Asn1parse

.github/workflows/ci.yml

@@ -22,7 +22,16 @@ jobs:
           - '--enable-wolfclu --enable-experimental --enable-dilithium'
           - '--enable-wolfclu --enable-smallstack --enable-experimental --enable-dilithium'
           - '--enable-all'
+
         sanitize: ['CC="cc -fsanitize=address" CFLAGS="-g"']
+        # Single-valued on purpose: --disable-oid-table only affects wolfCLU's
+        # own compilation, so sweeping it across every wolfSSL config would
+        # rebuild wolfSSL 12 extra times to test the same code.  It gets one
+        # dedicated job via include below.  Keeping the key here (rather than
+        # omitting it) means that include entry overwrites an original matrix
+        # value, so it adds a job instead of mutating an existing one.
+        wolfCLUOpts: ['']
+
         include:
           - os: ubuntu-latest
             config: '--enable-wolfclu'
@@ -31,7 +40,24 @@ jobs:
             config: '--enable-wolfclu'
             sanitize: ''
 
-    name: ${{ matrix.os }} ${{ matrix.sanitize && 'ASAN' || '' }} (${{ matrix.config }})
+          - os: ubuntu-latest
+            config: '--enable-wolfclu'
+            sanitize: 'CC="cc -fsanitize=address" CFLAGS="-g"'
+            wolfCLUOpts: '--disable-oid-table'
+
+          - os: macos-latest
+            config: '--enable-wolfclu'
+            sanitize: 'CC="cc -fsanitize=address" CFLAGS="-g"'
+            wolfCLUOpts: '--disable-oid-table'
+
+          # wolfSSL master exports wc_EncodeObjectId32, so force the word16
+          # wc_EncodeObjectId fallback that released wolfSSL builds use.
+          - os: ubuntu-latest
+            config: '--enable-wolfclu'
+            sanitize: 'CC="cc -fsanitize=address" CFLAGS="-g"'
+            wolfCLUOpts: 'CPPFLAGS="-DTRUNCATED_ENCODE_OBJECT_ID"'
+
+    name: ${{ matrix.os }} ${{ matrix.sanitize && 'ASAN' || '' }} (${{ matrix.config }})${{ matrix.wolfCLUOpts && format(' [{0}]', matrix.wolfCLUOpts) || '' }}
     runs-on: ${{ matrix.os }}
     timeout-minutes: 10
 
@@ -73,7 +99,8 @@ jobs:
         working-directory: ./wolfclu
         run: |
           ./autogen.sh
-          ./configure ${{ matrix.sanitize }} --with-wolfssl=$GITHUB_WORKSPACE/build-dir
+          ./configure ${{ matrix.wolfCLUOpts }} ${{ matrix.sanitize }} \
+              --with-wolfssl=$GITHUB_WORKSPACE/build-dir
           make -j
 
       - name: Run tests

.gitignore

@@ -1,7 +1,5 @@
-clu_src/stamp*
 libtool
 wolfssl_clu-config
-clu_src/config.h
 Makefile
 Makefile.in
 aclocal.m4
@@ -11,7 +9,7 @@ config.log
 config.status
 configure
 configure~
-clu_src/config.h.in*
+wolfclu/config.h.in*
 *.lo
 *.Plo
 *.o

Makefile.am

@@ -53,6 +53,7 @@ man_MANS+= manpages/wolfssl-hash.1
 man_MANS+= manpages/wolfssl-enc.1
 man_MANS+= manpages/wolfssl-ca.1
 man_MANS+= manpages/wolfssl-x509.1
+man_MANS+= manpages/wolfssl-asn1parse.1
 man_MANS+= manpages/wolfssl-req.1
 man_MANS+= manpages/wolfssl-verify.1
 man_MANS+= manpages/wolfssl-crl.1
@@ -95,6 +96,7 @@ include tests/dsa/include.am
 include tests/pkey/include.am
 include tests/dgst/include.am
 include tests/rand/include.am
+include tests/asn1/include.am
 include tests/base64/include.am
 include tests/ocsp/include.am
 include tests/ocsp-scgi/include.am

configure.ac

@@ -95,6 +95,19 @@ AC_ARG_ENABLE([manpages],
 
 AM_CONDITIONAL([ENABLE_MANPAGES], [test "x$ENABLED_MANPAGES" != "xno"])
 
+# OID Name Table Build
+ENABLED_OIDTABLE_DEFAULT=yes
+AC_ARG_ENABLE([oid-table],
+    [AS_HELP_STRING([--disable-oid-table],[Disable OID-to-name lookup table (default: enabled)])],
+    [ ENABLED_OIDTABLE=$enableval ],
+    [ ENABLED_OIDTABLE=$ENABLED_OIDTABLE_DEFAULT ]
+    )
+
+if test "x$ENABLED_OIDTABLE" != "xno"
+then
+    AM_CFLAGS="$AM_CFLAGS -DHAVE_OID_TABLE"
+fi
+
 
 #wolfssl
 AC_MSG_CHECKING([for wolfSSL])
@@ -144,7 +157,11 @@ AC_CHECK_FUNC([wolfSSL_X509_REQ_print],
 AC_CHECK_FUNC([wc_EncodeObjectId],
     [],
     [AM_CFLAGS="$AM_CFLAGS -DNO_WC_ENCODE_OBJECT_ID"])
-
+# wolfSSL releases only have the word16 wc_EncodeObjectId, which truncates
+# OID arcs above 65535; wc_EncodeObjectId32 encodes the full word32 arc
+AC_CHECK_FUNC([wc_EncodeObjectId32],
+    [],
+    [AM_CFLAGS="$AM_CFLAGS -DTRUNCATED_ENCODE_OBJECT_ID"])
 
 ###############################################
 #                                             #
@@ -213,3 +230,4 @@ echo "   * C Flags:                   $CFLAGS"
 echo "   * CPP Flags:                 $CPPFLAGS"
 echo "   * LIB Flags:                 $LIB"
 echo "   * Debug enabled:             $ax_enable_debug"
+echo "   * OID Name Table:            $ENABLED_OIDTABLE"

ide/winvs/user_settings.h

@@ -40,6 +40,7 @@
 #define WOLFSSL_WC_DILITHIUM
 #define WOLFSSL_EXPERIMENTAL_SETTINGS
 #define WOLFSSL_DUAL_ALG_CERTS
+#define WOLFSSL_ASN_PRINT
 
 #define HAVE_TLS_EXTENSIONS
 #define HAVE_SNI
@@ -56,4 +57,6 @@
 #define HAVE_OCSP
 #define HAVE_OCSP_RESPONDER
 
+#define HAVE_OID_TABLE
+
 #endif /* _WIN_USER_SETTINGS_H_ */

manpages/wolfssl-asn1parse.1

@@ -0,0 +1,114 @@
+.\" Manpage for wolfssl asn1parse.
+.\" Contact facts@wolfssl.com to correct errors or typos.
+.TH wolfSSL SSL1  "June 2026" "0.2.0" "wolfssl asn1parse man page"
+.SH NAME
+wolfssl-asn1parse, asn1parse \- ASN.1 parsing utility
+.SH SYNOPSIS
+wolfssl asn1parse -in file [-inform DER|PEM|B64] [-out file] [-oid file] [-offset n] [-length n] [-strparse n[,n...]] [-i] [-dump] [-noout] [-help]
+.SH DESCRIPTION
+Parses an ASN.1 encoded structure (for example a certificate, key, or CRL)
+and prints a human readable listing of its tags, lengths, and contents.
+Input may be read in DER, PEM, or Base64 form.
+.SH GENERAL OPTIONS
+-help                 print the asn1parse help summary and exit.
+.br
+.LP
+-oid file             file of extra OID definitions. Each line uses the
+.br
+                      format: <oid> <shortName> <long name with spaces>.
+.br
+                      shortName is accepted for compatibility but only the
+.br
+                      long name is printed.
+.br
+                      The built in OID table is used unless wolfCLU was
+.br
+                      configured with --disable-oid-table.
+.br
+                      Names wolfSSL already knows take precedence over both
+.br
+                      the -oid file and the built in table.
+.SH I/O OPTIONS
+-in file              input file to read the ASN.1 structure from.
+.br
+                      Required.
+.br
+.LP
+-inform DER|PEM|B64   input file format. One of DER, PEM, or B64 (Base64).
+.br
+                      Defaults to DER.
+.br
+.LP
+-out file             output file for the ASN.1 DER data after processing.
+.br
+                      Best used with -strparse.
+.br
+.LP
+-noout                do not print the parsed output. Requires -out.
+.br
+.LP
+-offset n             offset into the DER data at which to begin parsing.
+.br
+                      For PEM and B64 input this is an offset into the
+.br
+                      decoded DER, not the file. With -strparse it is an
+.br
+                      offset into the nested structure.
+.br
+.LP
+-length n             number of bytes of DER data to parse. A length past
+.br
+                      the end of the data is reduced to the bytes remaining.
+.br
+.LP
+-strparse n[,n...]    offset to an OCTET/BIT STRING to parse. A comma
+.br
+                      separated list may be given, e.g. -strparse 702,64.
+.br
+                      -strparse is applied first, starting from the
+.br
+                      beginning of the input, and -offset and -length then
+.br
+                      select bytes within the nested result.
+.SH FORMATTING OPTIONS
+-i                    indent the output by structure depth instead of
+.br
+                      drawing branches.
+.br
+.LP
+-dump                 print data in hex form.
+.SH OUTPUT
+Each line is formatted as:
+.RS
+                     0: 4 [1187]  (0) SEQUENCE
+.RE
+.LP
+where the first number is the offset, the second is the header length, the
+value in brackets is the data length, and the value in parentheses is the
+depth. Brackets indicate constructed types and a plus indicates a primitive
+type.
+.SH EXAMPLES
+Parse a DER encoded certificate with indented output:
+.RS
+wolfssl asn1parse -inform DER -in cert.der -i
+.RE
+.LP
+Parse a PEM file and print data in hex form:
+.RS
+wolfssl asn1parse -in cert.pem -inform PEM -dump
+.RE
+.SH SEE ALSO
+.BR wolfssl-x509(1) ", " wolfssl-req(1)
+.SH NOTES
+Available only when wolfSSL is built with WOLFSSL_ASN_PRINT and wolfCLU is
+built with filesystem support (not WOLFCLU_NO_FILESYSTEM). The -oid option
+additionally requires object id encoding support (wolfSSL built with
+HAVE_OID_ENCODING, and NO_WC_ENCODE_OBJECT_ID not defined).
+.SH BUGS
+No known bugs at this time.
+.SH AUTHOR
+wolfSSL, Inc. (facts@wolfssl.com)
+.SH COPYRIGHT
+Copyright 2026 wolfSSL Inc.  All rights reserved.
+.SH REPORTING BUGS
+Report wolfssl bugs to support@wolfssl.com

manpages/wolfssl.1

@@ -55,6 +55,7 @@ Certificates and CAs
         req            generate certificate requests / self-signed certs
         verify         verify an X.509 certificate chain
         crl            parse and verify Certificate Revocation Lists
+        asn1parse      parse and print ASN.1 (DER/PEM/Base64) structures
 
 Keys
         genkey         generate cryptographic keys