Generic X.509 certificate helpers and secure file utilities by stenslae · Pull Request #276 · wolfSSL/wolfCLU

stenslae · 2026-07-15T22:48:39Z

Added helper functions to do secure file operations. Added simplified certificate parsing and mapping logic into helper functions. Existing modules were refactored to utilize new functions. Added CI tests for all new changes.

This allows for potential reduction in openssl compat layer reliance and new signature algos.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #276

Scan targets checked: wolfclu-bugs, wolfclu-src

Findings: 2
2 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #276

Scan targets checked: wolfclu-bugs, wolfclu-src

Findings: 3
3 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #276

Scan targets checked: wolfclu-bugs, wolfclu-src

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #276

⚠️ An internal error occurred during the automated review. This error has been logged. Please contact the Fenrir team if you need assistance.

Error: GitHubAPIError

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #276

⚠️ An internal error occurred during the automated review. This error has been logged. Please contact the Fenrir team if you need assistance.

Error: GitHubAPIError

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #276

⚠️ An internal error occurred during the automated review. This error has been logged. Please contact the Fenrir team if you need assistance.

Error: GitHubAPIError

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #276

Scan targets checked: wolfclu-bugs, wolfclu-src

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #276

Scan targets checked: wolfclu-bugs, wolfclu-src

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #276

Scan targets checked: wolfclu-src
Failed targets: wolfclu-bugs

⚠️ Review incomplete — one or more scan targets failed before findings could be produced. See the Fenrir PR review detail page for logs.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #276

Scan targets checked: wolfclu-bugs, wolfclu-src

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

… integration tests

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #276

Scan targets checked: wolfclu-bugs, wolfclu-src

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #276

Scan targets checked: wolfclu-bugs, wolfclu-src

Findings: 3
3 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

…eneration/CA signing pipelines

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #276

Scan targets checked: wolfclu-src
Failed targets: wolfclu-bugs
Findings: 3
2 finding(s) posted as inline comments (see file-level comments below)

High (1)

Heap buffer overflow copying PEM-to-DER key material into fixed-size scratch buffers

File: src/x509/clu_x509_sign.c:436
Function: wolfCLU_GenChimeraCertSign
Category: Buffer overflows

caKeyBuf/serverKeyBuf/sapkiBuf/altCaKeyBuf are fixed LARGE_TEMP_SZ (11264-byte) allocations, but after wc_PemToDer the code copies derObj->length bytes into them with no check that derObj->length <= LARGE_TEMP_SZ, at lines 435-436, 482-483, 528-529, and 562-563.

Recommendation: Reject with an error if derObj->length exceeds the destination buffer capacity before each XMEMCPY.

Referenced code: src/x509/clu_x509_sign.c:436-438 (3 lines)

This review was generated automatically by Fenrir. Findings are non-blocking.

wolfSSL-Fenrir-bot · 2026-08-03T21:56:57Z

+    CHECK(wolfCLU_PathsRefEqual("same.txt", "same.txt") == 1, "PathsRefEqual identical");
+    CHECK(wolfCLU_PathsRefEqual("a.txt", "b.txt") == 0, "PathsRefEqual different");
+
+    f = fopen("test_ref_equal.tmp", "wb");


🔵 [Low] Hardcoded temp filename in PathsRefEqual unit test not PID-scoped · Hardcoded paths, ports, or environment dependencies

test_ref_equal.tmp is a fixed filename in the CWD, unlike the sibling testReadFileToBuffer which PID-scopes its temp file; concurrent/parallel test runs in the same directory can collide.

Fix: Use a PID- or tmpnam-scoped filename as done in testReadFileToBuffer.

stenslae requested a review from wolfSSL-Fenrir-bot July 15, 2026 22:48

stenslae self-assigned this Jul 15, 2026

stenslae mentioned this pull request Jul 15, 2026

ML-DSA Pure Cert Support #251

Open

stenslae force-pushed the pr-x509-only branch from be08cfe to 1cb22ee Compare July 16, 2026 17:09

stenslae requested review from wolfSSL-Fenrir-bot and removed request for wolfSSL-Fenrir-bot July 16, 2026 17:14

wolfSSL-Fenrir-bot reviewed Jul 16, 2026

View reviewed changes

Comment thread tests/x509/cert_setup_unit_test.c

Comment thread src/tools/clu_funcs.c

stenslae commented Jul 16, 2026

View reviewed changes

Comment thread tests/x509/cert_setup_unit_test.c

stenslae commented Jul 16, 2026

View reviewed changes

Comment thread src/tools/clu_funcs.c

stenslae force-pushed the pr-x509-only branch from 1cb22ee to 678296d Compare July 16, 2026 17:51

stenslae requested a review from wolfSSL-Fenrir-bot July 16, 2026 17:58

wolfSSL-Fenrir-bot reviewed Jul 16, 2026

View reviewed changes

Comment thread tests/x509/cert_setup_unit_test.c

Comment thread src/genkey/clu_genkey.c Outdated

Comment thread tests/x509/cert_setup_unit_test.c

stenslae commented Jul 16, 2026

View reviewed changes

Comment thread tests/x509/cert_setup_unit_test.c

stenslae commented Jul 16, 2026

View reviewed changes

Comment thread src/genkey/clu_genkey.c Outdated

stenslae commented Jul 16, 2026

View reviewed changes

Comment thread tests/x509/cert_setup_unit_test.c

stenslae force-pushed the pr-x509-only branch from 678296d to 611a7ce Compare July 16, 2026 21:47

stenslae requested a review from wolfSSL-Fenrir-bot July 16, 2026 21:47

stenslae force-pushed the pr-x509-only branch from 641b6c8 to ec046e2 Compare July 16, 2026 22:11

wolfSSL-Fenrir-bot reviewed Jul 16, 2026

View reviewed changes

Comment thread src/genkey/clu_genkey.c Outdated

stenslae force-pushed the pr-x509-only branch from ec046e2 to 8be5533 Compare July 16, 2026 22:15

stenslae commented Jul 16, 2026

View reviewed changes

Comment thread src/genkey/clu_genkey.c Outdated

stenslae requested a review from wolfSSL-Fenrir-bot July 16, 2026 22:35

wolfSSL-Fenrir-bot reviewed Jul 16, 2026

View reviewed changes

stenslae requested a review from wolfSSL-Fenrir-bot July 16, 2026 22:36

wolfSSL-Fenrir-bot reviewed Jul 16, 2026

View reviewed changes

stenslae requested a review from wolfSSL-Fenrir-bot July 16, 2026 22:39

wolfSSL-Fenrir-bot reviewed Jul 16, 2026

View reviewed changes

stenslae force-pushed the pr-x509-only branch from 8be5533 to efbf23e Compare July 20, 2026 18:02

stenslae requested a review from wolfSSL-Fenrir-bot July 20, 2026 18:02

stenslae force-pushed the pr-x509-only branch from efbf23e to 68b251e Compare July 20, 2026 18:15

stenslae force-pushed the pr-x509-only branch from ac4c61e to 4ac1c09 Compare July 29, 2026 17:06

stenslae requested a review from wolfSSL-Fenrir-bot July 29, 2026 17:06

wolfSSL-Fenrir-bot reviewed Jul 29, 2026

View reviewed changes

Comment thread src/sign-verify/clu_dgst_setup.c Outdated

stenslae commented Jul 29, 2026

View reviewed changes

Comment thread src/sign-verify/clu_dgst_setup.c Outdated

stenslae force-pushed the pr-x509-only branch from 8e1c995 to c4337d6 Compare July 29, 2026 17:32

stenslae requested a review from wolfSSL-Fenrir-bot July 29, 2026 17:33

wolfSSL-Fenrir-bot reviewed Jul 29, 2026

View reviewed changes

Comment thread src/x509/clu_cert_setup.c Outdated

stenslae commented Jul 29, 2026

View reviewed changes

Comment thread src/x509/clu_cert_setup.c Outdated

stenslae force-pushed the pr-x509-only branch from c4337d6 to fd0c2c6 Compare July 29, 2026 21:16

stenslae requested a review from wolfSSL-Fenrir-bot July 29, 2026 21:29

stenslae force-pushed the pr-x509-only branch from fd0c2c6 to e4ea143 Compare July 29, 2026 21:43

wolfSSL-Fenrir-bot reviewed Jul 29, 2026

View reviewed changes

stenslae requested a review from wolfSSL-Fenrir-bot July 29, 2026 21:46

stenslae force-pushed the pr-x509-only branch 2 times, most recently from a09fd6d to 0592d3a Compare July 29, 2026 22:06

wolfSSL-Fenrir-bot reviewed Jul 29, 2026

View reviewed changes

Comment thread src/x509/clu_request_setup.c

stenslae commented Jul 29, 2026

View reviewed changes

Comment thread src/x509/clu_request_setup.c

Emma Stensland added 2 commits July 31, 2026 13:44

Add generic X.509 certificate helpers and unit tests

776680f

Refactor existing modules to use new generic helpers and update their…

8fa97b5

… integration tests

stenslae force-pushed the pr-x509-only branch from 0592d3a to 27de160 Compare July 31, 2026 21:58

stenslae requested a review from wolfSSL-Fenrir-bot July 31, 2026 21:58

stenslae force-pushed the pr-x509-only branch from 27de160 to 2eac5cd Compare July 31, 2026 22:07

wolfSSL-Fenrir-bot reviewed Jul 31, 2026

View reviewed changes

Comment thread src/x509/clu_x509_sign.c Outdated

stenslae commented Jul 31, 2026

View reviewed changes

Comment thread src/x509/clu_x509_sign.c Outdated

wolfSSL-Fenrir-bot reviewed Jul 31, 2026

View reviewed changes

Comment thread src/ecparam/clu_ecparam.c Outdated

Comment thread src/x509/clu_ca_setup.c

Comment thread src/ocsp/clu_ocsp.c

stenslae commented Aug 3, 2026

View reviewed changes

Comment thread src/ecparam/clu_ecparam.c Outdated

stenslae commented Aug 3, 2026

View reviewed changes

Comment thread src/x509/clu_ca_setup.c

stenslae commented Aug 3, 2026

View reviewed changes

Comment thread src/ocsp/clu_ocsp.c

Fix digest buffer overflow in dgst sign/verify and add native X.509 g…

b9fdb97

…eneration/CA signing pipelines

wolfSSL-Fenrir-bot reviewed Aug 3, 2026

View reviewed changes

Uh oh!

Conversation

stenslae commented Jul 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #276

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #276

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #276

Uh oh!

Uh oh!

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #276

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #276

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #276

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #276

Uh oh!

Uh oh!

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #276

Uh oh!

Uh oh!

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #276

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #276

Uh oh!

Uh oh!

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #276

Uh oh!

Uh oh!

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #276

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

wolfSSL-Fenrir-bot left a comment

stenslae commented Jul 15, 2026 •

edited

Loading