Missing compatibility layer functionality

[Roy-Carter]

Description

Implement needed as part of migrating from OpenSSL -> WolfSSL
wolfSSL_SSL_CIPHER_find - find cipher by 2 bytes in wired like openssl
wolfSSL_sk_SSL_CIPHER_delete - remove cipher at given index
SSL_clear_chain_certs

Testing

created unitests .

Checklist

• [*] added tests
• [*] updated/added doxygen
• updated appropriate READMEs
• Updated manual and documentation

[Roy-Carter]

@julek-wolfssl adding PR for the 3 functions i've seen problems with (missing functionality) lmk what you think

[wolfSSL-Bot]

Can one of the admins verify this patch?

[Roy-Carter]

Hey @julek-wolfssl before I fix anything here since I wasn't 100% sure this is correct implementation I'd like if you can verify on your end if it's fine or not before I continue editing this

[dgarske]

@Roy-Carter looks like issue with --enable-asynccrypt "FAIL: scripts/unit.test"

[julek-wolfssl]

I would like a test to check that the connection still completes after a call to SSL_clear_chain_certs.

[Roy-Carter]

I would like a test to check that the connection still completes after a call to SSL_clear_chain_certs.

Regarding this without the PR fix of #10517 there's a segfault in clear , so just for the sake of the test + fix i've added the two bugs I encountered as part of the test because wolfSSL_add0_chain_cert never increments certChainCnt (CTX version does), and clear_chain_certs never resets it thus TLS 1.3 send walks a freed/NULL
chain. so maybe worth just closing the other one and sticking to this one for the addition of clearing also.

[Copilot]

Pull request overview

Adds three OpenSSL compatibility layer functions needed for application migration: SSL_CIPHER_find, sk_SSL_CIPHER_delete, and SSL_clear_chain_certs, with unit tests and a corresponding fix that increments ssl->buffers.certChainCnt when wolfSSL_add0_chain_cert succeeds.

Changes:

• New wolfSSL_SSL_CIPHER_find walks the SSL's cipher list to match by a 2-byte wire-format suite id.
• New wolfSSL_sk_SSL_CIPHER_delete removes a cipher from a stack at a given index, returning a heap copy.
• New wolfSSL_clear_chain_certs frees the SSL's added chain certs and resets ownership; add0_chain_cert now bumps certChainCnt.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
wolfssl/ssl.h	Public prototypes for the three new APIs
wolfssl/openssl/ssl.h	OpenSSL-style macro aliases for the three new APIs
src/ssl.c	Implementation of wolfSSL_SSL_CIPHER_find
src/ssl_sk.c	Implementation of wolfSSL_sk_SSL_CIPHER_delete using wolfSSL_sk_pop_node
src/ssl_load.c	Implementation of wolfSSL_clear_chain_certs and certChainCnt++ fix in add0_chain_cert
tests/api.c	New unit tests for the three APIs and a handshake-after-clear test

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[julek-wolfssl]

Please address the copilot comment and fix the CI. Thanks.

[Roy-Carter]

@julek-wolfssl can we re run workflow see if its working now ?

[github-actions]

MemBrowse Memory Report

gcc-arm-cortex-m4-openssl-compat

• FLASH: .text +256 B (+0.0%, 765,932 B / 1,048,576 B, total: 73% used)

linuxkm-standard

• Data: __patchable_function_entries +24 B (+0.1%, 45,896 B)
  No memory changes detected for:
• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m3
• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-dtls13
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-pq
• gcc-arm-cortex-m4-rsa-only
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m4-tls13
• gcc-arm-cortex-m7
• gcc-arm-cortex-m7-pq
• gcc-arm-cortex-m7-tls13
• linuxkm-pie
• stm32-sim-stm32h753