ExternalVendorCode/openwrt
1
0
Fork 0
mirror of https://github.com/openwrt/openwrt.git synced 2025-02-21 01:41:41 +00:00
Code Issues Actions 4 Packages Projects Releases Wiki Activity

wolfssl: build with WOLFSSL_ALT_CERT_CHAINS

Browse Source 
"Alternate certification chains, as oppossed to requiring full chain
validataion. Certificate validation behavior is relaxed, similar to
openssl and browsers. Only the peer certificate must validate to a trusted
certificate. Without this, all certificates sent by a peer must be
used in the trust chain or the connection will be rejected."

This fixes e.g. uclient-fetch and curl connecting to servers using a Let's
Encrypt certificate which are cross-signed by the now expired
DST Root CA X3, see [0].

This is the recommended solution from upstream [1].

The binary size increases by ~12.3kb:
1236160 staging_dir/target-mipsel_24kc_musl/usr/lib/libwolfssl.so.4.8.1.39c36f2f
1248704 staging_dir/target-mipsel_24kc_musl/usr/lib/libwolfssl.so.4.8.1.39c36f2f

[0] https://github.com/openwrt/packages/issues/16674
[1] https://github.com/wolfSSL/wolfssl/issues/4443#issuecomment-934926793

Signed-off-by: Andre Heider <a.heider@gmail.com>
[bump PKG_RELEASE]
Signed-off-by: David Bauer <mail@david-bauer.net>
(cherry picked from commit 28d8e6a8711ba78f1684a205e11b0dbd4ff2b2f3)
This commit is contained in:
Andre Heider 2021-10-06 10:54:48 +02:00 committed by David Bauer
parent c43a5921fa
commit 4b212b1306
1 changed files with 7 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
package/libs/wolfssl/Makefile
View File

@ -58,7 +58,13 @@ define Package/libwolfssl/config
source "$(SOURCE)/Config.in"
endef
TARGET_CFLAGS += $(FPIC) -DFP_MAX_BITS=8192 -fomit-frame-pointer -flto
TARGET_CFLAGS += \
$(FPIC) \
-fomit-frame-pointer \
-flto \
-DFP_MAX_BITS=8192 \
-DWOLFSSL_ALT_CERT_CHAINS
TARGET_LDFLAGS += -flto
# --enable-stunnel needed for OpenSSL API compatibility bits