New API for CRL unknown extension callback

[anhu]

Adds public entry points mirroring the existing X.509 unknown extension callback so callers can register a handler for unrecognized CRL extensions instead of failing with ASN_CRIT_EXT_E.

Fixes ZD 21887

[github-actions]

MemBrowse Memory Report

gcc-arm-cortex-m4-openssl-compat

• FLASH: .text +320 B (+0.0%, 771,348 B / 1,048,576 B, total: 74% used)

linuxkm-standard

• Data: __patchable_function_entries +24 B (+0.0%, 49,000 B)
  No memory changes detected for:
• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m3
• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-dtls13
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-pq
• gcc-arm-cortex-m4-rsa-only
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m4-tls13
• gcc-arm-cortex-m7
• gcc-arm-cortex-m7-pq
• gcc-arm-cortex-m7-tls13
• linuxkm-pie
• stm32-sim-stm32h753

[anhu]

jenkins retest this please.

[anhu]

jenkins retest this please

[Frauschi]

🐺 Skoll Code Review

Overall recommendation: APPROVE
Findings: 3 total — 3 posted, 0 skipped

Posted findings

• [Medium] CRL unknown-ext callback is a silent no-op in non-template (WOLFSSL_NO_ASN_TEMPLATE) builds — wolfcrypt/src/asn_orig.c:9194, wolfcrypt/src/asn_orig.c:9394-9541
• [Low] No test coverage for the non-Ex setter wolfSSL_CertManagerSetCRLUnknownExtCallback — tests/api/test_certman.c:3020-3190
• [Low] Positive-return sanitization untested on the CRL-level extension path — tests/api/test_certman.c:3160-3190, wolfcrypt/src/asn.c:37351-37357

Review generated by Skoll via Claude/Codex

[Frauschi]

🐺 Skoll Code Review

Overall recommendation: APPROVE
Findings: 25 total — 6 posted, 19 skipped

Posted findings

• [Medium] Accept-all CRL callback also silently bypasses recognized-but-unimplemented critical extensions (IDP, deltaCRLIndicator) — wolfcrypt/src/asn.c:37323-37364
• [Medium] New CRL unknown-extension callback is a silent no-op on every OpenSSL-compat CRL load path — src/crl.c:900-907
• [Medium] Zero-length entry-extension OID hands the callback an uninitialized 64-byte stack array — wolfcrypt/src/asn.c:36814-36879
• [Medium] Registering a permissive callback makes CRL parsing STRICTER when DecodeObjectId cannot decode the OID — wolfcrypt/src/asn.c:36872-36888
• [Medium] Observe-only callback silently disables RFC 5280 §5.3 enforcement for all critical CRL extensions, including Issuing Distribution Point — wolfssl/ssl.h:4477-4494
• [Low] Registering an accepting CRL callback turns previously-tolerated unknown non-critical entry extensions into hard load failures — wolfcrypt/src/asn.c:36858-36890

Skipped findings

• [Medium] Callback error code reaches the application differently depending on where the extension sits
• [Medium] Bare BAD_FUNC_ARG in test assertions instead of WC_NO_ERR_TRACE(BAD_FUNC_ARG)
• [Medium] GetCRLInfo callback wiring is untested
• [Medium] No test that the callback fires for a non-critical unknown CRL extension
• [Medium] New CRL unknown-extension callback is a silent no-op in non-template ASN builds, and the new unit tests fail there
• [Low] Registering a callback turns previously-skipped malformed entry extensions into hard load failures
• [Low] CRL-level dispatch reads the ASNGetData union through buffer.data instead of the buf + localIdx idiom used by the rest of the function
• [Low] Buffer-only callback tests are gated on !NO_FILESYSTEM
• [Low] Callback error codes are discarded by the caller, contradicting the preservation logic and the new ssl.h documentation
• [Low] Callback's negative error code is flattened to ASN_PARSE_E, contradicting the code's own comment and the X.509 callback it claims to mirror
• [Low] New unconditional ASN_PARSE_E when an unknown CRL entry extension's extnValue is malformed
• [Low] Ex callback and its context pointer are published and consumed as two unsynchronized accesses
• [Low] New setters return int while the adjacent unknown-extension setter returns void, and the return contract is undocumented
• [Info] Moved static test arrays keep function-body indentation at file scope
• [Info] New public API functions lack doxygen parameter/return blocks
• [Info] Cert-manager cert-side callback still has no Ex variant, leaving an asymmetric API surface
• [Info] New tests compare against bare BAD_FUNC_ARG instead of WC_NO_ERR_TRACE(BAD_FUNC_ARG)
• [Info] Callback/context pair is read unsynchronized and now fires from the CRL monitor thread
• [Info] Undocumented dispatch semantics: both callbacks chain, and neither can tell a CRL-level from a revoked-entry extension

Review generated by Skoll via Claude/Codex

[Frauschi]

GetASN_ObjectId() is only compiled under WOLFSSL_ASN_TEMPLATE, so this causes a compile-error with the old non-template asn code (also the cause for the PRB-master failure).