rustls
diff --git a/‎src/subject_name/mod.rs‎
Lines changed: 12 additions & 6 deletions b/‎src/subject_name/mod.rs‎
Lines changed: 12 additions & 6 deletions
diff --git a/‎tests/common/mod.rs‎
Lines changed: 2 additions & 0 deletions b/‎tests/common/mod.rs‎
Lines changed: 2 additions & 0 deletions
diff --git a/‎tests/tls_server_certs.rs‎
Lines changed: 91 additions & 0 deletions b/‎tests/tls_server_certs.rs‎
Lines changed: 91 additions & 0 deletions
@@ -126,10 +126,12 @@ fn check_presented_id_conforms_to_constraints(
                 Err(err) => return Some(Err(err)),
             };
 
+            // Avoid having a catch-all branch here which might fail open on new variants
             let matches = match (name, base) {
                 (GeneralName::DnsName(name), GeneralName::DnsName(base)) => {
                     dns_name::presented_id_matches_reference_id(name, IdRole::NameConstraint, base)
                 }
+                (GeneralName::DnsName(_), _) => continue,
 
                 (GeneralName::DirectoryName, GeneralName::DirectoryName) => Ok(
                     // Reject any uses of directory name constraints; we don't implement this.
@@ -150,10 +152,19 @@ fn check_presented_id_conforms_to_constraints(
                         Subtrees::ExcludedSubtrees => true,
                     },
                 ),
+                (GeneralName::DirectoryName, _) => continue,
 
                 (GeneralName::IpAddress(name), GeneralName::IpAddress(base)) => {
                     ip_address::presented_id_matches_constraint(name, base)
                 }
+                (GeneralName::IpAddress(_), _) => continue,
+
+                // We currently don't support URI constraints -- fail closed for now.
+                (
+                    GeneralName::UniformResourceIdentifier(_),
+                    GeneralName::UniformResourceIdentifier(_),
+                ) => Ok(false),
+                (GeneralName::UniformResourceIdentifier(_), _) => continue,
 
                 // RFC 4280 says "If a name constraints extension that is marked as
                 // critical imposes constraints on a particular name form, and an
@@ -168,12 +179,7 @@ fn check_presented_id_conforms_to_constraints(
                 {
                     Err(Error::NameConstraintViolation)
                 }
-
-                _ => {
-                    // mismatch between constraint and name types; continue with current
-                    // name and next constraint
-                    continue;
-                }
+                (GeneralName::Unsupported(_), _) => continue,
             };
 
             match (subtrees, matches) {
 
@@ -1,3 +1,5 @@
+#![allow(dead_code, unreachable_pub)]
+
 use std::error::Error as StdError;
 
 use rcgen::{
 
@@ -16,8 +16,60 @@
 use core::time::Duration;
 
 use pki_types::{CertificateDer, ServerName, UnixTime};
+use rcgen::{
+    Certificate, CertificateParams, CertifiedIssuer, CustomExtension, DnType, IsCa, KeyPair,
+    SanType, date_time_ymd,
+};
 use webpki::{InvalidNameContext, KeyUsage, anchor_from_trusted_cert};
 
+mod common;
+use common::issuer_params;
+
+/// Since we don't have real constraint matching implemented for URI names, fail closed.
+#[test]
+fn uri_san_rejected_against_uri_permitted_subtree() {
+    let ca_key = KeyPair::generate().unwrap();
+    let mut ca_params = issuer_params("issuer.example.com").unwrap();
+    ca_params
+        .custom_extensions
+        .push(uri_permitted_name_constraints(
+            b"https://allowed.example.com",
+        ));
+    let issuer = CertifiedIssuer::self_signed(ca_params, ca_key).expect("failed to generate CA");
+
+    let ee = generate_cert(
+        vec![SanType::URI("https://evil.example.com".try_into().unwrap())],
+        &issuer,
+    );
+    assert_eq!(
+        check_cert(ee.der(), issuer.der(), &[], &[], &[]),
+        Err(webpki::Error::NameConstraintViolation),
+    );
+}
+
+// Hand-encode a NameConstraints extension (OID 2.5.29.30) with a single
+// permittedSubtree containing a URI GeneralName. rcgen's GeneralSubtree enum
+// doesn't expose a URI variant, so we emit the DER directly.
+fn uri_permitted_name_constraints(uri: &[u8]) -> CustomExtension {
+    assert!(uri.len() < 128);
+    // URI GeneralName: [6] IMPLICIT IA5String
+    let mut uri_gn = vec![0x86, uri.len() as u8];
+    uri_gn.extend_from_slice(uri);
+    // GeneralSubtree SEQUENCE { base GeneralName, ... }
+    let mut subtree = vec![0x30, uri_gn.len() as u8];
+    subtree.extend_from_slice(&uri_gn);
+    // permittedSubtrees [0] IMPLICIT GeneralSubtrees
+    let mut permitted = vec![0xa0, subtree.len() as u8];
+    permitted.extend_from_slice(&subtree);
+    // NameConstraints SEQUENCE
+    let mut nc = vec![0x30, permitted.len() as u8];
+    nc.extend_from_slice(&permitted);
+
+    let mut ext = CustomExtension::from_oid_content(&[2, 5, 29, 30], nc);
+    ext.set_criticality(true);
+    ext
+}
+
 #[track_caller]
 fn check_cert(
     ee: &[u8],
@@ -61,6 +113,45 @@ fn check_cert(
     Ok(())
 }
 
+fn generate_cert(sans: Vec<SanType>, issuer: &CertifiedIssuer<'_, KeyPair>) -> Certificate {
+    generate_cert_with_names(None, None, sans, issuer)
+}
+
+fn generate_cert_with_names(
+    subject_cn: Option<&str>,
+    subject_email: Option<&str>,
+    sans: Vec<SanType>,
+    issuer: &CertifiedIssuer<'_, KeyPair>,
+) -> Certificate {
+    let (not_before, not_after) = (date_time_ymd(1970, 1, 1), date_time_ymd(2050, 1, 1));
+
+    // Generate end entity certificate
+    let ee_key = KeyPair::generate().unwrap();
+    let mut ee_params = CertificateParams::new([]).expect("failed to create EE params");
+    ee_params.subject_alt_names = sans;
+    if let Some(cn) = subject_cn {
+        ee_params.distinguished_name.push(DnType::CommonName, cn);
+    }
+    if let Some(email) = subject_email {
+        ee_params
+            .distinguished_name
+            .push(DnType::from_oid(OID_EMAIL_ADDRESS), email);
+    }
+    ee_params
+        .distinguished_name
+        .push(DnType::OrganizationName, "test");
+    ee_params.is_ca = IsCa::ExplicitNoCa;
+    ee_params.not_before = not_before;
+    ee_params.not_after = not_after;
+
+    ee_params
+        .signed_by(&ee_key, issuer)
+        .expect("failed to generate EE cert")
+}
+
+// OID for emailAddress in subject DN (pkcs9-emailAddress)
+const OID_EMAIL_ADDRESS: &[u64] = &[1, 2, 840, 113549, 1, 9, 1];
+
 // DO NOT EDIT BELOW: generated by tests/generate.py
 
 #[test]
Original file line number	Diff line number	Diff line change
@@ -1,3 +1,5 @@
	1	+ #![allow(dead_code, unreachable_pub)]
	2	+
1	3	use std::error::Error as StdError;
2	4
3	5	use rcgen::{