Generic X.509 certificate helpers and secure file utilities by stenslae · Pull Request #276 · wolfSSL/wolfCLU

stenslae · 2026-07-15T22:48:39Z

Added helper functions to do secure file operations. Added simplified certificate parsing and mapping logic into helper functions. Existing modules were refactored to utilize new functions. Added CI tests for all new changes.

This allows for potential reduction in openssl compat layer reliance and new signature algos.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #276

Scan targets checked: wolfclu-bugs, wolfclu-src

Findings: 2
2 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #276

Scan targets checked: wolfclu-bugs, wolfclu-src

Findings: 3
3 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #276

Scan targets checked: wolfclu-bugs, wolfclu-src

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #276

⚠️ An internal error occurred during the automated review. This error has been logged. Please contact the Fenrir team if you need assistance.

Error: GitHubAPIError

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #276

⚠️ An internal error occurred during the automated review. This error has been logged. Please contact the Fenrir team if you need assistance.

Error: GitHubAPIError

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #276

⚠️ An internal error occurred during the automated review. This error has been logged. Please contact the Fenrir team if you need assistance.

Error: GitHubAPIError

philljj · 2026-07-29T04:03:20Z

PR is failing CI.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #276

Scan targets checked: wolfclu-bugs, wolfclu-src

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #276

Scan targets checked: wolfclu-bugs, wolfclu-src

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #276

Scan targets checked: wolfclu-src
Failed targets: wolfclu-bugs

⚠️ Review incomplete — one or more scan targets failed before findings could be produced. See the Fenrir PR review detail page for logs.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #276

Scan targets checked: wolfclu-bugs, wolfclu-src

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

… integration tests

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #276

Scan targets checked: wolfclu-bugs, wolfclu-src

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

…eneration/CA signing pipelines

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #276

Scan targets checked: wolfclu-bugs, wolfclu-src

Findings: 3
3 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

wolfSSL-Fenrir-bot · 2026-07-31T23:10:03Z

                if (in == NULL) {
                    wolfCLU_LogError("Error opening file %s", optarg);
-                    ret = USER_INPUT_ERROR;
+                    return USER_INPUT_ERROR;


🔵 [Low] Early return on -in failure leaks -name buffer · Resource leaks on error paths

The WOLFCLU_INFILE handler now does return USER_INPUT_ERROR; directly instead of setting ret and breaking. If -name was parsed earlier in the same invocation (allocating name via XMALLOC), this bypasses the if (name != NULL) XFREE(name, ...) cleanup at the end of the function.

Fix: Set ret = USER_INPUT_ERROR; break; instead of returning directly, so the loop exits normally and reaches the existing name/bioOut/key cleanup.

wolfSSL-Fenrir-bot · 2026-07-31T23:10:03Z

@@ -344,6 +360,9 @@ int wolfCLU_CASetup(int argc, char** argv)
    if ((selfSigned || altSign) && ca != NULL) {


🔵 [Low] x509 leaked when -selfsign used without -keyfile/-cert/-altkey/-altpub · Resource leaks on error paths

wolfCLU_CertSignSetCA (which transfers x509 ownership to signer when selfSigned) only runs inside the pkey != NULL || ca != NULL || altKey != NULL || altKeyPub != NULL guard. If none are set, ownership is never transferred, but cleanup unconditionally skips wolfSSL_X509_free(x509) whenever selfSigned is true, leaking x509.

Fix: Track whether wolfCLU_CertSignSetCA actually took ownership of x509 (e.g. a boolean) and only skip the free when it did.

wolfSSL-Fenrir-bot · 2026-07-31T23:10:03Z

+        /* count every request a response was sent for (valid or a malformed-
+         * request error), so -nrequest still limits the loop even under a
+         * flood of malformed requests */
+        requestsProcessed++;


🟠 [Medium] OCSP responder request-limit counts malformed requests, enabling forced early shutdown · Logic error

requestsProcessed now increments for every request that gets any response, including malformed ones, reversing the prior guard that only counted OCSP_SUCCESSFUL responses. An unauthenticated client can send nrequest malformed OCSP requests to force the responder to hit its limit and exit at line 874 before serving legitimate clients.

Fix: Only increment requestsProcessed when ocspStatus == OCSP_SUCCESSFUL, restoring the original protection.

stenslae requested a review from wolfSSL-Fenrir-bot July 15, 2026 22:48

stenslae self-assigned this Jul 15, 2026

stenslae mentioned this pull request Jul 15, 2026

ML-DSA Pure Cert Support #251

Open

stenslae force-pushed the pr-x509-only branch from be08cfe to 1cb22ee Compare July 16, 2026 17:09

stenslae requested review from wolfSSL-Fenrir-bot and removed request for wolfSSL-Fenrir-bot July 16, 2026 17:14

wolfSSL-Fenrir-bot reviewed Jul 16, 2026

View reviewed changes

Comment thread tests/x509/cert_setup_unit_test.c

Comment thread src/tools/clu_funcs.c

stenslae commented Jul 16, 2026

View reviewed changes

Comment thread tests/x509/cert_setup_unit_test.c

stenslae commented Jul 16, 2026

View reviewed changes

Comment thread src/tools/clu_funcs.c

stenslae force-pushed the pr-x509-only branch from 1cb22ee to 678296d Compare July 16, 2026 17:51

stenslae requested a review from wolfSSL-Fenrir-bot July 16, 2026 17:58

wolfSSL-Fenrir-bot reviewed Jul 16, 2026

View reviewed changes

Comment thread tests/x509/cert_setup_unit_test.c

Comment thread src/genkey/clu_genkey.c Outdated

Comment thread tests/x509/cert_setup_unit_test.c

stenslae commented Jul 16, 2026

View reviewed changes

Comment thread tests/x509/cert_setup_unit_test.c

stenslae commented Jul 16, 2026

View reviewed changes

Comment thread src/genkey/clu_genkey.c Outdated

stenslae commented Jul 16, 2026

View reviewed changes

Comment thread tests/x509/cert_setup_unit_test.c

stenslae force-pushed the pr-x509-only branch from 678296d to 611a7ce Compare July 16, 2026 21:47

stenslae requested a review from wolfSSL-Fenrir-bot July 16, 2026 21:47

stenslae force-pushed the pr-x509-only branch from 641b6c8 to ec046e2 Compare July 16, 2026 22:11

wolfSSL-Fenrir-bot reviewed Jul 16, 2026

View reviewed changes

Comment thread src/genkey/clu_genkey.c Outdated

stenslae force-pushed the pr-x509-only branch from ec046e2 to 8be5533 Compare July 16, 2026 22:15

stenslae commented Jul 16, 2026

View reviewed changes

Comment thread src/genkey/clu_genkey.c Outdated

stenslae requested a review from wolfSSL-Fenrir-bot July 16, 2026 22:35

wolfSSL-Fenrir-bot reviewed Jul 16, 2026

View reviewed changes

stenslae requested a review from wolfSSL-Fenrir-bot July 16, 2026 22:36

wolfSSL-Fenrir-bot reviewed Jul 16, 2026

View reviewed changes

stenslae requested a review from wolfSSL-Fenrir-bot July 16, 2026 22:39

wolfSSL-Fenrir-bot reviewed Jul 16, 2026

View reviewed changes

stenslae force-pushed the pr-x509-only branch from 8be5533 to efbf23e Compare July 20, 2026 18:02

stenslae requested a review from wolfSSL-Fenrir-bot July 20, 2026 18:02

stenslae force-pushed the pr-x509-only branch from efbf23e to 68b251e Compare July 20, 2026 18:15

philljj unassigned wolfSSL-Bot Jul 29, 2026

stenslae commented Jul 29, 2026

View reviewed changes

Comment thread src/x509/clu_cert_setup.c Outdated

Add secure file utilities and stream hashing helpers

7dbca9b

stenslae force-pushed the pr-x509-only branch from ac4c61e to 4ac1c09 Compare July 29, 2026 17:06

stenslae requested a review from wolfSSL-Fenrir-bot July 29, 2026 17:06

wolfSSL-Fenrir-bot reviewed Jul 29, 2026

View reviewed changes

Comment thread src/sign-verify/clu_dgst_setup.c Outdated

stenslae commented Jul 29, 2026

View reviewed changes

Comment thread src/sign-verify/clu_dgst_setup.c Outdated

stenslae force-pushed the pr-x509-only branch from 8e1c995 to c4337d6 Compare July 29, 2026 17:32

stenslae requested a review from wolfSSL-Fenrir-bot July 29, 2026 17:33

wolfSSL-Fenrir-bot reviewed Jul 29, 2026

View reviewed changes

Comment thread src/x509/clu_cert_setup.c Outdated

stenslae commented Jul 29, 2026

View reviewed changes

Comment thread src/x509/clu_cert_setup.c Outdated

stenslae force-pushed the pr-x509-only branch from c4337d6 to fd0c2c6 Compare July 29, 2026 21:16

stenslae requested a review from wolfSSL-Fenrir-bot July 29, 2026 21:29

stenslae force-pushed the pr-x509-only branch from fd0c2c6 to e4ea143 Compare July 29, 2026 21:43

wolfSSL-Fenrir-bot reviewed Jul 29, 2026

View reviewed changes

stenslae requested a review from wolfSSL-Fenrir-bot July 29, 2026 21:46

stenslae force-pushed the pr-x509-only branch 2 times, most recently from a09fd6d to 0592d3a Compare July 29, 2026 22:06

wolfSSL-Fenrir-bot reviewed Jul 29, 2026

View reviewed changes

Comment thread src/x509/clu_request_setup.c

stenslae commented Jul 29, 2026

View reviewed changes

Comment thread src/x509/clu_request_setup.c

Emma Stensland added 2 commits July 31, 2026 13:44

Add generic X.509 certificate helpers and unit tests

776680f

Refactor existing modules to use new generic helpers and update their…

8fa97b5

… integration tests

stenslae force-pushed the pr-x509-only branch from 0592d3a to 27de160 Compare July 31, 2026 21:58

stenslae requested a review from wolfSSL-Fenrir-bot July 31, 2026 21:58

stenslae force-pushed the pr-x509-only branch from 27de160 to 2eac5cd Compare July 31, 2026 22:07

wolfSSL-Fenrir-bot reviewed Jul 31, 2026

View reviewed changes

Comment thread src/x509/clu_x509_sign.c Outdated

stenslae commented Jul 31, 2026

View reviewed changes

Comment thread src/x509/clu_x509_sign.c Outdated

Fix digest buffer overflow in dgst sign/verify and add native X.509 g…

80445cc

…eneration/CA signing pipelines

wolfSSL-Fenrir-bot reviewed Jul 31, 2026

View reviewed changes

		@@ -344,6 +360,9 @@ int wolfCLU_CASetup(int argc, char** argv)
		if ((selfSigned \|\| altSign) && ca != NULL) {

Uh oh!

Conversation

stenslae commented Jul 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #276

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #276

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #276

Uh oh!

Uh oh!

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #276

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #276

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #276

Uh oh!

philljj commented Jul 29, 2026

Uh oh!

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #276

Uh oh!

Uh oh!

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #276

Uh oh!

Uh oh!

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #276

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #276

Uh oh!

Uh oh!

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #276

Uh oh!

Uh oh!

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #276

Uh oh!

wolfSSL-Fenrir-bot Jul 31, 2026

Choose a reason for hiding this comment

Uh oh!

wolfSSL-Fenrir-bot Jul 31, 2026

stenslae commented Jul 15, 2026 •

edited

Loading