Disallow support for a*.example.net, *a.example.net, and a*b.example.net in certificate wildcard ha…

Disallow support for a*.example.net, *a.example.net, and a*b.example.net in certificate wildcard handling.

RFC 2818 deprecates these esoteric forms, thus RFC 6125 documents them,
but they should never appear in a publicly trusted certificate, and
are dang weird for internal certificates.

Instead, require that the wildcard
- Appear ONLY in the left-most label of a presented name. This is
  existing behaviour.
- Appear as the ONLY character in the label (e.g. it is the full
  label). This is the new behaviour.

BUG=434960
R=davidben@chromium.org

Committed: https://crrev.com/11b72a072effbf22f4f80eaba75acb38e33967dd
Cr-Commit-Position: refs/heads/master@{#306603}

[Ryan Sleevi, 2014-11-27 15:09:21]

David: For your bemusement.

[davidben, 2014-12-01 21:39:06]

lgtm.

I can't imagine anyone could possibly be relying on this, but, for completeness:
were there any certs in the CT log like this and do other browsers accept these
certs?

[Ryan Sleevi, 2014-12-03 14:05:45]

On 2014/12/01 21:39:06, David Benjamin wrote:
> lgtm.
> 
> I can't imagine anyone could possibly be relying on this, but, for
completeness:
> were there any certs in the CT log like this and do other browsers accept
these
> certs?

There are, but they're not valid, and the Baseline Requirements prohibits them.

Mozilla allows ab* but not *bc form (
http://mxr.mozilla.org/nss/source/lib/certdb/certdb.c#1390 ) - and only if the
name has a single wildcard (most of the ones matching the form have multiple and
are thus excluded)

[Ryan Sleevi, 2014-12-03 14:05:48]

The CQ bit was checked by rsleevi@chromium.org

[commit-bot: I haz the power, 2014-12-03 14:06:53]

CQ is trying da patch. Follow status at
 https://chromium-cq-status.appspot.com/patch-status/762013002/1

[commit-bot: I haz the power, 2014-12-03 15:01:48]

Committed patchset #1 (id:1)

[commit-bot: I haz the power, 2014-12-03 15:02:32]

Patchset 1 (id:??) landed as
https://crrev.com/11b72a072effbf22f4f80eaba75acb38e33967dd
Cr-Commit-Position: refs/heads/master@{#306603}