Add tests for Cast certificate interpretation of policies.

components/cast_certificate/cast_cert_validator_unittest.cc

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "components/cast_certificate/cast_cert_validator.h"
 
 #include "components/cast_certificate/cast_cert_validator_test_helpers.h"
 #include "net/cert/internal/cert_errors.h"
 #include "net/cert/internal/parsed_certificate.h"
 #include "net/cert/internal/trust_store_in_memory.h"
@@ skipping 398 matching lines @@
           "certificates/violates_root_pathlen_constraint.pem", AprilFirst2016(),
           TRUST_STORE_FROM_TEST_FILE_UNCONSTRAINED, "");
 
   // Now do the real test and verify validation fails when using a TrustAncho
   // with pathlen constraint.
   RunTest(RESULT_FAIL, "Target", CastDeviceCertPolicy::NONE,
           "certificates/violates_root_pathlen_constraint.pem", AprilFirst2016(),
           TRUST_STORE_FROM_TEST_FILE, "");
 }
 
+// Tests verifying a certificate chain with the policies:
+//
+//  Root:           policies={}
+//  Intermediate:   policies={anyPolicy}
+//  Leaf:           policies={anyPolicy}
+TEST(VerifyCastDeviceCertTest, PoliciesIcaAnypolicyLeafAnypolicy) {
+  RunTest(RESULT_SUCCESS, "Leaf", CastDeviceCertPolicy::NONE,
+          "certificates/policies_ica_anypolicy_leaf_anypolicy.pem",
+          AprilFirst2016(), TRUST_STORE_FROM_TEST_FILE, "");
+}
+
+// Test verifying a certificate chain with the policies:
+//
+//   Root:           policies={}
+//   Intermediate:   policies={anyPolicy}
+//   Leaf:           policies={audioOnly}
+TEST(VerifyCastDeviceCertTest, PoliciesIcaAnypolicyLeafAudioonly) {
+  RunTest(RESULT_SUCCESS, "Leaf", CastDeviceCertPolicy::AUDIO_ONLY,
+          "certificates/policies_ica_anypolicy_leaf_audioonly.pem",
+          AprilFirst2016(), TRUST_STORE_FROM_TEST_FILE, "");
+}
+
+// Test verifying a certificate chain with the policies:
+//
+//   Root:           policies={}
+//   Intermediate:   policies={anyPolicy}
+//   Leaf:           policies={foo}
+TEST(VerifyCastDeviceCertTest, PoliciesIcaAnypolicyLeafFoo) {
+  RunTest(RESULT_SUCCESS, "Leaf", CastDeviceCertPolicy::NONE,
+          "certificates/policies_ica_anypolicy_leaf_foo.pem", AprilFirst2016(),
+          TRUST_STORE_FROM_TEST_FILE, "");
+}
+
+// Test verifying a certificate chain with the policies:
+//
+//   Root:           policies={}
+//   Intermediate:   policies={anyPolicy}
+//   Leaf:           policies={}
+TEST(VerifyCastDeviceCertTest, PoliciesIcaAnypolicyLeafNone) {
+  RunTest(RESULT_SUCCESS, "Leaf", CastDeviceCertPolicy::NONE,
+          "certificates/policies_ica_anypolicy_leaf_none.pem", AprilFirst2016(),
+          TRUST_STORE_FROM_TEST_FILE, "");
+}
+
+// Test verifying a certificate chain with the policies:
+//
+//   Root:           policies={}
+//   Intermediate:   policies={audioOnly}
+//   Leaf:           policies={anyPolicy}
+TEST(VerifyCastDeviceCertTest, PoliciesIcaAudioonlyLeafAnypolicy) {
+  RunTest(RESULT_SUCCESS, "Leaf", CastDeviceCertPolicy::AUDIO_ONLY,
+          "certificates/policies_ica_audioonly_leaf_anypolicy.pem",
+          AprilFirst2016(), TRUST_STORE_FROM_TEST_FILE, "");
+}
+
+// Test verifying a certificate chain with the policies:
+//
+//   Root:           policies={}
+//   Intermediate:   policies={audioOnly}
+//   Leaf:           policies={audioOnly}
+TEST(VerifyCastDeviceCertTest, PoliciesIcaAudioonlyLeafAudioonly) {
+  RunTest(RESULT_SUCCESS, "Leaf", CastDeviceCertPolicy::AUDIO_ONLY,
+          "certificates/policies_ica_audioonly_leaf_audioonly.pem",
+          AprilFirst2016(), TRUST_STORE_FROM_TEST_FILE, "");
+}
+
+// Test verifying a certificate chain with the policies:
+//
+//   Root:           policies={}
+//   Intermediate:   policies={audioOnly}
+//   Leaf:           policies={foo}
+TEST(VerifyCastDeviceCertTest, PoliciesIcaAudioonlyLeafFoo) {
+  RunTest(RESULT_SUCCESS, "Leaf", CastDeviceCertPolicy::AUDIO_ONLY,
+          "certificates/policies_ica_audioonly_leaf_foo.pem", AprilFirst2016(),
+          TRUST_STORE_FROM_TEST_FILE, "");
+}
+
+// Test verifying a certificate chain with the policies:
+//
+//   Root:           policies={}
+//   Intermediate:   policies={audioOnly}
+//   Leaf:           policies={}
+TEST(VerifyCastDeviceCertTest, PoliciesIcaAudioonlyLeafNone) {
+  RunTest(RESULT_SUCCESS, "Leaf", CastDeviceCertPolicy::AUDIO_ONLY,
+          "certificates/policies_ica_audioonly_leaf_none.pem", AprilFirst2016(),
+          TRUST_STORE_FROM_TEST_FILE, "");
+}
+
+// Test verifying a certificate chain with the policies:
+//
+//   Root:           policies={}
+//   Intermediate:   policies={}
+//   Leaf:           policies={anyPolicy}
+TEST(VerifyCastDeviceCertTest, PoliciesIcaNoneLeafAnypolicy) {
+  RunTest(RESULT_SUCCESS, "Leaf", CastDeviceCertPolicy::NONE,
+          "certificates/policies_ica_none_leaf_anypolicy.pem", AprilFirst2016(),
+          TRUST_STORE_FROM_TEST_FILE, "");
+}
+
+// Test verifying a certificate chain with the policies:
+//
+//   Root:           policies={}
+//   Intermediate:   policies={}
+//   Leaf:           policies={audioOnly}
+TEST(VerifyCastDeviceCertTest, PoliciesIcaNoneLeafAudioonly) {
+  RunTest(RESULT_SUCCESS, "Leaf", CastDeviceCertPolicy::AUDIO_ONLY,
+          "certificates/policies_ica_none_leaf_audioonly.pem", AprilFirst2016(),
+          TRUST_STORE_FROM_TEST_FILE, "");
+}
+
+// Test verifying a certificate chain with the policies:
+//
+//   Root:           policies={}
+//   Intermediate:   policies={}
+//   Leaf:           policies={foo}
+TEST(VerifyCastDeviceCertTest, PoliciesIcaNoneLeafFoo) {
+  RunTest(RESULT_SUCCESS, "Leaf", CastDeviceCertPolicy::NONE,
+          "certificates/policies_ica_none_leaf_foo.pem", AprilFirst2016(),
+          TRUST_STORE_FROM_TEST_FILE, "");
+}
+
+// Test verifying a certificate chain with the policies:
+//
+//   Root:           policies={}
+//   Intermediate:   policies={}
+//   Leaf:           policies={}
+TEST(VerifyCastDeviceCertTest, PoliciesIcaNoneLeafNone) {
+  RunTest(RESULT_SUCCESS, "Leaf", CastDeviceCertPolicy::NONE,
+          "certificates/policies_ica_none_leaf_none.pem", AprilFirst2016(),
+          TRUST_STORE_FROM_TEST_FILE, "");
+}
+
 // ------------------------------------------------------
 // Valid signature using 1024-bit RSA key
 // ------------------------------------------------------
 
 // This test vector comes from the NIST test vectors (pkcs1v15sign-vectors.txt),
 // PKCS#1 v1.5 Signature Example 1.2.
 //
 // It is a valid signature using a 1024 bit key and SHA-1.
 
 const uint8_t kEx1Message[] = {
@@ skipping 115 matching lines @@
   auto context =
       CertVerificationContextImplForTest(CreateString(kEx2PublicKeySpki));
 
   EXPECT_TRUE(context->VerifySignatureOverData(CreateString(kEx2Signature),
                                                CreateString(kEx2Message)));
 }
 
 }  // namespace
 
 }  // namespace cast_certificate