Relax SAN DNSname validation and constraints to permit non leading *

wildcards. While we may choose not to support them the standards
appear to permit them optionally so we can't declare a certificate
containing them invalid. Noticed by jeremy@, and Steffan Ulrich
and others. Modify the regression tests to test these cases and
not check the SAN DNSnames as "hostnames" anymore (which don't support
wildcards).

ok jsing@, tb@

1 files changed, 4 insertions, 8 deletions

diff --git a/src/regress/lib/libcrypto/x509/constraints.c b/src/regress/lib/libcrypto/x509/constraints.c
index 7eef55d591..c4dedeb1fa 100644
--- a/src/regress/lib/libcrypto/x509/constraints.c
+++ b/src/regress/lib/libcrypto/x509/constraints.c
@@ -49,6 +49,8 @@ unsigned char *valid_hostnames[] = {
 unsigned char *valid_sandns_names[] = {
         "*.ca",
         "*.op3nbsd.org",
+        "c*.openbsd.org",
+        "foo.*.d*.c*.openbsd.org",
         NULL,
 };
 
@@ -96,6 +98,7 @@ unsigned char *invalid_hostnames[] = {
         "openbsd\n.org",
         "open\178bsd.org",
         "open\255bsd.org",
+        "*.openbsd.org",
         NULL,
 };
 
@@ -110,10 +113,10 @@ unsigned char *invalid_sandns_names[] = {
         "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa."
         "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa.a",
         "*.-p3nbsd.org",
-        "a*.openbsd.org",
         "*.*..openbsd.org",
         "*..openbsd.org",
         ".openbsd.org",
+        "c*c.openbsd.org",
         NULL,
 };
 
@@ -254,13 +257,6 @@ test_invalid_hostnames(void)
                         failure = 1;
                         goto done;
                 }
-                if (x509_constraints_valid_sandns(invalid_hostnames[i],
-                    strlen(invalid_hostnames[i]))) {
-                        FAIL("Invalid sandns '%s' accepted\n",
-                            invalid_hostnames[i]);
-                        failure = 1;
-                        goto done;
-                }
         }
         if (x509_constraints_valid_host(nulhost,
             strlen(nulhost) + 1)) {