Add OpenSSL compatibility fixes and X509_verify_cert chain building for xmlsec

.github/ci-deps/packages-ubuntu-24.04-full.txt

@@ -58,6 +58,7 @@ libjansson-dev
 libkrb5-dev
 libldb-dev
 libldb2
+libltdl-dev
 liblz4-dev
 liblzma-dev
 liblzo2-dev
@@ -82,6 +83,8 @@ libssl-dev
 libtool
 liburcu-dev
 libuv1-dev
+libxml2-dev
+libxslt1-dev
 linux-libc-dev
 make
 man2html

.github/workflows/xmlsec.yml

@@ -0,0 +1,175 @@
+name: xmlsec Tests
+
+# START OF COMMON SECTION
+on:
+  push:
+    branches: [ 'release/**' ]
+  pull_request:
+    types: [opened, synchronize, reopened, ready_for_review]
+    branches: [ '*' ]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+# END OF COMMON SECTION
+
+jobs:
+  build_wolfssl:
+    name: Build wolfSSL
+    if: ${{ (github.repository_owner == 'wolfssl') && (github.event_name != 'pull_request' || github.event.pull_request.draft == false) }}
+    # Just to keep it the same as the testing target
+    runs-on: ubuntu-24.04
+    # This should be a safe limit for the tests to run.
+    timeout-minutes: 4
+    steps:
+      - name: Build wolfSSL
+        uses: wolfSSL/actions-build-autotools-project@v1
+        with:
+          path: wolfssl
+          # The CFLAGS only relax limits for the xmlsec test data: a 512-bit
+          # RSA CA, rsa-1024 key generation, serial-0 certs and MD5-signed
+          # certs.
+          configure: >-
+            --enable-all
+            'CFLAGS=-DWOLFSSL_MIN_RSA_BITS=512 -DRSA_MIN_SIZE=1024 -DWOLFSSL_ASN_ALLOW_0_SERIAL -DWOLFSSL_ALLOW_MD5_CERT_SIGS'
+          install: true
+          check: false
+
+      - name: tar build-dir
+        run: tar -zcf build-dir.tgz build-dir
+
+      - name: Upload built lib
+        uses: actions/upload-artifact@v6
+        with:
+          name: wolf-install-xmlsec
+          path: build-dir.tgz
+          retention-days: 5
+
+  xmlsec_check:
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - ref: 1.2.42
+            tag: xmlsec-1_2_42
+            sha256: 5359e3c19016ab164b505c1222ef5a2d87b34f50f85ff91d765f4aaa0df42db2
+            # wolfSSL PKCS12_parse() does not load DSA keys, and a DSA CA's
+            # key is not kept for chain verification.
+            expect_fail: >-
+              aleksey-xmldsig-01/enveloping-dsa-x509chain
+              aleksey-xmldsig-01/enveloping-sha256-dsa2048-sha256
+              aleksey-xmldsig-01/enveloping-sha256-dsa3072-sha256
+              merlin-exc-c14n-one/exc-signature
+              merlin-xmldsig-twenty-three/signature
+              merlin-xmldsig-twenty-three/signature-enveloped-dsa
+              merlin-xmldsig-twenty-three/signature-enveloping-b64-dsa
+              merlin-xmldsig-twenty-three/signature-enveloping-dsa
+              merlin-xmldsig-twenty-three/signature-external-b64-dsa
+              merlin-xmldsig-twenty-three/signature-external-dsa
+              merlin-xmldsig-twenty-three/signature-keyname
+              merlin-xmldsig-twenty-three/signature-retrievalmethod-rawx509crt
+              merlin-xmldsig-twenty-three/signature-x509-crt
+              merlin-xmldsig-twenty-three/signature-x509-is
+              merlin-xmldsig-twenty-three/signature-x509-ski
+              merlin-xmldsig-twenty-three/signature-x509-sn
+              phaos-xmldsig-three/signature-dsa-detached
+              phaos-xmldsig-three/signature-dsa-enveloped
+              phaos-xmldsig-three/signature-dsa-enveloping
+    name: ${{ matrix.ref }}
+    if: ${{ (github.repository_owner == 'wolfssl') && (github.event_name != 'pull_request' || github.event.pull_request.draft == false) }}
+    runs-on: ubuntu-24.04
+    # This should be a safe limit for the tests to run.
+    timeout-minutes: 10
+    needs: build_wolfssl
+    steps:
+      - name: Checkout wolfSSL CI actions
+        uses: actions/checkout@v5
+        with:
+          sparse-checkout: .github/actions
+          fetch-depth: 1
+
+      - name: Install dependencies
+        uses: ./.github/actions/install-apt-deps
+        with:
+          # Fit the loop inside this job's timeout-minutes.
+          budget-seconds: '120'
+          pull-timeout: '60'
+          packages: libltdl-dev libxml2-dev libxslt1-dev
+          ghcr-debs-tag: ubuntu-24.04-full
+
+      - name: Download lib
+        uses: actions/download-artifact@v7
+        with:
+          name: wolf-install-xmlsec
+
+      - name: untar build-dir
+        run: tar -xf build-dir.tgz
+
+      - name: Checkout OSP
+        uses: actions/checkout@v5
+        with:
+          repository: wolfssl/osp
+          path: osp
+          fetch-depth: 1
+
+      - name: Download xmlsec
+        run: |
+          curl -fLO https://github.com/lsh123/xmlsec/releases/download/${{ matrix.tag }}/xmlsec1-${{ matrix.ref }}.tar.gz
+          echo "${{ matrix.sha256 }}  xmlsec1-${{ matrix.ref }}.tar.gz" | sha256sum -c -
+          tar xf xmlsec1-${{ matrix.ref }}.tar.gz
+
+      - name: Build xmlsec
+        working-directory: xmlsec1-${{ matrix.ref }}
+        run: |
+          patch -p1 < "$GITHUB_WORKSPACE/osp/xmlsec/${{ matrix.ref }}/xmlsec1-${{ matrix.ref }}.patch"
+          # --disable-ripemd160: wolfSSL EVP_ripemd160() is a stub
+          OPENSSL_CFLAGS="-I$GITHUB_WORKSPACE/build-dir/include -I$GITHUB_WORKSPACE/build-dir/include/wolfssl -DWOLFSSL_USE_OPTIONS_H" \
+          OPENSSL_LIBS="-L$GITHUB_WORKSPACE/build-dir/lib -Wl,-rpath,$GITHUB_WORKSPACE/build-dir/lib -lwolfssl" \
+          ./configure --with-default-crypto=openssl --without-nss --without-gnutls \
+              --without-gcrypt --disable-ripemd160 --disable-docs --disable-mans
+          make -j
+          ldd src/openssl/.libs/libxmlsec1-openssl.so | grep wolfssl
+          if ldd src/openssl/.libs/libxmlsec1-openssl.so | grep -E 'libssl|libcrypto'; then
+            echo "::error::libxmlsec1-openssl is linked against OpenSSL"
+            exit 1
+          fi
+
+      - name: Run xmlsec tests
+        working-directory: xmlsec1-${{ matrix.ref }}
+        env:
+          EXPECT_FAIL: ${{ matrix.expect_fail }}
+        run: |
+          export TMPFOLDER="$GITHUB_WORKSPACE/xmlsec-logs"
+          mkdir -p "$TMPFOLDER"
+          # make check stops at the first failing script, so run each one
+          for t in keys dsig enc; do
+            make "check-$t" > "$TMPFOLDER/check-$t.log" 2>&1 || true
+            if ! grep -- '--- TOTAL' "$TMPFOLDER/check-$t.log"; then
+              tail -n 50 "$TMPFOLDER/check-$t.log"
+              echo "::error::check-$t did not finish"
+              exit 1
+            fi
+          done
+          # A test name is an unindented line. Its steps are indented and end
+          # in OK, Fail or Skip.
+          for t in keys dsig enc; do
+            awk '/^--- TOTAL/ {exit} /^[^ \t]/ {name = $0} /[ \t]Fail$/ {print name}' "$TMPFOLDER/check-$t.log"
+          done | sort -u > "$TMPFOLDER/failed.txt"
+          # Tests are matched by name: a listed test that fails for another
+          # reason is not caught.
+          echo "$EXPECT_FAIL" | tr ' ' '\n' | sed '/^$/d' | sort -u > "$TMPFOLDER/expected.txt"
+          if ! diff -u "$TMPFOLDER/expected.txt" "$TMPFOLDER/failed.txt"; then
+            echo "::error::Failed tests differ from expect_fail (- passes now, + new failure)"
+            exit 1
+          fi
+
+      - name: Upload test logs
+        if: ${{ failure() }}
+        uses: actions/upload-artifact@v6
+        with:
+          name: xmlsec-${{ matrix.ref }}-logs
+          path: xmlsec-logs
+          retention-days: 5

.wolfssl_known_macro_extras

@@ -1020,7 +1020,6 @@ WOLFSSL_HARDEN_TLS_NO_PKEY_CHECK
 WOLFSSL_HARDEN_TLS_NO_SCR_CHECK
 WOLFSSL_HAVE_KYBER
 WOLFSSL_HOSTNAME_VERIFY_ALT_NAME_ONLY
-WOLFSSL_I2D_ECDSA_SIG_ALLOC
 WOLFSSL_IAR_ARM_TIME
 WOLFSSL_IGNORE_BAD_CERT_PATH
 WOLFSSL_IMX6