Add openssh 10.5p1 patch for wolfSSL - #359
Open
julek-wolfssl wants to merge 3 commits into
Open
Conversation
There was a problem hiding this comment.
Pull request overview
This PR adds a new OpenSSH 10.5p1 patch file to enable building/testing OpenSSH against wolfSSL.
Changes:
- Introduces
openssh-10.5p1.patchwith build-system updates (Autoconf/Makefile) to detect and enable wolfSSL. - Adds wolfSSL-specific OpenSSH source changes (logging/init, RNG seeding, and minor crypto compatibility adjustments).
- Updates test harness invocation to pass wolfSSL enablement into regression tests.
Suppressed comments (2)
openssh-patches/openssh-10.5p1.patch:208
- The shell
testbuiltin in Autoconf-generated scripts is not guaranteed to support==(POSIX specifies=). Using==here can break./configureon systems where/bin/shis a strict POSIX shell (e.g., dash).
+ if test "x$wolf_has_aesni" == "xyes" ; then
openssh-patches/openssh-10.5p1.patch:383
log_init()unconditionally requiresWC_RNG_SEED_CBand registerswolf_seed, but after makingwolf_seedconditional ongetrandomavailability (or on platforms withoutgetrandom), this will either fail compilation or force an unnecessary build-time constraint. Consider registering the seed callback only whengetrandomis available, and otherwise rely on wolfSSL’s internal sandbox-safe seeding (e.g., RDSEED) guarded by theincludes.hcheck.
+#ifndef WC_RNG_SEED_CB
+#error wolfSSL needs to be built with WC_RNG_SEED_CB
+#endif
+ wc_SetSeed_Cb(wolf_seed);
+#endif
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
- configure.ac: use `test =` rather than the bash-only `==`. - configure.ac: describe WITH_OPENSSL by what it does. The macro is named for OpenSSL but is satisfied by wolfSSL's compatibility layer here. - log.c: build wolf_seed() only with HAVE_GETRANDOM. includes.h already requires some sandbox-safe seed source, but rdseed satisfies that without providing getrandom(2), and wolf_seed() calls it unconditionally. Skipping wc_SetSeed_Cb() leaves wolfSSL on wc_GenerateSeed(), which uses rdseed on such a build. - log.c: mark Logging_cb()'s unused logLevel. - log.c, test_helper.c: enable wolfSSL debug logging only when the caller asked for it - the requested LogLevel, and -v for the unit tests.
There was a problem hiding this comment.
🟡 Changes recommended
The patch breaks non-wolfSSL builds and mishandles explicit --without-wolfssl configuration.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Review details
- Files reviewed: 1/1 changed files
- Comments generated: 2
- Review effort level: Balanced
Comment on lines
+60
to
+61
| -#define AES_BLOCK_SIZE 16 | ||
| - |
Comment on lines
+110
to
+112
| + if test "x${withval}" != "xyes" ; then | ||
| + wolfssl_install_dir=${withval} | ||
| + fi |
The patched tree only built with wolfSSL. - cipher-aesctr.h: restore AES_BLOCK_SIZE behind #ifndef. It was dropped because wolfSSL and OpenSSL both define it unguarded, but with neither in the build nothing defines it and aesctr_ctx.ctr fails to compile. - configure.ac: --without-wolfssl also runs the AC_ARG_WITH action, with withval=no, so "no" was taken as an install prefix and configure aborted with "lib directory not found at no". - configure.ac: restore LIBS after the entropy probes rather than before. Moving it earlier dropped -lcrypto before the OpenSSL PRNG check, which then reported no seed source and failed configure. wolfSSL builds keep their LIBS, since -lwolfssl has to stay on the link line. Checked --with-wolfssl, --without-wolfssl and --without-openssl all configure and build from a clean V_10_5_P1 tree.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.