From: Andre Heider Date: Wed, 6 Oct 2021 08:54:48 +0000 (+0200) Subject: wolfssl: build with WOLFSSL_ALT_CERT_CHAINS X-Git-Tag: v21.02.1~19 X-Git-Url: http://git.cdn.openwrt.org/?a=commitdiff_plain;h=4b212b1306a93b6ebd450a4b1066ddf906035f4d;p=openwrt%2Fstaging%2Fchunkeey.git wolfssl: build with WOLFSSL_ALT_CERT_CHAINS "Alternate certification chains, as oppossed to requiring full chain validataion. Certificate validation behavior is relaxed, similar to openssl and browsers. Only the peer certificate must validate to a trusted certificate. Without this, all certificates sent by a peer must be used in the trust chain or the connection will be rejected." This fixes e.g. uclient-fetch and curl connecting to servers using a Let's Encrypt certificate which are cross-signed by the now expired DST Root CA X3, see [0]. This is the recommended solution from upstream [1]. The binary size increases by ~12.3kb: 1236160 staging_dir/target-mipsel_24kc_musl/usr/lib/libwolfssl.so.4.8.1.39c36f2f 1248704 staging_dir/target-mipsel_24kc_musl/usr/lib/libwolfssl.so.4.8.1.39c36f2f [0] https://github.com/openwrt/packages/issues/16674 [1] https://github.com/wolfSSL/wolfssl/issues/4443#issuecomment-934926793 Signed-off-by: Andre Heider [bump PKG_RELEASE] Signed-off-by: David Bauer (cherry picked from commit 28d8e6a8711ba78f1684a205e11b0dbd4ff2b2f3) --- diff --git a/package/libs/wolfssl/Makefile b/package/libs/wolfssl/Makefile index 030a0224f5..539f16d399 100644 --- a/package/libs/wolfssl/Makefile +++ b/package/libs/wolfssl/Makefile @@ -58,7 +58,13 @@ define Package/libwolfssl/config source "$(SOURCE)/Config.in" endef -TARGET_CFLAGS += $(FPIC) -DFP_MAX_BITS=8192 -fomit-frame-pointer -flto +TARGET_CFLAGS += \ + $(FPIC) \ + -fomit-frame-pointer \ + -flto \ + -DFP_MAX_BITS=8192 \ + -DWOLFSSL_ALT_CERT_CHAINS + TARGET_LDFLAGS += -flto # --enable-stunnel needed for OpenSSL API compatibility bits