Add SSL_set_tlsext_debug_callback compat API - #11256
Open
julek-wolfssl wants to merge 1 commit into
Open
Conversation
|
Can one of the admins verify this patch? |
Contributor
There was a problem hiding this comment.
Pull request overview
Warning
Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.
Adds an OpenSSL-compatible TLS extension debug callback API to wolfSSL, enabling inspection of received handshake extensions before they’re processed.
Changes:
- Introduces
wolfSSL_set_tlsext_debug_callback()andWOLFSSL_TLSEXT_DEBUG_CBin the public API and OpenSSL-compat header. - Stores and invokes the callback during extension parsing (
TLSX_Parse) for each received extension. - Adds API and handshake loopback tests validating callback installation and observed extension presence.
Reviewed changes
Copilot reviewed 8 out of 8 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| wolfssl/ssl.h | Declares the new callback typedef and public setter API. |
| wolfssl/openssl/ssl.h | Adds OpenSSL-compat macro mapping for SSL_set_tlsext_debug_callback. |
| wolfssl/internal.h | Adds callback storage to WOLFSSL object (behind feature guards). |
| src/tls.c | Invokes the callback once per received extension during parsing. |
| src/ssl_api_ext.c | Implements wolfSSL_set_tlsext_debug_callback(). |
| doc/dox_comments/header_files/ssl.h | Documents the new callback type and setter. |
| tests/api/test_ssl_ext.h | Registers new API tests. |
| tests/api/test_ssl_ext.c | Adds installation and handshake callback behavior tests. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| #ifdef OPENSSL_EXTRA | ||
| #ifdef HAVE_PK_CALLBACKS | ||
| void* loggingCtx; /* logging callback argument */ | ||
| WOLFSSL_TLSEXT_DEBUG_CB tlsextDebugCb; /* TLS ext debug callback */ |
| #define SSL_renegotiate wolfSSL_Rehandshake | ||
| #define SSL_get_secure_renegotiation_support wolfSSL_SSL_get_secure_renegotiation_support | ||
| #define SSL_renegotiate_pending wolfSSL_SSL_renegotiate_pending | ||
| #define SSL_set_tlsext_debug_arg wolfSSL_set_tlsext_debug_arg |
Comment on lines
+6384
to
+6385
| \return SSL_SUCCESS On successful setting of the callback. | ||
| \return SSL_FAILURE If a NULL ssl is passed in. |
|
Add wolfSSL_set_tlsext_debug_callback() with the WOLFSSL_TLSEXT_DEBUG_CB callback type, mirroring OpenSSL's SSL_set_tlsext_debug_callback(). The callback is invoked once for every TLS extension received during the handshake, in wire order, before the extension is processed, with the connection side, extension type, raw extension content and the argument set via wolfSSL_set_tlsext_debug_arg(). This covers client hello, server hello, hello retry request, encrypted extensions, certificate, certificate request and session ticket messages for TLS 1.2/1.3 and DTLS, mirroring OpenSSL's tls1_handle_extensions() receive path. Unlike OpenSSL 3.x, unknown (unregistered) extension types are also reported. The callback is stored in the WOLFSSL object and guarded by OPENSSL_EXTRA && HAVE_PK_CALLBACKS, matching the existing wolfSSL_set_tlsext_debug_arg(). The argument reuses ssl->loggingCtx. Document the new API in doc/dox_comments/header_files/ssl.h and add API tests, including a loopback handshake test asserting that both sides observe the expected extensions (TLSX_SUPPORTED_VERSIONS for TLS 1.3, TLSX_EXTENDED_MASTER_SECRET for TLS 1.2 with EMS).
julek-wolfssl
force-pushed
the
x509-auth-level-ssl-tlsext-debug-cb
branch
from
August 26, 2026 11:15
7857f80 to
e09385e
Compare
Member
Author
|
retest this please |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds
wolfSSL_set_tlsext_debug_callback()and theWOLFSSL_TLSEXT_DEBUG_CBcallback type, mirroring OpenSSL'sSSL_set_tlsext_debug_callback().wolfSSL_set_tlsext_debug_arg().tls1_handle_extensions()receive path.OPENSSL_EXTRA && HAVE_PK_CALLBACKS, matching the existingwolfSSL_set_tlsext_debug_arg(); the argument reusesssl->loggingCtx.doc/dox_comments/header_files/ssl.h.TLSX_SUPPORTED_VERSIONSfor TLS 1.3,TLSX_EXTENDED_MASTER_SECRETfor TLS 1.2 with EMS).