Reduce OpenSSL compat layer heap use and time when parsing certificates

certs/test/cert-max-name-entries.cfg

@@ -0,0 +1,25 @@
+[ req ]
+distinguished_name = req_distinguished_name
+prompt             = no
+x509_extensions    = v3_ca
+
+[ req_distinguished_name ]
+0.OU = Unit 1
+1.OU = Unit 2
+2.OU = Unit 3
+3.OU = Unit 4
+4.OU = Unit 5
+5.OU = Unit 6
+6.OU = Unit 7
+7.OU = Unit 8
+8.OU = Unit 9
+9.OU = Unit 10
+10.OU = Unit 11
+11.OU = Unit 12
+12.OU = Unit 13
+13.OU = Unit 14
+14.OU = Unit 15
+CN = www.wolfssl.com
+
+[ v3_ca ]
+basicConstraints = critical, CA:TRUE

certs/test/cert-max-name-entries.pem

@@ -0,0 +1,29 @@
+-----BEGIN CERTIFICATE-----
+MIIE4zCCA8ugAwIBAgIUNsLW2RNP4CtaY3EwJupxH/8NMHUwDQYJKoZIhvcNAQEL
+BQAwggEfMQ8wDQYDVQQLDAZVbml0IDExDzANBgNVBAsMBlVuaXQgMjEPMA0GA1UE
+CwwGVW5pdCAzMQ8wDQYDVQQLDAZVbml0IDQxDzANBgNVBAsMBlVuaXQgNTEPMA0G
+A1UECwwGVW5pdCA2MQ8wDQYDVQQLDAZVbml0IDcxDzANBgNVBAsMBlVuaXQgODEP
+MA0GA1UECwwGVW5pdCA5MRAwDgYDVQQLDAdVbml0IDEwMRAwDgYDVQQLDAdVbml0
+IDExMRAwDgYDVQQLDAdVbml0IDEyMRAwDgYDVQQLDAdVbml0IDEzMRAwDgYDVQQL
+DAdVbml0IDE0MRAwDgYDVQQLDAdVbml0IDE1MRgwFgYDVQQDDA93d3cud29sZnNz
+bC5jb20wHhcNMjYxMDI4MTM0NTQzWhcNMjkwNzI0MTM0NTQzWjCCAR8xDzANBgNV
+BAsMBlVuaXQgMTEPMA0GA1UECwwGVW5pdCAyMQ8wDQYDVQQLDAZVbml0IDMxDzAN
+BgNVBAsMBlVuaXQgNDEPMA0GA1UECwwGVW5pdCA1MQ8wDQYDVQQLDAZVbml0IDYx
+DzANBgNVBAsMBlVuaXQgNzEPMA0GA1UECwwGVW5pdCA4MQ8wDQYDVQQLDAZVbml0
+IDkxEDAOBgNVBAsMB1VuaXQgMTAxEDAOBgNVBAsMB1VuaXQgMTExEDAOBgNVBAsM
+B1VuaXQgMTIxEDAOBgNVBAsMB1VuaXQgMTMxEDAOBgNVBAsMB1VuaXQgMTQxEDAO
+BgNVBAsMB1VuaXQgMTUxGDAWBgNVBAMMD3d3dy53b2xmc3NsLmNvbTCCASIwDQYJ
+KoZIhvcNAQEBBQADggEPADCCAQoCggEBAMCVCOFXQfJxbbfSRUEnAWXGRa7yvCQw
+uJXOL07W9hyIvHyf+6hnf/5cnFF194rKB+c1L4/hvXvAL3yrZKgX/Mpde7rgIeVy
+Lm8uhtiVc9qsG1O5Xz/XGQ0lT+FjY1GLC2Q/rUO4pRxcNLOuAKBjxfZ/C1loeHOm
+jBipAm2vwxkBLrgQ48bMQLRpo0YzaYduxLsXpvPo3a1zvHsvIbX9ZlEMvVSz4W1f
+HLwjc9EJA4kU0hC5ZMMq0KGWSrzh1Bpbx6DAwWN4D0Q3MDKWgDIjlaF3uhPSl3Pi
+XSXJag3DOWCktLBpQkIJ6dgIvDMgs1gip6rrxOHmYYPF0pbf2dBPrdcCAwEAAaMT
+MBEwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAmTfaakUVMMDE
+vIafwGdq5qxOGFGECFhKS8yRFiuzIUpddrzcrn4V1H9gVtD0ND2ke4sevNCV8e23
+XHgcsrjahzx09HP6vrcrgpuwGawzd1S0jGuXtE9bq7/QnJo2co4wK6/DWEIzE752
+Gzj8iu4e0K7WHBokz1mqwBwB7FBFVrMC1e9rJS40kOaIvvY9jPVEb7wT1ajOj7Wt
+e++8E7IPyLqh59K5g2rthdEaj6q1YCHIYGe+xa6IVUk/XnOP3lw+ltjaN28a161G
++wdw5wxWYIN+3utOLmGr8euZu5pyvL4HXxYEKlcZ8u/M9MqJY7Qzq752Kf7rs4Ms
+8nRLzUmiDQ==
+-----END CERTIFICATE-----

certs/test/cert-over-max-name-entries.cfg

@@ -0,0 +1,26 @@
+[ req ]
+distinguished_name = req_distinguished_name
+prompt             = no
+x509_extensions    = v3_ca
+
+[ req_distinguished_name ]
+0.OU = Unit 1
+1.OU = Unit 2
+2.OU = Unit 3
+3.OU = Unit 4
+4.OU = Unit 5
+5.OU = Unit 6
+6.OU = Unit 7
+7.OU = Unit 8
+8.OU = Unit 9
+9.OU = Unit 10
+10.OU = Unit 11
+11.OU = Unit 12
+12.OU = Unit 13
+13.OU = Unit 14
+14.OU = Unit 15
+15.OU = Unit 16
+CN = www.wolfssl.com
+
+[ v3_ca ]
+basicConstraints = critical, CA:TRUE

certs/test/cert-over-max-name-entries.pem

@@ -0,0 +1,29 @@
+-----BEGIN CERTIFICATE-----
+MIIFBzCCA++gAwIBAgIUdexUP+aDlmBpXXrWAPj7Q0naxUIwDQYJKoZIhvcNAQEL
+BQAwggExMQ8wDQYDVQQLDAZVbml0IDExDzANBgNVBAsMBlVuaXQgMjEPMA0GA1UE
+CwwGVW5pdCAzMQ8wDQYDVQQLDAZVbml0IDQxDzANBgNVBAsMBlVuaXQgNTEPMA0G
+A1UECwwGVW5pdCA2MQ8wDQYDVQQLDAZVbml0IDcxDzANBgNVBAsMBlVuaXQgODEP
+MA0GA1UECwwGVW5pdCA5MRAwDgYDVQQLDAdVbml0IDEwMRAwDgYDVQQLDAdVbml0
+IDExMRAwDgYDVQQLDAdVbml0IDEyMRAwDgYDVQQLDAdVbml0IDEzMRAwDgYDVQQL
+DAdVbml0IDE0MRAwDgYDVQQLDAdVbml0IDE1MRAwDgYDVQQLDAdVbml0IDE2MRgw
+FgYDVQQDDA93d3cud29sZnNzbC5jb20wHhcNMjYxMDI4MTM0NTQzWhcNMjkwNzI0
+MTM0NTQzWjCCATExDzANBgNVBAsMBlVuaXQgMTEPMA0GA1UECwwGVW5pdCAyMQ8w
+DQYDVQQLDAZVbml0IDMxDzANBgNVBAsMBlVuaXQgNDEPMA0GA1UECwwGVW5pdCA1
+MQ8wDQYDVQQLDAZVbml0IDYxDzANBgNVBAsMBlVuaXQgNzEPMA0GA1UECwwGVW5p
+dCA4MQ8wDQYDVQQLDAZVbml0IDkxEDAOBgNVBAsMB1VuaXQgMTAxEDAOBgNVBAsM
+B1VuaXQgMTExEDAOBgNVBAsMB1VuaXQgMTIxEDAOBgNVBAsMB1VuaXQgMTMxEDAO
+BgNVBAsMB1VuaXQgMTQxEDAOBgNVBAsMB1VuaXQgMTUxEDAOBgNVBAsMB1VuaXQg
+MTYxGDAWBgNVBAMMD3d3dy53b2xmc3NsLmNvbTCCASIwDQYJKoZIhvcNAQEBBQAD
+ggEPADCCAQoCggEBAMCVCOFXQfJxbbfSRUEnAWXGRa7yvCQwuJXOL07W9hyIvHyf
++6hnf/5cnFF194rKB+c1L4/hvXvAL3yrZKgX/Mpde7rgIeVyLm8uhtiVc9qsG1O5
+Xz/XGQ0lT+FjY1GLC2Q/rUO4pRxcNLOuAKBjxfZ/C1loeHOmjBipAm2vwxkBLrgQ
+48bMQLRpo0YzaYduxLsXpvPo3a1zvHsvIbX9ZlEMvVSz4W1fHLwjc9EJA4kU0hC5
+ZMMq0KGWSrzh1Bpbx6DAwWN4D0Q3MDKWgDIjlaF3uhPSl3PiXSXJag3DOWCktLBp
+QkIJ6dgIvDMgs1gip6rrxOHmYYPF0pbf2dBPrdcCAwEAAaMTMBEwDwYDVR0TAQH/
+BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAvoraEaAYuFdQBu0teN4CbKmz7ADh
++pNY18LYO9EH7YUNqVElkeUB74ti+plPIY4KMHja/5GyojHnhay8MsL8AUvc0Ngk
+4sy+tkbBS6CmsrCl+Cxqb2fwmGQ4OznKosbjkfngSigKb6kyD/cBK5CUKAewqnBu
+v4vmx6GYZ8ppqgZyT19SZvUv4KvhEpwARPjicsaAe+rLs72VrqgfSZOBCFonCc0p
+RLCecYCunYQItaDIc6dgQu09QEwPgcR4yp503B4jI2h4MlkfLkhmQT+aotU81Z9U
+r/zDrwlGcFNjda0VajrlAyqux+23RAY5OnY8c3x0EOEyWdoTFyVhf0ax1Q==
+-----END CERTIFICATE-----

certs/test/gen-ext-certs.sh

@@ -1541,3 +1541,69 @@ DNS.1050 = example1050.com
 EOF
 gen_cert
 
+# Subject and issuer with 16 attributes: the most an X509_NAME holds
+# with OPENSSL_EXTRA
+OUT=certs/test/cert-max-name-entries
+CONFIG=certs/test/cert-max-name-entries.cfg
+tee >$CONFIG <<EOF
+[ req ]
+distinguished_name = req_distinguished_name
+prompt             = no
+x509_extensions    = v3_ca
+
+[ req_distinguished_name ]
+0.OU = Unit 1
+1.OU = Unit 2
+2.OU = Unit 3
+3.OU = Unit 4
+4.OU = Unit 5
+5.OU = Unit 6
+6.OU = Unit 7
+7.OU = Unit 8
+8.OU = Unit 9
+9.OU = Unit 10
+10.OU = Unit 11
+11.OU = Unit 12
+12.OU = Unit 13
+13.OU = Unit 14
+14.OU = Unit 15
+CN = www.wolfssl.com
+
+[ v3_ca ]
+basicConstraints = critical, CA:TRUE
+EOF
+gen_cert
+
+# Subject and issuer with 17 attributes: one more than an X509_NAME
+# holds with OPENSSL_EXTRA
+OUT=certs/test/cert-over-max-name-entries
+CONFIG=certs/test/cert-over-max-name-entries.cfg
+tee >$CONFIG <<EOF
+[ req ]
+distinguished_name = req_distinguished_name
+prompt             = no
+x509_extensions    = v3_ca
+
+[ req_distinguished_name ]
+0.OU = Unit 1
+1.OU = Unit 2
+2.OU = Unit 3
+3.OU = Unit 4
+4.OU = Unit 5
+5.OU = Unit 6
+6.OU = Unit 7
+7.OU = Unit 8
+8.OU = Unit 9
+9.OU = Unit 10
+10.OU = Unit 11
+11.OU = Unit 12
+12.OU = Unit 13
+13.OU = Unit 14
+14.OU = Unit 15
+15.OU = Unit 16
+CN = www.wolfssl.com
+
+[ v3_ca ]
+basicConstraints = critical, CA:TRUE
+EOF
+gen_cert

certs/test/include.am

@@ -48,6 +48,12 @@ EXTRA_DIST += \
          certs/test/cert-over-max-altnames.pem \
          certs/test/cert-over-max-nc.cfg \
          certs/test/cert-over-max-nc.pem \
+         certs/test/cert-max-name-entries.cfg \
+         certs/test/cert-max-name-entries.der \
+         certs/test/cert-max-name-entries.pem \
+         certs/test/cert-over-max-name-entries.cfg \
+         certs/test/cert-over-max-name-entries.der \
+         certs/test/cert-over-max-name-entries.pem \
          certs/test/client-ecc-cert-ski.hex
 
 # The certs/server-cert with the last byte (signature byte) changed

src/crl.c

@@ -731,14 +731,31 @@ int CheckCertCRL_ex(WOLFSSL_CRL* crl, byte* issuerHash, byte* serial,
             extCrlInfo, extCrlInfoSz, issuerName, crl->cm, 1);
 }
 
-static int CheckDecodedCertCRL(WOLFSSL_CRL* crl, DecodedCert* cert,
-        WOLFSSL_CERT_MANAGER* cm, int canRetry)
+/* Get the issuer X509_NAME of cert to pass to CheckCertCRLCm(). */
+static void* CertCrlIssuerName(DecodedCert* cert)
 {
-#if defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL)
-    void* issuerName = cert->issuerName;
+#if defined(OPENSSL_ALL) && defined(WOLFSSL_CERT_GEN) && \
+    (defined(WOLFSSL_CERT_REQ) || defined(WOLFSSL_CERT_EXT)) && \
+    !defined(NO_FILESYSTEM) && !defined(NO_WOLFSSL_DIR) && \
+    !defined(NO_STDIO_FILESYSTEM) && \
+    (!defined(NO_WOLFSSL_CLIENT) || !defined(WOLFSSL_NO_CLIENT_AUTH))
+    /* Used to load a CRL from the hash directory. The cert may have been
+     * parsed without its X509_NAMEs. */
+    (void)GetCertX509Name(cert, ASN_ISSUER, NULL);
+    return cert->issuerName;
+#elif defined(OPENSSL_EXTRA) || defined(OPENSSL_EXTRA_X509_SMALL)
+    return cert->issuerName;
 #else
-    void* issuerName = NULL;
+    (void)cert;
+    return NULL;
 #endif
+}
+
+static int CheckDecodedCertCRL(WOLFSSL_CRL* crl, DecodedCert* cert,
+        WOLFSSL_CERT_MANAGER* cm, int canRetry)
+{
+    void* issuerName = CertCrlIssuerName(cert);
+
     return CheckCertCRLCm(crl, cert->issuerHash, cert->serial, cert->serialSz,
             NULL, cert->extCrlInfo, cert->extCrlInfoSz, issuerName, cm,
             canRetry);