Implementing missing macros to openssl compatibility layer - #10520
Open
Roy-Carter wants to merge 6 commits into
Open
Implementing missing macros to openssl compatibility layer #10520Roy-Carter wants to merge 6 commits into
Roy-Carter wants to merge 6 commits into
Conversation
|
Can one of the admins verify this patch? |
Contributor
Author
|
@julek-wolfssl second part of the functions i've implemented , split the PR's for clarity of checks . |
Roy-Carter
force-pushed
the
feature/extending_comp_layer
branch
from
May 24, 2026 11:04
54ef2e4 to
413e8ac
Compare
Contributor
Author
|
@dgarske errors seemed related to master diff. both tests worked for me locally , I rebased , can we re-run workflow? |
Roy-Carter
force-pushed
the
feature/extending_comp_layer
branch
from
May 29, 2026 12:42
413e8ac to
62138a2
Compare
Contributor
Author
|
@julek-wolfssl @dgarske I've rebased to master , seems related to new changes added . |
Member
|
Jenkins okay to test |
Contributor
There was a problem hiding this comment.
Pull request overview
This PR expands the OpenSSL compatibility layer with aliases and implementations for several missing APIs used during migration to wolfSSL.
Changes:
- Adds compatibility mappings for
SSL_set_ciphersuites,X509_add1_ext_i2d,sk_GENERAL_NAME_new_null, andEC_KEY_oct2key. - Implements
wolfSSL_X509_add1_ext_i2dandwolfSSL_EC_KEY_oct2key. - Adds unit tests covering the new compatibility APIs.
Reviewed changes
Copilot reviewed 6 out of 6 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
wolfssl/ssl.h |
Declares the new X509 extension helper. |
wolfssl/openssl/ssl.h |
Adds OpenSSL compatibility macros for SSL, X509, and GENERAL_NAME APIs. |
wolfssl/openssl/ec.h |
Declares and maps EC_KEY_oct2key. |
src/x509.c |
Implements wolfSSL_X509_add1_ext_i2d. |
src/pk_ec.c |
Implements wolfSSL_EC_KEY_oct2key. |
tests/api.c |
Adds API tests for the new compatibility additions. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
julek-wolfssl
requested changes
Jun 1, 2026
julek-wolfssl
left a comment
julek-wolfssl
left a comment
Member
There was a problem hiding this comment.
@Roy-Carter please address copilot review. Thanks.
Roy-Carter
force-pushed
the
feature/extending_comp_layer
branch
from
June 7, 2026 07:53
62138a2 to
653ec68
Compare
Contributor
Author
|
@julek-wolfssl can we re-run workflow ? |
julek-wolfssl
previously approved these changes
Jun 8, 2026
Member
|
Roy-Carter
force-pushed
the
feature/extending_comp_layer
branch
from
June 21, 2026 12:44
f2a562a to
99427a3
Compare
Contributor
Author
|
can we re-run workflow @julek-wolfssl also writing here about our ticket , I think it might've been closed / I lost perms to write on it even though I did send emails there it seems as if zendesk link is unavailable |
dgarske
requested changes
Jun 22, 2026
| ExpectNotNull(ctx = SSL_CTX_new(wolfSSLv23_client_method())); | ||
| ExpectNotNull(ssl = SSL_new(ctx)); | ||
|
|
||
| ExpectIntEQ(SSL_set_ciphersuites(ssl, "TLS_AES_128_GCM_SHA256"), 1); |
Member
There was a problem hiding this comment.
With --disable-errorstrings
1309: test_wolfSSL_SSL_set_ciphersuites :
ERROR - tests/api.c line 2537 failed with:
expected: wolfSSL_set_cipher_list(ssl, "TLS_AES_128_GCM_SHA256") == 1
result: 0 != 1
failed ( 0.00002)
ERROR - tests/api.c line 36346 failed with:
expected: Test failed
result: ret 0
|
cipher_names[] only holds the IANA suite name when error strings are built in, so lean builds could not match "TLS_AES_128_GCM_SHA256". Gate the test on BUILD_TLS_AES_128_GCM_SHA256 and fall back to the wolfSSL suite name. Also build the basicConstraints ASN1_OBJECT with OBJ_nid2obj() so it carries a real OID encoding, not just a hand-set type.
Removing an extension left state behind: the freed altName list was still referenced by the altNamesNext retrieval hint (use after free through X509_get_next_altname()), and the cached subject key ID string, the encoded extended key usage and the per-extension set flags kept the removed extension observable. X509V3_ADD_SILENT only suppresses error reporting in OpenSSL, so X509V3_ADD_DEFAULT on an existing extension fails either way. REPLACE and REPLACE_EXISTING now encode the new extension before dropping the old one, so a failure no longer destroys the existing extension.
julek-wolfssl
force-pushed
the
feature/extending_comp_layer
branch
from
July 28, 2026 14:26
99427a3 to
76dec0a
Compare
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 7 out of 7 changed files in this pull request and generated no new comments.
Comments suppressed due to low confidence (2)
tests/api.c:21462
- test_san_first_dns() truncates the copied DNS name to fit dnsBuf, but it reports the original (untruncated) length in outLen. This makes outLen inconsistent with the returned string and can lead callers to read past the end of the buffer when they trust outLen.
src/pk_ec.c:4754 - wolfSSL_EC_POINT_new() takes a const WOLFSSL_EC_GROUP*. Casting away const here is unnecessary and can mask real const-correctness issues (and may trigger compiler warnings with -Wcast-qual).
point = wolfSSL_EC_POINT_new((WOLFSSL_EC_GROUP*)group);
Member
|
retest this please |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Implementing as part of migration to wolfssl
SSL_set_ciphersuites
X509_add1_ext_i2d
sk_GENERAL_NAME_new_null
EC_KEY_oct2key
Testing
unitests to each functionality added
Checklist