[PATCH 19.07 v2 3/3] wolfssl: build with WOLFSSL_ALT_CERT_CHAINS

Eneas U de Queiroz cotequeiroz at gmail.com
Mon Feb 14 13:19:10 PST 2022

From: Andre Heider <a.heider at gmail.com>

"Alternate certification chains, as oppossed to requiring full chain
validataion. Certificate validation behavior is relaxed, similar to
openssl and browsers. Only the peer certificate must validate to a trusted
certificate. Without this, all certificates sent by a peer must be
used in the trust chain or the connection will be rejected."

This fixes e.g. uclient-fetch and curl connecting to servers using a Let's
Encrypt certificate which are cross-signed by the now expired
DST Root CA X3, see [0].

This is the recommended solution from upstream [1].

The binary size increases by ~12.3kb:
1236160 staging_dir/target-mipsel_24kc_musl/usr/lib/libwolfssl.so.
1248704 staging_dir/target-mipsel_24kc_musl/usr/lib/libwolfssl.so.

[0] https://github.com/openwrt/packages/issues/16674
[1] https://github.com/wolfSSL/wolfssl/issues/4443#issuecomment-934926793

Signed-off-by: Andre Heider <a.heider at gmail.com>
Signed-off-by: David Bauer <mail at david-bauer.net>
(cherry picked from commit 28d8e6a8711ba78f1684a205e11b0dbd4ff2b2f3)
[adjust to v4.7.0 Makefile]
Signed-off-by: Eneas U de Queiroz <cotequeiroz at gmail.com>
 package/libs/wolfssl/Makefile | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/package/libs/wolfssl/Makefile b/package/libs/wolfssl/Makefile
index d123e7a875..4394b9ea4f 100644
--- a/package/libs/wolfssl/Makefile
+++ b/package/libs/wolfssl/Makefile
@@ -9,7 +9,7 @@ include $(TOPDIR)/rules.mk
@@ -56,7 +56,11 @@ define Package/libwolfssl/config
 	source "$(SOURCE)/Config.in"
-TARGET_CFLAGS += $(FPIC) -DFP_MAX_BITS=8192 -fomit-frame-pointer
+	$(FPIC) \
+	-fomit-frame-pointer \
+	-DFP_MAX_BITS=8192 \
 # --enable-stunnel needed for OpenSSL API compatibility bits

More information about the openwrt-devel mailing list