[kareem-wolfssl]

Description

Fixes zd#22514

Testing

Built in + added tests

Checklist

• added tests
• updated/added doxygen
• updated appropriate READMEs
• Updated manual and documentation

[Copilot]

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Copilot review overview

Review effort: Lite
Findings: 1 · 3 · 2

Open (6)

• ssl_s is updated to use server-garbage.pem as its certificate, but there is no corresponding… · New
• This macro changes hostname validation semantics in a security-sensitive area (relaxing the “must… · New
• test_ctx is initialized and passed to test_memio_setup(), but there is no corresponding… · New
• test_ctx is initialized and passed to test_memio_setup(), but there is no corresponding… · New
• The #define lines are indented, which is atypical for preprocessor directives and can reduce… · New
• The comment says “single label, too short” but the expected result is now SINGLE_LABEL_OK (i.e.,… · New

What changed in this PR

Adds an opt-in build macro to relax the FQDN label-count requirement so single-label hostnames can pass validation, along with test coverage for the new behavior.

Changes:

• Introduces WOLFSSL_ALLOW_SINGLE_LABEL_HOSTNAME to permit single-label hostnames in wolfssl_local_IsValidFQDN.
• Adds new TLS API test for wolfSSL_check_domain_name() behavior with single-label hostnames.
• Updates X509/domain matching tests to conditionally expect single-label host acceptance.

File	Description
tests/​api/​test_tls.h	Registers a new TLS API test for single-label hostname checking.
tests/​api/​test_tls.c	Adds a memio-based handshake test that exercises wolfSSL_check_domain_name() with single-label inputs.
tests/​api/​test_ossl_x509.c	Updates FQDN validity and domain match tests to be conditional on the new macro.
src/​ssl.c	Implements the macro-controlled relaxation of label-count validation in wolfssl_local_IsValidFQDN.
.wolfssl_known_macro_extras	Adds the new macro to the known macro list.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

retest this please

[github-actions]

MemBrowse Memory Report · Explore what changed →

zephyr-frdm_rw612

• FLASH: log_const_area -8 B, rodata -8 B, text +168 B (+0.1%, 282,616 B / 67,108,864 B, total: 0% used)

No memory changes detected for:

• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m3
• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-dtls13
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-openssl-compat
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-pq
• gcc-arm-cortex-m4-rsa-only
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m4-tls13
• gcc-arm-cortex-m7
• gcc-arm-cortex-m7-pq
• gcc-arm-cortex-m7-tls13
• stm32-sim-stm32h753

---

_{Catch memory regressions in CI with MemBrowse. Free for open source.}

[philljj]

tests good with multi-test.

curl failure is unrelated.