PKI library: dNSName constraints starting with dot should match subdomains.

net/data/name_constraints_unittest/generate_name_constraints.py

 #!/usr/bin/env python
 # Copyright 2015 The Chromium Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
 import base64
 import copy
 import os
 import random
 import subprocess
@@ skipping 193 matching lines @@
 
   dnsname_constraints2 = NameConstraintsGenerator()
   dnsname_constraints2.add_permitted(dns_name("com"))
   dnsname_constraints2.add_excluded(dns_name("foo.bar.com"))
   generate(dnsname_constraints2, "dnsname2.pem")
 
   dnsname_constraints3 = NameConstraintsGenerator()
   dnsname_constraints3.add_permitted(dns_name(".bar.com"))
   generate(dnsname_constraints3, "dnsname-permitted_with_leading_dot.pem")
 
+  dnsname_constraints4 = NameConstraintsGenerator()
+  dnsname_constraints4.add_excluded(dns_name(".bar.com"))
+  generate(dnsname_constraints4, "dnsname-excluded_with_leading_dot.pem")
+
   c = NameConstraintsGenerator()
   c.add_excluded(dns_name("excluded.permitted.example.com"))
   generate(c, "dnsname-excluded.pem")
 
   c = NameConstraintsGenerator()
   c.add_permitted(dns_name("permitted.example.com"))
   c.add_excluded(dns_name(""))
   generate(c, "dnsname-excludeall.pem")
 
   c = NameConstraintsGenerator()
@@ skipping 300 matching lines @@
       dns_name("permitted.example.com"), minimum=1, maximum=2))
   generate(c, "dnsname-with_min_1_and_max.pem")
 
   c = NameConstraintsGenerator()
   c.add_permitted(with_min_max(dns_name("permitted.example.com"), maximum=2))
   generate(c, "dnsname-with_max.pem")
 
 
 if __name__ == '__main__':
   main()