X509_NAME_oneline: escape '/', '+' and '\' inside attribute values by aidankeefe2022 · Pull Request #11446 · wolfSSL/wolfssl

aidankeefe2022 · 2026-09-11T21:30:49Z

A single attribute whose value contains the RDN separator rendered byte-identical to a name made of several attributes: CN="foo/O=bar" and CN=foo, O=bar both came out as "/CN=foo/O=bar". X509_NAME_cmp() compares this string, so the two names compared equal, and so did the issuer checks built on it.
#11392

Description

Add X509CertEscapeName(), which prefixes every '', '/' and '+' in a value with '', and use it wherever the one-line form is built:

GetRDN() and GetCertName(), which build the DecodedCert subject and issuer strings. The WC_ASN_NAME_MAX check now uses the escaped length.
AddAllEntry() and RebuildFullName(), which rebuild the string from the X509_NAME entries. The sizing pass skips entries with no value.

OpenSSL 3 escapes '/' and '+'. '' is escaped here as well: otherwise CN="foo", O=bar still renders as CN="foo/O=bar" does, and CN="a+b" as CN="a+b" does. A value containing '' therefore renders differently than it does in OpenSSL.

This changes the strings from wolfSSL_X509_NAME_oneline(), wc_GetDecodedCertSubject() and wc_GetDecodedCertIssuer() for values containing these characters, and so the caSubject that wc_OcspResponder_AddSigner() expects. Document the escaping for each.

Fixes zd#

Testing

test_wolfSSL_X509_NAME_oneline_escape covers names built from entries and names parsed from a signed certificate, that X509_NAME_dup() does not escape twice, and a value long enough that escaping doubles it.

Checklist

added tests
updated/added doxygen

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #11446

Scan targets checked: wolfcrypt-src, wolfcrypt-bugs, wolfssl-src, wolfssl-bugs

Findings: 4
4 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Reported findings require changes before merge.

github-actions · 2026-09-12T03:52:13Z

MemBrowse Memory Report · Explore what changed →

gcc-arm-cortex-m0plus

FLASH: .text +84 B (+0.1%, 70,803 B / 262,144 B, total: 27% used)

gcc-arm-cortex-m3

FLASH: .text +84 B (+0.1%, 131,761 B / 262,144 B, total: 50% used)

gcc-arm-cortex-m4

FLASH: .text +64 B (+0.0%, 209,036 B / 262,144 B, total: 80% used)

gcc-arm-cortex-m4-baremetal

FLASH: .text +64 B (+0.1%, 73,527 B / 262,144 B, total: 28% used)

gcc-arm-cortex-m4-crypto-only

FLASH: .text +64 B (+0.0%, 181,715 B / 262,144 B, total: 69% used)

gcc-arm-cortex-m4-dtls13

FLASH: .text +64 B (+0.0%, 195,992 B / 1,048,576 B, total: 19% used)

gcc-arm-cortex-m4-min-ecc

FLASH: .text +128 B (+0.2%, 68,121 B / 262,144 B, total: 26% used)

gcc-arm-cortex-m4-openssl-compat

FLASH: .text +192 B (+0.0%, 800,868 B / 1,048,576 B, total: 76% used)

gcc-arm-cortex-m4-pkcs7

FLASH: .text +128 B (+0.1%, 222,868 B / 262,144 B, total: 85% used)

gcc-arm-cortex-m4-pq

FLASH: .text +64 B (+0.0%, 312,848 B / 1,048,576 B, total: 30% used)

gcc-arm-cortex-m4-rsa-only

FLASH: .text +64 B (+0.0%, 343,696 B / 1,048,576 B, total: 33% used)

gcc-arm-cortex-m4-sp-math

FLASH: .text +128 B (+0.2%, 68,121 B / 262,144 B, total: 26% used)

gcc-arm-cortex-m4-tls12

FLASH: .text +128 B (+0.1%, 132,561 B / 262,144 B, total: 51% used)

gcc-arm-cortex-m4-tls13

FLASH: .text +128 B (+0.1%, 249,634 B / 262,144 B, total: 95% used)

gcc-arm-cortex-m7

FLASH: .text +64 B (+0.0%, 209,036 B / 262,144 B, total: 80% used)

gcc-arm-cortex-m7-pq

FLASH: .text +64 B (+0.0%, 313,680 B / 1,048,576 B, total: 30% used)

gcc-arm-cortex-m7-tls13

FLASH: .text +128 B (+0.1%, 249,634 B / 262,144 B, total: 95% used)

stm32-sim-stm32h753

FLASH: .text +320 B (+0.2%, 204,076 B / 2,097,152 B, total: 10% used)

zephyr-frdm_rw612

FLASH: text +48 B (+0.0%, 284,112 B / 67,108,864 B, total: 0% used)

_{Catch memory regressions in CI with MemBrowse. Free for open source.}

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #11446

Fenrir already completed a review of this PR at commit 8c3db19c5b5f (run 2502); its findings are the review threads on the PR. Push new commits to get a re-review of what changed, or comment @wolfSSL-Fenrir-bot review force to run the full review again at this commit.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #11446

Scan targets checked: wolfcrypt-src, wolfcrypt-bugs, wolfssl-src, wolfssl-bugs

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Reported findings require changes before merge.

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #11446

Scan targets checked: wolfssl-src, wolfssl-bugs
Unchanged since last review (not re-run): wolfcrypt-src, wolfcrypt-bugs

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

Fenrir's latest completed scan found no issues; clearing the prior automated change request.

aidankeefe2022 · 2026-09-18T18:31:18Z

retest this please

aidankeefe2022 · 2026-09-25T17:38:54Z

retest this please

aidankeefe2022 · 2026-09-29T15:49:47Z

retest this please

wolfSSL-Fenrir-bot

Fenrir Automated Review — PR #11446

Scan targets checked: wolfssl-src, wolfssl-bugs
Unchanged since last review (not re-run): wolfcrypt-src, wolfcrypt-bugs
Coverage: 1 of 1 in-scope changed file(s) opened by the reviewer

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

Review tier: Lite

padelsbach · 2026-10-21T19:02:46Z

@aidankeefe2022 , can you please rebase this PR to get a fresh CI run on it?

Copilot

🟡 Changes recommended

Escaped subject names can silently lose the CN and collide during OCSP CA selection, while certificate-generation tests fail in RSA public-only or verify-only configurations.

2 open issues

What changed in this PR

Addresses #11392 by escaping separator characters in X.509 attribute values, distinguishing names that previously produced identical one-line strings.

Changes:

Adds shared escaping for /, +, and \ in both certificate parsers and X509 name rebuilding, with escaped-length sizing.
Adds regression tests for name collisions, duplication, certificate parsing, and buffer boundaries.
Documents the output format, OpenSSL differences, and OCSP subject-name requirements.

File	Description
wolfssl/wolfcrypt/asn.h	Declares the shared escaping helper.
wolfcrypt/src/asn.c	Implements escaping and updates the template parser.
wolfcrypt/src/asn_orig.c	Applies escaping in the original parser.
tests/api/test_ossl_x509_name.h	Registers the escaping regression test.
tests/api/test_ossl_x509_name.c	Tests escaped output, comparisons, duplication, and parsing.
tests/api/test_asn.c	Extends buffer-boundary tests for escaped values.
src/x509.c	Updates name rebuilding and allocation sizing.
doc/dox_comments/header_files/ssl.h	Documents one-line escaping and OpenSSL differences.
doc/dox_comments/header_files/ocsp.h	Clarifies escaped CA subject input.
doc/dox_comments/header_files/asn_public.h	Documents escaped subject and issuer output.

_{Review effort: Balanced}

A single attribute whose value contains the RDN separator rendered byte-identical to a name made of several attributes: CN="foo/O=bar" and CN=foo, O=bar both came out as "/CN=foo/O=bar". X509_NAME_cmp() compares this string, so the two names compared equal, and so did the issuer checks built on it. Add X509CertEscapeName(), which prefixes every '\', '/' and '+' in a value with '\', and use it wherever the one-line form is built: - GetRDN() and GetCertName(), which build the DecodedCert subject and issuer strings. The WC_ASN_NAME_MAX check now uses the escaped length. - AddAllEntry() and RebuildFullName(), which rebuild the string from the X509_NAME entries. The sizing pass skips entries with no value. OpenSSL 3 escapes '/' and '+'. '\' is escaped here as well: otherwise CN="foo\", O=bar still renders as CN="foo/O=bar" does, and CN="a\+b" as CN="a+b" does. A value containing '\' therefore renders differently than it does in OpenSSL. This changes the strings from wolfSSL_X509_NAME_oneline(), wc_GetDecodedCertSubject() and wc_GetDecodedCertIssuer() for values containing these characters, and so the caSubject that wc_OcspResponder_AddSigner() expects. Document the escaping for each. test_wolfSSL_X509_NAME_oneline_escape covers names built from entries and names parsed from a signed certificate, that X509_NAME_dup() does not escape twice, and a value long enough that escaping doubles it. This change also means that some CNs will be made longer and maybe dropped where they weren't previously. Issue: wolfSSL#11392

aidankeefe2022 · 2026-11-06T17:45:46Z

looked for more nits and fixed them up

aidankeefe2022 · 2026-11-06T21:37:39Z

retest this please

padelsbach

Looks good, thanks

aidankeefe2022 self-assigned this Sep 11, 2026

aidankeefe2022 mentioned this pull request Sep 11, 2026

X509_NAME_oneline(): two structurally different certificate subjects render identically (no escaping of '/' or '+' in RDN values) #11392

Closed

aidankeefe2022 requested a review from wolfSSL-Fenrir-bot September 11, 2026 21:32

wolfSSL-Fenrir-bot previously requested changes Sep 11, 2026

View reviewed changes

Comment thread wolfcrypt/src/asn.c Resolved

Comment thread wolfcrypt/src/asn_orig.c Resolved

Comment thread wolfcrypt/src/asn_orig.c Resolved

Comment thread src/x509.c Resolved

aidankeefe2022 requested a review from wolfSSL-Fenrir-bot September 15, 2026 16:31

wolfSSL-Fenrir-bot reviewed Sep 15, 2026

View reviewed changes

aidankeefe2022 force-pushed the wolfssl_issue_x509 branch 3 times, most recently from 94e06e1 to 0abe298 Compare September 15, 2026 22:13

aidankeefe2022 requested a review from wolfSSL-Fenrir-bot September 15, 2026 22:14

wolfSSL-Fenrir-bot previously requested changes Sep 15, 2026

View reviewed changes

Comment thread src/x509.c Resolved

aidankeefe2022 force-pushed the wolfssl_issue_x509 branch from 0abe298 to 0071a99 Compare September 17, 2026 23:07

aidankeefe2022 requested a review from wolfSSL-Fenrir-bot September 17, 2026 23:07

wolfSSL-Fenrir-bot reviewed Sep 17, 2026

View reviewed changes

aidankeefe2022 force-pushed the wolfssl_issue_x509 branch 2 times, most recently from 9aa3c73 to 81d09d5 Compare September 18, 2026 22:45

aidankeefe2022 force-pushed the wolfssl_issue_x509 branch from 81d09d5 to b551bb4 Compare September 29, 2026 21:48

aidankeefe2022 requested a review from wolfSSL-Fenrir-bot September 29, 2026 21:48

wolfSSL-Fenrir-bot reviewed Sep 29, 2026

View reviewed changes

aidankeefe2022 assigned wolfSSL-Bot and unassigned aidankeefe2022 Oct 1, 2026

philljj requested a review from padelsbach October 21, 2026 14:43

philljj assigned padelsbach Oct 21, 2026

padelsbach mentioned this pull request Oct 21, 2026

Ensure that a resumed session properly handles client auth. Clear session ticket resumption state in wolfSSL_clear. #11600

Merged

1 of 4 tasks

padelsbach reviewed Oct 21, 2026

View reviewed changes

Comment thread wolfcrypt/src/asn.c Resolved

Comment thread tests/api/test_ossl_x509_name.c Resolved

Comment thread src/x509.c Resolved

padelsbach assigned aidankeefe2022 and unassigned wolfSSL-Bot and padelsbach Oct 21, 2026

aidankeefe2022 force-pushed the wolfssl_issue_x509 branch from b551bb4 to 683f97e Compare November 3, 2026 23:05

Copilot AI balanced review requested due to automatic review settings November 3, 2026 23:05

Copilot started reviewing on behalf of aidankeefe2022 November 3, 2026 23:06

View session

Copilot AI reviewed Nov 3, 2026

View reviewed changes

Comment thread wolfcrypt/src/asn.c Resolved

Comment thread tests/api/test_ossl_x509_name.c Resolved

aidankeefe2022 force-pushed the wolfssl_issue_x509 branch from 1b3e2b2 to f80ce9c Compare November 4, 2026 19:44

aidankeefe2022 added 3 commits November 5, 2026 11:31

github issue

383694d

clang-tidy warning fix

75fc907

aidankeefe2022 force-pushed the wolfssl_issue_x509 branch from 6ac8b74 to 75fc907 Compare November 5, 2026 18:31

padelsbach reviewed Nov 5, 2026

View reviewed changes

Comment thread tests/api/test_ossl_x509_name.h Resolved

padelsbach reviewed Nov 5, 2026

View reviewed changes

Comment thread tests/api/test_ossl_x509_name.c Resolved

padelsbach reviewed Nov 5, 2026

View reviewed changes

Comment thread src/x509.c Resolved

padelsbach reviewed Nov 5, 2026

View reviewed changes

Comment thread src/x509.c Resolved

aidankeefe2022 force-pushed the wolfssl_issue_x509 branch from cc331ca to e390d61 Compare November 5, 2026 22:45

padelsbach reviewed Nov 6, 2026

View reviewed changes

Comment thread src/x509.c Resolved

aidankeefe2022 force-pushed the wolfssl_issue_x509 branch from e390d61 to 1fa7e3f Compare November 6, 2026 17:35

Review fixes

44925e0

aidankeefe2022 force-pushed the wolfssl_issue_x509 branch from 1fa7e3f to 44925e0 Compare November 6, 2026 17:45

padelsbach approved these changes Nov 6, 2026

View reviewed changes

padelsbach merged commit c46c49b into wolfSSL:master Nov 6, 2026
443 checks passed

aidankeefe2022 deleted the wolfssl_issue_x509 branch November 6, 2026 23:39

Conversation

aidankeefe2022 commented Sep 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Testing

Checklist

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #11446

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

github-actions Bot commented Sep 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

MemBrowse Memory Report · Explore what changed →

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #11446

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #11446

Uh oh!

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #11446

Uh oh!

aidankeefe2022 commented Sep 18, 2026

Uh oh!

aidankeefe2022 commented Sep 25, 2026

Uh oh!

aidankeefe2022 commented Sep 29, 2026

Uh oh!

wolfSSL-Fenrir-bot left a comment

Choose a reason for hiding this comment

Fenrir Automated Review — PR #11446

Uh oh!

Uh oh!

Uh oh!

Uh oh!

padelsbach commented Oct 21, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

🟡 Changes recommended

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

aidankeefe2022 commented Nov 6, 2026

Uh oh!

aidankeefe2022 commented Nov 6, 2026

Uh oh!

padelsbach left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

aidankeefe2022 commented Sep 11, 2026 •

edited

Loading

github-actions Bot commented Sep 12, 2026 •

edited

Loading