Map Mac's CSSMERR_APPLETP_INVALID_EMPTY_SUBJECT error to...

net/base/x509_certificate_unittest.cc

 // Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "base/crypto/rsa_private_key.h"
 #include "base/file_path.h"
 #include "base/file_util.h"
 #include "base/path_service.h"
 #include "base/pickle.h"
 #include "base/string_split.h"
@@ skipping 452 matching lines @@
   EXPECT_EQ(ERR_CERT_INVALID, error);
   EXPECT_NE(0, verify_result.cert_status & CERT_STATUS_INVALID);
   // TODO(wtc): fix http://crbug.com/75520 to get all the certificate errors
   // from NSS.
 #if !defined(USE_NSS)
   // The certificate is issued by an unknown CA.
   EXPECT_NE(0, verify_result.cert_status & CERT_STATUS_AUTHORITY_INVALID);
 #endif
 }
 
+// A regression test for http://crbug.com/63988.
+// Do not report ERR_CERT_INVALID on a certificate with an empty Subject field
+// and a subjectAltName extension that is not marked as critical.
+TEST(X509CertificateTest, EmptySubject) {
+  FilePath certs_dir = GetTestCertsDirectory();
+
+  scoped_refptr<X509Certificate> server_cert =
+      ImportCertFromFile(certs_dir, "empty_subject_cert.der");
+  ASSERT_NE(static_cast<X509Certificate*>(NULL), server_cert);
+
+  int flags = 0;
+  CertVerifyResult verify_result;
+  int error = server_cert->Verify("1.1.1.1", flags, &verify_result);
+
+  // We no longer map the invalid subject error to CERT_STATUS_INVALID on the
+  // Mac.
+  EXPECT_NE(ERR_CERT_INVALID, error);
+  EXPECT_EQ(0, verify_result.cert_status & CERT_STATUS_INVALID);
+
+  // The subjectAltName extension contains an iPAddress of "1.1.1.1", but
+  // we map the invalid empty subject error to CERT_STATUS_COMMON_NAME_INVALID
+  // on the Mac.
+#if defined(OS_MACOSX)
+  EXPECT_NE(0, verify_result.cert_status & CERT_STATUS_COMMON_NAME_INVALID);
+#endif
+
+  // The certificate is self-signed.
+  EXPECT_NE(0, verify_result.cert_status & CERT_STATUS_AUTHORITY_INVALID);
+}
+
 // Tests X509Certificate::Cache via X509Certificate::CreateFromHandle.  We
 // call X509Certificate::CreateFromHandle several times and observe whether
 // it returns a cached or new X509Certificate object.
 //
 // All the OS certificate handles in this test are actually from the same
 // source (the bytes of a lone certificate), but we pretend that some of them
 // come from the network.
 TEST(X509CertificateTest, Cache) {
   X509Certificate::OSCertHandle google_cert_handle;
 
@@ skipping 469 matching lines @@
   EXPECT_EQ(test_data.expected,
             X509Certificate::VerifyHostname(test_data.hostname, cert_names))
       << "Host [" << test_data.hostname
       << "], cert name [" << test_data.cert_names << "]";
 }
 
 INSTANTIATE_TEST_CASE_P(, X509CertificateNameVerifyTest,
                         testing::ValuesIn(kNameVerifyTestData));
 
 }  // namespace net