Skip to content

Fix bug in ParseCRL_Extensions #8587

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Jun 12, 2025
Merged

Fix bug in ParseCRL_Extensions #8587

merged 1 commit into from
Jun 12, 2025

Conversation

lealem47
Copy link
Contributor

@lealem47 lealem47 commented Mar 24, 2025

Description

  • Fix a bug where the idx would get incremented where we don't expect it to be, in the else-if CRL_NUMBER_OID case in ParseCRL_Extensions()
  • Store crl->crlNumber as a byte array to handle CRL numbers as long as 20 octets or 49 digits (https://datatracker.ietf.org/doc/html/rfc5280#section-5.2.3). This conversion unfortunately makes it so that crlNumber isn't stored when NO_BIG_INT is defined

Fixes #8574 and wolfSSL/wolfCLU#174

Also fixes zd#19611

Testing

Tested using wolfCLU with the CRL files provided in #8574 and wolfSSL/wolfCLU#174

Build wolfSSL with
./configure --enable-wolfclu --enable-crl

Then run wolfCLU with
./wolfssl crl -in crl_extention_test.pem -text

Checklist

  • added tests
  • updated/added doxygen
  • updated appropriate READMEs
  • Updated manual and documentation

@SparkiDev
Copy link
Contributor

Using a mp_int is heavy weight for a 20 byte number - can allocate up to 1KB for storage of 20 bytes.
You can store the array of bytes and do a XMEMCMP and add a simple big-endian number larger comparison.

@lealem47
Copy link
Contributor Author

lealem47 commented Mar 25, 2025

Jenkins retest this please

@lealem47 lealem47 removed their assignment Mar 26, 2025
dgarske
dgarske previously approved these changes Mar 26, 2025
Copy link
Contributor

@dgarske dgarske left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks good. Still on fence about backwards compatibility, but okay for now. Over to @SparkiDev

@lealem47
Copy link
Contributor Author

Jenkins retest this please

PRB-generic-config-parser error:

Found unhandled org.jenkinsci.plugins.workflow.support.steps.AgentOfflineException exception:
Unable to create live FilePath for wolf-linux-cloud-node-cps0d5; wolf-linux-cloud-node-cps0d5 was marked offline: Connection was broken

@lealem47
Copy link
Contributor Author

lealem47 commented May 14, 2025

Jenkins Retest this please

@lealem47 lealem47 removed their assignment May 15, 2025
@douzzer douzzer assigned douzzer and unassigned wolfSSL-Bot May 16, 2025
@lealem47 lealem47 requested review from douzzer and dgarske May 28, 2025 16:27
@lealem47 lealem47 assigned wolfSSL-Bot and unassigned lealem47 May 28, 2025
@lealem47 lealem47 removed their assignment Jun 4, 2025
@dgarske dgarske dismissed stale reviews from SparkiDev and douzzer June 12, 2025 19:09

Fixed

@dgarske dgarske merged commit 2fc1110 into wolfSSL:master Jun 12, 2025
204 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

[Bug]: wolfSSL cannot correctly process CRL files with extensions.
5 participants