Name Constraints cert chain walk

[rlm2002]

Description

Implements chain walk to perform Name Constraints check for certificate ancestors.
Walks the cert chain in ParseCertRelative and applies each ancestor CA's name constraints to the leaf. Previously only the immediate signer's constraints were checked, so higher-level CA constraints were not enforced.

Parent lookup prefers AKID→SKID (validated against issuer name) and falls back to name-only; NO_SKID builds are name-only and cannot disambiguate same-DN sibling CAs in the CM.

Adds authKeyIdHash + authKeyIdSet to Signer (populated in FillSigner from the cert's AKID) so the walk can locate each ancestor's parent by SKID via GetCA, rather than relying on issuer name alone.

Adds regression tests and supporting cert chain undercerts/test/nc-ancestor/.

Fixes zd#21877, #21879, #21895

Testing

./configure --enable-all && make check

Checklist

• added tests
• updated/added doxygen
• updated appropriate READMEs
• Updated manual and documentation

[github-actions]

retest this please

[github-actions]

MemBrowse Memory Report

gcc-arm-cortex-m0plus

• FLASH: .text +164 B (+0.3%, 63,659 B / 262,144 B, total: 24% used)

gcc-arm-cortex-m3

• FLASH: .text +184 B (+0.2%, 121,581 B / 262,144 B, total: 46% used)

gcc-arm-cortex-m4

• FLASH: .text +192 B (+0.1%, 199,248 B / 262,144 B, total: 76% used)

gcc-arm-cortex-m4-baremetal

• FLASH: .text +192 B (+0.3%, 66,251 B / 262,144 B, total: 25% used)

gcc-arm-cortex-m4-crypto-only

• FLASH: .text +128 B (+0.1%, 173,806 B / 262,144 B, total: 66% used)

gcc-arm-cortex-m4-dtls13

• FLASH: .text +192 B (+0.1%, 179,928 B / 1,048,576 B, total: 17% used)

gcc-arm-cortex-m4-min-ecc

• FLASH: .text +128 B (+0.2%, 61,165 B / 262,144 B, total: 23% used)

gcc-arm-cortex-m4-openssl-compat

• FLASH: .text +256 B (+0.0%, 767,988 B / 1,048,576 B, total: 73% used)

gcc-arm-cortex-m4-pkcs7

• FLASH: .text +128 B (+0.1%, 211,441 B / 262,144 B, total: 81% used)

gcc-arm-cortex-m4-pq

• FLASH: .text +128 B (+0.0%, 278,072 B / 1,048,576 B, total: 27% used)

gcc-arm-cortex-m4-rsa-only

• FLASH: .text +192 B (+0.1%, 323,672 B / 1,048,576 B, total: 31% used)

gcc-arm-cortex-m4-sp-math

• FLASH: .text +128 B (+0.2%, 61,165 B / 262,144 B, total: 23% used)

gcc-arm-cortex-m4-tls12

• FLASH: .text +192 B (+0.2%, 122,317 B / 262,144 B, total: 47% used)

gcc-arm-cortex-m4-tls13

• FLASH: .text +192 B (+0.1%, 234,882 B / 262,144 B, total: 90% used)

gcc-arm-cortex-m7

• FLASH: .text +128 B (+0.1%, 199,184 B / 262,144 B, total: 76% used)

gcc-arm-cortex-m7-pq

• FLASH: .text +128 B (+0.0%, 278,648 B / 1,048,576 B, total: 27% used)

gcc-arm-cortex-m7-tls13

• FLASH: .text +128 B (+0.1%, 234,882 B / 262,144 B, total: 90% used)

stm32-sim-stm32h753

• FLASH: .text -64 B (-0.0%, 181,620 B / 2,097,152 B, total: 9% used)
  No memory changes detected for:
• linuxkm-pie
• linuxkm-standard

[rlm2002]

Retest this please Jenkins: PRB-fips-repo-and-harness-test-v3-part2 failure