Add parsing code for TBSCertificate's "validity" field.

net/cert/internal/parse_certificate_unittest.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/internal/parse_certificate.h"
 
+#include "base/strings/stringprintf.h"
 #include "net/cert/internal/test_helpers.h"
 #include "net/der/input.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 namespace net {
 
 namespace {
 
+// Pretty-prints a GeneralizedTime as a human-readable string for use in test
+// expectations (it is more readable to specify the expected results as a
+// string).
+std::string ToString(const der::GeneralizedTime& time) {
+  return base::StringPrintf(
+      "year=%d, month=%d, day=%d, hours=%d, minutes=%d, seconds=%d", time.year,
+      time.month, time.day, time.hours, time.minutes, time.seconds);
+}
+
 std::string GetFilePath(const std::string file_name) {
   return std::string("net/data/parse_certificate_unittest/") + file_name;
 }
 
 // Loads certificate data and expectations from the PEM file |file_name|.
 // Verifies that parsing the Certificate succeeds, and each parsed field matches
 // the expectations.
 void EnsureParsingCertificateSucceeds(const std::string& file_name) {
   std::string data;
   std::string expected_tbs_certificate;
@@ skipping 85 matching lines @@
 
 // Loads tbsCertificate data and expectations from the PEM file |file_name|.
 // Verifies that parsing the TBSCertificate succeeds, and each parsed field
 // matches the expectations.
 void EnsureParsingTbsSucceeds(const std::string& file_name,
                               CertificateVersion expected_version) {
   std::string data;
   std::string expected_serial_number;
   std::string expected_signature_algorithm;
   std::string expected_issuer;
-  std::string expected_validity;
+  std::string expected_validity_not_before;
+  std::string expected_validity_not_after;
   std::string expected_subject;
   std::string expected_spki;
   std::string expected_issuer_unique_id;
   std::string expected_subject_unique_id;
   std::string expected_extensions;
 
   // Read the certificate data and test expectations from a single PEM file.
   const PemBlockMapping mappings[] = {
       {"TBS CERTIFICATE", &data},
       {"SIGNATURE ALGORITHM", &expected_signature_algorithm},
       {"SERIAL NUMBER", &expected_serial_number},
       {"ISSUER", &expected_issuer},
-      {"VALIDITY", &expected_validity},
+      {"VALIDITY NOTBEFORE", &expected_validity_not_before},
+      {"VALIDITY NOTAFTER", &expected_validity_not_after},
       {"SUBJECT", &expected_subject},
       {"SPKI", &expected_spki},
       {"ISSUER UNIQUE ID", &expected_issuer_unique_id, true},
       {"SUBJECT UNIQUE ID", &expected_subject_unique_id, true},
       {"EXTENSIONS", &expected_extensions, true},
   };
   ASSERT_TRUE(ReadTestDataFromPemFile(GetFilePath(file_name), mappings));
 
   // Parsing the TBSCertificate should succeed.
   ParsedTbsCertificate parsed;
   ASSERT_TRUE(ParseTbsCertificate(InputFromString(&data), &parsed));
 
   // Ensure that the ParsedTbsCertificate matches expectations.
   EXPECT_EQ(expected_version, parsed.version);
 
   EXPECT_EQ(InputFromString(&expected_serial_number), parsed.serial_number);
   EXPECT_EQ(InputFromString(&expected_signature_algorithm),
             parsed.signature_algorithm_tlv);
 
   EXPECT_EQ(InputFromString(&expected_issuer), parsed.issuer_tlv);
-  EXPECT_EQ(InputFromString(&expected_validity), parsed.validity_tlv);
+
+  // In the test expectations PEM file, validity is described as a
+  // textual string of the parsed value (rather than as DER).
+  EXPECT_EQ(expected_validity_not_before, ToString(parsed.validity_not_before));
+  EXPECT_EQ(expected_validity_not_after, ToString(parsed.validity_not_after));
+
   EXPECT_EQ(InputFromString(&expected_subject), parsed.subject_tlv);
   EXPECT_EQ(InputFromString(&expected_spki), parsed.spki_tlv);
 
   EXPECT_EQ(InputFromString(&expected_issuer_unique_id),
             parsed.issuer_unique_id.bytes());
   EXPECT_EQ(!expected_issuer_unique_id.empty(), parsed.has_issuer_unique_id);
   EXPECT_EQ(InputFromString(&expected_subject_unique_id),
             parsed.subject_unique_id.bytes());
   EXPECT_EQ(!expected_subject_unique_id.empty(), parsed.has_subject_unique_id);
 
@@ skipping 102 matching lines @@
 TEST(ParseTbsCertificateTest, Version3DataAfterExtensions) {
   EnsureParsingTbsFails("tbs_v3_data_after_extensions.pem");
 }
 
 // Tests using a real-world certificate (whereas the other tests are fabricated
 // (and in fact invalid) data.
 TEST(ParseTbsCertificateTest, Version3Real) {
   EnsureParsingTbsSucceeds("tbs_v3_real.pem", CertificateVersion::V3);
 }
 
+// Parses a TBSCertificate whose "validity" field expresses both notBefore
+// and notAfter using UTCTime.
+TEST(ParseTbsCertificateTest, ValidityBothUtcTime) {
+  EnsureParsingTbsSucceeds("tbs_validity_both_utc_time.pem",
+                           CertificateVersion::V3);
+}
+
+// Parses a TBSCertificate whose "validity" field expresses both notBefore
+// and notAfter using GeneralizedTime.
+TEST(ParseTbsCertificateTest, ValidityBothGeneralizedTime) {
+  EnsureParsingTbsSucceeds("tbs_validity_both_generalized_time.pem",
+                           CertificateVersion::V3);
+}
+
+// Parses a TBSCertificate whose "validity" field expresses notBefore using
+// UTCTime and notAfter using GeneralizedTime.
+TEST(ParseTbsCertificateTest, ValidityUTCTimeAndGeneralizedTime) {
+  EnsureParsingTbsSucceeds("tbs_validity_utc_time_and_generalized_time.pem",
+                           CertificateVersion::V3);
+}
+
+// Parses a TBSCertificate whose validity" field expresses notBefore using
+// GeneralizedTime and notAfter using UTCTime. Also of interest, notBefore >
+// notAfter. Parsing will succeed, however no time can satisfy this constraint.
+TEST(ParseTbsCertificateTest, ValidityGeneralizedTimeAndUTCTime) {
+  EnsureParsingTbsSucceeds("tbs_validity_generalized_time_and_utc_time.pem",
+                           CertificateVersion::V3);
+}
+
+// Parses a TBSCertificate whose "validity" field does not strictly follow
+// the DER rules (and fails to be parsed).
+TEST(ParseTbsCertificateTest, ValidityRelaxed) {
+  EnsureParsingTbsFails("tbs_validity_relaxed.pem");
+}
+
 }  // namespace
 
 }  // namespace net