PKI library: dNSName constraints starting with dot should match subdomains.

net/cert/internal/name_constraints.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/internal/name_constraints.h"
 
 #include <limits.h>
 
 #include <memory>
 
@@ skipping 69 matching lines @@
     }
   }
 
   if (!base::EndsWith(name, dns_constraint,
                       base::CompareCase::INSENSITIVE_ASCII)) {
     return false;
   }
   // Exact match.
   if (name.size() == dns_constraint.size())
     return true;
+  // If dNSName constraint starts with a dot, only subdomains should match.
+  // (e.g., "foo.bar.com" matches constraint ".bar.com", but "bar.com" doesn't.)
+  // RFC 5280 is ambiguous, but this matches the behavior of other platforms.
+  if (!dns_constraint.empty() && dns_constraint[0] == '.')
+    dns_constraint.remove_prefix(1);
   // Subtree match.
   if (name.size() > dns_constraint.size() &&
       name[name.size() - dns_constraint.size() - 1] == '.') {
     return true;
   }
   // Trailing text matches, but not in a subtree (e.g., "foobar.com" is not a
   // match for "bar.com").
   return false;
 }
 
@@ skipping 443 matching lines @@
 
   return false;
 }
 
 int NameConstraints::ConstrainedNameTypes() const {
   return (permitted_subtrees_.present_name_types |
           excluded_subtrees_.present_name_types);
 }
 
 }  // namespace net