Improve credential loading diagnostics, function parameter declarations, etc.

[DDvO]

This provides fixes and extensions for use with genCredMgr v0.

• credential_loading.c: improve diagnostics of FILES_load_*_ex() and STORE_load_more_check_ex()
• credential_loading.{c,h}: add missing OPTIONAL and remove needless 'maybe_stdin' parameter of FILES_load_certs_ex()
• credential_loading.{c,h}: rename 'src' parameter of FILES_load_crl_ex() to 'uri'
• credential_loading.c: move definition of FILES_load_credentials_ex() and CREDENTIALS_load_ex() for consistency with header file
• credential_loading.c: fix FILES_load_credentials_ex() double free, mem leaks, diagnostics, and indentation
• credential_loading.{c,h}: generalize cert and CRL loading to support HTTP download of PEM/DER encoded data
• STORE_load_more_check_ex(): fix diagnostics with possibly NULL file argument
• credential_loading.{c,h}: rename FILES_* to CREDS_*
• credential_loading.c: tweak diagnostics of load_key_certs_crls(), CREDS_load_cert_ex(), and CREDS_load_crl_ex()
• demo.cnf,Makefile_v1: add some options to avoid warnings
• credential_loading.{c,h},cmpClient.c: simplify naming of most loading functions
• move credential_loading.{c,h} into genCMPClient library
• credential_loading.c: fixup for: tweak diagnostics of load_key_certs_crls()
• genericCMPClient_util.{c,h}: compensate for stuff needed by new credential loading in case GENCMP_NO_SECUTILS
• credential_loading.{c,h},cmpClient.c: streamline credentials loading API, generalize HTTP(S) support
• credential_loading.c: increase max_resp_len used by http_get_mem() calling OSSL_HTTP_get()
• genericCMPClient_util.{c,h}: fix Windows compatibility
• CMakeLists.txt: prevent failure of 'rm CMakeCache.txt' in case file is not present
• demo.cnf: fix comment on partial_chain used for CloudCA
• add add LOG_syslog() and teak CMPclient_init() to not affect logging if name and log_fn are NULL
• genericCMPClient_util.{c,h}: add UTIL_file_ext()
• genericCMPClient_util.{c,h}: add KEY_new_ex()
• genericCMPClient_util.{c,h}: add KEY_type_supported(), and UTIL_atoint() used by it
• genericCMPClient_util.{c,h}: add CONF_ functions needed by genCredMgr
• genericCMPClient_util.{c,h}: add LOG_close()
• genericCMPClient_util.h: add OPENSSL_V_4_0_0
• credential_loading.{c,h}: add FILES_store_key(), FILES_store_certs(), FILES_store_crls()
• genericCMPClient_util.h: add KEY_free
• genericCMPClient_util.{c,h}: add TLS_CTX_new() and TLS_CTX_free(); fix use of GENCMP_NO_TLS
• genericCMPClient_util.c: tweak UTIL_file_ext()
• genericCMPClient_util.c: complete making CONF_entry_in_sections() and conf_get_string() re-entrant
• genericCMPClient_util.c: make LOG_generic() more robust on snprintf() failure
• genericCMPClient_util.h: fix compatibility with C23, which provides 'true' and 'false' as keywords
• demo.cnf: include example of multi-line option definition, here for 'tls_trusted' of CloudCA
• genericCMPClient_util.{c,h}: introduce OPT_EMPTY_OK for CONF_read_options()
• CREDS_load_{key,cert,credentials}(): avoid logging file load errors on desc == NULL
• genericCMPClient_util.{c,h}: introduce OPT_INT and OPT_POS_INT for CONF_read_options()
• genericCMPClient_util.{c,h}: add source parameter to CONF_read_check_options() and internalize CONF_read_options()
• CONF_read_options_ex(): fix handling of error queue
• genericCMPClient_util.{c,h}: introduce OPT_SEL and OPT_POS_INT for CONF_read_check_options()
• extend CREDS_load() to check if key and cert match
• genericCMPClient_util.c: in calls to isspace(), cast argument to type 'unsigned char'
• demo.cnf: increase msg_timeout to 25 for getting proper error on PPKI Playground server not yet reachable
• credential_loading.c: make sure that comparison against min_num does not go wrong on min_num < 0
• make sure to use latest libsecutils and cmpossl

[Copilot]

Pull request overview

This PR updates credential/certificate/CRL loading to better support HTTP-sourced data and improves diagnostics/consistency across the credential-loading APIs, while also syncing the CMP HTTP test recipe with a newer upstream OpenSSL variant.

Changes:

• Extend cert/CRL loading logic to download and decode PEM/DER over HTTP (with updated logging and parameter conventions).
• Refactor/align credential-loading function signatures (OPTIONAL annotations, parameter naming, timeout plumbing).
• Update 80-test_cmp_http.t and test config to match newer upstream behavior (skip conditions, server host/port derivation, improved failure logs).

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 6 comments.

File	Description
test/recipes/80-test_cmp_http.t	Updates CMP HTTP test harness logic (skip gates, server discovery, enhanced failure logging).
test/recipes/80-test_cmp_http_data/test.cnf	Adjusts port config to reference $server_port for dynamic substitution.
src/credential_loading.h	Updates/aligns credential-loading API declarations (OPTIONAL, formats, parameter naming).
src/credential_loading.c	Implements HTTP download+decode helpers and refactors credential/cert/CRL loading and diagnostics.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

Comments suppressed due to low confidence (1)

src/credential_loading.c:908

• FILES_load_crl_ex() leaks the memory BIO returned by http_get_mem(): mem is not freed after PEM_read_bio_X509_CRL()/d2i_X509_CRL_bio(). Mirror the certificate-loading path and BIO_free(mem) in all cases (including decode failure).

        BIO *mem = http_get_mem(uri, timeout, "-----BEGIN X509 CRL-----", &is_pem, desc);
        if (mem != NULL) {
            crl = is_pem ? PEM_read_bio_X509_CRL(mem, NULL, NULL, NULL) : d2i_X509_CRL_bio(mem, NULL);
            if (crl == NULL)
                LOG(FL_ERR, "Unable to decode %s from %s", desc, uri);
        }

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.

Comments suppressed due to low confidence (1)

src/credential_loading.c:916

• FILES_load_crl_ex() uses CONN_IS_HTTP(uri) / CONN_IS_HTTPS(uri) and calls CRL_check(uri, ...), but uri is an OPTIONAL parameter and may be NULL when reading from stdin. This can lead to crashes/undefined behavior (e.g., %s formatting with a NULL src). Add uri != NULL guards for scheme checks and pass a non-NULL placeholder like "<stdin>" into CRL_check() / error messages when uri is NULL.

    LOG(FL_DEBUG, "Loading %s from %s", desc, uri != NULL ? uri : "<stdin>");
    if (CONN_IS_HTTP(uri) || CONN_IS_HTTPS(uri)) {
        bool is_pem;
        BIO *mem = http_get_mem(uri, timeout, "-----BEGIN X509 CRL-----", &is_pem, desc);
        if (mem != NULL) {
            crl = is_pem ? PEM_read_bio_X509_CRL(mem, NULL, NULL, NULL) : d2i_X509_CRL_bio(mem, NULL);
            BIO_free(mem);
            if (crl == NULL)
                LOG(FL_ERR, "Unable to decode %s from %s", desc, uri);
        }
    } else {
        (void)load_key_certs_crls(libctx, propq,
                                  uri, format, maybe_stdin, NULL, desc, false,
                                  NULL, NULL,  NULL, NULL, NULL, 0, &crl, NULL, 1);
    }
    if (!CRL_check(uri, crl, vpm) && vpm != NULL) {
        X509_CRL_free(crl);
        crl = NULL;

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.

[sonarqubecloud]

Quality Gate failed

Failed conditions
1 Security Hotspot
61.5% Coverage on New Code (required ≥ 80%)
C Reliability Rating on New Code (required ≥ A)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 6 comments.

[sonarqubecloud]

Quality Gate failed

Failed conditions
52.7% Coverage on New Code (required ≥ 80%)
8.8% Duplication on New Code (required ≤ 3%)

See analysis details on SonarQube Cloud