multissl: make openssl + wolfssl builds work

[vszakats]

• make colliding vtls static function names unique.
• wolfssl: stop including an unused compatibility header.
• cmake: adapt detection logic for openssl+wolfssl coexist.
• wolfssl: fix to use native wolfSSL API in ECH codepath.
• openssl+wolfssl: fix ECH code to coexist.

Requires a post wolfSSL v5.7.4, recent master for OPENSSL_COEXIST
feature, and CPPFLAGS=-DOPENSSL_COEXIST.

Ref: wolfSSL/wolfssl#8194

---

• auto-enable and other steps →multissl: auto-enable OPENSSL_COEXIST for wolfSSL + OpenSSL #15765
  • finalize cutoff version for wolfSSL's OPENSSL_COEXIST.
  • wait for wolfSSL release with coexist support.
    then add logic to auto-enable OPENSSL_COEXIST for wolfSSL.
  • wait for vcpkg supporting that version.
  • enable wolfSSL in the vcpkg MultiSSL job.
• perhaps merge 20241126-wolf-opensslcoexist-expansion #15650 into this PR? [MERGED ORGINAL PR]
• finalize if the OTHERNAME and MD5_CTX collision workarounds
  are still necessary. → 20241122-opensslcoexist-expansion wolfSSL/wolfssl#8216

[bagder]

You need wolfSSL from their git master still to do a combo-build with OpenSSL. I presume that will come proper in their next release.

[vszakats]

You need wolfSSL from their git master still to do a combo-build with OpenSSL. I presume that will come proper in their next release.

Yes, I'm testing this with wolfSSL master. This clears the way for the wolfSSL feature when it's released.

[vszakats]

It seems the way we build wolfSSL in CI isn't going to be
compatible with "coexist" mode, nor will be any distros
building it with --enable-all:

In file included from /path/to/wolfssl.git/_pkg/include/wolfssl/ssl.h:33:
/path/to/wolfssl.git/_pkg/include/wolfssl/wolfcrypt/settings.h:4239:6: error: "OPENSSL_ALL can not be defined with OPENSSL_COEXIST"
    #error "OPENSSL_ALL can not be defined with OPENSSL_COEXIST"
     ^

Such distros are Homebrew and Debian AFAIK.

[talregev]

wolfssl vcpkg have now ech feature. Can you check that it correct and work in the tests?

[talregev]

Can we add in the curl --version if the ech feature is working or not?

[vszakats]

Can we add in the curl --version if the ech feature is working or not?

It's already there if enabled:

Features: [...] ECH [...]

[talregev]

Can we add in the curl --version if the ech feature is working or not?

It's already there if enabled:

Features: [...] ECH [...]

It not working, while wolfssl vcpkg is compile with:
What is missing?

      -DWOLFSSL_ECH=yes
      -DWOLFSSL_HPKE=yes
      -DWOLFSSL_SNI=yes

https://github.com/curl/curl/actions/runs/12034376811/job/33550798676?pr=15438#step:10:36

[talregev]

Can we add in the curl --version if the ech feature is working or not?

It's already there if enabled:

Features: [...] ECH [...]

We need add a curl flag to enable ech?

[talregev]

I now understand:
#15647

[vszakats]

Can we add in the curl --version if the ech feature is working or not?

It's already there if enabled:

Features: [...] ECH [...]

We need add a curl flag to enable ech?

Yes, the two options already enabled for BoringSSL.

[talregev]

Can we add in the curl --version if the ech feature is working or not?

It's already there if enabled:

Features: [...] ECH [...]

We need add a curl flag to enable ech?

Yes, the two options already enabled for BoringSSL.

I enable only -DUSE_ECH=ON for wolfssl. It have a compilation error. Am I missing something?
Can you take a look on my PR?

[talregev]

@vszakats Happy to see you that you back! :)

[vszakats]

@vszakats Happy to see you that you back! :)

Thanks @talregev! :) I'm dealing with a little bit of offline stuff these weeks (and looking forward for the feature window).

[talregev]

Looking forward the feature windows too!
Good to see you back :)

[vszakats]

I dropped the auto-enable logic from this PR and will open it separately once a stable wolfSSL release allows it.

It means this PR is ready to merge to fix remaining coexist issues and enable using it with compatible wolfSSL revisions.