Generic X.509 certificate helpers and secure file utilities by stenslae · Pull Request #276 · wolfSSL/wolfCLU

stenslae · 2026-07-15T22:48:39Z

Added helper functions to do secure file operations. Added simplified certificate parsing and mapping logic into helper functions. Existing modules were refactored to utilize new functions. Added CI tests for all new changes.

This allows for potential reduction in openssl compat layer reliance and new signature algos.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #276

Scan targets checked: wolfclu-bugs, wolfclu-src

Findings: 2
2 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #276

Scan targets checked: wolfclu-bugs, wolfclu-src

Findings: 3
3 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #276

Scan targets checked: wolfclu-bugs, wolfclu-src

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #276

⚠️ An internal error occurred during the automated review. This error has been logged. Please contact the Fenrir team if you need assistance.

Error: GitHubAPIError

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #276

⚠️ An internal error occurred during the automated review. This error has been logged. Please contact the Fenrir team if you need assistance.

Error: GitHubAPIError

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #276

⚠️ An internal error occurred during the automated review. This error has been logged. Please contact the Fenrir team if you need assistance.

Error: GitHubAPIError

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #276

Scan targets checked: wolfclu-bugs, wolfclu-src

No new issues found in the changed files. ✅

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #276

Scan targets checked: wolfclu-bugs, wolfclu-src

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #276

Scan targets checked: wolfclu-bugs, wolfclu-src

No new issues found in the changed files. ✅

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #276

Scan targets checked: wolfclu-bugs, wolfclu-src
Findings: 2
1 finding(s) posted as inline comments (see file-level comments below)

Medium (1)

Removed guard allows a self-signed cert to verify against itself as CA

File: src/sign-verify/clu_x509_verify.c:214
Function: wolfCLU_x509Verify
Category: Certificate validation bypass

The removed XSTRCMP(caCert, verifyCert) == 0 check previously rejected -CAfile equal to the cert being verified unless -partial_chain was passed. Now verify -CAfile X X succeeds for any self-signed X even without -partial_chain, silently granting partial-chain-like trust.

Recommendation: Restore the removed equality check (or use wolfCLU_PathsRefEqual) to reject -CAfile == cert-to-verify unless -partial_chain is set.

Referenced code: src/sign-verify/clu_x509_verify.c:214-217 (4 lines)

This review was generated automatically by Fenrir. Findings are non-blocking.

# Conflicts: # src/tools/clu_funcs.c

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #276

Scan targets checked: wolfclu-bugs, wolfclu-src

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Findings are non-blocking.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #276

Scan targets checked: wolfclu-bugs, wolfclu-src

No new issues found in the changed files. ✅

stenslae requested a review from wolfSSL-Fenrir-bot July 15, 2026 22:48

stenslae self-assigned this Jul 15, 2026

stenslae mentioned this pull request Jul 15, 2026

ML-DSA Pure Cert Support #251

Open

stenslae force-pushed the pr-x509-only branch from be08cfe to 1cb22ee Compare July 16, 2026 17:09

stenslae requested review from wolfSSL-Fenrir-bot and removed request for wolfSSL-Fenrir-bot July 16, 2026 17:14

wolfSSL-Fenrir-bot reviewed Jul 16, 2026

View reviewed changes

Comment thread tests/x509/cert_setup_unit_test.c

Comment thread src/tools/clu_funcs.c

stenslae commented Jul 16, 2026

View reviewed changes

Comment thread tests/x509/cert_setup_unit_test.c

stenslae commented Jul 16, 2026

View reviewed changes

Comment thread src/tools/clu_funcs.c

stenslae force-pushed the pr-x509-only branch from 1cb22ee to 678296d Compare July 16, 2026 17:51

stenslae requested a review from wolfSSL-Fenrir-bot July 16, 2026 17:58

wolfSSL-Fenrir-bot reviewed Jul 16, 2026

View reviewed changes

Comment thread tests/x509/cert_setup_unit_test.c

Comment thread src/genkey/clu_genkey.c Outdated

Comment thread tests/x509/cert_setup_unit_test.c

stenslae commented Jul 16, 2026

View reviewed changes

Comment thread tests/x509/cert_setup_unit_test.c

stenslae commented Jul 16, 2026

View reviewed changes

Comment thread src/genkey/clu_genkey.c Outdated

stenslae commented Jul 16, 2026

View reviewed changes

Comment thread tests/x509/cert_setup_unit_test.c

stenslae force-pushed the pr-x509-only branch from 678296d to 611a7ce Compare July 16, 2026 21:47

stenslae requested a review from wolfSSL-Fenrir-bot July 16, 2026 21:47

stenslae force-pushed the pr-x509-only branch from 641b6c8 to ec046e2 Compare July 16, 2026 22:11

wolfSSL-Fenrir-bot reviewed Jul 16, 2026

View reviewed changes

Comment thread src/genkey/clu_genkey.c Outdated

stenslae force-pushed the pr-x509-only branch from ec046e2 to 8be5533 Compare July 16, 2026 22:15

stenslae commented Jul 16, 2026

View reviewed changes

Comment thread src/genkey/clu_genkey.c Outdated

stenslae requested a review from wolfSSL-Fenrir-bot July 16, 2026 22:35

wolfSSL-Fenrir-bot reviewed Jul 16, 2026

View reviewed changes

stenslae requested a review from wolfSSL-Fenrir-bot July 16, 2026 22:36

wolfSSL-Fenrir-bot reviewed Jul 16, 2026

View reviewed changes

stenslae requested a review from wolfSSL-Fenrir-bot July 16, 2026 22:39

wolfSSL-Fenrir-bot reviewed Jul 16, 2026

View reviewed changes

stenslae force-pushed the pr-x509-only branch from 8be5533 to efbf23e Compare July 20, 2026 18:02

stenslae requested a review from wolfSSL-Fenrir-bot July 20, 2026 18:02

stenslae force-pushed the pr-x509-only branch from efbf23e to 68b251e Compare July 20, 2026 18:15

stenslae commented Jul 27, 2026

View reviewed changes

Comment thread src/tools/clu_funcs.c Outdated

Add secure file utilities and stream hashing helpers

0db016e

stenslae force-pushed the pr-x509-only branch from 9998048 to e473d10 Compare July 27, 2026 17:37

stenslae requested a review from wolfSSL-Fenrir-bot July 27, 2026 17:38

wolfSSL-Fenrir-bot reviewed Jul 27, 2026

View reviewed changes

stenslae assigned wolfSSL-Bot and unassigned stenslae Jul 27, 2026

stenslae force-pushed the pr-x509-only branch from e473d10 to ec157ee Compare July 27, 2026 18:00

stenslae requested a review from wolfSSL-Fenrir-bot July 27, 2026 18:02

wolfSSL-Fenrir-bot reviewed Jul 27, 2026

View reviewed changes

Comment thread tests/x509/cert_setup_unit_test.c

stenslae commented Jul 27, 2026

View reviewed changes

Comment thread tests/x509/cert_setup_unit_test.c

Emma Stensland added 2 commits July 27, 2026 14:37

Add generic X.509 certificate helpers and unit tests

cb8b533

Refactor existing modules to use new generic helpers

9561827

stenslae force-pushed the pr-x509-only branch from ec157ee to 69b86b3 Compare July 27, 2026 20:38

stenslae requested a review from wolfSSL-Fenrir-bot July 27, 2026 20:40

stenslae force-pushed the pr-x509-only branch from 69b86b3 to 0f442b4 Compare July 27, 2026 20:43

stenslae mentioned this pull request Jul 27, 2026

Add CRL extraction logic #275

Open

wolfSSL-Fenrir-bot reviewed Jul 27, 2026

View reviewed changes

stenslae force-pushed the pr-x509-only branch from 0f442b4 to 6ea47a9 Compare July 27, 2026 21:08

stenslae requested a review from wolfSSL-Fenrir-bot July 27, 2026 21:13

wolfSSL-Fenrir-bot reviewed Jul 27, 2026

View reviewed changes

Comment thread src/tools/clu_funcs.c

stenslae commented Jul 27, 2026

View reviewed changes

Comment thread src/tools/clu_funcs.c

stenslae force-pushed the pr-x509-only branch from 808e2c9 to 5720f90 Compare July 27, 2026 22:36

stenslae requested a review from wolfSSL-Fenrir-bot July 27, 2026 22:37

Update integration tests for refactored commands

88a4640

# Conflicts: # src/tools/clu_funcs.c

stenslae force-pushed the pr-x509-only branch from 5720f90 to 88a4640 Compare July 27, 2026 22:41

wolfSSL-Fenrir-bot reviewed Jul 27, 2026

View reviewed changes

Comment thread src/tools/clu_funcs.c Outdated

stenslae commented Jul 27, 2026

View reviewed changes

Comment thread src/tools/clu_funcs.c Outdated

stenslae requested a review from wolfSSL-Fenrir-bot July 27, 2026 22:53

wolfSSL-Fenrir-bot reviewed Jul 27, 2026

View reviewed changes

Uh oh!

Conversation

stenslae commented Jul 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #276

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #276

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #276

Uh oh!

Uh oh!

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #276

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #276

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #276

Uh oh!

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #276

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #276

Uh oh!

Uh oh!

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #276

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #276

Medium (1)

Removed guard allows a self-signed cert to verify against itself as CA

Uh oh!

Uh oh!

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #276

Uh oh!

Uh oh!

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #276

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

stenslae commented Jul 15, 2026 •

edited

Loading