Correct the locality key length in the subject DN table

[yosuke-wolfssl]

Problem

src/csr.c matches subject-DN attribute keys against a table that records a key
string and its length per row. The locality row recorded a length of 2 for the
one-character key "L":

{ "L", 2, offsetof(CertName, locality), CTC_NAME_SIZE },

assign_rdn selects a row only when rdn_fields[i].key_len == klen, so L
(length 1) never matched any row, fell through to WOLFCERT_ERR_UNSUPPORTED, and
parse_subject_dn propagated that to the caller. Every other row was correct.

Any subject DN containing L= therefore failed to build a CSR at all:
CN=device-1,O=Acme,L=Portland,C=US returns -12 before any network traffic, on
both EST and SCEP, library and CLI. Closes f-8012.

Fix (src/csr.c)

Record the locality key length as 1. The matcher is unchanged: assign_rdn's
key/klen is a pointer into the caller's DN plus a length, not a
NUL-terminated string, and the existing form compares exactly klen bytes
without ever indexing key[klen].

src/ca_issue.c already copies subjectL on issuance, so the locality now
survives the full CSR to issued-cert round trip with no second change.

Tests (tests/unit/test_csr.c)

Extended build_with_extras rather than adding a binary: its subject DN carries
L=Portland, and the reparsed request is asserted against dc.subjectL and
dc.subjectLLen. wolfSSL's DecodedCert name fields point into the DER and are
not NUL-terminated, hence the explicit length rather than strcmp.

Verification

• Build clean, zero warnings.
• csr fails before the fix and passes after, confirmed by reverting only
  src/csr.c and rebuilding.
• Full suite 26/26 passing.

[Copilot]

Pull request overview

Fixes CSR subject-DN parsing for the locality attribute (L=) by correcting the key-length metadata used during RDN matching, and adds a unit test to prevent regressions. This aligns with wolfCert’s CSR-building path (used by both EST and SCEP) and ensures subject DNs containing L= are accepted.

Changes:

• Correct rdn_fields metadata so "L" is matched with length 1 (not 2) during subject-DN parsing.
• Extend the existing CSR unit test to include L=Portland and assert it round-trips into DecodedCert.subjectL/subjectLLen.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
src/csr.c	Fixes locality (L) key-length in the subject DN attribute table so L= matches correctly.
tests/unit/test_csr.c	Adds coverage to ensure L= is parsed and preserved in the generated CSR.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #16

Scan targets checked: none
Failed targets: wolfcert-bugs, wolfcert-src

⚠️ Review incomplete — one or more scan targets failed before findings could be produced. See the Fenrir PR review detail page for logs.