[aidankeefe2022]

Description

F-15885
Made it so CRL and X509 are distinguished in the union in wolfSSL_X509_OBJECT_retrieve_by_subject
OpenSSL compatibility change

F-12742
Made wolfSSL_X509_CRL_get_REVOKED work for CRL_STATIC_REVOKED_LIST
Added new tests and a conversion helper to turn an array into a linked list. The array is a list of the CRL node objects, so we just link them when we cannot use just the array. This is only used when wc_MakeCRL_ex needs the CRL list because it is public and expects the linked list.

Testing

Added regression tests for changes.
regression to make sure that CRL list operations work when static-crl is enabled

• new CI test; this would have caught that all this CRL static list was broken

Checklist

• added tests

[Copilot]

🟢 Approval recommended

No active review issues block approval of the certificate/CRL lookup and static revoked-list changes.

No open issues 🎉

What changed in this PR

This PR improves wolfSSL’s OpenSSL compatibility by distinguishing certificates from CRLs during subject lookup and supporting static revoked-certificate arrays across CRL operations.

Changes:

• Match X509 objects by certificate subject or CRL issuer, using the correct union member.
• Support static revoked arrays in accessors, printing, insertion, and signing.
• Add regression tests and a Linux CI configuration for static revoked lists.

File	Description
tests/​api/​test_ossl_x509_str.h	Registers the mixed certificate/CRL lookup test.
tests/​api/​test_ossl_x509_str.c	Tests type-aware lookup and head-CRL issuer matching.
tests/​api/​test_certman.h	Registers the static revoked-list addition test.
tests/​api/​test_certman.c	Tests static-array access, signing, lookup, capacity, and empty CRLs.
tests/​api.c	Excludes linked-list-specific generation tests from static-array builds.
src/​x509.c	Fixes type-aware object lookup and static-array iteration.
src/​crl.c	Adds sorted, capacity-checked insertion and links static entries for signing.
.github/​configs/​os-check-linux.json	Adds CI coverage for CRL_STATIC_REVOKED_LIST.

_{Review effort: Balanced}

[github-actions]

retest this please

[github-actions]

MemBrowse Memory Report · Explore what changed →

gcc-arm-cortex-m4-openssl-compat

• FLASH: .text +64 B (+0.0%, 801,572 B / 1,048,576 B, total: 76% used)

zephyr-frdm_rw612

• FLASH: datas +16 B, log_const_area -8 B, rodata -8 B, text +3,688 B (+1.3%, 286,152 B / 67,108,864 B, total: 0% used)
• RAM: bss +49 B, datas +16 B (+0.1%, 58,423 B / 983,040 B, total: 6% used)

No memory changes detected for:

• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m3
• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-dtls13
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-pq
• gcc-arm-cortex-m4-rsa-only
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m4-tls13
• gcc-arm-cortex-m7
• gcc-arm-cortex-m7-pq
• gcc-arm-cortex-m7-tls13
• stm32-sim-stm32h753

---

_{Catch memory regressions in CI with MemBrowse. Free for open source.}

[Copilot]

🟢 Approval recommended

No active review issues were identified for the certificate/CRL lookup and static revoked-list changes.

No open issues 🎉

_{Review effort: Balanced}

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #12071

Scan targets checked: wolfssl-src, wolfssl-bugs
Not reviewed (no scan target covers them): .github/configs/os-check-linux.json, tests/api/test_certman.h, tests/api/test_ossl_x509_str.h
Coverage: 5 of 5 in-scope changed file(s) opened by the reviewer

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Reported findings require changes before merge.

Review tier: Max

[wolfSSL-Fenrir-bot]

CRL lookup only matches the first CRL entry's issuer in the aggregated store CRL · Logic errors

The new X509_LU_CRL branch compares name only to wolfSSL_X509_CRL_get_issuer_name(), which returns the first crlList entry's issuer. The store's single CRL object holds every loaded CRL, so lookups for any other issuer return NULL. The new test asserts that miss for caEccCrl.pem.

Suggested fix: Making the CRL lookup match every CRL_Entry issuer in the aggregated store CRL needs a design decision; consult OpenSSL's X509_STORE/X509_OBJECT API documentation.

Related known findings (similar but distinct; listed for context, not part of this finding)

• F-15885: F-15885 is reading the data.x509 union arm for CRL-tagged objects (type confusion), which this PR fixes; this defect is the new CRL branch matching only the first CRL_Entry issuer of the aggregated store CRL.