// Copyright 2022 The Chromium Authors
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

#include "chrome/common/net/x509_certificate_model.h"

#include <string_view>

#include "base/compiler_specific.h"
#include "base/strings/string_view_util.h"
#include "net/cert/qwac.h"
#include "net/cert/x509_util.h"
#include "net/test/cert_builder.h"
#include "net/test/cert_test_util.h"
#include "net/test/test_data_directory.h"
#include "testing/gtest/include/gtest/gtest.h"
#include "third_party/boringssl/src/pki/parse_certificate.h"

using x509_certificate_model::Error;
using x509_certificate_model::NotPresent;
using x509_certificate_model::OptionalStringOrError;

namespace {

std::optional<std::string> FindExtension(
    const std::vector<x509_certificate_model::Extension>& extensions,
    std::string_view name) {
  for (const auto& extension : extensions) {
    if (extension.name == name) {
      return extension.value;
    }
  }

  return std::nullopt;
}

}  // namespace

TEST(X509CertificateModel, InvalidCert) {
  x509_certificate_model::X509CertificateModel model(
      net::x509_util::CreateCryptoBuffer(
          base::span<const uint8_t>({'b', 'a', 'd', '\n'})));

  EXPECT_EQ("1d7a363ce12430881ec56c9cf1409c49c491043618e598c356e2959040872f5a",
            model.HashCertSHA256());
  EXPECT_EQ("1d7a363ce12430881ec56c9cf1409c49c491043618e598c356e2959040872f5a",
            model.GetTitle());
  EXPECT_FALSE(model.is_valid());
}

TEST(X509CertificateModel, GetGoogleCertFields) {
  auto cert = net::ImportCertFromFile(net::GetTestCertsDirectory(),
                                      "google.single.pem");
  ASSERT_TRUE(cert);
  x509_certificate_model::X509CertificateModel model(
      bssl::UpRef(cert->cert_buffer()));
  EXPECT_EQ("f641c36cfef49bc071359ecf88eed9317b738b5989416ad401720c0a4e2e6352",
            model.HashCertSHA256());
  ASSERT_TRUE(model.is_valid());

  EXPECT_EQ("23a55ce68ea1b20623de09e93fdf3bb03287ac737b27335b4307fe9ec4855c34",
            model.HashSpkiSHA256());
  EXPECT_EQ("3", model.GetVersion());
  EXPECT_EQ("2F:DF:BC:F6:AE:91:52:6D:0F:9A:A3:DF:40:34:3E:9A",
            model.GetSerialNumberHexified());

  EXPECT_EQ(OptionalStringOrError("Thawte SGC CA"),
            model.GetIssuerCommonName());
  EXPECT_EQ(OptionalStringOrError("Thawte Consulting (Pty) Ltd."),
            model.GetIssuerOrgName());
  EXPECT_EQ(OptionalStringOrError(NotPresent()), model.GetIssuerOrgUnitName());

  EXPECT_EQ(OptionalStringOrError("www.google.com"),
            model.GetSubjectCommonName());
  EXPECT_EQ(OptionalStringOrError("Google Inc"), model.GetSubjectOrgName());
  EXPECT_EQ(OptionalStringOrError(NotPresent()), model.GetSubjectOrgUnitName());

  EXPECT_EQ("www.google.com", model.GetTitle());

  EXPECT_EQ(
      OptionalStringOrError(
          "CN = Thawte SGC CA\nO = Thawte Consulting (Pty) Ltd.\nC = ZA\n"),
      model.GetIssuerName());
  EXPECT_EQ(OptionalStringOrError(
                "CN = www.google.com\nO = Google Inc\nL = Mountain View\nST = "
                "California\nC = US\n"),
            model.GetSubjectName());

  base::Time not_before, not_after;
  EXPECT_TRUE(model.GetTimes(&not_before, &not_after));
  // Constants copied from x509_certificate_unittest.cc.
  // Dec 18 00:00:00 2009 GMT
  const double kGoogleParseValidFrom = 1261094400;
  EXPECT_EQ(kGoogleParseValidFrom, not_before.InSecondsFSinceUnixEpoch());
  // Dec 18 23:59:59 2011 GMT
  const double kGoogleParseValidTo = 1324252799;
  EXPECT_EQ(kGoogleParseValidTo, not_after.InSecondsFSinceUnixEpoch());

  EXPECT_EQ("PKCS #1 SHA-1 With RSA Encryption",
            model.ProcessSecAlgorithmSignature());
  EXPECT_EQ("PKCS #1 SHA-1 With RSA Encryption",
            model.ProcessSecAlgorithmSignatureWrap());
  EXPECT_EQ("PKCS #1 RSA Encryption",
            model.ProcessSecAlgorithmSubjectPublicKey());
  EXPECT_EQ(
      "Modulus (1024 bits):\n"
      "  E8 F9 86 0F 90 FA 86 D7 DF BD 72 26 B6 D7 44 02\n"
      "83 78 73 D9 02 28 EF 88 45 39 FB 10 E8 7C AE A9\n"
      "38 D5 75 C6 38 EB 0A 15 07 9B 83 E8 CD 82 D5 E3\n"
      "F7 15 68 45 A1 0B 19 85 BC E2 EF 84 E7 DD F2 D7\n"
      "B8 98 C2 A1 BB B5 C1 51 DF D4 83 02 A7 3D 06 42\n"
      "5B E1 22 C3 DE 6B 85 5F 1C D6 DA 4E 8B D3 9B EE\n"
      "B9 67 22 2A 1D 11 EF 79 A4 B3 37 8A F4 FE 18 FD\n"
      "BC F9 46 23 50 97 F3 AC FC 24 46 2B 5C 3B B7 45\n"
      "\n"
      "  Public Exponent (17 bits):\n"
      "  01 00 01",
      model.ProcessSubjectPublicKeyInfo());
  EXPECT_EQ(
      "9F 43 CF 5B C4 50 29 B1 BF E2 B0 9A FF 6A 21 1D\n"
      "2D 12 C3 2C 4E 5A F9 12 E2 CE B9 82 52 2D E7 1D\n"
      "7E 1A 76 96 90 79 D1 24 52 38 79 BB 63 8D 80 97\n"
      "7C 23 20 0F 91 4D 16 B9 EA EE F4 6D 89 CA C6 BD\n"
      "CC 24 68 D6 43 5B CE 2A 58 BF 3C 18 E0 E0 3C 62\n"
      "CF 96 02 2D 28 47 50 34 E1 27 BA CF 99 D1 50 FF\n"
      "29 25 C0 36 36 15 33 52 70 BE 31 8F 9F E8 7F E7\n"
      "11 0C 8D BF 84 A0 42 1A 80 89 B0 31 58 41 07 5F",
      model.ProcessRawBitsSignatureWrap());

  auto extensions = model.GetExtensions("critical", "notcrit");
  ASSERT_EQ(4U, extensions.size());
  EXPECT_EQ("Certificate Basic Constraints", extensions[0].name);
  EXPECT_EQ("critical\nIs not a Certification Authority\n",
            extensions[0].value);
  EXPECT_EQ("CRL Distribution Points", extensions[1].name);
  EXPECT_EQ("notcrit\nURI: http://crl.thawte.com/ThawteSGCCA.crl\n",
            extensions[1].value);
  EXPECT_EQ("Extended Key Usage", extensions[2].name);
  EXPECT_EQ(
      "notcrit\nTLS WWW Server Authentication (OID.1.3.6.1.5.5.7.3.1)\nTLS WWW "
      "Client Authentication (OID.1.3.6.1.5.5.7.3.2)\nNetscape International "
      "Step-Up (OID.2.16.840.1.113730.4.1)\n",
      extensions[2].value);
  EXPECT_EQ("Authority Information Access", extensions[3].name);
  EXPECT_EQ(
      "notcrit\nOCSP Responder: URI: http://ocsp.thawte.com\nCA Issuers: URI: "
      "http://www.thawte.com/repository/Thawte_SGC_CA.crt\n",
      extensions[3].value);
}

TEST(X509CertificateModel, GetSCTField) {
  auto cert = net::ImportCertFromFile(net::GetTestCertsDirectory(),
                                      "lets-encrypt-dst-x3-root.pem");
  ASSERT_TRUE(cert);
  x509_certificate_model::X509CertificateModel model(
      bssl::UpRef(cert->cert_buffer()));
  ASSERT_TRUE(model.is_valid());

  EXPECT_EQ("3", model.GetVersion());
  EXPECT_EQ("04:7B:F4:FD:2C:FB:01:92:D5:30:C1:0F:C9:19:83:2A:49:EF",
            model.GetSerialNumberHexified());

  auto extensions = model.GetExtensions("critical", "notcrit");
  auto extension_value =
      FindExtension(extensions, "Signed Certificate Timestamp List");
  ASSERT_TRUE(extension_value);
  EXPECT_EQ(
      "notcrit\n"
      "04 81 F1 00 EF 00 76 00 41 C8 CA B1 DF 22 46 4A\n"
      "10 C6 A1 3A 09 42 87 5E 4E 31 8B 1B 03 EB EB 4B\n"
      "C7 68 F0 90 62 96 06 F6 00 00 01 7E 17 63 85 3D\n"
      "00 00 04 03 00 47 30 45 02 20 05 FB 47 45 BD 63\n"
      "AD FD E7 AF 9E 7E D6 51 5A 1E AB 62 FE 2A 27 4B\n"
      "A0 ED 8A 4A 8F B3 C8 36 8C BD 02 21 00 8B 07 10\n"
      "4C BF 07 1C ED 54 DF 28 2C E3 B2 32 6B 43 48 E4\n"
      "04 80 28 17 91 50 8D 28 FC 58 08 BF 7C 00 75 00\n"
      "46 A5 55 EB 75 FA 91 20 30 B5 A2 89 69 F4 F3 7D\n"
      "11 2C 41 74 BE FD 49 B8 85 AB F2 FC 70 FE 6D 47\n"
      "00 00 01 7E 17 63 85 53 00 00 04 03 00 46 30 44\n"
      "02 20 73 8C D6 ED CC 59 2D 3D 5E 1A 37 E9 42 A2\n"
      "74 6D 95 1B 20 0E 19 91 40 0E AD A3 80 66 48 FB\n"
      "17 32 02 20 02 3A 61 DA 61 EF CB 37 BB 97 5E AC\n"
      "79 08 2B 5E 71 EA 9B 7B FC B4 F5 50 04 2E E0 40\n"
      "42 44 2C 79",
      extension_value);
}

TEST(X509CertificateModel, GetNDNCertFields) {
  auto cert =
      net::ImportCertFromFile(net::GetTestCertsDirectory(), "ndn.ca.crt");
  ASSERT_TRUE(cert);
  x509_certificate_model::X509CertificateModel model(
      bssl::UpRef(cert->cert_buffer()));
  ASSERT_TRUE(model.is_valid());
  EXPECT_EQ("1", model.GetVersion());
  // The model just returns the hex of the DER bytes, so the leading zeros are
  // included.
  EXPECT_EQ("00:DB:B7:C6:06:47:AF:37:A2", model.GetSerialNumberHexified());

  EXPECT_EQ(OptionalStringOrError("New Dream Network Certificate Authority"),
            model.GetIssuerCommonName());
  EXPECT_EQ(OptionalStringOrError("New Dream Network, LLC"),
            model.GetIssuerOrgName());
  EXPECT_EQ(OptionalStringOrError("Security"), model.GetIssuerOrgUnitName());
  EXPECT_EQ(OptionalStringOrError("New Dream Network Certificate Authority"),
            model.GetSubjectCommonName());
  EXPECT_EQ(OptionalStringOrError("New Dream Network, LLC"),
            model.GetSubjectOrgName());
  EXPECT_EQ(OptionalStringOrError("Security"), model.GetSubjectOrgUnitName());

  EXPECT_EQ("New Dream Network Certificate Authority", model.GetTitle());

  EXPECT_EQ(OptionalStringOrError(
                "emailAddress = support@dreamhost.com\nCN = New Dream Network "
                "Certificate "
                "Authority\nOU = Security\nO = New Dream Network, LLC\nL = Los "
                "Angeles\nST = California\nC = US\n"),
            model.GetIssuerName());
  EXPECT_EQ(OptionalStringOrError(
                "emailAddress = support@dreamhost.com\nCN = New Dream Network "
                "Certificate "
                "Authority\nOU = Security\nO = New Dream Network, LLC\nL = Los "
                "Angeles\nST = California\nC = US\n"),
            model.GetSubjectName());

  base::Time not_before, not_after;
  EXPECT_TRUE(model.GetTimes(&not_before, &not_after));
  EXPECT_EQ(12800754778, not_before.ToDeltaSinceWindowsEpoch().InSeconds());
  EXPECT_EQ(13116114778, not_after.ToDeltaSinceWindowsEpoch().InSeconds());

  auto extensions = model.GetExtensions("critical", "notcrit");
  EXPECT_EQ(0U, extensions.size());
}

TEST(X509CertificateModel, PunyCodeCert) {
  auto cert =
      net::ImportCertFromFile(net::GetTestCertsDirectory(), "punycodetest.pem");
  ASSERT_TRUE(cert);
  x509_certificate_model::X509CertificateModel model(
      bssl::UpRef(cert->cert_buffer()));
  ASSERT_TRUE(model.is_valid());
  EXPECT_EQ("xn--wgv71a119e.com", model.GetTitle());
  EXPECT_EQ(OptionalStringOrError("xn--wgv71a119e.com"),
            model.GetIssuerCommonName());
  EXPECT_EQ(OptionalStringOrError("xn--wgv71a119e.com"),
            model.GetSubjectCommonName());
  EXPECT_EQ(OptionalStringOrError("CN = xn--wgv71a119e.com (日本語.com)\n"),
            model.GetIssuerName());
  EXPECT_EQ(OptionalStringOrError("CN = xn--wgv71a119e.com (日本語.com)\n"),
            model.GetSubjectName());
}

TEST(X509CertificateModel, SubjectAltNameSanityTest) {
  auto cert = net::ImportCertFromFile(net::GetTestCertsDirectory(),
                                      "subjectAltName_sanity_check.pem");
  ASSERT_TRUE(cert);
  x509_certificate_model::X509CertificateModel model(
      bssl::UpRef(cert->cert_buffer()));

  auto extensions = model.GetExtensions("critical", "notcrit");
  ASSERT_EQ(3U, extensions.size());
  EXPECT_EQ("Certificate Subject Alternative Name", extensions[1].name);
  EXPECT_EQ(
      "notcrit\n"
      "OID.1.2.3.4: 0C 09 69 67 6E 6F 72 65 20 6D 65\n"
      "Email Address: test@test.example\n"
      "DNS Name: test.example\n"
      "X.500 Name: CN = 127.0.0.3\n"
      "\n"
      "IP Address: 127.0.0.2\nIP Address: fe80::1\n",
      extensions[1].value);
}

TEST(X509CertificateModel, CertificatePoliciesSanityTest) {
  auto cert = net::ImportCertFromFile(net::GetTestCertsDirectory(),
                                      "policies_sanity_check.pem");
  ASSERT_TRUE(cert);
  x509_certificate_model::X509CertificateModel model(
      bssl::UpRef(cert->cert_buffer()));

  auto extensions = model.GetExtensions("critical", "notcrit");
  ASSERT_EQ(2U, extensions.size());
  EXPECT_EQ("Certificate Policies", extensions[0].name);
  EXPECT_EQ(
      "notcrit\nOID.1.2.3.4.5\nOID.1.3.5.8.12:\n"
      "  Certification Practice Statement Pointer:"
      "    http://cps.example.com/foo\n"
      "  User Notice:Organization Name - #1, #2, #3, #4\n"
      "    Explicit Text Here\n"
      "  User Notice:\n    Explicit Text Two\n"
      "  User Notice:Organization Name Two - #42\n",
      extensions[0].value);
}

TEST(X509CertificateModel, CertificatePoliciesInvalidUtf8UserNotice) {
  base::FilePath certs_dir = net::GetTestCertsDirectory();
  std::unique_ptr<net::CertBuilder> builder =
      net::CertBuilder::FromFile(certs_dir.AppendASCII("ok_cert.pem"), nullptr);
  ASSERT_TRUE(builder);

  // \xa1 is a UTF-8 continuation byte, but there is no leading byte before it,
  // which is invalid.
  //
  // SEQUENCE {
  //   SEQUENCE {
  //     OBJECT_IDENTIFIER { 1.2.3 }
  //     SEQUENCE {
  //       SEQUENCE {
  //         # unotice
  //         OBJECT_IDENTIFIER { 1.3.6.1.5.5.7.2.2 }
  //         SEQUENCE {
  //           # explicitText
  //           UTF8String { "Explicit \xa1 Text" }
  //         }
  //       }
  //     }
  //   }
  // }
  const uint8_t kExtension[] = {
      0x30, 0x27, 0x30, 0x25, 0x06, 0x02, 0x2a, 0x03, 0x30, 0x1f, 0x30,
      0x1d, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05, 0x07, 0x02, 0x02,
      0x30, 0x11, 0x0c, 0x0f, 0x45, 0x78, 0x70, 0x6c, 0x69, 0x63, 0x69,
      0x74, 0x20, 0xa1, 0x20, 0x54, 0x65, 0x78, 0x74};
  builder->SetExtension(
      bssl::der::Input(bssl::kCertificatePoliciesOid),
      std::string(kExtension, UNSAFE_TODO(kExtension + sizeof(kExtension))));

  x509_certificate_model::X509CertificateModel model(
      bssl::UpRef(builder->GetCertBuffer()));
  ASSERT_TRUE(model.is_valid());
  auto cert = net::ImportCertFromFile(net::GetTestCertsDirectory(),
                                      "policies_sanity_check.pem");
  ASSERT_TRUE(cert);
  auto extensions = model.GetExtensions("critical", "notcrit");
  auto extension_value = FindExtension(extensions, "Certificate Policies");
  ASSERT_TRUE(extension_value);
  EXPECT_EQ("notcrit\nError: Unable to decode extension", *extension_value);
}

TEST(X509CertificateModel, GlobalsignComCert) {
  auto cert = net::ImportCertFromFile(net::GetTestCertsDirectory(),
                                      "2029_globalsign_com_cert.pem");
  ASSERT_TRUE(cert.get());
  x509_certificate_model::X509CertificateModel model(
      bssl::UpRef(cert->cert_buffer()));
  ASSERT_TRUE(model.is_valid());

  auto extensions = model.GetExtensions("critical", "notcrit");
  ASSERT_EQ(9U, extensions.size());

  EXPECT_EQ("Certificate Subject Key ID", extensions[0].name);
  EXPECT_EQ(
      "notcrit\nKey ID: 59 BC D9 69 F7 B0 65 BB C8 34 C5 D2 C2 EF 17 78\nA6 "
      "47 1E 8B",
      extensions[0].value);

  EXPECT_EQ("Certification Authority Key ID", extensions[1].name);
  EXPECT_EQ(
      "notcrit\nKey ID: 8A FC 14 1B 3D A3 59 67 A5 3B E1 73 92 A6 62 91\n7F "
      "E4 78 30\n",
      extensions[1].value);

  EXPECT_EQ("Authority Information Access", extensions[2].name);
  EXPECT_EQ(
      "notcrit\nCA Issuers: "
      "URI: http://secure.globalsign.net/cacert/SHA256extendval1.crt\n",
      extensions[2].value);

  EXPECT_EQ("CRL Distribution Points", extensions[3].name);
  EXPECT_EQ("notcrit\nURI: http://crl.globalsign.net/SHA256ExtendVal1.crl\n",
            extensions[3].value);

  EXPECT_EQ("Certificate Basic Constraints", extensions[4].name);
  EXPECT_EQ("notcrit\nIs not a Certification Authority\n", extensions[4].value);

  EXPECT_EQ("Certificate Key Usage", extensions[5].name);
  EXPECT_EQ(
      "critical\nSigning\nNon-repudiation\nKey Encipherment\n"
      "Data Encipherment",
      extensions[5].value);

  EXPECT_EQ("Extended Key Usage", extensions[6].name);
  EXPECT_EQ(
      "notcrit\nTLS WWW Server Authentication (OID.1.3.6.1.5.5.7.3.1)\n"
      "TLS WWW Client Authentication (OID.1.3.6.1.5.5.7.3.2)\n",
      extensions[6].value);

  EXPECT_EQ("Certificate Policies", extensions[7].name);
  EXPECT_EQ(
      "notcrit\nOID.1.3.6.1.4.1.4146.1.1:\n"
      "  Certification Practice Statement Pointer:"
      "    http://www.globalsign.net/repository/\n",
      extensions[7].value);

  EXPECT_EQ("Netscape Certificate Type", extensions[8].name);
  EXPECT_EQ("notcrit\nSSL Client Certificate\nSSL Server Certificate",
            extensions[8].value);
}

TEST(X509CertificateModel, NSCertComment) {
  auto cert = net::ImportCertFromFile(net::GetTestCertsDirectory(),
                                      "foaf.me.chromium-test-cert.der");
  ASSERT_TRUE(cert.get());
  x509_certificate_model::X509CertificateModel model(
      bssl::UpRef(cert->cert_buffer()));
  ASSERT_TRUE(model.is_valid());

  auto extensions = model.GetExtensions("critical", "notcrit");
  ASSERT_EQ(5U, extensions.size());
  EXPECT_EQ("Netscape Certificate Comment", extensions[1].name);
  EXPECT_EQ("notcrit\nOpenSSL Generated Certificate", extensions[1].value);
}

TEST(X509CertificateModel, DiginotarCert) {
  auto cert = net::ImportCertFromFile(net::GetTestCertsDirectory(),
                                      "diginotar_public_ca_2025.pem");
  ASSERT_TRUE(cert.get());
  x509_certificate_model::X509CertificateModel model(
      bssl::UpRef(cert->cert_buffer()));
  ASSERT_TRUE(model.is_valid());

  auto extensions = model.GetExtensions("critical", "notcrit");
  ASSERT_EQ(7U, extensions.size());

  EXPECT_EQ("Authority Information Access", extensions[0].name);
  EXPECT_EQ(
      "notcrit\nOCSP Responder: "
      "URI: http://validation.diginotar.nl\n",
      extensions[0].value);

  EXPECT_EQ("Certificate Basic Constraints", extensions[2].name);
  EXPECT_EQ(
      "critical\nIs a Certification Authority\n"
      "Maximum number of intermediate CAs: 0",
      extensions[2].value);

  EXPECT_EQ("Certificate Policies", extensions[3].name);
  EXPECT_EQ(
      "notcrit\nOID.2.16.528.1.1001.1.1.1.1.5.2.6.4:\n"
      "  Certification Practice Statement Pointer:"
      "    http://www.diginotar.nl/cps\n"
      "  User Notice:\n"
      "    Conditions, as mentioned on our website (www.diginotar.nl), are "
      "applicable to all our products and services.\n",
      extensions[3].value);
}

TEST(X509CertificateModel, AuthorityKeyIdentifierAllFields) {
  auto cert = net::ImportCertFromFile(net::GetTestCertsDirectory(),
                                      "diginotar_cyber_ca.pem");
  ASSERT_TRUE(cert.get());
  x509_certificate_model::X509CertificateModel model(
      bssl::UpRef(cert->cert_buffer()));
  ASSERT_TRUE(model.is_valid());

  auto extensions = model.GetExtensions("critical", "notcrit");
  ASSERT_EQ(6U, extensions.size());
  EXPECT_EQ("Certification Authority Key ID", extensions[3].name);
  EXPECT_EQ(
      "notcrit\nKey ID: A6 0C 1D 9F 61 FF 07 17 B5 BF 38 46 DB 43 30 D5\n"
      "8E B0 52 06\nIssuer: X.500 Name: CN = GTE CyberTrust Global Root\n"
      "OU = GTE CyberTrust Solutions, Inc.\nO = GTE Corporation\nC = US\n\n\n"
      "Serial Number: 01 A5\n",
      extensions[3].value);
}

TEST(X509CertificateModel, CrlDpCrlIssuerAndRelativeName) {
  base::FilePath certs_dir = net::GetTestCertsDirectory();
  std::unique_ptr<net::CertBuilder> builder =
      net::CertBuilder::FromFile(certs_dir.AppendASCII("ok_cert.pem"), nullptr);
  ASSERT_TRUE(builder);

  // SEQUENCE {
  //   SEQUENCE {
  //     [0] {
  //       [1] {
  //         SEQUENCE {
  //           # commonName
  //           OBJECT_IDENTIFIER { 2.5.4.3 }
  //           PrintableString { "indirect CRL for indirectCRL CA3" }
  //         }
  //       }
  //     }
  //     [2] {
  //       [4] {
  //         SEQUENCE {
  //           SET {
  //             SEQUENCE {
  //               # organizationUnitName
  //               OBJECT_IDENTIFIER { 2.5.4.11 }
  //               PrintableString { "indirectCRL CA3 cRLIssuer" }
  //             }
  //           }
  //         }
  //       }
  //     }
  //   }
  // }
  const uint8_t kCrldp[] = {
      0x30, 0x59, 0x30, 0x57, 0xa0, 0x2b, 0xa1, 0x29, 0x30, 0x27, 0x06, 0x03,
      0x55, 0x04, 0x03, 0x13, 0x20, 0x69, 0x6e, 0x64, 0x69, 0x72, 0x65, 0x63,
      0x74, 0x20, 0x43, 0x52, 0x4c, 0x20, 0x66, 0x6f, 0x72, 0x20, 0x69, 0x6e,
      0x64, 0x69, 0x72, 0x65, 0x63, 0x74, 0x43, 0x52, 0x4c, 0x20, 0x43, 0x41,
      0x33, 0xa2, 0x28, 0xa4, 0x26, 0x30, 0x24, 0x31, 0x22, 0x30, 0x20, 0x06,
      0x03, 0x55, 0x04, 0x0b, 0x13, 0x19, 0x69, 0x6e, 0x64, 0x69, 0x72, 0x65,
      0x63, 0x74, 0x43, 0x52, 0x4c, 0x20, 0x43, 0x41, 0x33, 0x20, 0x63, 0x52,
      0x4c, 0x49, 0x73, 0x73, 0x75, 0x65, 0x72};

  builder->SetExtension(
      bssl::der::Input(bssl::kCrlDistributionPointsOid),
      std::string(kCrldp, UNSAFE_TODO(kCrldp + sizeof(kCrldp))));

  x509_certificate_model::X509CertificateModel model(
      bssl::UpRef(builder->GetCertBuffer()));
  ASSERT_TRUE(model.is_valid());

  auto extensions = model.GetExtensions("critical", "notcrit");

  auto extension_value = FindExtension(extensions, "CRL Distribution Points");
  ASSERT_TRUE(extension_value);
  EXPECT_EQ(
      "notcrit\nCN = indirect CRL for indirectCRL CA3\nIssuer: X.500 Name: OU "
      "= indirectCRL CA3 cRLIssuer\n\n",
      *extension_value);
}

TEST(X509CertificateModel, CrlDpReasons) {
  base::FilePath certs_dir = net::GetTestCertsDirectory();
  std::unique_ptr<net::CertBuilder> builder =
      net::CertBuilder::FromFile(certs_dir.AppendASCII("ok_cert.pem"), nullptr);
  ASSERT_TRUE(builder);

  // SEQUENCE {
  //   SEQUENCE {
  //     [0] {
  //       [0] {
  //         [4] {
  //           SEQUENCE {
  //             SET {
  //               SEQUENCE {
  //                 # commonName
  //                 OBJECT_IDENTIFIER { 2.5.4.3 }
  //                 PrintableString { "CRL1" }
  //               }
  //             }
  //           }
  //         }
  //       }
  //     }
  //     [1 PRIMITIVE] { `0560` }
  //   }
  //   SEQUENCE {
  //     [0] {
  //       [0] {
  //         [4] {
  //           SEQUENCE {
  //             SET {
  //               SEQUENCE {
  //                 # commonName
  //                 OBJECT_IDENTIFIER { 2.5.4.3 }
  //                 PrintableString { "CRL2" }
  //               }
  //             }
  //           }
  //         }
  //       }
  //     }
  //     [1 PRIMITIVE] { `079f80` }
  //   }
  // }
  const uint8_t kCrldp[] = {
      0x30, 0x3b, 0x30, 0x1b, 0xa0, 0x15, 0xa0, 0x13, 0xa4, 0x11, 0x30,
      0x0f, 0x31, 0x0d, 0x30, 0x0b, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13,
      0x04, 0x43, 0x52, 0x4c, 0x31, 0x81, 0x02, 0x05, 0x60, 0x30, 0x1c,
      0xa0, 0x15, 0xa0, 0x13, 0xa4, 0x11, 0x30, 0x0f, 0x31, 0x0d, 0x30,
      0x0b, 0x06, 0x03, 0x55, 0x04, 0x03, 0x13, 0x04, 0x43, 0x52, 0x4c,
      0x32, 0x81, 0x03, 0x07, 0x9f, 0x80};

  builder->SetExtension(
      bssl::der::Input(bssl::kCrlDistributionPointsOid),
      std::string(kCrldp, UNSAFE_TODO(kCrldp + sizeof(kCrldp))));

  x509_certificate_model::X509CertificateModel model(
      bssl::UpRef(builder->GetCertBuffer()));
  ASSERT_TRUE(model.is_valid());

  auto extensions = model.GetExtensions("critical", "notcrit");

  auto extension_value = FindExtension(extensions, "CRL Distribution Points");
  ASSERT_TRUE(extension_value);

  EXPECT_EQ(
      "notcrit\nX.500 Name: CN = CRL1\n\nKey Compromise,CA Compromise\nX.500 "
      "Name: CN = CRL2\n\nUnused,Affiliation Changed,Superseded,Cessation of "
      "Operation,Certificate on Hold\n",
      *extension_value);
}

TEST(X509CertificateModel, AuthorityInfoAccessNonstandardOidAndLocationType) {
  base::FilePath certs_dir = net::GetTestCertsDirectory();
  std::unique_ptr<net::CertBuilder> builder =
      net::CertBuilder::FromFile(certs_dir.AppendASCII("ok_cert.pem"), nullptr);
  ASSERT_TRUE(builder);

  // SEQUENCE {
  //  SEQUENCE {
  //    OBJECT_IDENTIFIER { 1.4.9.20 }
  //    [1 PRIMITIVE] { "foo@example.com" }
  //  }
  // }
  const uint8_t kAIA[] = {0x30, 0x18, 0x30, 0x16, 0x06, 0x03, 0x2c, 0x09, 0x14,
                          0x81, 0x0f, 0x66, 0x6f, 0x6f, 0x40, 0x65, 0x78, 0x61,
                          0x6d, 0x70, 0x6c, 0x65, 0x2e, 0x63, 0x6f, 0x6d};
  builder->SetExtension(bssl::der::Input(bssl::kAuthorityInfoAccessOid),
                        std::string(kAIA, UNSAFE_TODO(kAIA + sizeof(kAIA))));

  x509_certificate_model::X509CertificateModel model(
      bssl::UpRef(builder->GetCertBuffer()));
  ASSERT_TRUE(model.is_valid());

  auto extensions = model.GetExtensions("critical", "notcrit");

  auto extension_value =
      FindExtension(extensions, "Authority Information Access");
  ASSERT_TRUE(extension_value);
  EXPECT_EQ("notcrit\nOID.1.4.9.20: Email Address: foo@example.com\n",
            *extension_value);
}

TEST(X509CertificateModel, SubjectIA5StringInvalidCharacters) {
  base::FilePath certs_dir = net::GetTestCertsDirectory();
  std::unique_ptr<net::CertBuilder> builder =
      net::CertBuilder::FromFile(certs_dir.AppendASCII("ok_cert.pem"), nullptr);
  ASSERT_TRUE(builder);

  // SEQUENCE {
  //   SET {
  //     SEQUENCE {
  //       # commonName
  //       OBJECT_IDENTIFIER { 2.5.4.3 }
  //       # Not a valid IA5String:
  //       IA5String { "a \xf6 b" }
  //     }
  //   }
  // }
  const uint8_t kSubject[] = {0x30, 0x10, 0x31, 0x0e, 0x30, 0x0c,
                              0x06, 0x03, 0x55, 0x04, 0x03, 0x16,
                              0x05, 0x61, 0x20, 0xf6, 0x20, 0x62};
  builder->SetSubjectTLV(kSubject);

  x509_certificate_model::X509CertificateModel model(
      bssl::UpRef(builder->GetCertBuffer()));
  ASSERT_TRUE(model.is_valid());
  EXPECT_EQ(model.HashCertSHA256(), model.GetTitle());
  EXPECT_EQ(OptionalStringOrError(Error()), model.GetSubjectCommonName());
  EXPECT_EQ(OptionalStringOrError(NotPresent()), model.GetSubjectOrgName());
  EXPECT_EQ(OptionalStringOrError(NotPresent()), model.GetSubjectOrgUnitName());
  EXPECT_EQ(OptionalStringOrError(Error()), model.GetSubjectName());
}

TEST(X509CertificateModel, SubjectInvalid) {
  base::FilePath certs_dir = net::GetTestCertsDirectory();
  std::unique_ptr<net::CertBuilder> builder =
      net::CertBuilder::FromFile(certs_dir.AppendASCII("ok_cert.pem"), nullptr);
  ASSERT_TRUE(builder);

  // SEQUENCE { SET { } }
  const uint8_t kSubject[] = {0x30, 0x02, 0x31, 0x00};
  builder->SetSubjectTLV(kSubject);

  x509_certificate_model::X509CertificateModel model(
      bssl::UpRef(builder->GetCertBuffer()));
  EXPECT_FALSE(model.is_valid());
}

TEST(X509CertificateModel, SubjectEmptySequence) {
  base::FilePath certs_dir = net::GetTestCertsDirectory();
  std::unique_ptr<net::CertBuilder> builder =
      net::CertBuilder::FromFile(certs_dir.AppendASCII("ok_cert.pem"), nullptr);
  ASSERT_TRUE(builder);

  // SEQUENCE { }
  const uint8_t kSubject[] = {0x30, 0x00};
  builder->SetSubjectTLV(kSubject);

  {
    x509_certificate_model::X509CertificateModel model(
        bssl::UpRef(builder->GetCertBuffer()));
    ASSERT_TRUE(model.is_valid());
    EXPECT_EQ(model.HashCertSHA256(), model.GetTitle());
    EXPECT_EQ(OptionalStringOrError(NotPresent()),
              model.GetSubjectCommonName());
    EXPECT_EQ(OptionalStringOrError(NotPresent()), model.GetSubjectOrgName());
    EXPECT_EQ(OptionalStringOrError(NotPresent()),
              model.GetSubjectOrgUnitName());
    EXPECT_EQ(OptionalStringOrError(NotPresent()), model.GetSubjectName());
  }
  {
    // If subject is empty but subjectAltNames is present, GetTitle checks
    // there.
    builder->SetSubjectAltNames({"foo.com", "bar.com"}, {});
    x509_certificate_model::X509CertificateModel model(
        bssl::UpRef(builder->GetCertBuffer()));
    ASSERT_TRUE(model.is_valid());
    EXPECT_EQ("foo.com", model.GetTitle());
  }
}

TEST(X509CertificateModel, QcStatements) {
  base::FilePath certs_dir = net::GetTestCertsDirectory();
  std::unique_ptr<net::CertBuilder> builder =
      net::CertBuilder::FromFile(certs_dir.AppendASCII("ok_cert.pem"), nullptr);
  ASSERT_TRUE(builder);

  // SEQUENCE {
  //   SEQUENCE {
  //     OBJECT_IDENTIFIER { 1.3.6.1.5.5.7.11.2 }
  //     SEQUENCE {
  //       OBJECT_IDENTIFIER { 0.4.0.194121.1.2 }
  //     }
  //   }
  //   SEQUENCE {
  //     OBJECT_IDENTIFIER { 0.4.0.1862.1.1 }
  //   }
  //   SEQUENCE {
  //     OBJECT_IDENTIFIER { 0.4.0.1862.1.6 }
  //     SEQUENCE {
  //       OBJECT_IDENTIFIER { 0.4.0.1862.1.6.3 }
  //       OBJECT_IDENTIFIER { 0.4.0.1862.1.6.2 }
  //     }
  //   }
  // }
  constexpr uint8_t kQcStatementsValue[] = {
      0x30, 0x3f, 0x30, 0x15, 0x06, 0x08, 0x2b, 0x06, 0x01, 0x05, 0x05,
      0x07, 0x0b, 0x02, 0x30, 0x09, 0x06, 0x07, 0x04, 0x00, 0x8b, 0xec,
      0x49, 0x01, 0x02, 0x30, 0x08, 0x06, 0x06, 0x04, 0x00, 0x8e, 0x46,
      0x01, 0x01, 0x30, 0x1c, 0x06, 0x06, 0x04, 0x00, 0x8e, 0x46, 0x01,
      0x06, 0x30, 0x12, 0x06, 0x07, 0x04, 0x00, 0x8e, 0x46, 0x01, 0x06,
      0x03, 0x06, 0x07, 0x04, 0x00, 0x8e, 0x46, 0x01, 0x06, 0x02};
  builder->SetExtension(bssl::der::Input(net::kQcStatementsOid),
                        std::string(base::as_string_view(kQcStatementsValue)));

  x509_certificate_model::X509CertificateModel model(
      bssl::UpRef(builder->GetCertBuffer()));
  ASSERT_TRUE(model.is_valid());
  auto extensions = model.GetExtensions("critical", "notcrit");
  auto extension_value =
      FindExtension(extensions, "Qualified Certificate Statements");
  ASSERT_TRUE(extension_value);
  EXPECT_EQ(
      "notcrit\n"
      "OID.1.3.6.1.5.5.7.11.2 = 30 09 06 07 04 00 8B EC 49 01 02\n"
      "ETSI QcCompliance\n"
      "ETSI QcType = ETSI qct-web, OID.0.4.0.1862.1.6.2\n",
      *extension_value);
}

TEST(X509CertificateModel, ProcessRawSubjectPublicKeyInfo) {
  // SEQUENCE {
  //   SEQUENCE {
  //     # rsaEncryption
  //     OBJECT_IDENTIFIER { 1.2.840.113549.1.1.1 }
  //     NULL {}
  //   }
  //   BIT_STRING {
  //     `00`
  //     SEQUENCE {
  //       INTEGER {
  //       `00e053f4f398c1143302c8a46dfeaa2af7943da66f00df3bde4c9fa3ea07d4ac`
  //       `e55b0dd1ace0edf9c5981d352de5b349971485440fdc4cd267088801a5d8a7eb`
  //       `93d16aa1f751e7847e522a7dbc6f0ed8dbb6a63ededcf5a4689644118502ed47`
  //       `12dfb86071957b6287687a445609d5b4c8f1f6c946928b68e883d5d5867123c3`
  //       `801ebf6c01c7d2a4bc406de0e3c02e3078bdaddd2566d3f5070756d7cee272c5`
  //       `257d0ce1a76f00a8daab4b54430964a4b652382fb7cc01dd1c03270347bfdfe6`
  //       `37b0ed18dc510bd47522df507b3ceb37391c9b6f087ba705ac8c43f7f1da5106`
  //       `b382453ec881739eb0a5cf7696af812cac012a4a584b1dbeff1f85c227def178`
  //       `0b`
  //       } INTEGER { 65537 }
  //     }
  //   }
  // }
  const uint8_t spki_bytes[] = {
      0x30, 0x82, 0x01, 0x22, 0x30, 0x0d, 0x06, 0x09, 0x2a, 0x86, 0x48, 0x86,
      0xf7, 0x0d, 0x01, 0x01, 0x01, 0x05, 0x00, 0x03, 0x82, 0x01, 0x0f, 0x00,
      0x30, 0x82, 0x01, 0x0a, 0x02, 0x82, 0x01, 0x01, 0x00, 0xe0, 0x53, 0xf4,
      0xf3, 0x98, 0xc1, 0x14, 0x33, 0x02, 0xc8, 0xa4, 0x6d, 0xfe, 0xaa, 0x2a,
      0xf7, 0x94, 0x3d, 0xa6, 0x6f, 0x00, 0xdf, 0x3b, 0xde, 0x4c, 0x9f, 0xa3,
      0xea, 0x07, 0xd4, 0xac, 0xe5, 0x5b, 0x0d, 0xd1, 0xac, 0xe0, 0xed, 0xf9,
      0xc5, 0x98, 0x1d, 0x35, 0x2d, 0xe5, 0xb3, 0x49, 0x97, 0x14, 0x85, 0x44,
      0x0f, 0xdc, 0x4c, 0xd2, 0x67, 0x08, 0x88, 0x01, 0xa5, 0xd8, 0xa7, 0xeb,
      0x93, 0xd1, 0x6a, 0xa1, 0xf7, 0x51, 0xe7, 0x84, 0x7e, 0x52, 0x2a, 0x7d,
      0xbc, 0x6f, 0x0e, 0xd8, 0xdb, 0xb6, 0xa6, 0x3e, 0xde, 0xdc, 0xf5, 0xa4,
      0x68, 0x96, 0x44, 0x11, 0x85, 0x02, 0xed, 0x47, 0x12, 0xdf, 0xb8, 0x60,
      0x71, 0x95, 0x7b, 0x62, 0x87, 0x68, 0x7a, 0x44, 0x56, 0x09, 0xd5, 0xb4,
      0xc8, 0xf1, 0xf6, 0xc9, 0x46, 0x92, 0x8b, 0x68, 0xe8, 0x83, 0xd5, 0xd5,
      0x86, 0x71, 0x23, 0xc3, 0x80, 0x1e, 0xbf, 0x6c, 0x01, 0xc7, 0xd2, 0xa4,
      0xbc, 0x40, 0x6d, 0xe0, 0xe3, 0xc0, 0x2e, 0x30, 0x78, 0xbd, 0xad, 0xdd,
      0x25, 0x66, 0xd3, 0xf5, 0x07, 0x07, 0x56, 0xd7, 0xce, 0xe2, 0x72, 0xc5,
      0x25, 0x7d, 0x0c, 0xe1, 0xa7, 0x6f, 0x00, 0xa8, 0xda, 0xab, 0x4b, 0x54,
      0x43, 0x09, 0x64, 0xa4, 0xb6, 0x52, 0x38, 0x2f, 0xb7, 0xcc, 0x01, 0xdd,
      0x1c, 0x03, 0x27, 0x03, 0x47, 0xbf, 0xdf, 0xe6, 0x37, 0xb0, 0xed, 0x18,
      0xdc, 0x51, 0x0b, 0xd4, 0x75, 0x22, 0xdf, 0x50, 0x7b, 0x3c, 0xeb, 0x37,
      0x39, 0x1c, 0x9b, 0x6f, 0x08, 0x7b, 0xa7, 0x05, 0xac, 0x8c, 0x43, 0xf7,
      0xf1, 0xda, 0x51, 0x06, 0xb3, 0x82, 0x45, 0x3e, 0xc8, 0x81, 0x73, 0x9e,
      0xb0, 0xa5, 0xcf, 0x76, 0x96, 0xaf, 0x81, 0x2c, 0xac, 0x01, 0x2a, 0x4a,
      0x58, 0x4b, 0x1d, 0xbe, 0xff, 0x1f, 0x85, 0xc2, 0x27, 0xde, 0xf1, 0x78,
      0x0b, 0x02, 0x03, 0x01, 0x00, 0x01};
  EXPECT_EQ(
      "Modulus (2048 bits):\n"
      "  E0 53 F4 F3 98 C1 14 33 02 C8 A4 6D FE AA 2A F7\n"
      "94 3D A6 6F 00 DF 3B DE 4C 9F A3 EA 07 D4 AC E5\n"
      "5B 0D D1 AC E0 ED F9 C5 98 1D 35 2D E5 B3 49 97\n"
      "14 85 44 0F DC 4C D2 67 08 88 01 A5 D8 A7 EB 93\n"
      "D1 6A A1 F7 51 E7 84 7E 52 2A 7D BC 6F 0E D8 DB\n"
      "B6 A6 3E DE DC F5 A4 68 96 44 11 85 02 ED 47 12\n"
      "DF B8 60 71 95 7B 62 87 68 7A 44 56 09 D5 B4 C8\n"
      "F1 F6 C9 46 92 8B 68 E8 83 D5 D5 86 71 23 C3 80\n"
      "1E BF 6C 01 C7 D2 A4 BC 40 6D E0 E3 C0 2E 30 78\n"
      "BD AD DD 25 66 D3 F5 07 07 56 D7 CE E2 72 C5 25\n"
      "7D 0C E1 A7 6F 00 A8 DA AB 4B 54 43 09 64 A4 B6\n"
      "52 38 2F B7 CC 01 DD 1C 03 27 03 47 BF DF E6 37\n"
      "B0 ED 18 DC 51 0B D4 75 22 DF 50 7B 3C EB 37 39\n"
      "1C 9B 6F 08 7B A7 05 AC 8C 43 F7 F1 DA 51 06 B3\n"
      "82 45 3E C8 81 73 9E B0 A5 CF 76 96 AF 81 2C AC\n"
      "01 2A 4A 58 4B 1D BE FF 1F 85 C2 27 DE F1 78 0B\n"
      "\n"
      "  Public Exponent (17 bits):\n"
      "  01 00 01",
      x509_certificate_model::ProcessRawSubjectPublicKeyInfo(spki_bytes));
}