Add public alt-name list APIs

[Frauschi]

Promotes wolfSSL's internal SAN-list helpers to a public wc_ API so apps can build SAN entries, encode them, and attach them to a Cert before signing without using internal functions.

New functions

Function	Purpose
wc_SetDNSEntry()	Append a typed alt-name entry (DNS, IP, RFC822, URI, …) to a DNS_entry list.
wc_FlattenAltNames()	Encode a list into a DER GeneralNames SEQUENCE (general buffer primitive).
wc_SetAltNamesFromList()	Encode a list straight into cert->altNames/altNamesSz - mirrors wc_SetAltNamesBuffer.

Notes

• Prototypes live in asn.h (they use the DNS_entry type) and share the WOLFSSL_ASN_API export gate (WOLFSSL_PUBLIC_ASN/OPENSSL_EXTRA/…); doxygen documents this.
• Guarded by WOLFSSL_CERT_GEN && WOLFSSL_ALT_NAMES.

Testing

Adds flattenAltNames_test covering success, NULL-list, NULL-output, BUFFER_E, and the Cert paths. Builds clean and passes under --enable-all.

Used in wolfCert.

[github-actions]

retest this please

[github-actions]

MemBrowse Memory Report

gcc-arm-cortex-m0plus

• FLASH: .text +12 B (+0.0%, 63,507 B / 262,144 B, total: 24% used)

gcc-arm-cortex-m3

• FLASH: .text +4 B (+0.0%, 121,413 B / 262,144 B, total: 46% used)

gcc-arm-cortex-m4-openssl-compat

• FLASH: .text +64 B (+0.0%, 768,196 B / 1,048,576 B, total: 73% used)

linuxkm-pie

• Data: __patchable_function_entries +24 B (+0.1%, 24,312 B)

linuxkm-standard

• Data: __patchable_function_entries +32 B (+0.1%, 46,048 B)

stm32-sim-stm32h753

• FLASH: .text -64 B (-0.0%, 181,620 B / 2,097,152 B, total: 9% used)
  No memory changes detected for:
• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-dtls13
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-pq
• gcc-arm-cortex-m4-rsa-only
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m4-tls13
• gcc-arm-cortex-m7
• gcc-arm-cortex-m7-pq
• gcc-arm-cortex-m7-tls13

[dgarske]

Skoll Code Review

Scan type: reviewOverall recommendation: COMMENT
Findings: 3 total — 3 posted, 0 skipped
3 finding(s) posted as inline comments (see file-level comments below)

Posted findings

• [Medium] New public wc_SetDNSEntry() does no argument validation, unlike its sibling wrappers — wolfcrypt/src/asn.c:14528-14532
• [Medium] Test does not cover documented NULL-names path of wc_SetAltNamesFromList or wc_SetDNSEntry error paths — wolfcrypt/test/test.c:26581-26606
• [Low] API availability mismatch: wc_SetDNSEntry can build a list that cannot be flattened in some build configs — wolfssl/wolfcrypt/asn.h:2393-2397

Review generated by Skoll

[dgarske]

🟠 [Medium] New public wc_SetDNSEntry() does no argument validation, unlike its sibling wrappers

This PR promotes the previously static internal SetDNSEntry() to a public API via a bare pass-through wrapper. The other two wrappers added in this same PR validate their pointer arguments (wc_SetAltNamesFromList checks cert == NULL, and wc_FlattenAltNames/FlattenAltNames checks output == NULL), but wc_SetDNSEntry performs no validation at all. Because it now accepts caller-supplied values from outside the library, malformed inputs reach SetDNSEntry() directly: a negative strLen flows into XMALLOC((size_t)strLen + 1, ...) and XMEMCPY(dnsEntry_name, str, (size_t)strLen) where the negative value casts to a huge size_t (out-of-bounds copy / crash); a NULL entries is dereferenced in AddDNSEntryToList(*lst...); and a NULL str with non-zero strLen causes a NULL read in XMEMCPY. The doxygen for this function does not document any BAD_FUNC_ARG return for these cases. wolfSSL convention is for public wc_ functions to return a non-void error and validate inputs at the boundary.

Fix: Add boundary validation (NULL str, NULL entries, negative strLen) in the public wrapper and document the BAD_FUNC_ARG return in the doxygen, to be consistent with the other two wrappers added in this PR and with wolfSSL public-API conventions.

[dgarske]

🟠 [Medium] Test does not cover documented NULL-names path of wc_SetAltNamesFromList or wc_SetDNSEntry error paths

The new test exercises the success paths, NULL-output, BAD_FUNC_ARG, BUFFER_E, and the NULL-cert path well. However, wc_SetAltNamesFromList() documents that names may be NULL, in which case cert->altNamesSz is set to 0 (this is a distinct branch: FlattenAltNames returns 0 and the function stores 0). That documented behavior is not asserted by any test. Likewise, none of the wc_SetDNSEntry() error returns are exercised. These are reasonable gaps to close while a dedicated test is being added.

Fix: Add an assertion that wc_SetAltNamesFromList(cert, NULL) returns 0 and sets cert->altNamesSz == 0, matching the documented contract. Optionally add a wc_SetDNSEntry error-path case.

[dgarske]

🔵 [Low] API availability mismatch: wc_SetDNSEntry can build a list that cannot be flattened in some build configs

wc_SetDNSEntry is gated by WOLFSSL_ASN_TEMPLATE && (WOLFSSL_CERT_GEN || !defined(NO_CERTS)), while its companions wc_FlattenAltNames and wc_SetAltNamesFromList are gated by WOLFSSL_CERT_GEN && WOLFSSL_ALT_NAMES. In a build with !NO_CERTS and WOLFSSL_ASN_TEMPLATE but without WOLFSSL_CERT_GEN/WOLFSSL_ALT_NAMES, a caller can construct a DNS_entry list via wc_SetDNSEntry (whose doxygen \sa points at wc_FlattenAltNames) but has no public function to encode it. This is a benign surface inconsistency, not a build break, but it makes the documented usage flow unavailable in that configuration.

Fix: Consider aligning the guards (or documenting the gap) so the wc_SetDNSEntry -> wc_FlattenAltNames flow advertised in the doxygen is available together. Mirroring the internal availability is acceptable, but a short note in the docs would avoid confusion.