CRL enhancements for revoked entries#9839
Open
padelsbach wants to merge 1 commit intowolfSSL:masterfrom
Open
Conversation
padelsbach
force-pushed
the
crl-enhancements-ossl
branch
2 times, most recently
from
9369b17 to
df73c7b
Compare
Contributor
Author
|
jenkins retest this please |
padelsbach
force-pushed
the
crl-enhancements-ossl
branch
2 times, most recently
from
3dfb8cf to
4586ed3
Compare
Contributor
There was a problem hiding this comment.
Pull request overview
This PR enhances CRL (Certificate Revocation List) functionality by adding support for revocation dates, reason codes, and extensions in revoked certificate entries. The implementation converts previously stubbed functions into fully functional APIs for retrieving and managing CRL revoked entries.
Changes:
- Added support for caller-specified revocation dates and CRL reason codes
- Implemented
wolfSSL_X509_CRL_get_REVOKED,wolfSSL_sk_X509_REVOKED_num,wolfSSL_sk_X509_REVOKED_value, andwolfSSL_X509_REVOKED_get0_revocation_datefunctions - Added parsing logic for CRL entry extensions including reason code extraction
Reviewed changes
Copilot reviewed 10 out of 10 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| wolfssl/wolfcrypt/asn.h | Added function declaration for parsing CRL reason codes and new fields to RevokedCert structure |
| wolfssl/ssl.h | Updated X509_REVOKED structure with new fields and changed function signatures to use WOLFSSL_STACK |
| wolfssl/openssl/x509v3.h | Added CRL reason code constant definitions per RFC 5280 |
| wolfssl/openssl/ssl.h | Added macro definitions for new X509_REVOKED functions |
| wolfssl/internal.h | Added revokedStack cache field and X509_REVOKED stack type |
| wolfcrypt/src/asn.c | Implemented CRL reason code parsing and extension handling in GetRevoked |
| tests/api.c | Added comprehensive unit tests for CRL revoked entry functionality |
| src/x509.c | Implemented previously stubbed functions for CRL revoked entry access |
| src/ssl_sk.c | Added X509_REVOKED stack type handling |
| src/crl.c | Enhanced CRL add_revoked to support caller-specified dates and reason codes |
Comments suppressed due to low confidence (3)
wolfcrypt/src/asn.c:1
- The variable
seqHdrSzis declared but never used meaningfully. Consider removing it along with its void cast, or implement the intended header size calculation if it was meant to be used.
wolfcrypt/src/asn.c:1 - The variable
seqHdrSzis declared but never used meaningfully. Consider removing it along with its void cast, or implement the intended header size calculation if it was meant to be used.
tests/api.c:1 - The comment 'Test X509_CRL_get_REVOKED and stack iteration' applies to a large block of code. Consider breaking this into smaller sub-sections with more specific comments for each test aspect (NULL checks, stack population verification, revocation date checks, etc.).
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
wolfssl/ssl.h
Outdated
| WOLFSSL_STACK* issuer; /* STACK_OF(GENERAL_NAME) for | ||
| * indirect CRL (currently NULL) */ | ||
| int reason; /* CRL reason code, -1 if absent */ | ||
| int sequence; /* original load order in CRL */ |
There was a problem hiding this comment.
The sequence field documentation is missing its purpose. Consider adding a docstring explaining that this field tracks the original order of entries in the CRL for iteration purposes.
Suggested change
| int sequence; /* original load order in CRL */ | |
| int sequence; /* tracks original order of entries | |
| * in the CRL for iteration */ |
padelsbach
force-pushed
the
crl-enhancements-ossl
branch
3 times, most recently
from
e3a1649 to
cbb568a
Compare
padelsbach
force-pushed
the
crl-enhancements-ossl
branch
from
cbb568a to
75bbf50
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Add/update CRL related features:
wolfSSL_X509_CRL_get_REVOKED,wolfSSL_sk_X509_REVOKED_num,wolfSSL_sk_X509_REVOKED_value,wolfSSL_X509_REVOKED_get0_revocation_dateFixes zd#
Testing
New unit tests
Checklist