New API for CRL unknown extension callback

[anhu]

Adds public entry points mirroring the existing X.509 unknown extension callback so callers can register a handler for unrecognized CRL extensions instead of failing with ASN_CRIT_EXT_E.

Fixes ZD 21887

[github-actions]

MemBrowse Memory Report

gcc-arm-cortex-m3

• FLASH: .text +64 B (+0.1%, 122,603 B / 262,144 B, total: 47% used)

gcc-arm-cortex-m4

• FLASH: .text +64 B (+0.0%, 200,853 B / 262,144 B, total: 77% used)

gcc-arm-cortex-m4-dtls13

• FLASH: .text +64 B (+0.0%, 181,092 B / 1,048,576 B, total: 17% used)

gcc-arm-cortex-m4-openssl-compat

• FLASH: .text +832 B (+0.1%, 770,044 B / 1,048,576 B, total: 73% used)

gcc-arm-cortex-m4-rsa-only

• FLASH: .text +256 B (+0.1%, 326,168 B / 1,048,576 B, total: 31% used)

gcc-arm-cortex-m4-tls12

• FLASH: .text +64 B (+0.1%, 123,355 B / 262,144 B, total: 47% used)

gcc-arm-cortex-m7

• FLASH: .text +64 B (+0.0%, 200,853 B / 262,144 B, total: 77% used)

linuxkm-standard

• Data: __patchable_function_entries +64 B (+0.1%, 48,680 B)
  No memory changes detected for:
• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-pq
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls13
• gcc-arm-cortex-m7-pq
• gcc-arm-cortex-m7-tls13
• linuxkm-pie
• stm32-sim-stm32h753

[anhu]

jenkins retest this please.

[anhu]

jenkins retest this please

[Frauschi]

🐺 Skoll Code Review

Overall recommendation: APPROVE
Findings: 3 total — 3 posted, 0 skipped

Posted findings

• [Medium] CRL unknown-ext callback is a silent no-op in non-template (WOLFSSL_NO_ASN_TEMPLATE) builds — wolfcrypt/src/asn_orig.c:9194, wolfcrypt/src/asn_orig.c:9394-9541
• [Low] No test coverage for the non-Ex setter wolfSSL_CertManagerSetCRLUnknownExtCallback — tests/api/test_certman.c:3020-3190
• [Low] Positive-return sanitization untested on the CRL-level extension path — tests/api/test_certman.c:3160-3190, wolfcrypt/src/asn.c:37351-37357

Review generated by Skoll via Claude/Codex

[Frauschi]

🔵 [Low] No test coverage for the non-Ex setter wolfSSL_CertManagerSetCRLUnknownExtCallback
🔧 NIT test

All three new tests exercise only the ...Ex variant (wolfSSL_CertManagerSetCRLUnknownExtCallbackEx). The non-Ex public API wolfSSL_CertManagerSetCRLUnknownExtCallback (which sets crlUnknownExtCallback and drives the dcrl->unknownExtCallback(...) branch in both parse paths) is never called by any test, so that branch is uncovered.

Suggestion: Add a case that registers the non-Ex callback via wolfSSL_CertManagerSetCRLUnknownExtCallback and asserts it fires (the non-Ex callback signature omits the ctx argument).