From ea21dedf1b82a18e2da38bf3c6be4bdb5f682cb9 Mon Sep 17 00:00:00 2001
From: "Jonathan M. Wilbur" <jonathan@wilbur.space>
Date: Tue, 25 Oct 2022 23:08:41 +0000
Subject: [PATCH] Support delegatedNameConstraints X.509v3 extension

---
 crypto/x509/ext_dat.h                       |  1 +
 crypto/x509/standard_exts.h                 |  1 +
 crypto/x509/v3_ncons.c                      | 10 ++++++++++
 test/certs/ext-delegatedNameConstraints.pem | 12 ++++++++++++
 test/recipes/25-test_x509.t                 | 13 ++++++++++++-
 5 files changed, 36 insertions(+), 1 deletion(-)
 create mode 100644 test/certs/ext-delegatedNameConstraints.pem

diff --git a/crypto/x509/ext_dat.h b/crypto/x509/ext_dat.h
index f9ec85fc825f3..3d3394f80e85c 100644
--- a/crypto/x509/ext_dat.h
+++ b/crypto/x509/ext_dat.h
@@ -33,3 +33,4 @@ extern const X509V3_EXT_METHOD ossl_v3_single_use;
 extern const X509V3_EXT_METHOD ossl_v3_targeting_information;
 extern const X509V3_EXT_METHOD ossl_v3_audit_identity;
 extern const X509V3_EXT_METHOD ossl_v3_bacons;
+extern const X509V3_EXT_METHOD ossl_v3_delegated_name_constraints;
diff --git a/crypto/x509/standard_exts.h b/crypto/x509/standard_exts.h
index 729bad949bb4e..9e91dc41fbcfd 100644
--- a/crypto/x509/standard_exts.h
+++ b/crypto/x509/standard_exts.h
@@ -76,6 +76,7 @@ static const X509V3_EXT_METHOD *standard_exts[] = {
     &ossl_v3_tls_feature,
     &ossl_v3_ext_admission,
     &ossl_v3_bacons,
+    &ossl_v3_delegated_name_constraints,
     &ossl_v3_soa_identifier,
     &ossl_v3_no_assertion,
     &ossl_v3_single_use,
diff --git a/crypto/x509/v3_ncons.c b/crypto/x509/v3_ncons.c
index 52675530e38c8..00375202ca14b 100644
--- a/crypto/x509/v3_ncons.c
+++ b/crypto/x509/v3_ncons.c
@@ -52,6 +52,16 @@ const X509V3_EXT_METHOD ossl_v3_name_constraints = {
     NULL
 };
 
+const X509V3_EXT_METHOD ossl_v3_delegated_name_constraints = {
+    NID_delegated_name_constraints, 0,
+    ASN1_ITEM_ref(NAME_CONSTRAINTS),
+    0, 0, 0, 0,
+    0, 0,
+    0, v2i_NAME_CONSTRAINTS,
+    i2r_NAME_CONSTRAINTS, 0,
+    NULL
+};
+
 ASN1_SEQUENCE(GENERAL_SUBTREE) = {
         ASN1_SIMPLE(GENERAL_SUBTREE, base, GENERAL_NAME),
         ASN1_IMP_OPT(GENERAL_SUBTREE, minimum, ASN1_INTEGER, 0),
diff --git a/test/certs/ext-delegatedNameConstraints.pem b/test/certs/ext-delegatedNameConstraints.pem
new file mode 100644
index 0000000000000..8ae755e2b8267
--- /dev/null
+++ b/test/certs/ext-delegatedNameConstraints.pem
@@ -0,0 +1,12 @@
+-----BEGIN CERTIFICATE-----
+MIIB2jCCAcagAwIBAgIDAQIDMAsGCSqGSIb3DQEBBTAAMCIYDzIwMjEwODMxMDIx
+ODAyWhgPMjAyMTA4MzEwMjE4MDJaMAAwggEgMAsGCSqGSIb3DQEBAQOCAQ8AMIIB
+CgKCAQEAtnjLm1ts1hC4fNNt3UnQD9y73bDXgioTyWYSI3ca/KNfuTydjFTEYAmq
+nuGrBOUfgbmH3PRQ0AmpqljgWTb3d3K8H4UFvDWQTPSS21IMjm8oqd19nE5GxWir
+Gu0oDRzhWLHe1RZ7ZrohCPg/1Ocsy47QZuK2laFB0rEmrRWBmEYbDl3/wxf5XfqI
+qpOynJB02thXrTCcTM7Rz1FqCFt/ZVZB5hKY2S+CTdE9OIVKlr4WHMfuvUYeOj06
+GkwLFJHNv2tU+tovI3mYRxUuY4UupkS3MC+Otey7XKm1P+INjWWoegm6iCAt3Vus
+pVz+6pU2xgl3nrAVMQHB4fReQPH0pQIDAQABo2EwXzBdBgNVHSoEVjBUoCgwJqQe
+MBwxGjAYBgNVBAMMEVdpbGRib2FyIFNvZnR3YXJlgAEBgQEDoSgwJqQeMBwxGjAY
+BgNVBAMMEVdpbGRib2FyIFNvZnR3YXJlgAECgQEEMAsGCSqGSIb3DQEBBQMBAA==
+-----END CERTIFICATE-----
diff --git a/test/recipes/25-test_x509.t b/test/recipes/25-test_x509.t
index a08534367156a..0189eeb7c84f8 100644
--- a/test/recipes/25-test_x509.t
+++ b/test/recipes/25-test_x509.t
@@ -16,7 +16,7 @@ use OpenSSL::Test qw/:DEFAULT srctop_file/;
 
 setup("test_x509");
 
-plan tests => 45;
+plan tests => 48;
 
 # Prevent MSys2 filename munging for arguments that look like file paths but
 # aren't
@@ -162,6 +162,17 @@ cert_contains($bacons_cert,
               "pathlen:3",
               1, 'X.509 Basic Attribute Constraints Path Length');
 
+my $dncons_cert = srctop_file(@certs, "ext-delegatedNameConstraints.pem");
+cert_contains($dncons_cert,
+              "DirName:CN = Wil",
+              1, 'X.509 Delegated Name Constraints');
+cert_contains($dncons_cert,
+              "Permitted:",
+              1, 'X.509 Delegated Name Constraints');
+cert_contains($dncons_cert,
+              "Excluded:",
+              1, 'X.509 Delegated Name Constraints');
+
 sub test_errors { # actually tests diagnostics of OSSL_STORE
     my ($expected, $cert, @opts) = @_;
     my $infile = srctop_file(@certs, $cert);