PKI library: dNSName constraints starting with dot should match subdomains.

net/cert/internal/name_constraints_unittest.cc

Index: net/cert/internal/name_constraints_unittest.cc
diff --git a/net/cert/internal/name_constraints_unittest.cc b/net/cert/internal/name_constraints_unittest.cc
index f1dd470d093bdb9df61f06eba901c8b51cffba2c..f4eabf110ed10cf35abb585541039332a05c8ab6 100644
--- a/net/cert/internal/name_constraints_unittest.cc
+++ b/net/cert/internal/name_constraints_unittest.cc
@@ -186,7 +186,7 @@ TEST_P(ParseNameConstraints,
   EXPECT_FALSE(name_constraints->IsPermittedDNSName("*.foo.bar.com"));
 }
 
-TEST_P(ParseNameConstraints, DNSNamesWithLeadingDot) {
+TEST_P(ParseNameConstraints, DNSNamesPermittedWithLeadingDot) {
   std::string a;
   ASSERT_TRUE(
       LoadTestNameConstraint("dnsname-permitted_with_leading_dot.pem", &a));
@@ -194,13 +194,30 @@ TEST_P(ParseNameConstraints, DNSNamesWithLeadingDot) {
       NameConstraints::Create(der::Input(&a), is_critical()));
   ASSERT_TRUE(name_constraints);
 
-  // dNSName constraints should be specified as a host. A dNSName constraint
-  // with a leading "." doesn't make sense, though some certs include it
-  // (probably confusing it with the rules for uniformResourceIdentifier
-  // constraints). It should not match anything.
+  // A permitted dNSName constraint of ".bar.com" should only match subdomains

[eroman, 2016/11/22 23:34:15]

If we don't already, might be good to have a test for ".." too (since we have
logic that strips the trailing dot first).

[mattm, 2016/11/24 00:08:50]

Done.

+  // of .bar.com, but not bar.com itself.
   EXPECT_FALSE(name_constraints->IsPermittedDNSName("com"));
   EXPECT_FALSE(name_constraints->IsPermittedDNSName("bar.com"));
+  EXPECT_FALSE(name_constraints->IsPermittedDNSName("foobar.com"));
+  EXPECT_TRUE(name_constraints->IsPermittedDNSName("foo.bar.com"));
+  EXPECT_TRUE(name_constraints->IsPermittedDNSName("*.bar.com"));
+}
+
+TEST_P(ParseNameConstraints, DNSNamesExcludedWithLeadingDot) {
+  std::string a;
+  ASSERT_TRUE(
+      LoadTestNameConstraint("dnsname-excluded_with_leading_dot.pem", &a));
+  std::unique_ptr<NameConstraints> name_constraints(
+      NameConstraints::Create(der::Input(&a), is_critical()));
+  ASSERT_TRUE(name_constraints);
+
+  // An excluded dNSName constraint of ".bar.com" should only match subdomains
+  // of .bar.com, but not bar.com itself.
+  EXPECT_TRUE(name_constraints->IsPermittedDNSName("com"));
+  EXPECT_TRUE(name_constraints->IsPermittedDNSName("bar.com"));
+  EXPECT_TRUE(name_constraints->IsPermittedDNSName("foobar.com"));
   EXPECT_FALSE(name_constraints->IsPermittedDNSName("foo.bar.com"));
+  EXPECT_FALSE(name_constraints->IsPermittedDNSName("*.bar.com"));
 }
 
 TEST_P(ParseNameConstraints, DNSNamesExcludeOnly) {