Class for parsing and evaluating RFC 5280 NameConstraints.

net/cert/internal/verify_name_match_unittest.cc

Index: net/cert/internal/verify_name_match_unittest.cc
diff --git a/net/cert/internal/verify_name_match_unittest.cc b/net/cert/internal/verify_name_match_unittest.cc
index 273e2e899165989c90307f387d6cf543827744ee..74d23445fcb55e7fd217ac20926f0b80ebcccac0 100644
--- a/net/cert/internal/verify_name_match_unittest.cc
+++ b/net/cert/internal/verify_name_match_unittest.cc
@@ -233,6 +233,58 @@ TEST_P(VerifyNameMatchDifferingTypesTest, NormalizableTypesAreEqual) {
   }
 }
 
+TEST_P(VerifyNameMatchDifferingTypesTest, NormalizableTypesInSubtrees) {
+  std::string der_1;
+  ASSERT_TRUE(LoadTestData("ascii", value_type_1(), "unmangled", &der_1));
+  std::string der_1_extra_rdn;
+  ASSERT_TRUE(LoadTestData("ascii", value_type_1(), "unmangled-extra_rdn",
+                           &der_1_extra_rdn));
+  std::string der_1_extra_attr;
+  ASSERT_TRUE(LoadTestData("ascii", value_type_1(), "unmangled-extra_attr",
+                           &der_1_extra_attr));
+  std::string der_2;
+  ASSERT_TRUE(LoadTestData("ascii", value_type_2(), "unmangled", &der_2));
+  std::string der_2_extra_rdn;
+  ASSERT_TRUE(LoadTestData("ascii", value_type_2(), "unmangled-extra_rdn",
+                           &der_2_extra_rdn));
+  std::string der_2_extra_attr;
+  ASSERT_TRUE(LoadTestData("ascii", value_type_2(), "unmangled-extra_attr",
+                           &der_2_extra_attr));
+
+  if (TypesAreComparable(value_type_1(), value_type_2())) {
+    EXPECT_TRUE(VerifyNameInSubtree(SequenceValueFromString(der_1),
+                                    SequenceValueFromString(der_2)));
+    EXPECT_TRUE(VerifyNameInSubtree(SequenceValueFromString(der_2),
+                                    SequenceValueFromString(der_1)));
+    EXPECT_TRUE(VerifyNameInSubtree(SequenceValueFromString(der_1_extra_rdn),
+                                    SequenceValueFromString(der_2)));
+    EXPECT_TRUE(VerifyNameInSubtree(SequenceValueFromString(der_2_extra_rdn),
+                                    SequenceValueFromString(der_1)));
+  } else {
+    EXPECT_FALSE(VerifyNameInSubtree(SequenceValueFromString(der_1),
+                                     SequenceValueFromString(der_2)));
+    EXPECT_FALSE(VerifyNameInSubtree(SequenceValueFromString(der_2),
+                                     SequenceValueFromString(der_1)));
+    EXPECT_FALSE(VerifyNameInSubtree(SequenceValueFromString(der_1_extra_rdn),
+                                     SequenceValueFromString(der_2)));
+    EXPECT_FALSE(VerifyNameInSubtree(SequenceValueFromString(der_2_extra_rdn),
+                                     SequenceValueFromString(der_1)));
+  }
+
+  EXPECT_FALSE(VerifyNameInSubtree(SequenceValueFromString(der_1),
+                                   SequenceValueFromString(der_2_extra_rdn)));
+  EXPECT_FALSE(VerifyNameInSubtree(SequenceValueFromString(der_2),
+                                   SequenceValueFromString(der_1_extra_rdn)));
+  EXPECT_FALSE(VerifyNameInSubtree(SequenceValueFromString(der_1_extra_attr),
+                                   SequenceValueFromString(der_2)));
+  EXPECT_FALSE(VerifyNameInSubtree(SequenceValueFromString(der_2_extra_attr),
+                                   SequenceValueFromString(der_1)));
+  EXPECT_FALSE(VerifyNameInSubtree(SequenceValueFromString(der_1),
+                                   SequenceValueFromString(der_2_extra_attr)));
+  EXPECT_FALSE(VerifyNameInSubtree(SequenceValueFromString(der_2),
+                                   SequenceValueFromString(der_1_extra_attr)));
+}
+
 // Runs VerifyNameMatchDifferingTypesTest for all combinations of value types in
 // value_type1 and value_type_2.
 INSTANTIATE_TEST_CASE_P(InstantiationName,
@@ -460,4 +512,36 @@ TEST(VerifyNameMatchRDNSorting, DuplicateTypes) {
       VerifyNameMatch(SequenceValueFromString(b), SequenceValueFromString(a)));
 }
 
+TEST(VerifyNameInSubtreeInvalidDataTest, FailOnEmptyRdn) {
+  std::string valid;
+  ASSERT_TRUE(LoadTestData("ascii", "PRINTABLESTRING", "unmangled", &valid));
+  std::string invalid;
+  ASSERT_TRUE(LoadTestData("invalid", "RDN", "empty", &invalid));
+  // For both |name| and |parent|, a RelativeDistinguishedName must have at
+  // least one AttributeTypeAndValue.
+  EXPECT_FALSE(VerifyNameInSubtree(SequenceValueFromString(valid),
+                                   SequenceValueFromString(invalid)));
+  EXPECT_FALSE(VerifyNameInSubtree(SequenceValueFromString(invalid),
+                                   SequenceValueFromString(valid)));
+  EXPECT_FALSE(VerifyNameInSubtree(SequenceValueFromString(invalid),
+                                   SequenceValueFromString(invalid)));
+}
+
+TEST(VerifyNameInSubtreeTest, EmptyNameMatching) {
+  std::string empty;
+  ASSERT_TRUE(LoadTestData("valid", "Name", "empty", &empty));
+  std::string non_empty;
+  ASSERT_TRUE(
+      LoadTestData("ascii", "PRINTABLESTRING", "unmangled", &non_empty));
+  // Empty name is in the subtree defined by empty name.
+  EXPECT_TRUE(VerifyNameInSubtree(SequenceValueFromString(empty),
+                                  SequenceValueFromString(empty)));
+  // Any non-empty name is in the subtree defined by empty name.
+  EXPECT_TRUE(VerifyNameInSubtree(SequenceValueFromString(non_empty),
+                                  SequenceValueFromString(empty)));
+  // Empty name is not in the subtree defined by non-empty name.
+  EXPECT_FALSE(VerifyNameInSubtree(SequenceValueFromString(empty),
+                                   SequenceValueFromString(non_empty)));
+}
+
 }  // namespace net