diff options
| author | Roland Shoemaker <roland@golang.org> | 2026-01-26 16:11:44 -0800 |
|---|---|---|
| committer | Gopher Robot <gobot@golang.org> | 2026-01-28 13:37:59 -0800 |
| commit | 2c4733c60978fc7a01d75cbcb3f99a1201687e7b (patch) | |
| tree | 535007c91082719d1a6d1fed5b9494c8a5c19f7b | |
| parent | 14d0bb39c1c4093bd02740d14b1a2ca720ced97c (diff) | |
| download | go-2c4733c60978fc7a01d75cbcb3f99a1201687e7b.tar.xz | |
[release-branch.go1.24] crypto/x509: fix single label excluded name constraints handling
Only strip labels when both the domain and constraint have more than one
label.
Fixes #76935
Fixes #77322
Change-Id: I1144c9f03cbfc3b858af153a839b193bb934618d
Reviewed-on: https://go-review.googlesource.com/c/go/+/739420
Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org>
Auto-Submit: Dmitri Shuralyov <dmitshur@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Damien Neil <dneil@google.com>
| -rw-r--r-- | src/crypto/x509/name_constraints_test.go | 16 | ||||
| -rw-r--r-- | src/crypto/x509/verify.go | 2 |
2 files changed, 17 insertions, 1 deletions
diff --git a/src/crypto/x509/name_constraints_test.go b/src/crypto/x509/name_constraints_test.go index bc91b28401..1f50650267 100644 --- a/src/crypto/x509/name_constraints_test.go +++ b/src/crypto/x509/name_constraints_test.go @@ -1658,6 +1658,22 @@ var nameConstraintsTests = []nameConstraintsTest{ }, expectedError: "\"*.example.com\" is not permitted", }, + // #89: a TLD constraint doesn't exclude unrelated wildcards + { + roots: []constraintsSpec{ + { + bad: []string{"dns:tld"}, + }, + }, + intermediates: [][]constraintsSpec{ + { + {}, + }, + }, + leaf: leafSpec{ + sans: []string{"dns:*.example.com"}, + }, + }, } func makeConstraintsCACert(constraints constraintsSpec, name string, key *ecdsa.PrivateKey, parent *Certificate, parentKey *ecdsa.PrivateKey) (*Certificate, error) { diff --git a/src/crypto/x509/verify.go b/src/crypto/x509/verify.go index 3de9f93b2c..076e82666a 100644 --- a/src/crypto/x509/verify.go +++ b/src/crypto/x509/verify.go @@ -546,7 +546,7 @@ func matchDomainConstraint(domain, constraint string, excluded bool, reversedDom return false, nil } - if excluded && wildcardDomain && len(domainLabels) > 1 && len(constraintLabels) > 0 { + if excluded && wildcardDomain && len(domainLabels) > 1 && len(constraintLabels) > 1 { domainLabels = domainLabels[:len(domainLabels)-1] constraintLabels = constraintLabels[:len(constraintLabels)-1] } |