FFI: Generic getter(s) for X.509 objects by reneme · Pull Request #5188 · randombit/botan

reneme · 2025-12-22T15:33:04Z

We're currently working on extending the strongswan botan plugin to parse and verify X.509 certificates and CRLs using Botan. That use case requires adding a number of new getters to fetch detailed information from certificates and CRLs, many of which are duplicated for both types like the raw signature bits, the serial number or the (optional) authority key ID.

Instead of extending the FFI with several new functions (including the duplication for botan_x509_cert_t and botan_x509_crl_t) we would like to propose a more generic API that can work with both types and provide access to a number of (shared) data fields, like so:

int copy_to_buffer(void*, uint8_t* bin, size_t); // some binary view function
int copy_to_string(void*, uint8_t* bin, size_t); // some string view function

botan_x509_cert_t cert = /* ... */;
botan_x509_crl_t crl   = /* ... */;

uint8_t cert_akid[32];
uint8_t crl_akid[32];
size_t outlen = 32;
botan_x509_cert_get_binary_values(cert, BOTAN_X509_AUTHORITY_KEY_ID, 0, cert_akid, copy_to_buffer);
botan_x509_crl_get_binary_values(crl , BOTAN_X509_AUTHORITY_KEY_ID, 0, crl_akid, copy_to_buffer);

char uri[128];
int rc = BOTAN_FFI_SUCCESS;
for (size_t i = 0; rc != BOTAN_FFI_ERROR_OUT_OF_RANGE; ++i) {
   rc = botan_x509_cert_get_string_values(cert, BOTAN_X509_OCSP_RESPONDER_URLS, i, uri, copy_to_string);
}
/* ... use the AKIDs somehow */

Our hope is that this significantly reduces the boilerplate and API surface while also being easily extensible by amending the "type enum" in an ABI-compatible way. Note that the proposed API allows to access multi-value fields using a simple index parameter.

Currently, the following data fields can be retrieved via this API:

Data field	Data Type	Certificate	CRL
TBS data	binary	x	x
Signature Bits	binary	x	x
Encoded Signature Scheme	binary	x	x
Encoded Subject DN	binary	x
Encoded Issuer DN	binary	x	x
Subject Key ID	binary	(x)
Authority Key ID	binary	(x)	(x)
Serial Number	binary	x	x
Public Key w/ Algorithm Identifier	binary	x
DER Encoding	binary	x	x
PEM Encoding	string	x	x
CRL distribution points	multi-value string	(x)
OCSP responders	multi-value string	(x)
CA issuers URLs	multi-value string	(x)

randombit · 2025-12-23T03:22:40Z

I'm not firmly against it. I would definitely suggest view-style functions since, with cases like this where the lengths can be somewhat open-ended (especially so given the set of fields might be expanded over time), retry handling is kind of a pain.

OTOH if we have a single kind of getter dispatch function, is there really that much duplication to have 2 instead, one for certs and one for CRLs? One thing I did try for in the FFI interface is making it a type safe as possible when used from C. (This stems from the fact that a major driver of the FFI interface as it exists today is due to the requirements of RNP, which at the time was written entirely in C). This function which will require a cast for either input type bypasses that a bit, and tbh I don't really see how 2 type specific getter-dispatchers would be a problem, admittedly I'm not at all familiar with strongswan internals.

reneme · 2025-12-23T07:21:54Z

I would definitely suggest view-style functions since, with cases like this where the lengths can be somewhat open-ended [...].

👍

OTOH if we have a single kind of getter dispatch function, is there really that much duplication to have 2 instead, one for certs and one for CRLs?

No, we could split it up. Perhaps the boilerplate might grow a bit faster once we introduce additional getters for strings, lists and such. Mostly I was interested in exploring the ergonomics of such a unified API. That said, I think I'll leave it in until the work on the strongswan plugin converges. Reverting this won't be a lot of work anyway.

coveralls · 2025-12-23T14:55:10Z

coverage: 90.409% (+0.02%) from 90.393%
when pulling 9d9388a on Rohde-Schwarz:feature/generic_ffi_getters
into 81beaa2 on randombit:master.

reneme · 2026-01-05T15:51:55Z

In my opinion this is now ready-for-review. Documentation as well as PR description is updated accordingly.
We're heavily relying on this API within the upcoming strongSwan extension and it allows quite ergonomic usage.

OTOH if we have a single kind of getter dispatch function, is there really that much duplication to have 2 instead, one for certs and one for CRLs?

I split the functions into CRL/cert as proposed. The required overhead indeed does not justify the added complexity in the API contract as well as the underlying implementation of the polymorphy.

The potential extension discussed in an inline thread would make a lot of sense, in my opinion. Some details may need further discussion though, so I would suggest to split this off into another PR.

arckoor · 2026-01-05T18:20:24Z

Could you increase the FFI version? Would be nice if it could be the intended release date like outlined here. Also any plans for an impl for the python binding, or should that happen at a later date by someone(tm)? :p

reneme · 2026-01-05T22:06:59Z

Also any plans for an impl for the python binding, or should that happen at a later date by someone(tm)?

Shouldn't be too hard to do. I would leave it to a future step though, once the API in this is finalized.

randombit

Thanks looking good

reneme · 2026-01-12T16:16:36Z

I've added *_count() functions to the generic getters as suggested and addressed the latest review comments.

Re: *_count() - their implementations are maximally trivial for now, basically just actually "counting" how many entries are produced by the enumerator functions where BOTAN_FFI_ERROR_NO_VALUE counts as "0". Given that (1) the enumerators mostly just invoke the viewer functions straight on the C++ objects' memory and (2) long lists are not to-be-expected for X.509 certificates, I believe this is just good enough for now. It definitely has the nice side effect that the *_count() functions aren't at any risk to become inconsistent with the enumerator implementations.

randombit · 2026-02-25T13:48:26Z

@reneme Shit sorry I thought this had already landed on master. Looks goods to me, needs a rebase though.

Namely: * botan_x509_cert_view_binary_values * botan_x509_cert_view_string_values * botan_x509_crl_view_binary_values * botan_x509_crl_view_string_values This allows fetching standard information from X.509 objects such as the serial number of both a certificate and a CRL but also more specific information like OCSP responder URLs. Some getter types may have more than one value. For such cases, the getters have an index parameter to enumerate all elements.

These functions are currently implemented by trivially counting the number of elements their associated enumerator functions are actually producing. Given that most values are anyway viewed straight from the C++ objects' memory, the overhead should be negligible. The main advantage of this approach is its minimal maintenance burden.

reneme · 2026-02-25T14:38:09Z

I thought this had already landed on master.

... actually, me too. We're still waiting on another team to test run this in their system and it fully disappeared from my short term memory. Thanks for noticing and moving it forward.

I applied your suggestion re:"assert unreachable" and rebased to master (testing locally that it compiles/unittests with --disable-modules=x509 as well).

reneme · 2026-02-25T16:32:26Z

@randombit This is now rebased and ready to go. I can haz ✅ plz?

randombit

🍏

reneme requested a review from randombit December 22, 2025 15:33

reneme self-assigned this Dec 22, 2025

reneme added the enhancement Enhancement or new feature label Dec 22, 2025

reneme force-pushed the feature/generic_ffi_getters branch 3 times, most recently from f81c4fb to 28c62c5 Compare December 23, 2025 09:24

arckoor reviewed Dec 27, 2025

View reviewed changes

Comment thread src/lib/ffi/ffi.h Outdated

reneme force-pushed the feature/generic_ffi_getters branch 2 times, most recently from 0324a33 to 08c8fae Compare January 5, 2026 15:46

reneme marked this pull request as ready for review January 5, 2026 15:46

reneme force-pushed the feature/generic_ffi_getters branch from 08c8fae to 7dacff2 Compare January 5, 2026 15:55

reneme commented Jan 5, 2026

View reviewed changes

Comment thread src/lib/ffi/ffi.h

reneme added this to the Botan 3.11 milestone Jan 6, 2026

reneme mentioned this pull request Jan 8, 2026

strongSwan: parse/validate X.509 objects in strongSwan's Botan plugin #5219

Closed

reneme requested a review from atreiber94 January 8, 2026 17:52

reneme mentioned this pull request Jan 9, 2026

Bump the FFI version for 3.11 #5224

Merged

reneme requested a review from Copilot January 9, 2026 13:14

Copilot started reviewing on behalf of reneme January 9, 2026 13:18 View session

This comment was marked as resolved.

Sign in to view

reneme force-pushed the feature/generic_ffi_getters branch from 8cc4c61 to 9824817 Compare January 9, 2026 13:41

reneme mentioned this pull request Jan 11, 2026

FFI: Enumeration of entries in an X.509 CRL #5220

Merged

randombit requested a review from Copilot January 11, 2026 13:31

Copilot started reviewing on behalf of randombit January 11, 2026 13:31 View session

randombit reviewed Jan 11, 2026

View reviewed changes

Comment thread src/lib/ffi/ffi_cert.cpp Outdated

Comment thread src/lib/ffi/ffi_cert.cpp Outdated

reneme force-pushed the feature/generic_ffi_getters branch from 9824817 to 6b8cb78 Compare January 11, 2026 18:50

randombit reviewed Jan 12, 2026

View reviewed changes

Comment thread src/lib/ffi/ffi_cert.cpp

randombit reviewed Jan 12, 2026

View reviewed changes

Comment thread src/lib/ffi/ffi_cert.cpp Outdated

randombit reviewed Jan 12, 2026

View reviewed changes

Comment thread src/lib/ffi/ffi_cert.cpp Outdated

This comment was marked as resolved.

Sign in to view

atreiber94 mentioned this pull request Jan 12, 2026

X509: Multiple OCSP Responders #5231

Merged

reneme force-pushed the feature/generic_ffi_getters branch from 6b8cb78 to 73ba696 Compare January 12, 2026 16:10

reneme requested review from Copilot and randombit January 12, 2026 16:16

Copilot started reviewing on behalf of reneme January 12, 2026 16:20 View session

This comment was marked as resolved.

Sign in to view

reneme force-pushed the feature/generic_ffi_getters branch from 73ba696 to 4497a60 Compare January 12, 2026 16:41

reneme requested a review from Copilot January 12, 2026 16:42

Copilot started reviewing on behalf of reneme January 12, 2026 16:49 View session

This comment was marked as resolved.

Sign in to view

reneme force-pushed the feature/generic_ffi_getters branch 3 times, most recently from a6a6401 to 9d9388a Compare January 14, 2026 06:31

Doc: explain BOTAN_FFI_ERROR_NO_VALUE

6cf5f35

reneme force-pushed the feature/generic_ffi_getters branch from 9d9388a to dc8b17a Compare February 25, 2026 14:30

reneme added 2 commits February 25, 2026 15:35

reneme force-pushed the feature/generic_ffi_getters branch from dc8b17a to 525e34c Compare February 25, 2026 14:36

randombit approved these changes Feb 26, 2026

View reviewed changes

reneme merged commit 27fd567 into randombit:master Feb 26, 2026
45 checks passed

arckoor mentioned this pull request Jul 21, 2026

Add certificate creation to FFI #5753

Draft

Conversation

reneme commented Dec 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

randombit commented Dec 23, 2025

Uh oh!

reneme commented Dec 23, 2025

Uh oh!

coveralls commented Dec 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

reneme commented Jan 5, 2026

Uh oh!

Uh oh!

arckoor commented Jan 5, 2026

Uh oh!

reneme commented Jan 5, 2026

Uh oh!

This comment was marked as resolved.

Uh oh!

randombit left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

This comment was marked as resolved.

reneme commented Jan 12, 2026

Uh oh!

This comment was marked as resolved.

Uh oh!

This comment was marked as resolved.

Uh oh!

randombit commented Feb 25, 2026

Uh oh!

reneme commented Feb 25, 2026

Uh oh!

reneme commented Feb 25, 2026

Uh oh!

randombit left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

reneme commented Dec 22, 2025 •

edited

Loading

coveralls commented Dec 23, 2025 •

edited

Loading