Marco Oliverio 4b3bb49b27 NameConstraints: Require DNS reg-name host for URI name constraints ...

RFC 5280 4.2.1.10 defines URI name constraints in terms of a host that
is a fully qualified domain name; RFC 3986 IP-literal ([...]) and
IPv4address hosts are not DNS reg-names and cannot be meaningfully
matched against a DNS-style constraint base.

- Classify the host extracted by GetUriHost (IP-literal, IPv4address,
  reg-name) and validate that a reg-name has no empty labels.
- wolfssl_local_MatchUriNameConstraint() no longer matches URIs whose
  host is an IP address.
- ConfirmNameConstraints() fails closed: when URI constraints are
  present, a URI SAN without a DNS host is rejected. A plain non-match
  would otherwise let such names pass excluded-only constraints.

2026-06-15 11:04:27 +02:00

..

benchmark

Merge pull request #10571 from Frauschi/mlkem_rename

2026-06-05 11:00:44 -05:00

src

NameConstraints: Require DNS reg-name host for URI name constraints

2026-06-15 11:04:27 +02:00

test

Merge pull request #10668 from holtrop-wolfssl/f-5394

2026-06-12 16:35:31 -07:00