 @@ done: + } + + return res; ++#endif + } + + /** +@@ -2646,9 +2679,11 @@ bool libspdm_gen_x509_csr(size_t hash_nid, size_t asym_nid, + case LIBSPDM_CRYPTO_NID_SHA3_512: + md = EVP_sha3_512(); + break; ++#ifndef SPDM_USING_WOLFSSL + case LIBSPDM_CRYPTO_NID_SM3_256: + md = EVP_sm3(); + break; ++#endif + default: + ret = 0; + goto free_all; +@@ -2662,7 +2697,7 @@ bool libspdm_gen_x509_csr(size_t hash_nid, size_t asym_nid, + } + + /*set basicConstraints*/ +- basic_constraints_ext = X509V3_EXT_conf_nid( ++ basic_constraints_ext = X509V3_EXT_nconf_nid( + NULL, NULL, NID_basic_constraints, + is_ca ? "CA:TRUE" : "CA:FALSE"); + if (!basic_constraints_ext) { +diff --git a/unit_test/test_spdm_secured_message/test_spdm_secured_message.c b/unit_test/test_spdm_secured_message/test_spdm_secured_message.c +index deec943..9d6e43e 100644 +--- a/unit_test/test_spdm_secured_message/test_spdm_secured_message.c ++++ b/unit_test/test_spdm_secured_message/test_spdm_secured_message.c +@@ -4,6 +4,8 @@ + * License: BSD 3-Clause License. For full text see link: https://github.com/DMTF/libspdm/blob/main/LICENSE.md + **/ + ++#include "spdm_unit_test.h" ++ + extern int libspdm_secured_message_encode_decode_test_main(void); + + int main(void) +-- +2.43.0 + diff --git a/libvncserver/0.9.15.patch b/libvncserver/0.9.15.patch new file mode 100644 index 000000000..f60d2b84b --- /dev/null +++ b/libvncserver/0.9.15.patch @@ -0,0 +1,122 @@ +From cf3df3942ca7268634f6f390f30a72e297773d5b Mon Sep 17 00:00:00 2001 +From: Juliusz Sosinowicz +Date: Fri, 4 Sep 2026 11:03:06 +0000 +Subject: [PATCH] Patch for wolfSSL + +This patch implements wolfSSL support in libvncserver 0.9.15 with CMake. +The OpenSSL backends (crypto_openssl.c, tls_openssl.c, rfbssl_openssl.c) +are compiled against wolfSSL's OpenSSL compatibility layer. + +Compile wolfSSL with: + ./configure --enable-all + make + make install + +Compile libvncserver with: + patch -p1 < /path/to/osp/libvncserver/0.9.15.patch + cmake -DCMAKE_POLICY_VERSION_MINIMUM=3.5 -B build -DWITH_GNUTLS=OFF -DWITH_OPENSSL=OFF -DWITH_GCRYPT=OFF -DWITH_WOLFSSL=ON . + make -C build + make -C build install + +To link with wolfSSL in a non-standard directory compile with: + PKG_CONFIG_PATH=/path/to/dir/with/pkgconfig/file cmake -DCMAKE_POLICY_VERSION_MINIMUM=3.5 -B build -DWITH_GNUTLS=OFF -DWITH_OPENSSL=OFF -DWITH_GCRYPT=OFF -DWITH_WOLFSSL=ON . + +Run tests with: + make -C build test + +All tests (cargs, includetest, turbojpeg, wstest) are expected to pass. +The turbojpeg test is only built when libjpeg-turbo is found. +--- + CMakeLists.txt | 34 +++++++++++++++++++++++++++++++++- + 1 file changed, 33 insertions(+), 1 deletion(-) + +diff --git a/CMakeLists.txt b/CMakeLists.txt +index 205f392..76547ae 100644 +--- a/CMakeLists.txt ++++ b/CMakeLists.txt +@@ -64,6 +64,7 @@ option(WITH_THREADS "Search for a threading library to build with multithreading + option(PREFER_WIN32THREADS "When searching for a threading library, prefer win32 threads if they are found" OFF) + option(WITH_GNUTLS "Search for the GnuTLS secure communications library to support TLS" ON) + option(WITH_OPENSSL "Search for the OpenSSL cryptography library to support TLS and use as crypto backend" ON) ++option(WITH_WOLFSSL "Search for the wolfSSL cryptography library to support TLS and use as crypto backend" ON) + option(WITH_SYSTEMD "Search for libsystemd to build with systemd socket activation support" ON) + option(WITH_GCRYPT "Search for Libgcrypt to use as crypto backend" ON) + option(WITH_FFMPEG "Search for FFMPEG to build an example VNC to MPEG encoder" ON) +@@ -182,6 +183,16 @@ if(WITH_OPENSSL) + find_package(OpenSSL) + endif(WITH_OPENSSL) + ++if(WITH_WOLFSSL AND NOT GNUTLS_FOUND AND NOT OPENSSL_FOUND) ++ find_package(PkgConfig) ++ if(PKG_CONFIG_FOUND) ++ pkg_check_modules(WOLFSSL "wolfssl") ++ endif(PKG_CONFIG_FOUND) ++ if(WOLFSSL_FOUND) ++ link_directories(${WOLFSSL_LIBRARY_DIRS}) ++ endif(WOLFSSL_FOUND) ++endif() ++ + + if(WITH_SYSTEMD AND NOT ANDROID AND NOT WIN32) + find_package(PkgConfig) +@@ -290,6 +301,10 @@ elseif(OPENSSL_FOUND) + message(STATUS "Building crypto with OpenSSL") + set(CRYPTO_LIBRARIES ${OPENSSL_LIBRARIES}) + set(CRYPTO_SOURCES ${COMMON_DIR}/crypto_openssl.c) ++elseif(WOLFSSL_FOUND) ++ message(STATUS "Building crypto with wolfSSL") ++ set(CRYPTO_LIBRARIES ${WOLFSSL_LIBRARIES}) ++ set(CRYPTO_SOURCES ${COMMON_DIR}/crypto_openssl.c) + else() + message(STATUS "Building crypto with builtin functions, only including SHA1 and D3DES") + set(CRYPTO_SOURCES ${COMMON_DIR}/crypto_included.c ${COMMON_DIR}/sha1.c ${COMMON_DIR}/d3des.c) +@@ -310,7 +325,11 @@ endif(GNUTLS_FOUND) + if(OPENSSL_FOUND) + include_directories(${OPENSSL_INCLUDE_DIR}) + set(LIBVNCSERVER_HAVE_LIBSSL 1) +-endif(OPENSSL_FOUND) ++elseif(WOLFSSL_FOUND) ++ include_directories("${WOLFSSL_INCLUDE_DIRS}" "${WOLFSSL_INCLUDEDIR}/wolfssl") ++ set(LIBVNCSERVER_HAVE_LIBSSL 1) ++ add_definitions(-DEXTERNAL_OPTS_OPENVPN -DOPENSSL_VERSION_NUMBER=0x10001040L) ++endif() + + if(WITH_IPv6) + if(WIN32 AND LIBVNCSERVER_HAVE_WS2TCPIP_H AND LIBVNCSERVER_HAVE_VPRINTF) +@@ -448,6 +467,17 @@ elseif(OPENSSL_FOUND) + ${LIBVNCSERVER_DIR}/rfbssl_openssl.c + ) + include_directories(${OPENSSL_INCLUDE_DIR}) ++elseif(WOLFSSL_FOUND) ++ message(STATUS "Building TLS with wolfSSL") ++ set(LIBVNCCLIENT_SOURCES ++ ${LIBVNCCLIENT_SOURCES} ++ ${LIBVNCCLIENT_DIR}/tls_openssl.c ++ ) ++ set(LIBVNCSERVER_SOURCES ++ ${LIBVNCSERVER_SOURCES} ++ ${LIBVNCSERVER_DIR}/rfbssl_openssl.c ++ ) ++ include_directories("${WOLFSSL_INCLUDE_DIRS}" "${WOLFSSL_INCLUDEDIR}/wolfssl") + else() + message(STATUS "Building without TLS") + set(LIBVNCCLIENT_SOURCES +@@ -548,6 +578,7 @@ target_link_libraries(vncclient + ${CRYPTO_LIBRARIES} + ${GNUTLS_LIBRARIES} + ${OPENSSL_LIBRARIES} ++ ${WOLFSSL_LIBRARIES} + ) + target_link_libraries(vncserver + ${ADDITIONAL_LIBS} +@@ -558,6 +589,7 @@ target_link_libraries(vncserver + ${CRYPTO_LIBRARIES} + ${GNUTLS_LIBRARIES} + ${OPENSSL_LIBRARIES} ++ ${WOLFSSL_LIBRARIES} + ) + + SET_TARGET_PROPERTIES(vncclient vncserver +-- +2.43.0 + diff --git a/msmtp/1.8.28/README.md b/msmtp/1.8.28/README.md index eaec1a276..6d307a83c 100644 --- a/msmtp/1.8.28/README.md +++ b/msmtp/1.8.28/README.md @@ -7,3 +7,7 @@ + Regenerate the configure script with `autoreconf -ivf`. + Configure msmtp with `./configure --with-tls=wolfssl`. + Run `make` to compile. ++ Run `make check` to run the tests (`tests/test-basic.sh`, `tests/test-auth-plain.sh`, `tests/test-header-handling.sh`). All three are expected to pass. They do not exercise TLS: `test-basic.sh` only runs `msmtp --version` and `--help`, the other two exchange mail with `msmtpd` over plain SMTP. They also need an IPv6 loopback because `msmtpd` is bound to `::1`. ++ wolfSSL verifies the peer certificate during the handshake while OpenSSL leaves that to the application. msmtp does its own checking after the handshake, so the patch turns verification off for the `tls_fingerprint` and disabled `tls_certcheck` cases, which would otherwise abort the handshake, and turns it on explicitly for `tls_trust_file` accounts so that the result does not depend on the library default. ++ `msmtp --version` reports `TLS/SSL library: wolfSSL`. ++ TLS was verified by hand against a local TLS SMTP server: `tls_trust_file`, `tls_fingerprint` and a disabled `tls_certcheck` connect, while a wrong CA, a wrong fingerprint and a hostname mismatch are rejected, with and without STARTTLS. diff --git a/msmtp/1.8.28/wolfssl-msmtp-1.8.28.patch b/msmtp/1.8.28/wolfssl-msmtp-1.8.28.patch index fa5e5fd6b..6c71430f9 100644 --- a/msmtp/1.8.28/wolfssl-msmtp-1.8.28.patch +++ b/msmtp/1.8.28/wolfssl-msmtp-1.8.28.patch @@ -94,8 +94,21 @@ index fcd18e3..0313014 100644 AM_CPPFLAGS = $(tls_CFLAGS) $(libgsasl_CFLAGS) $(libidn2_CFLAGS) $(libsecret_CFLAGS) +diff --git a/src/msmtp.c b/src/msmtp.c +index a0ce6a7..888aee9 100644 +--- a/src/msmtp.c ++++ b/src/msmtp.c +@@ -2192,6 +2192,8 @@ void msmtp_print_version(void) + "OpenSSL" + #elif defined (HAVE_LIBTLS) + "libtls" ++#elif defined (HAVE_LIBWOLFSSL) ++ "wolfSSL" + #else + _("none") + #endif diff --git a/src/mtls-openssl.c b/src/mtls-openssl.c -index 976d72b..9c05351 100644 +index 976d72b..f1b0698 100644 --- a/src/mtls-openssl.c +++ b/src/mtls-openssl.c @@ -41,9 +41,13 @@ @@ -121,3 +134,26 @@ index 976d72b..9c05351 100644 SSL_load_error_strings(); SSL_library_init(); #endif +@@ -754,6 +758,22 @@ int mtls_init(mtls_t *mtls, + memcpy(mtls->fingerprint, md5_fingerprint, 16); + mtls->have_md5_fingerprint = 1; + } ++#ifdef HAVE_LIBWOLFSSL ++ /* wolfSSL verifies the peer certificate during the handshake, OpenSSL does ++ * not. Turn that off where msmtp does its own checking afterwards, so that ++ * tls_fingerprint and a disabled tls_certcheck keep working. */ ++ if (no_certcheck || mtls->have_sha256_fingerprint ++ || mtls->have_sha1_fingerprint || mtls->have_md5_fingerprint) ++ { ++ SSL_CTX_set_verify(mtls->internals->ssl_ctx, SSL_VERIFY_NONE, NULL); ++ } ++ else ++ { ++ /* Do not depend on the library default: a tls_trust_file account ++ * must be verified during the handshake. */ ++ SSL_CTX_set_verify(mtls->internals->ssl_ctx, SSL_VERIFY_PEER, NULL); ++ } ++#endif + if (!(mtls->internals->ssl = SSL_new(mtls->internals->ssl_ctx))) + { + *errstr = xasprintf(_("cannot create a TLS structure: %s"), diff --git a/msmtp/1.8.32/README.md b/msmtp/1.8.32/README.md new file mode 100644 index 000000000..f4baf787d --- /dev/null +++ b/msmtp/1.8.32/README.md @@ -0,0 +1,13 @@ +# Building msmtp with wolfSSL ++ Configure wolfSSL with `./configure --enable-opensslextra --enable-opensslall`. Add `--enable-debug` if you're going to be debugging. ++ `make` and `sudo make install` wolfSSL into /usr/local. ++ Download msmtp-1.8.32 with `curl -O https://marlam.de/msmtp/releases/msmtp-1.8.32.tar.xz`. ++ Unarchive this tar ball with `tar xvf msmtp-1.8.32.tar.xz`. `cd msmtp-1.8.32`. ++ Apply the wolfssl-msmtp-1.8.32.patch file with `patch -p1 < wolfssl-msmtp-1.8.32.patch` (assuming the patch file is in the msmtp-1.8.32 directory; adjust the path according to your situation). ++ Regenerate the configure script with `autoreconf -ivf`. ++ Configure msmtp with `./configure --with-tls=wolfssl`. ++ Run `make` to compile. ++ Run `make check` to run the tests (`tests/test-basic.sh`, `tests/test-auth-plain.sh`, `tests/test-header-handling.sh`). All three are expected to pass. They do not exercise TLS: `test-basic.sh` only runs `msmtp --version` and `--help`, the other two exchange mail with `msmtpd` over plain SMTP. They also need an IPv6 loopback because `msmtpd` is bound to `::1`. ++ wolfSSL verifies the peer certificate during the handshake while OpenSSL leaves that to the application. msmtp does its own checking after the handshake, so the patch turns verification off for the `tls_fingerprint` and disabled `tls_certcheck` cases, which would otherwise abort the handshake, and turns it on explicitly for `tls_trust_file` accounts so that the result does not depend on the library default. ++ `msmtp --version` reports `TLS/SSL library: wolfSSL`. ++ TLS was verified by hand against a local TLS SMTP server: `tls_trust_file`, `tls_fingerprint` and a disabled `tls_certcheck` connect, while a wrong CA, a wrong fingerprint and a hostname mismatch are rejected, with and without STARTTLS. diff --git a/msmtp/1.8.32/wolfssl-msmtp-1.8.32.patch b/msmtp/1.8.32/wolfssl-msmtp-1.8.32.patch new file mode 100644 index 000000000..f1245c571 --- /dev/null +++ b/msmtp/1.8.32/wolfssl-msmtp-1.8.32.patch @@ -0,0 +1,217 @@ +From 87080a09b4bf8c488f70e8321e13116e4de798f7 Mon Sep 17 00:00:00 2001 +From: Juliusz Sosinowicz +Date: Fri, 4 Sep 2026 11:09:11 +0000 +Subject: [PATCH] wolfSSL Patch + +This patch adds wolfSSL support to msmtp 1.8.32. It adds +--with-tls=wolfssl to configure.ac (pkg-config probe, HAVE_LIBWOLFSSL, +HAVE_WOLFSSL automake conditional) and reuses src/mtls-openssl.c +through wolfSSL's OpenSSL compatibility layer. + +wolfSSL verifies the peer certificate during the handshake while OpenSSL +leaves that to the application. msmtp does its own checking after the +handshake, so verification is turned off for the tls_fingerprint and +disabled tls_certcheck cases, which would otherwise abort the handshake. +A configured tls_trust_file keeps wolfSSL's stricter default. + +Compile wolfSSL with: + ./configure --enable-opensslextra --enable-opensslall + make + make install + +Compile msmtp with: + patch -p1 < wolfssl-msmtp-1.8.32.patch + autoreconf -ivf + PKG_CONFIG_PATH=/usr/local/lib/pkgconfig ./configure --with-tls=wolfssl + make + +Run the tests with: + LD_LIBRARY_PATH=/usr/local/lib make check + +Tests passed: +- tests/test-basic.sh +- tests/test-auth-plain.sh +- tests/test-header-handling.sh + +The tests do not use TLS: test-basic.sh only runs msmtp --version and +--help, the other two exchange mail with msmtpd over plain SMTP. They +bind msmtpd to ::1 and fail with "Address family not supported by +protocol" on hosts without IPv6 loopback; they pass on IPv4 when ::1 is +replaced by 127.0.0.1. + +TLS itself was checked by hand against a local TLS SMTP server: +tls_trust_file, tls_fingerprint and a disabled tls_certcheck all +connect, and a wrong CA, a wrong fingerprint and a hostname mismatch are +all rejected, both with and without STARTTLS. + +Confirm the binary links against wolfSSL with: + ldd src/msmtp | grep wolfssl +--- + configure.ac | 33 ++++++++++++++++++++++++++++++--- + src/Makefile.am | 3 +++ + src/msmtp.c | 2 ++ + src/mtls-openssl.c | 22 +++++++++++++++++++++- + 4 files changed, 56 insertions(+), 4 deletions(-) + +diff --git a/configure.ac b/configure.ac +index d180cd9..10a5e18 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -95,33 +95,44 @@ want_tls="yes" + want_gnutls="yes" + want_openssl="no" + want_libtls="no" ++want_wolfssl="no" + tls_CFLAGS="" + tls_LIBS="" + with_ssl_was_used=no +-AC_ARG_WITH([tls], [AS_HELP_STRING([--with-tls=[gnutls|openssl|libtls|no]], +- [TLS support: GnuTLS (default), OpenSSL (discouraged), libtls, or none.])], ++AC_ARG_WITH([tls], [AS_HELP_STRING([--with-tls=[gnutls|openssl|wolfssl|libtls|no]], ++ [TLS support: GnuTLS (default), OpenSSL (discouraged), wolfSSL, libtls, or none.])], + if test "$withval" = "gnutls"; then + want_tls=yes + want_gnutls=yes + want_openssl=no + want_libtls=no ++ want_wolfssl=no + elif test "$withval" = "openssl"; then + want_tls=yes + want_gnutls=no + want_openssl=yes + want_libtls=no ++ want_wolfssl=no ++ elif test "$withval" = "wolfssl"; then ++ want_tls=yes ++ want_gnutls=no ++ want_openssl=no ++ want_libtls=no ++ want_wolfssl=yes + elif test "$withval" = "libtls"; then + want_tls=yes + want_gnutls=no + want_openssl=no + want_libtls=yes ++ want_wolfssl=no + elif test "$withval" = "no"; then + want_tls=no + want_gnutls=no + want_openssl=no + want_libtls=no ++ want_wolfssl=no + else +- AC_MSG_ERROR([Use --with-tls=gnutls or --with-tls=openssl or --with-tls=libtls or --with-tls=no]) ++ AC_MSG_ERROR([Use --with-tls=gnutls or --with-tls=openssl or --with-tls=wolfssl or --with-tls=libtls or --with-tls=no]) + fi) + if test "$want_gnutls" = "yes"; then + PKG_CHECK_MODULES([libgnutls], [gnutls >= 3.7.2], [HAVE_LIBGNUTLS=1], [HAVE_LIBGNUTLS=0]) +@@ -166,6 +177,21 @@ if test "$want_libtls" = "yes" -a "$have_tls" = "no"; then + AC_DEFINE([HAVE_LIBTLS], [1], [Define to 1 if libtls is available]) + fi + fi ++if test "$want_wolfssl" = "yes" -a "$have_tls" = "no"; then ++ PKG_CHECK_MODULES([libwolfssl], [wolfssl >= 0.0], [HAVE_LIBWOLFSSL=1], [HAVE_LIBWOLFSSL=0]) ++ if test "$HAVE_LIBWOLFSSL" != "1"; then ++ AC_MSG_WARN([library libwolfssl not found:]) ++ AC_MSG_WARN([$libwolfssl_PKG_ERRORS]) ++ AC_MSG_WARN([libwolfssl is provided by wolfSSL]) ++ else ++ have_tls="yes" ++ tls_lib="wolfSSL" ++ wolfssl_includedir=`$PKG_CONFIG --variable=includedir wolfssl` ++ tls_CFLAGS="$libwolfssl_CFLAGS -I${wolfssl_includedir}/wolfssl -DWOLFSSL_USE_OPTIONS_H" ++ tls_LIBS="$libwolfssl_LIBS" ++ AC_DEFINE([HAVE_LIBWOLFSSL], [1], [Define to 1 if libwolfssl is available]) ++ fi ++fi + if test "$have_tls" = "yes"; then + AC_DEFINE([HAVE_TLS], [1], [Define to 1 to build with TLS/SSL support]) + elif test "$want_tls" = "yes"; then +@@ -175,6 +201,7 @@ AM_CONDITIONAL([HAVE_TLS], [test "$have_tls" = "yes"]) + AM_CONDITIONAL([HAVE_GNUTLS], [test "$tls_lib" = "GnuTLS"]) + AM_CONDITIONAL([HAVE_OPENSSL], [test "$tls_lib" = "OpenSSL"]) + AM_CONDITIONAL([HAVE_LIBTLS], [test "$tls_lib" = "libtls"]) ++AM_CONDITIONAL([HAVE_WOLFSSL], [test "$tls_lib" = "wolfSSL"]) + AC_SUBST([tls_CFLAGS]) + AC_SUBST([tls_LIBS]) + +diff --git a/src/Makefile.am b/src/Makefile.am +index be9a60f..c27a82b 100644 +--- a/src/Makefile.am ++++ b/src/Makefile.am +@@ -32,6 +32,9 @@ endif + if HAVE_LIBTLS + msmtp_SOURCES += mtls-libtls.c + endif ++if HAVE_WOLFSSL ++msmtp_SOURCES += mtls-openssl.c ++endif + + AM_CPPFLAGS = $(tls_CFLAGS) $(libgsasl_CFLAGS) $(libidn2_CFLAGS) $(libsecret_CFLAGS) + +diff --git a/src/msmtp.c b/src/msmtp.c +index 2e7173f..fc95d6a 100644 +--- a/src/msmtp.c ++++ b/src/msmtp.c +@@ -2193,6 +2193,8 @@ void msmtp_print_version(void) + "OpenSSL" + #elif defined (HAVE_LIBTLS) + "libtls" ++#elif defined (HAVE_LIBWOLFSSL) ++ "wolfSSL" + #else + _("none") + #endif +diff --git a/src/mtls-openssl.c b/src/mtls-openssl.c +index 976d72b..f1b0698 100644 +--- a/src/mtls-openssl.c ++++ b/src/mtls-openssl.c +@@ -41,9 +41,13 @@ + #include + #include + #if OPENSSL_VERSION_NUMBER < 0x10100000L ++#ifndef X509_get0_notBefore + #define X509_get0_notBefore X509_get_notBefore ++#endif ++#ifndef X509_get0_notAfter + #define X509_get0_notAfter X509_get_notAfter + #endif ++#endif + + #ifdef HAVE_LIBIDN + # include +@@ -139,7 +143,7 @@ int mtls_lib_init(char **errstr) + { + int e; + +-#if OPENSSL_VERSION_NUMBER < 0x10100000L ++#if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(HAVE_LIBWOLFSSL) + SSL_load_error_strings(); + SSL_library_init(); + #endif +@@ -754,6 +758,22 @@ int mtls_init(mtls_t *mtls, + memcpy(mtls->fingerprint, md5_fingerprint, 16); + mtls->have_md5_fingerprint = 1; + } ++#ifdef HAVE_LIBWOLFSSL ++ /* wolfSSL verifies the peer certificate during the handshake, OpenSSL does ++ * not. Turn that off where msmtp does its own checking afterwards, so that ++ * tls_fingerprint and a disabled tls_certcheck keep working. */ ++ if (no_certcheck || mtls->have_sha256_fingerprint ++ || mtls->have_sha1_fingerprint || mtls->have_md5_fingerprint) ++ { ++ SSL_CTX_set_verify(mtls->internals->ssl_ctx, SSL_VERIFY_NONE, NULL); ++ } ++ else ++ { ++ /* Do not depend on the library default: a tls_trust_file account ++ * must be verified during the handshake. */ ++ SSL_CTX_set_verify(mtls->internals->ssl_ctx, SSL_VERIFY_PEER, NULL); ++ } ++#endif + if (!(mtls->internals->ssl = SSL_new(mtls->internals->ssl_ctx))) + { + *errstr = xasprintf(_("cannot create a TLS structure: %s"), +-- +2.43.0 + diff --git a/net-snmp/README.md b/net-snmp/README.md index 4ac41c355..859564db8 100644 --- a/net-snmp/README.md +++ b/net-snmp/README.md @@ -4,3 +4,30 @@ the patch names is: .patch Instructions for applying each patch are included in the patch commit message. + +## net-snmp 5.9.5 and newer + +Starting with net-snmp 5.9.5 the wolfSSL support is part of upstream net-snmp +(`--with-wolfssl`), so no patch is needed. Tested with net-snmp 5.9.5.2. + +wolfSSL +``` +./autogen.sh +./configure --enable-net-snmp +make +make install +``` + +net-snmp +``` +git clone --depth 1 --branch v5.9.5.2 https://github.com/net-snmp/net-snmp +cd net-snmp +autoreconf -ivf +./configure --disable-shared --with-wolfssl=/usr/local +make +autoconf --version | grep -P '2\.\d\d' -o > dist/autoconf-version +make test TESTOPTS="-e 'agentxperl'" +``` + +The `agentxperl` test needs the NetSNMP perl modules (`--with-perl-modules`) +and is excluded, matching the wolfSSL CI job. All other tests pass. diff --git a/openldap/2.6.13/README.md b/openldap/2.6.13/README.md new file mode 100644 index 000000000..a44216b75 --- /dev/null +++ b/openldap/2.6.13/README.md @@ -0,0 +1,18 @@ +# Building OpenLDAP with wolfSSL ++ Configure wolfSSL with `./configure --enable-openldap`. Add `--enable-debug` if you're going to be debugging. ++ `TLSCRLCheck` needs CRL support in wolfSSL. `--enable-openldap` turns it on (older wolfSSL releases need `--enable-crl` as well). Without it libldap refuses the option instead of silently ignoring it. ++ `make` and `sudo make install` wolfSSL into /usr/local. ++ Download OpenLDAP with `curl -O https://www.openldap.org/software/download/OpenLDAP/openldap-release/openldap-2.6.13.tgz`. ++ Unarchive the tar ball with `tar xvf openldap-2.6.13.tgz`. `cd into openldap-2.6.13`. ++ Patch the OpenLDAP source code with `patch -p1 < openldap-2.6.13.patch` (assuming the patch file is in the openldap-2.6.13 directory; adjust the path according to your situation). ++ OpenLDAP developers use very old versions of autotools (see build/README). I have been able to successfully build the project without using these old tools (I'm using autoconf 2.69), but your mileage may vary. ++ Delete aclocal.m4 with `rm aclocal.m4`. If you don't do this step, you'll get weird libtool errors when you try to run make later on. ++ Regenerate the configure script with `autoreconf -ivf`. This should fail at the automake step because OpenLDAP doesn't use a Makefile.am. That's ok. We just want to run everything else (e.g. autoheader, autoconf, etc.). ++ Configure OpenLDAP with `./configure CPPFLAGS="-I/usr/local/include/wolfssl" --with-tls=wolfssl`. ++ Compile dependencies with `make depend`. ++ Compile everything else with `make`. ++ Install with `sudo make install`. + +# Testing +The certificates used for testing in OpenLDAP have some issues (like using '0' for the serial number). To pass all the tests run with `make check` configure wolfSSL additionally with `CPPFLAGS=-DWOLFSSL_NO_ASN_STRICT`. + diff --git a/openldap/2.6.13/openldap-2.6.13.patch b/openldap/2.6.13/openldap-2.6.13.patch new file mode 100644 index 000000000..de6c3e0f2 --- /dev/null +++ b/openldap/2.6.13/openldap-2.6.13.patch @@ -0,0 +1,570 @@ +From 8e0f99eff5d8462c552abc83bc347bcc9d868cfd Mon Sep 17 00:00:00 2001 +From: Juliusz Sosinowicz +Date: Fri, 4 Sep 2026 11:17:54 +0000 +Subject: [PATCH] Add wolfSSL support to OpenLDAP 2.6.13 + +Adds --with-tls=wolfssl to configure.ac and ports libldap/slapd to the +wolfSSL OpenSSL compatibility layer. + +Compile wolfSSL with: + ./configure --enable-openldap CPPFLAGS=-DWOLFSSL_NO_ASN_STRICT + make + make install + +WOLFSSL_NO_ASN_STRICT is needed for the test suite only: the test +certificates in tests/data use a serial number of 0. + +TLSCRLCheck needs CRL support in wolfSSL. --enable-openldap turns it on +(older wolfSSL releases need --enable-crl as well). Without it libldap +refuses the option instead of silently ignoring it. + +Compile OpenLDAP with: + patch -p1 < openldap-2.6.13.patch + rm aclocal.m4 + autoreconf -ivf + ./configure --with-tls=wolfssl --disable-bdb --disable-hdb \ + CFLAGS="-I/usr/local/include -I/usr/local/include/wolfssl \ + -L/usr/local/lib" + make depend + make + +autoreconf may complain at the automake step because OpenLDAP has no +Makefile.am. That is expected; autoheader and autoconf still run. + +Run the tests with: + make check + +All 90 tests in tests/scripts run for the mdb backend: 40 pass and 50 +are skipped by the test suite itself because the corresponding +overlays, backends (ldap, meta, asyncmeta), SASL, ACI or external +services (MSAD, DSEE) are not built or configured with the configure +line above. The same 50 tests are skipped when the same tree is built +against OpenSSL, so the skips are not caused by wolfSSL. The TLS test +test067-tls (StartTLS, ldaps, hard cert validation and key pinning) +and the certificate test test021-certificate pass. Upstream runs the +tls_protocol_min sub-check of test067-tls only for OpenSSL. +--- + configure.ac | 40 +++++++++++- + libraries/libldap/init.c | 2 +- + libraries/libldap/tls2.c | 17 +++-- + libraries/libldap/tls_o.c | 130 ++++++++++++++++++++++++++++++++++---- + servers/lloadd/config.c | 6 +- + servers/slapd/bconfig.c | 2 +- + servers/slapd/config.c | 8 +-- + servers/slapd/slap.h | 2 +- + 8 files changed, 177 insertions(+), 30 deletions(-) + +diff --git a/configure.ac b/configure.ac +index 27377ac..dd3287b 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -247,8 +247,8 @@ OL_ARG_WITH(threads, + [AS_HELP_STRING([--with-threads], [with threads library auto|nt|posix|pth|lwp|manual])], + auto, [auto nt posix pth lwp yes no manual] ) + OL_ARG_WITH(tls, +- [AS_HELP_STRING([--with-tls], [with TLS/SSL support auto|openssl|gnutls])], +- auto, [auto openssl gnutls yes no] ) ++ [AS_HELP_STRING([--with-tls], [with TLS/SSL support auto|openssl|gnutls|wolfssl])], ++ auto, [auto openssl gnutls wolfssl yes no] ) + OL_ARG_WITH(yielding_select, + [AS_HELP_STRING([--with-yielding-select], [with implicitly yielding select])], + auto, [auto yes no manual] ) +@@ -1293,6 +1293,42 @@ if test $ol_link_tls = no ; then + fi + fi + ++dnl NOTE: caller must specify CPPFLAGS=-I/path/to/wolfssl/ to pick up ++dnl OpenSSL compatibility headers (e.g. /usr/local/include/wolfssl). ++if test $ol_link_tls = no ; then ++ if test $ol_with_tls = wolfssl || test $ol_with_tls = auto ; then ++ have_wolfssl=no ++ ++ AC_CHECK_HEADERS([wolfssl/options.h]) ++ if test "$ac_cv_header_wolfssl_options_h" = no && ++ test $ol_with_tls = wolfssl ; then ++ AC_MSG_ERROR([wolfSSL not found]) ++ fi ++ ++ AC_RUN_IFELSE([AC_LANG_PROGRAM([ ++ #include ++ ],[ ++ #ifndef OPENSSL_EXTRA ++ exit(1); ++ #endif ++ ])], [have_wolfssl=yes]) ++ ++ if test "$have_wolfssl" = yes ; then ++ ol_with_tls=wolfssl ++ ol_link_tls=yes ++ ++ TLS_LIBS="-lwolfssl" ++ ++ AC_DEFINE(HAVE_WOLFSSL, 1, ++ [define if you have wolfSSL]) ++ else ++ if test $ol_with_tls = wolfssl ; then ++ AC_MSG_ERROR([wolfSSL not compiled with OpenSSL compatibility layer. Re-compile and install wolfSSL with OPENSSL_EXTRA defined.]) ++ fi ++ fi ++ fi ++fi ++ + WITH_TLS=no + if test $ol_link_tls = yes ; then + AC_DEFINE(HAVE_TLS, 1, [define if you have TLS]) +diff --git a/libraries/libldap/init.c b/libraries/libldap/init.c +index e40fa93..5692641 100644 +--- a/libraries/libldap/init.c ++++ b/libraries/libldap/init.c +@@ -133,7 +133,7 @@ static const struct ol_attribute { + {0, ATTR_TLS, "TLS_PEERKEY_HASH", NULL, LDAP_OPT_X_TLS_PEERKEY_HASH}, + {0, ATTR_TLS, "TLS_ECNAME", NULL, LDAP_OPT_X_TLS_ECNAME}, + +-#ifdef HAVE_OPENSSL ++#if defined(HAVE_OPENSSL) || defined(HAVE_WOLFSSL) + {0, ATTR_TLS, "TLS_CRLCHECK", NULL, LDAP_OPT_X_TLS_CRLCHECK}, + #endif + #ifdef HAVE_GNUTLS +diff --git a/libraries/libldap/tls2.c b/libraries/libldap/tls2.c +index 054b016..f85d8ca 100644 +--- a/libraries/libldap/tls2.c ++++ b/libraries/libldap/tls2.c +@@ -551,6 +551,10 @@ ldap_pvt_tls_get_peer_dn( void *s, struct berval *dn, + + rc = ldap_X509dn2bv( &bvdn, dn, + (LDAPDN_rewrite_func *)func, flags); ++#ifdef HAVE_WOLFSSL ++ /* see comment in tlso_session_peer_dn */ ++ free(bvdn.bv_val); ++#endif + return rc; + } + +@@ -646,7 +650,7 @@ ldap_pvt_tls_config( LDAP *ld, int option, const char *arg ) + } + return ldap_pvt_tls_set_option( ld, option, &i ); + } +-#ifdef HAVE_OPENSSL ++#if defined(HAVE_OPENSSL) || defined(HAVE_WOLFSSL) + case LDAP_OPT_X_TLS_CRLCHECK: /* OpenSSL only */ + i = -1; + if ( strcasecmp( arg, "none" ) == 0 ) { +@@ -736,7 +740,7 @@ ldap_pvt_tls_get_option( LDAP *ld, int option, void *arg ) + case LDAP_OPT_X_TLS_REQUIRE_SAN: + *(int *)arg = lo->ldo_tls_require_san; + break; +-#ifdef HAVE_OPENSSL ++#if defined(HAVE_OPENSSL) || defined(HAVE_WOLFSSL) + case LDAP_OPT_X_TLS_CRLCHECK: /* OpenSSL only */ + *(int *)arg = lo->ldo_tls_crlcheck; + break; +@@ -957,7 +961,7 @@ ldap_pvt_tls_set_option( LDAP *ld, int option, void *arg ) + return 0; + } + return -1; +-#ifdef HAVE_OPENSSL ++#if defined(HAVE_OPENSSL) || defined(HAVE_WOLFSSL) + case LDAP_OPT_X_TLS_CRLCHECK: /* OpenSSL only */ + if ( !arg ) return -1; + switch( *(int *) arg ) { +@@ -1267,8 +1271,13 @@ ldap_pvt_tls_get_my_dn( void *s, struct berval *dn, LDAPDN_rewrite_dummy *func, + int rc; + + rc = tls_imp->ti_session_my_dn( session, &der_dn ); +- if ( rc == LDAP_SUCCESS ) ++ if ( rc == LDAP_SUCCESS ) { + rc = ldap_X509dn2bv(&der_dn, dn, (LDAPDN_rewrite_func *)func, flags ); ++#ifdef HAVE_WOLFSSL ++ /* see comment in tlso_session_peer_dn */ ++ free(der_dn.bv_val); ++#endif ++ } + return rc; + } + +diff --git a/libraries/libldap/tls_o.c b/libraries/libldap/tls_o.c +index cad42f8..872c4be 100644 +--- a/libraries/libldap/tls_o.c ++++ b/libraries/libldap/tls_o.c +@@ -18,7 +18,7 @@ + + #include "portable.h" + +-#ifdef HAVE_OPENSSL ++#if defined(HAVE_OPENSSL) || defined(HAVE_WOLFSSL) + + #include "ldap_config.h" + +@@ -37,18 +37,23 @@ + #include "ldap-int.h" + #include "ldap-tls.h" + +-#ifdef HAVE_OPENSSL_SSL_H ++#if defined(HAVE_OPENSSL_SSL_H) || defined(HAVE_WOLFSSL) ++#ifdef HAVE_WOLFSSL ++#include ++#endif + #include + #include + #include + #include ++#ifndef HAVE_WOLFSSL + #include ++#endif + #include + #include + #include + #endif + +-#if OPENSSL_VERSION_NUMBER >= 0x10100000 ++#if OPENSSL_VERSION_NUMBER >= 0x10100000 && !defined(HAVE_WOLFSSL) + #define ASN1_STRING_data(x) ASN1_STRING_get0_data(x) + #endif + +@@ -93,7 +98,7 @@ static void tlso_locking_cb( int mode, int type, const char *file, int line ) + } + } + +-#if OPENSSL_VERSION_NUMBER >= 0x0909000 ++#if OPENSSL_VERSION_NUMBER >= 0x0909000 && !defined(HAVE_WOLFSSL) + static void tlso_thread_self( CRYPTO_THREADID *id ) + { + CRYPTO_THREADID_set_pointer( id, (void *)ldap_pvt_thread_self() ); +@@ -131,7 +136,7 @@ static void tlso_thr_init( void ) {} + #endif + #endif /* OpenSSL 1.1 */ + +-#if OPENSSL_VERSION_NUMBER < 0x10100000 ++#if OPENSSL_VERSION_NUMBER < 0x10100000 && !defined(HAVE_WOLFSSL) + /* + * OpenSSL 1.1 API and later makes the BIO method concrete types internal. + */ +@@ -168,6 +173,7 @@ BIO_meth_free( BIO_METHOD *meth ) + + #endif /* OpenSSL 1.1 */ + ++#ifndef HAVE_WOLFSSL + static STACK_OF(X509_NAME) * + tlso_ca_list( char * bundle, char * dir, X509 *cert ) + { +@@ -203,6 +209,7 @@ tlso_ca_list( char * bundle, char * dir, X509 *cert ) + } + return ca_list; + } ++#endif + + /* + * Initialize TLS subsystem. Should be called only once. +@@ -235,8 +242,10 @@ tlso_init( void ) + OPENSSL_init_ssl(OPENSSL_FLAGS, NULL); + #endif + ++#ifndef HAVE_WOLFSSL + /* FIXME: mod_ssl does this */ + X509V3_add_standard_extensions(); ++#endif + + tlso_bio_method = tlso_bio_setup(); + +@@ -275,7 +284,7 @@ static void + tlso_ctx_ref( tls_ctx *ctx ) + { + tlso_ctx *c = (tlso_ctx *)ctx; +-#if OPENSSL_VERSION_NUMBER < 0x10100000 ++#if OPENSSL_VERSION_NUMBER < 0x10100000 && !defined(HAVE_WOLFSSL) + #define SSL_CTX_up_ref(ctx) CRYPTO_add( &(ctx->references), 1, CRYPTO_LOCK_SSL_CTX ) + #endif + SSL_CTX_up_ref( c ); +@@ -511,8 +520,62 @@ tlso_ctx_init( struct ldapoptions *lo, struct ldaptls *lt, int is_server, char * + + if ( is_server ) { + STACK_OF(X509_NAME) *calist; ++/* ++ * tlso_ca_list calls SSL_add_dir_cert_subjects_to_stack, which wolfSSL hasn't ++ * implemented. However, since we've just added all the CA certs in ++ * lt->lt_cacertdir to the wolfSSL cert manager, we can just get them from ++ * there, which is what this #ifdef'd code does instead of tlso_ca_list. ++ */ ++#ifdef HAVE_WOLFSSL ++ WOLFSSL_CERT_MANAGER* cert_manager = NULL; ++ STACK_OF(X509)* certs = NULL; ++ X509* x509; ++ X509_NAME* subj_name; ++ int i; ++ ++ if ((calist = sk_X509_NAME_new_null()) == NULL) { ++ Debug0(LDAP_DEBUG_ANY, "TLS: could not create X509_NAME stack\n"); ++ tlso_report_error( errmsg ); ++ return -1; ++ } ++ if ((cert_manager = wolfSSL_CTX_GetCertManager(ctx)) == NULL) { ++ Debug0(LDAP_DEBUG_ANY, "TLS: could not get cert manager\n"); ++ sk_X509_NAME_pop_free(calist, NULL); ++ tlso_report_error( errmsg ); ++ return -1; ++ } ++ ++ if ((certs = wolfSSL_CertManagerGetCerts(cert_manager)) == NULL) { ++ Debug0(LDAP_DEBUG_ANY, "TLS: could not load certs from cert " ++ "manager\n"); ++ sk_X509_NAME_pop_free(calist, NULL); ++ tlso_report_error( errmsg ); ++ return -1; ++ } ++ ++ for (i = 0; i < sk_num(certs); ++i) { ++ x509 = sk_X509_value(certs, i); ++ if (X509_check_ca(x509)) { ++ subj_name = X509_NAME_dup(X509_get_subject_name(x509)); ++ if (subj_name == NULL) { ++ Debug0(LDAP_DEBUG_ANY, "TLS: could not duplicate subject" ++ " name\n"); ++ sk_X509_NAME_pop_free(calist, NULL); ++ sk_X509_pop_free(certs, NULL); ++ tlso_report_error( errmsg ); ++ return -1; ++ } ++ else { ++ sk_X509_NAME_push(calist, subj_name); ++ } ++ } ++ } ++ ++ sk_X509_pop_free(certs, NULL); ++#else + /* List of CA names to send to a client */ + calist = tlso_ca_list( lt->lt_cacertfile, lt->lt_cacertdir, cert ); ++#endif /* HAVE_WOLFSSL */ + if ( !calist ) { + Debug2( LDAP_DEBUG_ANY, "TLS: " + "could not load client CA list (file:`%s',dir:`%s').\n", +@@ -627,7 +690,7 @@ tlso_ctx_init( struct ldapoptions *lo, struct ldaptls *lt, int is_server, char * + * This is a NOP in OpenSSL 1.1.0 and later, where curves are always + * auto-negotiated. + */ +-#if OPENSSL_VERSION_NUMBER < 0x10100000UL ++#if OPENSSL_VERSION_NUMBER < 0x10100000UL && !defined(HAVE_WOLFSSL) + if ( SSL_CTX_set_ecdh_auto( ctx, 1 ) <= 0 ) { + Debug0( LDAP_DEBUG_ANY, + "TLS: could not enable automatic EC negotiation.\n" ); +@@ -657,12 +720,25 @@ tlso_ctx_init( struct ldapoptions *lo, struct ldaptls *lt, int is_server, char * + #endif + if ( lo->ldo_tls_crlcheck ) { + X509_STORE *x509_s = SSL_CTX_get_cert_store( ctx ); ++ int crc = 1; + if ( lo->ldo_tls_crlcheck == LDAP_OPT_X_TLS_CRL_PEER ) { +- X509_STORE_set_flags( x509_s, X509_V_FLAG_CRL_CHECK ); ++ crc = X509_STORE_set_flags( x509_s, X509_V_FLAG_CRL_CHECK ); + } else if ( lo->ldo_tls_crlcheck == LDAP_OPT_X_TLS_CRL_ALL ) { +- X509_STORE_set_flags( x509_s, ++ crc = X509_STORE_set_flags( x509_s, + X509_V_FLAG_CRL_CHECK | X509_V_FLAG_CRL_CHECK_ALL ); + } ++#ifdef HAVE_WOLFSSL ++ /* Without CRL support wolfSSL accepts the flag and ignores it. */ ++ if ( crc != 1 ) { ++ Debug0( LDAP_DEBUG_ANY, "TLS: CRL checking requested but " ++ "wolfSSL was built without CRL support.\n" ); ++ strncpy( errmsg, "wolfSSL was built without CRL support", ++ ERRBUFSIZE ); ++ return -1; ++ } ++#else ++ (void) crc; ++#endif + } + /* Explicitly honor the server side cipher suite preference */ + SSL_CTX_set_options( ctx, SSL_OP_CIPHER_SERVER_PREFERENCE ); +@@ -752,13 +828,25 @@ tlso_session_my_dn( tls_session *sess, struct berval *der_dn ) + tlso_session *s = (tlso_session *)sess; + X509 *x; + X509_NAME *xn; ++#ifdef HAVE_WOLFSSL ++ int ret; ++ unsigned char *der_buf = NULL; ++#endif + + x = SSL_get_certificate( s ); + + if (!x) return LDAP_INVALID_CREDENTIALS; + + xn = X509_get_subject_name(x); +-#if OPENSSL_VERSION_NUMBER < 0x10100000 ++#ifdef HAVE_WOLFSSL ++ /* der_buf is dynamically allocated, so callers of this function will need ++ to free der_dn->bv_val. */ ++ ret = i2d_X509_NAME(xn, &der_buf); ++ if (ret < 0) ++ return LDAP_INVALID_CREDENTIALS; ++ der_dn->bv_len = ret; ++ der_dn->bv_val = der_buf; ++#elif OPENSSL_VERSION_NUMBER < 0x10100000 + der_dn->bv_len = i2d_X509_NAME( xn, NULL ); + der_dn->bv_val = xn->bytes->data; + #else +@@ -789,12 +877,24 @@ tlso_session_peer_dn( tls_session *sess, struct berval *der_dn ) + tlso_session *s = (tlso_session *)sess; + X509 *x = tlso_get_cert( s ); + X509_NAME *xn; ++#ifdef HAVE_WOLFSSL ++ unsigned char *der_buf = NULL; ++ int ret; ++#endif + + if ( !x ) + return LDAP_INVALID_CREDENTIALS; + + xn = X509_get_subject_name(x); +-#if OPENSSL_VERSION_NUMBER < 0x10100000 ++#ifdef HAVE_WOLFSSL ++ /* der_buf is dynamically allocated, so callers of this function will need ++ to free der_dn->bv_val. */ ++ ret = i2d_X509_NAME(xn, &der_buf); ++ if (ret < 0) ++ return LDAP_INVALID_CREDENTIALS; ++ der_dn->bv_len = ret; ++ der_dn->bv_val = der_buf; ++#elif OPENSSL_VERSION_NUMBER < 0x10100000 + der_dn->bv_len = i2d_X509_NAME( xn, NULL ); + der_dn->bv_val = xn->bytes->data; + #else +@@ -1077,7 +1177,7 @@ tlso_session_endpoint( tls_session *sess, struct berval *buf, int is_server ) + if ( cert == NULL ) + return 0; + +-#if OPENSSL_VERSION_NUMBER >= 0x10100000 ++#if OPENSSL_VERSION_NUMBER >= 0x10100000 || defined(HAVE_WOLFSSL) + { + int mdnid; + if ( !OBJ_find_sigid_algs( X509_get_signature_nid( cert ), &mdnid, NULL )) +@@ -1090,6 +1190,7 @@ tlso_session_endpoint( tls_session *sess, struct berval *buf, int is_server ) + + /* See RFC 5929 */ + if ( md == NULL || ++#ifndef HAVE_WOLFSSL + md == EVP_md_null() || + #ifndef OPENSSL_NO_MD2 + md == EVP_md2() || +@@ -1097,6 +1198,7 @@ tlso_session_endpoint( tls_session *sess, struct berval *buf, int is_server ) + #ifndef OPENSSL_NO_MD4 + md == EVP_md4() || + #endif ++#endif + #ifndef OPENSSL_NO_MD5 + md == EVP_md5() || + #endif +@@ -1237,7 +1339,7 @@ struct tls_data { + Sockbuf_IO_Desc *sbiod; + }; + +-#if OPENSSL_VERSION_NUMBER < 0x10100000 ++#if OPENSSL_VERSION_NUMBER < 0x10100000 && !defined(HAVE_WOLFSSL) + #define BIO_set_init(b, x) b->init = x + #define BIO_set_data(b, x) b->ptr = x + #define BIO_clear_flags(b, x) b->flags &= ~(x) +@@ -1759,4 +1861,4 @@ tls_impl ldap_int_tls_impl = { + 0 + }; + +-#endif /* HAVE_OPENSSL */ ++#endif /* HAVE_OPENSSL || HAVE_WOLFSSL */ +diff --git a/servers/lloadd/config.c b/servers/lloadd/config.c +index d0e938b..b5ec152 100644 +--- a/servers/lloadd/config.c ++++ b/servers/lloadd/config.c +@@ -511,7 +511,7 @@ static ConfigTable config_back_cf_table[] = { + NULL, NULL + }, + { "TLSCRLCheck", NULL, 2, 2, 0, +-#if defined(HAVE_TLS) && defined(HAVE_OPENSSL) ++#if defined(HAVE_TLS) && (defined(HAVE_OPENSSL) || defined(HAVE_WOLFSSL)) + CFG_TLS_CRLCHECK|ARG_STRING|ARG_MAGIC, + &config_tls_config, + #else +@@ -2868,7 +2868,7 @@ static slap_cf_aux_table bindkey[] = { + { BER_BVC("tls_cipher_suite="), offsetof(slap_bindconf, sb_tls_cipher_suite), 's', 0, NULL }, + { BER_BVC("tls_protocol_min="), offsetof(slap_bindconf, sb_tls_protocol_min), 's', 0, NULL }, + { BER_BVC("tls_ecname="), offsetof(slap_bindconf, sb_tls_ecname), 's', 0, NULL }, +-#ifdef HAVE_OPENSSL ++#if defined(HAVE_OPENSSL) || defined(HAVE_WOLFSSL) + { BER_BVC("tls_crlcheck="), offsetof(slap_bindconf, sb_tls_crlcheck), 's', 0, NULL }, + #endif + #endif +@@ -3220,7 +3220,7 @@ lload_bindconf_tls_set( slap_bindconf *bc, LDAP *ld ) + } else + newctx = 1; + } +-#ifdef HAVE_OPENSSL ++#if defined(HAVE_OPENSSL) || defined(HAVE_WOLFSSL) + if ( bc->sb_tls_crlcheck ) { + rc = ldap_pvt_tls_config( + ld, LDAP_OPT_X_TLS_CRLCHECK, bc->sb_tls_crlcheck ); +diff --git a/servers/slapd/bconfig.c b/servers/slapd/bconfig.c +index 9757ee6..42bc0ed 100644 +--- a/servers/slapd/bconfig.c ++++ b/servers/slapd/bconfig.c +@@ -861,7 +861,7 @@ static ConfigTable config_back_cf_table[] = { + "EQUALITY caseExactMatch " + "SYNTAX OMsDirectoryString SINGLE-VALUE )", NULL, NULL }, + { "TLSCRLCheck", NULL, 2, 2, 0, +-#if defined(HAVE_TLS) && defined(HAVE_OPENSSL) ++#if defined(HAVE_TLS) && (defined(HAVE_OPENSSL) || defined(HAVE_WOLFSSL)) + CFG_TLS_CRLCHECK|ARG_STRING|ARG_MAGIC, &config_tls_config, + #else + ARG_IGNORED, NULL, +diff --git a/servers/slapd/config.c b/servers/slapd/config.c +index aa5aa6b..b7241c3 100644 +--- a/servers/slapd/config.c ++++ b/servers/slapd/config.c +@@ -1295,7 +1295,7 @@ static slap_cf_aux_table bindkey[] = { + { BER_BVC("tls_cipher_suite="), offsetof(slap_bindconf, sb_tls_cipher_suite), 's', 0, NULL }, + { BER_BVC("tls_protocol_min="), offsetof(slap_bindconf, sb_tls_protocol_min), 's', 0, NULL }, + { BER_BVC("tls_ecname="), offsetof(slap_bindconf, sb_tls_ecname), 's', 0, NULL }, +-#ifdef HAVE_OPENSSL ++#if defined(HAVE_OPENSSL) || defined(HAVE_WOLFSSL) + { BER_BVC("tls_crlcheck="), offsetof(slap_bindconf, sb_tls_crlcheck), 's', 0, NULL }, + #endif + #endif +@@ -1676,7 +1676,7 @@ void bindconf_free( slap_bindconf *bc ) { + ch_free( bc->sb_tls_ecname ); + bc->sb_tls_ecname = NULL; + } +-#ifdef HAVE_OPENSSL ++#if defined(HAVE_OPENSSL) || defined(HAVE_WOLFSSL) + if ( bc->sb_tls_crlcheck ) { + ch_free( bc->sb_tls_crlcheck ); + bc->sb_tls_crlcheck = NULL; +@@ -1716,7 +1716,7 @@ bindconf_tls_defaults( slap_bindconf *bc ) + if ( !bc->sb_tls_ecname ) + slap_tls_get_config( slap_tls_ld, LDAP_OPT_X_TLS_ECNAME, + &bc->sb_tls_ecname ); +-#ifdef HAVE_OPENSSL ++#if defined(HAVE_OPENSSL) || defined(HAVE_WOLFSSL) + if ( !bc->sb_tls_crlcheck ) + slap_tls_get_config( slap_tls_ld, LDAP_OPT_X_TLS_CRLCHECK, + &bc->sb_tls_crlcheck ); +@@ -1798,7 +1798,7 @@ int bindconf_tls_set( slap_bindconf *bc, LDAP *ld ) + } else + newctx = 1; + } +-#ifdef HAVE_OPENSSL ++#if defined(HAVE_OPENSSL) || defined(HAVE_WOLFSSL) + if ( bc->sb_tls_crlcheck ) { + rc = ldap_pvt_tls_config( ld, LDAP_OPT_X_TLS_CRLCHECK, + bc->sb_tls_crlcheck ); +diff --git a/servers/slapd/slap.h b/servers/slapd/slap.h +index e9b6ba7..554dc96 100644 +--- a/servers/slapd/slap.h ++++ b/servers/slapd/slap.h +@@ -1668,7 +1668,7 @@ typedef struct slap_bindconf { + char *sb_tls_cipher_suite; + char *sb_tls_protocol_min; + char *sb_tls_ecname; +-#ifdef HAVE_OPENSSL ++#if defined(HAVE_OPENSSL) || defined(HAVE_WOLFSSL) + char *sb_tls_crlcheck; + #endif + int sb_tls_int_reqcert; +-- +2.43.0 + diff --git a/socat/1.8.1.1/README.md b/socat/1.8.1.1/README.md new file mode 100644 index 000000000..6c692833a --- /dev/null +++ b/socat/1.8.1.1/README.md @@ -0,0 +1,109 @@ +# socat 1.8.1.1 with wolfSSL + +Build wolfSSL with the configure line used by the wolfSSL CI job +(`.github/workflows/socat.yml`): + +``` +./configure --enable-all --enable-oldtls --enable-tlsv10 --enable-ipv6 'CPPFLAGS=-DWOLFSSL_NO_DTLS_SIZE_CHECK -DOPENSSL_COMPATIBLE_DEFAULTS' +make +make install +``` + +Download socat-1.8.1.1.tar.gz, apply the patch and build: + +``` +curl -O http://www.dest-unreach.org/socat/download/socat-1.8.1.1.tar.gz +tar xvf socat-1.8.1.1.tar.gz +cd socat-1.8.1.1 +patch -p1 < socat-1.8.1.1.patch +autoreconf -vfi +./configure --with-wolfssl=/usr/local --enable-default-ipv=4 +make +``` + +`--with-wolfssl=PATH` points at the wolfSSL install prefix (default +`/usr/local`). Add `PATH/lib` to `LD_LIBRARY_PATH` when running socat if +wolfSSL was installed outside the system library path. + +Run the tests with: + +``` +SOCAT=$PWD/socat SHELL=/bin/bash ./test.sh -t 1.0 +``` + +The wolfSSL CI job (`.github/workflows/socat.yml` in the wolfSSL repo) +runs the same suite in parallel bwrap network namespaces with +`--expect-fail 23,146,155,156,307,321,386,399,467,468,475,478,491,492,495,528,529`. + +A full local `./test.sh -t 1.0` run as root, with stdin not a terminal +and no IPv6, gives 423 ok / 9 failed / 173 could not be performed: + +``` +FAILED: 146 304 326 386 399 410 487 492 495 +``` + +TLS related: + +- Test 146 OPENSSLLISTENDSA uses a DSA certificate and gets -501 (bad + cipher suite). wolfSSL does not support DSA cipher suites. +- Test 386 OPENSSL_ECDHE requests cipher ECDHE-ECDSA-AES256-GCM-SHA384 + against an RSA server certificate. It only passes with OpenSSL because + TLS 1.3 gets negotiated there; wolfSSL offers exactly the named suite. +- Test 399 OPENSSL_DTLS_CLIENT: when the suite runs non-interactively + socat's stdin is at EOF, so it closes the DTLS connection before + `openssl s_server` sends its data. It fails the same way when socat is + linked with OpenSSL and passes when stdin is held open. +- Test 475 RCVTIMEO_DTLS: wolfSSL handles DTLS timeouts internally. + Setting so-rcvtimeo on the socket does not affect the timeout. +- Test 402 OPENSSL_SERVERALTIP4AUTH, fixed by this patch: with an IPv6 + loopback present test.sh adds `IP.2 = ::1` to testalt.crt. wolfSSL + returns the subjectAltName stack in reverse order, so socat compared + the `::1` entry first and resolved the peer name `127.0.0.1` with an + AF_INET6 hint; that lookup fails and socat treats it as fatal, so the + client died mid-handshake. The patch skips IPv6 entries when the peer + name is an IPv4 literal, and the test passes with and without IPv6. + Checked here with a hand-made `::1` certificate, since this machine has + no IPv6. The 1.8.0.x CI lists carry 402 as an expected failure for this + reason. + +The configure.ac changes force `autoreconf -vfi`, and autoheader then +regenerates the hand-maintained `config.h.in`. An `AH_BOTTOM` block in +configure.ac keeps the derived defines socat only carries in that file +(HAVE_TERMIOS_ISPEED/OSPEED/SPEED, WITH_STREAMS, HAVE_HOSTS_DENY_TABLE), +so the ispeed/ospeed terminal options and the tcpwrap deny-table options +are still compiled in; tests 459 MISSING_INTEGER and 460 INTEGER_GARBAGE +pass. The 1.8.0.x wolfSSL patches do not have this block. + +Not TLS related (environment): + +- Test 304 IOCTL_VOID: TIOCEXCL does not exclude root. +- Test 326 READLINE_OVFL: needs a terminal on stdin. +- Test 410 VSOCK_ECHO: no vsock device. +- Test 487 NETNS_EXEC: needs `ip netns` rights. +- Test 491 SOCKETPAIR_BOUNDARIES and test 205 TCP4ENDCLOSE: timing races + that only show up on a loaded machine; they pass on their own with both + wolfSSL and OpenSSL. +- Test 492 ACCEPT_FD: systemd-socket-activate drops LD_LIBRARY_PATH, so + the exec'd socat cannot find libwolfssl.so when wolfSSL is installed + outside the system library path. +- Test 495 POSIXMQ_RECV_MAXCHILDREN: output ordering timing race. + +Tests 304, 326, 399, 410, 487 and 495 fail the same way with a socat +built against OpenSSL 3.0 on the same machine. + +The remaining `--expect-fail` numbers (23, 155, 156, 307, 321, 467, 468, +478, 528, 529) are carried over unchanged from the 1.8.0.3 CI list - the +test numbering of 1.8.1.1 is identical up to test 593 and the new tests +are appended after it. They are not TLS tests (SCTP, fd handling, +statistics, procan, SOCKS chaining) and they either pass or report +"could not be performed" locally; they are kept because they are +environment-dependent in the CI runners. + +Test 318 OPENSSL_ANULL exercises `ciphers=aNULL` on both ends. It needs +wolfSSL with the "aNULL" cipher list fix (anonymous suites generated and +allowed by `SSL_CTX_set_cipher_list`) to complete the handshake; without +it both ends error out. Note that upstream test.sh counts this test as +ok whatever happens, so the suite result does not show the difference. + +The configure.ac was updated to have `[ ]` instead of `[]` because of +autoconf's expected format with AC_DEFINE. diff --git a/socat/1.8.1.1/socat-1.8.1.1.patch b/socat/1.8.1.1/socat-1.8.1.1.patch new file mode 100644 index 000000000..2ff1fcc18 --- /dev/null +++ b/socat/1.8.1.1/socat-1.8.1.1.patch @@ -0,0 +1,1865 @@ +From 850a4cde3f2994d5b4fc90bf2cff9f48caa64b05 Mon Sep 17 00:00:00 2001 +From: Juliusz Sosinowicz +Date: Mon, 7 Sep 2026 18:19:42 +0000 +Subject: [PATCH] Add wolfSSL support to socat 1.8.1.1 + +Port of the socat 1.8.0.3 wolfSSL patch. configure.ac gains a +--with-wolfssl=PATH option (defaults to /usr/local) and every one-argument +AC_DEFINE(X) is rewritten as AC_DEFINE([X],[1],[ ]) because autoconf needs +the bracketed form; the new WITH_STALL, WITH_TEXT and +HAVE_LINUX_RTNETLINK_H defines of 1.8.1.1 are converted the same way. +xio-openssl.c uses "!" instead of "-" in the default cipher string, caps +SSL23/default contexts at TLS 1.2 and treats RAND errors like BoringSSL. + +The subjectAltName check in xio-openssl.c no longer resolves an IPv4 +peer name as IPv6. wolfSSL returns the SAN stack in reverse order, so a +certificate with an IPv6 entry hands it to the comparison before the +IPv4 one; socat resolved the peer with an AF_INET6 hint and the failed +lookup was fatal. Test 402 OPENSSL_SERVERALTIP4AUTH failed that way +whenever testalt.crt carried ::1. + +Build wolfSSL with: + ./configure --enable-all --enable-oldtls --enable-tlsv10 --enable-ipv6 \ + 'CPPFLAGS=-DWOLFSSL_NO_DTLS_SIZE_CHECK -DOPENSSL_COMPATIBLE_DEFAULTS' + make + make install + +Build socat with: + curl -O http://www.dest-unreach.org/socat/download/socat-1.8.1.1.tar.gz + tar xf socat-1.8.1.1.tar.gz + cd socat-1.8.1.1 + patch -p1 < socat-1.8.1.1.patch + autoreconf -vfi + ./configure --with-wolfssl=/usr/local --enable-default-ipv=4 + make + +Run the tests with (add the wolfSSL lib dir to LD_LIBRARY_PATH if needed): + SOCAT=$PWD/socat SHELL=/bin/bash ./test.sh -t 1.0 + +A full run gives 423 ok, 9 failed, 173 could not be performed: + FAILED: 146 304 326 386 399 410 487 492 495 + +TLS related: + 146 OPENSSLLISTENDSA: wolfSSL has no DSA cipher suites. + 386 OPENSSL_ECDHE: asks for ECDHE-ECDSA-AES256-GCM-SHA384 against an + RSA server certificate; only passes with OpenSSL because TLS 1.3 + gets negotiated there. + 399 OPENSSL_DTLS_CLIENT: socat's stdin is at EOF when the suite runs + non-interactively, so socat closes before openssl s_server sends + its data; fails the same way with OpenSSL. + 475 RCVTIMEO_DTLS: wolfSSL handles DTLS timeouts internally, so + so-rcvtimeo does not shorten the handshake timeout. + +The configure.ac changes force autoreconf, and autoheader then rebuilds +config.h.in. socat maintains that file by hand with derived defines that +no AC_DEFINE produces (HAVE_TERMIOS_ISPEED/OSPEED/SPEED, WITH_STREAMS, +HAVE_HOSTS_DENY_TABLE); an AH_BOTTOM block in configure.ac keeps them, +so the ispeed/ospeed terminal options and the tcpwrap deny-table options +stay available (tests 459 and 460 pass). Only the __config_h_included +include guard is lost, and nothing references it. + +Environment, not TLS: 304, 326, 410, 487, 492 and 495 depend on root, a +tty, vsock, netns rights, timing races (205 and 491 too, under load) and on +systemd-socket-activate dropping LD_LIBRARY_PATH. 304, 326, 399, 410, +487 and 495 fail identically with a socat built against OpenSSL 3.0. + +Test 318 OPENSSL_ANULL needs a wolfSSL with the "aNULL" cipher list fix +to handshake, but upstream test.sh counts that test as ok either way. +--- + configure.ac | 703 +++++++++++++++++++++++++++++--------------------- + xio-openssl.c | 31 ++- + 2 files changed, 431 insertions(+), 303 deletions(-) + +diff --git a/configure.ac b/configure.ac +index 218db56..4b8453f 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -66,13 +66,13 @@ AC_CHECK_HEADERS(fcntl.h limits.h strings.h sys/param.h sys/ioctl.h sys/time.h s + AC_CHECK_HEADERS(pwd.h grp.h stdint.h sys/types.h poll.h sys/poll.h sys/socket.h sys/uio.h sys/stat.h netdb.h sys/un.h) + AC_CHECK_HEADERS(pty.h) + AC_CHECK_HEADERS(netinet/in.h netinet/in_systm.h) +-AC_CHECK_HEADERS(netinet/ip.h, [], [], [AC_INCLUDES_DEFAULT ++AC_CHECK_HEADERS(netinet/ip.h, [ ], [ ], [AC_INCLUDES_DEFAULT + #if HAVE_NETINET_IN_H && HAVE_NETINET_IN_SYSTM_H + #include + #include + #endif]) # Solaris prerequisites for netinet/ip.h + AC_CHECK_HEADERS(netinet/tcp.h) +-AC_CHECK_HEADER(net/if.h, AC_DEFINE(HAVE_NET_IF_H), [], [AC_INCLUDES_DEFAULT ++AC_CHECK_HEADER(net/if.h, AC_DEFINE([HAVE_NET_IF_H],[1],[ ]), [ ], [AC_INCLUDES_DEFAULT + #if HAVE_SYS_SOCKET_H + #include + #endif]) # Mac OS X requires including sys/socket.h +@@ -83,7 +83,7 @@ AC_HEADER_RESOLV() + AC_CHECK_HEADERS(termios.h linux/if_tun.h) + AC_CHECK_HEADERS(net/if_dl.h) + AC_CHECK_HEADERS(linux/types.h) +-AC_CHECK_HEADER(linux/errqueue.h, AC_DEFINE(HAVE_LINUX_ERRQUEUE_H), [], [#include ++AC_CHECK_HEADER(linux/errqueue.h, AC_DEFINE([HAVE_LINUX_ERRQUEUE_H],[1],[ ]), [ ], [#include + #include ]) + AC_CHECK_HEADERS(sys/utsname.h sys/select.h sys/file.h) + AC_CHECK_HEADERS(util.h bsd/libutil.h libutil.h stropts.h regex.h) +@@ -100,7 +100,7 @@ AC_SEARCH_LIBS([res_9_init], [resolv]) + + + dnl Check for extra socket library (for Solaris) +-AC_CHECK_FUNC(hstrerror, , AC_CHECK_LIB(resolv, hstrerror, [LIBS="$LIBS -lresolv"; AC_DEFINE(HAVE_HSTRERROR)])) ++AC_CHECK_FUNC(hstrerror, , AC_CHECK_LIB(resolv, hstrerror, [LIBS="$LIBS -lresolv"; AC_DEFINE([HAVE_HSTRERROR],[1],[ ])])) + AC_CHECK_FUNC(gethostent, , AC_CHECK_LIB(nsl, gethostent)) + AC_CHECK_FUNC(setsockopt, , AC_CHECK_LIB(socket, setsockopt)) + +@@ -117,7 +117,7 @@ $2],[return(&$1==(void *)&$1);], + [sc_cv_have_prototype_lib_$1=no]); + CFLAGS="$CFLAGS1"]) + if test $sc_cv_have_prototype_lib_$1 = yes; then +- AC_DEFINE(HAVE_PROTOTYPE_LIB_$1) ++ AC_DEFINE([HAVE_PROTOTYPE_LIB_$1],[1],[ ]) + fi + AC_MSG_RESULT($sc_cv_have_prototype_lib_$1) + ]) +@@ -132,7 +132,7 @@ AC_CACHE_VAL(sc_cv_have_prototype_hstrerror, + [sc_cv_have_prototype_hstrerror=yes]); + CFLAGS="$CFLAGS1"]) + if test $sc_cv_have_prototype_hstrerror = yes; then +- AC_DEFINE(HAVE_PROTOTYPE_HSTRERROR) ++ AC_DEFINE([HAVE_PROTOTYPE_HSTRERROR],[1],[ ]) + fi + AC_MSG_RESULT($sc_cv_have_prototype_hstrerror) + +@@ -152,7 +152,7 @@ AC_CACHE_VAL(sc_cv_getprotobynumber_r, + [sc_cv_getprotobynumber_r=] + )])])]) + if test "$sc_cv_getprotobynumber_r"; then +- AC_DEFINE_UNQUOTED(HAVE_GETPROTOBYNUMBER_R, $sc_cv_getprotobynumber_r) ++ AC_DEFINE_UNQUOTED([HAVE_GETPROTOBYNUMBER_R],[$sc_cv_getprotobynumber_r],[ ]) + fi + AC_MSG_RESULT($sc_cv_getprotobynumber_r /* $tmp_bynum_variant */) + +@@ -161,115 +161,115 @@ AC_MSG_CHECKING(whether to include help) + AC_ARG_ENABLE(help, [ --disable-help disable help], + [case "$enableval" in + no) AC_MSG_RESULT(no);; +- *) AC_DEFINE(WITH_HELP) AC_MSG_RESULT(yes);; ++ *) AC_DEFINE([WITH_HELP],[1],[ ]) AC_MSG_RESULT(yes);; + esac], +- [AC_DEFINE(WITH_HELP) AC_MSG_RESULT(yes)]) ++ [AC_DEFINE([WITH_HELP],[1],[ ]) AC_MSG_RESULT(yes)]) + + AC_MSG_CHECKING(whether to include transfer statistics) + AC_ARG_ENABLE(stats, [ --disable-stats disable stats], + [case "$enableval" in + no) AC_MSG_RESULT(no);; +- *) AC_DEFINE(WITH_STATS) AC_MSG_RESULT(yes);; ++ *) AC_DEFINE([WITH_STATS],[1],[ ]) AC_MSG_RESULT(yes);; + esac], +- [AC_DEFINE(WITH_STATS) AC_MSG_RESULT(yes)]) ++ [AC_DEFINE([WITH_STATS],[1],[ ]) AC_MSG_RESULT(yes)]) + + AC_MSG_CHECKING(whether to include STDIO support) + AC_ARG_ENABLE(stdio, [ --disable-stdio disable STDIO support], + [case "$enableval" in + no) AC_MSG_RESULT(no);; +- *) AC_DEFINE(WITH_STDIO) AC_MSG_RESULT(yes);; ++ *) AC_DEFINE([WITH_STDIO],[1],[ ]) AC_MSG_RESULT(yes);; + esac], +- [AC_DEFINE(WITH_STDIO) AC_MSG_RESULT(yes)]) ++ [AC_DEFINE([WITH_STDIO],[1],[ ]) AC_MSG_RESULT(yes)]) + + AC_MSG_CHECKING(whether to include FD-number support) + AC_ARG_ENABLE(fdnum, [ --disable-fdnum disable FD-number support], + [case "$enableval" in + no) AC_MSG_RESULT(no);; +- *) AC_DEFINE(WITH_FDNUM) AC_MSG_RESULT(yes);; ++ *) AC_DEFINE([WITH_FDNUM],[1],[ ]) AC_MSG_RESULT(yes);; + esac], +- [AC_DEFINE(WITH_FDNUM) AC_MSG_RESULT(yes)]) ++ [AC_DEFINE([WITH_FDNUM],[1],[ ]) AC_MSG_RESULT(yes)]) + + AC_MSG_CHECKING(whether to include direct file support) + AC_ARG_ENABLE(file, [ --disable-file disable direct file support], + [case "$enableval" in + no) AC_MSG_RESULT(no);; +- *) AC_DEFINE(WITH_FILE) AC_MSG_RESULT(yes);; ++ *) AC_DEFINE([WITH_FILE],[1],[ ]) AC_MSG_RESULT(yes);; + esac], +- [AC_DEFINE(WITH_FILE) AC_MSG_RESULT(yes)]) ++ [AC_DEFINE([WITH_FILE],[1],[ ]) AC_MSG_RESULT(yes)]) + + AC_MSG_CHECKING(whether to include direct create support) + AC_ARG_ENABLE(creat, [ --disable-creat disable direct create support], + [case "$enableval" in + no) AC_MSG_RESULT(no);; +- *) AC_DEFINE(WITH_CREAT) AC_MSG_RESULT(yes);; ++ *) AC_DEFINE([WITH_CREAT],[1],[ ]) AC_MSG_RESULT(yes);; + esac], +- [AC_DEFINE(WITH_CREAT) AC_MSG_RESULT(yes)]) ++ [AC_DEFINE([WITH_CREAT],[1],[ ]) AC_MSG_RESULT(yes)]) + + AC_MSG_CHECKING(whether to include gopen support) + AC_ARG_ENABLE(gopen, [ --disable-gopen disable open for UNIX socket support], + [case "$enableval" in + no) AC_MSG_RESULT(no);; +- *) AC_DEFINE(WITH_GOPEN) AC_MSG_RESULT(yes);; ++ *) AC_DEFINE([WITH_GOPEN],[1],[ ]) AC_MSG_RESULT(yes);; + esac], +- [AC_DEFINE(WITH_GOPEN) AC_MSG_RESULT(yes)]) ++ [AC_DEFINE([WITH_GOPEN],[1],[ ]) AC_MSG_RESULT(yes)]) + + AC_MSG_CHECKING(whether to include explicit pipe support) + AC_ARG_ENABLE(pipe, [ --disable-pipe disable pipe support], + [case "$enableval" in + no) AC_MSG_RESULT(no);; +- *) AC_DEFINE(WITH_PIPE) AC_MSG_RESULT(yes);; ++ *) AC_DEFINE([WITH_PIPE],[1],[ ]) AC_MSG_RESULT(yes);; + esac], +- [AC_DEFINE(WITH_PIPE) AC_MSG_RESULT(yes)]) ++ [AC_DEFINE([WITH_PIPE],[1],[ ]) AC_MSG_RESULT(yes)]) + + AC_MSG_CHECKING(whether to include explicit stall support) + AC_ARG_ENABLE(stall, [ --disable-stall disable stall support], + [case "$enableval" in + no) AC_MSG_RESULT(no);; +- *) AC_DEFINE(WITH_STALL) AC_MSG_RESULT(yes);; ++ *) AC_DEFINE([WITH_STALL],[1],[ ]) AC_MSG_RESULT(yes);; + esac], +- [AC_DEFINE(WITH_STALL) AC_MSG_RESULT(yes)]) ++ [AC_DEFINE([WITH_STALL],[1],[ ]) AC_MSG_RESULT(yes)]) + + AC_MSG_CHECKING(whether to include explicit text support) + AC_ARG_ENABLE(text, [ --disable-text disable text support], + [case "$enableval" in + no) AC_MSG_RESULT(no);; +- *) AC_DEFINE(WITH_TEXT) AC_MSG_RESULT(yes);; ++ *) AC_DEFINE([WITH_TEXT],[1],[ ]) AC_MSG_RESULT(yes);; + esac], +- [AC_DEFINE(WITH_TEXT) AC_MSG_RESULT(yes)]) ++ [AC_DEFINE([WITH_TEXT],[1],[ ]) AC_MSG_RESULT(yes)]) + + AC_MSG_CHECKING(whether to include explicit socketpair support) + AC_ARG_ENABLE(socketpair, [ --disable-socketpair disable socketpair support], + [case "$enableval" in + no) AC_MSG_RESULT(no);; +- *) AC_DEFINE(WITH_SOCKETPAIR) AC_MSG_RESULT(yes);; ++ *) AC_DEFINE([WITH_SOCKETPAIR],[1],[ ]) AC_MSG_RESULT(yes);; + esac], +- [AC_DEFINE(WITH_SOCKETPAIR) AC_MSG_RESULT(yes)]) ++ [AC_DEFINE([WITH_SOCKETPAIR],[1],[ ]) AC_MSG_RESULT(yes)]) + + AC_MSG_CHECKING(whether to include explicit termios support) + AC_ARG_ENABLE(termios, [ --disable-termios disable termios support], + [case "$enableval" in + no) AC_MSG_RESULT(no);; +- *) AC_DEFINE(WITH_TERMIOS) AC_MSG_RESULT(yes);; ++ *) AC_DEFINE([WITH_TERMIOS],[1],[ ]) AC_MSG_RESULT(yes);; + esac], +- [AC_DEFINE(WITH_TERMIOS) AC_MSG_RESULT(yes)]) ++ [AC_DEFINE([WITH_TERMIOS],[1],[ ]) AC_MSG_RESULT(yes)]) + + AC_MSG_CHECKING(whether to include UNIX socket support) + AC_ARG_ENABLE(unix, [ --disable-unix disable UNIX domain socket support], + [case "$enableval" in + no) AC_MSG_RESULT(no);; +- *) AC_DEFINE(WITH_UNIX) AC_MSG_RESULT(yes);; ++ *) AC_DEFINE([WITH_UNIX],[1],[ ]) AC_MSG_RESULT(yes);; + esac], +- [AC_DEFINE(WITH_UNIX) AC_MSG_RESULT(yes)]) ++ [AC_DEFINE([WITH_UNIX],[1],[ ]) AC_MSG_RESULT(yes)]) + + AC_MSG_CHECKING(whether to include abstract UNIX socket support) + AC_ARG_ENABLE(abstract_unixsocket, [ --disable-abstract-unixsocket disable abstract UNIX domain socket support], + [case "$enableval" in + no) AC_MSG_RESULT(no);; +- *) AC_DEFINE(WITH_ABSTRACT_UNIXSOCKET) AC_MSG_RESULT(yes);; ++ *) AC_DEFINE([WITH_ABSTRACT_UNIXSOCKET],[1],[ ]) AC_MSG_RESULT(yes);; + esac], + [ case "`uname`" in + Linux) +- AC_DEFINE(WITH_ABSTRACT_UNIXSOCKET) AC_MSG_RESULT(yes);; ++ AC_DEFINE([WITH_ABSTRACT_UNIXSOCKET],[1],[ ]) AC_MSG_RESULT(yes);; + *) + AC_MSG_RESULT(no);; + esac]) +@@ -278,9 +278,9 @@ AC_MSG_CHECKING(whether to include IPv4 support) + AC_ARG_ENABLE(ip4, [ --disable-ip4 disable IPv4 support], + [case "$enableval" in + no) AC_MSG_RESULT(no);; +- *) AC_DEFINE(WITH_IP4) AC_MSG_RESULT(yes);; ++ *) AC_DEFINE([WITH_IP4],[1],[ ]) AC_MSG_RESULT(yes);; + esac], +- [AC_DEFINE(WITH_IP4) AC_MSG_RESULT(yes)]) ++ [AC_DEFINE([WITH_IP4],[1],[ ]) AC_MSG_RESULT(yes)]) + + AC_MSG_CHECKING(whether to include IPv6 support) + AC_ARG_ENABLE(ip6, [ --disable-ip6 disable IPv6 support], +@@ -291,7 +291,7 @@ AC_ARG_ENABLE(ip6, [ --disable-ip6 disable IPv6 support], + [ AC_MSG_RESULT(yes); WITH_IP6=1 ]) + if test "$WITH_IP6"; then + AC_CHECK_HEADERS([netinet/ip6.h], +- [AC_DEFINE(HAVE_NETINET_IP6_H) AC_DEFINE(WITH_IP6)], ++ [AC_DEFINE([HAVE_NETINET_IP6_H],[1],[ ]) AC_DEFINE([WITH_IP6],[1],[ ])], + [AC_MSG_WARN([include file netinet/ip6.h not found, disabling IP6])], + [AC_INCLUDES_DEFAULT + #ifdef HAVE_NETINET_IN_H +@@ -317,7 +317,7 @@ AC_CACHE_VAL(ac_cv_apple_use_rfc_2292, + )] + )]) + if test "$ac_cv_apple_use_rfc_2292" = yes; then +- AC_DEFINE(__APPLE_USE_RFC_2292) ++ AC_DEFINE([__APPLE_USE_RFC_2292],[1],[ ]) + fi + AC_MSG_RESULT($ac_cv_apple_use_rfc_2292) + +@@ -328,7 +328,7 @@ AC_TRY_COMPILE([#include + [ AC_MSG_RESULT(yes); WITH_IP6=1], + [ AC_MSG_RESULT(no); WITH_IP6=]) + if test "$WITH_IP6"; then +- AC_DEFINE(WITH_IP6) ++ AC_DEFINE([WITH_IP6],[1],[ ]) + fi + + fi +@@ -337,17 +337,17 @@ AC_MSG_CHECKING(whether to include raw IP support) + AC_ARG_ENABLE(rawip, [ --disable-rawip disable raw IP support], + [case "$enableval" in + no) AC_MSG_RESULT(no);; +- *) AC_DEFINE(WITH_RAWIP) AC_MSG_RESULT(yes);; ++ *) AC_DEFINE([WITH_RAWIP],[1],[ ]) AC_MSG_RESULT(yes);; + esac], +- [AC_DEFINE(WITH_RAWIP) AC_MSG_RESULT(yes)]) ++ [AC_DEFINE([WITH_RAWIP],[1],[ ]) AC_MSG_RESULT(yes)]) + + AC_MSG_CHECKING(whether to include generic socket support) + AC_ARG_ENABLE(genericsocket, [ --disable-genericsocket disable generic socket support], + [case "$enableval" in + no) AC_MSG_RESULT(no);; +- *) AC_DEFINE(WITH_GENERICSOCKET) AC_MSG_RESULT(yes);; ++ *) AC_DEFINE([WITH_GENERICSOCKET],[1],[ ]) AC_MSG_RESULT(yes);; + esac], +- [AC_DEFINE(WITH_GENERICSOCKET) AC_MSG_RESULT(yes)]) ++ [AC_DEFINE([WITH_GENERICSOCKET],[1],[ ]) AC_MSG_RESULT(yes)]) + + AC_MSG_CHECKING(whether to include generic network interface support) + AC_ARG_ENABLE(interface, [ --disable-interface disable network interface support], +@@ -361,17 +361,17 @@ AC_MSG_CHECKING(whether to include TCP support) + AC_ARG_ENABLE(tcp, [ --disable-tcp disable TCP support], + [case "$enableval" in + no) AC_MSG_RESULT(no);; +- *) AC_DEFINE(WITH_TCP) AC_MSG_RESULT(yes);; ++ *) AC_DEFINE([WITH_TCP],[1],[ ]) AC_MSG_RESULT(yes);; + esac], +- [AC_DEFINE(WITH_TCP) AC_MSG_RESULT(yes)]) ++ [AC_DEFINE([WITH_TCP],[1],[ ]) AC_MSG_RESULT(yes)]) + + AC_MSG_CHECKING(whether to include UDP support) + AC_ARG_ENABLE(udp, [ --disable-udp disable UDP support], + [case "$enableval" in + no) AC_MSG_RESULT(no);; +- *) AC_DEFINE(WITH_UDP) AC_MSG_RESULT(yes);; ++ *) AC_DEFINE([WITH_UDP],[1],[ ]) AC_MSG_RESULT(yes);; + esac], +- [AC_DEFINE(WITH_UDP) AC_MSG_RESULT(yes)]) ++ [AC_DEFINE([WITH_UDP],[1],[ ]) AC_MSG_RESULT(yes)]) + + AC_MSG_CHECKING(whether to include UDP-Lite support) + AC_ARG_ENABLE(udplite, [ --disable-udplite disable UDP-Lite support], +@@ -388,7 +388,7 @@ AC_TRY_COMPILE([#include + [ AC_MSG_RESULT(yes); WITH_UDPLITE=1], + [ AC_MSG_RESULT(no); WITH_UDPLITE=]) + if test "$WITH_UDPLITE"; then +- AC_DEFINE(WITH_UDPLITE) ++ AC_DEFINE([WITH_UDPLITE],[1],[ ]) + fi + fi + +@@ -410,7 +410,7 @@ AC_CACHE_VAL(sc_cv_define_ipproto_sctp, + [sc_cv_define_ipproto_sctp=no])]) + AC_MSG_RESULT($sc_cv_define_ipproto_sctp) + if test $sc_cv_define_ipproto_sctp = yes; then +- AC_DEFINE(WITH_SCTP) ++ AC_DEFINE([WITH_SCTP],[1],[ ]) + else + AC_MSG_WARN([IPPROTO_SCTP undefined, disabling SCTP support]) + fi +@@ -426,9 +426,9 @@ AC_ARG_ENABLE(dccp, [ --disable-dccp disable DCCP support], + + if test -n "$WITH_DCCP"; then + AC_CHECK_HEADER(netinet/dccp.h, +- AC_DEFINE(HAVE_NETINET_DCCP_H)) ++ AC_DEFINE([HAVE_NETINET_DCCP_H],[1],[ ])) + AC_CHECK_HEADER(linux/dccp.h, +- AC_DEFINE(HAVE_LINUX_DCCP_H)) ++ AC_DEFINE([HAVE_LINUX_DCCP_H],[1],[ ])) + fi + if test -n "$WITH_DCCP"; then + AC_MSG_CHECKING(for IPPROTO_DCCP) +@@ -451,7 +451,7 @@ if test -n "$WITH_DCCP"; then + AC_MSG_RESULT($sc_cv_define_sock_dccp) + fi + if test -n "$WITH_DCCP"; then +- AC_DEFINE(WITH_DCCP) ++ AC_DEFINE([WITH_DCCP],[1],[ ]) + fi + + AC_MSG_CHECKING(whether to include vsock support) +@@ -463,7 +463,7 @@ AC_ARG_ENABLE(vsock, [ --disable-vsock disable vsock support], + [AC_MSG_RESULT(yes); WITH_VSOCK=1 ]) + if test "$WITH_VSOCK"; then + AC_CHECK_HEADER(linux/vm_sockets.h, +- AC_DEFINE(HAVE_LINUX_VM_SOCKETS_H), ++ AC_DEFINE([HAVE_LINUX_VM_SOCKETS_H],[1],[ ]), + [WITH_VSOCK=; + AC_MSG_WARN([include file linux/vm_sockets.h not found, disabling vsock])], + [AC_INCLUDES_DEFAULT +@@ -474,7 +474,7 @@ if test "$WITH_VSOCK"; then + ) + fi + if test "$WITH_VSOCK"; then +- AC_DEFINE(WITH_VSOCK) ++ AC_DEFINE([WITH_VSOCK],[1],[ ]) + fi + + AC_ARG_ENABLE(namespaces, [ --disable-namespaces disable Linux namespaces support], +@@ -486,15 +486,15 @@ AC_ARG_ENABLE(namespaces, [ --disable-namespaces disable Linux namespaces su + if test "TRY_NAMESPACES"; then + AC_TRY_LINK([#include ], + [int x=setns(0,0);], +- [], ++ [ ], + [TRY_NAMESPACES=failed]) + fi + AC_MSG_CHECKING(whether to include Linux namespaces support) + if test "$TRY_NAMESPACES" = 1; then + AC_MSG_RESULT(YES) +- AC_DEFINE(WITH_NAMESPACES) +- AC_DEFINE(HAVE_SCHED_H) +- AC_DEFINE(HAVE_SETNS) ++ AC_DEFINE([WITH_NAMESPACES],[1],[ ]) ++ AC_DEFINE([HAVE_SCHED_H],[1],[ ]) ++ AC_DEFINE([HAVE_SETNS],[1],[ ]) + elif test "$TRY_NAMESPACES" = yes; then + AC_MSG_RESULT(NO (failed)) + else +@@ -505,9 +505,9 @@ AC_MSG_CHECKING(whether to include listen support) + AC_ARG_ENABLE(listen, [ --disable-listen disable listen support], + [case "$enableval" in + no) AC_MSG_RESULT(no);; +- *) AC_DEFINE(WITH_LISTEN) AC_MSG_RESULT(yes);; ++ *) AC_DEFINE([WITH_LISTEN],[1],[ ]) AC_MSG_RESULT(yes);; + esac], +- [AC_DEFINE(WITH_LISTEN) AC_MSG_RESULT(yes)]) ++ [AC_DEFINE([WITH_LISTEN],[1],[ ]) AC_MSG_RESULT(yes)]) + + AC_MSG_CHECKING(whether to include POSIX MQ support) + AC_ARG_ENABLE(posixmq, [ --disable-posixmq disable POSIX MQ support], +@@ -526,7 +526,7 @@ if test "$WITH_POSIXMQ"; then + fi + if test "$WITH_POSIXMQ"; then + case "`uname`" in +- Linux) AC_DEFINE(WITH_POSIXMQ) ++ Linux) AC_DEFINE([WITH_POSIXMQ],[1],[ ]) + LIBS="$LIBS -lrt" ;; + *) AC_MSG_WARN([POSIX MQ currently implemented for Linux only]) + WITH_POSIXMQ= ;; +@@ -537,73 +537,73 @@ AC_MSG_CHECKING(whether to include socks4 support) + AC_ARG_ENABLE(socks4, [ --disable-socks4 disable socks4 support], + [case "$enableval" in + no) AC_MSG_RESULT(no);; +- *) AC_DEFINE(WITH_SOCKS4) AC_MSG_RESULT(yes);; ++ *) AC_DEFINE([WITH_SOCKS4],[1],[ ]) AC_MSG_RESULT(yes);; + esac], +- [AC_DEFINE(WITH_SOCKS4) AC_MSG_RESULT(yes)]) ++ [AC_DEFINE([WITH_SOCKS4],[1],[ ]) AC_MSG_RESULT(yes)]) + + AC_MSG_CHECKING(whether to include socks4a support) + AC_ARG_ENABLE(socks4a, [ --disable-socks4a disable socks4a support], + [case "$enableval" in + no) AC_MSG_RESULT(no);; +- *) AC_DEFINE(WITH_SOCKS4A) AC_MSG_RESULT(yes);; ++ *) AC_DEFINE([WITH_SOCKS4A],[1],[ ]) AC_MSG_RESULT(yes);; + esac], +- [AC_DEFINE(WITH_SOCKS4A) AC_MSG_RESULT(yes)]) ++ [AC_DEFINE([WITH_SOCKS4A],[1],[ ]) AC_MSG_RESULT(yes)]) + + AC_MSG_CHECKING(whether to include socks5 support) + AC_ARG_ENABLE(socks5, [ --disable-socks5 disable socks5 support], + [case "$enableval" in + no) AC_MSG_RESULT(no);; +- *) AC_DEFINE(WITH_SOCKS5) AC_MSG_RESULT(yes);; ++ *) AC_DEFINE([WITH_SOCKS5],[1],[ ]) AC_MSG_RESULT(yes);; + esac], +- [AC_DEFINE(WITH_SOCKS5) AC_MSG_RESULT(yes)]) ++ [AC_DEFINE([WITH_SOCKS5],[1],[ ]) AC_MSG_RESULT(yes)]) + + AC_MSG_CHECKING(whether to include proxy connect support) + AC_ARG_ENABLE(proxy, [ --disable-proxy disable proxy connect support], + [case "$enableval" in + no) AC_MSG_RESULT(no);; +- *) AC_DEFINE(WITH_PROXY) AC_MSG_RESULT(yes);; ++ *) AC_DEFINE([WITH_PROXY],[1],[ ]) AC_MSG_RESULT(yes);; + esac], +- [AC_DEFINE(WITH_PROXY) AC_MSG_RESULT(yes)]) ++ [AC_DEFINE([WITH_PROXY],[1],[ ]) AC_MSG_RESULT(yes)]) + + AC_MSG_CHECKING(whether to include exec support) + AC_ARG_ENABLE(exec, [ --disable-exec disable exec support], + [case "$enableval" in + no) AC_MSG_RESULT(no);; +- *) AC_DEFINE(WITH_EXEC) AC_MSG_RESULT(yes);; ++ *) AC_DEFINE([WITH_EXEC],[1],[ ]) AC_MSG_RESULT(yes);; + esac], +- [AC_DEFINE(WITH_EXEC) AC_MSG_RESULT(yes)]) ++ [AC_DEFINE([WITH_EXEC],[1],[ ]) AC_MSG_RESULT(yes)]) + + AC_MSG_CHECKING([whether to include system (shell) support]) + AC_ARG_ENABLE(system, [ --disable-system disable system (shell) support], + [case "$enableval" in + no) AC_MSG_RESULT(no);; +- *) AC_DEFINE(WITH_SYSTEM) AC_MSG_RESULT(yes);; ++ *) AC_DEFINE([WITH_SYSTEM],[1],[ ]) AC_MSG_RESULT(yes);; + esac], +- [AC_DEFINE(WITH_SYSTEM) AC_MSG_RESULT(yes)]) ++ [AC_DEFINE([WITH_SYSTEM],[1],[ ]) AC_MSG_RESULT(yes)]) + + AC_MSG_CHECKING([whether to include shell invocation support]) + AC_ARG_ENABLE(shell, [ --disable-shell disable shell invocation support], + [case "$enableval" in + no) AC_MSG_RESULT(no);; +- *) AC_DEFINE(WITH_SHELL) AC_MSG_RESULT(yes);; ++ *) AC_DEFINE([WITH_SHELL],[1],[ ]) AC_MSG_RESULT(yes);; + esac], +- [AC_DEFINE(WITH_SHELL) AC_MSG_RESULT(yes)]) ++ [AC_DEFINE([WITH_SHELL],[1],[ ]) AC_MSG_RESULT(yes)]) + + AC_MSG_CHECKING(whether to include pty address support) + AC_ARG_ENABLE(pty, [ --disable-pty disable pty support], + [case "$enableval" in + no) AC_MSG_RESULT(no);; +- *) AC_DEFINE(WITH_PTY) AC_MSG_RESULT(yes);; ++ *) AC_DEFINE([WITH_PTY],[1],[ ]) AC_MSG_RESULT(yes);; + esac], +- [AC_DEFINE(WITH_PTY) AC_MSG_RESULT(yes)]) ++ [AC_DEFINE([WITH_PTY],[1],[ ]) AC_MSG_RESULT(yes)]) + + AC_MSG_CHECKING(whether to include fs attributes support) + AC_ARG_ENABLE(fs, [ --disable-fs disable fs attributes support], + [case "$enableval" in + no) AC_MSG_RESULT(no);; +- *) AC_DEFINE(WITH_FS) AC_MSG_RESULT(yes);; ++ *) AC_DEFINE([WITH_FS],[1],[ ]) AC_MSG_RESULT(yes);; + esac], +- [AC_DEFINE(WITH_FS) AC_MSG_RESULT(yes)]) ++ [AC_DEFINE([WITH_FS],[1],[ ]) AC_MSG_RESULT(yes)]) + + AC_MSG_CHECKING(whether to include readline support) + AC_ARG_ENABLE(readline, [ --disable-readline disable readline support], +@@ -648,10 +648,10 @@ if test -n "$WITH_READLINE"; then + + if test -n "$sc_usable_readline_found"; then + AC_MSG_RESULT(yes) +- AC_DEFINE(HAVE_READLINE_READLINE_H,1) +- AC_DEFINE(HAVE_READLINE_HISTORY_H,1) +- AC_DEFINE(HAVE_LIBREADLINE,1) +- AC_DEFINE(WITH_READLINE,1) ++ AC_DEFINE([HAVE_READLINE_READLINE_H],[1],[ ]) ++ AC_DEFINE([HAVE_READLINE_HISTORY_H],[1],[ ]) ++ AC_DEFINE([HAVE_LIBREADLINE],[1],[ ]) ++ AC_DEFINE([WITH_READLINE],[1],[ ]) + break + else + AC_MSG_RESULT(no) +@@ -666,6 +666,82 @@ if test -n "$WITH_READLINE"; then + fi + fi + ++AC_MSG_CHECKING(whether to include wolfSSL support) ++WOLFSSL_URL="https://www.wolfssl.com/download/" ++AC_ARG_WITH(wolfssl, ++ [ --with-wolfssl=PATH PATH to wolfssl install (default /usr/local) ], ++ [ ++ if test "x$withval" != "xno"; then ++ if test -d "$withval/lib"; then ++ LDFLAGS="-L${withval}/lib ${LDFLAGS}" ++ fi ++ if test -d "$withval/include"; then ++ CPPFLAGS="$CPPFLAGS -I${withval}/include -I${withval}/include/wolfssl" ++ fi ++ fi ++ if test "x$withval" == "xyes" ; then ++ LDFLAGS="-L/usr/local/lib $LDFLAGS" ++ CPPFLAGS="-I/usr/local/include -I/usr/local/include/wolfssl $CPPFLAGS" ++ fi ++ LIBS="$LIBS -lwolfssl" ++ CPPFLAGS="$CPPFLAGS -DWOLFSSL_USE_OPTIONS_H" ++ ++ AC_MSG_RESULT([yes]) ++ WITH_WOLFSSL=yes ++ ++ AC_DEFINE([WITH_WOLFSSL],[1],[ ]) ++ AC_DEFINE([WITH_OPENSSL],[1],[ ]) ++ AC_DEFINE([WITH_OPENSSL_METHOD],[1],[ ]) ++ ++ # Note that we are disabling compression when using wolfSSL. ++ AC_DEFINE([OPENSSL_NO_COMP],[1],[ ]) ++ ++ AC_CHECK_FUNC([wolfTLS_client_method], [AC_DEFINE([HAVE_TLS_client_method],[1],[ ])], [ ]) ++ AC_CHECK_FUNC([wolfTLS_server_method], [AC_DEFINE([HAVE_TLS_server_method],[1],[ ])], [ ]) ++ AC_CHECK_FUNC([wolfDTLS_client_method], [AC_DEFINE([HAVE_DTLS_client_method],[1],[ ])], [ ]) ++ AC_CHECK_FUNC([wolfDTLS_server_method], [AC_DEFINE([HAVE_DTLS_server_method],[1],[ ])], [ ]) ++ AC_CHECK_FUNC([wolfSSLv2_client_method], [AC_DEFINE([HAVE_SSLv2_client_method],[1],[ ])], [ ]) ++ AC_CHECK_FUNC([wolfSSLv2_server_method], [AC_DEFINE([HAVE_SSLv2_server_method],[1],[ ])], [ ]) ++ AC_CHECK_FUNC([wolfSSLv3_client_method], [AC_DEFINE([HAVE_SSLv3_client_method],[1],[ ])], [ ]) ++ AC_CHECK_FUNC([wolfSSLv3_server_method], [AC_DEFINE([HAVE_SSLv3_server_method],[1],[ ])], [ ]) ++ AC_CHECK_FUNC([wolfSSLv23_client_method], [AC_DEFINE([HAVE_SSLv23_client_method],[1],[ ])], [ ]) ++ AC_CHECK_FUNC([wolfSSLv23_server_method], [AC_DEFINE([HAVE_SSLv23_server_method],[1],[ ])], [ ]) ++ AC_CHECK_FUNC([wolfTLSv1_client_method], [AC_DEFINE([HAVE_TLSv1_client_method],[1],[ ])], [ ]) ++ AC_CHECK_FUNC([wolfTLSv1_server_method], [AC_DEFINE([HAVE_TLSv1_server_method],[1],[ ])], [ ]) ++ AC_CHECK_FUNC([wolfTLSv1_1_client_method], [AC_DEFINE([HAVE_TLSv1_1_client_method],[1],[ ])], [ ]) ++ AC_CHECK_FUNC([wolfTLSv1_1_server_method], [AC_DEFINE([HAVE_TLSv1_1_server_method],[1],[ ])], [ ]) ++ AC_CHECK_FUNC([wolfTLSv1_2_client_method], [AC_DEFINE([HAVE_TLSv1_2_client_method],[1],[ ])], [ ]) ++ AC_CHECK_FUNC([wolfTLSv1_2_server_method], [AC_DEFINE([HAVE_TLSv1_2_server_method],[1],[ ])], [ ]) ++ AC_CHECK_FUNC([wolfDTLSv1_client_method], [AC_DEFINE([HAVE_DTLSv1_client_method],[1],[ ])], [ ]) ++ AC_CHECK_FUNC([wolfDTLSv1_server_method], [AC_DEFINE([HAVE_DTLSv1_server_method],[1],[ ])], [ ]) ++ AC_CHECK_FUNC([wolfDTLSv1_2_client_method], [AC_DEFINE([HAVE_DTLSv1_2_client_method],[1],[ ])], [ ]) ++ AC_CHECK_FUNC([wolfDTLSv1_2_server_method], [AC_DEFINE([HAVE_DTLSv1_2_server_method],[1],[ ])], [ ]) ++ AC_CHECK_FUNC([wolfSSL_RAND_egd], [AC_DEFINE([HAVE_RAND_egd],[1],[ ])], [ ]) ++ AC_CHECK_FUNC([wolfSSL_DH_set0_pqg], [AC_DEFINE([HAVE_DH_set0_pqg],[1],[ ])], [ ]) ++ AC_CHECK_FUNC([wolfSSL_ASN1_STRING_data], [AC_DEFINE([HAVE_ASN1_STRING_get0_data],[1],[ ])], [ ]) ++ AC_CHECK_FUNC([wolfSSL_RAND_status], [AC_DEFINE([HAVE_RAND_status],[1],[ ])], [ ]) ++ AC_CHECK_FUNC([wolfSSL_set_tlsext_host_name], [AC_DEFINE([HAVE_SSL_set_tlsext_host_name],[1],[ ])], [ ]) ++ AC_CHECK_FUNC([wolfSSL_library_init], [AC_DEFINE([HAVE_SSL_library_init],[1],[ ])], [ ]) ++ AC_CHECK_FUNC([wolfSSL_OPENSSL_init_ssl], [AC_DEFINE([HAVE_OPENSSL_init_ssl],[1],[ ])], [ ]) ++ AC_CHECK_FUNC([wolfSSL_ERR_error_string], [AC_DEFINE([HAVE_ERR_error_string],[1],[ ])], [ ]) ++ AC_CHECK_FUNC([wolfSSL_CTX_set_min_proto_version], [AC_DEFINE([HAVE_SSL_CTX_set_min_proto_version],[1],[ ])], [ ]) ++ AC_CHECK_FUNC([wolfSSL_CTX_set_max_proto_version], [AC_DEFINE([HAVE_SSL_CTX_set_max_proto_version],[1],[ ])], [ ]) ++ ++ AC_MSG_CHECKING(for type WOLFSSL_EC_KEY) ++ AC_TRY_COMPILE([#include ], [EC_KEY *s;], [HAVE_TYPE_EC_KEY=yes], [HAVE_TYPE_EC_KEY=no]) ++ if test "$HAVE_TYPE_EC_KEY" = "yes" ++ then ++ AC_DEFINE([HAVE_TYPE_EC_KEY],[1],[ ]) ++ AC_MSG_RESULT([yes]) ++ else ++ AC_MSG_RESULT([no]) ++ fi ++ ], ++ [AC_MSG_RESULT([no]); WITH_WOLFSSL=no] ++) ++ ++if test "$WITH_WOLFSSL" != "yes" ++then + AC_MSG_CHECKING(whether to include openssl support) + AC_ARG_ENABLE(openssl, [ --disable-openssl disable OpenSSL support], + [ case "$enableval" in +@@ -699,12 +775,13 @@ if test -n "$WITH_OPENSSL"; then + ]) + ]) + if test "$sc_cv_have_openssl_ssl_h" = "yes"; then +- AC_DEFINE(HAVE_OPENSSL_SSL_H) ++ AC_DEFINE([HAVE_OPENSSL_SSL_H],[1],[ ]) + fi + AC_MSG_NOTICE(checked for openssl/ssl.h... $sc_cv_have_openssl_ssl_h) + fi + fi # end checking for openssl/ssl.h + # ++fi + + #if test -n "$WITH_OPENSSL"; then + # AC_CHECK_FUNCS(OPENSSL_init_ssl, SSL_library_init) +@@ -739,7 +816,7 @@ if test -n "$WITH_OPENSSL" -a "$sc_cv_have_openssl_ssl_h" = 'yes'; then + ] + ) + if test "$sc_cv_have_libssl" = 'yes'; then +- AC_DEFINE(HAVE_LIBSSL) ++ AC_DEFINE([HAVE_LIBSSL],[1],[ ]) + fi + AC_MSG_RESULT($sc_cv_have_libssl) + fi +@@ -767,7 +844,7 @@ fi + #fi + if test -n "$WITH_OPENSSL"; then + if test "$sc_cv_have_openssl_ssl_h" = "yes" -a "$sc_cv_have_libssl" = "yes"; then +- AC_DEFINE(WITH_OPENSSL) ++ AC_DEFINE([WITH_OPENSSL],[1],[ ]) + else + AC_MSG_WARN([not all components of OpenSSL found, disabling it]); + fi +@@ -775,11 +852,11 @@ fi + + # Guarded for OpenBSD + AC_CHECK_FUNCS(OPENSSL_init_ssl SSL_library_init OPENSSL_INIT_new) +-AC_CHECK_TYPE(OPENSSL_INIT_SETTINGS, AC_DEFINE(HAVE_TYPE_OPENSSL_INIT_SETTINGS),,[#include "openssl.h"]) ++AC_CHECK_TYPE(OPENSSL_INIT_SETTINGS, AC_DEFINE([HAVE_TYPE_OPENSSL_INIT_SETTINGS],[1],[ ]),,[#include "openssl.h"]) + + #; sc_cv_have_SSL_library_init='yes'; AC_DEFINE(HAVE_SSL_library_init) + #if test -n "$WITH_OPENSSL"; then +-# AC_CHECK_LIB(crypto, CRYPTO_new_ex_data, [], [AC_MSG_ERROR([library 'crypto' is required for OpenSSL])]) ++# AC_CHECK_LIB(crypto, CRYPTO_new_ex_data, [ ], [AC_MSG_ERROR([library 'crypto' is required for OpenSSL])]) + # FOUND_SSL_LIB="no" + # AC_CHECK_LIB(ssl, OPENSSL_init_ssl, [FOUND_SSL_LIB="yes"]) + # AC_CHECK_LIB(ssl, SSL_library_init, [FOUND_SSL_LIB="yes"]) +@@ -792,7 +869,7 @@ AC_MSG_CHECKING(whether to include OpenSSL method option) + AC_ARG_ENABLE(openssl-method, [ --enable-openssl-method enable OpenSSL method option], + [case "$enableval" in + no) AC_MSG_RESULT(no);; +- *) AC_DEFINE(WITH_OPENSSL_METHOD) WITH_OPENSSL_METHOD=1; AC_MSG_RESULT(yes);; ++ *) AC_DEFINE([WITH_OPENSSL_METHOD],[1],[ ]) WITH_OPENSSL_METHOD=1; AC_MSG_RESULT(yes);; + esac], + [AC_MSG_RESULT(no)]) + fi +@@ -801,38 +878,41 @@ AC_MSG_CHECKING(whether to include undocumented resolver related options) + AC_ARG_ENABLE(resolve, [ --enable-resolve enable undocumented resolver options], + [case "$enableval" in + no) AC_MSG_RESULT(no);; +- *) AC_DEFINE(WITH_RESOLVE) AC_MSG_RESULT(yes);; ++ *) AC_DEFINE([WITH_RESOLVE],[1],[ ]) AC_MSG_RESULT(yes);; + esac], +- [AC_DEFINE(WITH_RESOLVE) AC_MSG_RESULT(yes)]) ++ [AC_DEFINE([WITH_RESOLVE],[1],[ ]) AC_MSG_RESULT(yes)]) + + AC_MSG_CHECKING(whether to include deprecated resolver option) + AC_ARG_ENABLE(res-deprecated, [ --enable-res-deprecated enable deprecated resolver options], + [case "$enableval" in + no) AC_MSG_RESULT(no);; +- *) AC_DEFINE(WITH_RES_DEPRECATED) WITH_RES_DEPRECATED=1; AC_MSG_RESULT(yes);; ++ *) AC_DEFINE([WITH_RES_DEPRECATED],[1],[ ]) WITH_RES_DEPRECATED=1; AC_MSG_RESULT(yes);; + esac], + [AC_MSG_RESULT(no)]) + +-# check for fips support +-AC_MSG_CHECKING(whether to include openssl fips support) +-AC_ARG_ENABLE(fips, [ --enable-fips enable OpenSSL FIPS support], +- [ case "$enableval" in +- yes) AC_MSG_RESULT(yes); WITH_FIPS=1 ;; +- *) AC_MSG_RESULT(no); WITH_FIPS= ;; +- esac], +- [ AC_MSG_RESULT(no); WITH_FIPS= ]) +- +-if test -n "$WITH_FIPS"; then +- if test -n "$WITH_OPENSSL"; then +- AC_CHECK_PROG(HAVE_FIPSLD, fipsld, 1) +- if test "$sc_cv_have_openssl_ssl_h" != "yes" -o "$sc_cv_have_libssl" != "yes" -o ! "$HAVE_FIPSLD"; +- then +- AC_MSG_WARN([not all components of OpenSSL found, disabling FIPS]); +- WITH_FIPS= ++if test "$WITH_WOLFSSL" != "yes" ++then ++ # check for fips support ++ AC_MSG_CHECKING(whether to include openssl fips support) ++ AC_ARG_ENABLE(fips, [ --enable-fips enable OpenSSL FIPS support], ++ [ case "$enableval" in ++ yes) AC_MSG_RESULT(yes); WITH_FIPS=1 ;; ++ *) AC_MSG_RESULT(no); WITH_FIPS= ;; ++ esac], ++ [ AC_MSG_RESULT(no); WITH_FIPS= ]) ++ ++ if test -n "$WITH_FIPS"; then ++ if test -n "$WITH_OPENSSL"; then ++ AC_CHECK_PROG(HAVE_FIPSLD, fipsld, 1) ++ if test "$sc_cv_have_openssl_ssl_h" != "yes" -o "$sc_cv_have_libssl" != "yes" -o ! "$HAVE_FIPSLD"; ++ then ++ AC_MSG_WARN([not all components of OpenSSL found, disabling FIPS]); ++ WITH_FIPS= ++ fi ++ else ++ AC_MSG_WARN([must enable OpenSSL to enable FIPS; use --enable-openssl]); ++ fi + fi +- else +- AC_MSG_WARN([must enable OpenSSL to enable FIPS; use --enable-openssl]); +- fi + fi + + if test -n "$WITH_FIPS"; then +@@ -856,7 +936,7 @@ if test -n "$WITH_FIPS"; then + )] + ) + if test "$sv_cv_have_openssl_fips_h" = "yes"; then +- AC_DEFINE(HAVE_OPENSSL_FIPS_H) ++ AC_DEFINE([HAVE_OPENSSL_FIPS_H],[1],[ ]) + fi + AC_MSG_NOTICE(checked for openssl/fips.h... $sc_cv_have_openssl_ssl_h) + fi +@@ -887,15 +967,15 @@ if test -n "$WITH_FIPS" -a "$sc_cv_have_openssl_fips_h" = 'yes'; then + ] + ) + if test "$sc_cv_have_libcrypto" = 'yes'; then +- AC_DEFINE(HAVE_LIBCRYPTO) ++ AC_DEFINE([HAVE_LIBCRYPTO],[1],[ ]) + fi + AC_MSG_RESULT($sc_cv_have_libcrypto) + fi + + if test -n "$WITH_FIPS"; then + if test "$sc_cv_have_openssl_fips_h" = 'yes' -a "$sc_cv_have_libcrypto" = 'yes'; then +- AC_DEFINE(WITH_FIPS) +- AC_DEFINE(OPENSSL_FIPS) ++ AC_DEFINE([WITH_FIPS],[1],[ ]) ++ AC_DEFINE([OPENSSL_FIPS],[1],[ ]) + else + AC_MSG_WARN([not all components of OpenSSL FIPS found, disabling it]); + fi +@@ -916,12 +996,12 @@ if ! test "$ac_cv_header_linux_if_tun_h" = 'yes'; then + fi + # + if test -n "$WITH_TUN"; then +- AC_DEFINE(WITH_TUN) ++ AC_DEFINE([WITH_TUN],[1],[ ]) + fi + + if test "$WITH_INTERFACE"; then + AC_CHECK_HEADER(netinet/if_ether.h, +- AC_DEFINE(HAVE_NETINET_IF_ETHER_H), ++ AC_DEFINE([HAVE_NETINET_IF_ETHER_H],[1],[ ]), + [WITH_INTERFACE=; + AC_MSG_WARN([include file netinet/if_ether.h not found, disabling interface])], + [AC_INCLUDES_DEFAULT +@@ -933,17 +1013,17 @@ fi + + if test "$WITH_INTERFACE" || test "$WITH_TUN"; then + AC_CHECK_HEADER(linux/if_packet.h, +- AC_DEFINE(HAVE_LINUX_IF_PACKET_H), ++ AC_DEFINE([HAVE_LINUX_IF_PACKET_H],[1],[ ]), + [WITH_INTERFACE=; + AC_MSG_WARN([include file linux/if_packet.h not found, disabling interface])]) + fi + if test "$WITH_INTERFACE"; then +- AC_DEFINE(WITH_INTERFACE) ++ AC_DEFINE([WITH_INTERFACE],[1],[ ]) + fi + + if test "$WITH_INTERFACE" || test "$WITH_TUN"; then + AC_CHECK_HEADERS(asm/types.h) +- AC_CHECK_HEADER(linux/rtnetlink.h, AC_DEFINE(HAVE_LINUX_RTNETLINK_H), [], [AC_INCLUDES_DEFAULT ++ AC_CHECK_HEADER(linux/rtnetlink.h, AC_DEFINE([HAVE_LINUX_RTNETLINK_H],[1],[ ]), [ ], [AC_INCLUDES_DEFAULT + #if HAVE_ASM_TYPES_H + #include + #endif]) +@@ -954,10 +1034,10 @@ AC_MSG_CHECKING(whether to include system call tracing) + AC_ARG_ENABLE(sycls, [ --disable-sycls disable system call tracing], + [case "$enableval" in + no) SYCLS=""; SSLCLS=""; AC_MSG_RESULT(no);; +- *) AC_DEFINE(WITH_SYCLS) ++ *) AC_DEFINE([WITH_SYCLS],[1],[ ]) + SYCLS="sycls.c"; SSLCLS="sslcls.c"; AC_MSG_RESULT(yes);; + esac], +- [AC_DEFINE(WITH_SYCLS) ++ [AC_DEFINE([WITH_SYCLS],[1],[ ]) + SYCLS="sycls.c"; SSLCLS="sslcls.c"; AC_MSG_RESULT(yes)]) + AC_SUBST(SYCLS) + AC_SUBST(SSLCLS) +@@ -966,23 +1046,23 @@ AC_MSG_CHECKING(whether to include file descriptor analyzer) + AC_ARG_ENABLE(filan, [ --disable-filan disable file descriptor analyzer], + [case "$enableval" in + no) FILAN=""; AC_MSG_RESULT(no);; +- *) AC_DEFINE(WITH_FILAN) FILAN="filan.c"; AC_MSG_RESULT(yes);; ++ *) AC_DEFINE([WITH_FILAN],[1],[ ]) FILAN="filan.c"; AC_MSG_RESULT(yes);; + esac], +- [AC_DEFINE(WITH_FILAN) FILAN="filan.c"; AC_MSG_RESULT(yes)]) ++ [AC_DEFINE([WITH_FILAN],[1],[ ]) FILAN="filan.c"; AC_MSG_RESULT(yes)]) + AC_SUBST(FILAN) + + AC_MSG_CHECKING(whether to include retry support) + AC_ARG_ENABLE(retry, [ --disable-retry disable retry support], + [case "$enableval" in + no) AC_MSG_RESULT(no);; +- *) AC_DEFINE(WITH_RETRY) AC_MSG_RESULT(yes);; ++ *) AC_DEFINE([WITH_RETRY],[1],[ ]) AC_MSG_RESULT(yes);; + esac], +- [AC_DEFINE(WITH_RETRY) AC_MSG_RESULT(yes)]) ++ [AC_DEFINE([WITH_RETRY],[1],[ ]) AC_MSG_RESULT(yes)]) + + AC_MSG_CHECKING(whether to include devtests support) + AC_ARG_ENABLE(devtests, [ --enable-devtests enable devtests support], + [case "$enableval" in +- yes) AC_DEFINE(WITH_DEVTESTS) AC_MSG_RESULT(yes);; ++ yes) AC_DEFINE([WITH_DEVTESTS],[1],[ ]) AC_MSG_RESULT(yes);; + *) AC_MSG_RESULT(no) ;; + esac], + [AC_MSG_RESULT(no)]) +@@ -991,26 +1071,26 @@ AC_ARG_ENABLE(devtests, [ --enable-devtests enable devtests support], + AC_MSG_CHECKING(included message level) + AC_ARG_ENABLE(msglevel, [ --enable-msglevel=N set max verbosity to debug,info,notice,warn,error,fatal], + [case "$enableval" in +- 0|DEBUG|Debug|debug) AC_DEFINE(WITH_MSGLEVEL,0) AC_MSG_RESULT(debug);; +- 1|INFO|Info|info) AC_DEFINE(WITH_MSGLEVEL,1) AC_MSG_RESULT(info);; +- 2|NOTICE|Notice|notice) AC_DEFINE(WITH_MSGLEVEL,2) AC_MSG_RESULT(notice);; +- 3|WARN|Warn|warn) AC_DEFINE(WITH_MSGLEVEL,3) AC_MSG_RESULT(warn);; +- 4|ERROR|Error|error) AC_DEFINE(WITH_MSGLEVEL,4) AC_MSG_RESULT(error);; +- 5|FATAL|Fatal|fatal) AC_DEFINE(WITH_MSGLEVEL,5) AC_MSG_RESULT(fatal);; +- *) AC_DEFINE(WITH_MSGLEVEL,0) AC_MSG_RESULT(debug);; ++ 0|DEBUG|Debug|debug) AC_DEFINE([WITH_MSGLEVEL],[0],[ ]) AC_MSG_RESULT(debug);; ++ 1|INFO|Info|info) AC_DEFINE([WITH_MSGLEVEL],[1],[ ]) AC_MSG_RESULT(info);; ++ 2|NOTICE|Notice|notice) AC_DEFINE([WITH_MSGLEVEL],[2],[ ]) AC_MSG_RESULT(notice);; ++ 3|WARN|Warn|warn) AC_DEFINE([WITH_MSGLEVEL],[3],[ ]) AC_MSG_RESULT(warn);; ++ 4|ERROR|Error|error) AC_DEFINE([WITH_MSGLEVEL],[4],[ ]) AC_MSG_RESULT(error);; ++ 5|FATAL|Fatal|fatal) AC_DEFINE([WITH_MSGLEVEL],[5],[ ]) AC_MSG_RESULT(fatal);; ++ *) AC_DEFINE([WITH_MSGLEVEL],[0],[ ]) AC_MSG_RESULT(debug);; + esac], +- [AC_DEFINE(WITH_MSGLEVEL,0) AC_MSG_RESULT(debug)]) ++ [AC_DEFINE([WITH_MSGLEVEL],[0],[ ]) AC_MSG_RESULT(debug)]) + + AC_MSG_CHECKING(default IP version) + AC_ARG_ENABLE(default-ipv, [ --enable-default-ipv=N set default/preferred IP version to "0" (none), "4", "6"], + [case "$enableval" in +- "") AC_DEFINE(WITH_DEFAULT_IPV, '4') AC_MSG_RESULT("0");; +- 0) AC_DEFINE(WITH_DEFAULT_IPV, '0') AC_MSG_RESULT("4");; +- 4) AC_DEFINE(WITH_DEFAULT_IPV, '4') AC_MSG_RESULT("4");; +- 6) AC_DEFINE(WITH_DEFAULT_IPV, '6') AC_MSG_RESULT("6");; +- *) AC_DEFINE(WITH_DEFAULT_IPV, '4') AC_MSG_RESULT("0");; ++ "") AC_DEFINE([WITH_DEFAULT_IPV],['4'],[ ]) AC_MSG_RESULT("0");; ++ 0) AC_DEFINE([WITH_DEFAULT_IPV],['0'],[ ]) AC_MSG_RESULT("4");; ++ 4) AC_DEFINE([WITH_DEFAULT_IPV],['4'],[ ]) AC_MSG_RESULT("4");; ++ 6) AC_DEFINE([WITH_DEFAULT_IPV],['6'],[ ]) AC_MSG_RESULT("6");; ++ *) AC_DEFINE([WITH_DEFAULT_IPV],['4'],[ ]) AC_MSG_RESULT("0");; + esac], +- [AC_DEFINE(WITH_DEFAULT_IPV, '4') AC_MSG_RESULT("0")]) ++ [AC_DEFINE([WITH_DEFAULT_IPV],['4'],[ ]) AC_MSG_RESULT("0")]) + + + #AC_SUBST(V_INCL) +@@ -1028,7 +1108,7 @@ AC_STRUCT_ST_RDEV + AC_HEADER_TIME + + dnl Check for extra realtime library (for Solaris) +-AC_CHECK_FUNC(nanosleep, AC_DEFINE(HAVE_NANOSLEEP), AC_CHECK_LIB(rt, nanosleep, [LIBS="-lrt $LIBS"; AC_DEFINE(HAVE_NANOSLEEP)])) ++AC_CHECK_FUNC(nanosleep, AC_DEFINE([HAVE_NANOSLEEP],[1],[ ]), AC_CHECK_LIB(rt, nanosleep, [LIBS="-lrt $LIBS"; AC_DEFINE([HAVE_NANOSLEEP],[1],[ ])])) + #AC_CHECK_FUNC(nanosleep, , AC_CHECK_LIB(rt, nanosleep)) + + dnl Checks for library functions. +@@ -1064,15 +1144,15 @@ AC_CHECK_PROTOTYPE_LIB(ptsname) + + AC_MSG_CHECKING(for long long) + AC_CACHE_VAL(sc_cv_type_longlong, +-[AC_TRY_COMPILE([],[long long s;], ++[AC_TRY_COMPILE([ ],[long long s;], + [sc_cv_type_longlong=yes], + [sc_cv_type_longlong=no])]) + if test $sc_cv_type_longlong = yes; then +- AC_DEFINE(HAVE_TYPE_LONGLONG) ++ AC_DEFINE([HAVE_TYPE_LONGLONG],[1],[ ]) + fi + AC_MSG_RESULT($sc_cv_type_longlong) + +-AC_CHECK_TYPE(sig_atomic_t,AC_DEFINE(HAVE_TYPE_SIG_ATOMIC_T),,[#include "sysincludes.h"]) ++AC_CHECK_TYPE(sig_atomic_t,AC_DEFINE([HAVE_TYPE_SIG_ATOMIC_T],[1],[ ]),,[#include "sysincludes.h"]) + + AC_MSG_CHECKING(for bool) + AC_CACHE_VAL(sc_cv_type_bool, +@@ -1083,7 +1163,7 @@ AC_CACHE_VAL(sc_cv_type_bool, + [sc_cv_type_bool=yes], + [sc_cv_type_bool=no])]) + if test $sc_cv_type_bool = yes; then +- AC_DEFINE(HAVE_TYPE_BOOL) ++ AC_DEFINE([HAVE_TYPE_BOOL],[1],[ ]) + fi + AC_MSG_RESULT($sc_cv_type_bool) + +@@ -1099,7 +1179,7 @@ AC_CACHE_VAL(sc_cv_type_socklen, + [sc_cv_type_socklen=yes], + [sc_cv_type_socklen=no])]) + if test $sc_cv_type_socklen = yes; then +- AC_DEFINE(HAVE_TYPE_SOCKLEN) ++ AC_DEFINE([HAVE_TYPE_SOCKLEN],[1],[ ]) + fi + AC_MSG_RESULT($sc_cv_type_socklen) + +@@ -1109,7 +1189,7 @@ AC_CACHE_VAL(sc_cv_type_stat64, + [sc_cv_type_stat64=yes], + [sc_cv_type_stat64=no])]) + if test $sc_cv_type_stat64 = yes; then +- AC_DEFINE(HAVE_TYPE_STAT64) ++ AC_DEFINE([HAVE_TYPE_STAT64],[1],[ ]) + fi + AC_MSG_RESULT($sc_cv_type_stat64) + +@@ -1119,7 +1199,7 @@ AC_CACHE_VAL(sc_cv_type_off64, + [sc_cv_type_off64=yes], + [sc_cv_type_off64=no])]) + if test $sc_cv_type_off64 = yes; then +- AC_DEFINE(HAVE_TYPE_OFF64) ++ AC_DEFINE([HAVE_TYPE_OFF64],[1],[ ]) + fi + AC_MSG_RESULT($sc_cv_type_off64) + +@@ -1129,7 +1209,7 @@ AC_CACHE_VAL(sc_cv_type_sighandler, + [sc_cv_type_sighandler=yes], + [sc_cv_type_sighandler=no])]) + if test $sc_cv_type_sighandler = yes; then +- AC_DEFINE(HAVE_TYPE_SIGHANDLER) ++ AC_DEFINE([HAVE_TYPE_SIGHANDLER],[1],[ ]) + fi + AC_MSG_RESULT($sc_cv_type_socklen) + +@@ -1147,7 +1227,7 @@ AC_CACHE_VAL(sc_cv_type_uint8, + [sc_cv_type_uint8=yes], + [sc_cv_type_uint8=no])]) + if test $sc_cv_type_uint8 = yes; then +- AC_DEFINE(HAVE_TYPE_UINT8) ++ AC_DEFINE([HAVE_TYPE_UINT8],[1],[ ]) + fi + AC_MSG_RESULT($sc_cv_type_uint8) + +@@ -1165,7 +1245,7 @@ AC_CACHE_VAL(sc_cv_type_uint16, + [sc_cv_type_uint16=yes], + [sc_cv_type_uint16=no])]) + if test $sc_cv_type_uint16 = yes; then +- AC_DEFINE(HAVE_TYPE_UINT16) ++ AC_DEFINE([HAVE_TYPE_UINT16],[1],[ ]) + fi + AC_MSG_RESULT($sc_cv_type_uint16) + +@@ -1183,7 +1263,7 @@ AC_CACHE_VAL(sc_cv_type_uint32, + [sc_cv_type_uint32=yes], + [sc_cv_type_uint32=no])]) + if test $sc_cv_type_uint32 = yes; then +- AC_DEFINE(HAVE_TYPE_UINT32) ++ AC_DEFINE([HAVE_TYPE_UINT32],[1],[ ]) + fi + AC_MSG_RESULT($sc_cv_type_uint32) + +@@ -1201,7 +1281,7 @@ AC_CACHE_VAL(sc_cv_type_uint64, + [sc_cv_type_uint64=yes], + [sc_cv_type_uint64=no])]) + if test $sc_cv_type_uint64 = yes; then +- AC_DEFINE(HAVE_TYPE_UINT64) ++ AC_DEFINE([HAVE_TYPE_UINT64],[1],[ ]) + fi + AC_MSG_RESULT($sc_cv_type_uint64) + +@@ -1222,7 +1302,7 @@ AC_TRY_COMPILE([#include + #include + #endif], + [fd_set s; s.fds_bits[0]=0;], +-[AC_MSG_RESULT(yes); AC_DEFINE(HAVE_FDS_BITS)], ++[AC_MSG_RESULT(yes); AC_DEFINE([HAVE_FDS_BITS],[1],[ ])], + [AC_MSG_RESULT(no);]) + + AC_MSG_CHECKING(for struct termios . c_ispeed) +@@ -1231,7 +1311,7 @@ AC_TRY_COMPILE([#include + #include + #endif], + [struct termios s; s.c_ispeed=0;], +-[AC_MSG_RESULT(yes); AC_DEFINE(HAVE_STRUCT_TERMIOS_C_ISPEED)], ++[AC_MSG_RESULT(yes); AC_DEFINE([HAVE_STRUCT_TERMIOS_C_ISPEED],[1],[ ])], + [AC_MSG_RESULT(no);]) + + AC_MSG_CHECKING(for struct termios . c_ospeed) +@@ -1240,7 +1320,7 @@ AC_TRY_COMPILE([#include + #include + #endif], + [struct termios s; s.c_ospeed=0;], +-[AC_MSG_RESULT(yes); AC_DEFINE(HAVE_STRUCT_TERMIOS_C_OSPEED)], ++[AC_MSG_RESULT(yes); AC_DEFINE([HAVE_STRUCT_TERMIOS_C_OSPEED],[1],[ ])], + [AC_MSG_RESULT(no);]) + + AC_MSG_CHECKING(for sa_family_t) +@@ -1251,7 +1331,7 @@ AC_CACHE_VAL(sc_cv_type_sa_family_t, + [sc_cv_type_sa_family_t=yes], + [sc_cv_type_sa_family_t=no])]) + if test $sc_cv_type_sa_family_t = yes; then +- AC_DEFINE(HAVE_TYPE_SA_FAMILY_T) ++ AC_DEFINE([HAVE_TYPE_SA_FAMILY_T],[1],[ ]) + fi + AC_MSG_RESULT($sc_cv_type_sa_family_t) + +@@ -1267,7 +1347,7 @@ AC_CACHE_VAL(sc_cv_struct_sock_extended_err, + [sc_cv_struct_sock_extended_err=yes], + [sc_cv_struct_sock_extended_err=no])]) + if test $sc_cv_struct_sock_extended_err = yes; then +- AC_DEFINE(HAVE_STRUCT_SOCK_EXTENDED_ERR) ++ AC_DEFINE([HAVE_STRUCT_SOCK_EXTENDED_ERR],[1],[ ]) + fi + AC_MSG_RESULT($sc_cv_struct_sock_extended_err) + +@@ -1277,7 +1357,7 @@ AC_CACHE_VAL(sc_cv_struct_sigaction_sa_sigaction, + [sc_cv_struct_sigaction_sa_sigaction=yes], + [sc_cv_struct_sigaction_sa_sigaction=no])]) + if test $sc_cv_struct_sigaction_sa_sigaction = yes; then +- AC_DEFINE(HAVE_STRUCT_SIGACTION_SA_SIGACTION) ++ AC_DEFINE([HAVE_STRUCT_SIGACTION_SA_SIGACTION],[1],[ ]) + fi + AC_MSG_RESULT($sc_cv_struct_sigaction_sa_sigaction) + +@@ -1296,7 +1376,7 @@ AC_CACHE_VAL(ac_cv_svid3, + )] + )]) + if test $ac_cv_svid3 = yes; then +- AC_DEFINE(_SVID3) ++ AC_DEFINE([_SVID3],[1],[ ]) + fi + AC_MSG_RESULT($ac_cv_svid3) + +@@ -1315,7 +1395,7 @@ AC_CACHE_VAL(ac_cv_xpg4_2, + )] + )]) + if test $ac_cv_xpg4_2 = yes; then +- AC_DEFINE(_XPG4_2) ++ AC_DEFINE([_XPG4_2],[1],[ ]) + fi + AC_MSG_RESULT($ac_cv_xpg4_2) + +@@ -1337,7 +1417,7 @@ if test "$ac_cv_xpg4_2" = yes; then + )] + )]) + if test $ac_cv___extensions__ = yes; then +- AC_DEFINE(__EXTENSIONS__) ++ AC_DEFINE([__EXTENSIONS__],[1],[ ]) + fi + AC_MSG_RESULT($ac_cv___extensions__) + fi +@@ -1358,7 +1438,7 @@ if test "$ac_cv___extensions__" = yes; then + )] + )]) + if test $ac_cv__posix_pthread_semantics = yes; then +- AC_DEFINE(_POSIX_PTHREAD_SEMANTICS) ++ AC_DEFINE([_POSIX_PTHREAD_SEMANTICS],[1],[ ]) + fi + AC_MSG_RESULT($ac_cv__posix_pthread_semantics) + fi +@@ -1374,7 +1454,7 @@ AC_CACHE_VAL(sc_cv_struct_timespec, + [sc_cv_struct_timespec=yes], + [sc_cv_struct_timespec=no])]) + if test $sc_cv_struct_timespec = yes; then +- AC_DEFINE(HAVE_STRUCT_TIMESPEC) ++ AC_DEFINE([HAVE_STRUCT_TIMESPEC],[1],[ ]) + fi + AC_MSG_RESULT($sc_cv_struct_timespec) + +@@ -1387,7 +1467,7 @@ AC_CACHE_VAL(sc_cv_struct_linger, + [sc_cv_struct_linger=yes], + [sc_cv_struct_linger=no])]) + if test $sc_cv_struct_linger = yes; then +- AC_DEFINE(HAVE_STRUCT_LINGER) ++ AC_DEFINE([HAVE_STRUCT_LINGER],[1],[ ]) + fi + AC_MSG_RESULT($sc_cv_struct_linger) + +@@ -1400,7 +1480,7 @@ AC_CACHE_VAL(sc_cv_struct_ip, + [sc_cv_struct_ip=yes], + [sc_cv_struct_ip=no])]) + if test $sc_cv_struct_ip = yes; then +- AC_DEFINE(HAVE_STRUCT_IP) ++ AC_DEFINE([HAVE_STRUCT_IP],[1],[ ]) + fi + AC_MSG_RESULT($sc_cv_struct_ip) + +@@ -1413,7 +1493,7 @@ AC_CACHE_VAL(sc_cv_struct_ip_mreq, + [sc_cv_struct_ip_mreq=yes], + [sc_cv_struct_ip_mreq=no])]) + if test $sc_cv_struct_ip_mreq = yes; then +- AC_DEFINE(HAVE_STRUCT_IP_MREQ) ++ AC_DEFINE([HAVE_STRUCT_IP_MREQ],[1],[ ]) + fi + AC_MSG_RESULT($sc_cv_struct_ip_mreq) + +@@ -1427,7 +1507,7 @@ AC_CACHE_VAL(sc_cv_struct_ip_mreqn, + [sc_cv_struct_ip_mreqn=yes], + [sc_cv_struct_ip_mreqn=no])]) + if test $sc_cv_struct_ip_mreqn = yes; then +- AC_DEFINE(HAVE_STRUCT_IP_MREQN) ++ AC_DEFINE([HAVE_STRUCT_IP_MREQN],[1],[ ]) + fi + AC_MSG_RESULT($sc_cv_struct_ip_mreqn) + +@@ -1440,7 +1520,7 @@ AC_CACHE_VAL(sc_cv_struct_ipv6_mreq, + [sc_cv_struct_ipv6_mreq=yes], + [sc_cv_struct_ipv6_mreq=no])]) + if test $sc_cv_struct_ipv6_mreq = yes; then +- AC_DEFINE(HAVE_STRUCT_IPV6_MREQ) ++ AC_DEFINE([HAVE_STRUCT_IPV6_MREQ],[1],[ ]) + fi + AC_MSG_RESULT($sc_cv_struct_ipv6_mreq) + +@@ -1454,7 +1534,7 @@ AC_CACHE_VAL(sc_cv_struct_ip_mreq_source, + [sc_cv_struct_ip_mreq_source=yes], + [sc_cv_struct_ip_mreq_source=no])]) + if test $sc_cv_struct_ip_mreq_source = yes; then +- AC_DEFINE(HAVE_STRUCT_IP_MREQ_SOURCE) ++ AC_DEFINE([HAVE_STRUCT_IP_MREQ_SOURCE],[1],[ ]) + fi + AC_MSG_RESULT($sc_cv_struct_ip_mreqn) + +@@ -1468,7 +1548,7 @@ AC_CACHE_VAL(sc_cv_struct_group_source_req, + [sc_cv_struct_group_source_req=yes], + [sc_cv_struct_group_source_req=no])]) + if test $sc_cv_struct_group_source_req = yes; then +- AC_DEFINE(HAVE_STRUCT_GROUP_SOURCE_REQ) ++ AC_DEFINE([HAVE_STRUCT_GROUP_SOURCE_REQ],[1],[ ]) + fi + AC_MSG_RESULT($sc_cv_struct_group_source_req) + +@@ -1482,7 +1562,7 @@ AC_CACHE_VAL(sc_cv_struct_ifreq, + [sc_cv_struct_ifreq=yes], + [sc_cv_struct_ifreq=no])]) + if test $sc_cv_struct_ifreq = yes; then +- AC_DEFINE(HAVE_STRUCT_IFREQ) ++ AC_DEFINE([HAVE_STRUCT_IFREQ],[1],[ ]) + fi + AC_MSG_RESULT($sc_cv_struct_ifreq) + +@@ -1497,7 +1577,7 @@ AC_CACHE_VAL(sc_cv_struct_ifreq_ifr_index, + [sc_cv_struct_ifreq_ifr_index=yes], + [sc_cv_struct_ifreq_ifr_index=no])]) + if test $sc_cv_struct_ifreq_ifr_index = yes; then +- AC_DEFINE(HAVE_STRUCT_IFREQ_IFR_INDEX) ++ AC_DEFINE([HAVE_STRUCT_IFREQ_IFR_INDEX],[1],[ ]) + fi + AC_MSG_RESULT($sc_cv_struct_ifreq_ifr_index) + +@@ -1512,7 +1592,7 @@ AC_CACHE_VAL(sc_cv_struct_ifreq_ifr_ifindex, + [sc_cv_struct_ifreq_ifr_ifindex=yes], + [sc_cv_struct_ifreq_ifr_ifindex=no])]) + if test $sc_cv_struct_ifreq_ifr_ifindex = yes; then +- AC_DEFINE(HAVE_STRUCT_IFREQ_IFR_IFINDEX) ++ AC_DEFINE([HAVE_STRUCT_IFREQ_IFR_IFINDEX],[1],[ ]) + fi + AC_MSG_RESULT($sc_cv_struct_ifreq_ifr_ifindex) + +@@ -1527,7 +1607,7 @@ AC_CACHE_VAL(sc_cv_struct_sockaddr_salen, + [sc_cv_struct_sockaddr_salen=yes], + [sc_cv_struct_sockaddr_salen=no])]) + if test $sc_cv_struct_sockaddr_salen = yes; then +- AC_DEFINE(HAVE_STRUCT_SOCKADDR_SALEN) ++ AC_DEFINE([HAVE_STRUCT_SOCKADDR_SALEN],[1],[ ]) + fi + AC_MSG_RESULT($sc_cv_struct_sockaddr_salen) + +@@ -1538,31 +1618,31 @@ AC_TRY_COMPILE([#include + #include ], + [struct sockaddr_in6 sa6;sa6.sin6_addr.s6_addr[0]=0;], + [AC_MSG_RESULT(s6_addr); +- AC_DEFINE(HAVE_IP6_SOCKADDR, 0)], ++ AC_DEFINE([HAVE_IP6_SOCKADDR],[0],[ ])], + [AC_TRY_COMPILE([#include + #include ], + [struct sockaddr_in6 sa6;sa6.sin6_addr.u6_addr.u6_addr16[0]=0;], + [AC_MSG_RESULT(u6_addr.u6_addr16); +- AC_DEFINE(HAVE_IP6_SOCKADDR, 1)], ++ AC_DEFINE([HAVE_IP6_SOCKADDR],[1],[ ])], + [AC_TRY_COMPILE([#include + #include ], + [struct sockaddr_in6 sa6;sa6.sin6_addr.u6_addr16[0]=0;], +- [AC_MSG_RESULT(u6_addr16); AC_DEFINE(HAVE_IP6_SOCKADDR, 2)], ++ [AC_MSG_RESULT(u6_addr16); AC_DEFINE([HAVE_IP6_SOCKADDR],[2],[ ])], + [AC_TRY_COMPILE([#include + #include ], + [struct sockaddr_in6 sa6;sa6.sin6_addr.in6_u.u6_addr16[0]=0;], + [AC_MSG_RESULT(in6_u.u6_addr16); +- AC_DEFINE(HAVE_IP6_SOCKADDR, 3)], ++ AC_DEFINE([HAVE_IP6_SOCKADDR],[3],[ ])], + [AC_TRY_COMPILE([#include + #include ], + [struct sockaddr_in6 sa6;sa6.sin6_addr._S6_un._S6_u32[0]=0;], + [AC_MSG_RESULT(_S6_un._S6_u32); +- AC_DEFINE(HAVE_IP6_SOCKADDR, 4)], ++ AC_DEFINE([HAVE_IP6_SOCKADDR],[4],[ ])], + [AC_TRY_COMPILE([#include + #include ], + [struct sockaddr_in6 sa6;sa6.sin6_addr.__u6_addr.__u6_addr32[0]=0;], + [AC_MSG_RESULT(__u6_addr.__u6_addr32); +- AC_DEFINE(HAVE_IP6_SOCKADDR, 5)], ++ AC_DEFINE([HAVE_IP6_SOCKADDR],[5],[ ])], + + [AC_MSG_RESULT([none or unknown])] + )])])])])]) +@@ -1574,7 +1654,7 @@ AC_CACHE_VAL(sc_cv_struct_iovec, + [sc_cv_struct_iovec=yes], + [sc_cv_struct_iovec=no])]) + if test $sc_cv_struct_iovec = yes; then +- AC_DEFINE(HAVE_STRUCT_IOVEC) ++ AC_DEFINE([HAVE_STRUCT_IOVEC],[1],[ ]) + fi + AC_MSG_RESULT($sc_cv_struct_iovec) + +@@ -1587,7 +1667,7 @@ AC_CACHE_VAL(sc_cv_struct_msghdr_msgcontrol, + [sc_cv_struct_msghdr_msgcontrol=yes], + [sc_cv_struct_msghdr_msgcontrol=no])]) + if test $sc_cv_struct_msghdr_msgcontrol = yes; then +- AC_DEFINE(HAVE_STRUCT_MSGHDR_MSGCONTROL) ++ AC_DEFINE([HAVE_STRUCT_MSGHDR_MSGCONTROL],[1],[ ]) + fi + AC_MSG_RESULT($sc_cv_struct_msghdr_msgcontrol) + +@@ -1600,7 +1680,7 @@ AC_CACHE_VAL(sc_cv_struct_msghdr_msgcontrollen, + [sc_cv_struct_msghdr_msgcontrollen=yes], + [sc_cv_struct_msghdr_msgcontrollen=no])]) + if test $sc_cv_struct_msghdr_msgcontrollen = yes; then +- AC_DEFINE(HAVE_STRUCT_MSGHDR_MSGCONTROLLEN) ++ AC_DEFINE([HAVE_STRUCT_MSGHDR_MSGCONTROLLEN],[1],[ ]) + fi + AC_MSG_RESULT($sc_cv_struct_msghdr_msgcontrollen) + +@@ -1613,7 +1693,7 @@ AC_CACHE_VAL(sc_cv_struct_msghdr_msgflags, + [sc_cv_struct_msghdr_msgflags=yes], + [sc_cv_struct_msghdr_msgflags=no])]) + if test $sc_cv_struct_msghdr_msgflags = yes; then +- AC_DEFINE(HAVE_STRUCT_MSGHDR_MSGFLAGS) ++ AC_DEFINE([HAVE_STRUCT_MSGHDR_MSGFLAGS],[1],[ ]) + fi + AC_MSG_RESULT($sc_cv_struct_msghdr_msgflags) + +@@ -1626,7 +1706,7 @@ AC_CACHE_VAL(sc_cv_struct_cmsghdr, + [sc_cv_struct_cmsghdr=yes], + [sc_cv_struct_cmsghdr=no])]) + if test $sc_cv_struct_cmsghdr = yes; then +- AC_DEFINE(HAVE_STRUCT_CMSGHDR) ++ AC_DEFINE([HAVE_STRUCT_CMSGHDR],[1],[ ]) + fi + AC_MSG_RESULT($sc_cv_struct_cmsghdr) + +@@ -1639,7 +1719,7 @@ AC_CACHE_VAL(sc_cv_struct_in_pktinfo, + [sc_cv_struct_in_pktinfo=yes], + [sc_cv_struct_in_pktinfo=no])]) + if test $sc_cv_struct_in_pktinfo = yes; then +- AC_DEFINE(HAVE_STRUCT_IN_PKTINFO) ++ AC_DEFINE([HAVE_STRUCT_IN_PKTINFO],[1],[ ]) + fi + AC_MSG_RESULT($sc_cv_struct_in_pktinfo) + +@@ -1653,7 +1733,7 @@ if test $sc_cv_struct_in_pktinfo = 'yes'; then + [sc_cv_pktinfo_ipi_spec_dst=yes], + [sc_cv_pktinfo_ipi_spec_dst=no])]) + if test $sc_cv_pktinfo_ipi_spec_dst = yes; then +- AC_DEFINE(HAVE_PKTINFO_IPI_SPEC_DST) ++ AC_DEFINE([HAVE_PKTINFO_IPI_SPEC_DST],[1],[ ]) + fi + AC_MSG_RESULT($sc_cv_pktinfo_ipi_spec_dst) + fi +@@ -1666,7 +1746,7 @@ AC_CACHE_VAL(sc_cv_struct_in6_pktinfo, + [sc_cv_struct_in6_pktinfo=yes], + [sc_cv_struct_in6_pktinfo=no])]) + if test $sc_cv_struct_in6_pktinfo = yes; then +- AC_DEFINE(HAVE_STRUCT_IN6_PKTINFO) ++ AC_DEFINE([HAVE_STRUCT_IN6_PKTINFO],[1],[ ]) + fi + AC_MSG_RESULT($sc_cv_struct_in6_pktinfo) + +@@ -1678,7 +1758,7 @@ AC_CACHE_VAL(sc_cv_struct_tpacket_auxdata, + [sc_cv_struct_tpacket_auxdata=yes], + [sc_cv_struct_tpacket_auxdata=no])]) + if test $sc_cv_struct_tpacket_auxdata = yes; then +- AC_DEFINE(HAVE_STRUCT_TPACKET_AUXDATA) ++ AC_DEFINE([HAVE_STRUCT_TPACKET_AUXDATA],[1],[ ]) + fi + AC_MSG_RESULT($sc_cv_struct_tpacket_auxdata) + +@@ -1689,7 +1769,7 @@ AC_CACHE_VAL(sc_cv_struct_tpacket_auxdata_tp_vlan_tpid, + [sc_cv_struct_tpacket_auxdata_tp_vlan_tpid=yes], + [sc_cv_struct_tpacket_auxdata_tp_vlan_tpid=no])]) + if test $sc_cv_struct_tpacket_auxdata_tp_vlan_tpid = yes; then +- AC_DEFINE(HAVE_STRUCT_TPACKET_AUXDATA_TP_VLAN_TPID) ++ AC_DEFINE([HAVE_STRUCT_TPACKET_AUXDATA_TP_VLAN_TPID],[1],[ ]) + fi + AC_MSG_RESULT($sc_cv_struct_tpacket_auxdata) + +@@ -1704,7 +1784,7 @@ AC_CACHE_VAL(sc_cv_struct_ip_ip_hl, + [sc_cv_struct_ip_ip_hl=yes], + [sc_cv_struct_ip_ip_hl=no])]) + if test $sc_cv_struct_ip_ip_hl = yes; then +- AC_DEFINE(HAVE_STRUCT_IP_IP_HL) ++ AC_DEFINE([HAVE_STRUCT_IP_IP_HL],[1],[ ]) + fi + AC_MSG_RESULT($sc_cv_struct_ip_ip_hl) + +@@ -1712,19 +1792,19 @@ AC_MSG_RESULT($sc_cv_struct_ip_ip_hl) + dnl Library function checks + + dnl Check sigaction() +-AC_CHECK_FUNC(sigaction, AC_DEFINE(HAVE_SIGACTION)) ++AC_CHECK_FUNC(sigaction, AC_DEFINE([HAVE_SIGACTION],[1],[ ])) + + dnl Check for 64bit versions of system calls +-AC_CHECK_FUNC(stat64, AC_DEFINE(HAVE_STAT64)) +-AC_CHECK_FUNC(fstat64, AC_DEFINE(HAVE_FSTAT64)) +-AC_CHECK_FUNC(lstat64, AC_DEFINE(HAVE_LSTAT64)) +-AC_CHECK_FUNC(lseek64, AC_DEFINE(HAVE_LSEEK64)) +-AC_CHECK_FUNC(truncate64, AC_DEFINE(HAVE_TRUNCATE64)) +-AC_CHECK_FUNC(ftruncate64, AC_DEFINE(HAVE_FTRUNCATE64)) ++AC_CHECK_FUNC(stat64, AC_DEFINE([HAVE_STAT64],[1],[ ])) ++AC_CHECK_FUNC(fstat64, AC_DEFINE([HAVE_FSTAT64],[1],[ ])) ++AC_CHECK_FUNC(lstat64, AC_DEFINE([HAVE_LSTAT64],[1],[ ])) ++AC_CHECK_FUNC(lseek64, AC_DEFINE([HAVE_LSEEK64],[1],[ ])) ++AC_CHECK_FUNC(truncate64, AC_DEFINE([HAVE_TRUNCATE64],[1],[ ])) ++AC_CHECK_FUNC(ftruncate64, AC_DEFINE([HAVE_FTRUNCATE64],[1],[ ])) + +-AC_CHECK_FUNC(strtoll, AC_DEFINE(HAVE_STRTOLL)) +-AC_CHECK_FUNC(hstrerror, AC_DEFINE(HAVE_HSTRERROR)) +-AC_CHECK_FUNC(inet_ntop, AC_DEFINE(HAVE_INET_NTOP)) ++AC_CHECK_FUNC(strtoll, AC_DEFINE([HAVE_STRTOLL],[1],[ ])) ++AC_CHECK_FUNC(hstrerror, AC_DEFINE([HAVE_HSTRERROR],[1],[ ])) ++AC_CHECK_FUNC(inet_ntop, AC_DEFINE([HAVE_INET_NTOP],[1],[ ])) + + #if test "$ac_cv_func_hstrerror" = "yes"; then + # AC_MSG_CHECKING(if _XOPEN_SOURCE_EXTENDED is helpful) +@@ -1747,94 +1827,97 @@ AC_CHECK_FUNC(inet_ntop, AC_DEFINE(HAVE_INET_NTOP)) + + dnl Search for openpty() + # MacOS +-AC_CHECK_FUNC(openpty, AC_DEFINE(HAVE_OPENPTY)) ++AC_CHECK_FUNC(openpty, AC_DEFINE([HAVE_OPENPTY],[1],[ ])) + # AIX + AC_CHECK_LIB(bsd, openpty, +- [LIBS="-lbsd $LIBS"; AC_DEFINE(HAVE_OPENPTY)]) ++ [LIBS="-lbsd $LIBS"; AC_DEFINE([HAVE_OPENPTY],[1],[ ])]) + # Linux 2.4 + AC_CHECK_LIB(util, openpty, +- [LIBS="-lutil $LIBS"; AC_DEFINE(HAVE_OPENPTY)]) ++ [LIBS="-lutil $LIBS"; AC_DEFINE([HAVE_OPENPTY],[1],[ ])]) + + AC_CHECK_PROTOTYPE_LIB(gettimeofday) + +-AC_CHECK_FUNC(clock_gettime, AC_DEFINE(HAVE_CLOCK_GETTIME), AC_CHECK_LIB(rt, clock_gettime, [LIBS="-lrt $LIBS"; AC_DEFINE(HAVE_CLOCK_GETTIME)])) ++AC_CHECK_FUNC(clock_gettime, AC_DEFINE([HAVE_CLOCK_GETTIME],[1],[ ]), AC_CHECK_LIB(rt, clock_gettime, [LIBS="-lrt $LIBS"; AC_DEFINE([HAVE_CLOCK_GETTIME],[1],[ ])])) + + AC_CHECK_FUNCS(getresuid getresgid) + + dnl Search for flock() + # with Linux it's in libc, with AIX in libbsd +-AC_CHECK_FUNC(flock, AC_DEFINE(HAVE_FLOCK), ++AC_CHECK_FUNC(flock, AC_DEFINE([HAVE_FLOCK],[1],[ ]), + AC_CHECK_LIB(bsd, flock, [LIBS="-lbsd $LIBS"])) + + dnl Search for setenv() +-AC_CHECK_FUNC(setenv, AC_DEFINE(HAVE_SETENV), ++AC_CHECK_FUNC(setenv, AC_DEFINE([HAVE_SETENV],[1],[ ]), + AC_CHECK_LIB(isode, setenv, [LIBS="-lisode $LIBS"])) + + dnl Search for unsetenv() +-AC_CHECK_FUNC(unsetenv, AC_DEFINE(HAVE_UNSETENV)) +- +-AC_CHECK_FUNC(TLS_client_method, AC_DEFINE(HAVE_TLS_client_method) ac_cv_have_tls_client_method=yes, AC_CHECK_LIB(crypt, TLS_client_method, [LIBS=-lcrypt $LIBS])) +-AC_CHECK_FUNC(TLS_server_method, AC_DEFINE(HAVE_TLS_server_method) ac_cv_have_tls_server_method=yes, AC_CHECK_LIB(crypt, TLS_server_method, [LIBS=-lcrypt $LIBS])) +-AC_CHECK_FUNC(DTLS_client_method, AC_DEFINE(HAVE_DTLS_client_method), AC_CHECK_LIB(crypt, DTLS_client_method, [LIBS=-lcrypt $LIBS])) +-AC_CHECK_FUNC(DTLS_server_method, AC_DEFINE(HAVE_DTLS_server_method), AC_CHECK_LIB(crypt, DTLS_server_method, [LIBS=-lcrypt $LIBS])) +-if test -n "$WITH_OPENSSL_METHOD" -o -z "$ac_cv_have_tls_client_method" -o -z "$ac_cv_have_tls_server_method" ; then +-dnl Search for SSLv2_client_method, SSLv2_server_method +-AC_CHECK_FUNC(SSLv2_client_method, AC_DEFINE(HAVE_SSLv2_client_method), AC_CHECK_LIB(crypt, SSLv2_client_method, [LIBS=-lcrypt $LIBS])) +-AC_CHECK_FUNC(SSLv2_server_method, AC_DEFINE(HAVE_SSLv2_server_method), AC_CHECK_LIB(crypt, SSLv2_server_method, [LIBS=-lcrypt $LIBS])) +-dnl +-AC_CHECK_FUNC(SSLv3_client_method, AC_DEFINE(HAVE_SSLv3_client_method), AC_CHECK_LIB(crypt, SSLv3_client_method, [LIBS=-lcrypt $LIBS])) +-AC_CHECK_FUNC(SSLv3_server_method, AC_DEFINE(HAVE_SSLv3_server_method), AC_CHECK_LIB(crypt, SSLv3_server_method, [LIBS=-lcrypt $LIBS])) +-AC_CHECK_FUNC(SSLv23_client_method, AC_DEFINE(HAVE_SSLv23_client_method), AC_CHECK_LIB(crypt, SSLv23_client_method, [LIBS=-lcrypt $LIBS])) +-AC_CHECK_FUNC(SSLv23_server_method, AC_DEFINE(HAVE_SSLv23_server_method), AC_CHECK_LIB(crypt, SSLv23_server_method, [LIBS=-lcrypt $LIBS])) +-AC_CHECK_FUNC(TLSv1_client_method, AC_DEFINE(HAVE_TLSv1_client_method), AC_CHECK_LIB(crypt, TLSv1_client_method, [LIBS=-lcrypt $LIBS])) +-AC_CHECK_FUNC(TLSv1_server_method, AC_DEFINE(HAVE_TLSv1_server_method), AC_CHECK_LIB(crypt, TLSv1_server_method, [LIBS=-lcrypt $LIBS])) +-AC_CHECK_FUNC(TLSv1_1_client_method, AC_DEFINE(HAVE_TLSv1_1_client_method), AC_CHECK_LIB(crypt, TLSv1_1_client_method, [LIBS=-lcrypt $LIBS])) +-AC_CHECK_FUNC(TLSv1_1_server_method, AC_DEFINE(HAVE_TLSv1_1_server_method), AC_CHECK_LIB(crypt, TLSv1_1_server_method, [LIBS=-lcrypt $LIBS])) +-AC_CHECK_FUNC(TLSv1_2_client_method, AC_DEFINE(HAVE_TLSv1_2_client_method), AC_CHECK_LIB(crypt, TLSv1_2_client_method, [LIBS=-lcrypt $LIBS])) +-AC_CHECK_FUNC(TLSv1_2_server_method, AC_DEFINE(HAVE_TLSv1_2_server_method), AC_CHECK_LIB(crypt, TLSv1_2_server_method, [LIBS=-lcrypt $LIBS])) +-AC_CHECK_FUNC(DTLSv1_client_method, AC_DEFINE(HAVE_DTLSv1_client_method), AC_CHECK_LIB(crypt, DTLSv1_client_method, [LIBS=-lcrypt $LIBS])) +-AC_CHECK_FUNC(DTLSv1_server_method, AC_DEFINE(HAVE_DTLSv1_server_method), AC_CHECK_LIB(crypt, DTLSv1_server_method, [LIBS=-lcrypt $LIBS])) +-AC_CHECK_FUNC(DTLSv1_2_client_method, AC_DEFINE(HAVE_DTLSv1_2_client_method), AC_CHECK_LIB(crypt, DTLSv1_2_client_method, [LIBS=-lcrypt $LIBS])) +-AC_CHECK_FUNC(DTLSv1_2_server_method, AC_DEFINE(HAVE_DTLSv1_2_server_method), AC_CHECK_LIB(crypt, DTLSv1_2_server_method, [LIBS=-lcrypt $LIBS])) +-fi # $WITH_OPENSSL_METHOD +- +-AC_CHECK_FUNC(SSL_CTX_set_default_verify_paths, AC_DEFINE(HAVE_SSL_CTX_set_default_verify_paths)) +-AC_CHECK_FUNC(RAND_egd, AC_DEFINE(HAVE_RAND_egd), AC_CHECK_LIB(crypt, RAND_egd, [LIBS=-lcrypt $LIBS])) +-AC_CHECK_FUNC(DH_set0_pqg, AC_DEFINE(HAVE_DH_set0_pqg), AC_CHECK_LIB(crypt, DH_set0_pqg, [LIBS=-lcrypt $LIBS])) +-AC_CHECK_FUNC(ASN1_STRING_get0_data, AC_DEFINE(HAVE_ASN1_STRING_get0_data), AC_CHECK_LIB(crypt, ASN1_STRING_get0_data, [LIBS=-lcrypt $LIBS])) +-AC_CHECK_FUNC(RAND_status, AC_DEFINE(HAVE_RAND_status)) +-AC_CHECK_FUNC(SSL_CTX_clear_mode, AC_DEFINE(HAVE_SSL_CTX_clear_mode)) +-AC_CHECK_FUNC(SSL_set_tlsext_host_name, AC_DEFINE(HAVE_SSL_set_tlsext_host_name)) +-AC_CHECK_FUNC(SSL_CTX_set_tlsext_max_fragment_length, AC_DEFINE(HAVE_SSL_CTX_set_tlsext_max_fragment_length)) +- +-AC_MSG_CHECKING(if SSL_CTX_set_max_send_fragment exists) +-AC_CACHE_VAL(ac_cv_have_SSL_CTX_set_max_send_fragment, +-[AC_TRY_COMPILE([#include ],[ +-#ifndef SSL_CTX_set_max_send_fragment +-#error "SSL_CTX_set_max_send_fragment not found" +-#endif +-], +-[ac_cv_have_SSL_CTX_set_max_send_fragment=yes], +-[ac_cv_have_SSL_CTX_set_max_send_fragment=no])] +-) +-if test $ac_cv_have_SSL_CTX_set_max_send_fragment = yes; then +- AC_DEFINE(HAVE_SSL_CTX_set_max_send_fragment) +-fi +-AC_MSG_RESULT($ac_cv_have_SSL_CTX_set_max_send_fragment) +- +-AC_CHECK_FUNC(SSL_library_init, AC_DEFINE(HAVE_SSL_library_init)) +-AC_CHECK_FUNC(ERR_error_string, AC_DEFINE(HAVE_ERR_error_string)) +- +-AC_MSG_CHECKING(for type EC_KEY) +-AC_CACHE_VAL(sc_cv_type_EC_TYPE, +-[AC_TRY_COMPILE([#include +-],[EC_KEY *s;], +-[sc_cv_type_EC_KEY=yes], +-[sc_cv_type_EC_KEY=no])]) +-if test $sc_cv_type_EC_KEY = yes; then +- AC_DEFINE(HAVE_TYPE_EC_KEY) ++AC_CHECK_FUNC(unsetenv, AC_DEFINE([HAVE_UNSETENV],[1],[ ])) ++ ++if test "$WITH_WOLFSSL" != "yes" ++then ++ AC_CHECK_FUNC(TLS_client_method, AC_DEFINE([HAVE_TLS_client_method],[1],[ ]) ac_cv_have_tls_client_method=yes, AC_CHECK_LIB(crypt, TLS_client_method, [LIBS=-lcrypt $LIBS])) ++ AC_CHECK_FUNC(TLS_server_method, AC_DEFINE([HAVE_TLS_server_method],[1],[ ]) ac_cv_have_tls_server_method=yes, AC_CHECK_LIB(crypt, TLS_server_method, [LIBS=-lcrypt $LIBS])) ++ AC_CHECK_FUNC(DTLS_client_method, AC_DEFINE([HAVE_DTLS_client_method],[1],[ ]), AC_CHECK_LIB(crypt, DTLS_client_method, [LIBS=-lcrypt $LIBS])) ++ AC_CHECK_FUNC(DTLS_server_method, AC_DEFINE([HAVE_DTLS_server_method],[1],[ ]), AC_CHECK_LIB(crypt, DTLS_server_method, [LIBS=-lcrypt $LIBS])) ++ if test -n "$WITH_OPENSSL_METHOD" -o -z "$ac_cv_have_tls_client_method" -o -z "$ac_cv_have_tls_server_method" ; then ++ dnl Search for SSLv2_client_method, SSLv2_server_method ++ AC_CHECK_FUNC(SSLv2_client_method, AC_DEFINE([HAVE_SSLv2_client_method],[1],[ ]), AC_CHECK_LIB(crypt, SSLv2_client_method, [LIBS=-lcrypt $LIBS])) ++ AC_CHECK_FUNC(SSLv2_server_method, AC_DEFINE([HAVE_SSLv2_server_method],[1],[ ]), AC_CHECK_LIB(crypt, SSLv2_server_method, [LIBS=-lcrypt $LIBS])) ++ dnl ++ AC_CHECK_FUNC(SSLv3_client_method, AC_DEFINE([HAVE_SSLv3_client_method],[1],[ ]), AC_CHECK_LIB(crypt, SSLv3_client_method, [LIBS=-lcrypt $LIBS])) ++ AC_CHECK_FUNC(SSLv3_server_method, AC_DEFINE([HAVE_SSLv3_server_method],[1],[ ]), AC_CHECK_LIB(crypt, SSLv3_server_method, [LIBS=-lcrypt $LIBS])) ++ AC_CHECK_FUNC(SSLv23_client_method, AC_DEFINE([HAVE_SSLv23_client_method],[1],[ ]), AC_CHECK_LIB(crypt, SSLv23_client_method, [LIBS=-lcrypt $LIBS])) ++ AC_CHECK_FUNC(SSLv23_server_method, AC_DEFINE([HAVE_SSLv23_server_method],[1],[ ]), AC_CHECK_LIB(crypt, SSLv23_server_method, [LIBS=-lcrypt $LIBS])) ++ AC_CHECK_FUNC(TLSv1_client_method, AC_DEFINE([HAVE_TLSv1_client_method],[1],[ ]), AC_CHECK_LIB(crypt, TLSv1_client_method, [LIBS=-lcrypt $LIBS])) ++ AC_CHECK_FUNC(TLSv1_server_method, AC_DEFINE([HAVE_TLSv1_server_method],[1],[ ]), AC_CHECK_LIB(crypt, TLSv1_server_method, [LIBS=-lcrypt $LIBS])) ++ AC_CHECK_FUNC(TLSv1_1_client_method, AC_DEFINE([HAVE_TLSv1_1_client_method],[1],[ ]), AC_CHECK_LIB(crypt, TLSv1_1_client_method, [LIBS=-lcrypt $LIBS])) ++ AC_CHECK_FUNC(TLSv1_1_server_method, AC_DEFINE([HAVE_TLSv1_1_server_method],[1],[ ]), AC_CHECK_LIB(crypt, TLSv1_1_server_method, [LIBS=-lcrypt $LIBS])) ++ AC_CHECK_FUNC(TLSv1_2_client_method, AC_DEFINE([HAVE_TLSv1_2_client_method],[1],[ ]), AC_CHECK_LIB(crypt, TLSv1_2_client_method, [LIBS=-lcrypt $LIBS])) ++ AC_CHECK_FUNC(TLSv1_2_server_method, AC_DEFINE([HAVE_TLSv1_2_server_method],[1],[ ]), AC_CHECK_LIB(crypt, TLSv1_2_server_method, [LIBS=-lcrypt $LIBS])) ++ AC_CHECK_FUNC(DTLSv1_client_method, AC_DEFINE([HAVE_DTLSv1_client_method],[1],[ ]), AC_CHECK_LIB(crypt, DTLSv1_client_method, [LIBS=-lcrypt $LIBS])) ++ AC_CHECK_FUNC(DTLSv1_server_method, AC_DEFINE([HAVE_DTLSv1_server_method],[1],[ ]), AC_CHECK_LIB(crypt, DTLSv1_server_method, [LIBS=-lcrypt $LIBS])) ++ AC_CHECK_FUNC(DTLSv1_2_client_method, AC_DEFINE([HAVE_DTLSv1_2_client_method],[1],[ ]), AC_CHECK_LIB(crypt, DTLSv1_2_client_method, [LIBS=-lcrypt $LIBS])) ++ AC_CHECK_FUNC(DTLSv1_2_server_method, AC_DEFINE([HAVE_DTLSv1_2_server_method],[1],[ ]), AC_CHECK_LIB(crypt, DTLSv1_2_server_method, [LIBS=-lcrypt $LIBS])) ++ fi # $WITH_OPENSSL_METHOD ++ ++ AC_CHECK_FUNC(SSL_CTX_set_default_verify_paths, AC_DEFINE([HAVE_SSL_CTX_set_default_verify_paths],[1],[ ])) ++ AC_CHECK_FUNC(RAND_egd, AC_DEFINE([HAVE_RAND_egd],[1],[ ]), AC_CHECK_LIB(crypt, RAND_egd, [LIBS=-lcrypt $LIBS])) ++ AC_CHECK_FUNC(DH_set0_pqg, AC_DEFINE([HAVE_DH_set0_pqg],[1],[ ]), AC_CHECK_LIB(crypt, DH_set0_pqg, [LIBS=-lcrypt $LIBS])) ++ AC_CHECK_FUNC(ASN1_STRING_get0_data, AC_DEFINE([HAVE_ASN1_STRING_get0_data],[1],[ ]), AC_CHECK_LIB(crypt, ASN1_STRING_get0_data, [LIBS=-lcrypt $LIBS])) ++ AC_CHECK_FUNC(RAND_status, AC_DEFINE([HAVE_RAND_status],[1],[ ])) ++ AC_CHECK_FUNC(SSL_CTX_clear_mode, AC_DEFINE([HAVE_SSL_CTX_clear_mode],[1],[ ])) ++ AC_CHECK_FUNC(SSL_set_tlsext_host_name, AC_DEFINE([HAVE_SSL_set_tlsext_host_name],[1],[ ])) ++ AC_CHECK_FUNC(SSL_CTX_set_tlsext_max_fragment_length, AC_DEFINE([HAVE_SSL_CTX_set_tlsext_max_fragment_length],[1],[ ])) ++ ++ AC_MSG_CHECKING(if SSL_CTX_set_max_send_fragment exists) ++ AC_CACHE_VAL(ac_cv_have_SSL_CTX_set_max_send_fragment, ++ [AC_TRY_COMPILE([#include ],[ ++ #ifndef SSL_CTX_set_max_send_fragment ++ #error "SSL_CTX_set_max_send_fragment not found" ++ #endif ++ ], ++ [ac_cv_have_SSL_CTX_set_max_send_fragment=yes], ++ [ac_cv_have_SSL_CTX_set_max_send_fragment=no])] ++ ) ++ if test $ac_cv_have_SSL_CTX_set_max_send_fragment = yes; then ++ AC_DEFINE([HAVE_SSL_CTX_set_max_send_fragment],[1],[ ]) ++ fi ++ AC_MSG_RESULT($ac_cv_have_SSL_CTX_set_max_send_fragment) ++ ++ AC_CHECK_FUNC(SSL_library_init, AC_DEFINE([HAVE_SSL_library_init],[1],[ ])) ++ AC_CHECK_FUNC(ERR_error_string, AC_DEFINE([HAVE_ERR_error_string],[1],[ ])) ++ ++ AC_MSG_CHECKING(for type EC_KEY) ++ AC_CACHE_VAL(sc_cv_type_EC_TYPE, ++ [AC_TRY_COMPILE([#include ++ ],[EC_KEY *s;], ++ [sc_cv_type_EC_KEY=yes], ++ [sc_cv_type_EC_KEY=no])]) ++ if test $sc_cv_type_EC_KEY = yes; then ++ AC_DEFINE([HAVE_TYPE_EC_KEY],[1],[ ]) ++ fi ++ AC_MSG_RESULT($sc_cv_type_EC_KEY) + fi +-AC_MSG_RESULT($sc_cv_type_EC_KEY) + + + dnl Run time checks +@@ -1853,7 +1936,7 @@ exit(snprintf(s,2,"ab")!=2); + [ac_cv_have_c99_snprintf=no], + [ac_cv_have_c99_snprintf=no])]) + if test $ac_cv_have_c99_snprintf = yes; then +- AC_DEFINE(HAVE_C99_SNPRINTF) ++ AC_DEFINE([HAVE_C99_SNPRINTF],[1],[ ]) + fi + AC_MSG_RESULT($ac_cv_have_c99_snprintf) + +@@ -1876,7 +1959,7 @@ else ac_cv_have_z_modifier=no + fi + ) + if test $ac_cv_have_z_modifier = yes; then +- AC_DEFINE(HAVE_FORMAT_Z) ++ AC_DEFINE([HAVE_FORMAT_Z],[1],[ ]) + fi + AC_MSG_RESULT($ac_cv_have_z_modifier) + +@@ -1916,7 +1999,7 @@ AC_CACHE_CHECK(shift offset of $1, $2, + [$2=-1] + ) + LIBS="$LIBS1"]) +-AC_DEFINE_UNQUOTED($1_SHIFT, ${$2}) ++AC_DEFINE_UNQUOTED([$1_SHIFT],[${$2}],[ ]) + if test "$2" = -1; then + AC_MSG_WARN(please determine $1_SHIFT manually) + fi +@@ -1983,7 +2066,7 @@ AC_CACHE_CHECK(for equivalent simple type of $2, $4, + [$4="0 /* unknown, taking default */" + ]) ]) ]) ]) ]) ]) ]) ]) + CFLAGS="$CFLAGS1" ]) +-AC_DEFINE_UNQUOTED($3, ${$4}) ++AC_DEFINE_UNQUOTED([$3],[${$4}],[ ]) + ]) + + dnl see AC_BASIC_TYPE +@@ -2034,7 +2117,7 @@ int main() { $2 x=-1; return !(x<0);}], + ) + ) + ]) +-AC_DEFINE_UNQUOTED($3, ${$4}) ++AC_DEFINE_UNQUOTED([$3],[${$4}],[ ]) + ]) + + dnl find what physical type (basic C type) is equivalent to the given type. +@@ -2077,7 +2160,7 @@ AC_TRY_COMPILE([$1],[$2 u;short v; return(&u.$3==&v);], + [$5="0 /* unknown, taking default */" + ]) ]) ]) ]) ]) ]) ]) ]) + CFLAGS="$CFLAGS1" ]) +-AC_DEFINE_UNQUOTED($4, ${$5}) ++AC_DEFINE_UNQUOTED([$4],[${$5}],[ ]) + ]) + + dnl See AC_TYPEOF_COMPONENT +@@ -2129,7 +2212,7 @@ int main() { x $2; x.$3=-1; return !(x.$3<0);}], + ) + ) + ]) +-AC_DEFINE_UNQUOTED($4, ${$5}) ++AC_DEFINE_UNQUOTED([$4],[${$5}],[ ]) + ]) + + dnl find what physical type (basic C type) describes the given struct or union +@@ -2218,13 +2301,13 @@ AC_TYPEOF_COMPONENT([#include "sysincludes.h"], struct cmsghdr, cmsg_len, HAVE_T + + AC_MSG_CHECKING(for /dev/ptmx) + if test -c /dev/ptmx; then +- AC_DEFINE(HAVE_DEV_PTMX, 1) ++ AC_DEFINE([HAVE_DEV_PTMX],[1],[ ]) + AC_MSG_RESULT(yes) + else + AC_MSG_RESULT(no) + AC_MSG_CHECKING(for /dev/ptc) + if test -c /dev/ptc; then +- AC_DEFINE(HAVE_DEV_PTC) ++ AC_DEFINE([HAVE_DEV_PTC],[1],[ ]) + AC_MSG_RESULT(yes) + else + AC_MSG_RESULT(no) +@@ -2233,7 +2316,7 @@ fi + + AC_MSG_CHECKING(for /proc) + if test -d /proc; then +- AC_DEFINE(HAVE_PROC_DIR, 1) ++ AC_DEFINE([HAVE_PROC_DIR],[1],[ ]) + AC_MSG_RESULT(yes) + else + AC_MSG_RESULT(no) +@@ -2241,7 +2324,7 @@ fi + + AC_MSG_CHECKING(for /proc/*/fd) + if test -d /proc/$$/fd; then +- AC_DEFINE(HAVE_PROC_DIR_FD, 1) ++ AC_DEFINE([HAVE_PROC_DIR_FD],[1],[ ]) + AC_MSG_RESULT(yes) + else + AC_MSG_RESULT(no) +@@ -2250,7 +2333,7 @@ fi + # On Solaris family, we have to use /proc/$$/path/N + AC_MSG_CHECKING(for /proc/*/path) + if test -d /proc/$$/path; then +- AC_DEFINE(HAVE_PROC_DIR_PATH, 1) ++ AC_DEFINE([HAVE_PROC_DIR_PATH],[1],[ ]) + AC_MSG_RESULT(yes) + else + AC_MSG_RESULT(no) +@@ -2263,7 +2346,7 @@ AC_CACHE_VAL(sc_cv_dirent_d_type, + [sc_cv_dirent_d_type=yes], + [sc_cv_dirent_d_type=no])]) + if test $sc_cv_dirent_d_type = yes; then +- AC_DEFINE(HAVE_DIRENT_D_TYPE) ++ AC_DEFINE([HAVE_DIRENT_D_TYPE],[1],[ ]) + fi + AC_MSG_RESULT($sc_cv_dirent_d_type) + +@@ -2272,19 +2355,19 @@ AC_MSG_CHECKING(for _res.retrans) + AC_TRY_COMPILE([#include ], + [_res.retrans == 0], + [AC_MSG_RESULT(yes); +- AC_DEFINE(HAVE_RES_RETRANS, 1)], ++ AC_DEFINE([HAVE_RES_RETRANS],[1],[ ])], + [AC_MSG_RESULT(no)]) + AC_MSG_CHECKING(for _res.retry) + AC_TRY_COMPILE([#include ], + [_res.retry == 0], + [AC_MSG_RESULT(yes); +- AC_DEFINE(HAVE_RES_RETRY, 1)], ++ AC_DEFINE([HAVE_RES_RETRY],[1],[ ])], + [AC_MSG_RESULT(no)]) + AC_MSG_CHECKING(for _res.nsaddr_list) + AC_TRY_COMPILE([#include ], + [_res.nsaddr_list[0].sin_family == 0], + [AC_MSG_RESULT(yes); +- AC_DEFINE(HAVE_RES_NSADDR_LIST, 1)], ++ AC_DEFINE([HAVE_RES_NSADDR_LIST],[1],[ ])], + [AC_MSG_RESULT(no)]) + + +@@ -2322,7 +2405,7 @@ if test -n "$WITH_LIBWRAP"; then + done]) + ]) + if test "$sc_cv_have_tcpd_h" = "yes"; then +- AC_DEFINE(HAVE_TCPD_H) ++ AC_DEFINE([HAVE_TCPD_H],[1],[ ]) + fi + AC_MSG_NOTICE(checked for tcpd.h... $sc_cv_have_tcpd_h) + fi # end checking for tcpd.h +@@ -2355,14 +2438,14 @@ int allow_severity,deny_severity;],[hosts_access(0)], + ] + ) + if test "$sc_cv_have_libwrap" = 'yes'; then +- AC_DEFINE(HAVE_LIBWRAP) ++ AC_DEFINE([HAVE_LIBWRAP],[1],[ ]) + fi + AC_MSG_RESULT($sc_cv_have_libwrap) + fi + # + if test -n "$WITH_LIBWRAP"; then + if test "$sc_cv_have_tcpd_h" = "yes" -a "$sc_cv_have_libwrap" = "yes"; then +- AC_DEFINE(WITH_LIBWRAP) ++ AC_DEFINE([WITH_LIBWRAP],[1],[ ]) + else + AC_MSG_WARN([not all components of tcp wrappers found, disabling it]); + fi +@@ -2377,7 +2460,7 @@ if test -n "$WITH_LIBWRAP"; then + [sc_cv_have_hosts_allow_table=yes], + [sc_cv_have_hosts_allow_table=no])]) + if test $sc_cv_have_hosts_allow_table = yes; then +- AC_DEFINE(HAVE_HOSTS_ALLOW_TABLE) ++ AC_DEFINE([HAVE_HOSTS_ALLOW_TABLE],[1],[ ]) + fi + AC_MSG_RESULT($sc_cv_have_hosts_allow_table) + fi # test -n "$WITH_LIBWRAP" +@@ -2410,18 +2493,18 @@ AC_CACHE_VAL(sc_cv_decl_environ, + [sc_cv_decl_environ=yes], + [sc_cv_decl_environ=no])]) + if test $sc_cv_decl_environ = yes; then +- AC_DEFINE(HAVE_DECL_ENVIRON) ++ AC_DEFINE([HAVE_DECL_ENVIRON],[1],[ ]) + fi + AC_MSG_RESULT($sc_cv_decl_environ) + + # on some systems environ exists but not the declaration + AC_MSG_CHECKING(for var environ) + AC_CACHE_VAL(sc_cv_var_environ, +-[AC_TRY_COMPILE([],[extern char **environ; char **s = environ;], ++[AC_TRY_COMPILE([ ],[extern char **environ; char **s = environ;], + [sc_cv_var_environ=yes], + [sc_cv_var_environ=no])]) + if test $sc_cv_var_environ = yes; then +- AC_DEFINE(HAVE_VAR_ENVIRON) ++ AC_DEFINE([HAVE_VAR_ENVIRON],[1],[ ]) + fi + AC_MSG_RESULT($sc_cv_var_environ) + +@@ -2429,11 +2512,33 @@ AC_MSG_RESULT($sc_cv_var_environ) + if test "$SOURCE_DATE_EPOCH"; then + DATE_FMT="%d %b %Y %H:%M:%S" + BUILD_DATE=$(LC_ALL=C date -u -d "@$SOURCE_DATE_EPOCH" "+$DATE_FMT") +- AC_DEFINE_UNQUOTED(BUILD_DATE, ["$BUILD_DATE"]) ++ AC_DEFINE_UNQUOTED([BUILD_DATE],["$BUILD_DATE"],[ ]) + elif test "$BUILD_DATE"; then +- AC_DEFINE_UNQUOTED(BUILD_DATE, ["$BUILD_DATE"]) ++ AC_DEFINE_UNQUOTED([BUILD_DATE],["$BUILD_DATE"],[ ]) + else +- AC_DEFINE(BUILD_DATE, [__DATE__" "__TIME__]) ++ AC_DEFINE([BUILD_DATE], [__DATE__" "__TIME__],[ ]) + fi + ++dnl autoheader regenerates config.h.in; keep the derived defines socat ++dnl maintains there by hand. ++AH_BOTTOM([ ++#if HAVE_CFSETISPEED ++# define HAVE_TERMIOS_ISPEED 1 ++#endif ++#if HAVE_CFSETOSPEED ++# define HAVE_TERMIOS_OSPEED 1 ++#endif ++#if defined(HAVE_TERMIOS_ISPEED) && defined(HAVE_TERMIOS_OSPEED) ++# define HAVE_TERMIOS_SPEED 1 ++#endif ++ ++#if defined(HAVE_HOSTS_ALLOW_TABLE) && HAVE_HOSTS_ALLOW_TABLE ++# define HAVE_HOSTS_DENY_TABLE 1 ++#else ++# undef HAVE_HOSTS_DENY_TABLE ++#endif ++ ++#define WITH_STREAMS 1 ++]) ++ + AC_OUTPUT(Makefile) +diff --git a/xio-openssl.c b/xio-openssl.c +index 344709b..1e9433a 100644 +--- a/xio-openssl.c ++++ b/xio-openssl.c +@@ -982,7 +982,7 @@ int + bool opt_fips = false; + const SSL_METHOD *method = NULL; + char *me_str = NULL; /* method string */ +- char *ci_str = "HIGH:-NULL:-PSK:-aNULL"; /* cipher string */ ++ char *ci_str = "HIGH:!NULL:!PSK:!aNULL"; /* cipher string */ + char *opt_key = NULL; /* file name of client private key */ + char *opt_dhparam = NULL; /* file name of DH params */ + char *opt_cafile = NULL; /* certificate authority file */ +@@ -1024,6 +1024,10 @@ int + + openssl_delete_cert_info(); + ++#if defined(WITH_WOLFSSL) && defined(DEBUG_WOLFSSL) ++ wolfSSL_Debugging_ON(); ++#endif ++ + /* OpenSSL preparation */ + #if defined(HAVE_OPENSSL_INIT_SSL) && defined(HAVE_OPENSSL_INIT_new) + { +@@ -1257,6 +1261,18 @@ int + } + #endif /* HAVE_SSL_set_min_proto_version || defined(SSL_set_min_proto_version) */ + #if HAVE_SSL_CTX_set_max_proto_version || defined(SSL_CTX_set_max_proto_version) ++#if defined(WITH_WOLFSSL) && defined(WOLFSSL_TLS13) ++ #if HAVE_SSLv23_client_method ++ if (!*use_dtls && (me_str == 0 || !strcasecmp(me_str, "SSL23"))) { ++ /* Setting max to TLS 1.2 since TLS 1.3 doesn't work with socat." */ ++ if (SSL_CTX_set_max_proto_version(ctx, TLS1_2_VERSION) <= 0) { ++ Error2("_xioopen_openssl_prepare(): SSL_CTX_set_max_proto_version(\"%s\"->%d): failed", ++ "Exclude TLS 1.3", TLS1_2_VERSION); ++ return STAT_NORETRY; ++ } ++ } ++ #endif ++#endif + if (sfd->para.openssl.max_proto_version != NULL) { + int sslver; + sslver = _xio_openssl_parse_version(sfd->para.openssl.max_proto_version, +@@ -1549,7 +1565,7 @@ static int openssl_SSL_ERROR_SSL(int level, const char *funcname) { + Debug1("ERR_get_error(): %lx", e); + if + ( +-#if defined(OPENSSL_IS_BORINGSSL) ++#if defined(OPENSSL_IS_BORINGSSL) || defined(WITH_WOLFSSL) + 0 /* BoringSSL's RNG always succeeds. */ + #elif defined(HAVE_RAND_status) + ERR_GET_LIB(e) == ERR_LIB_RAND && RAND_status() != 1 +@@ -1915,8 +1931,15 @@ static int openssl_handle_peer_certificate(struct single *sfd, + case 16: /* IPv6 */ + inet_ntop(AF_INET6, data, aBuffer, sizeof(aBuffer)); + if (peername != NULL) { +- xioip6_pton(peername, &ip6bin, sfd->para.socket.ip.ai_flags); +- if (memcmp(data, &ip6bin, sizeof(ip6bin)) == 0) { ++ struct in_addr ip4bin; ++ /* An IPv4 literal cannot match an IPv6 entry. Do not resolve ++ it as IPv6: a failed xioresolve() is fatal. */ ++ if (inet_pton(AF_INET, peername, &ip4bin) == 1) { ++ Info2("subjectAltName \"%s\" does not match peername \"%s\"", ++ aBuffer, peername); ++ } else if (xioip6_pton(peername, &ip6bin, ++ sfd->para.socket.ip.ai_flags) == STAT_OK && ++ memcmp(data, &ip6bin, sizeof(ip6bin)) == 0) { + Debug2("subjectAltName \"%s\" matches peername \"%s\"", + aBuffer, peername); + ok = 1; +-- +2.43.0 + diff --git a/softhsm/2.7.0.patch b/softhsm/2.7.0.patch new file mode 100644 index 000000000..e9b3de5ff --- /dev/null +++ b/softhsm/2.7.0.patch @@ -0,0 +1,2553 @@ +From 1edf952a91c38ccd7e52510accf27e0a52826b89 Mon Sep 17 00:00:00 2001 +From: Juliusz Sosinowicz +Date: Fri, 4 Sep 2026 09:46:45 +0000 +Subject: [PATCH] Patch for wolfSSL support + +This patch implements wolfSSL support in SoftHSMv2 2.7.0. + +Compile wolfSSL with: + ./configure --enable-all --disable-oldnames CFLAGS=-DRSA_MIN_SIZE=1024 + make + make install + +Compile SoftHSMv2 with: + patch -p1 < /path/to/this/patch + autoreconf -if + ./configure --with-crypto-backend=wolfssl WOLFSSL_INSTALL_DIR=/path/to/wolfssl/install + make + +To run the tests: + make check + +All test programs pass (cryptotest, datamgrtest, objstoretest, sessionmgrtest, +slotmgrtest, handlemgrtest and p11test). The p11test suite, which was disabled +in the 2.6.1 patch, is enabled again. + +Test cases that are skipped under WITH_WOLFSSL, with the reason: + - 2-key triple DES (CKK_DES2, 112-bit DES keys) is not supported by wolfSSL: + DESTests, DeriveTests::testSymDerive, ObjectTests::testCreateSecretKey, + SymmetricAlgorithmTests::testDesEncryptDecrypt. + - CMAC is only supported with AES: MacTests and + SignVerifyTests::testMacSignVerify skip CKM_DES3_CMAC. + - AES GCM IVs longer than the block size are not supported: AESTests. + - CKM_RSA_AES_KEY_WRAP needs CKM_AES_KEY_WRAP_PAD (EVP_aes_*_wrap_pad), + which wolfSSL does not provide: AsymWrapUnwrapTests skips it when + HAVE_AES_KEY_WRAP_PAD is not defined. CKM_AES_KEY_WRAP(_PAD) tests are + already skipped by upstream when HAVE_AES_KEY_WRAP is not defined. + - wolfSSL requires at least 16 bytes of data for raw ECDSA signing, so + SignVerifyTests::signVerifySingle uses 16 bytes of data. + - AsymMech::RSA_SSL (MD5+SHA-1 signatures, NID_md5_sha1) is not + supported by wolfSSL: RSATests skips it. + +OpenSSL engines are disabled for the wolfssl backend (WITHOUT_OPENSSL_ENGINES) +because wolfSSL has no RDRAND or GOST engine. + +The patch needs wolfSSL master newer than 5.8.2 (ERR_set_mark, +ERR_pop_to_mark, EVP_PKEY_RSA_PSS, BN_mask_bits and an EVP_DecryptUpdate fix). + +When building for FIPS or with wolfSSL releases 5.7.2 and older add `CPPFLAGS=-DRSA_LOW_MEM` to the wolfSSL configuration: + ./configure --enable-all CPPFLAGS=-DRSA_LOW_MEM +--- + m4/acx_crypto_backend.m4 | 44 +++++++- + src/bin/keyconv/softhsm2-keyconv-ossl.cpp | 25 ++++- + src/bin/util/softhsm2-util-ossl.cpp | 6 ++ + src/lib/P11Attributes.cpp | 2 +- + src/lib/SoftHSM.cpp | 68 ++++++------- + src/lib/crypto/AsymmetricAlgorithm.h | 2 +- + src/lib/crypto/BotanCryptoFactory.cpp | 16 +-- + src/lib/crypto/BotanCryptoFactory.h | 2 +- + src/lib/crypto/BotanECDSA.cpp | 28 +++--- + src/lib/crypto/BotanRSA.cpp | 30 +++--- + src/lib/crypto/CryptoFactory.h | 2 +- + src/lib/crypto/HashAlgorithm.h | 18 ++-- + src/lib/crypto/OSSLCMAC.cpp | 2 + + src/lib/crypto/OSSLCryptoFactory.cpp | 18 ++-- + src/lib/crypto/OSSLCryptoFactory.h | 2 +- + src/lib/crypto/OSSLDES.cpp | 6 ++ + src/lib/crypto/OSSLDHPrivateKey.cpp | 2 + + src/lib/crypto/OSSLDHPublicKey.cpp | 2 + + src/lib/crypto/OSSLDSA.cpp | 26 ++--- + src/lib/crypto/OSSLDSAPrivateKey.cpp | 2 + + src/lib/crypto/OSSLDSAPublicKey.cpp | 2 + + src/lib/crypto/OSSLECDSA.cpp | 28 +++--- + src/lib/crypto/OSSLECPrivateKey.cpp | 4 + + src/lib/crypto/OSSLRSA.cpp | 116 ++++++++++++---------- + src/lib/crypto/OSSLRSAPrivateKey.cpp | 2 + + src/lib/crypto/OSSLRSAPublicKey.cpp | 2 + + src/lib/crypto/SymmetricKey.cpp | 2 +- + src/lib/crypto/test/AESTests.cpp | 12 +++ + src/lib/crypto/test/DESTests.cpp | 34 +++++++ + src/lib/crypto/test/DESTests.h | 2 + + src/lib/crypto/test/DHTests.cpp | 5 + + src/lib/crypto/test/DSATests.cpp | 4 + + src/lib/crypto/test/ECDSATests.cpp | 14 +-- + src/lib/crypto/test/GOSTTests.cpp | 4 +- + src/lib/crypto/test/HashTests.cpp | 12 +-- + src/lib/crypto/test/MacTests.cpp | 2 + + src/lib/crypto/test/MacTests.h | 4 + + src/lib/crypto/test/RSATests.cpp | 16 +-- + src/lib/data_mgr/RFC4880.cpp | 2 +- + src/lib/session_mgr/Session.cpp | 8 +- + src/lib/session_mgr/Session.h | 6 +- + src/lib/test/AsymWrapUnwrapTests.cpp | 8 ++ + src/lib/test/DeriveTests.cpp | 20 ++++ + src/lib/test/ObjectTests.cpp | 2 + + src/lib/test/SignVerifyTests.cpp | 13 +++ + src/lib/test/SymmetricAlgorithmTests.cpp | 2 + + 46 files changed, 424 insertions(+), 205 deletions(-) + +diff --git a/m4/acx_crypto_backend.m4 b/m4/acx_crypto_backend.m4 +index fe59ca9..9017c6e 100644 +--- a/m4/acx_crypto_backend.m4 ++++ b/m4/acx_crypto_backend.m4 +@@ -63,7 +63,7 @@ AC_DEFUN([ACX_CRYPTO_BACKEND],[ + + AC_ARG_WITH(crypto-backend, + AS_HELP_STRING([--with-crypto-backend], +- [Select crypto backend (openssl|botan)] ++ [Select crypto backend (openssl|botan|wolfssl)] + ), + [crypto_backend="${withval}"], + [crypto_backend="openssl"] +@@ -187,6 +187,46 @@ AC_DEFUN([ACX_CRYPTO_BACKEND],[ + [Compile with Botan support] + ) + ++ elif test "x${crypto_backend}" = "xwolfssl"; then ++ AC_MSG_RESULT(wolfSSL) ++ ++ AS_IF([test -z $WOLFSSL_INSTALL_DIR || test ! -d $WOLFSSL_INSTALL_DIR ], [ ++ WOLFSSL_INSTALL_DIR=/usr/local ++ ]) ++ ++ CRYPTO_INCLUDES="-I$WOLFSSL_INSTALL_DIR/include -I$WOLFSSL_INSTALL_DIR/include/wolfssl" ++ CRYPTO_LIBS="-lwolfssl -L$WOLFSSL_INSTALL_DIR/lib" ++ ++ acx_cv_lib_openssl_sufficient=yes ++ enable_ecc=yes ++ enable_eddsa=no ++ enable_gost=no ++ enable_fips=no ++ enable_openssl_engines=no ++ ++ AC_DEFINE([WITHOUT_OPENSSL_ENGINES], [1], ++ [Compile without OpenSSL engines support as it is disabled]) ++ ++ AC_DEFINE_UNQUOTED( ++ [WITH_RAW_PSS], ++ [1], ++ [Compile with raw RSA PKCS PSS] ++ ) ++ AC_DEFINE_UNQUOTED( ++ [WITH_OPENSSL], ++ [], ++ [Compile with OpenSSL support] ++ ) ++ AC_DEFINE_UNQUOTED( ++ [WITH_WOLFSSL], ++ [], ++ [Compile with wolfssl support] ++ ) ++ AC_DEFINE_UNQUOTED( ++ [EXTERNAL_OPTS_OPENVPN], ++ [], ++ [wolfoptions] ++ ) + else + AC_MSG_RESULT(Unknown) + AC_MSG_ERROR([Crypto backend ${crypto_backend} not supported. Use openssl or botan.]) +@@ -234,7 +274,7 @@ AC_DEFUN([ACX_CRYPTO_BACKEND],[ + + AC_SUBST(CRYPTO_INCLUDES) + AC_SUBST(CRYPTO_LIBS) +- AM_CONDITIONAL([WITH_OPENSSL], [test "x${crypto_backend}" = "xopenssl"]) ++ AM_CONDITIONAL([WITH_OPENSSL], [test "x${crypto_backend}" = "xopenssl" || test "x${crypto_backend}" = "xwolfssl"]) + AM_CONDITIONAL([WITH_BOTAN], [test "x${crypto_backend}" = "xbotan"]) + + ]) +diff --git a/src/bin/keyconv/softhsm2-keyconv-ossl.cpp b/src/bin/keyconv/softhsm2-keyconv-ossl.cpp +index a5cd8eb..7df3b61 100644 +--- a/src/bin/keyconv/softhsm2-keyconv-ossl.cpp ++++ b/src/bin/keyconv/softhsm2-keyconv-ossl.cpp +@@ -75,7 +75,9 @@ int save_rsa_pkcs8(char* out_path, char* file_pin, key_material_t* pkey) + EVP_PKEY* ossl_pkey = NULL; + PKCS8_PRIV_KEY_INFO* p8inf = NULL; + BIO* out = NULL; ++#ifndef WITH_WOLFSSL + X509_SIG* p8 = NULL; ++#endif + int result = 0; + + // See if the key material was found. +@@ -127,7 +129,6 @@ int save_rsa_pkcs8(char* out_path, char* file_pin, key_material_t* pkey) + EVP_PKEY_free(ossl_pkey); + return 1; + } +- EVP_PKEY_free(ossl_pkey); + + // Open output file + if (!(out = BIO_new_file (out_path, "wb"))) +@@ -145,6 +146,7 @@ int save_rsa_pkcs8(char* out_path, char* file_pin, key_material_t* pkey) + } + else + { ++#ifndef WITH_WOLFSSL + // Encrypt p8 + if (!(p8 = PKCS8_encrypt(NID_pbeWithMD5AndDES_CBC, NULL, + file_pin, strlen(file_pin), NULL, +@@ -159,6 +161,15 @@ int save_rsa_pkcs8(char* out_path, char* file_pin, key_material_t* pkey) + X509_SIG_free(p8); + printf("The key has been written to %s\n", out_path); + } ++#else ++ if (wolfSSL_PEM_write_bio_PKCS8PrivateKey( ++ out, ossl_pkey, wolfSSL_EVP_aes_256_cbc(), file_pin, ++ strlen(file_pin), NULL, NULL) == 0) ++ { ++ fprintf(stderr, "ERROR: wolfSSL_PEM_write_bio_PKCS8PrivateKey failed\n"); ++ result = 1; ++ } ++#endif + } + + PKCS8_PRIV_KEY_INFO_free(p8inf); +@@ -174,7 +185,9 @@ int save_dsa_pkcs8(char* out_path, char* file_pin, key_material_t* pkey) + EVP_PKEY* ossl_pkey = NULL; + PKCS8_PRIV_KEY_INFO* p8inf = NULL; + BIO* out = NULL; ++#ifndef WITH_WOLFSSL + X509_SIG* p8 = NULL; ++#endif + int result = 0; + + // See if the key material was found. +@@ -238,6 +251,7 @@ int save_dsa_pkcs8(char* out_path, char* file_pin, key_material_t* pkey) + } + else + { ++#ifndef WITH_WOLFSSL + // Encrypt p8 + if (!(p8 = PKCS8_encrypt(NID_pbeWithMD5AndDES_CBC, NULL, + file_pin, strlen(file_pin), NULL, +@@ -252,6 +266,15 @@ int save_dsa_pkcs8(char* out_path, char* file_pin, key_material_t* pkey) + X509_SIG_free(p8); + printf("The key has been written to %s\n", out_path); + } ++#else ++ if (wolfSSL_PEM_write_bio_PKCS8PrivateKey( ++ out, ossl_pkey, wolfSSL_EVP_aes_256_cbc(), file_pin, ++ strlen(file_pin), NULL, NULL) == 0) ++ { ++ fprintf(stderr, "ERROR: wolfSSL_PEM_write_bio_PKCS8PrivateKey failed\n"); ++ result = 1; ++ } ++#endif + } + + PKCS8_PRIV_KEY_INFO_free(p8inf); +diff --git a/src/bin/util/softhsm2-util-ossl.cpp b/src/bin/util/softhsm2-util-ossl.cpp +index 86813f2..1c27b54 100644 +--- a/src/bin/util/softhsm2-util-ossl.cpp ++++ b/src/bin/util/softhsm2-util-ossl.cpp +@@ -370,7 +370,9 @@ EVP_PKEY* crypto_read_file(char* filePath, char* filePIN) + BIO* in = NULL; + PKCS8_PRIV_KEY_INFO* p8inf = NULL; + EVP_PKEY* pkey = NULL; ++#ifndef WITH_WOLFSSL + X509_SIG* p8 = NULL; ++#endif + + if (!(in = BIO_new_file(filePath, "rb"))) + { +@@ -381,6 +383,7 @@ EVP_PKEY* crypto_read_file(char* filePath, char* filePIN) + // The PKCS#8 file is encrypted + if (filePIN) + { ++#ifndef WITH_WOLFSSL + p8 = PEM_read_bio_PKCS8(in, NULL, NULL, NULL); + BIO_free(in); + +@@ -400,6 +403,9 @@ EVP_PKEY* crypto_read_file(char* filePath, char* filePIN) + "Maybe wrong PIN to file (--file-pin )\n"); + return NULL; + } ++#else ++ p8inf = (EVP_PKEY*)wolfSSL_PEM_read_bio_PrivateKey(in, NULL, NULL, filePIN); ++#endif + } + else + { +diff --git a/src/lib/P11Attributes.cpp b/src/lib/P11Attributes.cpp +index 937f043..53600ca 100644 +--- a/src/lib/P11Attributes.cpp ++++ b/src/lib/P11Attributes.cpp +@@ -987,7 +987,7 @@ CK_RV P11AttrValue::updateAttr(Token *token, bool isPrivate, CK_VOID_PTR pValue, + // Calculate the CKA_CHECK_VALUE for certificates + if (osobject->getUnsignedLongValue(CKA_CLASS, CKO_VENDOR_DEFINED) == CKO_CERTIFICATE) + { +- HashAlgorithm* hash = CryptoFactory::i()->getHashAlgorithm(HashAlgo::SHA1); ++ HashAlgorithm* hash = CryptoFactory::i()->getHashAlgorithm(HashAlgo::shsm_SHA1); + if (hash == NULL) return CKR_GENERAL_ERROR; + + ByteString digest; +diff --git a/src/lib/SoftHSM.cpp b/src/lib/SoftHSM.cpp +index 8a2a73c..cee8796 100644 +--- a/src/lib/SoftHSM.cpp ++++ b/src/lib/SoftHSM.cpp +@@ -3652,31 +3652,31 @@ CK_RV SoftHSM::C_DigestInit(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMechan + if (session->getOpType() != SESSION_OP_NONE) return CKR_OPERATION_ACTIVE; + + // Get the mechanism +- HashAlgo::Type algo = HashAlgo::Unknown; ++ HashAlgo::shsm_Type algo = HashAlgo::shsm_Unknown; + switch(pMechanism->mechanism) { + #ifndef WITH_FIPS + case CKM_MD5: +- algo = HashAlgo::MD5; ++ algo = HashAlgo::shsm_MD5; + break; + #endif + case CKM_SHA_1: +- algo = HashAlgo::SHA1; ++ algo = HashAlgo::shsm_SHA1; + break; + case CKM_SHA224: +- algo = HashAlgo::SHA224; ++ algo = HashAlgo::shsm_SHA224; + break; + case CKM_SHA256: +- algo = HashAlgo::SHA256; ++ algo = HashAlgo::shsm_SHA256; + break; + case CKM_SHA384: +- algo = HashAlgo::SHA384; ++ algo = HashAlgo::shsm_SHA384; + break; + case CKM_SHA512: +- algo = HashAlgo::SHA512; ++ algo = HashAlgo::shsm_SHA512; + break; + #ifdef WITH_GOST + case CKM_GOSTR3411: +- algo = HashAlgo::GOST; ++ algo = HashAlgo::shsm_GOST; + break; + #endif + default: +@@ -3825,12 +3825,12 @@ CK_RV SoftHSM::C_DigestKey(CK_SESSION_HANDLE hSession, CK_OBJECT_HANDLE hObject) + } + + // Whitelist +- HashAlgo::Type algo = session->getHashAlgo(); +- if (algo != HashAlgo::SHA1 && +- algo != HashAlgo::SHA224 && +- algo != HashAlgo::SHA256 && +- algo != HashAlgo::SHA384 && +- algo != HashAlgo::SHA512) ++ HashAlgo::shsm_Type algo = session->getHashAlgo(); ++ if (algo != HashAlgo::shsm_SHA1 && ++ algo != HashAlgo::shsm_SHA224 && ++ algo != HashAlgo::shsm_SHA256 && ++ algo != HashAlgo::shsm_SHA384 && ++ algo != HashAlgo::shsm_SHA512) + { + // Parano... + if (!key->getBooleanValue(CKA_EXTRACTABLE, false)) +@@ -4203,27 +4203,27 @@ CK_RV SoftHSM::AsymSignInit(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMechan + + switch(CK_RSA_PKCS_PSS_PARAMS_PTR(pMechanism->pParameter)->hashAlg) { + case CKM_SHA_1: +- pssParam.hashAlg = HashAlgo::SHA1; ++ pssParam.hashAlg = HashAlgo::shsm_SHA1; + pssParam.mgf = AsymRSAMGF::MGF1_SHA1; + allowedMgf = CKG_MGF1_SHA1; + break; + case CKM_SHA224: +- pssParam.hashAlg = HashAlgo::SHA224; ++ pssParam.hashAlg = HashAlgo::shsm_SHA224; + pssParam.mgf = AsymRSAMGF::MGF1_SHA224; + allowedMgf = CKG_MGF1_SHA224; + break; + case CKM_SHA256: +- pssParam.hashAlg = HashAlgo::SHA256; ++ pssParam.hashAlg = HashAlgo::shsm_SHA256; + pssParam.mgf = AsymRSAMGF::MGF1_SHA256; + allowedMgf = CKG_MGF1_SHA256; + break; + case CKM_SHA384: +- pssParam.hashAlg = HashAlgo::SHA384; ++ pssParam.hashAlg = HashAlgo::shsm_SHA384; + pssParam.mgf = AsymRSAMGF::MGF1_SHA384; + allowedMgf = CKG_MGF1_SHA384; + break; + case CKM_SHA512: +- pssParam.hashAlg = HashAlgo::SHA512; ++ pssParam.hashAlg = HashAlgo::shsm_SHA512; + pssParam.mgf = AsymRSAMGF::MGF1_SHA512; + allowedMgf = CKG_MGF1_SHA512; + break; +@@ -4254,7 +4254,7 @@ CK_RV SoftHSM::AsymSignInit(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMechan + return CKR_ARGUMENTS_BAD; + } + mechanism = AsymMech::RSA_SHA1_PKCS_PSS; +- pssParam.hashAlg = HashAlgo::SHA1; ++ pssParam.hashAlg = HashAlgo::shsm_SHA1; + pssParam.mgf = AsymRSAMGF::MGF1_SHA1; + pssParam.sLen = CK_RSA_PKCS_PSS_PARAMS_PTR(pMechanism->pParameter)->sLen; + param = &pssParam; +@@ -4272,7 +4272,7 @@ CK_RV SoftHSM::AsymSignInit(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMechan + return CKR_ARGUMENTS_BAD; + } + mechanism = AsymMech::RSA_SHA224_PKCS_PSS; +- pssParam.hashAlg = HashAlgo::SHA224; ++ pssParam.hashAlg = HashAlgo::shsm_SHA224; + pssParam.mgf = AsymRSAMGF::MGF1_SHA224; + pssParam.sLen = CK_RSA_PKCS_PSS_PARAMS_PTR(pMechanism->pParameter)->sLen; + param = &pssParam; +@@ -4290,7 +4290,7 @@ CK_RV SoftHSM::AsymSignInit(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMechan + return CKR_ARGUMENTS_BAD; + } + mechanism = AsymMech::RSA_SHA256_PKCS_PSS; +- pssParam.hashAlg = HashAlgo::SHA256; ++ pssParam.hashAlg = HashAlgo::shsm_SHA256; + pssParam.mgf = AsymRSAMGF::MGF1_SHA256; + pssParam.sLen = CK_RSA_PKCS_PSS_PARAMS_PTR(pMechanism->pParameter)->sLen; + param = &pssParam; +@@ -4308,7 +4308,7 @@ CK_RV SoftHSM::AsymSignInit(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMechan + return CKR_ARGUMENTS_BAD; + } + mechanism = AsymMech::RSA_SHA384_PKCS_PSS; +- pssParam.hashAlg = HashAlgo::SHA384; ++ pssParam.hashAlg = HashAlgo::shsm_SHA384; + pssParam.mgf = AsymRSAMGF::MGF1_SHA384; + pssParam.sLen = CK_RSA_PKCS_PSS_PARAMS_PTR(pMechanism->pParameter)->sLen; + param = &pssParam; +@@ -4326,7 +4326,7 @@ CK_RV SoftHSM::AsymSignInit(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMechan + return CKR_ARGUMENTS_BAD; + } + mechanism = AsymMech::RSA_SHA512_PKCS_PSS; +- pssParam.hashAlg = HashAlgo::SHA512; ++ pssParam.hashAlg = HashAlgo::shsm_SHA512; + pssParam.mgf = AsymRSAMGF::MGF1_SHA512; + pssParam.sLen = CK_RSA_PKCS_PSS_PARAMS_PTR(pMechanism->pParameter)->sLen; + param = &pssParam; +@@ -5206,27 +5206,27 @@ CK_RV SoftHSM::AsymVerifyInit(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMech + unsigned long expectedMgf; + switch(CK_RSA_PKCS_PSS_PARAMS_PTR(pMechanism->pParameter)->hashAlg) { + case CKM_SHA_1: +- pssParam.hashAlg = HashAlgo::SHA1; ++ pssParam.hashAlg = HashAlgo::shsm_SHA1; + pssParam.mgf = AsymRSAMGF::MGF1_SHA1; + expectedMgf = CKG_MGF1_SHA1; + break; + case CKM_SHA224: +- pssParam.hashAlg = HashAlgo::SHA224; ++ pssParam.hashAlg = HashAlgo::shsm_SHA224; + pssParam.mgf = AsymRSAMGF::MGF1_SHA224; + expectedMgf = CKG_MGF1_SHA224; + break; + case CKM_SHA256: +- pssParam.hashAlg = HashAlgo::SHA256; ++ pssParam.hashAlg = HashAlgo::shsm_SHA256; + pssParam.mgf = AsymRSAMGF::MGF1_SHA256; + expectedMgf = CKG_MGF1_SHA256; + break; + case CKM_SHA384: +- pssParam.hashAlg = HashAlgo::SHA384; ++ pssParam.hashAlg = HashAlgo::shsm_SHA384; + pssParam.mgf = AsymRSAMGF::MGF1_SHA384; + expectedMgf = CKG_MGF1_SHA384; + break; + case CKM_SHA512: +- pssParam.hashAlg = HashAlgo::SHA512; ++ pssParam.hashAlg = HashAlgo::shsm_SHA512; + pssParam.mgf = AsymRSAMGF::MGF1_SHA512; + expectedMgf = CKG_MGF1_SHA512; + break; +@@ -5255,7 +5255,7 @@ CK_RV SoftHSM::AsymVerifyInit(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMech + return CKR_ARGUMENTS_BAD; + } + mechanism = AsymMech::RSA_SHA1_PKCS_PSS; +- pssParam.hashAlg = HashAlgo::SHA1; ++ pssParam.hashAlg = HashAlgo::shsm_SHA1; + pssParam.mgf = AsymRSAMGF::MGF1_SHA1; + pssParam.sLen = CK_RSA_PKCS_PSS_PARAMS_PTR(pMechanism->pParameter)->sLen; + param = &pssParam; +@@ -5273,7 +5273,7 @@ CK_RV SoftHSM::AsymVerifyInit(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMech + return CKR_ARGUMENTS_BAD; + } + mechanism = AsymMech::RSA_SHA224_PKCS_PSS; +- pssParam.hashAlg = HashAlgo::SHA224; ++ pssParam.hashAlg = HashAlgo::shsm_SHA224; + pssParam.mgf = AsymRSAMGF::MGF1_SHA224; + pssParam.sLen = CK_RSA_PKCS_PSS_PARAMS_PTR(pMechanism->pParameter)->sLen; + param = &pssParam; +@@ -5291,7 +5291,7 @@ CK_RV SoftHSM::AsymVerifyInit(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMech + return CKR_ARGUMENTS_BAD; + } + mechanism = AsymMech::RSA_SHA256_PKCS_PSS; +- pssParam.hashAlg = HashAlgo::SHA256; ++ pssParam.hashAlg = HashAlgo::shsm_SHA256; + pssParam.mgf = AsymRSAMGF::MGF1_SHA256; + pssParam.sLen = CK_RSA_PKCS_PSS_PARAMS_PTR(pMechanism->pParameter)->sLen; + param = &pssParam; +@@ -5309,7 +5309,7 @@ CK_RV SoftHSM::AsymVerifyInit(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMech + return CKR_ARGUMENTS_BAD; + } + mechanism = AsymMech::RSA_SHA384_PKCS_PSS; +- pssParam.hashAlg = HashAlgo::SHA384; ++ pssParam.hashAlg = HashAlgo::shsm_SHA384; + pssParam.mgf = AsymRSAMGF::MGF1_SHA384; + pssParam.sLen = CK_RSA_PKCS_PSS_PARAMS_PTR(pMechanism->pParameter)->sLen; + param = &pssParam; +@@ -5327,7 +5327,7 @@ CK_RV SoftHSM::AsymVerifyInit(CK_SESSION_HANDLE hSession, CK_MECHANISM_PTR pMech + return CKR_ARGUMENTS_BAD; + } + mechanism = AsymMech::RSA_SHA512_PKCS_PSS; +- pssParam.hashAlg = HashAlgo::SHA512; ++ pssParam.hashAlg = HashAlgo::shsm_SHA512; + pssParam.mgf = AsymRSAMGF::MGF1_SHA512; + pssParam.sLen = CK_RSA_PKCS_PSS_PARAMS_PTR(pMechanism->pParameter)->sLen; + param = &pssParam; +diff --git a/src/lib/crypto/AsymmetricAlgorithm.h b/src/lib/crypto/AsymmetricAlgorithm.h +index 52519db..a9fa5b2 100644 +--- a/src/lib/crypto/AsymmetricAlgorithm.h ++++ b/src/lib/crypto/AsymmetricAlgorithm.h +@@ -111,7 +111,7 @@ struct AsymRSAMGF + + struct RSA_PKCS_PSS_PARAMS + { +- HashAlgo::Type hashAlg; ++ HashAlgo::shsm_Type hashAlg; + AsymRSAMGF::Type mgf; + size_t sLen; + }; +diff --git a/src/lib/crypto/BotanCryptoFactory.cpp b/src/lib/crypto/BotanCryptoFactory.cpp +index 4ad743d..e1a84e7 100644 +--- a/src/lib/crypto/BotanCryptoFactory.cpp ++++ b/src/lib/crypto/BotanCryptoFactory.cpp +@@ -161,24 +161,24 @@ AsymmetricAlgorithm* BotanCryptoFactory::getAsymmetricAlgorithm(AsymAlgo::Type a + } + + // Create a concrete instance of a hash algorithm +-HashAlgorithm* BotanCryptoFactory::getHashAlgorithm(HashAlgo::Type algorithm) ++HashAlgorithm* BotanCryptoFactory::getHashAlgorithm(HashAlgo::shsm_Type algorithm) + { + switch (algorithm) + { +- case HashAlgo::MD5: ++ case HashAlgo::shsm_MD5: + return new BotanMD5(); +- case HashAlgo::SHA1: ++ case HashAlgo::shsm_SHA1: + return new BotanSHA1(); +- case HashAlgo::SHA224: ++ case HashAlgo::shsm_SHA224: + return new BotanSHA224(); +- case HashAlgo::SHA256: ++ case HashAlgo::shsm_SHA256: + return new BotanSHA256(); +- case HashAlgo::SHA384: ++ case HashAlgo::shsm_SHA384: + return new BotanSHA384(); +- case HashAlgo::SHA512: ++ case HashAlgo::shsm_SHA512: + return new BotanSHA512(); + #ifdef WITH_GOST +- case HashAlgo::GOST: ++ case HashAlgo::shsm_GOST: + return new BotanGOSTR3411(); + #endif + default: +diff --git a/src/lib/crypto/BotanCryptoFactory.h b/src/lib/crypto/BotanCryptoFactory.h +index 788ae37..87d2fb3 100644 +--- a/src/lib/crypto/BotanCryptoFactory.h ++++ b/src/lib/crypto/BotanCryptoFactory.h +@@ -66,7 +66,7 @@ public: + AsymmetricAlgorithm* getAsymmetricAlgorithm(AsymAlgo::Type algorithm); + + // Create a concrete instance of a hash algorithm +- HashAlgorithm* getHashAlgorithm(HashAlgo::Type algorithm); ++ HashAlgorithm* getHashAlgorithm(HashAlgo::shsm_Type algorithm); + + // Create a concrete instance of a MAC algorithm + MacAlgorithm* getMacAlgorithm(MacAlgo::Type algorithm); +diff --git a/src/lib/crypto/BotanECDSA.cpp b/src/lib/crypto/BotanECDSA.cpp +index 4fffa4e..c97f6a5 100644 +--- a/src/lib/crypto/BotanECDSA.cpp ++++ b/src/lib/crypto/BotanECDSA.cpp +@@ -67,25 +67,25 @@ bool BotanECDSA::sign(PrivateKey* privateKey, const ByteString& dataToSign, + { + std::string emsa = "Raw"; + +- HashAlgo::Type hash = HashAlgo::Unknown; ++ HashAlgo::shsm_Type hash = HashAlgo::shsm_Unknown; + if (mechanism != AsymMech::ECDSA) + { + switch (mechanism) + { + case AsymMech::ECDSA_SHA1: +- hash = HashAlgo::SHA1; ++ hash = HashAlgo::shsm_SHA1; + break; + case AsymMech::ECDSA_SHA224: +- hash = HashAlgo::SHA224; ++ hash = HashAlgo::shsm_SHA224; + break; + case AsymMech::ECDSA_SHA256: +- hash = HashAlgo::SHA256; ++ hash = HashAlgo::shsm_SHA256; + break; + case AsymMech::ECDSA_SHA384: +- hash = HashAlgo::SHA384; ++ hash = HashAlgo::shsm_SHA384; + break; + case AsymMech::ECDSA_SHA512: +- hash = HashAlgo::SHA512; ++ hash = HashAlgo::shsm_SHA512; + break; + default: + ERROR_MSG("Invalid mechanism supplied (%i)", mechanism); +@@ -126,7 +126,7 @@ bool BotanECDSA::sign(PrivateKey* privateKey, const ByteString& dataToSign, + // Pre-hash the data if necessary + ByteString prepDataToSign; + +- if (hash == HashAlgo::Unknown) { ++ if (hash == HashAlgo::shsm_Unknown) { + prepDataToSign = dataToSign; + } else { + HashAlgorithm* digest = BotanCryptoFactory::i()->getHashAlgorithm(hash); +@@ -198,25 +198,25 @@ bool BotanECDSA::verify(PublicKey* publicKey, const ByteString& originalData, + { + std::string emsa = "Raw"; + +- HashAlgo::Type hash = HashAlgo::Unknown; ++ HashAlgo::shsm_Type hash = HashAlgo::shsm_Unknown; + if (mechanism != AsymMech::ECDSA) + { + switch (mechanism) + { + case AsymMech::ECDSA_SHA1: +- hash = HashAlgo::SHA1; ++ hash = HashAlgo::shsm_SHA1; + break; + case AsymMech::ECDSA_SHA224: +- hash = HashAlgo::SHA224; ++ hash = HashAlgo::shsm_SHA224; + break; + case AsymMech::ECDSA_SHA256: +- hash = HashAlgo::SHA256; ++ hash = HashAlgo::shsm_SHA256; + break; + case AsymMech::ECDSA_SHA384: +- hash = HashAlgo::SHA384; ++ hash = HashAlgo::shsm_SHA384; + break; + case AsymMech::ECDSA_SHA512: +- hash = HashAlgo::SHA512; ++ hash = HashAlgo::shsm_SHA512; + break; + default: + ERROR_MSG("Invalid mechanism supplied (%i)", mechanism); +@@ -256,7 +256,7 @@ bool BotanECDSA::verify(PublicKey* publicKey, const ByteString& originalData, + // Pre-hash the data if necessary + ByteString prepDataToSign; + +- if (hash == HashAlgo::Unknown) { ++ if (hash == HashAlgo::shsm_Unknown) { + prepDataToSign = originalData; + } else { + HashAlgorithm* digest = BotanCryptoFactory::i()->getHashAlgorithm(hash); +diff --git a/src/lib/crypto/BotanRSA.cpp b/src/lib/crypto/BotanRSA.cpp +index 3ed450e..75c8036 100644 +--- a/src/lib/crypto/BotanRSA.cpp ++++ b/src/lib/crypto/BotanRSA.cpp +@@ -188,7 +188,7 @@ bool BotanRSA::signInit(PrivateKey* privateKey, const AsymMech::Type mechanism, + break; + case AsymMech::RSA_SHA1_PKCS_PSS: + if (param == NULL || paramLen != sizeof(RSA_PKCS_PSS_PARAMS) || +- ((RSA_PKCS_PSS_PARAMS*) param)->hashAlg != HashAlgo::SHA1 || ++ ((RSA_PKCS_PSS_PARAMS*) param)->hashAlg != HashAlgo::shsm_SHA1 || + ((RSA_PKCS_PSS_PARAMS*) param)->mgf != AsymRSAMGF::MGF1_SHA1) + { + ERROR_MSG("Invalid parameters"); +@@ -210,7 +210,7 @@ bool BotanRSA::signInit(PrivateKey* privateKey, const AsymMech::Type mechanism, + break; + case AsymMech::RSA_SHA224_PKCS_PSS: + if (param == NULL || paramLen != sizeof(RSA_PKCS_PSS_PARAMS) || +- ((RSA_PKCS_PSS_PARAMS*) param)->hashAlg != HashAlgo::SHA224 || ++ ((RSA_PKCS_PSS_PARAMS*) param)->hashAlg != HashAlgo::shsm_SHA224 || + ((RSA_PKCS_PSS_PARAMS*) param)->mgf != AsymRSAMGF::MGF1_SHA224) + { + ERROR_MSG("Invalid parameters"); +@@ -232,7 +232,7 @@ bool BotanRSA::signInit(PrivateKey* privateKey, const AsymMech::Type mechanism, + break; + case AsymMech::RSA_SHA256_PKCS_PSS: + if (param == NULL || paramLen != sizeof(RSA_PKCS_PSS_PARAMS) || +- ((RSA_PKCS_PSS_PARAMS*) param)->hashAlg != HashAlgo::SHA256 || ++ ((RSA_PKCS_PSS_PARAMS*) param)->hashAlg != HashAlgo::shsm_SHA256 || + ((RSA_PKCS_PSS_PARAMS*) param)->mgf != AsymRSAMGF::MGF1_SHA256) + { + ERROR_MSG("Invalid parameters"); +@@ -254,7 +254,7 @@ bool BotanRSA::signInit(PrivateKey* privateKey, const AsymMech::Type mechanism, + break; + case AsymMech::RSA_SHA384_PKCS_PSS: + if (param == NULL || paramLen != sizeof(RSA_PKCS_PSS_PARAMS) || +- ((RSA_PKCS_PSS_PARAMS*) param)->hashAlg != HashAlgo::SHA384 || ++ ((RSA_PKCS_PSS_PARAMS*) param)->hashAlg != HashAlgo::shsm_SHA384 || + ((RSA_PKCS_PSS_PARAMS*) param)->mgf != AsymRSAMGF::MGF1_SHA384) + { + ERROR_MSG("Invalid parameters"); +@@ -276,7 +276,7 @@ bool BotanRSA::signInit(PrivateKey* privateKey, const AsymMech::Type mechanism, + break; + case AsymMech::RSA_SHA512_PKCS_PSS: + if (param == NULL || paramLen != sizeof(RSA_PKCS_PSS_PARAMS) || +- ((RSA_PKCS_PSS_PARAMS*) param)->hashAlg != HashAlgo::SHA512 || ++ ((RSA_PKCS_PSS_PARAMS*) param)->hashAlg != HashAlgo::shsm_SHA512 || + ((RSA_PKCS_PSS_PARAMS*) param)->mgf != AsymRSAMGF::MGF1_SHA512) + { + ERROR_MSG("Invalid parameters"); +@@ -532,7 +532,7 @@ bool BotanRSA::verifyInit(PublicKey* publicKey, const AsymMech::Type mechanism, + break; + case AsymMech::RSA_SHA1_PKCS_PSS: + if (param == NULL || paramLen != sizeof(RSA_PKCS_PSS_PARAMS) || +- ((RSA_PKCS_PSS_PARAMS*) param)->hashAlg != HashAlgo::SHA1 || ++ ((RSA_PKCS_PSS_PARAMS*) param)->hashAlg != HashAlgo::shsm_SHA1 || + ((RSA_PKCS_PSS_PARAMS*) param)->mgf != AsymRSAMGF::MGF1_SHA1) + { + ERROR_MSG("Invalid parameters"); +@@ -554,7 +554,7 @@ bool BotanRSA::verifyInit(PublicKey* publicKey, const AsymMech::Type mechanism, + break; + case AsymMech::RSA_SHA224_PKCS_PSS: + if (param == NULL || paramLen != sizeof(RSA_PKCS_PSS_PARAMS) || +- ((RSA_PKCS_PSS_PARAMS*) param)->hashAlg != HashAlgo::SHA224 || ++ ((RSA_PKCS_PSS_PARAMS*) param)->hashAlg != HashAlgo::shsm_SHA224 || + ((RSA_PKCS_PSS_PARAMS*) param)->mgf != AsymRSAMGF::MGF1_SHA224) + { + ERROR_MSG("Invalid parameters"); +@@ -576,7 +576,7 @@ bool BotanRSA::verifyInit(PublicKey* publicKey, const AsymMech::Type mechanism, + break; + case AsymMech::RSA_SHA256_PKCS_PSS: + if (param == NULL || paramLen != sizeof(RSA_PKCS_PSS_PARAMS) || +- ((RSA_PKCS_PSS_PARAMS*) param)->hashAlg != HashAlgo::SHA256 || ++ ((RSA_PKCS_PSS_PARAMS*) param)->hashAlg != HashAlgo::shsm_SHA256 || + ((RSA_PKCS_PSS_PARAMS*) param)->mgf != AsymRSAMGF::MGF1_SHA256) + { + ERROR_MSG("Invalid parameters"); +@@ -598,7 +598,7 @@ bool BotanRSA::verifyInit(PublicKey* publicKey, const AsymMech::Type mechanism, + break; + case AsymMech::RSA_SHA384_PKCS_PSS: + if (param == NULL || paramLen != sizeof(RSA_PKCS_PSS_PARAMS) || +- ((RSA_PKCS_PSS_PARAMS*) param)->hashAlg != HashAlgo::SHA384 || ++ ((RSA_PKCS_PSS_PARAMS*) param)->hashAlg != HashAlgo::shsm_SHA384 || + ((RSA_PKCS_PSS_PARAMS*) param)->mgf != AsymRSAMGF::MGF1_SHA384) + { + ERROR_MSG("Invalid parameters"); +@@ -620,7 +620,7 @@ bool BotanRSA::verifyInit(PublicKey* publicKey, const AsymMech::Type mechanism, + break; + case AsymMech::RSA_SHA512_PKCS_PSS: + if (param == NULL || paramLen != sizeof(RSA_PKCS_PSS_PARAMS) || +- ((RSA_PKCS_PSS_PARAMS*) param)->hashAlg != HashAlgo::SHA512 || ++ ((RSA_PKCS_PSS_PARAMS*) param)->hashAlg != HashAlgo::shsm_SHA512 || + ((RSA_PKCS_PSS_PARAMS*) param)->mgf != AsymRSAMGF::MGF1_SHA512) + { + ERROR_MSG("Invalid parameters"); +@@ -1119,23 +1119,23 @@ std::string BotanRSA::getCipherRawPss(size_t bitLength, size_t dataSize, const v + size_t allowedLen = 0; + switch (((RSA_PKCS_PSS_PARAMS*) param)->hashAlg) + { +- case HashAlgo::SHA1: ++ case HashAlgo::shsm_SHA1: + hashStr = "SHA-160"; + allowedLen = 20; + break; +- case HashAlgo::SHA224: ++ case HashAlgo::shsm_SHA224: + hashStr = "SHA-224"; + allowedLen = 28; + break; +- case HashAlgo::SHA256: ++ case HashAlgo::shsm_SHA256: + hashStr = "SHA-256"; + allowedLen = 32; + break; +- case HashAlgo::SHA384: ++ case HashAlgo::shsm_SHA384: + hashStr = "SHA-384"; + allowedLen = 48; + break; +- case HashAlgo::SHA512: ++ case HashAlgo::shsm_SHA512: + hashStr = "SHA-512"; + allowedLen = 64; + break; +diff --git a/src/lib/crypto/CryptoFactory.h b/src/lib/crypto/CryptoFactory.h +index 761e473..c49f4eb 100644 +--- a/src/lib/crypto/CryptoFactory.h ++++ b/src/lib/crypto/CryptoFactory.h +@@ -71,7 +71,7 @@ public: + virtual void recycleAsymmetricAlgorithm(AsymmetricAlgorithm* toRecycle); + + // Create a concrete instance of a hash algorithm +- virtual HashAlgorithm* getHashAlgorithm(HashAlgo::Type algorithm) = 0; ++ virtual HashAlgorithm* getHashAlgorithm(HashAlgo::shsm_Type algorithm) = 0; + + // Recycle a hash algorithm instance -- override this function in the derived + // class if you need to perform specific clean-up +diff --git a/src/lib/crypto/HashAlgorithm.h b/src/lib/crypto/HashAlgorithm.h +index ca2ae08..0e33174 100644 +--- a/src/lib/crypto/HashAlgorithm.h ++++ b/src/lib/crypto/HashAlgorithm.h +@@ -38,16 +38,16 @@ + + struct HashAlgo + { +- enum Type ++ enum shsm_Type + { +- Unknown, +- MD5, +- SHA1, +- SHA224, +- SHA256, +- SHA384, +- SHA512, +- GOST ++ shsm_Unknown, ++ shsm_MD5, ++ shsm_SHA1, ++ shsm_SHA224, ++ shsm_SHA256, ++ shsm_SHA384, ++ shsm_SHA512, ++ shsm_GOST + }; + }; + +diff --git a/src/lib/crypto/OSSLCMAC.cpp b/src/lib/crypto/OSSLCMAC.cpp +index 554c308..af47776 100644 +--- a/src/lib/crypto/OSSLCMAC.cpp ++++ b/src/lib/crypto/OSSLCMAC.cpp +@@ -40,8 +40,10 @@ const EVP_CIPHER* OSSLCMACDES::getEVPCipher() const + case 56: + ERROR_MSG("Only supporting 3DES"); + return NULL; ++#ifndef WITH_WOLFSSL + case 112: + return EVP_des_ede_cbc(); ++#endif + case 168: + return EVP_des_ede3_cbc(); + default: +diff --git a/src/lib/crypto/OSSLCryptoFactory.cpp b/src/lib/crypto/OSSLCryptoFactory.cpp +index db22998..ec8f8be 100644 +--- a/src/lib/crypto/OSSLCryptoFactory.cpp ++++ b/src/lib/crypto/OSSLCryptoFactory.cpp +@@ -358,24 +358,24 @@ AsymmetricAlgorithm* OSSLCryptoFactory::getAsymmetricAlgorithm(AsymAlgo::Type al + } + + // Create a concrete instance of a hash algorithm +-HashAlgorithm* OSSLCryptoFactory::getHashAlgorithm(HashAlgo::Type algorithm) ++HashAlgorithm* OSSLCryptoFactory::getHashAlgorithm(HashAlgo::shsm_Type algorithm) + { + switch (algorithm) + { +- case HashAlgo::MD5: ++ case HashAlgo::shsm_MD5: + return new OSSLMD5(); +- case HashAlgo::SHA1: ++ case HashAlgo::shsm_SHA1: + return new OSSLSHA1(); +- case HashAlgo::SHA224: ++ case HashAlgo::shsm_SHA224: + return new OSSLSHA224(); +- case HashAlgo::SHA256: ++ case HashAlgo::shsm_SHA256: + return new OSSLSHA256(); +- case HashAlgo::SHA384: ++ case HashAlgo::shsm_SHA384: + return new OSSLSHA384(); +- case HashAlgo::SHA512: ++ case HashAlgo::shsm_SHA512: + return new OSSLSHA512(); + #ifdef WITH_GOST +- case HashAlgo::GOST: ++ case HashAlgo::shsm_GOST: + return new OSSLGOSTR3411(); + #endif + default: +@@ -408,8 +408,10 @@ MacAlgorithm* OSSLCryptoFactory::getMacAlgorithm(MacAlgo::Type algorithm) + case MacAlgo::HMAC_GOST: + return new OSSLHMACGOSTR3411(); + #endif ++#ifndef WITH_WOLFSSL /* wolfSSL only supports cmac with aes */ + case MacAlgo::CMAC_DES: + return new OSSLCMACDES(); ++#endif + case MacAlgo::CMAC_AES: + return new OSSLCMACAES(); + default: +diff --git a/src/lib/crypto/OSSLCryptoFactory.h b/src/lib/crypto/OSSLCryptoFactory.h +index bdfc031..8652d13 100644 +--- a/src/lib/crypto/OSSLCryptoFactory.h ++++ b/src/lib/crypto/OSSLCryptoFactory.h +@@ -69,7 +69,7 @@ public: + virtual AsymmetricAlgorithm* getAsymmetricAlgorithm(AsymAlgo::Type algorithm); + + // Create a concrete instance of a hash algorithm +- virtual HashAlgorithm* getHashAlgorithm(HashAlgo::Type algorithm); ++ virtual HashAlgorithm* getHashAlgorithm(HashAlgo::shsm_Type algorithm); + + // Create a concrete instance of a MAC algorithm + virtual MacAlgorithm* getMacAlgorithm(MacAlgo::Type algorithm); +diff --git a/src/lib/crypto/OSSLDES.cpp b/src/lib/crypto/OSSLDES.cpp +index 4fb56b5..e7dd193 100644 +--- a/src/lib/crypto/OSSLDES.cpp ++++ b/src/lib/crypto/OSSLDES.cpp +@@ -79,8 +79,10 @@ const EVP_CIPHER* OSSLDES::getCipher() const + { + case 56: + return EVP_des_cbc(); ++#ifndef WITH_WOLFSSL + case 112: + return EVP_des_ede_cbc(); ++#endif + case 168: + return EVP_des_ede3_cbc(); + }; +@@ -91,12 +93,15 @@ const EVP_CIPHER* OSSLDES::getCipher() const + { + case 56: + return EVP_des_ecb(); ++#ifndef WITH_WOLFSSL + case 112: + return EVP_des_ede_ecb(); ++#endif + case 168: + return EVP_des_ede3_ecb(); + }; + } ++#ifndef WITH_WOLFSSL + else if (currentCipherMode == SymMode::OFB) + { + switch(currentKey->getBitLen()) +@@ -121,6 +126,7 @@ const EVP_CIPHER* OSSLDES::getCipher() const + return EVP_des_ede3_cfb(); + }; + } ++#endif + + ERROR_MSG("Invalid DES cipher mode %i", currentCipherMode); + +diff --git a/src/lib/crypto/OSSLDHPrivateKey.cpp b/src/lib/crypto/OSSLDHPrivateKey.cpp +index 5571a88..ce1256f 100644 +--- a/src/lib/crypto/OSSLDHPrivateKey.cpp ++++ b/src/lib/crypto/OSSLDHPrivateKey.cpp +@@ -209,6 +209,7 @@ void OSSLDHPrivateKey::createOSSLKey() + return; + } + ++#ifndef WITH_WOLFSSL + // Use the OpenSSL implementation and not any engine + #if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER) + +@@ -223,6 +224,7 @@ void OSSLDHPrivateKey::createOSSLKey() + + #else + DH_set_method(dh, DH_OpenSSL()); ++#endif + #endif + + BIGNUM* bn_p = OSSL::byteString2bn(p); +diff --git a/src/lib/crypto/OSSLDHPublicKey.cpp b/src/lib/crypto/OSSLDHPublicKey.cpp +index e261726..2241fed 100644 +--- a/src/lib/crypto/OSSLDHPublicKey.cpp ++++ b/src/lib/crypto/OSSLDHPublicKey.cpp +@@ -150,6 +150,7 @@ void OSSLDHPublicKey::createOSSLKey() + return; + } + ++#ifndef WITH_WOLFSSL + // Use the OpenSSL implementation and not any engine + #if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER) + +@@ -164,6 +165,7 @@ void OSSLDHPublicKey::createOSSLKey() + + #else + DH_set_method(dh, DH_OpenSSL()); ++#endif + #endif + + BIGNUM* bn_p = OSSL::byteString2bn(p); +diff --git a/src/lib/crypto/OSSLDSA.cpp b/src/lib/crypto/OSSLDSA.cpp +index 06b5d50..2f49415 100644 +--- a/src/lib/crypto/OSSLDSA.cpp ++++ b/src/lib/crypto/OSSLDSA.cpp +@@ -121,24 +121,24 @@ bool OSSLDSA::signInit(PrivateKey* privateKey, const AsymMech::Type mechanism, + return false; + } + +- HashAlgo::Type hash = HashAlgo::Unknown; ++ HashAlgo::shsm_Type hash = HashAlgo::shsm_Unknown; + + switch (mechanism) + { + case AsymMech::DSA_SHA1: +- hash = HashAlgo::SHA1; ++ hash = HashAlgo::shsm_SHA1; + break; + case AsymMech::DSA_SHA224: +- hash = HashAlgo::SHA224; ++ hash = HashAlgo::shsm_SHA224; + break; + case AsymMech::DSA_SHA256: +- hash = HashAlgo::SHA256; ++ hash = HashAlgo::shsm_SHA256; + break; + case AsymMech::DSA_SHA384: +- hash = HashAlgo::SHA384; ++ hash = HashAlgo::shsm_SHA384; + break; + case AsymMech::DSA_SHA512: +- hash = HashAlgo::SHA512; ++ hash = HashAlgo::shsm_SHA512; + break; + default: + ERROR_MSG("Invalid mechanism supplied (%i)", mechanism); +@@ -309,24 +309,24 @@ bool OSSLDSA::verifyInit(PublicKey* publicKey, const AsymMech::Type mechanism, + return false; + } + +- HashAlgo::Type hash = HashAlgo::Unknown; ++ HashAlgo::shsm_Type hash = HashAlgo::shsm_Unknown; + + switch (mechanism) + { + case AsymMech::DSA_SHA1: +- hash = HashAlgo::SHA1; ++ hash = HashAlgo::shsm_SHA1; + break; + case AsymMech::DSA_SHA224: +- hash = HashAlgo::SHA224; ++ hash = HashAlgo::shsm_SHA224; + break; + case AsymMech::DSA_SHA256: +- hash = HashAlgo::SHA256; ++ hash = HashAlgo::shsm_SHA256; + break; + case AsymMech::DSA_SHA384: +- hash = HashAlgo::SHA384; ++ hash = HashAlgo::shsm_SHA384; + break; + case AsymMech::DSA_SHA512: +- hash = HashAlgo::SHA512; ++ hash = HashAlgo::shsm_SHA512; + break; + default: + ERROR_MSG("Invalid mechanism supplied (%i)", mechanism); +@@ -481,8 +481,10 @@ bool OSSLDSA::generateKeyPair(AsymmetricKeyPair** ppKeyPair, AsymmetricParameter + return false; + } + ++#ifndef WITH_WOLFSSL + // Use the OpenSSL implementation and not any engine + DSA_set_method(dsa, DSA_get_default_method()); ++#endif + + BIGNUM* bn_p = OSSL::byteString2bn(params->getP()); + BIGNUM* bn_q = OSSL::byteString2bn(params->getQ()); +diff --git a/src/lib/crypto/OSSLDSAPrivateKey.cpp b/src/lib/crypto/OSSLDSAPrivateKey.cpp +index 527e041..edc5228 100644 +--- a/src/lib/crypto/OSSLDSAPrivateKey.cpp ++++ b/src/lib/crypto/OSSLDSAPrivateKey.cpp +@@ -226,6 +226,7 @@ void OSSLDSAPrivateKey::createOSSLKey() + return; + } + ++#ifndef WITH_WOLFSSL + // Use the OpenSSL implementation and not any engine + #if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER) + +@@ -240,6 +241,7 @@ void OSSLDSAPrivateKey::createOSSLKey() + + #else + DSA_set_method(dsa, DSA_OpenSSL()); ++#endif + #endif + + BIGNUM* bn_p = OSSL::byteString2bn(p); +diff --git a/src/lib/crypto/OSSLDSAPublicKey.cpp b/src/lib/crypto/OSSLDSAPublicKey.cpp +index 38ecc79..5cf9b2d 100644 +--- a/src/lib/crypto/OSSLDSAPublicKey.cpp ++++ b/src/lib/crypto/OSSLDSAPublicKey.cpp +@@ -167,6 +167,7 @@ void OSSLDSAPublicKey::createOSSLKey() + return; + } + ++#ifndef WITH_WOLFSSL + // Use the OpenSSL implementation and not any engine + #if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER) + +@@ -181,6 +182,7 @@ void OSSLDSAPublicKey::createOSSLKey() + + #else + DSA_set_method(dsa, DSA_OpenSSL()); ++#endif + #endif + + BIGNUM* bn_p = OSSL::byteString2bn(p); +diff --git a/src/lib/crypto/OSSLECDSA.cpp b/src/lib/crypto/OSSLECDSA.cpp +index 23139c1..633b8f9 100644 +--- a/src/lib/crypto/OSSLECDSA.cpp ++++ b/src/lib/crypto/OSSLECDSA.cpp +@@ -54,26 +54,26 @@ bool OSSLECDSA::sign(PrivateKey* privateKey, const ByteString& dataToSign, + const void* /* param = NULL */, const size_t /* paramLen = 0 */) + { + +- HashAlgo::Type hash = HashAlgo::Unknown; ++ HashAlgo::shsm_Type hash = HashAlgo::shsm_Unknown; + + if (mechanism != AsymMech::ECDSA) + { + switch (mechanism) + { + case AsymMech::ECDSA_SHA1: +- hash = HashAlgo::SHA1; ++ hash = HashAlgo::shsm_SHA1; + break; + case AsymMech::ECDSA_SHA224: +- hash = HashAlgo::SHA224; ++ hash = HashAlgo::shsm_SHA224; + break; + case AsymMech::ECDSA_SHA256: +- hash = HashAlgo::SHA256; ++ hash = HashAlgo::shsm_SHA256; + break; + case AsymMech::ECDSA_SHA384: +- hash = HashAlgo::SHA384; ++ hash = HashAlgo::shsm_SHA384; + break; + case AsymMech::ECDSA_SHA512: +- hash = HashAlgo::SHA512; ++ hash = HashAlgo::shsm_SHA512; + break; + default: + ERROR_MSG("Invalid mechanism supplied (%i)", mechanism); +@@ -117,7 +117,7 @@ bool OSSLECDSA::sign(PrivateKey* privateKey, const ByteString& dataToSign, + + // Pre-hash the data if necessary + ByteString prepDataToSign; +- if (hash == HashAlgo::Unknown) { ++ if (hash == HashAlgo::shsm_Unknown) { + prepDataToSign = dataToSign; + } else { + HashAlgorithm* digest = CryptoFactory::i()->getHashAlgorithm(hash); +@@ -186,26 +186,26 @@ bool OSSLECDSA::verify(PublicKey* publicKey, const ByteString& originalData, + const void* /* param = NULL */, const size_t /* paramLen = 0 */) + { + +- HashAlgo::Type hash = HashAlgo::Unknown; ++ HashAlgo::shsm_Type hash = HashAlgo::shsm_Unknown; + + if (mechanism != AsymMech::ECDSA) + { + switch (mechanism) + { + case AsymMech::ECDSA_SHA1: +- hash = HashAlgo::SHA1; ++ hash = HashAlgo::shsm_SHA1; + break; + case AsymMech::ECDSA_SHA224: +- hash = HashAlgo::SHA224; ++ hash = HashAlgo::shsm_SHA224; + break; + case AsymMech::ECDSA_SHA256: +- hash = HashAlgo::SHA256; ++ hash = HashAlgo::shsm_SHA256; + break; + case AsymMech::ECDSA_SHA384: +- hash = HashAlgo::SHA384; ++ hash = HashAlgo::shsm_SHA384; + break; + case AsymMech::ECDSA_SHA512: +- hash = HashAlgo::SHA512; ++ hash = HashAlgo::shsm_SHA512; + break; + default: + ERROR_MSG("Invalid mechanism supplied (%i)", mechanism); +@@ -278,7 +278,7 @@ bool OSSLECDSA::verify(PublicKey* publicKey, const ByteString& originalData, + + // Pre-hash the data if necessary + ByteString prepDataToSign; +- if (hash == HashAlgo::Unknown) { ++ if (hash == HashAlgo::shsm_Unknown) { + prepDataToSign = originalData; + } else { + HashAlgorithm* digest = CryptoFactory::i()->getHashAlgorithm(hash); +diff --git a/src/lib/crypto/OSSLECPrivateKey.cpp b/src/lib/crypto/OSSLECPrivateKey.cpp +index 4f6b055..3129f71 100644 +--- a/src/lib/crypto/OSSLECPrivateKey.cpp ++++ b/src/lib/crypto/OSSLECPrivateKey.cpp +@@ -43,16 +43,20 @@ OSSLECPrivateKey::OSSLECPrivateKey() + { + eckey = EC_KEY_new(); + ++#ifndef WITH_WOLFSSL + // For PKCS#8 encoding + EC_KEY_set_enc_flags(eckey, EC_PKEY_NO_PUBKEY); ++#endif + } + + OSSLECPrivateKey::OSSLECPrivateKey(const EC_KEY* inECKEY) + { + eckey = EC_KEY_new(); + ++#ifndef WITH_WOLFSSL + // For PKCS#8 encoding + EC_KEY_set_enc_flags(eckey, EC_PKEY_NO_PUBKEY); ++#endif + + setFromOSSL(inECKEY); + } +diff --git a/src/lib/crypto/OSSLRSA.cpp b/src/lib/crypto/OSSLRSA.cpp +index d36a1e6..2c615e8 100644 +--- a/src/lib/crypto/OSSLRSA.cpp ++++ b/src/lib/crypto/OSSLRSA.cpp +@@ -108,7 +108,9 @@ bool OSSLRSA::sign(PrivateKey* privateKey, const ByteString& dataToSign, + + int sigLen = RSA_private_encrypt(dataToSign.size(), (unsigned char*) dataToSign.const_byte_str(), &signature[0], rsa, RSA_PKCS1_PADDING); + ++#ifndef WITH_WOLFSSL + RSA_blinding_off(rsa); ++#endif + + if (sigLen == -1) + { +@@ -147,23 +149,23 @@ bool OSSLRSA::sign(PrivateKey* privateKey, const ByteString& dataToSign, + + switch (pssParam->hashAlg) + { +- case HashAlgo::SHA1: ++ case HashAlgo::shsm_SHA1: + hash = EVP_sha1(); + allowedLen = 20; + break; +- case HashAlgo::SHA224: ++ case HashAlgo::shsm_SHA224: + hash = EVP_sha224(); + allowedLen = 28; + break; +- case HashAlgo::SHA256: ++ case HashAlgo::shsm_SHA256: + hash = EVP_sha256(); + allowedLen = 32; + break; +- case HashAlgo::SHA384: ++ case HashAlgo::shsm_SHA384: + hash = EVP_sha384(); + allowedLen = 48; + break; +- case HashAlgo::SHA512: ++ case HashAlgo::shsm_SHA512: + hash = EVP_sha512(); + allowedLen = 64; + break; +@@ -214,7 +216,9 @@ bool OSSLRSA::sign(PrivateKey* privateKey, const ByteString& dataToSign, + + int sigLen = RSA_private_encrypt(osslKey->getN().size(), &em[0], &signature[0], rsa, RSA_NO_PADDING); + ++#ifndef WITH_WOLFSSL + RSA_blinding_off(rsa); ++#endif + + if (sigLen == -1) + { +@@ -263,7 +267,9 @@ bool OSSLRSA::sign(PrivateKey* privateKey, const ByteString& dataToSign, + + int sigLen = RSA_private_encrypt(dataToSign.size(), (unsigned char*) dataToSign.const_byte_str(), &signature[0], rsa, RSA_NO_PADDING); + ++#ifndef WITH_WOLFSSL + RSA_blinding_off(rsa); ++#endif + + if (sigLen == -1) + { +@@ -302,32 +308,32 @@ bool OSSLRSA::signInit(PrivateKey* privateKey, const AsymMech::Type mechanism, + return false; + } + +- HashAlgo::Type hash1 = HashAlgo::Unknown; +- HashAlgo::Type hash2 = HashAlgo::Unknown; ++ HashAlgo::shsm_Type hash1 = HashAlgo::shsm_Unknown; ++ HashAlgo::shsm_Type hash2 = HashAlgo::shsm_Unknown; + + switch (mechanism) + { + case AsymMech::RSA_MD5_PKCS: +- hash1 = HashAlgo::MD5; ++ hash1 = HashAlgo::shsm_MD5; + break; + case AsymMech::RSA_SHA1_PKCS: +- hash1 = HashAlgo::SHA1; ++ hash1 = HashAlgo::shsm_SHA1; + break; + case AsymMech::RSA_SHA224_PKCS: +- hash1 = HashAlgo::SHA224; ++ hash1 = HashAlgo::shsm_SHA224; + break; + case AsymMech::RSA_SHA256_PKCS: +- hash1 = HashAlgo::SHA256; ++ hash1 = HashAlgo::shsm_SHA256; + break; + case AsymMech::RSA_SHA384_PKCS: +- hash1 = HashAlgo::SHA384; ++ hash1 = HashAlgo::shsm_SHA384; + break; + case AsymMech::RSA_SHA512_PKCS: +- hash1 = HashAlgo::SHA512; ++ hash1 = HashAlgo::shsm_SHA512; + break; + case AsymMech::RSA_SHA1_PKCS_PSS: + if (param == NULL || paramLen != sizeof(RSA_PKCS_PSS_PARAMS) || +- ((RSA_PKCS_PSS_PARAMS*) param)->hashAlg != HashAlgo::SHA1 || ++ ((RSA_PKCS_PSS_PARAMS*) param)->hashAlg != HashAlgo::shsm_SHA1 || + ((RSA_PKCS_PSS_PARAMS*) param)->mgf != AsymRSAMGF::MGF1_SHA1) + { + ERROR_MSG("Invalid parameters"); +@@ -344,11 +350,11 @@ bool OSSLRSA::signInit(PrivateKey* privateKey, const AsymMech::Type mechanism, + AsymmetricAlgorithm::signFinal(dummy); + return false; + } +- hash1 = HashAlgo::SHA1; ++ hash1 = HashAlgo::shsm_SHA1; + break; + case AsymMech::RSA_SHA224_PKCS_PSS: + if (param == NULL || paramLen != sizeof(RSA_PKCS_PSS_PARAMS) || +- ((RSA_PKCS_PSS_PARAMS*) param)->hashAlg != HashAlgo::SHA224 || ++ ((RSA_PKCS_PSS_PARAMS*) param)->hashAlg != HashAlgo::shsm_SHA224 || + ((RSA_PKCS_PSS_PARAMS*) param)->mgf != AsymRSAMGF::MGF1_SHA224) + { + ERROR_MSG("Invalid parameters"); +@@ -365,11 +371,11 @@ bool OSSLRSA::signInit(PrivateKey* privateKey, const AsymMech::Type mechanism, + AsymmetricAlgorithm::signFinal(dummy); + return false; + } +- hash1 = HashAlgo::SHA224; ++ hash1 = HashAlgo::shsm_SHA224; + break; + case AsymMech::RSA_SHA256_PKCS_PSS: + if (param == NULL || paramLen != sizeof(RSA_PKCS_PSS_PARAMS) || +- ((RSA_PKCS_PSS_PARAMS*) param)->hashAlg != HashAlgo::SHA256 || ++ ((RSA_PKCS_PSS_PARAMS*) param)->hashAlg != HashAlgo::shsm_SHA256 || + ((RSA_PKCS_PSS_PARAMS*) param)->mgf != AsymRSAMGF::MGF1_SHA256) + { + ERROR_MSG("Invalid parameters"); +@@ -386,11 +392,11 @@ bool OSSLRSA::signInit(PrivateKey* privateKey, const AsymMech::Type mechanism, + AsymmetricAlgorithm::signFinal(dummy); + return false; + } +- hash1 = HashAlgo::SHA256; ++ hash1 = HashAlgo::shsm_SHA256; + break; + case AsymMech::RSA_SHA384_PKCS_PSS: + if (param == NULL || paramLen != sizeof(RSA_PKCS_PSS_PARAMS) || +- ((RSA_PKCS_PSS_PARAMS*) param)->hashAlg != HashAlgo::SHA384 || ++ ((RSA_PKCS_PSS_PARAMS*) param)->hashAlg != HashAlgo::shsm_SHA384 || + ((RSA_PKCS_PSS_PARAMS*) param)->mgf != AsymRSAMGF::MGF1_SHA384) + { + ERROR_MSG("Invalid parameters"); +@@ -407,11 +413,11 @@ bool OSSLRSA::signInit(PrivateKey* privateKey, const AsymMech::Type mechanism, + AsymmetricAlgorithm::signFinal(dummy); + return false; + } +- hash1 = HashAlgo::SHA384; ++ hash1 = HashAlgo::shsm_SHA384; + break; + case AsymMech::RSA_SHA512_PKCS_PSS: + if (param == NULL || paramLen != sizeof(RSA_PKCS_PSS_PARAMS) || +- ((RSA_PKCS_PSS_PARAMS*) param)->hashAlg != HashAlgo::SHA512 || ++ ((RSA_PKCS_PSS_PARAMS*) param)->hashAlg != HashAlgo::shsm_SHA512 || + ((RSA_PKCS_PSS_PARAMS*) param)->mgf != AsymRSAMGF::MGF1_SHA512) + { + ERROR_MSG("Invalid parameters"); +@@ -428,11 +434,11 @@ bool OSSLRSA::signInit(PrivateKey* privateKey, const AsymMech::Type mechanism, + AsymmetricAlgorithm::signFinal(dummy); + return false; + } +- hash1 = HashAlgo::SHA512; ++ hash1 = HashAlgo::shsm_SHA512; + break; + case AsymMech::RSA_SSL: +- hash1 = HashAlgo::MD5; +- hash2 = HashAlgo::SHA1; ++ hash1 = HashAlgo::shsm_MD5; ++ hash2 = HashAlgo::shsm_SHA1; + break; + default: + ERROR_MSG("Invalid mechanism supplied (%i)", mechanism); +@@ -459,7 +465,7 @@ bool OSSLRSA::signInit(PrivateKey* privateKey, const AsymMech::Type mechanism, + return false; + } + +- if (hash2 != HashAlgo::Unknown) ++ if (hash2 != HashAlgo::shsm_Unknown) + { + pSecondHash = CryptoFactory::i()->getHashAlgorithm(hash2); + +@@ -600,9 +606,11 @@ bool OSSLRSA::signFinal(ByteString& signature) + isPSS = true; + hash = EVP_sha512(); + break; ++#ifndef WITH_WOLFSSL + case AsymMech::RSA_SSL: + type = NID_md5_sha1; + break; ++#endif + default: + break; + } +@@ -665,7 +673,9 @@ bool OSSLRSA::signFinal(ByteString& signature) + } + } + ++#ifndef WITH_WOLFSSL + RSA_blinding_off(rsa); ++#endif + + signature.resize(sigLen); + +@@ -757,23 +767,23 @@ bool OSSLRSA::verify(PublicKey* publicKey, const ByteString& originalData, + + switch (pssParam->hashAlg) + { +- case HashAlgo::SHA1: ++ case HashAlgo::shsm_SHA1: + hash = EVP_sha1(); + allowedLen = 20; + break; +- case HashAlgo::SHA224: ++ case HashAlgo::shsm_SHA224: + hash = EVP_sha224(); + allowedLen = 28; + break; +- case HashAlgo::SHA256: ++ case HashAlgo::shsm_SHA256: + hash = EVP_sha256(); + allowedLen = 32; + break; +- case HashAlgo::SHA384: ++ case HashAlgo::shsm_SHA384: + hash = EVP_sha384(); + allowedLen = 48; + break; +- case HashAlgo::SHA512: ++ case HashAlgo::shsm_SHA512: + hash = EVP_sha512(); + allowedLen = 64; + break; +@@ -859,32 +869,32 @@ bool OSSLRSA::verifyInit(PublicKey* publicKey, const AsymMech::Type mechanism, + return false; + } + +- HashAlgo::Type hash1 = HashAlgo::Unknown; +- HashAlgo::Type hash2 = HashAlgo::Unknown; ++ HashAlgo::shsm_Type hash1 = HashAlgo::shsm_Unknown; ++ HashAlgo::shsm_Type hash2 = HashAlgo::shsm_Unknown; + + switch (mechanism) + { + case AsymMech::RSA_MD5_PKCS: +- hash1 = HashAlgo::MD5; ++ hash1 = HashAlgo::shsm_MD5; + break; + case AsymMech::RSA_SHA1_PKCS: +- hash1 = HashAlgo::SHA1; ++ hash1 = HashAlgo::shsm_SHA1; + break; + case AsymMech::RSA_SHA224_PKCS: +- hash1 = HashAlgo::SHA224; ++ hash1 = HashAlgo::shsm_SHA224; + break; + case AsymMech::RSA_SHA256_PKCS: +- hash1 = HashAlgo::SHA256; ++ hash1 = HashAlgo::shsm_SHA256; + break; + case AsymMech::RSA_SHA384_PKCS: +- hash1 = HashAlgo::SHA384; ++ hash1 = HashAlgo::shsm_SHA384; + break; + case AsymMech::RSA_SHA512_PKCS: +- hash1 = HashAlgo::SHA512; ++ hash1 = HashAlgo::shsm_SHA512; + break; + case AsymMech::RSA_SHA1_PKCS_PSS: + if (param == NULL || paramLen != sizeof(RSA_PKCS_PSS_PARAMS) || +- ((RSA_PKCS_PSS_PARAMS*) param)->hashAlg != HashAlgo::SHA1 || ++ ((RSA_PKCS_PSS_PARAMS*) param)->hashAlg != HashAlgo::shsm_SHA1 || + ((RSA_PKCS_PSS_PARAMS*) param)->mgf != AsymRSAMGF::MGF1_SHA1) + { + ERROR_MSG("Invalid parameters"); +@@ -901,11 +911,11 @@ bool OSSLRSA::verifyInit(PublicKey* publicKey, const AsymMech::Type mechanism, + AsymmetricAlgorithm::verifyFinal(dummy); + return false; + } +- hash1 = HashAlgo::SHA1; ++ hash1 = HashAlgo::shsm_SHA1; + break; + case AsymMech::RSA_SHA224_PKCS_PSS: + if (param == NULL || paramLen != sizeof(RSA_PKCS_PSS_PARAMS) || +- ((RSA_PKCS_PSS_PARAMS*) param)->hashAlg != HashAlgo::SHA224 || ++ ((RSA_PKCS_PSS_PARAMS*) param)->hashAlg != HashAlgo::shsm_SHA224 || + ((RSA_PKCS_PSS_PARAMS*) param)->mgf != AsymRSAMGF::MGF1_SHA224) + { + ERROR_MSG("Invalid parameters"); +@@ -922,11 +932,11 @@ bool OSSLRSA::verifyInit(PublicKey* publicKey, const AsymMech::Type mechanism, + AsymmetricAlgorithm::verifyFinal(dummy); + return false; + } +- hash1 = HashAlgo::SHA224; ++ hash1 = HashAlgo::shsm_SHA224; + break; + case AsymMech::RSA_SHA256_PKCS_PSS: + if (param == NULL || paramLen != sizeof(RSA_PKCS_PSS_PARAMS) || +- ((RSA_PKCS_PSS_PARAMS*) param)->hashAlg != HashAlgo::SHA256 || ++ ((RSA_PKCS_PSS_PARAMS*) param)->hashAlg != HashAlgo::shsm_SHA256 || + ((RSA_PKCS_PSS_PARAMS*) param)->mgf != AsymRSAMGF::MGF1_SHA256) + { + ERROR_MSG("Invalid parameters"); +@@ -943,11 +953,11 @@ bool OSSLRSA::verifyInit(PublicKey* publicKey, const AsymMech::Type mechanism, + AsymmetricAlgorithm::verifyFinal(dummy); + return false; + } +- hash1 = HashAlgo::SHA256; ++ hash1 = HashAlgo::shsm_SHA256; + break; + case AsymMech::RSA_SHA384_PKCS_PSS: + if (param == NULL || paramLen != sizeof(RSA_PKCS_PSS_PARAMS) || +- ((RSA_PKCS_PSS_PARAMS*) param)->hashAlg != HashAlgo::SHA384 || ++ ((RSA_PKCS_PSS_PARAMS*) param)->hashAlg != HashAlgo::shsm_SHA384 || + ((RSA_PKCS_PSS_PARAMS*) param)->mgf != AsymRSAMGF::MGF1_SHA384) + { + ERROR_MSG("Invalid parameters"); +@@ -964,11 +974,11 @@ bool OSSLRSA::verifyInit(PublicKey* publicKey, const AsymMech::Type mechanism, + AsymmetricAlgorithm::verifyFinal(dummy); + return false; + } +- hash1 = HashAlgo::SHA384; ++ hash1 = HashAlgo::shsm_SHA384; + break; + case AsymMech::RSA_SHA512_PKCS_PSS: + if (param == NULL || paramLen != sizeof(RSA_PKCS_PSS_PARAMS) || +- ((RSA_PKCS_PSS_PARAMS*) param)->hashAlg != HashAlgo::SHA512 || ++ ((RSA_PKCS_PSS_PARAMS*) param)->hashAlg != HashAlgo::shsm_SHA512 || + ((RSA_PKCS_PSS_PARAMS*) param)->mgf != AsymRSAMGF::MGF1_SHA512) + { + ERROR_MSG("Invalid parameters"); +@@ -985,11 +995,11 @@ bool OSSLRSA::verifyInit(PublicKey* publicKey, const AsymMech::Type mechanism, + AsymmetricAlgorithm::verifyFinal(dummy); + return false; + } +- hash1 = HashAlgo::SHA512; ++ hash1 = HashAlgo::shsm_SHA512; + break; + case AsymMech::RSA_SSL: +- hash1 = HashAlgo::MD5; +- hash2 = HashAlgo::SHA1; ++ hash1 = HashAlgo::shsm_MD5; ++ hash2 = HashAlgo::shsm_SHA1; + break; + default: + ERROR_MSG("Invalid mechanism supplied (%i)", mechanism); +@@ -1016,7 +1026,7 @@ bool OSSLRSA::verifyInit(PublicKey* publicKey, const AsymMech::Type mechanism, + return false; + } + +- if (hash2 != HashAlgo::Unknown) ++ if (hash2 != HashAlgo::shsm_Unknown) + { + pSecondHash = CryptoFactory::i()->getHashAlgorithm(hash2); + +@@ -1154,9 +1164,11 @@ bool OSSLRSA::verifyFinal(const ByteString& signature) + isPSS = true; + hash = EVP_sha512(); + break; ++#ifndef WITH_WOLFSSL + case AsymMech::RSA_SSL: + type = NID_md5_sha1; + break; ++#endif + default: + break; + } +diff --git a/src/lib/crypto/OSSLRSAPrivateKey.cpp b/src/lib/crypto/OSSLRSAPrivateKey.cpp +index 26065cf..ee62a07 100644 +--- a/src/lib/crypto/OSSLRSAPrivateKey.cpp ++++ b/src/lib/crypto/OSSLRSAPrivateKey.cpp +@@ -288,6 +288,7 @@ void OSSLRSAPrivateKey::createOSSLKey() + return; + } + ++#ifndef WITH_WOLFSSL + // Use the OpenSSL implementation and not any engine + #if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER) + +@@ -302,6 +303,7 @@ void OSSLRSAPrivateKey::createOSSLKey() + + #else + RSA_set_method(rsa, RSA_PKCS1_OpenSSL()); ++#endif + #endif + + BIGNUM* bn_p = OSSL::byteString2bn(p); +diff --git a/src/lib/crypto/OSSLRSAPublicKey.cpp b/src/lib/crypto/OSSLRSAPublicKey.cpp +index 2a6893b..8145079 100644 +--- a/src/lib/crypto/OSSLRSAPublicKey.cpp ++++ b/src/lib/crypto/OSSLRSAPublicKey.cpp +@@ -132,6 +132,7 @@ void OSSLRSAPublicKey::createOSSLKey() + return; + } + ++#ifndef WITH_WOLFSSL + // Use the OpenSSL implementation and not any engine + #if OPENSSL_VERSION_NUMBER < 0x10100000L || defined(LIBRESSL_VERSION_NUMBER) + +@@ -146,6 +147,7 @@ void OSSLRSAPublicKey::createOSSLKey() + + #else + RSA_set_method(rsa, RSA_PKCS1_OpenSSL()); ++#endif + #endif + + BIGNUM* bn_n = OSSL::byteString2bn(n); +diff --git a/src/lib/crypto/SymmetricKey.cpp b/src/lib/crypto/SymmetricKey.cpp +index 182ce70..6e4f007 100644 +--- a/src/lib/crypto/SymmetricKey.cpp ++++ b/src/lib/crypto/SymmetricKey.cpp +@@ -66,7 +66,7 @@ ByteString SymmetricKey::getKeyCheckValue() const + { + ByteString digest; + +- HashAlgorithm* hash = CryptoFactory::i()->getHashAlgorithm(HashAlgo::SHA1); ++ HashAlgorithm* hash = CryptoFactory::i()->getHashAlgorithm(HashAlgo::shsm_SHA1); + if (hash == NULL) return digest; + + if (!hash->hashInit() || +diff --git a/src/lib/crypto/test/AESTests.cpp b/src/lib/crypto/test/AESTests.cpp +index 58d58af..41f29b5 100644 +--- a/src/lib/crypto/test/AESTests.cpp ++++ b/src/lib/crypto/test/AESTests.cpp +@@ -815,6 +815,7 @@ void AESTests::testGCM() + "10", + "61353B4C2806934A777FF51FA22A4755699B2A714FCDC6F83766E5F97B6C742373806900E49F24B22B097544D4896B424989B5E1EBAC0F07C23F45983612D2E79E3B0785561BE14AACA2FCCB" + }, ++#ifndef WITH_WOLFSSL /* wolfSSL doesn't support IV longer than block size */ + { + "FEFFE9928665731C6D6A8F9467308308", + "9313225DF88406E555909C5AFF5269AA6A7A9538534F7DA1E4C303D2A318A728C3C0C95156809539FCF0E2429A6B525416AEDBF5A0DE6A57A637B39B", +@@ -823,6 +824,7 @@ void AESTests::testGCM() + "10", + "8CE24998625615B603A033ACA13FB894BE9112A5C3A211A8BA262A3CCA7E2CA701E4A9A4FBA43C90CCDCB281D48C7C6FD62875D2ACA417034C34AEE5619CC5AEFFFE0BFA462AF43C1699D050" + }, ++#endif + { + "FEFFE9928665731C6D6A8F9467308308", + "CAFEBABEFACEDBAD", +@@ -831,6 +833,7 @@ void AESTests::testGCM() + "C", + "61353B4C2806934A777FF51FA22A4755699B2A714FCDC6F83766E5F97B6C742373806900E49F24B22B097544D4896B424989B5E1EBAC0F07C23F45983612D2E79E3B0785561BE14A" + }, ++#ifndef WITH_WOLFSSL /* wolfSSL doesn't support IV longer than block size */ + { + "FEFFE9928665731C6D6A8F9467308308", + "9313225DF88406E555909C5AFF5269AA6A7A9538534F7DA1E4C303D2A318A728C3C0C95156809539FCF0E2429A6B525416AEDBF5A0DE6A57A637B39B", +@@ -839,6 +842,7 @@ void AESTests::testGCM() + "C", + "8CE24998625615B603A033ACA13FB894BE9112A5C3A211A8BA262A3CCA7E2CA701E4A9A4FBA43C90CCDCB281D48C7C6FD62875D2ACA417034C34AEE5619CC5AEFFFE0BFA462AF43C" + } ++#endif + }; + + char test192[8][6][256] = +@@ -883,6 +887,7 @@ void AESTests::testGCM() + "10", + "0f10f599ae14a154ed24b36e25324db8c566632ef2bbb34f8347280fc4507057fddc29df9a471f75c66541d4d4dad1c9e93a19a58e8b473fa0f062f765dcc57fcf623a24094fcca40d3533f8" + }, ++#ifndef WITH_WOLFSSL /* wolfSSL doesn't support IV longer than block size */ + { + "feffe9928665731c6d6a8f9467308308feffe9928665731c", + "9313225df88406e555909c5aff5269aa6a7a9538534f7da1e4c303d2a318a728c3c0c95156809539fcf0e2429a6b525416aedbf5a0de6a57a637b39b", +@@ -891,6 +896,7 @@ void AESTests::testGCM() + "10", + "d27e88681ce3243c4830165a8fdcf9ff1de9a1d8e6b447ef6ef7b79828666e4581e79012af34ddd9e2f037589b292db3e67c036745fa22e7e9b7373bdcf566ff291c25bbb8568fc3d376a6d9" + }, ++#endif + { + "feffe9928665731c6d6a8f9467308308feffe9928665731c", + "cafebabefacedbaddecaf888", +@@ -951,6 +957,7 @@ void AESTests::testGCM() + "10", + "c3762df1ca787d32ae47c13bf19844cbaf1ae14d0b976afac52ff7d79bba9de0feb582d33934a4f0954cc2363bc73f7862ac430e64abe499f47c9b1f3a337dbf46a792c45e454913fe2ea8f2", + }, ++#ifndef WITH_WOLFSSL /* wolfSSL doesn't support IV longer than block size */ + { + "feffe9928665731c6d6a8f9467308308feffe9928665731c6d6a8f9467308308", + "9313225df88406e555909c5aff5269aa6a7a9538534f7da1e4c303d2a318a728c3c0c95156809539fcf0e2429a6b525416aedbf5a0de6a57a637b39b", +@@ -959,6 +966,7 @@ void AESTests::testGCM() + "10", + "5a8def2f0c9e53f1f75d7853659e2a20eeb2b22aafde6419a058ab4f6f746bf40fc0c3b780f244452da3ebf1c5d82cdea2418997200ef82e44ae7e3fa44a8266ee1c8eb0c8b5d4cf5ae9f19a" + }, ++#endif + { + "feffe9928665731c6d6a8f9467308308feffe9928665731c6d6a8f9467308308", + "cafebabefacedbaddecaf888", +@@ -977,7 +985,11 @@ void AESTests::testGCM() + } + }; + ++#ifndef WITH_WOLFSSL /* wolfSSL doesn't support IV longer than block size */ + for (int i = 0; i < 8; i++) ++#else ++ for (int i = 0; i < 6; i++) ++#endif + { + ByteString keyData128(test128[i][0]); + ByteString keyData192(test192[i][0]); +diff --git a/src/lib/crypto/test/DESTests.cpp b/src/lib/crypto/test/DESTests.cpp +index bcb1c6b..70aa6c7 100644 +--- a/src/lib/crypto/test/DESTests.cpp ++++ b/src/lib/crypto/test/DESTests.cpp +@@ -76,6 +76,7 @@ void DESTests::testCBC() + "0940278947239572" + }; + ++#ifndef WITH_WOLFSSL + char testKeys112[][33] = + { + "00000000000000000000000000000000", +@@ -84,6 +85,7 @@ void DESTests::testCBC() + "64398647034486943598534703463870", + "87406984068406984607412103517413" + }; ++#endif + #endif + + char testKeys168[][49] = +@@ -230,8 +232,10 @@ void DESTests::testCBC() + #ifndef WITH_FIPS + ByteString keyData56(testKeys56[i]); + CPPUNIT_ASSERT(keyData56.size() == 8); ++#ifndef WITH_WOLFSSL + ByteString keyData112(testKeys112[i]); + CPPUNIT_ASSERT(keyData112.size() == 16); ++#endif + #endif + ByteString keyData168(testKeys168[i]); + CPPUNIT_ASSERT(keyData168.size() == 24); +@@ -239,8 +243,10 @@ void DESTests::testCBC() + #ifndef WITH_FIPS + DESKey desKey56(56); + CPPUNIT_ASSERT(desKey56.setKeyBits(keyData56)); ++#ifndef WITH_WOLFSSL + DESKey desKey112(112); + CPPUNIT_ASSERT(desKey112.setKeyBits(keyData112)); ++#endif + #endif + DESKey desKey168(168); + CPPUNIT_ASSERT(desKey168.setKeyBits(keyData168)); +@@ -281,6 +287,7 @@ void DESTests::testCBC() + + CPPUNIT_ASSERT(shsmPlainText == plainText); + ++#ifndef WITH_WOLFSSL + // Test 112-bit key + cipherText = ByteString(testResult[i][j][1]); + +@@ -307,6 +314,7 @@ void DESTests::testCBC() + shsmPlainText += OB; + + CPPUNIT_ASSERT(shsmPlainText == plainText); ++#endif + #endif + + // Test 168-bit key +@@ -351,6 +359,7 @@ void DESTests::testECB() + "0940278947239572" + }; + ++#ifndef WITH_WOLFSSL + char testKeys112[][33] = + { + "00000000000000000000000000000000", +@@ -359,6 +368,7 @@ void DESTests::testECB() + "64398647034486943598534703463870", + "87406984068406984607412103517413" + }; ++#endif + #endif + + char testKeys168[][49] = +@@ -505,8 +515,10 @@ void DESTests::testECB() + #ifndef WITH_FIPS + ByteString keyData56(testKeys56[i]); + CPPUNIT_ASSERT(keyData56.size() == 8); ++#ifndef WITH_WOLFSSL + ByteString keyData112(testKeys112[i]); + CPPUNIT_ASSERT(keyData112.size() == 16); ++#endif + #endif + ByteString keyData168(testKeys168[i]); + CPPUNIT_ASSERT(keyData168.size() == 24); +@@ -514,8 +526,10 @@ void DESTests::testECB() + #ifndef WITH_FIPS + DESKey desKey56(56); + CPPUNIT_ASSERT(desKey56.setKeyBits(keyData56)); ++#ifndef WITH_WOLFSSL + DESKey desKey112(112); + CPPUNIT_ASSERT(desKey112.setKeyBits(keyData112)); ++#endif + #endif + DESKey desKey168(168); + CPPUNIT_ASSERT(desKey168.setKeyBits(keyData168)); +@@ -556,6 +570,7 @@ void DESTests::testECB() + + CPPUNIT_ASSERT(shsmPlainText == plainText); + ++#ifndef WITH_WOLFSSL + // Test 112-bit key + cipherText = ByteString(testResult[i][j][1]); + +@@ -582,6 +597,7 @@ void DESTests::testECB() + shsmPlainText += OB; + + CPPUNIT_ASSERT(shsmPlainText == plainText); ++#endif + #endif + + // Test 168-bit key +@@ -614,6 +630,7 @@ void DESTests::testECB() + } + } + ++#ifndef WITH_WOLFSSL + void DESTests::testOFB() + { + #ifndef WITH_FIPS +@@ -626,6 +643,7 @@ void DESTests::testOFB() + "0940278947239572" + }; + ++#ifndef WITH_WOLFSSL + char testKeys112[][33] = + { + "00000000000000000000000000000000", +@@ -634,6 +652,7 @@ void DESTests::testOFB() + "64398647034486943598534703463870", + "87406984068406984607412103517413" + }; ++#endif + #endif + + char testKeys168[][49] = +@@ -780,8 +799,10 @@ void DESTests::testOFB() + #ifndef WITH_FIPS + ByteString keyData56(testKeys56[i]); + CPPUNIT_ASSERT(keyData56.size() == 8); ++#ifndef WITH_WOLFSSL + ByteString keyData112(testKeys112[i]); + CPPUNIT_ASSERT(keyData112.size() == 16); ++#endif + #endif + ByteString keyData168(testKeys168[i]); + CPPUNIT_ASSERT(keyData168.size() == 24); +@@ -789,8 +810,10 @@ void DESTests::testOFB() + #ifndef WITH_FIPS + DESKey desKey56(56); + CPPUNIT_ASSERT(desKey56.setKeyBits(keyData56)); ++#ifndef WITH_WOLFSSL + DESKey desKey112(112); + CPPUNIT_ASSERT(desKey112.setKeyBits(keyData112)); ++#endif + #endif + DESKey desKey168(168); + CPPUNIT_ASSERT(desKey168.setKeyBits(keyData168)); +@@ -831,6 +854,7 @@ void DESTests::testOFB() + + CPPUNIT_ASSERT(shsmPlainText == plainText); + ++#ifndef WITH_WOLFSSL + // Test 112-bit key + cipherText = ByteString(testResult[i][j][1]); + +@@ -857,6 +881,7 @@ void DESTests::testOFB() + shsmPlainText += OB; + + CPPUNIT_ASSERT(shsmPlainText == plainText); ++#endif + #endif + + // Test 168-bit key +@@ -901,6 +926,7 @@ void DESTests::testCFB() + "0940278947239572" + }; + ++#ifndef WITH_WOLFSSL + char testKeys112[][33] = + { + "00000000000000000000000000000000", +@@ -909,6 +935,7 @@ void DESTests::testCFB() + "64398647034486943598534703463870", + "87406984068406984607412103517413" + }; ++#endif + #endif + + char testKeys168[][49] = +@@ -1054,8 +1081,10 @@ void DESTests::testCFB() + #ifndef WITH_FIPS + ByteString keyData56(testKeys56[i]); + CPPUNIT_ASSERT(keyData56.size() == 8); ++#ifndef WITH_WOLFSSL + ByteString keyData112(testKeys112[i]); + CPPUNIT_ASSERT(keyData112.size() == 16); ++#endif + #endif + ByteString keyData168(testKeys168[i]); + CPPUNIT_ASSERT(keyData168.size() == 24); +@@ -1063,8 +1092,10 @@ void DESTests::testCFB() + #ifndef WITH_FIPS + DESKey desKey56(56); + CPPUNIT_ASSERT(desKey56.setKeyBits(keyData56)); ++#ifndef WITH_WOLFSSL + DESKey desKey112(112); + CPPUNIT_ASSERT(desKey112.setKeyBits(keyData112)); ++#endif + #endif + DESKey desKey168(168); + CPPUNIT_ASSERT(desKey168.setKeyBits(keyData168)); +@@ -1105,6 +1136,7 @@ void DESTests::testCFB() + + CPPUNIT_ASSERT(shsmPlainText == plainText); + ++#ifndef WITH_WOLFSSL + // Test 112-bit key + cipherText = ByteString(testResult[i][j][1]); + +@@ -1131,6 +1163,7 @@ void DESTests::testCFB() + shsmPlainText += OB; + + CPPUNIT_ASSERT(shsmPlainText == plainText); ++#endif + #endif + + // Test 168-bit key +@@ -1162,3 +1195,4 @@ void DESTests::testCFB() + } + } + } ++#endif +diff --git a/src/lib/crypto/test/DESTests.h b/src/lib/crypto/test/DESTests.h +index 0834462..fc119fa 100644 +--- a/src/lib/crypto/test/DESTests.h ++++ b/src/lib/crypto/test/DESTests.h +@@ -42,8 +42,10 @@ class DESTests : public CppUnit::TestFixture + CPPUNIT_TEST(testBlockSize); + CPPUNIT_TEST(testCBC); + CPPUNIT_TEST(testECB); ++#ifndef WITH_WOLFSSL + CPPUNIT_TEST(testOFB); + CPPUNIT_TEST(testCFB); ++#endif + CPPUNIT_TEST_SUITE_END(); + + public: +diff --git a/src/lib/crypto/test/DHTests.cpp b/src/lib/crypto/test/DHTests.cpp +index 354cdac..a9ba2ac 100644 +--- a/src/lib/crypto/test/DHTests.cpp ++++ b/src/lib/crypto/test/DHTests.cpp +@@ -97,7 +97,12 @@ void DHTests::testKeyGeneration() + + priv = (DHPrivateKey*) kp->getPrivateKey(); + ++#ifndef WITH_WOLFSSL + CPPUNIT_ASSERT(priv->getX().bits() == 128); ++#else ++ /* wolfSSL rounds up the desired length */ ++ CPPUNIT_ASSERT(priv->getX().bits() > 160 && priv->getX().bits() < 170); ++#endif + + dh->recycleParameters(p); + dh->recycleKeyPair(kp); +diff --git a/src/lib/crypto/test/DSATests.cpp b/src/lib/crypto/test/DSATests.cpp +index 80f2514..342e13b 100644 +--- a/src/lib/crypto/test/DSATests.cpp ++++ b/src/lib/crypto/test/DSATests.cpp +@@ -72,7 +72,9 @@ void DSATests::testKeyGeneration() + std::vector keySizes; + #ifndef WITH_FIPS + keySizes.push_back(1024); ++#ifndef WITH_WOLFSSL + keySizes.push_back(1536); ++#endif + #else + keySizes.push_back(1024); + #endif +@@ -205,7 +207,9 @@ void DSATests::testSigningVerifying() + std::vector keySizes; + #ifndef WITH_FIPS + keySizes.push_back(1024); ++#ifndef WITH_WOLFSSL + keySizes.push_back(1536); ++#endif + #else + keySizes.push_back(1024); + #endif +diff --git a/src/lib/crypto/test/ECDSATests.cpp b/src/lib/crypto/test/ECDSATests.cpp +index 3c29d06..74990d4 100644 +--- a/src/lib/crypto/test/ECDSATests.cpp ++++ b/src/lib/crypto/test/ECDSATests.cpp +@@ -189,15 +189,15 @@ void ECDSATests::testSigningVerifying() + ECParameters *p; + + // Curves/Hashes to test +- std::vector > totest; ++ std::vector > totest; + // Add X9.62 prime256v1 +- totest.push_back(std::make_pair(ByteString("06082a8648ce3d030107"), HashAlgo::SHA256)); ++ totest.push_back(std::make_pair(ByteString("06082a8648ce3d030107"), HashAlgo::shsm_SHA256)); + // Add secp384r1 +- totest.push_back(std::make_pair(ByteString("06052b81040022"), HashAlgo::SHA384)); ++ totest.push_back(std::make_pair(ByteString("06052b81040022"), HashAlgo::shsm_SHA384)); + // Add secp521r1 +- totest.push_back(std::make_pair(ByteString("06052b81040023"), HashAlgo::SHA384)); ++ totest.push_back(std::make_pair(ByteString("06052b81040023"), HashAlgo::shsm_SHA384)); + +- for (std::vector >::iterator k = totest.begin(); k != totest.end(); k++) ++ for (std::vector >::iterator k = totest.begin(); k != totest.end(); k++) + { + // Get parameters + p = new ECParameters; +@@ -241,8 +241,8 @@ void ECDSATests::testSignVerifyKnownVector() + ECPublicKey* pubKey2 = (ECPublicKey*) ecdsa->newPublicKey(); + ECPrivateKey* privKey1 = (ECPrivateKey*) ecdsa->newPrivateKey(); + ECPrivateKey* privKey2 = (ECPrivateKey*) ecdsa->newPrivateKey(); +- HashAlgorithm* hash1 = CryptoFactory::i()->getHashAlgorithm(HashAlgo::SHA256); +- HashAlgorithm* hash2 = CryptoFactory::i()->getHashAlgorithm(HashAlgo::SHA384); ++ HashAlgorithm* hash1 = CryptoFactory::i()->getHashAlgorithm(HashAlgo::shsm_SHA256); ++ HashAlgorithm* hash2 = CryptoFactory::i()->getHashAlgorithm(HashAlgo::shsm_SHA384); + + // Reconstruct public and private key #1 + ByteString ec1 = "06082a8648ce3d030107"; // X9.62 prime256v1 +diff --git a/src/lib/crypto/test/GOSTTests.cpp b/src/lib/crypto/test/GOSTTests.cpp +index 50d42e0..2c3bb5f 100644 +--- a/src/lib/crypto/test/GOSTTests.cpp ++++ b/src/lib/crypto/test/GOSTTests.cpp +@@ -86,7 +86,7 @@ void GOSTTests::testHash() + char testResult[512] = "3EC65819A084AD30712C4B3EB69CE130A8C7221EA3D8A9996D4BA6F298BC39F9"; + + // Get a GOST R 34.11-94 hash instance +- CPPUNIT_ASSERT((hash = CryptoFactory::i()->getHashAlgorithm(HashAlgo::GOST)) != NULL); ++ CPPUNIT_ASSERT((hash = CryptoFactory::i()->getHashAlgorithm(HashAlgo::shsm_GOST)) != NULL); + + ByteString b(testData); + ByteString osslHash(testResult), gostHash; +@@ -175,7 +175,7 @@ void GOSTTests::testHmac() + + void GOSTTests::testHashKnownVector() + { +- CPPUNIT_ASSERT((hash = CryptoFactory::i()->getHashAlgorithm(HashAlgo::GOST)) != NULL); ++ CPPUNIT_ASSERT((hash = CryptoFactory::i()->getHashAlgorithm(HashAlgo::shsm_GOST)) != NULL); + + // Message to hash for test #1 + ByteString msg = "6d65737361676520646967657374"; // "message digest" +diff --git a/src/lib/crypto/test/HashTests.cpp b/src/lib/crypto/test/HashTests.cpp +index f02adbc..17a0837 100644 +--- a/src/lib/crypto/test/HashTests.cpp ++++ b/src/lib/crypto/test/HashTests.cpp +@@ -63,7 +63,7 @@ void HashTests::testMD5() + char testResult[512] = "7299FE513582D71A3B9EA1E9F45F95FD"; + + // Get a MD5 hash instance +- CPPUNIT_ASSERT((hash = CryptoFactory::i()->getHashAlgorithm(HashAlgo::MD5)) != NULL); ++ CPPUNIT_ASSERT((hash = CryptoFactory::i()->getHashAlgorithm(HashAlgo::shsm_MD5)) != NULL); + + ByteString b(testData); + ByteString osslHash(testResult), shsmHash; +@@ -99,7 +99,7 @@ void HashTests::testSHA1() + char testResult[512] = "9A5BD96DC0CD3B0089FBB6BE7D56BEE638431F5A"; + + // Get a SHA1 hash instance +- CPPUNIT_ASSERT((hash = CryptoFactory::i()->getHashAlgorithm(HashAlgo::SHA1)) != NULL); ++ CPPUNIT_ASSERT((hash = CryptoFactory::i()->getHashAlgorithm(HashAlgo::shsm_SHA1)) != NULL); + + ByteString b(testData); + ByteString osslHash(testResult), shsmHash; +@@ -134,7 +134,7 @@ void HashTests::testSHA224() + char testResult[512] = "A4E71A239CED53E936011DF80B516A07DFF13BB5B05BE43C46C05CCD"; + + // Get a SHA224 hash instance +- CPPUNIT_ASSERT((hash = CryptoFactory::i()->getHashAlgorithm(HashAlgo::SHA224)) != NULL); ++ CPPUNIT_ASSERT((hash = CryptoFactory::i()->getHashAlgorithm(HashAlgo::shsm_SHA224)) != NULL); + + ByteString b(testData); + ByteString osslHash(testResult), shsmHash; +@@ -169,7 +169,7 @@ void HashTests::testSHA256() + char testResult[512] = "3902802C215A5271439FE3E81AC7F21DA55545F71193A8DA8BEB0EAC8046A43B"; + + // Get a SHA256 hash instance +- CPPUNIT_ASSERT((hash = CryptoFactory::i()->getHashAlgorithm(HashAlgo::SHA256)) != NULL); ++ CPPUNIT_ASSERT((hash = CryptoFactory::i()->getHashAlgorithm(HashAlgo::shsm_SHA256)) != NULL); + + ByteString b(testData); + ByteString osslHash(testResult), shsmHash; +@@ -204,7 +204,7 @@ void HashTests::testSHA384() + char testResult[512] = "753659D55E4198325A3FED0A35761EC45038E8963B7525BF00D5A6A5D904DD9FA3FC80AB020185E08B14992ECC36A744"; + + // Get a SHA384 hash instance +- CPPUNIT_ASSERT((hash = CryptoFactory::i()->getHashAlgorithm(HashAlgo::SHA384)) != NULL); ++ CPPUNIT_ASSERT((hash = CryptoFactory::i()->getHashAlgorithm(HashAlgo::shsm_SHA384)) != NULL); + + ByteString b(testData); + ByteString osslHash(testResult), shsmHash; +@@ -239,7 +239,7 @@ void HashTests::testSHA512() + char testResult[512] = "E1483A8525CE39705D14D60D8B19BD89087AED5FE6D8913AF8FC3F6F4EA2C1BB5957E205294B1EFAF20AE5EE39A9522F38B4514C3C15ED70BCBBD5821E385F95"; + + // Get a SHA512 hash instance +- CPPUNIT_ASSERT((hash = CryptoFactory::i()->getHashAlgorithm(HashAlgo::SHA512)) != NULL); ++ CPPUNIT_ASSERT((hash = CryptoFactory::i()->getHashAlgorithm(HashAlgo::shsm_SHA512)) != NULL); + + ByteString b(testData); + ByteString osslHash(testResult), shsmHash; +diff --git a/src/lib/crypto/test/MacTests.cpp b/src/lib/crypto/test/MacTests.cpp +index 8a3db1e..5e3cefc 100644 +--- a/src/lib/crypto/test/MacTests.cpp ++++ b/src/lib/crypto/test/MacTests.cpp +@@ -316,6 +316,7 @@ void MacTests::testHMACSHA512() + rng = NULL; + } + ++#ifndef WITH_WOLFSSL + void MacTests::testCMACDES2() + { + // Test vectors from NIST SP 800-38B +@@ -463,6 +464,7 @@ void MacTests::testCMACDES3() + mac = NULL; + rng = NULL; + } ++#endif + + void MacTests::testCMACAES128() + { +diff --git a/src/lib/crypto/test/MacTests.h b/src/lib/crypto/test/MacTests.h +index 9e6fa99..54be803 100644 +--- a/src/lib/crypto/test/MacTests.h ++++ b/src/lib/crypto/test/MacTests.h +@@ -48,8 +48,10 @@ class MacTests : public CppUnit::TestFixture + CPPUNIT_TEST(testHMACSHA256); + CPPUNIT_TEST(testHMACSHA384); + CPPUNIT_TEST(testHMACSHA512); ++#ifndef WITH_WOLFSSL + CPPUNIT_TEST(testCMACDES2); + CPPUNIT_TEST(testCMACDES3); ++#endif + CPPUNIT_TEST(testCMACAES128); + CPPUNIT_TEST(testCMACAES192); + CPPUNIT_TEST(testCMACAES256); +@@ -64,8 +66,10 @@ public: + void testHMACSHA256(); + void testHMACSHA384(); + void testHMACSHA512(); ++#ifndef WITH_WOLFSSL + void testCMACDES2(); + void testCMACDES3(); ++#endif + void testCMACAES128(); + void testCMACAES192(); + void testCMACAES256(); +diff --git a/src/lib/crypto/test/RSATests.cpp b/src/lib/crypto/test/RSATests.cpp +index 6af1e19..47b8d7e 100644 +--- a/src/lib/crypto/test/RSATests.cpp ++++ b/src/lib/crypto/test/RSATests.cpp +@@ -79,10 +79,12 @@ void RSATests::testKeyGeneration() + // Key sizes to test + std::vector keySizes; + keySizes.push_back(1024); ++#ifndef WITH_WOLFSSL + #ifndef WITH_FIPS + keySizes.push_back(1025); + #endif + keySizes.push_back(1280); ++#endif + keySizes.push_back(2048); + //keySizes.push_back(4096); + +@@ -273,17 +275,17 @@ void RSATests::testSigningVerifying() + mechanisms.push_back(AsymMech::RSA_SHA256_PKCS_PSS); + mechanisms.push_back(AsymMech::RSA_SHA384_PKCS_PSS); + mechanisms.push_back(AsymMech::RSA_SHA512_PKCS_PSS); +-#ifndef WITH_FIPS ++#if !defined(WITH_FIPS) && !defined(WITH_WOLFSSL) + mechanisms.push_back(AsymMech::RSA_SSL); + #endif + + /* Max salt length for SHA512 and 1024-bit RSA is 62 bytes */ + RSA_PKCS_PSS_PARAMS pssParams[] = { +- { HashAlgo::SHA1, AsymRSAMGF::MGF1_SHA1, 20 }, +- { HashAlgo::SHA224, AsymRSAMGF::MGF1_SHA224, 0 }, +- { HashAlgo::SHA256, AsymRSAMGF::MGF1_SHA256, 0 }, +- { HashAlgo::SHA384, AsymRSAMGF::MGF1_SHA384, 48 }, +- { HashAlgo::SHA512, AsymRSAMGF::MGF1_SHA512, 62 } ++ { HashAlgo::shsm_SHA1, AsymRSAMGF::MGF1_SHA1, 20 }, ++ { HashAlgo::shsm_SHA224, AsymRSAMGF::MGF1_SHA224, 0 }, ++ { HashAlgo::shsm_SHA256, AsymRSAMGF::MGF1_SHA256, 0 }, ++ { HashAlgo::shsm_SHA384, AsymRSAMGF::MGF1_SHA384, 48 }, ++ { HashAlgo::shsm_SHA512, AsymRSAMGF::MGF1_SHA512, 62 } + }; + + for (std::vector::iterator e = exponents.begin(); e != exponents.end(); e++) +@@ -581,7 +583,7 @@ void RSATests::testSignVerifyKnownVector() + + CPPUNIT_ASSERT(rsa->verifyInit(pubKey3, AsymMech::RSA_SHA1_PKCS)); + CPPUNIT_ASSERT(rsa->verifyUpdate(dataToSign3)); +- CPPUNIT_ASSERT(rsa->verifyFinal(expectedSignature3)); ++ CPPUNIT_ASSERT(rsa->verifyFinal(signature3)); + + #ifndef WITH_FIPS + rsa->recyclePublicKey(pubKey1); +diff --git a/src/lib/data_mgr/RFC4880.cpp b/src/lib/data_mgr/RFC4880.cpp +index 9ea23bd..880da86 100644 +--- a/src/lib/data_mgr/RFC4880.cpp ++++ b/src/lib/data_mgr/RFC4880.cpp +@@ -58,7 +58,7 @@ bool RFC4880::PBEDeriveKey(const ByteString& password, ByteString& salt, AESKey* + unsigned int iter = PBE_ITERATION_BASE_COUNT + salt[salt.size() - 1]; + + // Get a hash instance +- HashAlgorithm* hash = CryptoFactory::i()->getHashAlgorithm(HashAlgo::SHA256); ++ HashAlgorithm* hash = CryptoFactory::i()->getHashAlgorithm(HashAlgo::shsm_SHA256); + + if (hash == NULL) + { +diff --git a/src/lib/session_mgr/Session.cpp b/src/lib/session_mgr/Session.cpp +index 5db36fd..4569964 100644 +--- a/src/lib/session_mgr/Session.cpp ++++ b/src/lib/session_mgr/Session.cpp +@@ -45,7 +45,7 @@ Session::Session(Slot* inSlot, bool inIsReadWrite, CK_VOID_PTR inPApplication, C + operation = SESSION_OP_NONE; + findOp = NULL; + digestOp = NULL; +- hashAlgo = HashAlgo::Unknown; ++ hashAlgo = HashAlgo::shsm_Unknown; + macOp = NULL; + asymmetricCryptoOp = NULL; + symmetricCryptoOp = NULL; +@@ -72,7 +72,7 @@ Session::Session() + operation = SESSION_OP_NONE; + findOp = NULL; + digestOp = NULL; +- hashAlgo = HashAlgo::Unknown; ++ hashAlgo = HashAlgo::shsm_Unknown; + macOp = NULL; + asymmetricCryptoOp = NULL; + symmetricCryptoOp = NULL; +@@ -271,12 +271,12 @@ HashAlgorithm* Session::getDigestOp() + return digestOp; + } + +-void Session::setHashAlgo(HashAlgo::Type inHashAlgo) ++void Session::setHashAlgo(HashAlgo::shsm_Type inHashAlgo) + { + hashAlgo = inHashAlgo; + } + +-HashAlgo::Type Session::getHashAlgo() ++HashAlgo::shsm_Type Session::getHashAlgo() + { + return hashAlgo; + } +diff --git a/src/lib/session_mgr/Session.h b/src/lib/session_mgr/Session.h +index 142aaa5..8cce237 100644 +--- a/src/lib/session_mgr/Session.h ++++ b/src/lib/session_mgr/Session.h +@@ -85,8 +85,8 @@ public: + // Digest + void setDigestOp(HashAlgorithm* inDigestOp); + HashAlgorithm* getDigestOp(); +- void setHashAlgo(HashAlgo::Type inHashAlgo); +- HashAlgo::Type getHashAlgo(); ++ void setHashAlgo(HashAlgo::shsm_Type inHashAlgo); ++ HashAlgo::shsm_Type getHashAlgo(); + + // Mac + void setMacOp(MacAlgorithm* inMacOp); +@@ -148,7 +148,7 @@ private: + + // Digest + HashAlgorithm* digestOp; +- HashAlgo::Type hashAlgo; ++ HashAlgo::shsm_Type hashAlgo; + + // Mac + MacAlgorithm* macOp; +diff --git a/src/lib/test/AsymWrapUnwrapTests.cpp b/src/lib/test/AsymWrapUnwrapTests.cpp +index 917747b..b90ad2e 100644 +--- a/src/lib/test/AsymWrapUnwrapTests.cpp ++++ b/src/lib/test/AsymWrapUnwrapTests.cpp +@@ -312,7 +312,9 @@ void AsymWrapUnwrapTests::testRsaWrapUnwrap() + + rsaWrapUnwrap(CKM_RSA_PKCS,hSessionRO,hPublicKey,hPrivateKey); + rsaWrapUnwrap(CKM_RSA_PKCS_OAEP,hSessionRO,hPublicKey,hPrivateKey); ++#ifdef HAVE_AES_KEY_WRAP_PAD /* CKM_RSA_AES_KEY_WRAP needs CKM_AES_KEY_WRAP_PAD */ + rsaWrapUnwrap(CKM_RSA_AES_KEY_WRAP, hSessionRO, hPublicKey, hPrivateKey); ++#endif + + // Private Session Keys + rv = generateRsaKeyPair(hSessionRW, IN_SESSION, IS_PRIVATE, IN_SESSION, IS_PRIVATE, hPublicKey, hPrivateKey); +@@ -320,7 +322,9 @@ void AsymWrapUnwrapTests::testRsaWrapUnwrap() + + rsaWrapUnwrap(CKM_RSA_PKCS,hSessionRO,hPublicKey,hPrivateKey); + rsaWrapUnwrap(CKM_RSA_PKCS_OAEP,hSessionRO,hPublicKey,hPrivateKey); ++#ifdef HAVE_AES_KEY_WRAP_PAD /* CKM_RSA_AES_KEY_WRAP needs CKM_AES_KEY_WRAP_PAD */ + rsaWrapUnwrap(CKM_RSA_AES_KEY_WRAP, hSessionRO, hPublicKey, hPrivateKey); ++#endif + + // Public Token Keys + rv = generateRsaKeyPair(hSessionRW, ON_TOKEN, IS_PUBLIC, ON_TOKEN, IS_PUBLIC, hPublicKey, hPrivateKey); +@@ -328,7 +332,9 @@ void AsymWrapUnwrapTests::testRsaWrapUnwrap() + + rsaWrapUnwrap(CKM_RSA_PKCS,hSessionRO,hPublicKey,hPrivateKey); + rsaWrapUnwrap(CKM_RSA_PKCS_OAEP,hSessionRO,hPublicKey,hPrivateKey); ++#ifdef HAVE_AES_KEY_WRAP_PAD /* CKM_RSA_AES_KEY_WRAP needs CKM_AES_KEY_WRAP_PAD */ + rsaWrapUnwrap(CKM_RSA_AES_KEY_WRAP, hSessionRO, hPublicKey, hPrivateKey); ++#endif + + // Private Token Keys + rv = generateRsaKeyPair(hSessionRW, ON_TOKEN, IS_PRIVATE, ON_TOKEN, IS_PRIVATE, hPublicKey, hPrivateKey); +@@ -336,5 +342,7 @@ void AsymWrapUnwrapTests::testRsaWrapUnwrap() + + rsaWrapUnwrap(CKM_RSA_PKCS,hSessionRO,hPublicKey,hPrivateKey); + rsaWrapUnwrap(CKM_RSA_PKCS_OAEP,hSessionRO,hPublicKey,hPrivateKey); ++#ifdef HAVE_AES_KEY_WRAP_PAD /* CKM_RSA_AES_KEY_WRAP needs CKM_AES_KEY_WRAP_PAD */ + rsaWrapUnwrap(CKM_RSA_AES_KEY_WRAP, hSessionRO, hPublicKey, hPrivateKey); ++#endif + } +diff --git a/src/lib/test/DeriveTests.cpp b/src/lib/test/DeriveTests.cpp +index 9438ac2..94d6a46 100644 +--- a/src/lib/test/DeriveTests.cpp ++++ b/src/lib/test/DeriveTests.cpp +@@ -814,15 +814,19 @@ void DeriveTests::testSymDerive() + #ifndef WITH_FIPS + CK_OBJECT_HANDLE hKeyDes = CK_INVALID_HANDLE; + #endif ++#ifndef WITH_WOLFSSL + CK_OBJECT_HANDLE hKeyDes2 = CK_INVALID_HANDLE; ++#endif + CK_OBJECT_HANDLE hKeyDes3 = CK_INVALID_HANDLE; + CK_OBJECT_HANDLE hKeyAes = CK_INVALID_HANDLE; + #ifndef WITH_FIPS + rv = generateDesKey(hSessionRW,IN_SESSION,IS_PUBLIC,hKeyDes); + CPPUNIT_ASSERT(rv == CKR_OK); + #endif ++#ifndef WITH_WOLFSSL /* wolfSSL doesn't support 2-key triple DES */ + rv = generateDes2Key(hSessionRW,IN_SESSION,IS_PUBLIC,hKeyDes2); + CPPUNIT_ASSERT(rv == CKR_OK); ++#endif + rv = generateDes3Key(hSessionRW,IN_SESSION,IS_PUBLIC,hKeyDes3); + CPPUNIT_ASSERT(rv == CKR_OK); + rv = generateAesKey(hSessionRW,IN_SESSION,IS_PUBLIC,hKeyAes); +@@ -833,10 +837,13 @@ void DeriveTests::testSymDerive() + #ifndef WITH_FIPS + symDerive(hSessionRW,hKeyDes,hDerive,CKM_DES_ECB_ENCRYPT_DATA,CKK_GENERIC_SECRET); + symDerive(hSessionRW,hKeyDes,hDerive,CKM_DES_ECB_ENCRYPT_DATA,CKK_DES); ++#ifndef WITH_WOLFSSL /* wolfSSL doesn't support 2-key triple DES */ + symDerive(hSessionRW,hKeyDes,hDerive,CKM_DES_ECB_ENCRYPT_DATA,CKK_DES2); ++#endif + symDerive(hSessionRW,hKeyDes,hDerive,CKM_DES_ECB_ENCRYPT_DATA,CKK_DES3); + symDerive(hSessionRW,hKeyDes,hDerive,CKM_DES_ECB_ENCRYPT_DATA,CKK_AES); + #endif ++#ifndef WITH_WOLFSSL /* wolfSSL doesn't support 2-key triple DES */ + symDerive(hSessionRW,hKeyDes2,hDerive,CKM_DES3_ECB_ENCRYPT_DATA,CKK_GENERIC_SECRET); + #ifndef WITH_FIPS + symDerive(hSessionRW,hKeyDes2,hDerive,CKM_DES3_ECB_ENCRYPT_DATA,CKK_DES); +@@ -844,27 +851,35 @@ void DeriveTests::testSymDerive() + symDerive(hSessionRW,hKeyDes2,hDerive,CKM_DES3_ECB_ENCRYPT_DATA,CKK_DES2); + symDerive(hSessionRW,hKeyDes2,hDerive,CKM_DES3_ECB_ENCRYPT_DATA,CKK_DES3); + symDerive(hSessionRW,hKeyDes2,hDerive,CKM_DES3_ECB_ENCRYPT_DATA,CKK_AES); ++#endif + symDerive(hSessionRW,hKeyDes3,hDerive,CKM_DES3_ECB_ENCRYPT_DATA,CKK_GENERIC_SECRET); + #ifndef WITH_FIPS + symDerive(hSessionRW,hKeyDes3,hDerive,CKM_DES3_ECB_ENCRYPT_DATA,CKK_DES); + #endif ++#ifndef WITH_WOLFSSL /* wolfSSL doesn't support 2-key triple DES */ + symDerive(hSessionRW,hKeyDes3,hDerive,CKM_DES3_ECB_ENCRYPT_DATA,CKK_DES2); ++#endif + symDerive(hSessionRW,hKeyDes3,hDerive,CKM_DES3_ECB_ENCRYPT_DATA,CKK_DES3); + symDerive(hSessionRW,hKeyDes3,hDerive,CKM_DES3_ECB_ENCRYPT_DATA,CKK_AES); + symDerive(hSessionRW,hKeyAes,hDerive,CKM_AES_ECB_ENCRYPT_DATA,CKK_GENERIC_SECRET); + #ifndef WITH_FIPS + symDerive(hSessionRW,hKeyAes,hDerive,CKM_AES_ECB_ENCRYPT_DATA,CKK_DES); + #endif ++#ifndef WITH_WOLFSSL /* wolfSSL doesn't support 2-key triple DES */ + symDerive(hSessionRW,hKeyAes,hDerive,CKM_AES_ECB_ENCRYPT_DATA,CKK_DES2); ++#endif + symDerive(hSessionRW,hKeyAes,hDerive,CKM_AES_ECB_ENCRYPT_DATA,CKK_DES3); + symDerive(hSessionRW,hKeyAes,hDerive,CKM_AES_ECB_ENCRYPT_DATA,CKK_AES); + #ifndef WITH_FIPS + symDerive(hSessionRW,hKeyDes,hDerive,CKM_DES_CBC_ENCRYPT_DATA,CKK_GENERIC_SECRET); + symDerive(hSessionRW,hKeyDes,hDerive,CKM_DES_CBC_ENCRYPT_DATA,CKK_DES); ++#ifndef WITH_WOLFSSL /* wolfSSL doesn't support 2-key triple DES */ + symDerive(hSessionRW,hKeyDes,hDerive,CKM_DES_CBC_ENCRYPT_DATA,CKK_DES2); ++#endif + symDerive(hSessionRW,hKeyDes,hDerive,CKM_DES_CBC_ENCRYPT_DATA,CKK_DES3); + symDerive(hSessionRW,hKeyDes,hDerive,CKM_DES_CBC_ENCRYPT_DATA,CKK_AES); + #endif ++#ifndef WITH_WOLFSSL /* wolfSSL doesn't support 2-key triple DES */ + symDerive(hSessionRW,hKeyDes2,hDerive,CKM_DES3_CBC_ENCRYPT_DATA,CKK_GENERIC_SECRET); + #ifndef WITH_FIPS + symDerive(hSessionRW,hKeyDes2,hDerive,CKM_DES3_CBC_ENCRYPT_DATA,CKK_DES); +@@ -872,18 +887,23 @@ void DeriveTests::testSymDerive() + symDerive(hSessionRW,hKeyDes2,hDerive,CKM_DES3_CBC_ENCRYPT_DATA,CKK_DES2); + symDerive(hSessionRW,hKeyDes2,hDerive,CKM_DES3_CBC_ENCRYPT_DATA,CKK_DES3); + symDerive(hSessionRW,hKeyDes2,hDerive,CKM_DES3_CBC_ENCRYPT_DATA,CKK_AES); ++#endif + symDerive(hSessionRW,hKeyDes3,hDerive,CKM_DES3_CBC_ENCRYPT_DATA,CKK_GENERIC_SECRET); + #ifndef WITH_FIPS + symDerive(hSessionRW,hKeyDes3,hDerive,CKM_DES3_CBC_ENCRYPT_DATA,CKK_DES); + #endif ++#ifndef WITH_WOLFSSL /* wolfSSL doesn't support 2-key triple DES */ + symDerive(hSessionRW,hKeyDes3,hDerive,CKM_DES3_CBC_ENCRYPT_DATA,CKK_DES2); ++#endif + symDerive(hSessionRW,hKeyDes3,hDerive,CKM_DES3_CBC_ENCRYPT_DATA,CKK_DES3); + symDerive(hSessionRW,hKeyDes3,hDerive,CKM_DES3_CBC_ENCRYPT_DATA,CKK_AES); + symDerive(hSessionRW,hKeyAes,hDerive,CKM_AES_CBC_ENCRYPT_DATA,CKK_GENERIC_SECRET); + #ifndef WITH_FIPS + symDerive(hSessionRW,hKeyAes,hDerive,CKM_AES_CBC_ENCRYPT_DATA,CKK_DES); + #endif ++#ifndef WITH_WOLFSSL /* wolfSSL doesn't support 2-key triple DES */ + symDerive(hSessionRW,hKeyAes,hDerive,CKM_AES_CBC_ENCRYPT_DATA,CKK_DES2); ++#endif + symDerive(hSessionRW,hKeyAes,hDerive,CKM_AES_CBC_ENCRYPT_DATA,CKK_DES3); + symDerive(hSessionRW,hKeyAes,hDerive,CKM_AES_CBC_ENCRYPT_DATA,CKK_AES); + } +diff --git a/src/lib/test/ObjectTests.cpp b/src/lib/test/ObjectTests.cpp +index c4248b2..e471838 100644 +--- a/src/lib/test/ObjectTests.cpp ++++ b/src/lib/test/ObjectTests.cpp +@@ -2409,6 +2409,7 @@ void ObjectTests::testCreateSecretKey() + rv = CRYPTOKI_F_PTR( C_DestroyObject(hSession,hObject) ); + CPPUNIT_ASSERT_EQUAL(CKR_OK, rv); + ++#ifndef WITH_WOLFSSL /* wolfSSL doesn't support 2-key triple DES */ + keyType = CKK_DES2; + attribs[0].pValue = des2Key; + attribs[0].ulValueLen = sizeof(des2Key); +@@ -2420,6 +2421,7 @@ void ObjectTests::testCreateSecretKey() + CPPUNIT_ASSERT(memcmp(pCheckValue, des2KCV, 3) == 0); + rv = CRYPTOKI_F_PTR( C_DestroyObject(hSession,hObject) ); + CPPUNIT_ASSERT_EQUAL(CKR_OK, rv); ++#endif + + keyType = CKK_DES3; + attribs[0].pValue = des3Key; +diff --git a/src/lib/test/SignVerifyTests.cpp b/src/lib/test/SignVerifyTests.cpp +index ac9d465..df40187 100644 +--- a/src/lib/test/SignVerifyTests.cpp ++++ b/src/lib/test/SignVerifyTests.cpp +@@ -232,7 +232,12 @@ void SignVerifyTests::signVerifySingle(CK_MECHANISM_TYPE mechanismType, CK_SESSI + { + CK_RV rv; + CK_MECHANISM mechanism = { mechanismType, param, paramLen }; ++#ifdef WITH_WOLFSSL ++ /* wolfSSL requires at least 16 bytes of data for raw ECDSA signing */ ++ CK_BYTE data[] = { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0A, 0x0B,0x0C, 0x0D, 0x0E, 0x0F }; ++#else + CK_BYTE data[] = { 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08, 0x09, 0x0A, 0x0B,0x0C, 0x0D, 0x0F }; ++#endif + CK_BYTE signature[256]; + CK_ULONG ulSignatureLen = 0; + +@@ -1003,6 +1008,7 @@ void SignVerifyTests::testMacSignVerify() + macSignVerify(CKM_GOSTR3411_HMAC, hSessionRO, hKey); + #endif + ++#ifndef WITH_WOLFSSL /* wolfSSL only supports CMAC with AES */ + rv = generateDes2Key(hSessionRW,IN_SESSION,IS_PUBLIC,hKey); + CPPUNIT_ASSERT(rv == CKR_OK); + macSignVerify(CKM_DES3_CMAC, hSessionRO, hKey); +@@ -1010,6 +1016,7 @@ void SignVerifyTests::testMacSignVerify() + rv = generateDes3Key(hSessionRW,IN_SESSION,IS_PUBLIC,hKey); + CPPUNIT_ASSERT(rv == CKR_OK); + macSignVerify(CKM_DES3_CMAC, hSessionRO, hKey); ++#endif + + rv = generateAesKey(hSessionRW,IN_SESSION,IS_PUBLIC,hKey); + CPPUNIT_ASSERT(rv == CKR_OK); +@@ -1048,6 +1055,7 @@ void SignVerifyTests::testMacSignVerify() + macSignVerify(CKM_GOSTR3411_HMAC, hSessionRW, hKey); + #endif + ++#ifndef WITH_WOLFSSL /* wolfSSL only supports CMAC with AES */ + rv = generateDes2Key(hSessionRW,IN_SESSION,IS_PRIVATE,hKey); + CPPUNIT_ASSERT(rv == CKR_OK); + macSignVerify(CKM_DES3_CMAC, hSessionRO, hKey); +@@ -1055,6 +1063,7 @@ void SignVerifyTests::testMacSignVerify() + rv = generateDes3Key(hSessionRW,IN_SESSION,IS_PRIVATE,hKey); + CPPUNIT_ASSERT(rv == CKR_OK); + macSignVerify(CKM_DES3_CMAC, hSessionRO, hKey); ++#endif + + rv = generateAesKey(hSessionRW,IN_SESSION,IS_PRIVATE,hKey); + CPPUNIT_ASSERT(rv == CKR_OK); +@@ -1093,6 +1102,7 @@ void SignVerifyTests::testMacSignVerify() + macSignVerify(CKM_GOSTR3411_HMAC, hSessionRW, hKey); + #endif + ++#ifndef WITH_WOLFSSL /* wolfSSL only supports CMAC with AES */ + rv = generateDes2Key(hSessionRW,ON_TOKEN,IS_PUBLIC,hKey); + CPPUNIT_ASSERT(rv == CKR_OK); + macSignVerify(CKM_DES3_CMAC, hSessionRO, hKey); +@@ -1100,6 +1110,7 @@ void SignVerifyTests::testMacSignVerify() + rv = generateDes3Key(hSessionRW,ON_TOKEN,IS_PUBLIC,hKey); + CPPUNIT_ASSERT(rv == CKR_OK); + macSignVerify(CKM_DES3_CMAC, hSessionRO, hKey); ++#endif + + rv = generateAesKey(hSessionRW,ON_TOKEN,IS_PUBLIC,hKey); + CPPUNIT_ASSERT(rv == CKR_OK); +@@ -1138,6 +1149,7 @@ void SignVerifyTests::testMacSignVerify() + macSignVerify(CKM_GOSTR3411_HMAC, hSessionRW, hKey); + #endif + ++#ifndef WITH_WOLFSSL /* wolfSSL only supports CMAC with AES */ + rv = generateDes2Key(hSessionRW,ON_TOKEN,IS_PRIVATE,hKey); + CPPUNIT_ASSERT(rv == CKR_OK); + macSignVerify(CKM_DES3_CMAC, hSessionRO, hKey); +@@ -1145,6 +1157,7 @@ void SignVerifyTests::testMacSignVerify() + rv = generateDes3Key(hSessionRW,ON_TOKEN,IS_PRIVATE,hKey); + CPPUNIT_ASSERT(rv == CKR_OK); + macSignVerify(CKM_DES3_CMAC, hSessionRO, hKey); ++#endif + + rv = generateAesKey(hSessionRW,ON_TOKEN,IS_PRIVATE,hKey); + CPPUNIT_ASSERT(rv == CKR_OK); +diff --git a/src/lib/test/SymmetricAlgorithmTests.cpp b/src/lib/test/SymmetricAlgorithmTests.cpp +index 4e95717..b90b2be 100644 +--- a/src/lib/test/SymmetricAlgorithmTests.cpp ++++ b/src/lib/test/SymmetricAlgorithmTests.cpp +@@ -1832,6 +1832,7 @@ void SymmetricAlgorithmTests::testDesEncryptDecrypt() + encryptDecrypt({CKM_DES_ECB,NULL_PTR,0},blockSize,hSessionRO,hKey,blockSize*NR_OF_BLOCKS_IN_TEST); + encryptDecrypt({CKM_DES_ECB,NULL_PTR,0},blockSize,hSessionRO,hKey,blockSize*NR_OF_BLOCKS_IN_TEST+1, false); + ++#ifndef WITH_WOLFSSL /* wolfSSL doesn't support 2-key triple DES */ + CK_OBJECT_HANDLE hKey2 = CK_INVALID_HANDLE; + + // Generate all combinations of session/token keys. +@@ -1845,6 +1846,7 @@ void SymmetricAlgorithmTests::testDesEncryptDecrypt() + encryptDecrypt({CKM_DES3_CBC,NULL_PTR,0},blockSize,hSessionRO,hKey2,blockSize*NR_OF_BLOCKS_IN_TEST+1, false); + encryptDecrypt({CKM_DES3_ECB,NULL_PTR,0},blockSize,hSessionRO,hKey2,blockSize*NR_OF_BLOCKS_IN_TEST); + encryptDecrypt({CKM_DES3_ECB,NULL_PTR,0},blockSize,hSessionRO,hKey2,blockSize*NR_OF_BLOCKS_IN_TEST+1, false); ++#endif + #endif + + CK_OBJECT_HANDLE hKey3 = CK_INVALID_HANDLE; +-- +2.43.0 + diff --git a/tcpdump/4.99.6/README.md b/tcpdump/4.99.6/README.md new file mode 100644 index 000000000..7300dbf1b --- /dev/null +++ b/tcpdump/4.99.6/README.md @@ -0,0 +1,13 @@ +# Building tcpdump with wolfSSL ++ Configure wolfSSL with `./configure --enable-tcpdump`. This turns on the OpenSSL compatibility layer, 3DES (ESP decryption) and MD5 (TCP MD5 signature option). Add `--enable-debug` if you're going to be debugging. ++ `make` and `sudo make install` wolfSSL into /usr/local. ++ Download tcpdump-4.99.6 with `curl -O https://www.tcpdump.org/release/tcpdump-4.99.6.tar.gz`. ++ Unarchive this tar ball with `tar xvf tcpdump-4.99.6.tar.gz`. ++ Apply the tcpdump-4.99.6.patch file with `patch -p1 < tcpdump-4.99.6.patch` (assuming the patch file is in the tcpdump-4.99.6 directory; adjust the path according to your situation). ++ Regenerate the configure script with `autoreconf -ivf`. ++ Configure tcpdump with `./configure --with-wolfssl=/usr/local`. Update the path if you've installed wolfSSL using a different prefix than /usr/local. If that prefix is not on the dynamic linker search path, export `LD_LIBRARY_PATH=/lib` before running tcpdump or the tests. ++ Run `make` to compile. ++ Run `make check`. All tests should pass. + +## libpcap +libpcap 1.10.4 (the version shipped by Ubuntu 24.04) reads pcap timestamps as signed 32-bit values, which makes the `time_2038_overflow`, `time_2039`, `time_2106` and `time_2106_max` tests fail regardless of the crypto library. Use libpcap 1.10.5 or newer. The easiest way is to build it in a `libpcap` directory next to the tcpdump directory (`./configure && make`); tcpdump's configure script picks it up automatically. diff --git a/tcpdump/4.99.6/tcpdump-4.99.6.patch b/tcpdump/4.99.6/tcpdump-4.99.6.patch new file mode 100644 index 000000000..74af57699 --- /dev/null +++ b/tcpdump/4.99.6/tcpdump-4.99.6.patch @@ -0,0 +1,155 @@ +From 0a34b0b1da2e0042553d2cc6eda5cf49dfaafa71 Mon Sep 17 00:00:00 2001 +From: Juliusz Sosinowicz +Date: Fri, 4 Sep 2026 09:41:51 +0000 +Subject: [PATCH] wolfSSL Patch + +This patch adds a --with-wolfssl=DIR configure option that builds tcpdump +against wolfSSL instead of OpenSSL libcrypto. The wolfSSL headers are +picked up through their OpenSSL compatibility layer, so no source changes +are needed beyond the configure script. DEBUG_WOLFSSL builds turn on +wolfSSL logging at startup. + +Compile wolfSSL with: + ./configure --enable-tcpdump + make + make install + +--enable-tcpdump turns on OPENSSL_EXTRA, DES3 (ESP 3DES-CBC decryption) +and MD5 (TCP MD5 signature option). Add --enable-debug for wolfSSL logging. + +Compile tcpdump with: + patch -p1 < tcpdump-4.99.6.patch + autoreconf -ivf + ./configure --with-wolfssl=/usr/local + make + +Adjust /usr/local to the wolfSSL install prefix. When the prefix is not on +the dynamic linker search path, export LD_LIBRARY_PATH=/lib before +running tcpdump or the tests. + +Run the tests with: + make check + +All tests pass (636 passed, 0 failed, 11 skipped). The skipped tests are +the same as with an OpenSSL build: bgp-as-path-oobr-nossl and +bgp-aigp-oobr-nossl (HAVE_LIBCRYPTO is set), the smb_*/eapon1*/ipx/ +nbns-valgrind tests (ENABLE_SMB not set) and lmp-v-fptype2. + +libpcap 1.10.4 (as shipped by Ubuntu 24.04) reads pcap timestamps as +signed 32-bit values, so time_2038_overflow, time_2039, time_2106 and +time_2106_max fail with it regardless of the crypto library. Build libpcap +1.10.5 or newer in ../libpcap (tcpdump's configure picks it up on its own) +or install it system-wide. +--- + configure.ac | 51 ++++++++++++++++++++++++++++++++++++++++++++++++--- + tcpdump.c | 7 +++++++ + 2 files changed, 55 insertions(+), 3 deletions(-) + +diff --git a/configure.ac b/configure.ac +index b50fef3..192bfaf 100644 +--- a/configure.ac ++++ b/configure.ac +@@ -998,6 +998,40 @@ AC_CHECK_TOOL([AR], [ar]) + + AC_LBL_DEVEL(V_CCOPT) + ++AC_ARG_WITH(wolfssl, ++ AS_HELP_STRING([--with-wolfssl]@<:@=DIR@:>@, ++ [use wolfSSL (located in directory DIR) @<:@default=no@:>@]), ++[ ++ if test "x$withval" = "xno" ++ then ++ USE_WOLFSSL=no ++ elif test "x$withval" = "xyes" ++ then ++ AC_MSG_ERROR([--with-wolfssl needs the wolfSSL install directory: --with-wolfssl=DIR]) ++ else ++ CPPFLAGS="$CPPFLAGS -I${withval}/include/wolfssl -I${withval}/include/ -DWOLFSSL_USE_OPTIONS_H" ++ LDFLAGS="$LDFLAGS -L${withval}/lib" ++ LIBS="$LIBS -lwolfssl" ++ USE_WOLFSSL=yes ++ fi], ++[ ++ USE_WOLFSSL=no ++]) ++ ++if test "x$USE_WOLFSSL" = "xyes" ++then ++ AC_CHECK_HEADER([wolfssl/options.h]) ++ if test $ac_cv_header_wolfssl_options_h = yes ++ then ++ AC_DEFINE(HAVE_WOLFSSL, 1, [define if you're using wolfSSL]) ++ AC_DEFINE(HAVE_EVP_CIPHER_CTX_NEW, 1, []) ++ AC_DEFINE(HAVE_EVP_DECRYPTINIT_EX, 1, []) ++ AC_DEFINE(HAVE_LIBCRYPTO, 1, []) ++ else ++ AC_MSG_ERROR([Unable to find wolfssl.]) ++ fi ++fi ++ + # Check for OpenSSL/libressl libcrypto + AC_MSG_CHECKING(whether to use OpenSSL/libressl libcrypto) + # Specify location for both includes and libraries. +@@ -1006,7 +1040,12 @@ AC_ARG_WITH(crypto, + AS_HELP_STRING([--with-crypto]@<:@=DIR@:>@, + [use OpenSSL/libressl libcrypto (located in directory DIR, if specified) @<:@default=yes, if available@:>@]), + [ +- if test $withval = no ++ if test "x$USE_WOLFSSL" = "xyes" ++ then ++ want_libcrypto=no ++ AC_MSG_RESULT(no) ++ AC_MSG_WARN([--with-crypto is ignored when --with-wolfssl is given]) ++ elif test $withval = no + then + # User doesn't want to link with libcrypto. + want_libcrypto=no +@@ -1025,12 +1064,18 @@ AC_ARG_WITH(crypto, + AC_MSG_RESULT([yes, using the version installed in $withval]) + fi + ],[ ++ if test "x$USE_WOLFSSL" = "xyes" ++ then ++ want_libcrypto=no ++ AC_MSG_RESULT(no) + # + # Use libcrypto if it's present, otherwise don't; no directory + # was specified. + # +- want_libcrypto=ifavailable +- AC_MSG_RESULT([yes, if available]) ++ else ++ want_libcrypto=ifavailable ++ AC_MSG_RESULT([yes, if available]) ++ fi + ]) + if test "$want_libcrypto" != "no"; then + # +diff --git a/tcpdump.c b/tcpdump.c +index bba632c..8d78591 100644 +--- a/tcpdump.c ++++ b/tcpdump.c +@@ -69,6 +69,9 @@ The Regents of the University of California. All rights reserved.\n"; + #ifdef HAVE_LIBCRYPTO + #include + #endif ++#if defined(HAVE_WOLFSSL) && defined(DEBUG_WOLFSSL) ++#include ++#endif + + #ifdef HAVE_GETOPT_LONG + #include +@@ -1713,6 +1716,10 @@ main(int argc, char **argv) + memset(ndo, 0, sizeof(*ndo)); + ndo_set_function_pointers(ndo); + ++#if defined(HAVE_WOLFSSL) && defined(DEBUG_WOLFSSL) ++ wolfSSL_Debugging_ON(); ++#endif ++ + cnt = -1; + device = NULL; + infile = NULL; +-- +2.43.0 +