Name constraints with excluded names but no permitted names should allow names not matching the exc…

net/cert/internal/name_constraints_unittest.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/internal/name_constraints.h"
 
 #include "net/cert/internal/test_helpers.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 namespace net {
@@ skipping 175 matching lines @@
 }
 
 TEST_P(ParseNameConstraints, DNSNamesExcludeOnly) {
   std::string a;
   ASSERT_TRUE(LoadTestNameConstraint("dnsname-excluded.pem", &a));
 
   scoped_ptr<NameConstraints> name_constraints(
       NameConstraints::CreateFromDer(der::Input(&a), is_critical()));
   ASSERT_TRUE(name_constraints);
 
-  // Only "excluded.permitted.example.com" is excluded, but since no dNSNames
-  // are permitted, everything is excluded.
-  EXPECT_FALSE(name_constraints->IsPermittedDNSName(""));
-  EXPECT_FALSE(name_constraints->IsPermittedDNSName("foo.com"));
-  EXPECT_FALSE(name_constraints->IsPermittedDNSName("permitted.example.com"));
+  // Only "excluded.permitted.example.com" is excluded, and since permitted is
+  // empty, any dNSName outside that is allowed.
+  EXPECT_TRUE(name_constraints->IsPermittedDNSName(""));
+  EXPECT_TRUE(name_constraints->IsPermittedDNSName("foo.com"));
+  EXPECT_TRUE(name_constraints->IsPermittedDNSName("permitted.example.com"));
   EXPECT_FALSE(
       name_constraints->IsPermittedDNSName("excluded.permitted.example.com"));
   EXPECT_FALSE(
       name_constraints->IsPermittedDNSName("a.excluded.permitted.example.com"));
 }
 
 TEST_P(ParseNameConstraints, DNSNamesExcludeAll) {
   std::string a;
   ASSERT_TRUE(LoadTestNameConstraint("dnsname-excludeall.pem", &a));
 
@@ skipping 131 matching lines @@
   std::string name_empty;
   ASSERT_TRUE(LoadTestName("name-empty.pem", &name_empty));
   std::string name_us;
   ASSERT_TRUE(LoadTestName("name-us.pem", &name_us));
   std::string name_us_ca;
   ASSERT_TRUE(LoadTestName("name-us-california.pem", &name_us_ca));
   std::string name_us_ca_mountain_view;
   ASSERT_TRUE(LoadTestName("name-us-california-mountain_view.pem",
                            &name_us_ca_mountain_view));
 
-  // Only "C=US,ST=California" is excluded, but since no directoryNames are
-  // permitted, everything is excluded.
-  EXPECT_FALSE(name_constraints->IsPermittedDirectoryName(
+  // Only "C=US,ST=California" is excluded, and since permitted is empty,
+  // any directoryName outside that is allowed.
+  EXPECT_TRUE(name_constraints->IsPermittedDirectoryName(
       SequenceValueFromString(&name_empty)));
-  EXPECT_FALSE(name_constraints->IsPermittedDirectoryName(
+  EXPECT_TRUE(name_constraints->IsPermittedDirectoryName(
       SequenceValueFromString(&name_us)));
   EXPECT_FALSE(name_constraints->IsPermittedDirectoryName(
       SequenceValueFromString(&name_us_ca)));
   EXPECT_FALSE(name_constraints->IsPermittedDirectoryName(
       SequenceValueFromString(&name_us_ca_mountain_view)));
 }
 
 TEST_P(ParseNameConstraints, DirectoryNamesExcludeAll) {
   std::string constraints_der;
   ASSERT_TRUE(
-      LoadTestNameConstraint("directoryname-excluded.pem", &constraints_der));
+      LoadTestNameConstraint("directoryname-excludeall.pem", &constraints_der));
   scoped_ptr<NameConstraints> name_constraints(NameConstraints::CreateFromDer(
       der::Input(&constraints_der), is_critical()));
   ASSERT_TRUE(name_constraints);
 
   std::string name_empty;
   ASSERT_TRUE(LoadTestName("name-empty.pem", &name_empty));
   std::string name_us;
   ASSERT_TRUE(LoadTestName("name-us.pem", &name_us));
   std::string name_us_ca;
   ASSERT_TRUE(LoadTestName("name-us-california.pem", &name_us_ca));
@@ skipping 182 matching lines @@
 }
 
 TEST_P(ParseNameConstraints, IPAdressesExcludeOnly) {
   std::string a;
   ASSERT_TRUE(LoadTestNameConstraint("ipaddress-excluded.pem", &a));
 
   scoped_ptr<NameConstraints> name_constraints(
       NameConstraints::CreateFromDer(der::Input(&a), is_critical()));
   ASSERT_TRUE(name_constraints);
 
-  // Only 192.168.5.0/255.255.255.0 is excluded, but since no iPAddresses
-  // are permitted, everything is excluded.
+  // Only 192.168.5.0/255.255.255.0 is excluded, and since permitted is empty,
+  // any iPAddress outside that is allowed.
   {
     const uint8_t ip4[] = {192, 168, 0, 1};
-    EXPECT_FALSE(name_constraints->IsPermittedIP(
+    EXPECT_TRUE(name_constraints->IsPermittedIP(
         IPAddressNumber(ip4, ip4 + arraysize(ip4))));
   }
   {
     const uint8_t ip4[] = {192, 168, 5, 1};
     EXPECT_FALSE(name_constraints->IsPermittedIP(
         IPAddressNumber(ip4, ip4 + arraysize(ip4))));
   }
   {
     const uint8_t ip6[] = {1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 13, 0, 0, 0, 1};
-    EXPECT_FALSE(name_constraints->IsPermittedIP(
+    EXPECT_TRUE(name_constraints->IsPermittedIP(
         IPAddressNumber(ip6, ip6 + arraysize(ip6))));
   }
 }
 
 TEST_P(ParseNameConstraints, IPAdressesExcludeAll) {
   std::string a;
   ASSERT_TRUE(LoadTestNameConstraint("ipaddress-excludeall.pem", &a));
 
   scoped_ptr<NameConstraints> name_constraints(
       NameConstraints::CreateFromDer(der::Input(&a), is_critical()));
@@ skipping 672 matching lines @@
       SequenceValueFromString(&name_us_az_192_168_1_1), der::Input()));
 
   std::string san;
   ASSERT_TRUE(LoadTestSubjectAltName("san-invalid-ipaddress.pem", &san));
   // Should fail if subjectAltName contains an invalid ip address.
   EXPECT_FALSE(name_constraints->IsPermittedCert(
       SequenceValueFromString(&name_us_az_192_168_1_1), der::Input(&san)));
 }
 
 }  // namespace net