strip all trailing dots in name-constraint host canonicalization

Author: rootvector2

core/src/main/java/org/bouncycastle/asn1/x509/PKIXNameConstraintValidator.java

@@ -1240,13 +1240,21 @@ private static boolean isDNSConstrained(String constraint, String dns)
 
     private static String stripTrailingDot(String s)
     {
-        // length > 1 so a single bare "." (theoretically the empty-label
-        // root) is preserved rather than reduced to "".
-        if (s != null && s.length() > 1 && s.charAt(s.length() - 1) == '.')
+        if (s == null)
         {
-            return s.substring(0, s.length() - 1);
+            return s;
         }
-        return s;
+        // Strip *every* trailing dot, not just one: a dNSName/rfc822Name/URI host such as
+        // "example.com.." (legal IA5String, unvalidated on parse) otherwise keeps a phantom
+        // empty label after a single strip and slips past the exact-match check. The lower bound
+        // of 1 preserves a bare "." (theoretically the empty-label root) rather than reducing it
+        // to "".
+        int end = s.length();
+        while (end > 1 && s.charAt(end - 1) == '.')
+        {
+            end--;
+        }
+        return end == s.length() ? s : s.substring(0, end);
     }
 
     /**

docs/releasenotes.md

@@ -208,6 +208,8 @@ Date: 2026, TBD
 
 - The PKCS12-PBMAC1 keystore asked PBKDF2 for a 256-octet MAC key against an HMAC-SHA-512 message-authentication scheme, four times the size of the key that scheme uses. RFC 9579 sec. 5 says the derived key "SHOULD be the same size as the HMAC function output size", giving the worked example of a 32-octet key for HMAC-SHA-256, so the keystore now asks for 64 - and so does the default on PKCS12StoreParameter.pbmac1WithPBKDF2Builder(), the public builder that configures the same field. Nothing was weaker for the extra length; the shorter derivation is the conformant one and is marginally cheaper. Reading is unaffected either way, since the length is taken from the file: a PFX written by an earlier release, asking for 256, still verifies, and that is why the keyLength upper bound is well above the HMAC output size rather than at it. The builder's setKeySize() parameter was named keySizeinBits but has always been used as octets, being passed straight into PBKDF2Params, whose keyLength RFC 8018 app. A.2 defines as "the length in octets of the derived key"; it is renamed keySizeInOctets, which changes no behaviour and no signature - only what the parameter is called. PBMAC1WithPBKDF2Builder had no javadoc at all, so the units were undiscoverable from the API docs; it and its six methods are now documented, including the RFC 9579 sec. 5 rule that the key length match the output size of the message-authentication scheme.
 
+- The name-constraint trailing-dot canonicalisation in PKIXNameConstraintValidator stripped only a single RFC 1034 root-label dot, so a dNSName, rfc822Name host or uniformResourceIdentifier host carrying two or more trailing dots (e.g. "example.com..", legal IA5String and unvalidated on parse) kept a phantom empty label and slipped past the exact-match check, escaping an excluded subtree it should have been caught by (RFC 5280 sec. 4.2.1.10). stripTrailingDot now removes every trailing dot, closing the gap uniformly across the dNSName, rfc822Name and URI paths that share it; a bare "." is still preserved and a sibling domain is still not caught. This completes the single-dot canonicalisation added earlier for the same class of bypass.
+
 ### 2.1.3 Additional Features and Functionality
 
 - BIP340Signer can now be initialised from an AsymmetricCipherKeyPair, through the new init(boolean, AsymmetricCipherKeyPair) and init(boolean, AsymmetricCipherKeyPair, SecureRandom) methods. BIP-340 signing needs the public point twice, for the parity of d and for bytes(P) in the nonce and challenge hashes (sec. 3.3 steps 3-4), and derived it with a d'*G multiplication every time; a caller that already holds the public key can now supply it and skip that. Since the two fixed-base multiplications - that one and R = k'*G - are very nearly the whole cost of a signature, producing one measures about twice as fast this way (github #2420). The public key is not checked against the private key, because checking it means performing the multiplication being avoided; a mismatched pair simply produces a signature that does not verify, and the javadoc says so. Independently, the public point is now derived once per init() rather than on every generateSignature() call, so a signer initialised once and used for several signatures gets most of the same saving with no change on the caller's part. Signatures are unchanged in every case, and the existing CipherParameters init is untouched.

prov/src/test/java/org/bouncycastle/jce/provider/test/PKIXNameConstraintsTest.java

@@ -295,6 +295,21 @@ private void testTrailingDotBypass() throws Exception
         // uniformResourceIdentifier: the host trailing dot is stripped like the dNSName path.
         isTrue("trailing-dot URI host must be caught by the excluded competitor.example subtree",
             isExcluded(uriName("competitor.example"), uriName("https://competitor.example./")));
+
+        // More than one trailing dot must be caught too - stripping only a single dot left a phantom
+        // empty label that slipped the exact-match check past an excluded subtree.
+        isTrue("exact host with two trailing dots must be caught",
+            isExcluded(dnsName("example.com"), dnsName("example.com..")));
+        isTrue("exact host with three trailing dots must be caught",
+            isExcluded(dnsName("example.com"), dnsName("example.com...")));
+        isTrue("two-trailing-dot email host must be caught",
+            isExcluded(emailName("bank.com"), emailName("ceo@bank.com..")));
+        isTrue("two-trailing-dot email mailbox must be caught",
+            isExcluded(emailName("ceo@bank.com"), emailName("ceo@bank.com..")));
+        isTrue("two-trailing-dot URI host must be caught",
+            isExcluded(uriName("competitor.example"), uriName("https://competitor.example../")));
+        isTrue("a sibling domain with trailing dots must still not be caught",
+            !isExcluded(dnsName("example.com"), dnsName("notexample.com..")));
     }
 
     /**