Asn1parse by aidankeefe2022 · Pull Request #253 · wolfSSL/wolfCLU

aidankeefe2022 · 2026-06-17T23:04:01Z

This is based on the asn1.c in the wolfSSL examples. But with the added new strparse feature which allows for the re-parsing of BIT STRINGS and OCTET STRINGS. And the ability for the user to load a custom OID database. Both of these are feature ideas from OpenSSL

The flags and behavior are meant to mimic OpenSSL to allow for users to be comfortable with the tool. Not all of the asn1parse capability is included however.

A man page has been created along with tests for this tool.

A new flag was introduced that enables the build in OID table this is because the table make the binary pretty large. We could remove the table or make it always on if the configure flag is overkill.

The diff says +7000 something but minus the OID table it is about 2000 new lines. The table was taken from asn1.c example code.

If wolfSSL is 5.9.2 or less the -oid feature will not work due to API break

aidankeefe2022 · 2026-06-17T23:04:45Z

Tests will fail until wolfssl get this PR merged

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #253

Scan targets checked: wolfclu-bugs, wolfclu-src

Findings: 2
2 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #253

Scan targets checked: wolfclu-bugs, wolfclu-src

No new issues found in the changed files. ✅

cconlon · 2026-07-01T21:26:25Z

+    if (ret == WOLFCLU_SUCCESS) {
+        /* oid is overwritten by and replaces with DER encoding */
+        XMEMSET(oid, '\0', *oidSz);
+        if ((err = wc_EncodeObjectId(arc, idx, (byte*)oid, oidSz)) != 0) {


Claude has some thoughts on an extra check in this function:

The -oid file format is per line; if the OID field contains only a single number with no dots (e.g. the line 5 myName My Long Name), OidToDer allocates the arc array with one element per character of the OID string — here just 1 — and calls wc_EncodeObjectId(arc, 1, ...). wolfSSL's EncodeObjectId only rejects inSz <= 0 and always computes the first byte as in[0]*40 + in[1], so with inSz == 1 it reads arc[1], one element past the end of the heap allocation. Please reject OIDs with fewer than 2 components before calling wc_EncodeObjectId.

I made a PR to wolfSSL that adds this check to wc_EncodeObjectId. Should we have checks in both spots for backwards compatibility?

Just checked again and the wc_EncodeObjectId function is not compiled in unless it has the updated arg checking this is guarded by the NO_WC_ENCODE_OBJECT_ID macro that checks wolfSSL version

Is this still an issue? It looks like this could still happen from glancing at wc_EncodeObjectId().

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #253

Scan targets checked: wolfclu-bugs, wolfclu-src

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

aidankeefe2022 · 2026-07-02T19:15:41Z

Jenkins retest this please

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #253

Scan targets checked: wolfclu-bugs, wolfclu-src

No new issues found in the changed files. ✅

philljj · 2026-07-09T17:07:19Z

Has conflicts now:

wolfclu/clu_header_main.h
wolfclu/clu_optargs.h

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #253

Scan targets checked: wolfclu-bugs, wolfclu-src

Findings: 2
2 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

wolfSSL-Fenrir-bot · 2026-07-14T23:32:28Z

+        return MEMORY_E;
+    }
+
+    if (XFREAD(*buffer, sizeof(char), fileLen, fp) != (word32)fileLen) {


🔵 [Low] Integer truncation in asn1_ReadFile XFREAD check and bufLen assignment · Integer overflows

XFREAD returns size_t (64-bit on LP64) but is compared against (word32)fileLen, silently truncating fileLen when it exceeds UINT32_MAX; *bufLen = (word32)fileLen at line 364 has the same truncation, causing callers to operate with a wrong data size.

Fix: Cast the XFREAD return value and fileLen consistently to size_t, and add an explicit fileLen > (long)UINT32_MAX guard before narrowing to word32.

It might be worth specifying a max file size (that's lower than max word32) to compare against before truncating to word32.

philljj

Looks cool. Here's my first pass review.

philljj · 2026-07-15T14:21:08Z

+        XFREE(p->entries , HEAP_HINT, DYNAMIC_TYPE_TMP_BUFFER);
+    }
+
+    XMEMSET(p, 0, sizeof(*p));


This XMEMSET should probably be wc_ForceZero to prevent compiler optimizing it away.

philljj · 2026-07-15T14:25:54Z

+static int WOLFCLU_OID_TO_NAME_free(WOLFCLU_OID_TO_NAME* p)
+{
+    if (p->dataBuffer != NULL) {
+        XFREE(p->dataBuffer, HEAP_HINT, DYNAMIC_TYPE_TMP_BUFFER);


Do p->dataBuffer or p->entries hold sensitive (private key, etc) data?

If so, then need wc_ForceZero() here as well.

But you will need to save off the length of dataBuffer and entries members during WOLFCLU_OID_TO_NAME_initWFile().

Nothing sensitive!

philljj · 2026-07-15T14:31:13Z

+        return MEMORY_E;
+    }
+
+    if (XFREAD(*buffer, sizeof(char), fileLen, fp) != (word32)fileLen) {


It might be worth specifying a max file size (that's lower than max word32) to compare against before truncating to word32.

philljj · 2026-07-15T14:37:20Z

+    if (ret == WOLFCLU_SUCCESS) {
+        /* oid is overwritten by and replaces with DER encoding */
+        XMEMSET(oid, '\0', *oidSz);
+        if ((err = wc_EncodeObjectId(arc, idx, (byte*)oid, oidSz)) != 0) {


Is this still an issue? It looks like this could still happen from glancing at wc_EncodeObjectId().

philljj · 2026-07-15T14:40:09Z

+
+typedef struct WOLFCLU_OID_TO_NAME{
+    OidName* entries;
+    byte* dataBuffer;


I think the WOLFCLU_OID_TO_NAME members need some short comments explaining what they do.

E.g. when I first looked in the code it seemed dataBuffer wasn't actually used, before I realized entries is a dynamic table that indexes tokens into dataBuffer.

philljj · 2026-07-15T14:48:48Z

+
+#ifdef HAVE_OID_TABLE
+
+static const OidName oid_name_table[] = {


Maybe add a comment saying this is from examples/asn1/oid_names.h from wolfssl repo.

philljj · 2026-07-15T14:57:15Z

+    }
+    if (ret == WOLFCLU_SUCCESS) {
+        /* Confirm header. */
+        for (i += 10; i < len; i++) {


It could be replaced with something like

#define BEGIN_PRIV_KEY_PREFIX "-----BEGIN"

or like we do in wolfcrypt/src/asn.c

static wcchar BEGIN_PRIV_KEY_PREFIX = "-----BEGIN";

with openssl. added help to explain oid command added comments to header file resolved configure.ac merge conflict added oid support to header includes added man page for asn1parse and fixed more skoll oid are properly handled Made -out output DER of input after processing Removed extra fmt file and put all in parse custom oid now compiled out for 5.9.2 added header to include.am fenrir fixes moved oid table added WOLFSSL_ASN_PRINT to windows build skoll fixes

aidankeefe2022 requested a review from wolfSSL-Fenrir-bot June 17, 2026 23:04

aidankeefe2022 self-assigned this Jun 17, 2026

wolfSSL-Fenrir-bot reviewed Jun 17, 2026

View reviewed changes

Comment thread wolfclu/asn1/clu_asn1.h Outdated

Comment thread src/asn1/clu_asn1_fmt.c Outdated

aidankeefe2022 commented Jun 18, 2026

View reviewed changes

Comment thread src/asn1/clu_asn1_fmt.c Outdated

aidankeefe2022 commented Jun 18, 2026

View reviewed changes

Comment thread wolfclu/asn1/clu_asn1.h Outdated

aidankeefe2022 force-pushed the ans1-parser branch 7 times, most recently from e0068dd to cfd1d42 Compare June 22, 2026 17:50

aidankeefe2022 assigned cconlon and unassigned aidankeefe2022 Jun 22, 2026

aidankeefe2022 force-pushed the ans1-parser branch from cfd1d42 to 62149fa Compare June 24, 2026 19:35

aidankeefe2022 requested a review from wolfSSL-Fenrir-bot June 25, 2026 16:54

wolfSSL-Fenrir-bot reviewed Jun 25, 2026

View reviewed changes

cconlon requested changes Jul 1, 2026

View reviewed changes

cconlon assigned aidankeefe2022 and unassigned cconlon Jul 1, 2026

aidankeefe2022 force-pushed the ans1-parser branch 3 times, most recently from eb7fef0 to 9a1ccd0 Compare July 2, 2026 18:28

aidankeefe2022 requested a review from wolfSSL-Fenrir-bot July 2, 2026 18:40

wolfSSL-Fenrir-bot reviewed Jul 2, 2026

View reviewed changes

Comment thread src/asn1/clu_asn1_parse.c

aidankeefe2022 commented Jul 2, 2026

View reviewed changes

Comment thread src/asn1/clu_asn1_parse.c

aidankeefe2022 force-pushed the ans1-parser branch 2 times, most recently from 4b15fc7 to 60b6f5a Compare July 2, 2026 21:59

aidankeefe2022 force-pushed the ans1-parser branch from a3256a0 to 3f3b934 Compare July 6, 2026 16:48

aidankeefe2022 assigned cconlon and unassigned aidankeefe2022 Jul 6, 2026

aidankeefe2022 requested review from cconlon and wolfSSL-Fenrir-bot July 6, 2026 17:32

wolfSSL-Fenrir-bot reviewed Jul 6, 2026

View reviewed changes

dgarske assigned wolfSSL-Bot and philljj and unassigned cconlon Jul 7, 2026

dgarske requested a review from philljj July 7, 2026 21:39

philljj assigned aidankeefe2022 and unassigned philljj and wolfSSL-Bot Jul 9, 2026

aidankeefe2022 force-pushed the ans1-parser branch from 3f3b934 to f8136dc Compare July 14, 2026 21:07

aidankeefe2022 assigned wolfSSL-Fenrir-bot and unassigned aidankeefe2022 Jul 14, 2026

wolfSSL-Fenrir-bot reviewed Jul 14, 2026

View reviewed changes

philljj assigned philljj and unassigned wolfSSL-Fenrir-bot Jul 15, 2026

philljj requested changes Jul 15, 2026

View reviewed changes

philljj assigned aidankeefe2022 and unassigned philljj Jul 15, 2026

aidankeefe2022 force-pushed the ans1-parser branch 5 times, most recently from b4694a2 to f91a34d Compare July 15, 2026 20:32

aidankeefe2022 force-pushed the ans1-parser branch from f91a34d to 98aa32a Compare July 15, 2026 20:46


		#ifdef HAVE_OID_TABLE

		static const OidName oid_name_table[] = {

Uh oh!

Conversation

aidankeefe2022 commented Jun 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

aidankeefe2022 commented Jun 17, 2026

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #253

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #253

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

aidankeefe2022 Jul 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #253

Uh oh!

Uh oh!

Uh oh!

aidankeefe2022 commented Jul 2, 2026

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #253

Uh oh!

philljj commented Jul 9, 2026

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #253

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

philljj left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

philljj Jul 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

aidankeefe2022 commented Jun 17, 2026 •

edited

Loading

aidankeefe2022 Jul 2, 2026 •

edited

Loading

philljj Jul 15, 2026 •

edited

Loading