[Openvpn-devel] Support for wolfSSL in OpenVPN

Message ID 20200414185214.1863-1-juliusz@wolfssl.com
State Changes Requested
Headers show
Series
  • [Openvpn-devel] Support for wolfSSL in OpenVPN
Related show

Commit Message

Juliusz Sosinowicz April 14, 2020, 6:52 p.m.
This patch adds support for wolfSSL in OpenVPN. Support is added by using wolfSSL's OpenSSL compatibility layer. Function calls are left unchanged and instead the OpenSSL includes point to wolfSSL headers and OpenVPN is linked against the wolfSSL library.

As requested by OpenVPN maintainers, this patch does not include wolfssl/options.h on its own. By defining the macro EXTERNAL_OPTS_OPENVPN in the configure script wolfSSL will include wolfssl/options.h on its own (change added in https://github.com/wolfSSL/wolfssl/pull/2825). The patch adds an option '--disable-wolfssl-options-h' in case the user would like to supply their own settings file for wolfSSL.

wolfSSL:
Support added in: https://github.com/wolfSSL/wolfssl/pull/2503
```
git clone https://github.com/wolfSSL/wolfssl.git
cd wolfssl
./autogen.sh
./configure --enable-openvpn
make
sudo make install
```

OpenVPN:
```
autoreconf -i -v -f
./configure --with-crypto-library=wolfssl
make
make check
sudo make install
```

Signed-off-by: Juliusz Sosinowicz <juliusz@wolfssl.com>
---
 configure.ac            | 91 ++++++++++++++++++++++++++++++++++++++++-
 src/openvpn/crypto.c    |  2 +-
 src/openvpn/cryptoapi.c |  4 ++
 3 files changed, 94 insertions(+), 3 deletions(-)

Comments

Arne Schwabe April 15, 2020, 9:31 a.m. | #1
Am 14.04.20 um 20:52 schrieb Juliusz Sosinowicz:
> This patch adds support for wolfSSL in OpenVPN. Support is added by using wolfSSL's OpenSSL compatibility layer. Function calls are left unchanged and instead the OpenSSL includes point to wolfSSL headers and OpenVPN is linked against the wolfSSL library.
> 
> As requested by OpenVPN maintainers, this patch does not include wolfssl/options.h on its own. By defining the macro EXTERNAL_OPTS_OPENVPN in the configure script wolfSSL will include wolfssl/options.h on its own (change added in https://github.com/wolfSSL/wolfssl/pull/2825). The patch adds an option '--disable-wolfssl-options-h' in case the user would like to supply their own settings file for wolfSSL.
> 

Thanks the patch is lot less intrusive then the last version. We will
have to discuss in our meeting under what condition we want to include
the patch. We might add a note or statement that the WolfSSL support in
OpenVPN is mainly developed and tested by WolfSSL itself or something
along these lines.

> diff --git a/src/openvpn/crypto.c b/src/openvpn/crypto.c
> index 453cb20a..73da5fa7 100644
> --- a/src/openvpn/crypto.c
> +++ b/src/openvpn/crypto.c
> @@ -428,7 +428,7 @@ openvpn_decrypt_aead(struct buffer *buf, struct buffer work,
>      tag_ptr = BPTR(buf);
>      ASSERT(buf_advance(buf, tag_size));
>      dmsg(D_PACKET_CONTENT, "DECRYPT MAC: %s", format_hex(tag_ptr, tag_size, 0, &gc));
> -#if defined(ENABLE_CRYPTO_OPENSSL) && OPENSSL_VERSION_NUMBER < 0x10001040L
> +#if (defined(ENABLE_CRYPTO_OPENSSL) && OPENSSL_VERSION_NUMBER < 0x10001040L) || defined(ENABLE_CRYPTO_WOLFSSL)
>      /* OpenSSL <= 1.0.1c bug requires set tag before processing ciphertext */
>      if (!EVP_CIPHER_CTX_ctrl(ctx->cipher, EVP_CTRL_GCM_SET_TAG, tag_size, tag_ptr))
>      {

Are you sure that WolfSSL requires a workaround for old OpenSSL version
before 1.0.1d?

Arne
Gert Doering April 15, 2020, 9:48 a.m. | #2
Hi,

as Arne said, this is much better.

On Tue, Apr 14, 2020 at 08:52:14PM +0200, Juliusz Sosinowicz wrote:
> This patch adds support for wolfSSL in OpenVPN. Support is added by using wolfSSL's OpenSSL compatibility layer. Function calls are left unchanged and instead the OpenSSL includes point to wolfSSL headers and OpenVPN is linked against the wolfSSL library.
[..]

There is one thing, though:

> index 30eba7b2..a82c52ad 100644
> --- a/src/openvpn/cryptoapi.c
> +++ b/src/openvpn/cryptoapi.c
> @@ -39,6 +39,10 @@
>  
>  #ifdef ENABLE_CRYPTOAPI
>  
> +#ifdef ENABLE_CRYPTO_WOLFSSL
> +#error wolfSSL does not support CryptoAPI
> +#endif
> +

I do not like this very much.  It will, effectively, break win32 builds
with WolfSSL - and add yet another #ifdef to our .c files.

ENABLE_CRYPTOAPI is defined in syshead.h

#if defined(_WIN32) && defined(ENABLE_CRYPTO) && defined(ENABLE_CRYPTO_OPENSSL)
#define ENABLE_CRYPTOAPI
#endif

... could you investigate whether it would be sufficient to just 
conditionalize this on WolfSSL, like this?

#if defined(_WIN32) && defined(ENABLE_CRYPTO) && \
	defined(ENABLE_CRYPTO_OPENSSL) && !defined(ENABLE_CRYPTO_WOLFSSL)
#define ENABLE_CRYPTOAPI
#endif

so you can have WolfSSL-linked binaries for Windows, just without
CryptoAPI support (as with mbedtls)...

gert
David Sommerseth April 15, 2020, 8:58 p.m. | #3
On 14/04/2020 20:52, Juliusz Sosinowicz wrote:
> diff --git a/src/openvpn/cryptoapi.c b/src/openvpn/cryptoapi.c
> index 30eba7b2..a82c52ad 100644
> --- a/src/openvpn/cryptoapi.c
> +++ b/src/openvpn/cryptoapi.c
> @@ -39,6 +39,10 @@
>  
>  #ifdef ENABLE_CRYPTOAPI
>  
> +#ifdef ENABLE_CRYPTO_WOLFSSL
> +#error wolfSSL does not support CryptoAPI
> +#endif
> +

Except of the documentation effect, wouldn't it be better to handle that in
syshead.h instead?

In syshead.h, I see this:
----------------------------------
#if defined(_WIN32) && defined(ENABLE_CRYPTO_OPENSSL)
#define ENABLE_CRYPTOAPI
#endif
----------------------------------

This is the only place I could find defining this macro.  So extending it with
&& !defined(ENABLE_CRYPTO_WOLFSSL) would eliminate the need to worry about the
ENABLE_CRYPTOAPI elsewhere.

Has this patch been tested against Windows builds with WolfSSL enabled, like
via mingw?
Juliusz Sosinowicz April 16, 2020, 10:42 a.m. | #4
Hi Arne,

On 15/04/2020 11:31, Arne Schwabe wrote:
> Am 14.04.20 um 20:52 schrieb Juliusz Sosinowicz:
>> This patch adds support for wolfSSL in OpenVPN. Support is added by using wolfSSL's OpenSSL compatibility layer. Function calls are left unchanged and instead the OpenSSL includes point to wolfSSL headers and OpenVPN is linked against the wolfSSL library.
>>
>> As requested by OpenVPN maintainers, this patch does not include wolfssl/options.h on its own. By defining the macro EXTERNAL_OPTS_OPENVPN in the configure script wolfSSL will include wolfssl/options.h on its own (change added in https://github.com/wolfSSL/wolfssl/pull/2825). The patch adds an option '--disable-wolfssl-options-h' in case the user would like to supply their own settings file for wolfSSL.
>>
> Thanks the patch is lot less intrusive then the last version. We will
> have to discuss in our meeting under what condition we want to include
> the patch. We might add a note or statement that the WolfSSL support in
> OpenVPN is mainly developed and tested by WolfSSL itself or something
> along these lines.
This is understandable since we will be maintaining wolfSSL within OpenVPN.
>> diff --git a/src/openvpn/crypto.c b/src/openvpn/crypto.c
>> index 453cb20a..73da5fa7 100644
>> --- a/src/openvpn/crypto.c
>> +++ b/src/openvpn/crypto.c
>> @@ -428,7 +428,7 @@ openvpn_decrypt_aead(struct buffer *buf, struct buffer work,
>>       tag_ptr = BPTR(buf);
>>       ASSERT(buf_advance(buf, tag_size));
>>       dmsg(D_PACKET_CONTENT, "DECRYPT MAC: %s", format_hex(tag_ptr, tag_size, 0, &gc));
>> -#if defined(ENABLE_CRYPTO_OPENSSL) && OPENSSL_VERSION_NUMBER < 0x10001040L
>> +#if (defined(ENABLE_CRYPTO_OPENSSL) && OPENSSL_VERSION_NUMBER < 0x10001040L) || defined(ENABLE_CRYPTO_WOLFSSL)
>>       /* OpenSSL <= 1.0.1c bug requires set tag before processing ciphertext */
>>       if (!EVP_CIPHER_CTX_ctrl(ctx->cipher, EVP_CTRL_GCM_SET_TAG, tag_size, tag_ptr))
>>       {
> Are you sure that WolfSSL requires a workaround for old OpenSSL version
> before 1.0.1d?
wolfSSL is built around one-shot APIs as oppose to OpenSSL's stream 
APIs. The reason for using this workaround is that the authentication 
tag is checked in the Update call not the Final call. I'll look into 
fixing this issue.
> Arne
>
Thanks!
Juliusz
Juliusz Sosinowicz April 16, 2020, 10:49 a.m. | #5
Hi Gert,

thanks for the suggestion. I will change this in the next patch after 
looking into the issue that Arne brought up.

On 15/04/2020 11:48, Gert Doering wrote:
> Hi,
>
> as Arne said, this is much better.
>
> On Tue, Apr 14, 2020 at 08:52:14PM +0200, Juliusz Sosinowicz wrote:
>> This patch adds support for wolfSSL in OpenVPN. Support is added by using wolfSSL's OpenSSL compatibility layer. Function calls are left unchanged and instead the OpenSSL includes point to wolfSSL headers and OpenVPN is linked against the wolfSSL library.
> [..]
>
> There is one thing, though:
>
>> index 30eba7b2..a82c52ad 100644
>> --- a/src/openvpn/cryptoapi.c
>> +++ b/src/openvpn/cryptoapi.c
>> @@ -39,6 +39,10 @@
>>   
>>   #ifdef ENABLE_CRYPTOAPI
>>   
>> +#ifdef ENABLE_CRYPTO_WOLFSSL
>> +#error wolfSSL does not support CryptoAPI
>> +#endif
>> +
> I do not like this very much.  It will, effectively, break win32 builds
> with WolfSSL - and add yet another #ifdef to our .c files.
>
> ENABLE_CRYPTOAPI is defined in syshead.h
>
> #if defined(_WIN32) && defined(ENABLE_CRYPTO) && defined(ENABLE_CRYPTO_OPENSSL)
> #define ENABLE_CRYPTOAPI
> #endif
>
> ... could you investigate whether it would be sufficient to just
> conditionalize this on WolfSSL, like this?
>
> #if defined(_WIN32) && defined(ENABLE_CRYPTO) && \
> 	defined(ENABLE_CRYPTO_OPENSSL) && !defined(ENABLE_CRYPTO_WOLFSSL)
> #define ENABLE_CRYPTOAPI
> #endif
>
> so you can have WolfSSL-linked binaries for Windows, just without
> CryptoAPI support (as with mbedtls)...
>
> gert
>
Sincerely
Juliusz
Arne Schwabe April 16, 2020, 11:11 a.m. | #6
Am 16.04.20 um 12:42 schrieb Juliusz Sosinowicz:
> Hi Arne,
> 
> On 15/04/2020 11:31, Arne Schwabe wrote:
>> Am 14.04.20 um 20:52 schrieb Juliusz Sosinowicz:
>>> This patch adds support for wolfSSL in OpenVPN. Support is added by
>>> using wolfSSL's OpenSSL compatibility layer. Function calls are left
>>> unchanged and instead the OpenSSL includes point to wolfSSL headers
>>> and OpenVPN is linked against the wolfSSL library.
>>>
>>> As requested by OpenVPN maintainers, this patch does not include
>>> wolfssl/options.h on its own. By defining the macro
>>> EXTERNAL_OPTS_OPENVPN in the configure script wolfSSL will include
>>> wolfssl/options.h on its own (change added in
>>> https://github.com/wolfSSL/wolfssl/pull/2825). The patch adds an
>>> option '--disable-wolfssl-options-h' in case the user would like to
>>> supply their own settings file for wolfSSL.
>>>
>> Thanks the patch is lot less intrusive then the last version. We will
>> have to discuss in our meeting under what condition we want to include
>> the patch. We might add a note or statement that the WolfSSL support in
>> OpenVPN is mainly developed and tested by WolfSSL itself or something
>> along these lines.
> This is understandable since we will be maintaining wolfSSL within OpenVPN.


Could you take a look if this is an acceptable text for a README.wolfssl?

Support for WolfSSL is implemented and maintained by WolfSSL Inc. The
support is implemented using WolfSSL's compatiblity layer. The WolfSSL
support in OpenVPN receives very limited testing/support from the
OpenVPN community itself.

If bugs in OpenVPN when using WolfSSL are encountered, the user should
try to also compile OpenVPN with OpenSSL to determinate if these are
bugs in the WolfSSL TLS implemenation or OpenVPN itself.

To Build and Install,

	./configure --with-crypto-library=wolfssl
	make
	make install

*************************************************************************
Due to limitations in the wolfSSL TLS library or its compability layer, the
following features are missing

 * blowfish support (BF-CBC), you must use something like
   cipher AES-128-CBC to avoid trying to use BF-CBC
 * Windows CryptoAPI support
Juliusz Sosinowicz April 16, 2020, 3:04 p.m. | #7
The Readme looks good. Just one suggestion.

On 16/04/2020 13:11, Arne Schwabe wrote:
> Am 16.04.20 um 12:42 schrieb Juliusz Sosinowicz:
>> Hi Arne,
>>
>> On 15/04/2020 11:31, Arne Schwabe wrote:
>>> Am 14.04.20 um 20:52 schrieb Juliusz Sosinowicz:
>>>> This patch adds support for wolfSSL in OpenVPN. Support is added by
>>>> using wolfSSL's OpenSSL compatibility layer. Function calls are left
>>>> unchanged and instead the OpenSSL includes point to wolfSSL headers
>>>> and OpenVPN is linked against the wolfSSL library.
>>>>
>>>> As requested by OpenVPN maintainers, this patch does not include
>>>> wolfssl/options.h on its own. By defining the macro
>>>> EXTERNAL_OPTS_OPENVPN in the configure script wolfSSL will include
>>>> wolfssl/options.h on its own (change added in
>>>> https://github.com/wolfSSL/wolfssl/pull/2825). The patch adds an
>>>> option '--disable-wolfssl-options-h' in case the user would like to
>>>> supply their own settings file for wolfSSL.
>>>>
>>> Thanks the patch is lot less intrusive then the last version. We will
>>> have to discuss in our meeting under what condition we want to include
>>> the patch. We might add a note or statement that the WolfSSL support in
>>> OpenVPN is mainly developed and tested by WolfSSL itself or something
>>> along these lines.
>> This is understandable since we will be maintaining wolfSSL within OpenVPN.
>
> Could you take a look if this is an acceptable text for a README.wolfssl?
>
> Support for WolfSSL is implemented and maintained by WolfSSL Inc. The
> support is implemented using WolfSSL's compatiblity layer. The WolfSSL
> support in OpenVPN receives very limited testing/support from the
> OpenVPN community itself.
>
> If bugs in OpenVPN when using WolfSSL are encountered, the user should
> try to also compile OpenVPN with OpenSSL to determinate if these are
> bugs in the WolfSSL TLS implemenation or OpenVPN itself.
>
> To Build and Install,
>
> 	./configure --with-crypto-library=wolfssl
> 	make
> 	make install

I would add here:

The wolfSSL library will include the installed options.h file by 
default. To include a custom user_settings.h file for wolfSSL,

./configure --with-crypto-library=wolfssl --disable-wolfssl-options-h
make
make install

>
> *************************************************************************
> Due to limitations in the wolfSSL TLS library or its compability layer, the
> following features are missing
>
>   * blowfish support (BF-CBC), you must use something like
>     cipher AES-128-CBC to avoid trying to use BF-CBC
>   * Windows CryptoAPI support
>

Patch

diff --git a/configure.ac b/configure.ac
index fcec7389..53ad3181 100644
--- a/configure.ac
+++ b/configure.ac
@@ -276,16 +276,23 @@  AC_ARG_WITH(
 
 AC_ARG_WITH(
 	[crypto-library],
-	[AS_HELP_STRING([--with-crypto-library=library], [build with the given crypto library, TYPE=openssl|mbedtls @<:@default=openssl@:>@])],
+	[AS_HELP_STRING([--with-crypto-library=library], [build with the given crypto library, TYPE=openssl|mbedtls|wolfssl @<:@default=openssl@:>@])],
 	[
 		case "${withval}" in
-			openssl|mbedtls) ;;
+			openssl|mbedtls|wolfssl) ;;
 			*) AC_MSG_ERROR([bad value ${withval} for --with-crypto-library]) ;;
 		esac
 	],
 	[with_crypto_library="openssl"]
 )
 
+AC_ARG_ENABLE(
+	[wolfssl-options-h],
+	[AS_HELP_STRING([--disable-wolfssl-options-h], [Disable including options.h in wolfSSL @<:@default=yes@:>@])],
+	,
+	[enable_wolfssl_options_h="yes"]
+)
+
 AC_ARG_VAR([PLUGINDIR], [Path of plug-in directory @<:@default=LIBDIR/openvpn/plugins@:>@])
 if test -n "${PLUGINDIR}"; then
 	plugindir="${PLUGINDIR}"
@@ -1029,6 +1036,86 @@  elif test "${with_crypto_library}" = "mbedtls"; then
 	AC_DEFINE([ENABLE_CRYPTO_MBEDTLS], [1], [Use mbed TLS library])
 	CRYPTO_CFLAGS="${MBEDTLS_CFLAGS}"
 	CRYPTO_LIBS="${MBEDTLS_LIBS}"
+
+elif test "${with_crypto_library}" = "wolfssl"; then
+	AC_ARG_VAR([WOLFSSL_CFLAGS], [C compiler flags for wolfssl])
+	AC_ARG_VAR([WOLFSSL_LIBS], [linker flags for wolfssl])
+	AC_ARG_VAR([WOLFSSL_DIR], [Path to the wolfssl directory @<:@default=/usr/local/include/wolfssl@:>@])
+	if test -n "${WOLFSSL_DIR}"; then
+		wolfssldir="${WOLFSSL_DIR}"
+	else
+		wolfssldir="/usr/local/include/wolfssl"
+	fi
+
+	saved_CFLAGS="${CFLAGS}"
+	saved_LIBS="${LIBS}"
+
+	if test -z "${WOLFSSL_CFLAGS}" -a -z "${WOLFSSL_LIBS}"; then
+		# if the user did not explicitly specify flags, try to autodetect
+		LIBS="${LIBS} -lwolfssl -lm -pthread"
+		AC_CHECK_LIB(
+			[wolfssl],
+			[wolfSSL_Init],
+			[],
+			[AC_MSG_ERROR([Could not link wolfSSL library.])]
+		)
+		AC_CHECK_HEADER([wolfssl/options.h],,[AC_MSG_ERROR([wolfSSL header wolfssl/options.h not found!])])
+	fi
+
+	AC_DEFINE([HAVE_HMAC_CTX_NEW], [1], [Emulate AC_CHECK_FUNCS since these are defined as macros])
+	AC_DEFINE([HAVE_HMAC_CTX_FREE], [1], [Emulate AC_CHECK_FUNCS since these are defined as macros])
+	AC_DEFINE([HAVE_HMAC_CTX_RESET], [1], [Emulate AC_CHECK_FUNCS since these are defined as macros])
+	AC_DEFINE([HAVE_EVP_MD_CTX_NEW], [1], [Emulate AC_CHECK_FUNCS since these are defined as macros])
+	AC_DEFINE([HAVE_EVP_MD_CTX_FREE], [1], [Emulate AC_CHECK_FUNCS since these are defined as macros])
+	AC_DEFINE([HAVE_EVP_MD_CTX_RESET], [1], [Emulate AC_CHECK_FUNCS since these are defined as macros])
+	AC_DEFINE([HAVE_OPENSSL_VERSION], [1], [Emulate AC_CHECK_FUNCS since these are defined as macros])
+	AC_DEFINE([HAVE_SSL_CTX_GET_DEFAULT_PASSWD_CB], [1], [Emulate AC_CHECK_FUNCS since these are defined as macros])
+	AC_DEFINE([HAVE_SSL_CTX_GET_DEFAULT_PASSWD_CB_USERDATA], [1], [Emulate AC_CHECK_FUNCS since these are defined as macros])
+	AC_DEFINE([HAVE_SSL_CTX_SET_SECURITY_LEVEL], [1], [Emulate AC_CHECK_FUNCS since these are defined as macros])
+	AC_DEFINE([HAVE_X509_GET0_PUBKEY], [1], [Emulate AC_CHECK_FUNCS since these are defined as macros])
+	AC_DEFINE([HAVE_X509_STORE_GET0_OBJECTS], [1], [Emulate AC_CHECK_FUNCS since these are defined as macros])
+	AC_DEFINE([HAVE_X509_OBJECT_FREE], [1], [Emulate AC_CHECK_FUNCS since these are defined as macros])
+	AC_DEFINE([HAVE_X509_OBJECT_GET_TYPE], [1], [Emulate AC_CHECK_FUNCS since these are defined as macros])
+	AC_DEFINE([HAVE_EVP_PKEY_ID], [1], [Emulate AC_CHECK_FUNCS since these are defined as macros])
+	AC_DEFINE([HAVE_EVP_PKEY_GET0_RSA], [1], [Emulate AC_CHECK_FUNCS since these are defined as macros])
+	AC_DEFINE([HAVE_EVP_PKEY_GET0_DSA], [1], [Emulate AC_CHECK_FUNCS since these are defined as macros])
+	AC_DEFINE([HAVE_EVP_PKEY_GET0_EC_KEY], [1], [Emulate AC_CHECK_FUNCS since these are defined as macros])
+	AC_DEFINE([HAVE_RSA_SET_FLAGS], [1], [Emulate AC_CHECK_FUNCS since these are defined as macros])
+	AC_DEFINE([HAVE_RSA_BITS], [1], [Emulate AC_CHECK_FUNCS since these are defined as macros])
+	AC_DEFINE([HAVE_RSA_GET0_KEY], [1], [Emulate AC_CHECK_FUNCS since these are defined as macros])
+	AC_DEFINE([HAVE_RSA_SET0_KEY], [1], [Emulate AC_CHECK_FUNCS since these are defined as macros])
+	AC_DEFINE([HAVE_DSA_GET0_PQG], [1], [Emulate AC_CHECK_FUNCS since these are defined as macros])
+	AC_DEFINE([HAVE_DSA_BITS], [1], [Emulate AC_CHECK_FUNCS since these are defined as macros])
+	AC_DEFINE([HAVE_RSA_METH_NEW], [1], [Emulate AC_CHECK_FUNCS since these are defined as macros])
+	AC_DEFINE([HAVE_RSA_METH_FREE], [1], [Emulate AC_CHECK_FUNCS since these are defined as macros])
+	AC_DEFINE([HAVE_RSA_METH_SET_PUB_ENC], [1], [Emulate AC_CHECK_FUNCS since these are defined as macros])
+	AC_DEFINE([HAVE_RSA_METH_SET_PUB_DEC], [1], [Emulate AC_CHECK_FUNCS since these are defined as macros])
+	AC_DEFINE([HAVE_RSA_METH_SET_PRIV_ENC], [1], [Emulate AC_CHECK_FUNCS since these are defined as macros])
+	AC_DEFINE([HAVE_RSA_METH_SET_PRIV_DEC], [1], [Emulate AC_CHECK_FUNCS since these are defined as macros])
+	AC_DEFINE([HAVE_RSA_METH_SET_INIT], [1], [Emulate AC_CHECK_FUNCS since these are defined as macros])
+	AC_DEFINE([HAVE_RSA_METH_SET_SIGN], [1], [Emulate AC_CHECK_FUNCS since these are defined as macros])
+	AC_DEFINE([HAVE_RSA_METH_SET_FINISH], [1], [Emulate AC_CHECK_FUNCS since these are defined as macros])
+	AC_DEFINE([HAVE_RSA_METH_SET0_APP_DATA], [1], [Emulate AC_CHECK_FUNCS since these are defined as macros])
+	AC_DEFINE([HAVE_RSA_METH_GET0_APP_DATA], [1], [Emulate AC_CHECK_FUNCS since these are defined as macros])
+	AC_DEFINE([HAVE_EC_GROUP_ORDER_BITS], [1], [Emulate AC_CHECK_FUNCS since these are defined as macros])
+	
+	have_crypto_aead_modes="yes"
+	have_crypto="yes"
+    
+	if test "${enable_wolfssl_options_h}" = "yes"; then
+		AC_DEFINE([EXTERNAL_OPTS_OPENVPN], [1], [Include options.h from wolfSSL library])
+	else
+		AC_DEFINE([WOLFSSL_USER_SETTINGS], [1], [Use custom user_settings.h file for wolfSSL library])
+	fi
+	
+	WOLFSSL_CFLAGS="${WOLFSSL_CFLAGS} -I${wolfssldir}"
+	CFLAGS="${WOLFSSL_CFLAGS} ${CFLAGS}"
+	LIBS="${WOLFSSL_LIBS} ${LIBS}"
+	
+	AC_DEFINE([ENABLE_CRYPTO_WOLFSSL], [1], [Use wolfSSL crypto library])
+	AC_DEFINE([ENABLE_CRYPTO_OPENSSL], [1], [Use wolfSSL openssl compatibility layer])
+	CRYPTO_CFLAGS="${WOLFSSL_CFLAGS}"
+	CRYPTO_LIBS="${WOLFSSL_LIBS}"
 else
 	AC_MSG_ERROR([Invalid crypto library: ${with_crypto_library}])
 fi
diff --git a/src/openvpn/crypto.c b/src/openvpn/crypto.c
index 453cb20a..73da5fa7 100644
--- a/src/openvpn/crypto.c
+++ b/src/openvpn/crypto.c
@@ -428,7 +428,7 @@  openvpn_decrypt_aead(struct buffer *buf, struct buffer work,
     tag_ptr = BPTR(buf);
     ASSERT(buf_advance(buf, tag_size));
     dmsg(D_PACKET_CONTENT, "DECRYPT MAC: %s", format_hex(tag_ptr, tag_size, 0, &gc));
-#if defined(ENABLE_CRYPTO_OPENSSL) && OPENSSL_VERSION_NUMBER < 0x10001040L
+#if (defined(ENABLE_CRYPTO_OPENSSL) && OPENSSL_VERSION_NUMBER < 0x10001040L) || defined(ENABLE_CRYPTO_WOLFSSL)
     /* OpenSSL <= 1.0.1c bug requires set tag before processing ciphertext */
     if (!EVP_CIPHER_CTX_ctrl(ctx->cipher, EVP_CTRL_GCM_SET_TAG, tag_size, tag_ptr))
     {
diff --git a/src/openvpn/cryptoapi.c b/src/openvpn/cryptoapi.c
index 30eba7b2..a82c52ad 100644
--- a/src/openvpn/cryptoapi.c
+++ b/src/openvpn/cryptoapi.c
@@ -39,6 +39,10 @@ 
 
 #ifdef ENABLE_CRYPTOAPI
 
+#ifdef ENABLE_CRYPTO_WOLFSSL
+#error wolfSSL does not support CryptoAPI
+#endif
+
 #include <openssl/ssl.h>
 #include <openssl/evp.h>
 #include <openssl/err.h>