Add a few regress test cases for name constraints.

From Alex Wilson

1 files changed, 17 insertions, 1 deletions

diff --git a/src/regress/lib/libcrypto/CA/root.cnf b/src/regress/lib/libcrypto/CA/root.cnf
index 506542e943..30a442f136 100644
--- a/src/regress/lib/libcrypto/CA/root.cnf
+++ b/src/regress/lib/libcrypto/CA/root.cnf
@@ -1,4 +1,4 @@
-#       $OpenBSD: root.cnf,v 1.3 2020/12/26 00:48:56 bluhm Exp $
+#       $OpenBSD: root.cnf,v 1.4 2022/03/14 21:30:48 tb Exp $
 # For regression tests
 default_ca = CA_regress
 
@@ -95,6 +95,22 @@ subjectKeyIdentifier = hash
 authorityKeyIdentifier = keyid:always,issuer
 basicConstraints = critical, CA:true, pathlen:0
 keyUsage = critical, digitalSignature, cRLSign, keyCertSign
+nameConstraints = critical, @ca_name_constraints
+
+[ ca_name_constraints ]
+permitted;DNS.0 = .openbsd.org
+permitted;DNS.1 = client
+permitted;email.0 = openbsd.org
+permitted;email.1 = @test.openbsd.org
+permitted;URI.0 = .openbsd.org
+permitted;dirName.0 = openbsd_dn
+permitted;otherName.0 = 1.3.6.1.4.1.311.20.2.3;UTF8:@openbsd.org
+excluded;IP.0 = 0.0.0.0/0.0.0.0
+excluded;IP.1 = 0:0:0:0:0:0:0:0/0:0:0:0:0:0:0:0
+
+[ openbsd_dn ]
+C = CA
+O = OpenBSD
 
 [ usr_cert ]
 # Extensions for client certificates (`man x509v3_config`).