Add path validation error expectations for PKITS tests.

net/cert/internal/nist_pkits_unittest.h

Index: net/cert/internal/nist_pkits_unittest.h
diff --git a/net/cert/internal/nist_pkits_unittest.h b/net/cert/internal/nist_pkits_unittest.h
index 8f9ef42c166f7d1a633cffdfdfbc7423d6e8b480..4ff7f90ce594bd285ed74a1f04b1240b56dce657 100644
--- a/net/cert/internal/nist_pkits_unittest.h
+++ b/net/cert/internal/nist_pkits_unittest.h
@@ -18,6 +18,7 @@ namespace net {
 struct PkitsTestInfo {
   // Default construction results in the "default settings".
   PkitsTestInfo();
+  PkitsTestInfo(const PkitsTestInfo& other);
   ~PkitsTestInfo();
 
   // Sets |initial_policy_set| to the specified policies. The
@@ -38,6 +39,13 @@ struct PkitsTestInfo {
   void SetInitialPolicyMappingInhibit(bool b);
   void SetInitialInhibitAnyPolicy(bool b);
 
+  // ----------------
+  // Info
+  // ----------------
+
+  // The PKITS test number. For example, "4.1.1".
+  const char* test_number = nullptr;
+
   // ----------------
   // Inputs
   // ----------------
@@ -88,7 +96,41 @@ class PkitsTest : public ::testing::Test {
     for (const std::string& s : crl_names)
       crl_ders.push_back(net::ReadTestFileToString(
           "net/third_party/nist-pkits/crls/" + s + ".crl"));
-    PkitsTestDelegate::RunTest(cert_ders, crl_ders, info);
+
+    base::StringPiece test_number = info.test_number;
+
+    // Some of the PKITS tests are intentionally given different expectations
+    // from PKITS.pdf.
+    //
+    // Expected to fail because DSA signatures are not supported:
+    //
+    //   4.1.4 - Valid DSA Signatures Test4
+    //   4.1.5 - Valid DSA Parameter Inheritance Test5
+    //
+    // Expected to fail because Name constraints on rfc822Names are not
+    // supported:
+    //
+    //   4.13.21 - Valid RFC822 nameConstraints Test21
+    //   4.13.23 - Valid RFC822 nameConstraints Test23
+    //   4.13.25 - Valid RFC822 nameConstraints Test25
+    //   4.13.27 - Valid DN and RFC822 nameConstraints Test27
+    //
+    // Expected to fail because Name constraints on
+    // uniformResourceIdentifiers are not supported:
+    //
+    //   4.13.34 - Valid URI nameConstraints Test34
+    //   4.13.36 - Valid URI nameConstraints Test36
+    if (test_number == "4.1.4" || test_number == "4.1.4" ||
+        test_number == "4.1.5" || test_number == "4.13.21" ||
+        test_number == "4.13.23" || test_number == "4.13.25" ||
+        test_number == "4.13.27" || test_number == "4.13.34" ||
+        test_number == "4.13.36") {
+      PkitsTestInfo modified_info = info;
+      modified_info.should_validate = false;
+      PkitsTestDelegate::RunTest(cert_ders, crl_ders, modified_info);
+    } else {
+      PkitsTestDelegate::RunTest(cert_ders, crl_ders, info);
+    }
   }
 };