From c2a0de93b839c8a854f3b481cc1643789d01ed96 Mon Sep 17 00:00:00 2001
From: David Garske <david@wolfssl.com>
Date: Wed, 7 Feb 2018 12:48:33 -0800
Subject: [PATCH] Fix to resolve wolfCrypt test for `cert_test nameConstraints
 test. Fixed ASN check to properly determine if certificate is CA type.

---
 certs/test/cert-ext-ia.cfg  |   2 +-
 certs/test/cert-ext-ia.der  | Bin 1030 -> 1022 bytes
 certs/test/cert-ext-nc.cfg  |   6 +++++-
 certs/test/cert-ext-nc.der  | Bin 1052 -> 1146 bytes
 certs/test/gen-ext-certs.sh |   8 ++++++--
 wolfcrypt/src/asn.c         |   2 +-
 6 files changed, 13 insertions(+), 5 deletions(-)
 mode change 100644 => 100755 certs/test/gen-ext-certs.sh

diff --git a/certs/test/cert-ext-ia.cfg b/certs/test/cert-ext-ia.cfg
index 8721916b3..44be1126a 100644
--- a/certs/test/cert-ext-ia.cfg
+++ b/certs/test/cert-ext-ia.cfg
@@ -10,7 +10,7 @@ L             = Brisbane
 O             = wolfSSL Inc
 OU            = Engineering
 CN            = www.wolfssl.com
-emailAddress  = support@www.wolfsssl.com
+emailAddress  = support@wolfsssl.com
 
 [ v3_ca ]
 inhibitAnyPolicy = critical,1
diff --git a/certs/test/cert-ext-ia.der b/certs/test/cert-ext-ia.der
index 73ea7c0a86f18a8789a72c2caa3c83bed8189f9e..1099fa986450321bf14e993280d5923725e0ff56 100644
GIT binary patch
delta 414
zcmZqU_{Xkg(8T=9po!_x0%j&gCMHgXvjX2|uK2X6+JKjhQ>)FR?K>|cBR4C9LF0mn
zA8Xu|4HV(RoQz^3#ia!W`9&oT<@q^j#l^)rddc~@26E!Oh86}!2IfWvCZ+~PQDCmI
zfhCj+F-iiLQJXs%YZ>dO?q0b+p=OtwHRI}hyR(%W4o#X=rxeS7+hxwZ#cU6AEyNR=
zuJLmR?NYGS?_!<1dG$xlzbAO!^M8$>d!T5iZp*ByufnP7vu>Y%yZha;#>-2xCf)tR
zBfIwCedcsaS&x)+?e;#Jsa|(8C-8>(AD_=x!hYKC%zE#l$F(ZYk`K2nSW(~WkmDnB
z@$s3<T#fU24{1)l-n0B++H$U?GE@KBFJ+Ty_gHLnt(SFn2j88S`MRZSOzwFfgq#0G
zcYnB?IkofdT8pRQ6Ia@O|Hl|}Rn;(5miI+qkM*(d-yaBEwyVo{bbWsR^D^dX0iVuH
gue{z{r~c;T+|RYLdxQB_U)xsrz$=6ECev&i02VB<9smFU

delta 422
zcmeyz-o~M2(8R)I(8Tm=0W%XL6B8#xUyR>or5k;R4S3l&wc0$|zVk9Na<eiRG%lI=
zw#HlCKou^`$tWgKTv||&UsU2yUS6(Oo}ZIeTwI)^mz<w#AScdiXl`I=XkcV)YG`Z`
z1?CzVSVFlF<7Ds|x4DtAma%?|%BgF@{m+hh@vqrpxu7k<{z2`cKenEGUO$y;ZGYI>
z86c*vJ|Xtpg14S0@7FDoTcugOP}(N2AotM0#U2a43Lf9j8}h58=)Kux{T+vMYRYxB
zPcC<zBV2N$(%$^=&+4q`g*A8jPWG;A%o1SyTzV%f^x>JOdKY#c*Eag4oc-arPQCt`
z91iVrj^8GU8SkRvCzWu$ogQLh%wgD<nQ}X%TC~P@QJA&tE{ok$JkmngA`I9RmZ?ih
zEZS?%t0{2B-_Krb>h1H_1Y_b)AKkS;IxmSQ{Ly)bcdzqKNbt>gUhQ+<<lNmOTLh}!
iE0v#|l&EVq?d6u=F2)CUUU;?IL1*6Yv>BdEO<w@tORkOp

diff --git a/certs/test/cert-ext-nc.cfg b/certs/test/cert-ext-nc.cfg
index b27f3f4fe..9e8ff6be5 100644
--- a/certs/test/cert-ext-nc.cfg
+++ b/certs/test/cert-ext-nc.cfg
@@ -10,9 +10,13 @@ L             = Brisbane
 O             = wolfSSL Inc
 OU            = Engineering
 CN            = www.wolfssl.com
-emailAddress  = support@www.wolfsssl.com
+emailAddress  = support@wolfsssl.com
 
 [ v3_ca ]
+subjectKeyIdentifier = hash
+authorityKeyIdentifier = keyid:always,issuer
+basicConstraints = critical, CA:true, pathlen:0
+keyUsage = critical, digitalSignature, cRLSign, keyCertSign
 nameConstraints = critical,permitted;email:.wolfssl.com
 nsComment       = "Testing name constraints"
 
diff --git a/certs/test/cert-ext-nc.der b/certs/test/cert-ext-nc.der
index ff944476d5564054aec33f6ea7572170d309cfd6..ffb2c1338917761c323c63b45d9d900f513f90f8 100644
GIT binary patch
delta 524
zcmbQk@ry&tpoyi-pouwd0W%XL6B8%H=8yC3r(WmaFyLk5)N1o+`_9YA$j!=N(70gY
z#~OEK14XznC!?51acMz8eo=`-d45h>adB~uUUGh}ft)z6p@o5wfw_@^iK&566qsvl
zU<u_yjFP}*)aFh`W5&$J4F-*C4P@DvLuL6`#8^Z&3mToAG^6Fw$sZT2^O&7Z$@BHu
z7|4U9m02VV#2T<G5CSO>W@P-&!ePM1$oQX$k->luB*qUCV_{}uY@58FDYkyq%(<bR
zlLLhK|M2rHn-kh0{f1||kVfqGclwwAb5GnXF0Pj8&eMJK;rq?pb-g+MorcR!)^1p!
zl|6&&0x$EOHsvkf=0z#K>k|oCV<c+hxxYC1rpu2=lP9;l4Lgs|Pl`xAF(t55P%&_o
zp7s0_%#Lh7-tDYP{JK_sO<Hi=F{J~g^_l{Q8f6U*R0X^+oNQvt?;90(z4EL{pi#W~
ziTw+{+O@3C*U@?Q!iVivnCQ-~>YKmh%RVxQ3FS??aY97+Ewi$bi-L&9|KnZtE{R(b
zyt_ZQ>a|DT*mlXcS!o|9W8Lza{2z_UidnWn!i}@9gk4T8S$K4c?WFUMtDk>3^EJTu
JO9s=qYXGL^#p?h7

delta 430
zcmeyxF^5CTpovAopoy7b0W%XL6B8%HuEJ#BY5Z@y40zc%wc0$|zVk9Na<eiRG%lI=
zw#HlCKou^`$tWgKTv||&UsU2yUS6(Oo}ZIeTwI)^mz<w#AScdiXl`I=XkcV)YG`Z`
z1?CzVSVFlF<7Ds|x4Dtgn337rz;m)Jb8P*x`%@oo4>+=U?K6!R9jE@r_G~zCC%~V#
zU3f_jyKB*%!pxdG&s%w=<}A>-`@=qX8(+iWDt+#KPQPaE%+5~dcUdt%qgl`5>813A
z8|T@%Z!U<gO>up@NP7CZX>V&|xC@&9zkHJO_2%t+7O!OTBi|G}Uuu5meDj5NpX^Z1
zALrLh^sk>b{kFEpLHm#yk>$Vi+E+Z)y7ZJ~(WROGyM(@%6qv;*t61EdlD%WzHcwLq
zHg|7h&DlqnF-q`HnNsT6eR-8j$6t**w;dyy>duQ5MV#)r_{TJLVUy#7vqc$<yuWyu
rBYr1!OFWOMG`D&D?d*)_eLoD2b_hK6QaT`R{N38@Wv7W0lV~jf2{*G8

diff --git a/certs/test/gen-ext-certs.sh b/certs/test/gen-ext-certs.sh
old mode 100644
new mode 100755
index 20b61e9c9..1d5d9b784
--- a/certs/test/gen-ext-certs.sh
+++ b/certs/test/gen-ext-certs.sh
@@ -33,9 +33,13 @@ L             = Brisbane
 O             = wolfSSL Inc
 OU            = Engineering
 CN            = www.wolfssl.com
-emailAddress  = support@www.wolfsssl.com
+emailAddress  = support@wolfsssl.com
 
 [ v3_ca ]
+subjectKeyIdentifier = hash
+authorityKeyIdentifier = keyid:always,issuer
+basicConstraints = critical, CA:true, pathlen:0
+keyUsage = critical, digitalSignature, cRLSign, keyCertSign
 nameConstraints = critical,permitted;email:.wolfssl.com
 nsComment       = "Testing name constraints"
 
@@ -58,7 +62,7 @@ L             = Brisbane
 O             = wolfSSL Inc
 OU            = Engineering
 CN            = www.wolfssl.com
-emailAddress  = support@www.wolfsssl.com
+emailAddress  = support@wolfsssl.com
 
 [ v3_ca ]
 inhibitAnyPolicy = critical,1
diff --git a/wolfcrypt/src/asn.c b/wolfcrypt/src/asn.c
index de81d3f35..85cc90a4d 100755
--- a/wolfcrypt/src/asn.c
+++ b/wolfcrypt/src/asn.c
@@ -6363,7 +6363,7 @@ static int DecodeCertExtensions(DecodedCert* cert)
                 /* Verify RFC 5280 Sec 4.2.1.10 rule:
                     "The name constraints extension,
                     which MUST be used only in a CA certificate" */
-                if (!cert->ca) {
+                if (!cert->isCA) {
                     WOLFSSL_MSG("Name constraints allowed only for CA certs");
                     return ASN_NAME_INVALID_E;
                 }