[kareem-wolfssl]

Description

Implement X509_CHECK_FLAG_NO_WILDCARDS and NO_PARTIAL_WILDCARDS.
Honor the host flags in the handshake peer-name check.

Fixes zd#22737

Testing

Built in + added tests, provided reproducer

Checklist

• added tests
• updated/added doxygen
• updated appropriate READMEs
• Updated manual and documentation

[kareem-wolfssl]

@claude review

[Copilot]

🟡 Changes recommended

The set1_host() verification paths still ignore configured host flags, allowing wildcard certificates that callers explicitly forbid.

1 open issue

• set1_host ignores wildcard restriction flags during hostname verification · New

What changed in this PR

This PR tightens wolfSSL certificate hostname matching to reject partial-label wildcards by default under RFC 9525, while retaining an opt-in compatibility mode.

Changes:

• Implements wildcard restriction flags and forwards host flags in the domain-name handshake check.
• Updates hostname-matching tests for strict defaults and compatibility behavior.
• Moves legacy partial-wildcard handshake cases into a conditional test suite.

File	Description
tests/​test.conf	Removes partial-wildcard cases from the default suite.
tests/​test-wildcard-partial.conf	Adds compatibility-only partial-wildcard cases.
tests/​suites.c	Runs the compatibility suite when partial wildcards are enabled.
tests/​include.am	Includes the new test configuration in distributions.
tests/​api/​test_ossl_x509.c	Tests wildcard restrictions and adjusts default expectations.
src/​x509.c	Enables supported wildcard flags and corrects an unsupported-flag diagnostic.
src/​internal.c	Enforces wildcard restrictions and forwards handshake host flags.

_{Review effort: Balanced}

[github-actions]

MemBrowse Memory Report · Explore what changed →

gcc-arm-cortex-m3

• FLASH: .text +64 B (+0.0%, 132,213 B / 262,144 B, total: 50% used)

gcc-arm-cortex-m4

• FLASH: .text +64 B (+0.0%, 209,548 B / 262,144 B, total: 80% used)

gcc-arm-cortex-m4-dtls13

• FLASH: .text +64 B (+0.0%, 197,224 B / 1,048,576 B, total: 19% used)

gcc-arm-cortex-m4-openssl-compat

• FLASH: .text +128 B (+0.0%, 804,332 B / 1,048,576 B, total: 77% used)

gcc-arm-cortex-m4-pq

• FLASH: .text +64 B (+0.0%, 314,136 B / 1,048,576 B, total: 30% used)

gcc-arm-cortex-m4-rsa-only

• FLASH: .text +64 B (+0.0%, 344,464 B / 1,048,576 B, total: 33% used)

gcc-arm-cortex-m4-tls12

• FLASH: .text +64 B (+0.0%, 132,945 B / 262,144 B, total: 51% used)

gcc-arm-cortex-m4-tls13

• FLASH: .text +64 B (+0.0%, 250,862 B / 262,144 B, total: 96% used)

gcc-arm-cortex-m7

• FLASH: .text +64 B (+0.0%, 209,548 B / 262,144 B, total: 80% used)

gcc-arm-cortex-m7-pq

• FLASH: .text +64 B (+0.0%, 314,968 B / 1,048,576 B, total: 30% used)

gcc-arm-cortex-m7-tls13

• FLASH: .text +64 B (+0.0%, 250,862 B / 262,144 B, total: 96% used)

zephyr-frdm_rw612

• FLASH: datas +16 B, log_const_area -8 B, rodata +36 B, text +11,624 B (+4.1%, 294,132 B / 67,108,864 B, total: 0% used)
• RAM: bss +49 B, datas +16 B (+0.1%, 58,423 B / 983,040 B, total: 6% used)

No memory changes detected for:

• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-sp-math
• stm32-sim-stm32h753

---

_{Catch memory regressions in CI with MemBrowse. Free for open source.}

[claude]

Nothing blocking. The comments below are optional suggestions. There is no need to push a fix for them before merging.

Additional findings (outside the current diff — GitHub can't attach inline comments there):

• 🟡 src/internal.c — nit: The header comment on WildcardPlacementOK still says partial wildcards like "a*" and "ab" keep their old matching, which is now wrong in default builds. The function now rejects them whenever WOLFSSL_NO_PARTIAL_WILDCARDS is set, and MatchDomainName sets that flag unless WOLFSSL_ALLOW_PARTIAL_WILDCARDS is defined. Fix: rewrite the comment to say partial-label wildcards are refused under WOLFSSL_NO_PARTIAL_WILDCARDS, which is the default, and are only exempt from the two-label rule when WOLFSSL_ALLOW_PARTIAL_WILDCARDS is defined.

  Why this was flagged

  The comment at src/internal.c:15447-15450 says "Partial left-most wildcards such as "a*" or "ab" retain their existing matching behavior". The new check at src/internal.c:15481-15483 returns 0 for those patterns when WOLFSSL_NO_PARTIAL_WILDCARDS is set. MatchDomainName ORs that flag in at src/internal.c:15565-15571 unless WOLFSSL_ALLOW_PARTIAL_WILDCARDS is defined, so the flag is set in every default build. Someone maintaining this security-sensitive hostname matcher, going by the comment, would assume partial wildcards still match by default, the opposite of what the code does. The code itself behaves correctly; only the documentation is wrong.

  Verification: nit. The trigger is any default build, i.e. one without WOLFSSL_ALLOW_PARTIAL_WILDCARDS. The diff leaves the WildcardPlacementOK header comment unchanged at src/internal.c:15447-15449. The check added at src/internal.c:15481-15483 returns 0 for "a*" and "ab". MatchDomainName sets that flag unconditionally at src/internal.c:15565-15571. Runtime behavior is unaffected.

• 🟣 src/internal.c — Host flags are still ignored for names set with X509_VERIFY_PARAM_set1_host, so a WOLFSSL_NO_WILDCARDS app still accepts a "*.example.com" certificate. CheckPeerHostName at src/internal.c:19663 passes flags 0 to CheckForAltNames and to both MatchDomainName CN calls. ProcessPeerCerts at :21298 calls it with ssl->param->hostName, the usual OpenSSL path. Fix: pass ssl->param->hostFlags into CheckPeerHostName and use it at all three match calls, like the wolfSSL_check_domain_name path this PR updated.

  Why this was flagged

  The trigger is an OPENSSL_EXTRA app that pairs X509_VERIFY_PARAM_set1_host (or SSL_set1_host) with X509_VERIFY_PARAM_set_hostflags(WOLFSSL_NO_WILDCARDS), which is the standard OpenSSL idiom. In the handshake, ProcessPeerCerts (src/internal.c:21295-21298) checks ssl->param->hostName through CheckPeerHostName. That function hard-codes flags 0 in CheckForAltNames (src/internal.c:19663) and in MatchDomainName (src/internal.c:19669, 19678). A peer certificate with the SAN "*.example.com" therefore still matches "foo.example.com", even though the app asked for no wildcards. This PR changed only the wolfSSL_check_domain_name block (src/internal.c:21227-21280) to read hostFlags, and its stated goal is to honor host flags in the handshake peer-name check. The behavior on the verify-param path is pre-existing; this path was left as it was on the base branch. The x509_str.c:1396 path that does honor hostFlags runs only in wolfSSL_X509_verify_cert, not in this handshake check.

  Verification: Pre-existing: the base also ignores the flags on this path. ProcessPeerCerts checks the name at src/internal.c:21295-21299 with CheckPeerHostName(args->dCert, ssl->param->hostName). The flags are never passed in. CheckPeerHostName hard-codes flags 0 in all four match calls (src/internal.c:19663, 19669-19670, 19678-19679, 19682). Result: a SAN "*.example.com" still passes for "www.example.com" despite NO_WILDCARDS.