Asn1parse by aidankeefe2022 · Pull Request #253 · wolfSSL/wolfCLU

aidankeefe2022 · 2026-06-17T23:04:01Z

This is based on the asn1.c in the wolfSSL examples. But with the added new strparse feature which allows for the re-parsing of BIT STRINGS and OCTET STRINGS. And the ability for the user to load a custom OID database. Both of these are feature ideas from OpenSSL

The flags and behavior are meant to mimic OpenSSL to allow for users to be comfortable with the tool. Not all of the asn1parse capability is included however.

A man page has been created along with tests for this tool.

A new flag was introduced that enables the build in OID table this is because the table make the binary pretty large. We could remove the table or make it always on if the configure flag is overkill.

The diff says +7000 something but minus the OID table it is about 2000 new lines. The table was taken from asn1.c example code.

If wolfSSL is 5.9.2 or less the -oid feature will not work due to API break

aidankeefe2022 · 2026-06-17T23:04:45Z

Tests will fail until wolfssl get this PR merged

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #253

Scan targets checked: wolfclu-bugs, wolfclu-src

Findings: 2
2 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #253

Scan targets checked: wolfclu-bugs, wolfclu-src

No new issues found in the changed files. ✅

cconlon · 2026-07-01T21:26:25Z

+    if (ret == WOLFCLU_SUCCESS) {
+        /* oid is overwritten by and replaces with DER encoding */
+        XMEMSET(oid, '\0', *oidSz);
+        if ((err = wc_EncodeObjectId(arc, idx, (byte*)oid, oidSz)) != 0) {


Claude has some thoughts on an extra check in this function:

The -oid file format is per line; if the OID field contains only a single number with no dots (e.g. the line 5 myName My Long Name), OidToDer allocates the arc array with one element per character of the OID string — here just 1 — and calls wc_EncodeObjectId(arc, 1, ...). wolfSSL's EncodeObjectId only rejects inSz <= 0 and always computes the first byte as in[0]*40 + in[1], so with inSz == 1 it reads arc[1], one element past the end of the heap allocation. Please reject OIDs with fewer than 2 components before calling wc_EncodeObjectId.

I made a PR to wolfSSL that adds this check to wc_EncodeObjectId. Should we have checks in both spots for backwards compatibility?

Just checked again and the wc_EncodeObjectId function is not compiled in unless it has the updated arg checking this is guarded by the NO_WC_ENCODE_OBJECT_ID macro that checks wolfSSL version

Is this still an issue? It looks like this could still happen from glancing at wc_EncodeObjectId().

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #253

Scan targets checked: wolfclu-bugs, wolfclu-src

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

aidankeefe2022 · 2026-07-02T19:15:41Z

Jenkins retest this please

philljj

Looks cool. Here's my first pass review.

philljj · 2026-07-15T14:31:13Z

+        return MEMORY_E;
+    }
+
+    if (XFREAD(*buffer, sizeof(char), fileLen, fp) != (word32)fileLen) {


It might be worth specifying a max file size (that's lower than max word32) to compare against before truncating to word32.

philljj · 2026-07-15T14:37:20Z

+    if (ret == WOLFCLU_SUCCESS) {
+        /* oid is overwritten by and replaces with DER encoding */
+        XMEMSET(oid, '\0', *oidSz);
+        if ((err = wc_EncodeObjectId(arc, idx, (byte*)oid, oidSz)) != 0) {


Is this still an issue? It looks like this could still happen from glancing at wc_EncodeObjectId().

philljj · 2026-07-15T14:57:15Z

+    }
+    if (ret == WOLFCLU_SUCCESS) {
+        /* Confirm header. */
+        for (i += 10; i < len; i++) {


It could be replaced with something like

#define BEGIN_PRIV_KEY_PREFIX "-----BEGIN"

or like we do in wolfcrypt/src/asn.c

static wcchar BEGIN_PRIV_KEY_PREFIX = "-----BEGIN";

philljj · 2026-07-20T21:16:12Z

+    if (wc_Asn1PrintOptions_Set(&PrintOpts, ASN1_PRINT_OPT_DRAW_BRANCH,
+            1) != 0)
+        return WOLFCLU_FATAL_ERROR;
+


double blank line

philljj · 2026-07-20T21:17:08Z

+{
+    int ret = WOLFCLU_SUCCESS;
+    word32 idx = 0;
+


double blank line

philljj · 2026-07-20T21:20:19Z

+ * @param  strSz size of input string.
+ * @param  out   pointer to word32 that out put will be placed in on success.
+ * @return       wolfCLU_FATAL_ERROR of str contains non-digit
+ *               charaters or overflows word32 size.


typo, characters

philljj · 2026-07-20T21:22:22Z

+        /* Maximum length is up to end from offset. */
+        asn1->max = dataSz - opts->offset;
+    }
+


double blank line

philljj · 2026-07-20T21:23:35Z

+    }
+
+    /* Handle offsets, strparse, etc... */
+    if (ret == WOLFCLU_SUCCESS) {


this ret check not needed.

philljj · 2026-07-20T21:49:49Z

+    WOLFCLU_OID_TO_NAME_free(&AdditionalOidNames);
+    return ret;
+#else
+#if !defined(WOLFSSL_ASN_PRINT)


Why are these additional ifdefs inside an already failing else?

philljj · 2026-07-20T21:51:18Z

+    return ret;
+}
+
+#endif


Please comment this #endif's closing scope `#endif /* BLAH_BLAH */

Same with other #endif that are separated by many lines.

Also double blank line.

philljj · 2026-07-20T21:51:51Z

+
+    return ret;
+}
+


double blank line.

philljj · 2026-07-20T22:06:12Z

+    if (file != NULL) {
+        XFILE f = XFOPEN(file, mode);
+        if (f != NULL) {
+            if (*file_out != NULL) {


Shouldn't this be an error if an already opened file_out is being passed in?

Is the goal of this function to leave the file open for further processing?

philljj · 2026-07-20T22:07:46Z

+    return WOLFCLU_SUCCESS;
+}
+
+static WOLFCLU_ASN1_PARSE_OPTIONS asn1Config = { 0 };


Does this need to be a global?

with openssl. added help to explain oid command added comments to header file resolved configure.ac merge conflict added oid support to header includes added man page for asn1parse and fixed more skoll oid are properly handled Made -out output DER of input after processing Removed extra fmt file and put all in parse custom oid now compiled out for 5.9.2 added header to include.am fenrir fixes moved oid table added WOLFSSL_ASN_PRINT to windows build skoll fixes

aidankeefe2022 requested a review from wolfSSL-Fenrir-bot June 17, 2026 23:04

aidankeefe2022 self-assigned this Jun 17, 2026

wolfSSL-Fenrir-bot reviewed Jun 17, 2026

View reviewed changes

Comment thread wolfclu/asn1/clu_asn1.h Outdated

Comment thread src/asn1/clu_asn1_fmt.c Outdated

aidankeefe2022 commented Jun 18, 2026

View reviewed changes

Comment thread src/asn1/clu_asn1_fmt.c Outdated

aidankeefe2022 commented Jun 18, 2026

View reviewed changes

Comment thread wolfclu/asn1/clu_asn1.h Outdated

aidankeefe2022 force-pushed the ans1-parser branch 7 times, most recently from e0068dd to cfd1d42 Compare June 22, 2026 17:50

aidankeefe2022 assigned cconlon and unassigned aidankeefe2022 Jun 22, 2026

aidankeefe2022 force-pushed the ans1-parser branch from cfd1d42 to 62149fa Compare June 24, 2026 19:35

aidankeefe2022 requested a review from wolfSSL-Fenrir-bot June 25, 2026 16:54

wolfSSL-Fenrir-bot reviewed Jun 25, 2026

View reviewed changes

cconlon requested changes Jul 1, 2026

View reviewed changes

cconlon assigned aidankeefe2022 and unassigned cconlon Jul 1, 2026

aidankeefe2022 force-pushed the ans1-parser branch 3 times, most recently from eb7fef0 to 9a1ccd0 Compare July 2, 2026 18:28

aidankeefe2022 requested a review from wolfSSL-Fenrir-bot July 2, 2026 18:40

wolfSSL-Fenrir-bot reviewed Jul 2, 2026

View reviewed changes

Comment thread src/asn1/clu_asn1_parse.c

aidankeefe2022 commented Jul 2, 2026

View reviewed changes

Comment thread src/asn1/clu_asn1_parse.c

aidankeefe2022 force-pushed the ans1-parser branch 2 times, most recently from 4b15fc7 to 60b6f5a Compare July 2, 2026 21:59

philljj unassigned wolfSSL-Fenrir-bot Jul 15, 2026

philljj requested changes Jul 15, 2026

View reviewed changes

philljj assigned aidankeefe2022 and unassigned philljj Jul 15, 2026

aidankeefe2022 force-pushed the ans1-parser branch 6 times, most recently from f91a34d to 98aa32a Compare July 15, 2026 20:46

aidankeefe2022 mentioned this pull request Jul 16, 2026

OIDs represented as word32 instead of word16 wolfSSL/wolfssl#10710

Open

4 tasks

aidankeefe2022 force-pushed the ans1-parser branch from 98aa32a to ae53049 Compare July 17, 2026 15:13

aidankeefe2022 assigned philljj and aidankeefe2022 and unassigned aidankeefe2022 and philljj Jul 17, 2026

aidankeefe2022 force-pushed the ans1-parser branch 2 times, most recently from 3834012 to 74bea95 Compare July 17, 2026 19:43

aidankeefe2022 requested a review from philljj July 17, 2026 20:03

aidankeefe2022 assigned philljj and unassigned aidankeefe2022 Jul 17, 2026

philljj requested changes Jul 20, 2026

View reviewed changes

philljj assigned aidankeefe2022 and unassigned philljj Jul 20, 2026

aidankeefe2022 force-pushed the ans1-parser branch from 74bea95 to c22c6b1 Compare July 21, 2026 23:03

aidankeefe2022 force-pushed the ans1-parser branch from c22c6b1 to b59f371 Compare July 22, 2026 01:00

aidankeefe2022 assigned philljj and unassigned aidankeefe2022 Jul 22, 2026

aidankeefe2022 requested a review from philljj July 22, 2026 16:11

Uh oh!

Conversation

aidankeefe2022 commented Jun 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

aidankeefe2022 commented Jun 17, 2026

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #253

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #253

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

aidankeefe2022 Jul 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #253

Uh oh!

Uh oh!

Uh oh!

aidankeefe2022 commented Jul 2, 2026

Uh oh!

philljj left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

aidankeefe2022 commented Jun 17, 2026 •

edited

Loading

aidankeefe2022 Jul 2, 2026 •

edited

Loading