From: Roland Shoemaker <roland@golang.org>
Date: Tue, 27 Jan 2026 00:11:44 +0000 (-0800)
Subject: [release-branch.go1.24] crypto/x509: fix single label excluded name constraints handling
X-Git-Tag: go1.24.13~7
X-Git-Url: http://www.git.cypherpunks.su/?a=commitdiff_plain;h=2c4733c60978fc7a01d75cbcb3f99a1201687e7b;p=gostls13.git

[release-branch.go1.24] crypto/x509: fix single label excluded name constraints handling

Only strip labels when both the domain and constraint have more than one
label.

Fixes #76935
Fixes #77322

Change-Id: I1144c9f03cbfc3b858af153a839b193bb934618d
Reviewed-on: https://go-review.googlesource.com/c/go/+/739420
Reviewed-by: Dmitri Shuralyov <dmitshur@golang.org>
Auto-Submit: Dmitri Shuralyov <dmitshur@google.com>
LUCI-TryBot-Result: Go LUCI <golang-scoped@luci-project-accounts.iam.gserviceaccount.com>
Reviewed-by: Damien Neil <dneil@google.com>
---

diff --git a/src/crypto/x509/name_constraints_test.go b/src/crypto/x509/name_constraints_test.go
index bc91b28401..1f50650267 100644
--- a/src/crypto/x509/name_constraints_test.go
+++ b/src/crypto/x509/name_constraints_test.go
@@ -1658,6 +1658,22 @@ var nameConstraintsTests = []nameConstraintsTest{
 		},
 		expectedError: "\"*.example.com\" is not permitted",
 	},
+	// #89: a TLD constraint doesn't exclude unrelated wildcards
+	{
+		roots: []constraintsSpec{
+			{
+				bad: []string{"dns:tld"},
+			},
+		},
+		intermediates: [][]constraintsSpec{
+			{
+				{},
+			},
+		},
+		leaf: leafSpec{
+			sans: []string{"dns:*.example.com"},
+		},
+	},
 }
 
 func makeConstraintsCACert(constraints constraintsSpec, name string, key *ecdsa.PrivateKey, parent *Certificate, parentKey *ecdsa.PrivateKey) (*Certificate, error) {
diff --git a/src/crypto/x509/verify.go b/src/crypto/x509/verify.go
index 3de9f93b2c..076e82666a 100644
--- a/src/crypto/x509/verify.go
+++ b/src/crypto/x509/verify.go
@@ -546,7 +546,7 @@ func matchDomainConstraint(domain, constraint string, excluded bool, reversedDom
 		return false, nil
 	}
 
-	if excluded && wildcardDomain && len(domainLabels) > 1 && len(constraintLabels) > 0 {
+	if excluded && wildcardDomain && len(domainLabels) > 1 && len(constraintLabels) > 1 {
 		domainLabels = domainLabels[:len(domainLabels)-1]
 		constraintLabels = constraintLabels[:len(constraintLabels)-1]
 	}