Asn1parse by aidankeefe2022 · Pull Request #253 · wolfSSL/wolfCLU

aidankeefe2022 · 2026-06-17T23:04:01Z

This is based on the asn1.c in the wolfSSL examples. But with the added new strparse feature which allows for the re-parsing of BIT STRINGS and OCTET STRINGS. And the ability for the user to load a custom OID database. Both of these are feature ideas from OpenSSL

The flags and behavior are meant to mimic OpenSSL to allow for users to be comfortable with the tool. Not all of the asn1parse capability is included however.

A man page has been created along with tests for this tool.

A new flag was introduced that enables the build in OID table this is because the table make the binary pretty large. We could remove the table or make it always on if the configure flag is overkill.

The diff says +7000 something but minus the OID table it is about 2000 new lines. The table was taken from asn1.c example code.

If wolfSSL is 5.9.2 or less the -oid feature will not work due to API break

aidankeefe2022 · 2026-06-17T23:04:45Z

Tests will fail until wolfssl get this PR merged

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #253

Scan targets checked: wolfclu-bugs, wolfclu-src

Findings: 2
2 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #253

Scan targets checked: wolfclu-bugs, wolfclu-src

No new issues found in the changed files. ✅

cconlon · 2026-07-01T21:26:25Z

+    if (ret == WOLFCLU_SUCCESS) {
+        /* oid is overwritten by and replaces with DER encoding */
+        XMEMSET(oid, '\0', *oidSz);
+        if ((err = wc_EncodeObjectId(arc, idx, (byte*)oid, oidSz)) != 0) {


Claude has some thoughts on an extra check in this function:

The -oid file format is per line; if the OID field contains only a single number with no dots (e.g. the line 5 myName My Long Name), OidToDer allocates the arc array with one element per character of the OID string — here just 1 — and calls wc_EncodeObjectId(arc, 1, ...). wolfSSL's EncodeObjectId only rejects inSz <= 0 and always computes the first byte as in[0]*40 + in[1], so with inSz == 1 it reads arc[1], one element past the end of the heap allocation. Please reject OIDs with fewer than 2 components before calling wc_EncodeObjectId.

I made a PR to wolfSSL that adds this check to wc_EncodeObjectId. Should we have checks in both spots for backwards compatibility?

Just checked again and the wc_EncodeObjectId function is not compiled in unless it has the updated arg checking this is guarded by the NO_WC_ENCODE_OBJECT_ID macro that checks wolfSSL version

Is this still an issue? It looks like this could still happen from glancing at wc_EncodeObjectId().

Is this resolved?

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #253

Scan targets checked: wolfclu-bugs, wolfclu-src

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

aidankeefe2022 · 2026-07-02T19:15:41Z

Jenkins retest this please

philljj · 2026-07-20T21:23:35Z

+    }
+
+    /* Handle offsets, strparse, etc... */
+    if (ret == WOLFCLU_SUCCESS) {


this ret check not needed.

philljj · 2026-07-20T21:49:49Z

+    WOLFCLU_OID_TO_NAME_free(&AdditionalOidNames);
+    return ret;
+#else
+#if !defined(WOLFSSL_ASN_PRINT)


Why are these additional ifdefs inside an already failing else?

I still don't understand why these additional ifdef's are inside of this #else , which will only return FATAL_ERROR.

philljj · 2026-07-20T21:51:18Z

+    return ret;
+}
+
+#endif


Please comment this #endif's closing scope `#endif /* BLAH_BLAH */

Same with other #endif that are separated by many lines.

Also double blank line.

Please comment #endif if it's many lines from the opening #if blah blah.

philljj · 2026-07-20T22:07:46Z

+    return WOLFCLU_SUCCESS;
+}
+
+static WOLFCLU_ASN1_PARSE_OPTIONS asn1Config = { 0 };


Does this need to be a global?

with openssl. added help to explain oid command added comments to header file resolved configure.ac merge conflict added oid support to header includes added man page for asn1parse and fixed more skoll oid are properly handled Made -out output DER of input after processing Removed extra fmt file and put all in parse custom oid now compiled out for 5.9.2 added header to include.am fenrir fixes moved oid table added WOLFSSL_ASN_PRINT to windows build skoll fixes

philljj · 2026-07-24T21:38:13Z

+    WOLFCLU_OID_TO_NAME_free(&AdditionalOidNames);
+    return ret;
+#else
+#if !defined(WOLFSSL_ASN_PRINT)


I still don't understand why these additional ifdef's are inside of this #else , which will only return FATAL_ERROR.

philljj · 2026-07-24T21:38:50Z

+    return ret;
+}
+
+#endif


Please comment #endif if it's many lines from the opening #if blah blah.

philljj · 2026-07-24T21:39:26Z

+
+    return ret;
+}
+


triple blank line.

philljj · 2026-07-24T21:40:28Z

+    if (ret == WOLFCLU_SUCCESS) {
+        /* oid is overwritten by and replaces with DER encoding */
+        XMEMSET(oid, '\0', *oidSz);
+        if ((err = wc_EncodeObjectId(arc, idx, (byte*)oid, oidSz)) != 0) {


Is this resolved?

philljj · 2026-07-24T21:40:45Z

+}
+
+/* Callback that wolfSSL uses to assign byte oids to names */
+static WOLFCLU_OID_TO_NAME AdditionalOidNames = {0};


Does this need to be a global?

philljj · 2026-07-24T21:43:37Z

+        else {
+            out[(*outSz)++] = val;
+        }
+        token = XSTRTOK(NULL, ",", &end);


Should this token = XSTRTOK(NULL, ",", &end); be only in the non-error else?

Or alternatively, shouldn't the error if's break?

philljj · 2026-07-24T21:50:39Z

+
+        /* The decoded length must fit within the bytes remaining after the
+         * tag and length octets. */
+        if (len < 0 || (word32)len > asn1->max - asn1->curr) {


is len == 0 ok for some fields here?

Copilot

Pull request overview

Adds an asn1parse subcommand to wolfCLU modeled after OpenSSL’s tool, including re-parsing of nested BIT STRING / OCTET STRING payloads (-strparse) and support for user-supplied OID name mappings (-oid), plus build-time optional inclusion of a large built-in OID table.

Changes:

Introduces asn1parse command wiring, option parsing, and ASN.1 decode/print pipeline (DER/PEM/B64, offset/length/strparse, dump/indent/noout).
Adds optional built-in OID name table via --enable-oid-table configure flag, along with manpage documentation.
Adds Python tests for the new tool (including config probing) and a parallel Python test runner.

Reviewed changes

Copilot reviewed 19 out of 22 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
wolfclu/include.am	Installs new ASN.1 public header; adds OID table header to build.
wolfclu/clu_optargs.h	Adds new mode/flags enums for `asn1parse`.
wolfclu/clu_header_main.h	Version-gates `NO_WC_ENCODE_OBJECT_ID`; declares `wolfCLU_StrToWord32`.
wolfclu/asn1/clu_asn1.h	Defines ASN.1 parse options struct and public entry points.
wolfCLU.vcxproj.filters	Adds ASN.1 header to Visual Studio filters.
wolfCLU.vcxproj	Adds ASN.1 sources/headers to Windows project build.
tests/wolfclu_test.py	Adds helper to read generated `wolfclu/config.h` defines for feature-gated tests.
tests/run_tests_parallel.py	New parallel test runner for Python test files.
tests/asn1/include.am	Hooks ASN.1 test script into automake test distribution.
tests/asn1/asn1-test.py	Adds functional tests for DER/PEM/B64, offset/length, strparse, OID mapping, and OID table.
src/x509/clu_config.c	Refactors RID parsing to use `wolfCLU_StrToWord32` and supports 32-bit arcs.
src/tools/clu_funcs.c	Adds `asn1parse` to help output; implements `wolfCLU_StrToWord32`.
src/include.am	Adds ASN.1 sources to automake build.
src/clu_main.c	Adds `asn1parse` mode and dispatch to `wolfCLU_Asn1Setup`.
src/asn1/clu_asn1_setup.c	New CLI option parsing / validation for `asn1parse`.
src/asn1/clu_asn1_parse.c	New core ASN.1 parsing/printing, PEM finding, base64 handling, OID callback support.
manpages/wolfssl-asn1parse.1	New man page for `wolfssl asn1parse`.
Makefile.am	Installs the new man page; includes ASN.1 tests.
ide/winvs/user_settings.h	Enables `WOLFSSL_ASN_PRINT` for the Windows VS settings.
configure.ac	Adds `--enable-oid-table` and version gating for `NO_WC_ENCODE_OBJECT_ID`.
.gitignore	Updates ignored config template path.

Comments suppressed due to low confidence (2)

src/asn1/clu_asn1_parse.c:288

FindPem() confirms the PEM header by running XSTRNCMP(data+i, "-----", 5) without checking that i+5 is within bounds. This can read out of bounds when i is near len; guard the compare with a remaining-length check.

        for (; i < len; i++) {
            if ((data[i] == '-') &&
                    (XSTRNCMP((char*)data + i, "-----", 5) == 0)) {
                break;

src/asn1/clu_asn1_parse.c:303

FindPem() searches for the PEM footer using XSTRNCMP(data+j, "-----END", 8) without checking that j+8 is within bounds. Add a bounds check so the scan can't read past the end of the buffer.

        for (j = i + 1; j < len; j++) {
            if ((data[j] == '-') &&
                    (XSTRNCMP((char*)data + j, "-----END", 8) == 0)) {
                break;

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

+        if ((data[i] == '-') &&
+                (XSTRNCMP((char*)data + i, "-----BEGIN", 10) == 0)) {


+        XFCLOSE(opt->outputFile);
+    }
+
+    *opt = (WOLFCLU_ASN1_PARSE_OPTIONS){ 0 };


+    int ret = WOLFCLU_SUCCESS;
+    int err;
+    int idx = 0;
+    char* token;
+    char* end;
+    word32* arc = (word32*)XMALLOC(sizeof(*arc) * *oidSz,
+            HEAP_HINT, DYNAMIC_TYPE_TMP_BUFFER);
+    if (arc == NULL) {
+        return MEMORY_E;
+    }


+    """True when the build can DER-encode the OIDs from an -oid file.
+
+    -oid relies on wc_EncodeObjectId, which is compiled out via
+    NO_WC_ENCODE_OBJECT_ID for libwolfssl <= 5.9.1 (set in configure.ac).


@@ -0,0 +1,6 @@
+# vim:ft=automake
+# included from top level Makefile.am
+# ALl path should be given relative to root directory


aidankeefe2022 requested a review from wolfSSL-Fenrir-bot June 17, 2026 23:04

aidankeefe2022 self-assigned this Jun 17, 2026

wolfSSL-Fenrir-bot reviewed Jun 17, 2026

View reviewed changes

Comment thread wolfclu/asn1/clu_asn1.h Outdated

Comment thread src/asn1/clu_asn1_fmt.c Outdated

aidankeefe2022 commented Jun 18, 2026

View reviewed changes

Comment thread src/asn1/clu_asn1_fmt.c Outdated

aidankeefe2022 commented Jun 18, 2026

View reviewed changes

Comment thread wolfclu/asn1/clu_asn1.h Outdated

aidankeefe2022 force-pushed the ans1-parser branch 7 times, most recently from e0068dd to cfd1d42 Compare June 22, 2026 17:50

aidankeefe2022 assigned cconlon and unassigned aidankeefe2022 Jun 22, 2026

aidankeefe2022 force-pushed the ans1-parser branch from cfd1d42 to 62149fa Compare June 24, 2026 19:35

aidankeefe2022 requested a review from wolfSSL-Fenrir-bot June 25, 2026 16:54

wolfSSL-Fenrir-bot reviewed Jun 25, 2026

View reviewed changes

cconlon requested changes Jul 1, 2026

View reviewed changes

cconlon assigned aidankeefe2022 and unassigned cconlon Jul 1, 2026

aidankeefe2022 force-pushed the ans1-parser branch 3 times, most recently from eb7fef0 to 9a1ccd0 Compare July 2, 2026 18:28

aidankeefe2022 requested a review from wolfSSL-Fenrir-bot July 2, 2026 18:40

wolfSSL-Fenrir-bot reviewed Jul 2, 2026

View reviewed changes

Comment thread src/asn1/clu_asn1_parse.c

aidankeefe2022 commented Jul 2, 2026

View reviewed changes

Comment thread src/asn1/clu_asn1_parse.c

aidankeefe2022 force-pushed the ans1-parser branch 2 times, most recently from 4b15fc7 to 60b6f5a Compare July 2, 2026 21:59

aidankeefe2022 force-pushed the ans1-parser branch 4 times, most recently from f91a34d to 98aa32a Compare July 15, 2026 20:46

aidankeefe2022 mentioned this pull request Jul 16, 2026

OIDs represented as word32 instead of word16 wolfSSL/wolfssl#10710

Open

4 tasks

aidankeefe2022 force-pushed the ans1-parser branch from 98aa32a to ae53049 Compare July 17, 2026 15:13

aidankeefe2022 assigned philljj and aidankeefe2022 and unassigned aidankeefe2022 and philljj Jul 17, 2026

aidankeefe2022 force-pushed the ans1-parser branch 2 times, most recently from 3834012 to 74bea95 Compare July 17, 2026 19:43

aidankeefe2022 requested a review from philljj July 17, 2026 20:03

aidankeefe2022 assigned philljj and unassigned aidankeefe2022 Jul 17, 2026

philljj requested changes Jul 20, 2026

View reviewed changes

philljj assigned aidankeefe2022 and unassigned philljj Jul 20, 2026

aidankeefe2022 force-pushed the ans1-parser branch from 74bea95 to c22c6b1 Compare July 21, 2026 23:03

aidankeefe2022 force-pushed the ans1-parser branch from c22c6b1 to b59f371 Compare July 22, 2026 01:00

aidankeefe2022 assigned philljj and unassigned aidankeefe2022 Jul 22, 2026

aidankeefe2022 requested a review from philljj July 22, 2026 16:11

philljj reviewed Jul 24, 2026

View reviewed changes

philljj requested a review from Copilot July 24, 2026 21:52

Copilot started reviewing on behalf of philljj July 24, 2026 21:53 View session

Copilot AI reviewed Jul 24, 2026

View reviewed changes

philljj assigned aidankeefe2022 and unassigned philljj Jul 24, 2026

		if ((data[i] == '-') &&
		(XSTRNCMP((char*)data + i, "-----BEGIN", 10) == 0)) {

Uh oh!

Conversation

aidankeefe2022 commented Jun 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

aidankeefe2022 commented Jun 17, 2026

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #253

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #253

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

aidankeefe2022 Jul 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #253

Uh oh!

Uh oh!

Uh oh!

aidankeefe2022 commented Jul 2, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

aidankeefe2022 commented Jun 17, 2026 •

edited

Loading

aidankeefe2022 Jul 2, 2026 •

edited

Loading