Fixes from review

Author: embhorn

tests/api/test_ossl_x509.c

@@ -1663,7 +1663,8 @@ int test_wolfssl_local_IsValidFQDN(void) {
                         test_cases[i].is_FQDN);
         if (! EXPECT_SUCCESS()) {
             fprintf(stderr, "wolfssl_local_IsValidFQDN() wrong result for "
-                    "case %d \"%s\"\n", i, test_cases[i].str);
+                    "case %d \"%s\"\n", i,
+                    test_cases[i].str ? test_cases[i].str : "(null)");
             break;
         }
     }
@@ -1710,12 +1711,12 @@ int test_wolfssl_local_IsValidFQDN(void) {
 /* Verify that MatchDomainName() refuses to expand wildcards across IDNA
  * A-labels (xn-- prefix) per RFC 6125 sec. 6.4.3 / RFC 9525 sec. 6.3.
  *
- * MatchDomainName() is WOLFSSL_LOCAL but visible to the test binary because
- * tests link against the in-tree library. */
+ * MatchDomainName() is exposed for testing via the visibility mechanism
+ * declared in wolfssl/internal.h. */
 int test_wolfSSL_MatchDomainName_idn(void)
 {
     EXPECT_DECLS;
-#if !defined(NO_CERTS)
+#if !defined(NO_ASN) && !defined(WOLFCRYPT_ONLY) && !defined(NO_CERTS)
     static const struct {
         const char* pattern;
         const char* host;
@@ -1791,7 +1792,7 @@ int test_wolfSSL_MatchDomainName_idn(void)
             break;
         }
     }
-#endif /* !NO_CERTS */
+#endif /* !NO_ASN && !WOLFCRYPT_ONLY && !NO_CERTS */
     return EXPECT_RESULT();
 }
 

wolfcrypt/src/asn.c

@@ -18076,7 +18076,11 @@ static int ConfirmNameConstraints(Signer* signer, DecodedCert* cert)
 #endif /* IGNORE_NAME_CONSTRAINTS */
 
 #if !defined(WOLFCRYPT_ONLY) && !defined(NO_CERTS)
-/* Returns 1 if name is a syntactically valid DNS FQDN per RFC 952/1123.
+/* Returns 1 if name is a syntactically valid DNS FQDN.
+ *
+ * Based on RFC 952/1123 DNS label rules, with the pragmatic extension that
+ * underscores are permitted in non-TLD labels (common in SRV/internal names
+ * despite RFC 952/1123 not allowing them).
  *
  * Rules enforced:
  *   - Total effective length (excluding optional trailing dot) in [1, 253]