wolfSSL/wolfssl
1
0
Fork 1
mirror of https://github.com/wolfSSL/wolfssl.git synced 2026-07-09 10:40:49 +02:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #10837 from rlm2002/zd-NameConstraints

Browse Source 
DNS name constraint fix
This commit is contained in:
David Garske
2026-07-08 09:21:52 -07:00
committed by GitHub
parent 673d8d00bb bd4c11aec4
commit 60085b0e48
2 changed files with 131 additions and 21 deletions
Download Patch File Download Diff File Expand all files Collapse all files
wolfcrypt/src/asn.c
+18 -8
View File
@@ -18897,20 +18897,30 @@ static int ConfirmNameConstraints(Signer* signer, DecodedCert* cert)
byte nameType = nameTypes[i];
DNS_entry* name = NULL;
DNS_entry subjectDnsName; /* temporary node used for subject name */
DNS_entry* dnsSan = NULL; /* scan for a dNSName SAN */
XMEMSET(&subjectDnsName, 0, sizeof(DNS_entry));
switch (nameType) {
case ASN_DNS_TYPE:
name = cert->altNames;
/* Apply DNS constraints to leaf Subject CN when no SAN
* (legacy hostname-in-CN). Skipped for CAs. */
if (cert->subjectCN != NULL && cert->altNames == NULL &&
!cert->isCA) {
subjectDnsName.next = NULL;
subjectDnsName.type = ASN_DNS_TYPE;
subjectDnsName.len = cert->subjectCNLen;
subjectDnsName.name = cert->subjectCN;
/* Apply DNS name constraints to the Subject CN as a legacy
* hostname-in-CN fallback only when the cert presents no
* dNSName SAN (RFC 6125 6.4.4). A SAN of another type
* (iPAddress/registeredID/otherName/...) must NOT suppress
* this check. Skip for CA certs. */
if (cert->subjectCN != NULL && !cert->isCA) {
for (dnsSan = cert->altNames; dnsSan != NULL;
dnsSan = dnsSan->next) {
if (dnsSan->type == ASN_DNS_TYPE)
break;
}
if (dnsSan == NULL) { /* no dNSName SAN present */
subjectDnsName.next = NULL;
subjectDnsName.type = ASN_DNS_TYPE;
subjectDnsName.len = cert->subjectCNLen;
subjectDnsName.name = cert->subjectCN;
}
}
break;
case ASN_IP_TYPE: