Separate entries with ",", ", ", "; " or a new line for
XN_FLAG_SEP_COMMA_PLUS, XN_FLAG_SEP_CPLUS_SPC, XN_FLAG_SEP_SPLUS_SPC
and XN_FLAG_SEP_MULTILINE, indenting every line for the last one.
Print long names for XN_FLAG_FN_LN, no name for XN_FLAG_FN_NONE and
pad names for XN_FLAG_FN_ALIGN, as OpenSSL does. XN_FLAG_FN_OID still
prints short names as wolfSSL has no OIDs for name attributes.
XN_FLAG_RFC2253 output changes from "CN=a, C=b" to "CN=a,C=b".
XN_FLAG_RFC2253 was defined as 1, the same bit as
ASN1_STRFLGS_ESC_2253, so a caller asking only for RFC 2253 escaping
also got the reversed DN order. OpenVPN master now calls
X509_NAME_print_ex() with XN_FLAG_SEP_CPLUS_SPC | XN_FLAG_FN_SN |
ASN1_STRFLGS_ESC_2253 | ASN1_STRFLGS_UTF8_CONVERT (fix for
CVE-2026-84790) and its ssl_testdriver failed against wolfSSL.
- Define XN_FLAG_RFC2253 and XN_FLAG_MULTILINE as OpenSSL does.
- Reverse the order only on XN_FLAG_DN_REV.
- Implement ASN1_STRFLGS_ESC_2253, ASN1_STRFLGS_ESC_CTRL and
ASN1_STRFLGS_ESC_MSB escaping as OpenSSL does.
- Write values byte for byte. An embedded NUL previously truncated
the value and copied uninitialized heap bytes into the BIO.
- Escaping can triple the value length. Reject lengths where the
buffer size would overflow.
Entries are still always separated by ", " and printed with their
short name. XN_FLAG_MULTILINE was 0xFFFF and behaved like
XN_FLAG_RFC2253; it now escapes control and non-ASCII bytes and does
not reverse the order.
Juliusz Sosinowicz
Emma Stensland
JacobBarthelmeh
Sean Parkinson