add ssh server extended key usage parsing and missing ssh extended ke…

[JacobBarthelmeh]

No description provided.

[Copilot]

🟢 Approval recommended

The added SSH server EKU support is consistently wired through OID tables, decoding logic, and is covered by a focused regression test.

Pull request overview

Adds support for decoding the RFC 6187 SSH server Extended Key Usage (EKU) OID into wolfSSL’s SSH-specific EKU bitfield, bringing parity across ASN parsing implementations and validating behavior with an API test.

Changes:

• Add id-kp-secureShellServer (1.3.6.1.5.5.7.3.22) to the EKU OID tables and OID->bytes mapping.
• Extend EKU decoding to set a new EXTKEYUSE_SSH_SERVER_AUTH bit when the SSH server EKU is present.
• Add an API test that parses a self-signed certificate containing only the SSH client/server EKUs and asserts the decoded SSH EKU flags.

File summaries

File	Description
wolfssl/wolfcrypt/oid_sum.h	Adds the SSH server-auth EKU identifier to the summarized OID enum values.
wolfssl/wolfcrypt/asn.h	Introduces the EXTKEYUSE_SSH_SERVER_AUTH bit for decoded SSH EKUs.
wolfcrypt/src/asn.c	Adds SSH server-auth OID bytes + OidFromId mapping and decodes SSH EKUs into extExtKeyUsageSsh.
wolfcrypt/src/asn_orig.c	Mirrors the SSH server-auth decoding change for the non-template ASN path.
tests/api/test_asn.h	Registers the new ASN API test in the test declarations/group list.
tests/api/test_asn.c	Adds a targeted regression test for decoding SSH client/server EKUs into the SSH EKU bitfield.
scripts/asn1_oid_sum.pl	Updates the OID-sum generation script to include the SSH server-auth EKU.

Review details

• Files reviewed: 7/7 changed files
• Comments generated: 0
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

MemBrowse Memory Report

gcc-arm-cortex-m0plus

• FLASH: .text +44 B (+0.1%, 66,927 B / 262,144 B, total: 26% used)

gcc-arm-cortex-m3

• FLASH: .text +28 B (+0.0%, 125,747 B / 262,144 B, total: 48% used)

gcc-arm-cortex-m4-dtls13

• FLASH: .text +64 B (+0.0%, 186,620 B / 1,048,576 B, total: 18% used)

gcc-arm-cortex-m4-openssl-compat

• FLASH: .text +64 B (+0.0%, 780,844 B / 1,048,576 B, total: 74% used)

gcc-arm-cortex-m4-pkcs7

• FLASH: .text +64 B (+0.0%, 217,628 B / 262,144 B, total: 83% used)

gcc-arm-cortex-m4-pq

• FLASH: .text +128 B (+0.0%, 301,636 B / 1,048,576 B, total: 29% used)

gcc-arm-cortex-m4-tls13

• FLASH: .text +64 B (+0.0%, 242,191 B / 262,144 B, total: 92% used)

gcc-arm-cortex-m7-pq

• FLASH: .text +64 B (+0.0%, 302,532 B / 1,048,576 B, total: 29% used)

gcc-arm-cortex-m7-tls13

• FLASH: .text +64 B (+0.0%, 242,255 B / 262,144 B, total: 92% used)

linuxkm-pie

• Data: __patchable_function_entries +48 B (+0.2%, 26,984 B)

linuxkm-standard

• Data: __patchable_function_entries +8 B (+0.0%, 49,760 B)

stm32-sim-stm32h753

• FLASH: .text +128 B (+0.1%, 188,580 B / 2,097,152 B, total: 9% used)
  No memory changes detected for:
• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-rsa-only
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m7

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #11361

Scan targets checked: wolfcrypt-bugs, wolfcrypt-rs-bugs, wolfcrypt-src, wolfssl-bugs, wolfssl-src

Findings: 2
2 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Reported findings require changes before merge.

[Copilot]

🟢 Approval recommended

The changes are consistent across OID tables, decoder logic, and tests, and the added coverage specifically targets the new EKU and the collision-hardening behavior.

Review details

• Files reviewed: 7/7 changed files
• Comments generated: 0 new
• Review effort level: Lite

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #11361

Scan targets checked: wolfcrypt-bugs, wolfcrypt-rs-bugs, wolfcrypt-src, wolfssl-bugs, wolfssl-src

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

Fenrir's latest completed scan found no issues; clearing the prior automated change request.