Changes for OpenSSL 4.0 support break wolfssl build

[LGA1150]

dc4a925

@cron2 @heitbaum

ssl_verify_openssl.c:263:60: error: passing argument 1 of 'wolfSSL_ASN1_STRING_get0_data' from incompatible pointer type [-Wincompatible-pointer-types]
  263 |         char *serial = format_hex_ex(ASN1_STRING_get0_data(asn1_i), ASN1_STRING_length(asn1_i), 0, 1 | FHE_CAPS, NULL, &gc);
      |                                                            ^~~~~~
      |                                                            |
      |                                                            WOLFSSL_ASN1_INTEGER *
/builder/staging_dir/target-mips_24kc_musl/usr/include/wolfssl/ssl.h:2357:72: note: expected 'const WOLFSSL_ASN1_STRING *' but argument is of type 'WOLFSSL_ASN1_INTEGER *'
 2357 |                                             const WOLFSSL_ASN1_STRING* asn);
      |                                             ~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~
ssl_verify_openssl.c:263:88: error: passing argument 1 of 'wolfSSL_ASN1_STRING_length' from incompatible pointer type [-Wincompatible-pointer-types]
  263 |         char *serial = format_hex_ex(ASN1_STRING_get0_data(asn1_i), ASN1_STRING_length(asn1_i), 0, 1 | FHE_CAPS, NULL, &gc);
      |                                                                                        ^~~~~~
      |                                                                                        |
      |                                                                                        WOLFSSL_ASN1_INTEGER *
/builder/staging_dir/target-mips_24kc_musl/usr/include/wolfssl/ssl.h:2358:71: note: expected 'const WOLFSSL_ASN1_STRING *' but argument is of type 'WOLFSSL_ASN1_INTEGER *'
 2358 | WOLFSSL_API int wolfSSL_ASN1_STRING_length(const WOLFSSL_ASN1_STRING* asn);
      |                                            ~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~
ssl_verify_openssl.c: In function 'backend_x509_get_serial_hex':
ssl_verify_openssl.c:317:48: error: passing argument 1 of 'wolfSSL_ASN1_STRING_get0_data' from incompatible pointer type [-Wincompatible-pointer-types]
  317 |     return format_hex_ex(ASN1_STRING_get0_data(asn1_i), ASN1_STRING_length(asn1_i), 0, 1, ":", gc);
      |                                                ^~~~~~
      |                                                |
      |                                                const WOLFSSL_ASN1_INTEGER *
/builder/staging_dir/target-mips_24kc_musl/usr/include/wolfssl/ssl.h:2357:72: note: expected 'const WOLFSSL_ASN1_STRING *' but argument is of type 'const WOLFSSL_ASN1_INTEGER *'
 2357 |                                             const WOLFSSL_ASN1_STRING* asn);
      |                                             ~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~
ssl_verify_openssl.c:317:76: error: passing argument 1 of 'wolfSSL_ASN1_STRING_length' from incompatible pointer type [-Wincompatible-pointer-types]
  317 |     return format_hex_ex(ASN1_STRING_get0_data(asn1_i), ASN1_STRING_length(asn1_i), 0, 1, ":", gc);
      |                                                                            ^~~~~~
      |                                                                            |
      |                                                                            const WOLFSSL_ASN1_INTEGER *
/builder/staging_dir/target-mips_24kc_musl/usr/include/wolfssl/ssl.h:2358:71: note: expected 'const WOLFSSL_ASN1_STRING *' but argument is of type 'const WOLFSSL_ASN1_INTEGER *'
 2358 | WOLFSSL_API int wolfSSL_ASN1_STRING_length(const WOLFSSL_ASN1_STRING* asn);
      |                                            ~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~
ssl_verify_openssl.c: In function 'x509_verify_ns_cert_type':
ssl_verify_openssl.c:630:48: error: passing argument 1 of 'wolfSSL_ASN1_STRING_length' from incompatible pointer type [-Wincompatible-pointer-types]
  630 |             result = (ns && ASN1_STRING_length(ns) > 0 && (ASN1_STRING_get0_data(ns)[0] & NS_SSL_CLIENT)) ? SUCCESS : FAILURE;
      |                                                ^~
      |                                                |
      |                                                ASN1_BIT_STRING * {aka WOLFSSL_ASN1_BIT_STRING *}
/builder/staging_dir/target-mips_24kc_musl/usr/include/wolfssl/ssl.h:2358:71: note: expected 'const WOLFSSL_ASN1_STRING *' but argument is of type 'ASN1_BIT_STRING *' {aka 'WOLFSSL_ASN1_BIT_STRING *'}
 2358 | WOLFSSL_API int wolfSSL_ASN1_STRING_length(const WOLFSSL_ASN1_STRING* asn);
      |                                            ~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~
ssl_verify_openssl.c:630:82: error: passing argument 1 of 'wolfSSL_ASN1_STRING_get0_data' from incompatible pointer type [-Wincompatible-pointer-types]
  630 |             result = (ns && ASN1_STRING_length(ns) > 0 && (ASN1_STRING_get0_data(ns)[0] & NS_SSL_CLIENT)) ? SUCCESS : FAILURE;
      |                                                                                  ^~
      |                                                                                  |
      |                                                                                  ASN1_BIT_STRING * {aka WOLFSSL_ASN1_BIT_STRING *}
/builder/staging_dir/target-mips_24kc_musl/usr/include/wolfssl/ssl.h:2357:72: note: expected 'const WOLFSSL_ASN1_STRING *' but argument is of type 'ASN1_BIT_STRING *' {aka 'WOLFSSL_ASN1_BIT_STRING *'}
 2357 |                                             const WOLFSSL_ASN1_STRING* asn);
      |                                             ~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~
ssl_verify_openssl.c:658:48: error: passing argument 1 of 'wolfSSL_ASN1_STRING_length' from incompatible pointer type [-Wincompatible-pointer-types]
  658 |             result = (ns && ASN1_STRING_length(ns) > 0 && (ASN1_STRING_get0_data(ns)[0] & NS_SSL_SERVER)) ? SUCCESS : FAILURE;
      |                                                ^~
      |                                                |
      |                                                ASN1_BIT_STRING * {aka WOLFSSL_ASN1_BIT_STRING *}
/builder/staging_dir/target-mips_24kc_musl/usr/include/wolfssl/ssl.h:2358:71: note: expected 'const WOLFSSL_ASN1_STRING *' but argument is of type 'ASN1_BIT_STRING *' {aka 'WOLFSSL_ASN1_BIT_STRING *'}
 2358 | WOLFSSL_API int wolfSSL_ASN1_STRING_length(const WOLFSSL_ASN1_STRING* asn);
      |                                            ~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~
ssl_verify_openssl.c:658:82: error: passing argument 1 of 'wolfSSL_ASN1_STRING_get0_data' from incompatible pointer type [-Wincompatible-pointer-types]
  658 |             result = (ns && ASN1_STRING_length(ns) > 0 && (ASN1_STRING_get0_data(ns)[0] & NS_SSL_SERVER)) ? SUCCESS : FAILURE;
      |                                                                                  ^~
      |                                                                                  |
      |                                                                                  ASN1_BIT_STRING * {aka WOLFSSL_ASN1_BIT_STRING *}
/builder/staging_dir/target-mips_24kc_musl/usr/include/wolfssl/ssl.h:2357:72: note: expected 'const WOLFSSL_ASN1_STRING *' but argument is of type 'ASN1_BIT_STRING *' {aka 'WOLFSSL_ASN1_BIT_STRING *'}
 2357 |                                             const WOLFSSL_ASN1_STRING* asn);
      |                                             ~~~~~~~~~~~~~~~~~~~~~~~~~~~^~~

[schwabe]

While this is unfortunate, wolfSSL has never been a fully supported library and we are lacking people that are interested enough in helping maintaining wolfSSL support.

The statement in README.wolfSSL reads:

Support for wolfSSL is implemented and maintained by wolfSSL Inc. The support is
implemented using wolfSSL's compatibility layer. The wolfSSL support in OpenVPN
receives very limited testing/support from the OpenVPN community itself.

Patches are welcome to fix these issues or fixes to upstream wolfSSL to make the compatibility layer actually be provide better compatibility but do not expect a high commitment/priority from the community maintainers.

[schwabe]

Not that these are only warnings. If you compile without --enable-werror, it should still compile.

[LGA1150]

If you compile without --enable-werror, it should still compile.

I assumed you mean implicitly casting the pointer types. That's not how C struct works. WOLFSSL_ASN1_STRING and WOLFSSL_ASN1_INTEGER are two different structs with completely different layouts.

[schwabe]

@LGA1150 your wolfSSL is too old: wolfSSL/wolfssl#10089

[schwabe]

Closing this as this problem is fixed in a new wolfSSL version.

[LGA1150]

Closing this as this problem is fixed in a new wolfSSL version.

I'm using the latest wolfssl release 5.9.0, which was released 2 weeks ago, before the PR was merged.

[LGA1150]

This commit is backported to release/2.7 3888007 and is included in the 2.7.1 release. I don't see a reason to backport that.

[schwabe]

@LGA1150 We want to eventually have OpenSSL 4.0 support in the release/2.7 branch. So we need all the compile warning fixes for 2.7

[cron2]

This commit is backported to release/2.7 3888007 and is included in the 2.7.1 release. I don't see a reason to backport that.

OpenSSL is a fully supported SSL backend, and we expect distributions to start shipping OpenSSL 4.0 during the support cycle of OpenVPN 2.7.x - thus, patches that improve OpenSSL 4.0 compatibilty get applied to master and release/2.7.

If we break WolfSSL in the process because their OpenSSL compat layer leaves room for improvement, this is sad, but given the niche nature of WolfSSL and their general lack of caring, we do not care very much either.