Merge pull request #10638 from rizlik/nc_uri_trailing_dot

douzzer · web-flow · commit 9f48aef47f01 · 2026-07-01T17:14:08.000-05:00
NameConstraints fixes
diff --git a/src/x509.c b/src/x509.c
@@ -5670,95 +5670,12 @@ static int MatchIpName(const char* name, int nameSz, WOLFSSL_GENERAL_NAME* gn)
         constraintData, constraintLen);
 }
 
-/* Extract host from URI for name constraint matching.
- * URI format: scheme://[userinfo@]host[:port][/path][?query][#fragment]
- * IPv6 literals are enclosed in brackets: scheme://[ipv6addr]:port/path
- * Returns pointer to host start and sets hostLen, or NULL on failure. */
-static const char* ExtractHostFromUri(const char* uri, int uriLen, int* hostLen)
-{
-    const char* hostStart;
-    const char* hostEnd;
-    const char* p;
-    const char* uriEnd;
-
-    if (uri == NULL || uriLen <= 0 || hostLen == NULL) {
-        return NULL;
-    }
-
-    uriEnd = uri + uriLen;
-
-    /* Find "://" to skip scheme */
-    hostStart = NULL;
-    for (p = uri; p < uriEnd - 2; p++) {
-        if (p[0] == ':' && p[1] == '/' && p[2] == '/') {
-            hostStart = p + 3;
-            break;
-        }
-    }
-    if (hostStart == NULL || hostStart >= uriEnd) {
-        return NULL;
-    }
-
-    /* Skip userinfo if present (look for @ before any /, ?, #)
-     * userinfo can contain ':' (ex: user:pass@host), don't stop at ':'
-     * For IPv6, also don't stop at '[' in userinfo */
-    for (p = hostStart; p < uriEnd; p++) {
-        if (*p == '@') {
-            hostStart = p + 1;
-            break;
-        }
-        if (*p == '/' || *p == '?' || *p == '#') {
-            /* No userinfo found */
-            break;
-        }
-        /* If '[' before '@', found IPv6 literal, not userinfo */
-        if (*p == '[') {
-            break;
-        }
-    }
-    if (hostStart >= uriEnd) {
-        return NULL;
-    }
-
-    /* Check for IPv6 literal */
-    if (*hostStart == '[') {
-        /* Find closing bracket, skip opening one */
-        hostStart++;
-        hostEnd = hostStart;
-        while (hostEnd < uriEnd && *hostEnd != ']') {
-            hostEnd++;
-        }
-        if (hostEnd >= uriEnd) {
-            /* No closing bracket found, malformed */
-            return NULL;
-        }
-        /* hostEnd points to closing bracket, extract content between */
-        *hostLen = (int)(hostEnd - hostStart);
-        if (*hostLen <= 0) {
-            return NULL;
-        }
-        return hostStart;
-    }
-
-    /* Regular hostname, find end */
-    hostEnd = hostStart;
-    while (hostEnd < uriEnd && *hostEnd != ':' && *hostEnd != '/' &&
-           *hostEnd != '?' && *hostEnd != '#') {
-        hostEnd++;
-    }
-
-    *hostLen = (int)(hostEnd - hostStart);
-    if (*hostLen <= 0) {
-        return NULL;
-    }
-
-    return hostStart;
-}
-
 /* Helper to check if name string matches a single GENERAL_NAME constraint.
+ * permitted selects subtree semantics for wildcard DNS names: containment
+ * for permitted subtrees, intersection for excluded subtrees.
  * Returns 1 if matches, 0 if not. */
 static int MatchNameConstraint(int type, const char* name, int nameSz,
-    WOLFSSL_GENERAL_NAME* gn)
+    WOLFSSL_GENERAL_NAME* gn, int permitted)
 {
     const char* baseStr;
     int baseLen;
@@ -5788,21 +5705,13 @@ static int MatchNameConstraint(int type, const char* name, int nameSz,
                     nameSz, baseStr, baseLen);
             }
             else if (type == WOLFSSL_GEN_URI) {
-                const char* host;
-                int hostLen;
-
-                /* For URI, extract host and match against DNS-style */
-                host = ExtractHostFromUri(name, nameSz, &hostLen);
-                if (host == NULL) {
-                    return 0;
-                }
-                return wolfssl_local_MatchBaseName(ASN_DNS_TYPE, host, hostLen,
+                return wolfssl_local_MatchUriNameConstraint(name, nameSz,
                     baseStr, baseLen);
             }
             else {
                 /* WOLFSSL_GEN_DNS uses DNS-style matching */
-                return wolfssl_local_MatchBaseName(ASN_DNS_TYPE, name, nameSz,
-                    baseStr, baseLen);
+                return wolfssl_local_MatchDnsNameConstraint(name, nameSz,
+                    baseStr, baseLen, permitted);
             }
 
         default:
@@ -5811,6 +5720,29 @@ static int MatchNameConstraint(int type, const char* name, int nameSz,
     }
 }
 
+static int NameConstraintsHasType(const WOLFSSL_STACK* sk, int type)
+{
+    int i;
+    int num;
+
+    if (sk == NULL) {
+        return 0;
+    }
+
+    num = wolfSSL_sk_GENERAL_SUBTREE_num(sk);
+    for (i = 0; i < num; i++) {
+        WOLFSSL_GENERAL_SUBTREE* subtree;
+
+        subtree = wolfSSL_sk_GENERAL_SUBTREE_value(sk, i);
+        if (subtree != NULL && subtree->base != NULL &&
+                subtree->base->type == type) {
+            return 1;
+        }
+    }
+
+    return 0;
+}
+
 /*
  * Check if a name string satisfies given name constraints.
  *
@@ -5841,6 +5773,14 @@ int wolfSSL_NAME_CONSTRAINTS_check_name(WOLFSSL_NAME_CONSTRAINTS* nc,
         return 0;
     }
 
+    if (type == WOLFSSL_GEN_URI &&
+            (NameConstraintsHasType(nc->permittedSubtrees, type) ||
+             NameConstraintsHasType(nc->excludedSubtrees, type)) &&
+            !wolfssl_local_UriNameHasDnsHost(name, nameSz)) {
+        WOLFSSL_MSG("URI name constraint applied to URI without DNS host");
+        return 0;
+    }
+
     /* Check permitted subtrees */
     if (nc->permittedSubtrees != NULL) {
         num = wolfSSL_sk_GENERAL_SUBTREE_num(nc->permittedSubtrees);
@@ -5857,7 +5797,7 @@ int wolfSSL_NAME_CONSTRAINTS_check_name(WOLFSSL_NAME_CONSTRAINTS* nc,
             }
             hasPermittedType = 1;
 
-            if (MatchNameConstraint(type, name, nameSz, gn)) {
+            if (MatchNameConstraint(type, name, nameSz, gn, 1)) {
                 matchedPermitted = 1;
                 break;
             }
@@ -5884,7 +5824,7 @@ int wolfSSL_NAME_CONSTRAINTS_check_name(WOLFSSL_NAME_CONSTRAINTS* nc,
                 continue;
             }
 
-            if (MatchNameConstraint(type, name, nameSz, gn)) {
+            if (MatchNameConstraint(type, name, nameSz, gn, 0)) {
                 WOLFSSL_MSG("Name in excluded subtrees");
                 return 0;
             }
diff --git a/tests/api.c b/tests/api.c
@@ -23304,6 +23304,46 @@ static int test_NameConstraints_DnsUriWildcard(void)
     sanSz = build_simple_san(san, sizeof(san), URI, "https://www.host.com/");
     ExpectIntGT((int)sanSz, 0);
     ExpectIntEQ(verify_with_otherName_chain(nc, ncSz, 1, san, sanSz), 0);
+
+    /* (11) RFC 5280 requires a DNS host when URI constraints are applied.
+     *      Fail closed even for excluded-only constraints where a boolean
+     *      non-match would otherwise pass. */
+    ncSz  = build_simple_nameConstraints(nc, sizeof(nc), 1, URI,
+                "blocked.com");
+    sanSz = build_simple_san(san, sizeof(san), URI, "https://12.31.2.3/");
+    ExpectIntGT((int)ncSz, 0);
+    ExpectIntGT((int)sanSz, 0);
+    ExpectIntEQ(verify_with_otherName_chain(nc, ncSz, 1, san, sanSz),
+        WC_NO_ERR_TRACE(ASN_NAME_INVALID_E));
+
+    sanSz = build_simple_san(san, sizeof(san), URI, "https://[v1.addr.]/");
+    ExpectIntGT((int)sanSz, 0);
+    ExpectIntEQ(verify_with_otherName_chain(nc, ncSz, 1, san, sanSz),
+        WC_NO_ERR_TRACE(ASN_NAME_INVALID_E));
+
+    /* An IPv4address host with the absolute-FQDN trailing dot is still not
+     * a DNS host. */
+    sanSz = build_simple_san(san, sizeof(san), URI, "https://12.31.2.3./");
+    ExpectIntGT((int)sanSz, 0);
+    ExpectIntEQ(verify_with_otherName_chain(nc, ncSz, 1, san, sanSz),
+        WC_NO_ERR_TRACE(ASN_NAME_INVALID_E));
+
+    /* (12) One trailing dot on the constraint base is the absolute-FQDN
+     *      marker: DNS:example.com. denotes the same subtree as
+     *      DNS:example.com, so the permitted form accepts the bare SAN and
+     *      the excluded form rejects it. */
+    ncSz  = build_simple_nameConstraints(nc, sizeof(nc), 0, DNS,
+                "example.com.");
+    sanSz = build_simple_san(san, sizeof(san), DNS, "example.com");
+    ExpectIntGT((int)ncSz, 0);
+    ExpectIntGT((int)sanSz, 0);
+    ExpectIntEQ(verify_with_otherName_chain(nc, ncSz, 1, san, sanSz), 0);
+
+    ncSz  = build_simple_nameConstraints(nc, sizeof(nc), 1, DNS,
+                "example.com.");
+    ExpectIntGT((int)ncSz, 0);
+    ExpectIntEQ(verify_with_otherName_chain(nc, ncSz, 1, san, sanSz),
+        WC_NO_ERR_TRACE(ASN_NAME_INVALID_E));
 #endif
     return EXPECT_RESULT();
 }
diff --git a/tests/api/test_asn.c b/tests/api/test_asn.c
@@ -1153,6 +1153,21 @@ int test_wolfssl_local_MatchUriNameConstraint(void)
     ExpectIntEQ(uriNC("https://host.com.evil.com",    "host.com"), 0);
     ExpectIntEQ(uriNC("https://other.com",            "host.com"), 0);
 
+    /* A single trailing dot is the absolute-FQDN marker: "host.com." and
+     * "host.com" denote the same host and must compare equal, matching the
+     * DNS name-constraint path. */
+    ExpectIntEQ(uriNC("https://host.com./",           "host.com"), 1);
+    ExpectIntEQ(uriNC("https://host.com.:8443/x",     "host.com"), 1);
+    ExpectIntEQ(uriNC("https://host.com",             "host.com."), 1);
+    ExpectIntEQ(uriNC("https://host.com./",           "host.com."), 1);
+    ExpectIntEQ(uriNC("https://v1.addr./",            "v1.addr"), 1);
+    ExpectIntEQ(uriNC("https://v1.addr/",             "v1.addr."), 1);
+    /* Only ONE trailing dot is the marker; an empty last label is not. */
+    ExpectIntEQ(uriNC("https://host.com../",          "host.com"), 0);
+    ExpectIntEQ(uriNC("https://a.host.com../",        ".host.com"), 0);
+    /* Empty interior labels are not valid DNS host labels. */
+    ExpectIntEQ(uriNC("https://a..host.com/",         ".host.com"), 0);
+
     /*
      * Leading-dot constraint: proper subtree of hosts (apex excluded).
      */
@@ -1164,10 +1179,18 @@ int test_wolfssl_local_MatchUriNameConstraint(void)
     ExpectIntEQ(uriNC("https://evilhost.com",         ".host.com"), 0);
 
     /*
-     * IPv6 literal host extraction ([..]) then exact match.
+     * RFC 5280 URI constraints require a DNS host. IP-literals / IPvFuture
+     * hosts in brackets and IPv4address hosts are not DNS reg-names.
      */
-    ExpectIntEQ(uriNC("https://[2001:db8::1]:443/x",  "2001:db8::1"), 1);
+    ExpectIntEQ(uriNC("https://[2001:db8::1]:443/x",  "2001:db8::1"), 0);
     ExpectIntEQ(uriNC("https://[2001:db8::1]",        "2001:db8::2"), 0);
+    ExpectIntEQ(uriNC("https://[v1.addr.]/",          "v1.addr"), 0);
+    ExpectIntEQ(uriNC("https://[v1.addr.]/",          "v1.addr."), 0);
+    ExpectIntEQ(uriNC("https://12.31.2.3/",           "12.31.2.3"), 0);
+    /* An IPv4address host is still not a DNS reg-name when written with the
+     * absolute-FQDN trailing dot. */
+    ExpectIntEQ(uriNC("https://12.31.2.3./",          "12.31.2.3"), 0);
+    ExpectIntEQ(uriNC("https://12.31.2.3./",          "12.31.2.3."), 0);
 
     /*
      * Malformed / degenerate URIs and inputs (reject).
diff --git a/tests/api/test_ossl_x509_ext.c b/tests/api/test_ossl_x509_ext.c
@@ -2039,8 +2039,8 @@ int test_wolfSSL_NAME_CONSTRAINTS_uri(void)
         ExpectIntEQ(wolfSSL_NAME_CONSTRAINTS_check_name(nc, GEN_URI,
             "https://user:pass@www.wolfssl.com/path", 38), 1);
 
-        /* IPv6 literal URIs, host extracted without brackets.
-         * These don't match .wolfssl.com constraint (different host type) */
+        /* URI constraints require a DNS reg-name host, so IP-literals do not
+         * match the .wolfssl.com constraint. */
         ExpectIntEQ(wolfSSL_NAME_CONSTRAINTS_check_name(nc, GEN_URI,
             "https://[::1]:8080/path", 23), 0);
         ExpectIntEQ(wolfSSL_NAME_CONSTRAINTS_check_name(nc, GEN_URI,
@@ -2243,6 +2243,71 @@ int test_wolfSSL_NAME_CONSTRAINTS_check_name(void)
     x509 = NULL;
     nc = NULL;
 
+    /* Wildcard names against an excluded DNS subtree. Build the constraints
+     * programmatically: excluded;DNS:foo.example.com */
+    ExpectNotNull(nc = wolfSSL_NAME_CONSTRAINTS_new());
+    if (EXPECT_SUCCESS()) {
+        GENERAL_SUBTREE* subtree = NULL;
+
+        ExpectNotNull(nc->excludedSubtrees = wolfSSL_sk_new_null());
+        if (EXPECT_SUCCESS()) {
+            nc->excludedSubtrees->type = STACK_TYPE_GENERAL_SUBTREE;
+        }
+        ExpectNotNull(subtree = wolfSSL_GENERAL_SUBTREE_new());
+        if (EXPECT_SUCCESS()) {
+            ExpectNotNull(subtree->base = wolfSSL_GENERAL_NAME_new());
+        }
+        if (EXPECT_SUCCESS()) {
+            subtree->base->type = GEN_DNS;
+            ExpectIntEQ(wolfSSL_ASN1_STRING_set(subtree->base->d.ia5,
+                "foo.example.com", 15), WOLFSSL_SUCCESS);
+        }
+        if (EXPECT_SUCCESS()) {
+            ExpectIntGT(wolfSSL_sk_push(nc->excludedSubtrees, subtree), 0);
+        }
+        if (EXPECT_FAIL()) {
+            wolfSSL_GENERAL_SUBTREE_free(subtree);
+        }
+    }
+
+    if (EXPECT_SUCCESS()) {
+        /* Literal names inside the excluded subtree are rejected. */
+        ExpectIntEQ(wolfSSL_NAME_CONSTRAINTS_check_name(nc, GEN_DNS,
+            "foo.example.com", 15), 0);
+        ExpectIntEQ(wolfSSL_NAME_CONSTRAINTS_check_name(nc, GEN_DNS,
+            "a.foo.example.com", 17), 0);
+        /* Names outside the subtree pass; there are no permitted subtrees. */
+        ExpectIntEQ(wolfSSL_NAME_CONSTRAINTS_check_name(nc, GEN_DNS,
+            "bar.example.com", 15), 1);
+        ExpectIntEQ(wolfSSL_NAME_CONSTRAINTS_check_name(nc, GEN_DNS,
+            "*.other.com", 11), 1);
+        /* A wildcard's '*' can expand to "foo", so "*.example.com" covers
+         * the excluded "foo.example.com" and must be rejected. */
+        ExpectIntEQ(wolfSSL_NAME_CONSTRAINTS_check_name(nc, GEN_DNS,
+            "*.example.com", 13), 0);
+    }
+
+    if (EXPECT_SUCCESS()) {
+        /* One trailing dot on the base is the absolute-FQDN marker:
+         * excluded;DNS:foo.example.com. covers the same subtree, so the
+         * bare name is still rejected. */
+        GENERAL_SUBTREE* subtree = NULL;
+
+        ExpectNotNull(subtree =
+            wolfSSL_sk_GENERAL_SUBTREE_value(nc->excludedSubtrees, 0));
+        if (EXPECT_SUCCESS()) {
+            ExpectIntEQ(wolfSSL_ASN1_STRING_set(subtree->base->d.ia5,
+                "foo.example.com.", 16), WOLFSSL_SUCCESS);
+        }
+        ExpectIntEQ(wolfSSL_NAME_CONSTRAINTS_check_name(nc, GEN_DNS,
+            "foo.example.com", 15), 0);
+        ExpectIntEQ(wolfSSL_NAME_CONSTRAINTS_check_name(nc, GEN_DNS,
+            "bar.example.com", 15), 1);
+    }
+
+    NAME_CONSTRAINTS_free(nc);
+    nc = NULL;
+
     /* Test IP address constraint checking with cert-ext-ncip.pem
      * This cert has permitted IP 192.168.1.0/255.255.255.0 */
     if ((f = XFOPEN("./certs/test/cert-ext-ncip.pem", "rb")) == XBADFILE) {
diff --git a/wolfcrypt/src/asn.c b/wolfcrypt/src/asn.c
diff --git a/wolfssl/wolfcrypt/asn.h b/wolfssl/wolfcrypt/asn.h
