tests: Add corner case tests for name constraints, improve doc

- Added corner case test suite for DNS name constraints.
- Documentation update in chain tests.

Signed-off-by: Martin Ukrop <mukrop@redhat.com>

1 files changed, 19 insertions, 0 deletions

diff --git a/tests/name-constraints.c b/tests/name-constraints.c
index 455acd4374..64e82ad35d 100644
--- a/tests/name-constraints.c
+++ b/tests/name-constraints.c
@@ -307,6 +307,25 @@ void doit(void)
 	gnutls_x509_name_constraints_deinit(nc);
 	gnutls_x509_crt_deinit(crt);
 
+	/* 4: corner cases */
+
+	/* 4a: empty excluded name (works as wildcard) */
+
+	ret = gnutls_x509_name_constraints_init(&nc);
+	check_for_error(ret);
+
+	set_name("", &name);
+	ret = gnutls_x509_name_constraints_add_excluded(nc, GNUTLS_SAN_DNSNAME, &name);
+	check_for_error(ret);
+
+	set_name("example.net", &name);
+	ret = gnutls_x509_name_constraints_check(nc, GNUTLS_SAN_DNSNAME, &name);
+	check_test_result(ret, NAME_REJECTED, &name);
+
+	gnutls_x509_name_constraints_deinit(nc);
+
+	// Test suite end.
+
 	if (debug)
 		success("Test success.\n");
 }