Improving errors for DNS name parsing

src/error.rs

@@ -138,7 +138,7 @@ pub enum Error {
 
     /// A presented or reference DNS identifier was malformed, potentially
     /// containing invalid characters or invalid labels.
-    MalformedDnsIdentifier,
+    MalformedDnsIdentifier(DnsNameError),
 
     /// The certificate extensions are malformed.
     ///
@@ -149,7 +149,7 @@ pub enum Error {
 
     /// A name constraint was malformed, potentially containing invalid characters or
     /// invalid labels.
-    MalformedNameConstraint,
+    MalformedNameConstraint(DnsNameError),
 
     /// The maximum number of name constraint comparisons has been reached.
     MaximumNameConstraintComparisonsExceeded,
@@ -302,8 +302,8 @@ impl Error {
             Self::MaximumPathDepthExceeded => 61,
 
             // Errors related to malformed data.
-            Self::MalformedDnsIdentifier => 60,
-            Self::MalformedNameConstraint => 50,
+            Self::MalformedDnsIdentifier(_) => 60,
+            Self::MalformedNameConstraint(_) => 50,
             Self::MalformedExtensions | Self::TrailingData(_) => 40,
             Self::ExtensionValueInvalid => 30,
 
@@ -430,3 +430,23 @@ pub enum DerTypeId {
     SubjectUniqueId,
     KeyUsageExtension,
 }
+
+/// Errors possible when parsing a DNS name.
+///
+/// This applies when parsing presented names, asserted names, or name constraints.
+#[expect(missing_docs)]
+#[non_exhaustive]
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum DnsNameError {
+    IllegalCharacter(u8),
+    LabelMustNotBeEmpty,
+    LabelMustNotEndWithHyphen,
+    LabelMustNotStartWithHyphen,
+    LabelTooLong,
+    LastLabelMustNotBeAllNumeric,
+    NameMustBeRelative,
+    NameTooLong,
+    Truncated,
+    WildcardAsteriskMustBeAloneInLabel,
+    WildcardMustPrecedeTwoLabels,
+}

src/lib.rs

@@ -77,7 +77,7 @@ pub use crl::{OwnedCertRevocationList, OwnedRevokedCert};
 pub use der::DerIterator;
 pub use end_entity::EndEntityCert;
 pub use error::{
-    DerTypeId, Error, InvalidNameContext, UnsupportedSignatureAlgorithmContext,
+    DerTypeId, DnsNameError, Error, InvalidNameContext, UnsupportedSignatureAlgorithmContext,
     UnsupportedSignatureAlgorithmForPublicKeyContext,
 };
 pub use rpk_entity::RawPublicKeyEntity;