Asn1parse by aidankeefe2022 · Pull Request #253 · wolfSSL/wolfCLU

aidankeefe2022 · 2026-06-17T23:04:01Z

This is based on the asn1.c in the wolfSSL examples. But with the added new strparse feature which allows for the re-parsing of BIT STRINGS and OCTET STRINGS. And the ability for the user to load a custom OID database. Both of these are feature ideas from OpenSSL

The flags and behavior are meant to mimic OpenSSL to allow for users to be comfortable with the tool. Not all of the asn1parse capability is included however.

A man page has been created along with tests for this tool.

A new flag was introduced that enables the build in OID table this is because the table make the binary pretty large. We could remove the table or make it always on if the configure flag is overkill.

The diff says +7000 something but minus the OID table it is about 2000 new lines. The table was taken from asn1.c example code.

If wolfSSL is 5.9.2 or less the -oid feature will not work due to API break

aidankeefe2022 · 2026-06-17T23:04:45Z

Tests will fail until wolfssl get this PR merged

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #253

Scan targets checked: wolfclu-bugs, wolfclu-src

Findings: 2
2 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #253

Scan targets checked: wolfclu-bugs, wolfclu-src

No new issues found in the changed files. ✅

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #253

Scan targets checked: wolfclu-bugs, wolfclu-src

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

aidankeefe2022 · 2026-07-02T19:15:41Z

Jenkins retest this please

with openssl. added help to explain oid command added comments to header file resolved configure.ac merge conflict added oid support to header includes added man page for asn1parse and fixed more skoll oid are properly handled Made -out output DER of input after processing Removed extra fmt file and put all in parse custom oid now compiled out for 5.9.2 added header to include.am fenrir fixes moved oid table added WOLFSSL_ASN_PRINT to windows build skoll fixes

Copilot

Pull request overview

Adds an asn1parse subcommand to wolfCLU modeled after OpenSSL’s tool, including re-parsing of nested BIT STRING / OCTET STRING payloads (-strparse) and support for user-supplied OID name mappings (-oid), plus build-time optional inclusion of a large built-in OID table.

Changes:

Introduces asn1parse command wiring, option parsing, and ASN.1 decode/print pipeline (DER/PEM/B64, offset/length/strparse, dump/indent/noout).
Adds optional built-in OID name table via --enable-oid-table configure flag, along with manpage documentation.
Adds Python tests for the new tool (including config probing) and a parallel Python test runner.

Reviewed changes

Copilot reviewed 19 out of 22 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
wolfclu/include.am	Installs new ASN.1 public header; adds OID table header to build.
wolfclu/clu_optargs.h	Adds new mode/flags enums for `asn1parse`.
wolfclu/clu_header_main.h	Version-gates `NO_WC_ENCODE_OBJECT_ID`; declares `wolfCLU_StrToWord32`.
wolfclu/asn1/clu_asn1.h	Defines ASN.1 parse options struct and public entry points.
wolfCLU.vcxproj.filters	Adds ASN.1 header to Visual Studio filters.
wolfCLU.vcxproj	Adds ASN.1 sources/headers to Windows project build.
tests/wolfclu_test.py	Adds helper to read generated `wolfclu/config.h` defines for feature-gated tests.
tests/run_tests_parallel.py	New parallel test runner for Python test files.
tests/asn1/include.am	Hooks ASN.1 test script into automake test distribution.
tests/asn1/asn1-test.py	Adds functional tests for DER/PEM/B64, offset/length, strparse, OID mapping, and OID table.
src/x509/clu_config.c	Refactors RID parsing to use `wolfCLU_StrToWord32` and supports 32-bit arcs.
src/tools/clu_funcs.c	Adds `asn1parse` to help output; implements `wolfCLU_StrToWord32`.
src/include.am	Adds ASN.1 sources to automake build.
src/clu_main.c	Adds `asn1parse` mode and dispatch to `wolfCLU_Asn1Setup`.
src/asn1/clu_asn1_setup.c	New CLI option parsing / validation for `asn1parse`.
src/asn1/clu_asn1_parse.c	New core ASN.1 parsing/printing, PEM finding, base64 handling, OID callback support.
manpages/wolfssl-asn1parse.1	New man page for `wolfssl asn1parse`.
Makefile.am	Installs the new man page; includes ASN.1 tests.
ide/winvs/user_settings.h	Enables `WOLFSSL_ASN_PRINT` for the Windows VS settings.
configure.ac	Adds `--enable-oid-table` and version gating for `NO_WC_ENCODE_OBJECT_ID`.
.gitignore	Updates ignored config template path.

Comments suppressed due to low confidence (2)

src/asn1/clu_asn1_parse.c:288

FindPem() confirms the PEM header by running XSTRNCMP(data+i, "-----", 5) without checking that i+5 is within bounds. This can read out of bounds when i is near len; guard the compare with a remaining-length check.

        for (; i < len; i++) {
            if ((data[i] == '-') &&
                    (XSTRNCMP((char*)data + i, "-----", 5) == 0)) {
                break;

src/asn1/clu_asn1_parse.c:303

FindPem() searches for the PEM footer using XSTRNCMP(data+j, "-----END", 8) without checking that j+8 is within bounds. Add a bounds check so the scan can't read past the end of the buffer.

        for (j = i + 1; j < len; j++) {
            if ((data[j] == '-') &&
                    (XSTRNCMP((char*)data + j, "-----END", 8) == 0)) {
                break;

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

philljj · 2026-07-30T02:35:18Z

+#endif
+
+typedef struct WOLFCLU_ASN1_PARSE_OPTIONS
+#if !defined(NO_FILESYSTEM) && defined(WOLFSSL_ASN_PRINT)


Does this need to use WOLFCLU_NO_FILESYSTEM?

philljj · 2026-07-30T02:37:04Z

+    word32 cap;
+}WOLFCLU_OID_TO_NAME;
+
+#if defined(HAVE_OID_TABLE) && !defined(NO_FILESYSTEM) && \


should be WOLFCLU_NO_FILESYSTEM as well?

philljj · 2026-07-30T02:37:28Z

+static const OidName oid_name_table[1] = {0};
+static const word32 oid_names_len = 0;
+
+#endif /* defined(HAVE_OID_TABLE) && !defined(NO_FILESYSTEM) &&


WOLFCLU_NO_FILESYSTEM

philljj · 2026-07-30T02:49:30Z

    #include <wolfssl/wolfcrypt/camellia.h>
 #endif

+/* API break introduced in 5.9.3 so compile out affected functionality


I don't understand this. The latest wolfssl release is 5.9.2, so this is hard disabled:

./wolfssl asn1parse -oid wolfSSL is not configured to handle encoding oids Error returned: -1.

Yes this functionality relies on this PR wolfSSL/wolfssl#10710 (that breaks the API) which in turn needs this PR to be merged to have its tests pass. I hope to have the API break PR in 5.9.3 so this is preemptive. In the mean time if it is not in 5.9.3 I will update these errors and guards.

philljj · 2026-07-30T02:57:46Z

+
+        # Skip when asn1parse is not compiled in (needs WOLFSSL_ASN_PRINT).
+        result = run_wolfssl("asn1parse", "-inform", "DER", "-in", cls.der)
+        if "Cannot Parse Asn1" in (result.stdout + result.stderr):


I think it will actually print Cannot parse Asn1 in this scenario, so this detection won't work.

Could this be detected in a better way?

I agree this is fragile I changed it to search the binary for a long string in the OID table and if it exists we know the table is included in the build and can run the tests

philljj · 2026-07-30T03:02:30Z

 #define WOLFSSL_WC_DILITHIUM
 #define WOLFSSL_EXPERIMENTAL_SETTINGS
 #define WOLFSSL_DUAL_ALG_CERTS
+#define WOLFSSL_ASN_PRINT


Should this user settings define HAVE_OID_TABLE?

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #253

Scan targets checked: wolfclu-bugs, wolfclu-src

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

aidankeefe2022 requested a review from wolfSSL-Fenrir-bot June 17, 2026 23:04

aidankeefe2022 self-assigned this Jun 17, 2026

wolfSSL-Fenrir-bot reviewed Jun 17, 2026

View reviewed changes

Comment thread wolfclu/asn1/clu_asn1.h Outdated

Comment thread src/asn1/clu_asn1_fmt.c Outdated

aidankeefe2022 commented Jun 18, 2026

View reviewed changes

Comment thread src/asn1/clu_asn1_fmt.c Outdated

aidankeefe2022 commented Jun 18, 2026

View reviewed changes

Comment thread wolfclu/asn1/clu_asn1.h Outdated

aidankeefe2022 force-pushed the ans1-parser branch 7 times, most recently from e0068dd to cfd1d42 Compare June 22, 2026 17:50

aidankeefe2022 assigned cconlon and unassigned aidankeefe2022 Jun 22, 2026

aidankeefe2022 force-pushed the ans1-parser branch from cfd1d42 to 62149fa Compare June 24, 2026 19:35

aidankeefe2022 requested a review from wolfSSL-Fenrir-bot June 25, 2026 16:54

wolfSSL-Fenrir-bot reviewed Jun 25, 2026

View reviewed changes

cconlon requested changes Jul 1, 2026

View reviewed changes

cconlon assigned aidankeefe2022 and unassigned cconlon Jul 1, 2026

aidankeefe2022 force-pushed the ans1-parser branch 3 times, most recently from eb7fef0 to 9a1ccd0 Compare July 2, 2026 18:28

aidankeefe2022 requested a review from wolfSSL-Fenrir-bot July 2, 2026 18:40

wolfSSL-Fenrir-bot reviewed Jul 2, 2026

View reviewed changes

Comment thread src/asn1/clu_asn1_parse.c Outdated

aidankeefe2022 commented Jul 2, 2026

View reviewed changes

Comment thread src/asn1/clu_asn1_parse.c Outdated

aidankeefe2022 force-pushed the ans1-parser branch 2 times, most recently from 4b15fc7 to 60b6f5a Compare July 2, 2026 21:59

aidankeefe2022 requested a review from philljj July 17, 2026 20:03

aidankeefe2022 assigned philljj and unassigned aidankeefe2022 Jul 17, 2026

philljj requested changes Jul 20, 2026

View reviewed changes

philljj assigned aidankeefe2022 and unassigned philljj Jul 20, 2026

aidankeefe2022 force-pushed the ans1-parser branch from 74bea95 to c22c6b1 Compare July 21, 2026 23:03

aidankeefe2022 force-pushed the ans1-parser branch from c22c6b1 to b59f371 Compare July 22, 2026 01:00

aidankeefe2022 assigned philljj and unassigned aidankeefe2022 Jul 22, 2026

aidankeefe2022 requested a review from philljj July 22, 2026 16:11

philljj reviewed Jul 24, 2026

View reviewed changes

philljj requested a review from Copilot July 24, 2026 21:52

Copilot started reviewing on behalf of philljj July 24, 2026 21:53 View session

Copilot AI reviewed Jul 24, 2026

View reviewed changes

Comment thread src/asn1/clu_asn1_parse.c Outdated

Comment thread src/asn1/clu_asn1_setup.c Outdated

Comment thread src/asn1/clu_asn1_parse.c

Comment thread tests/asn1/asn1-test.py Outdated

Comment thread tests/asn1/include.am Outdated

philljj assigned aidankeefe2022 and unassigned philljj Jul 24, 2026

review fixes and skoll fixes

ba41d70

aidankeefe2022 force-pushed the ans1-parser branch from 35c7932 to ba41d70 Compare July 28, 2026 16:22

aidankeefe2022 requested a review from philljj July 28, 2026 16:54

philljj requested changes Jul 28, 2026

View reviewed changes

Comment thread src/asn1/clu_asn1_parse.c

Comment thread src/asn1/clu_asn1_parse.c

philljj previously approved these changes Jul 29, 2026

View reviewed changes

JacobBarthelmeh requested changes Jul 29, 2026

View reviewed changes

Comment thread .github/workflows/ci.yml Outdated

Comment thread wolfclu/asn1/clu_oid_name_table.h

Comment thread .gitignore

Comment thread src/asn1/clu_asn1_parse.c Outdated

Comment thread tests/wolfclu_test.py Outdated

Github review and invert of oid table

32515fd

JacobBarthelmeh previously approved these changes Jul 29, 2026

View reviewed changes

Comment thread tests/wolfclu_test.py Outdated

runtime check for oid table

4c52162

philljj requested changes Jul 30, 2026

View reviewed changes

Define change and new compile-time oid table check

04e2d61

wolfSSL-Fenrir-bot reviewed Jul 30, 2026

View reviewed changes

Comment thread src/asn1/clu_asn1_parse.c

Uh oh!

Conversation

aidankeefe2022 commented Jun 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

aidankeefe2022 commented Jun 17, 2026

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #253

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #253

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #253

Uh oh!

Uh oh!

Uh oh!

aidankeefe2022 commented Jul 2, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

aidankeefe2022 commented Jun 17, 2026 •

edited

Loading

philljj Jul 30, 2026 •

edited

Loading

aidankeefe2022 Jul 30, 2026 •

edited

Loading

aidankeefe2022 Jul 30, 2026 •

edited

Loading