Asn1parse

.github/workflows/ci.yml

@@ -23,6 +23,13 @@ jobs:
           - '--enable-wolfclu --enable-smallstack --enable-experimental --enable-dilithium'
           - '--enable-all'
         sanitize: ['CC="cc -fsanitize=address"']
+        # Single-valued on purpose: --disable-oid-table only affects wolfCLU's
+        # own compilation, so sweeping it across every wolfSSL config would
+        # rebuild wolfSSL 12 extra times to test the same code.  It gets one
+        # dedicated job via include below.  Keeping the key here (rather than
+        # omitting it) means that include entry overwrites an original matrix
+        # value, so it adds a job instead of mutating an existing one.
+        wolfCLUOpts: ['']
         include:
           - os: ubuntu-latest
             config: '--enable-wolfclu'
@@ -31,7 +38,17 @@ jobs:
             config: '--enable-wolfclu'
             sanitize: ''
 
-    name: ${{ matrix.os }} ${{ matrix.sanitize && 'ASAN' || '' }} (${{ matrix.config }})
+          - os: ubuntu-latest
+            config: '--enable-wolfclu'
+            sanitize: 'CC="cc -fsanitize=address"'
+            wolfCLUOpts: '--disable-oid-table'
+
+          - os: macos-latest
+            config: '--enable-wolfclu'
+            sanitize: 'CC="cc -fsanitize=address"'
+            wolfCLUOpts: '--disable-oid-table'
+
+    name: ${{ matrix.os }} ${{ matrix.sanitize && 'ASAN' || '' }} (${{ matrix.config }})${{ matrix.wolfCLUOpts && format(' [{0}]', matrix.wolfCLUOpts) || '' }}
     runs-on: ${{ matrix.os }}
     timeout-minutes: 10
 
@@ -73,7 +90,8 @@ jobs:
         working-directory: ./wolfclu
         run: |
           ./autogen.sh
-          ./configure ${{ matrix.sanitize }} --with-wolfssl=$GITHUB_WORKSPACE/build-dir
+          ./configure ${{ matrix.wolfCLUOpts }} ${{ matrix.sanitize }} \
+              --with-wolfssl=$GITHUB_WORKSPACE/build-dir
           make -j
 
       - name: Run tests

.gitignore

@@ -1,7 +1,5 @@
-clu_src/stamp*
 libtool
 wolfssl_clu-config
-clu_src/config.h
 Makefile
 Makefile.in
 aclocal.m4
@@ -11,7 +9,7 @@ config.log
 config.status
 configure
 configure~
-clu_src/config.h.in*
+wolfclu/config.h.in*
 *.lo
 *.Plo
 *.o

Makefile.am

@@ -53,6 +53,7 @@ man_MANS+= manpages/wolfssl-hash.1
 man_MANS+= manpages/wolfssl-enc.1
 man_MANS+= manpages/wolfssl-ca.1
 man_MANS+= manpages/wolfssl-x509.1
+man_MANS+= manpages/wolfssl-asn1parse.1
 man_MANS+= manpages/wolfssl-req.1
 man_MANS+= manpages/wolfssl-verify.1
 man_MANS+= manpages/wolfssl-crl.1
@@ -95,6 +96,7 @@ include tests/dsa/include.am
 include tests/pkey/include.am
 include tests/dgst/include.am
 include tests/rand/include.am
+include tests/asn1/include.am
 include tests/base64/include.am
 include tests/ocsp/include.am
 include tests/ocsp-scgi/include.am

configure.ac

@@ -90,6 +90,20 @@ AC_ARG_ENABLE([manpages],
 
 AM_CONDITIONAL([ENABLE_MANPAGES], [test "x$ENABLED_MANPAGES" != "xno"])
 
+# OID Name Table Build
+ENABLED_OIDTABLE_DEFAULT=yes
+AC_ARG_ENABLE([oid-table],
+    [AS_HELP_STRING([--disable-oid-table],[Disable OID-to-name lookup table (default: enabled)])],
+    [ ENABLED_OIDTABLE=$enableval ],
+    [ ENABLED_OIDTABLE=$ENABLED_OIDTABLE_DEFAULT ]
+    )
+
+if test "x$ENABLED_OIDTABLE" != "xno"
+then
+    AC_DEFINE([HAVE_OID_TABLE], [1],
+              [Enable OID-to-name lookup table])
+fi
+
 
 #wolfssl
 AC_MSG_CHECKING([for wolfSSL])
@@ -136,7 +150,6 @@ AC_CHECK_FUNC([wc_EncodeObjectId],
     [],
     [AM_CFLAGS="$AM_CFLAGS -DNO_WC_ENCODE_OBJECT_ID"])
 
-
 ###############################################
 #                                             #
 #     Need a genKey check                     #
@@ -198,3 +211,4 @@ echo "   * C Compiler:                $CC_VERSION"
 echo "   * C Flags:                   $CFLAGS"
 echo "   * CPP Flags:                 $CPPFLAGS"
 echo "   * LIB Flags:                 $LIB"
+echo "   * OID Name Table:            $ENABLED_OIDTABLE"

ide/winvs/user_settings.h

@@ -40,6 +40,7 @@
 #define WOLFSSL_WC_DILITHIUM
 #define WOLFSSL_EXPERIMENTAL_SETTINGS
 #define WOLFSSL_DUAL_ALG_CERTS
+#define WOLFSSL_ASN_PRINT
 
 #define HAVE_TLS_EXTENSIONS
 #define HAVE_SNI
@@ -56,4 +57,6 @@
 #define HAVE_OCSP
 #define HAVE_OCSP_RESPONDER
 
+#define HAVE_OID_TABLE
+
 #endif /* _WIN_USER_SETTINGS_H_ */

manpages/wolfssl-asn1parse.1

@@ -0,0 +1,86 @@
+.\" Manpage for wolfssl asn1parse.
+.\" Contact facts@wolfssl.com to correct errors or typos.
+.TH wolfSSL SSL1  "June 2026" "0.2.0" "wolfssl asn1parse man page"
+.SH NAME
+wolfssl-asn1parse, asn1parse \- ASN.1 parsing utility
+.SH SYNOPSIS
+wolfssl asn1parse [-in file] [-inform DER|PEM|B64] [-out file] [-oid file] [-offset n] [-length n] [-strparse n[,n...]] [-i] [-dump] [-noout] [-help]
+.SH DESCRIPTION
+Parses an ASN.1 encoded structure (for example a certificate, key, or CRL)
+and prints a human readable listing of its tags, lengths, and contents.
+Input may be read in DER, PEM, or Base64 form.
+.SH GENERAL OPTIONS
+-help                 print the asn1parse help summary and exit.
+.br
+.LP
+-oid file             file of extra OID definitions. Each line uses the
+.br
+                      format: <oid> <shortName> <long name with spaces>.
+.br
+                      The built in OID table is used unless wolfCLU was
+.br
+                      configured with --disable-oid-table.
+.SH I/O OPTIONS
+-in file              input file to read the ASN.1 structure from.
+.br
+.LP
+-inform DER|PEM|B64   input file format. One of DER, PEM, or B64 (Base64).
+.br
+.LP
+-out file             output file for the ASN.1 DER data after processing.
+.br
+                      Best used with -strparse.
+.br
+.LP
+-noout                do not print the parsed output.
+.br
+.LP
+-offset n             offset into the file at which to begin parsing.
+.br
+.LP
+-length n             number of bytes to parse.
+.br
+.LP
+-strparse n[,n...]    offset to an OCTET/BIT STRING to parse. A comma
+.br
+                      separated list may be given, e.g. -strparse 702,64.
+.SH FORMATTING OPTIONS
+-i                    indent the output according to structure depth.
+.br
+.LP
+-dump                 print unknown data in hex form.
+.SH OUTPUT
+Each line is formatted as:
+.RS
+                     0: 4 [1187]  (0) SEQUENCE
+.RE
+.LP
+where the first number is the offset, the second is the header length, the
+value in brackets is the data length, and the value in parentheses is the
+depth. Brackets indicate constructed types and a plus indicates a primitive
+type.
+.SH EXAMPLES
+Parse a DER encoded certificate with indented output:
+.RS
+wolfssl asn1parse -inform DER -in cert.der -i
+.RE
+.LP
+Parse a PEM file and dump unknown data as hex:
+.RS
+wolfssl asn1parse -in cert.pem -inform PEM -dump
+.RE
+.SH SEE ALSO
+.BR wolfssl-x509(1) ", " wolfssl-req(1)
+.SH NOTES
+Available only when wolfSSL is built with WOLFSSL_ASN_PRINT and wolfCLU is
+built with filesystem support (not WOLFCLU_NO_FILESYSTEM). The -oid option
+additionally requires object id encoding support (NO_WC_ENCODE_OBJECT_ID
+must not be defined).
+.SH BUGS
+No known bugs at this time.
+.SH AUTHOR
+wolfSSL, Inc. (facts@wolfssl.com)
+.SH COPYRIGHT
+Copyright 2026 wolfSSL Inc.  All rights reserved.
+.SH REPORTING BUGS
+Report wolfssl bugs to support@wolfssl.com

manpages/wolfssl.1

@@ -55,6 +55,7 @@ Certificates and CAs
         req            generate certificate requests / self-signed certs
         verify         verify an X.509 certificate chain
         crl            parse and verify Certificate Revocation Lists
+        asn1parse      print out a human readable print out of a given cert
 
 Keys
         genkey         generate cryptographic keys