Skip to content

OpenSSL compatibility for libodbc #10813

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
kojo1 wants to merge 3 commits into
base: master
Choose a base branch
from
Open

OpenSSL compatibility for libodbc #10813

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
49db948
OpenSSL compatibility for libpq
kojo1 Jun 30, 2026
9e4ba6f
Imporoved OBJ_find_sigid_algs, add comments
kojo1 Jul 7, 2026
7ffc758
added test on WOLFSSL_VERIFY_NONE_DEFAULT
kojo1 Jul 7, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .wolfssl_known_macro_extras
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -970,6 +970,7 @@ WOLFSSL_USE_FLASHMEM
WOLFSSL_USE_FORCE_ZERO
WOLFSSL_USE_OPTIONS_H
WOLFSSL_VALIDATE_DH_KEYGEN
WOLFSSL_VERIFY_NONE_DEFAULT
WOLFSSL_WC_SLHDSA_RECURSIVE
WOLFSSL_WC_XMSS_NO_SHA256
WOLFSSL_WICED_PSEUDO_UNIX_EPOCH_TIME
Expand Down
6 changes: 6 additions & 0 deletions src/internal.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2642,6 +2642,12 @@ int InitSSL_Ctx(WOLFSSL_CTX* ctx, WOLFSSL_METHOD* method, void* heap)

XMEMSET(ctx, 0, sizeof(WOLFSSL_CTX));

#ifdef WOLFSSL_VERIFY_NONE_DEFAULT
Comment thread
dgarske marked this conversation as resolved.
/* OpenSSL compat: default to SSL_VERIFY_NONE unless the app
* sets SSL_VERIFY_PEER. */
ctx->verifyNone = 1;
#endif

ctx->method = method;
if (heap == NULL) {
ctx->heap = ctx; /* defaults to self */
Expand Down
44 changes: 44 additions & 0 deletions tests/api.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1793,6 +1793,46 @@ static int test_wolfSSL_CTX_new(void)
}
#endif

#if defined(WOLFSSL_VERIFY_NONE_DEFAULT) && !defined(NO_WOLFSSL_CLIENT) && \
!defined(NO_TLS)
/* WOLFSSL_VERIFY_NONE_DEFAULT makes a fresh CTX default to SSL_VERIFY_NONE
* (OpenSSL compat). Assert the default is applied, inherited by a spawned
* SSL, and correctly overridden by wolfSSL_CTX_set_verify(). */
static int test_wolfSSL_CTX_verify_none_default(void)
{
EXPECT_DECLS;
WOLFSSL_CTX* ctx = NULL;
WOLFSSL* ssl = NULL;

ExpectNotNull(ctx = wolfSSL_CTX_new(wolfSSLv23_client_method()));

/* Freshly created CTX defaults to no verification. */
ExpectIntEQ(ctx->verifyNone, 1);
#if defined(OPENSSL_EXTRA) || defined(OPENSSL_ALL)
ExpectIntEQ(wolfSSL_CTX_get_verify_mode(ctx), WOLFSSL_VERIFY_NONE);
#endif

/* A spawned SSL inherits the default. */
ExpectNotNull(ssl = wolfSSL_new(ctx));
ExpectIntEQ(ssl->options.verifyNone, 1);
wolfSSL_free(ssl);

/* SSL_VERIFY_PEER clears the default. */
wolfSSL_CTX_set_verify(ctx, WOLFSSL_VERIFY_PEER, NULL);
ExpectIntEQ(ctx->verifyNone, 0);
ExpectIntEQ(ctx->verifyPeer, 1);

/* WOLFSSL_VERIFY_DEFAULT resets verifyNone back to 0 (does not restore
* the compat default). */
wolfSSL_CTX_set_verify(ctx, WOLFSSL_VERIFY_DEFAULT, NULL);
ExpectIntEQ(ctx->verifyNone, 0);

wolfSSL_CTX_free(ctx);

return EXPECT_RESULT();
}
#endif

#if (!defined(NO_WOLFSSL_CLIENT) || !defined(NO_WOLFSSL_SERVER)) && \
!defined(NO_TLS) && \
(!defined(NO_RSA) || defined(HAVE_ECC)) && !defined(NO_FILESYSTEM)
Expand Down Expand Up @@ -35250,6 +35290,10 @@ TEST_CASE testCases[] = {
TEST_DECL(test_wolfSSL_Method_Allocators),
#if !defined(NO_WOLFSSL_SERVER) && !defined(NO_TLS)
TEST_DECL(test_wolfSSL_CTX_new),
#endif
#if defined(WOLFSSL_VERIFY_NONE_DEFAULT) && !defined(NO_WOLFSSL_CLIENT) && \
!defined(NO_TLS)
TEST_DECL(test_wolfSSL_CTX_verify_none_default),
#endif
TEST_DECL(test_server_wolfSSL_new),
TEST_DECL(test_client_wolfSSL_new),
Expand Down
31 changes: 31 additions & 0 deletions wolfssl/openssl/bio.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -188,6 +188,37 @@
#define BIO_meth_set_create wolfSSL_BIO_meth_set_create
#define BIO_meth_set_destroy wolfSSL_BIO_meth_set_destroy

#define WOLFSSL_BIO_TYPE_DESCRIPTOR 0x0100
#define WOLFSSL_BIO_TYPE_SOURCE_SINK 0x0400

/* OpenSSL allocates a fresh BIO type index per call; wolfSSL
* untracked, so return a fixed app-range index. */
static WC_INLINE int wolfSSL_BIO_get_new_index(void) { return 1000; }

/* wolfSSL does not store these BIO method callbacks; getters
* report none, set_callback_ctrl is a no-op. */
static WC_INLINE void *
wolfSSL_BIO_meth_get_gets(WOLFSSL_BIO_METHOD *m)
{ (void)m; return NULL; }
static WC_INLINE void *
wolfSSL_BIO_meth_get_puts(WOLFSSL_BIO_METHOD *m)
{ (void)m; return NULL; }
static WC_INLINE void *
wolfSSL_BIO_meth_get_ctrl(WOLFSSL_BIO_METHOD *m)
{ (void)m; return NULL; }
static WC_INLINE void *
wolfSSL_BIO_meth_get_create(WOLFSSL_BIO_METHOD *m)
{ (void)m; return NULL; }
static WC_INLINE void *
wolfSSL_BIO_meth_get_destroy(WOLFSSL_BIO_METHOD *m)
{ (void)m; return NULL; }
static WC_INLINE void *
wolfSSL_BIO_meth_get_callback_ctrl(WOLFSSL_BIO_METHOD *m)
{ (void)m; return NULL; }
static WC_INLINE int
wolfSSL_BIO_meth_set_callback_ctrl(WOLFSSL_BIO_METHOD *m, void *cb)
{ (void)m; (void)cb; return 1; }

#define BIO_snprintf XSNPRINTF

/* BIO CTRL */
Expand Down
12 changes: 12 additions & 0 deletions wolfssl/openssl/err.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,10 +38,22 @@
#define WOLFSSL_SSL_F_SSL_CTX_USE_CERTIFICATE_FILE 2
#define WOLFSSL_SSL_F_SSL_USE_PRIVATEKEY 3
#define WOLFSSL_EC_F_EC_GFP_SIMPLE_POINT2OCT 4
#define WOLFSSL_SSL_F_SSL_SET_FD 5

/* reasons */
#define WOLFSSL_ERR_R_SYS_LIB 1
#define WOLFSSL_PKCS12_R_MAC_VERIFY_FAILURE 2
/* Matches OpenSSL's ERR_R_BUF_LIB (= ERR_LIB_BUF, 7). */
#define WOLFSSL_ERR_R_BUF_LIB 7
#define WOLFSSL_SSL_R_UNKNOWN_PROTOCOL 252
#define WOLFSSL_SSL_R_WRONG_VERSION_NUMBER 267
#define WOLFSSL_SSL_R_UNSUPPORTED_PROTOCOL 258
#define WOLFSSL_SSL_R_NO_PROTOCOLS_AVAILABLE 194
#define WOLFSSL_SSL_R_BAD_PROTOCOL_VERSION_NUMBER 182
#define WOLFSSL_SSL_R_UNKNOWN_SSL_VERSION 254
#define WOLFSSL_SSL_R_UNSUPPORTED_SSL_VERSION 259
#define WOLFSSL_SSL_R_WRONG_SSL_VERSION 266
#define WOLFSSL_SSL_R_TLSV1_ALERT_PROTOCOL_VERSION 1070

#ifndef OPENSSL_COEXIST

Expand Down
6 changes: 6 additions & 0 deletions wolfssl/openssl/hmac.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -37,6 +37,12 @@

#include <wolfssl/openssl/compat_types.h>
#include <wolfssl/openssl/opensslv.h>
/* OpenSSL's hmac.h pulls in evp.h; mirror it, but only on standalone
* include (WOLFSSL_SSL_H unset) to avoid an include cycle during
* wolfssl/ssl.h's own parse. */
#ifndef WOLFSSL_SSL_H
#include <wolfssl/openssl/evp.h>
#endif

#ifdef __cplusplus
extern "C" {
Expand Down
47 changes: 47 additions & 0 deletions wolfssl/openssl/objects.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -74,6 +74,53 @@
#define NID_ad_OCSP WC_NID_ad_OCSP
#define NID_ad_ca_issuers WC_NID_ad_ca_issuers

/* OBJ_find_sigid_algs(): map a certificate signature-algorithm NID to its
* digest and public-key NIDs; returns 0 for unsupported algorithms. */
#ifndef BUILDING_WOLFSSL
static WC_INLINE int
Comment thread
dgarske marked this conversation as resolved.
wolfSSL_OBJ_find_sigid_algs(int sigid, int *pdig, int *ppkey)
{
int dig = 0;
int pkey = 0;
int ret = 1;

switch (sigid) {
#ifndef NO_RSA
case WC_NID_sha1WithRSAEncryption:
dig = WC_NID_sha1; pkey = WC_NID_rsaEncryption; break;
case WC_NID_sha224WithRSAEncryption:
dig = WC_NID_sha224; pkey = WC_NID_rsaEncryption; break;
case WC_NID_sha256WithRSAEncryption:
dig = WC_NID_sha256; pkey = WC_NID_rsaEncryption; break;
case WC_NID_sha384WithRSAEncryption:
dig = WC_NID_sha384; pkey = WC_NID_rsaEncryption; break;
case WC_NID_sha512WithRSAEncryption:
dig = WC_NID_sha512; pkey = WC_NID_rsaEncryption; break;
#endif /* !NO_RSA */
#ifdef HAVE_ECC
case WC_NID_ecdsa_with_SHA1:
dig = WC_NID_sha1; pkey = WC_NID_X9_62_id_ecPublicKey; break;
case WC_NID_ecdsa_with_SHA224:
dig = WC_NID_sha224; pkey = WC_NID_X9_62_id_ecPublicKey; break;
case WC_NID_ecdsa_with_SHA256:
dig = WC_NID_sha256; pkey = WC_NID_X9_62_id_ecPublicKey; break;
case WC_NID_ecdsa_with_SHA384:
dig = WC_NID_sha384; pkey = WC_NID_X9_62_id_ecPublicKey; break;
case WC_NID_ecdsa_with_SHA512:
dig = WC_NID_sha512; pkey = WC_NID_X9_62_id_ecPublicKey; break;
#endif /* HAVE_ECC */
default:
ret = 0; break;
}

if (ret == 1) {
if (pdig != NULL) *pdig = dig;
if (ppkey != NULL) *ppkey = pkey;
}
return ret;
}
#endif

#endif /* !OPENSSL_COEXIST */

#endif /* OPENSSL_EXTRA || OPENSSL_EXTRA_X509_SMALL */
Expand Down
42 changes: 39 additions & 3 deletions wolfssl/openssl/ssl.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,6 +44,7 @@
#include <wolfssl/openssl/evp.h>
#endif
#include <wolfssl/openssl/bio.h>
#include <wolfssl/openssl/err.h>
#ifdef OPENSSL_EXTRA
#include <wolfssl/openssl/crypto.h>
#endif
Expand Down Expand Up @@ -1568,6 +1569,14 @@ typedef WOLFSSL_SRTP_PROTECTION_PROFILE SRTP_PROTECTION_PROFILE;
#define SSL_get_state wolfSSL_get_state
#define SSL_state_string_long wolfSSL_state_string_long

/* Must equal HANDSHAKE_DONE in the internal 'enum states'
* (wolfssl/internal.h), returned by wolfSSL_get_state(); 16 today. */
#define WOLFSSL_TLS_ST_OK 16
Comment thread
dgarske marked this conversation as resolved.
#define WOLFSSL_SSL_ST_OK WOLFSSL_TLS_ST_OK
#define TLS_ST_OK WOLFSSL_TLS_ST_OK
#define SSL_ST_OK WOLFSSL_SSL_ST_OK
#define SSL_F_SSL_SET_FD WOLFSSL_SSL_F_SSL_SET_FD

#define GENERAL_NAME_new wolfSSL_GENERAL_NAME_new
#define GENERAL_NAME_free wolfSSL_GENERAL_NAME_free
#define GENERAL_NAME_dup wolfSSL_GENERAL_NAME_dup
Expand Down Expand Up @@ -1738,16 +1747,43 @@ typedef WOLFSSL_SRTP_PROTECTION_PROFILE SRTP_PROTECTION_PROFILE;
#define SSL_R_DATA_LENGTH_TOO_LONG BUFFER_ERROR
#define SSL_R_ENCRYPTED_LENGTH_TOO_LONG BUFFER_ERROR
#define SSL_R_BAD_LENGTH BUFFER_ERROR
#define SSL_R_UNKNOWN_PROTOCOL VERSION_ERROR
#define SSL_R_WRONG_VERSION_NUMBER VERSION_ERROR
#define SSL_R_UNKNOWN_PROTOCOL WOLFSSL_SSL_R_UNKNOWN_PROTOCOL
#define SSL_R_WRONG_VERSION_NUMBER WOLFSSL_SSL_R_WRONG_VERSION_NUMBER
#define SSL_R_DECRYPTION_FAILED_OR_BAD_RECORD_MAC ENCRYPT_ERROR
#define SSL_R_HTTPS_PROXY_REQUEST PARSE_ERROR
#define SSL_R_HTTP_REQUEST PARSE_ERROR
#define SSL_R_UNSUPPORTED_PROTOCOL VERSION_ERROR
#define SSL_R_UNSUPPORTED_PROTOCOL WOLFSSL_SSL_R_UNSUPPORTED_PROTOCOL
#define SSL_R_NO_PROTOCOLS_AVAILABLE \
WOLFSSL_SSL_R_NO_PROTOCOLS_AVAILABLE
#define SSL_R_BAD_PROTOCOL_VERSION_NUMBER \
WOLFSSL_SSL_R_BAD_PROTOCOL_VERSION_NUMBER
#define SSL_R_UNKNOWN_SSL_VERSION WOLFSSL_SSL_R_UNKNOWN_SSL_VERSION
#define SSL_R_UNSUPPORTED_SSL_VERSION \
WOLFSSL_SSL_R_UNSUPPORTED_SSL_VERSION
#define SSL_R_WRONG_SSL_VERSION WOLFSSL_SSL_R_WRONG_SSL_VERSION
#define SSL_R_TLSV1_ALERT_PROTOCOL_VERSION \
WOLFSSL_SSL_R_TLSV1_ALERT_PROTOCOL_VERSION
#define SSL_R_CERTIFICATE_VERIFY_FAILED VERIFY_CERT_ERROR
#define SSL_R_CERT_CB_ERROR CLIENT_CERT_CB_ERROR
#define SSL_R_NULL_SSL_METHOD_PASSED BAD_FUNC_ARG
#define SSL_R_CCS_RECEIVED_EARLY OUT_OF_ORDER_E
#define ERR_R_BUF_LIB WOLFSSL_ERR_R_BUF_LIB
#define BIO_TYPE_DESCRIPTOR WOLFSSL_BIO_TYPE_DESCRIPTOR
#define BIO_TYPE_SOURCE_SINK WOLFSSL_BIO_TYPE_SOURCE_SINK
#define BIO_get_app_data(bio) wolfSSL_BIO_get_data(bio)
#define BIO_set_app_data(bio, data) \
wolfSSL_BIO_set_data((bio), (data))
#define BIO_get_new_index wolfSSL_BIO_get_new_index
#define BIO_meth_get_gets wolfSSL_BIO_meth_get_gets
#define BIO_meth_get_puts wolfSSL_BIO_meth_get_puts
#define BIO_meth_get_ctrl wolfSSL_BIO_meth_get_ctrl
#define BIO_meth_get_create wolfSSL_BIO_meth_get_create
#define BIO_meth_get_destroy wolfSSL_BIO_meth_get_destroy
#define BIO_meth_get_callback_ctrl wolfSSL_BIO_meth_get_callback_ctrl
#define BIO_meth_set_callback_ctrl wolfSSL_BIO_meth_set_callback_ctrl
#ifndef BUILDING_WOLFSSL
#define OBJ_find_sigid_algs wolfSSL_OBJ_find_sigid_algs
#endif

#ifdef HAVE_SESSION_TICKET
#define SSL_CTRL_SET_TLSEXT_TICKET_KEY_CB 72
Expand Down
Loading