// Copyright 2021 The Chromium Authors
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.

#include "net/cert/internal/trust_store_chrome.h"

#include "base/containers/span.h"
#include "base/strings/string_number_conversions.h"
#include "base/strings/string_util.h"
#include "crypto/sha2.h"
#include "net/cert/root_store_proto_lite/root_store.pb.h"
#include "net/cert/x509_certificate.h"
#include "net/cert/x509_util.h"
#include "net/test/cert_builder.h"
#include "net/test/cert_test_util.h"
#include "net/test/test_data_directory.h"
#include "testing/gmock/include/gmock/gmock.h"
#include "testing/gtest/include/gtest/gtest.h"
#include "third_party/boringssl/src/pki/cert_errors.h"
#include "third_party/boringssl/src/pki/parsed_certificate.h"

namespace net {
namespace {

#include "net/data/ssl/chrome_root_store/chrome-root-store-test-data-inc.cc"

std::shared_ptr<const bssl::ParsedCertificate> ToParsedCertificate(
    const X509Certificate& cert) {
  bssl::CertErrors errors;
  std::shared_ptr<const bssl::ParsedCertificate> parsed =
      bssl::ParsedCertificate::Create(
          bssl::UpRef(cert.cert_buffer()),
          x509_util::DefaultParseCertificateOptions(), &errors);
  EXPECT_TRUE(parsed) << errors.ToDebugString();
  return parsed;
}

scoped_refptr<X509Certificate> MakeTestRoot() {
  auto builder = std::make_unique<CertBuilder>(nullptr, nullptr);
  auto now = base::Time::Now();
  builder->SetValidity(now - base::Days(1), now + base::Days(1));
  builder->SetBasicConstraints(/*is_ca=*/true, /*path_len=*/-1);
  builder->SetKeyUsages(
      {bssl::KEY_USAGE_BIT_KEY_CERT_SIGN, bssl::KEY_USAGE_BIT_CRL_SIGN});
  return builder->GetX509Certificate();
}

std::shared_ptr<const bssl::ParsedCertificate>
FindParsedCertificateInCertificateList(const std::string& hash,
                                       CertificateList certs) {
  for (const auto& cert : certs) {
    std::shared_ptr<const bssl::ParsedCertificate> parsed =
        ToParsedCertificate(*cert);
    std::string sha256_hex = base::ToLowerASCII(
        base::HexEncode(crypto::SHA256Hash(parsed->der_cert())));
    if (sha256_hex == hash) {
      return parsed;
    }
  }
  return nullptr;
}

TEST(TrustStoreChromeTestNoFixture, ContainsCert) {
  std::unique_ptr<TrustStoreChrome> trust_store_chrome =
      TrustStoreChrome::CreateTrustStoreForTesting(
          base::span<const ChromeRootCertInfo>(kChromeRootCertList),
          base::span(kEutlRootCertList),
          /*version=*/1);

  // Check every certificate in test_store.certs is included.
  CertificateList certs = CreateCertificateListFromFile(
      GetTestNetDataDirectory().AppendASCII("ssl/chrome_root_store"),
      "test_store.certs", X509Certificate::FORMAT_PEM_CERT_SEQUENCE);
  ASSERT_EQ(certs.size(), 6u);

  size_t eutl_certs = 0;
  for (const auto& cert : certs) {
    std::shared_ptr<const bssl::ParsedCertificate> parsed =
        ToParsedCertificate(*cert);
    ASSERT_TRUE(trust_store_chrome->Contains(parsed.get()));
    bssl::CertificateTrust trust = trust_store_chrome->GetTrust(parsed.get());
    EXPECT_TRUE(trust.IsTrustAnchor());
    // Count how many certs are on the EUTL.
    bssl::CertificateTrust eutl_trust =
        trust_store_chrome->eutl_trust_store()->GetTrust(parsed.get());
    if (eutl_trust.type == bssl::CertificateTrustType::TRUSTED_ANCHOR) {
      eutl_certs++;
    }
  }
  // There should be one cert from test_store.certs on the EUTL.
  EXPECT_EQ(eutl_certs, 1);

  // Other certificates should not be included. Which test cert used here isn't
  // important as long as it isn't one of the certificates in the
  // chrome_root_store/test_store.certs.
  scoped_refptr<X509Certificate> other_cert =
      ImportCertFromFile(GetTestCertsDirectory(), "root_ca_cert.pem");
  ASSERT_TRUE(other_cert);
  std::shared_ptr<const bssl::ParsedCertificate> other_parsed =
      ToParsedCertificate(*other_cert);
  ASSERT_FALSE(trust_store_chrome->Contains(other_parsed.get()));
  bssl::CertificateTrust trust =
      trust_store_chrome->GetTrust(other_parsed.get());
  EXPECT_EQ(bssl::CertificateTrust::ForUnspecified().ToDebugString(),
            trust.ToDebugString());
}

TEST(TrustStoreChromeTestNoFixture, ContainsEutlCert) {
  std::unique_ptr<TrustStoreChrome> trust_store_chrome =
      TrustStoreChrome::CreateTrustStoreForTesting(
          base::span<const ChromeRootCertInfo>(kChromeRootCertList),
          base::span(kEutlRootCertList),
          /*version=*/1);

  const std::string kEUTLCertHash =
      "f7c7e28fb5e79f314aaac6bbba932f15e1a72069f435d4c9e707f93ca1482ee3";

  // Check that the EUTL certificate in test_additional.certs is included in
  // the EUTL trust store, but not trusted for TLS connection establishment.
  CertificateList certs = CreateCertificateListFromFile(
      GetTestNetDataDirectory().AppendASCII("ssl/chrome_root_store"),
      "test_additional.certs", X509Certificate::FORMAT_PEM_CERT_SEQUENCE);
  std::shared_ptr<const bssl::ParsedCertificate> parsed =
      FindParsedCertificateInCertificateList(kEUTLCertHash, certs);
  ASSERT_TRUE(parsed);

  bssl::CertificateTrust eutl_trust =
      trust_store_chrome->eutl_trust_store()->GetTrust(parsed.get());
  EXPECT_EQ(bssl::CertificateTrust::ForTrustAnchor().ToDebugString(),
            eutl_trust.ToDebugString());

  EXPECT_FALSE(trust_store_chrome->Contains(parsed.get()));
  bssl::CertificateTrust trust = trust_store_chrome->GetTrust(parsed.get());
  EXPECT_EQ(bssl::CertificateTrust::ForUnspecified().ToDebugString(),
            trust.ToDebugString());

  // Other certificates should not be included. Which test cert used here isn't
  // important as long as it isn't one of the certificates in the
  // chrome_root_store/test_store.certs.
  scoped_refptr<X509Certificate> other_cert =
      ImportCertFromFile(GetTestCertsDirectory(), "root_ca_cert.pem");
  ASSERT_TRUE(other_cert);
  std::shared_ptr<const bssl::ParsedCertificate> other_parsed =
      ToParsedCertificate(*other_cert);
  eutl_trust =
      trust_store_chrome->eutl_trust_store()->GetTrust(other_parsed.get());
  EXPECT_EQ(bssl::CertificateTrust::ForUnspecified().ToDebugString(),
            eutl_trust.ToDebugString());
}

TEST(TrustStoreChromeTestNoFixture, Constraints) {
  std::unique_ptr<TrustStoreChrome> trust_store_chrome =
      TrustStoreChrome::CreateTrustStoreForTesting(
          base::span<const ChromeRootCertInfo>(kChromeRootCertList),
          base::span(kEutlRootCertList),
          /*version=*/1);

  const std::string kUnconstrainedCertHash =
      "568d6905a2c88708a4b3025190edcfedb1974a606a13c6e5290fcb2ae63edab5";
  const std::string kConstrainedCertHash =
      "6b9c08e86eb0f767cfad65cd98b62149e5494a67f5845e7bd1ed019f27b86bd6";

  std::shared_ptr<const bssl::ParsedCertificate> constrained_cert;
  std::shared_ptr<const bssl::ParsedCertificate> unconstrained_cert;

  CertificateList certs = CreateCertificateListFromFile(
      GetTestNetDataDirectory().AppendASCII("ssl/chrome_root_store"),
      "test_store.certs", X509Certificate::FORMAT_PEM_CERT_SEQUENCE);
  for (const auto& cert : certs) {
    std::shared_ptr<const bssl::ParsedCertificate> parsed =
        ToParsedCertificate(*cert);
    std::string sha256_hex = base::ToLowerASCII(
        base::HexEncode(crypto::SHA256Hash(parsed->der_cert())));
    if (sha256_hex == kConstrainedCertHash) {
      constrained_cert = parsed;
    } else if (sha256_hex == kUnconstrainedCertHash) {
      unconstrained_cert = parsed;
    }
  }

  ASSERT_TRUE(unconstrained_cert);
  EXPECT_TRUE(
      trust_store_chrome->GetConstraintsForCert(unconstrained_cert.get())
          .empty());

  ASSERT_TRUE(constrained_cert);
  base::span<const ChromeRootCertConstraints> constraints =
      trust_store_chrome->GetConstraintsForCert(constrained_cert.get());
  ASSERT_EQ(constraints.size(), 3U);

  EXPECT_FALSE(constraints[0].sct_all_after.has_value());
  ASSERT_TRUE(constraints[0].sct_not_after.has_value());
  EXPECT_EQ(
      constraints[0].sct_not_after.value().InMillisecondsSinceUnixEpoch() /
          1000,
      0x5af);
  EXPECT_FALSE(constraints[0].min_version.has_value());
  ASSERT_TRUE(constraints[0].max_version_exclusive.has_value());
  EXPECT_EQ(constraints[0].max_version_exclusive.value().components(),
            std::vector<uint32_t>({125, 0, 6368, 2}));
  EXPECT_THAT(constraints[0].permitted_dns_names,
              testing::ElementsAre("foo.example.com", "bar.example.com"));

  EXPECT_FALSE(constraints[1].sct_not_after.has_value());
  ASSERT_TRUE(constraints[1].sct_all_after.has_value());
  EXPECT_EQ(
      constraints[1].sct_all_after.value().InMillisecondsSinceUnixEpoch() /
          1000,
      0x2579);
  ASSERT_TRUE(constraints[1].min_version.has_value());
  EXPECT_FALSE(constraints[1].max_version_exclusive.has_value());
  EXPECT_EQ(constraints[1].min_version.value().components(),
            std::vector<uint32_t>({128}));
  EXPECT_TRUE(constraints[1].permitted_dns_names.empty());

  EXPECT_THAT(constraints[2].permitted_dns_names,
              testing::ElementsAre("baz.example.com"));

  // Other certificates should return nullptr if they are queried for CRS
  // constraints. Which test cert used here isn't important as long as it isn't
  // one of the certificates in the chrome_root_store/test_store.certs.
  scoped_refptr<X509Certificate> other_cert =
      ImportCertFromFile(GetTestCertsDirectory(), "root_ca_cert.pem");
  ASSERT_TRUE(other_cert);
  std::shared_ptr<const bssl::ParsedCertificate> other_parsed =
      ToParsedCertificate(*other_cert);
  ASSERT_TRUE(other_parsed);
  EXPECT_FALSE(trust_store_chrome->Contains(other_parsed.get()));
  EXPECT_TRUE(
      trust_store_chrome->GetConstraintsForCert(other_parsed.get()).empty());
}

TEST(TrustStoreChromeTestNoFixture, EnforceAnchorExpiryAndConstraints) {
  std::unique_ptr<TrustStoreChrome> trust_store_chrome =
      TrustStoreChrome::CreateTrustStoreForTesting(
          base::span<const ChromeRootCertInfo>(kChromeRootCertList),
          base::span(kEutlRootCertList),
          /*version=*/1);

  std::map<std::string /* SHA-256 hash of certificate */,
           bssl::CertificateTrust>
      tests = {
          {"568d6905a2c88708a4b3025190edcfedb1974a606a13c6e5290fcb2ae63edab5",
           bssl::CertificateTrust::ForTrustAnchor()},
          {"d92e93252eabca950870b94331990963a2dd5db96d833c82b08e41afd1719178",
           bssl::CertificateTrust::ForTrustAnchor().WithEnforceAnchorExpiry()},
          {"68b9c761219a5b1f0131784474665db61bbdb109e00f05ca9f74244ee5f5f52b",
           bssl::CertificateTrust::ForTrustAnchor()
               .WithEnforceAnchorConstraints()},
          {"687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff2",
           bssl::CertificateTrust::ForTrustAnchor()
               .WithEnforceAnchorExpiry()
               .WithEnforceAnchorConstraints()},
      };

  CertificateList certs = CreateCertificateListFromFile(
      GetTestNetDataDirectory().AppendASCII("ssl/chrome_root_store"),
      "test_store.certs", X509Certificate::FORMAT_PEM_CERT_SEQUENCE);

  for (const auto& test : tests) {
    std::shared_ptr<const bssl::ParsedCertificate> cert =
        FindParsedCertificateInCertificateList(test.first, certs);
    bssl::CertificateTrust trust = trust_store_chrome->GetTrust(cert.get());
    EXPECT_TRUE(trust.IsTrustAnchor());
    EXPECT_EQ(trust.enforce_anchor_expiry, test.second.enforce_anchor_expiry);
    EXPECT_EQ(trust.enforce_anchor_constraints,
              test.second.enforce_anchor_constraints);
  }
}

TEST(TrustStoreChromeTestNoFixture,
     EnforceAnchorExpiryAndConstraintsFromProto) {
  for (bool enforce_anchor_expiry : {false, true}) {
    for (bool enforce_anchor_constraints : {false, true}) {
      scoped_refptr<X509Certificate> root = MakeTestRoot();
      chrome_root_store::RootStore root_store;
      chrome_root_store::TrustAnchor* anchor = root_store.add_trust_anchors();
      anchor->set_der(
          net::x509_util::CryptoBufferAsStringPiece(root->cert_buffer()));
      anchor->set_enforce_anchor_expiry(enforce_anchor_expiry);
      anchor->set_enforce_anchor_constraints(enforce_anchor_constraints);

      std::optional<ChromeRootStoreData> root_store_data =
          ChromeRootStoreData::CreateFromRootStoreProto(root_store);
      ASSERT_TRUE(root_store_data);
      TrustStoreChrome trust_store_chrome(root_store_data.value());

      std::shared_ptr<const bssl::ParsedCertificate> parsed =
          ToParsedCertificate(*root);
      bssl::CertificateTrust trust = trust_store_chrome.GetTrust(parsed.get());
      EXPECT_TRUE(trust.IsTrustAnchor());
      EXPECT_EQ(trust.enforce_anchor_expiry, enforce_anchor_expiry);
      EXPECT_EQ(trust.enforce_anchor_constraints, enforce_anchor_constraints);
    }
  }
}

// Tests that, for a compiled-in root store, certificates in |additional_certs|
// are compiled in as trust anchors when indicated, with associated trust anchor
// IDs when present, with |enforce_anchor_expiry| and
// |enforce_anchor_constraints| flags enforced.
TEST(TrustStoreChromeTestNoFixture,
     LoadCompiledTrustAnchorsWithTrustAnchorIDs) {
  std::unique_ptr<TrustStoreChrome> trust_store_chrome =
      TrustStoreChrome::CreateTrustStoreForTesting(
          base::span<const ChromeRootCertInfo>(kChromeRootCertList),
          base::span(kEutlRootCertList),
          /*version=*/1);

  // Map of hex-encoded SHA-256 hashes of |trust_anchors| certificates that have
  // associated Trust Anchor IDs to their expected CertificateTrust setting.
  std::map<std::string, bssl::CertificateTrust>
      expected_trust_anchor_trust_by_hash = {
          {"687fa451382278fff0c8b11f8d43d576671c6eb2bceab413fb83d965d06d2ff2",
           bssl::CertificateTrust::ForTrustAnchor()
               .WithEnforceAnchorExpiry()
               .WithEnforceAnchorConstraints()},
      };

  // Map of hex-encoded SHA-256 hashes of |additional_certs| certificates that
  // are marked as trust anchors, and have associated Trust Anchor IDs, to their
  // expected CertificateTrust setting.
  std::map<std::string, bssl::CertificateTrust>
      expected_additional_certificate_trust_by_hash = {
          {"72a34ac2b424aed3f6b0b04755b88cc027dccc806fddb22b4cd7c47773973ec0",
           bssl::CertificateTrust::ForTrustAnchor().WithEnforceAnchorExpiry()},
          {"e6fe22bf45e4f0d3b85c59e02c0f495418e1eb8d3210f788d48cd5e1cb547cd4",
           bssl::CertificateTrust::ForTrustAnchor()
               .WithEnforceAnchorConstraints()},
          {"973a41276ffd01e027a2aad49e34c37846d3e976ff6a620b6712e33832041aa6",
           bssl::CertificateTrust::ForTrustAnchor()
               .WithEnforceAnchorExpiry()
               .WithEnforceAnchorConstraints()}};

  CertificateList trust_anchor_certs = CreateCertificateListFromFile(
      GetTestNetDataDirectory().AppendASCII("ssl/chrome_root_store"),
      "test_store.certs", X509Certificate::FORMAT_PEM_CERT_SEQUENCE);

  CertificateList additional_certs = CreateCertificateListFromFile(
      GetTestNetDataDirectory().AppendASCII("ssl/chrome_root_store"),
      "test_additional.certs", X509Certificate::FORMAT_PEM_CERT_SEQUENCE);

  size_t certs_with_tai = 0;
  for (const auto& cert : kChromeRootCertList) {
    if (cert.trust_anchor_id.empty()) {
      continue;
    }

    certs_with_tai++;
    std::string hash = base::ToLowerASCII(
        base::HexEncode(crypto::SHA256Hash(cert.root_cert_der)));
    bool is_additional_cert =
        expected_additional_certificate_trust_by_hash.contains(hash);
    bssl::CertificateTrust expected_trust =
        is_additional_cert ? expected_additional_certificate_trust_by_hash[hash]
                           : expected_trust_anchor_trust_by_hash[hash];

    std::shared_ptr<const bssl::ParsedCertificate> parsed_cert =
        is_additional_cert
            ? FindParsedCertificateInCertificateList(hash, additional_certs)
            : FindParsedCertificateInCertificateList(hash, trust_anchor_certs);
    ASSERT_TRUE(parsed_cert);

    // Check that the certificate is present in the trust store as an anchor,
    // with the expected settings for expiry and X.509 constraints.
    // TODO(crbug.com/414630735): check that the correct Trust Anchor ID is
    // stored in TrustStoreChrome, once implemented. (Right now TrustStoreChrome
    // throws out Trust Anchor IDs and doesn't keep them around.)
    bssl::CertificateTrust trust =
        trust_store_chrome->GetTrust(parsed_cert.get());
    EXPECT_TRUE(trust.IsTrustAnchor());
    EXPECT_EQ(trust.enforce_anchor_expiry,
              expected_trust.enforce_anchor_expiry);
    EXPECT_EQ(trust.enforce_anchor_constraints,
              expected_trust.enforce_anchor_constraints);
  }
  EXPECT_EQ(4u, certs_with_tai);
}

// Tests that, for a compiled-in root store, certificates in |additional_certs|
// are compiled in as trust anchors when indicated, even if they have no
// associated Trust Anchor ID.
TEST(TrustStoreChromeTestNoFixture,
     LoadCompiledTrustAnchorsWithNoTrustAnchorID) {
  std::unique_ptr<TrustStoreChrome> trust_store_chrome =
      TrustStoreChrome::CreateTrustStoreForTesting(
          base::span<const ChromeRootCertInfo>(kChromeRootCertList),
          base::span(kEutlRootCertList),
          /*version=*/1);

  const std::string kAdditionalCertTrustAnchorWithNoTAIHash =
      "19400be5b7a31fb733917700789d2f0a2471c0c9d506c0e504c06c16d7cb17c0";

  CertificateList additional_certs = CreateCertificateListFromFile(
      GetTestNetDataDirectory().AppendASCII("ssl/chrome_root_store"),
      "test_additional.certs", X509Certificate::FORMAT_PEM_CERT_SEQUENCE);

  std::shared_ptr<const bssl::ParsedCertificate> parsed_cert =
      FindParsedCertificateInCertificateList(
          kAdditionalCertTrustAnchorWithNoTAIHash, additional_certs);
  ASSERT_TRUE(parsed_cert);
  bssl::CertificateTrust trust =
      trust_store_chrome->GetTrust(parsed_cert.get());
  EXPECT_TRUE(trust.IsTrustAnchor());
  EXPECT_TRUE(trust.enforce_anchor_expiry);
  EXPECT_TRUE(trust.enforce_anchor_constraints);
}

// Tests that, for a root loaded from a proto, certificates in
// |additional_certs| are loaded into TrustStoreChrome as trust anchors when
// indicated, with |enforce_anchor_expiry| and |enforce_anchor_constraints|
// flags enforced.
TEST(TrustStoreChromeTestNoFixture, LoadProtoAdditionalCertsAsTrustAnchors) {
  for (bool enforce_anchor_expiry : {true, false}) {
    for (bool enforce_anchor_constraints : {true, false}) {
      scoped_refptr<X509Certificate> root = MakeTestRoot();
      chrome_root_store::RootStore root_store;
      chrome_root_store::TrustAnchor* anchor =
          root_store.add_additional_certs();
      anchor->set_der(
          net::x509_util::CryptoBufferAsStringPiece(root->cert_buffer()));
      anchor->set_enforce_anchor_expiry(enforce_anchor_expiry);
      anchor->set_enforce_anchor_constraints(enforce_anchor_constraints);
      anchor->set_tls_trust_anchor(true);
      anchor->set_trust_anchor_id("\x01\x02\x03\x04");

      std::optional<ChromeRootStoreData> root_store_data =
          ChromeRootStoreData::CreateFromRootStoreProto(root_store);
      ASSERT_TRUE(root_store_data);
      TrustStoreChrome trust_store_chrome(root_store_data.value());

      std::shared_ptr<const bssl::ParsedCertificate> parsed =
          ToParsedCertificate(*root);
      bssl::CertificateTrust trust = trust_store_chrome.GetTrust(parsed.get());
      EXPECT_TRUE(trust.IsTrustAnchor());
      EXPECT_EQ(trust.enforce_anchor_expiry, enforce_anchor_expiry);
      EXPECT_EQ(trust.enforce_anchor_constraints, enforce_anchor_constraints);
      // TODO(crbug.com/414630735): check that the correct Trust Anchor ID is
      // stored in TrustStoreChrome, once implemented. (Right now
      // TrustStoreChrome throws out Trust Anchor IDs and doesn't keep them
      // around.)
    }
  }
}

// Tests that, for a root loaded from a proto, certificates in
// |additional_certs| are loaded into TrustStoreChrome as trust anchors when
// indicated, even if there is no Trust Anchor ID set.
TEST(TrustStoreChromeTestNoFixture,
     LoadProtoAdditionalCertsAsTrustAnchorsWithNoTrustAnchorID) {
  scoped_refptr<X509Certificate> root = MakeTestRoot();
  chrome_root_store::RootStore root_store;
  chrome_root_store::TrustAnchor* anchor = root_store.add_additional_certs();
  anchor->set_der(
      net::x509_util::CryptoBufferAsStringPiece(root->cert_buffer()));
  anchor->set_enforce_anchor_expiry(true);
  anchor->set_enforce_anchor_constraints(true);
  anchor->set_tls_trust_anchor(true);
  // `trust_anchor_id` is left unset here.

  std::optional<ChromeRootStoreData> root_store_data =
      ChromeRootStoreData::CreateFromRootStoreProto(root_store);
  ASSERT_TRUE(root_store_data);
  TrustStoreChrome trust_store_chrome(root_store_data.value());

  std::shared_ptr<const bssl::ParsedCertificate> parsed =
      ToParsedCertificate(*root);
  bssl::CertificateTrust trust = trust_store_chrome.GetTrust(parsed.get());
  EXPECT_TRUE(trust.IsTrustAnchor());
  EXPECT_TRUE(trust.enforce_anchor_expiry);
  EXPECT_TRUE(trust.enforce_anchor_constraints);
}

// Tests that, for a root loaded from a proto, certificates in
// |additional_certs| are not loaded into TrustStoreChrome as trust anchors when
// |tls_trust_anchor| is false.
TEST(TrustStoreChromeTestNoFixture, LoadProtoNonAnchorsAreNotTrusted) {
  scoped_refptr<X509Certificate> root = MakeTestRoot();
  chrome_root_store::RootStore root_store;
  chrome_root_store::TrustAnchor* anchor = root_store.add_additional_certs();
  anchor->set_der(
      net::x509_util::CryptoBufferAsStringPiece(root->cert_buffer()));
  anchor->set_enforce_anchor_expiry(true);
  anchor->set_enforce_anchor_constraints(true);
  // |tls_trust_anchor| is left unset here.
  anchor->set_trust_anchor_id("\x01\x02\x03\x04");

  std::optional<ChromeRootStoreData> root_store_data =
      ChromeRootStoreData::CreateFromRootStoreProto(root_store);
  ASSERT_TRUE(root_store_data);
  TrustStoreChrome trust_store_chrome(root_store_data.value());

  std::shared_ptr<const bssl::ParsedCertificate> parsed =
      ToParsedCertificate(*root);
  EXPECT_FALSE(trust_store_chrome.Contains(parsed.get()));
  // TODO(crbug.com/414630735): check that the above Trust Anchor ID is
  // not present in TrustStoreChrome, once implemented. (Right now
  // TrustStoreChrome throws out Trust Anchor IDs and doesn't keep them around.)
}

// Tests that TLS Trust Anchor IDs are loaded correctly from the compiled-in
// root store.
TEST(TrustStoreChromeTestNoFixture, LoadCompiledInTrustAnchorIDs) {
  std::vector<std::vector<uint8_t>> trust_anchor_ids =
      TrustStoreChrome::GetTrustAnchorIDsFromCompiledInRootStore(
          base::span<const ChromeRootCertInfo>(kChromeRootCertList));
  EXPECT_THAT(trust_anchor_ids,
              testing::UnorderedElementsAre(
                  std::vector<uint8_t>({0x05u, 0x05u, 0x05u}),
                  std::vector<uint8_t>({0x01u, 0x01u, 0x01u, 0x01u}),
                  std::vector<uint8_t>({0x03u, 0x03u, 0x03u, 0x03u}),
                  std::vector<uint8_t>({0x02u, 0x02u, 0x02u, 0x02u})));
}

TEST(TrustStoreChromeTestNoFixture, OverrideConstraints) {
  // Root1: has no constraints and no override constraints
  // Root2: has constraints and no override constraints
  // Root3: has no constraints and has override constraints
  // Root4: has constraints and has override constraints
  // Root5: not present in CRS and no override constraints
  // Root6: not present in CRS but has override constraints
  scoped_refptr<X509Certificate> root1 = MakeTestRoot();
  scoped_refptr<X509Certificate> root2 = MakeTestRoot();
  scoped_refptr<X509Certificate> root3 = MakeTestRoot();
  scoped_refptr<X509Certificate> root4 = MakeTestRoot();
  scoped_refptr<X509Certificate> root5 = MakeTestRoot();
  scoped_refptr<X509Certificate> root6 = MakeTestRoot();

  std::vector<StaticChromeRootCertConstraints> c2 = {{.min_version = "20"}};
  std::vector<StaticChromeRootCertConstraints> c4 = {{.min_version = "40"}};
  std::vector<ChromeRootCertInfo> root_cert_info = {
      {root1->cert_span(), {}},
      {root2->cert_span(), c2},
      {root3->cert_span(), {}},
      {root4->cert_span(), c4},
  };

  base::flat_map<std::array<uint8_t, crypto::kSHA256Length>,
                 std::vector<ChromeRootCertConstraints>>
      override_constraints;

  override_constraints[crypto::SHA256Hash(root3->cert_span())] = {
      {std::nullopt,
       std::nullopt,
       std::nullopt,
       /*max_version_exclusive=*/std::make_optional(base::Version("31")),
       {}}};

  override_constraints[crypto::SHA256Hash(root4->cert_span())] = {
      {std::nullopt,
       std::nullopt,
       std::nullopt,
       /*max_version_exclusive=*/std::make_optional(base::Version("41")),
       {}}};

  override_constraints[crypto::SHA256Hash(root6->cert_span())] = {
      {std::nullopt,
       std::nullopt,
       std::nullopt,
       /*max_version_exclusive=*/std::make_optional(base::Version("61")),
       {}}};

  std::unique_ptr<TrustStoreChrome> trust_store_chrome =
      TrustStoreChrome::CreateTrustStoreForTesting(
          std::move(root_cert_info),
          /*eutl_certs=*/{},
          /*version=*/1, std::move(override_constraints));

  {
    std::shared_ptr<const bssl::ParsedCertificate> parsed =
        ToParsedCertificate(*root1);
    ASSERT_TRUE(parsed);
    EXPECT_TRUE(trust_store_chrome->Contains(parsed.get()));
    EXPECT_TRUE(
        trust_store_chrome->GetConstraintsForCert(parsed.get()).empty());
  }

  {
    std::shared_ptr<const bssl::ParsedCertificate> parsed =
        ToParsedCertificate(*root2);
    ASSERT_TRUE(parsed);
    EXPECT_TRUE(trust_store_chrome->Contains(parsed.get()));

    base::span<const ChromeRootCertConstraints> constraints =
        trust_store_chrome->GetConstraintsForCert(parsed.get());
    ASSERT_EQ(constraints.size(), 1U);
    EXPECT_EQ(constraints[0].min_version.value().components(),
              std::vector<uint32_t>({20}));
    EXPECT_FALSE(constraints[0].max_version_exclusive.has_value());
  }

  {
    std::shared_ptr<const bssl::ParsedCertificate> parsed =
        ToParsedCertificate(*root3);
    ASSERT_TRUE(parsed);
    EXPECT_TRUE(trust_store_chrome->Contains(parsed.get()));

    base::span<const ChromeRootCertConstraints> constraints =
        trust_store_chrome->GetConstraintsForCert(parsed.get());
    ASSERT_EQ(constraints.size(), 1U);
    EXPECT_FALSE(constraints[0].min_version.has_value());
    EXPECT_EQ(constraints[0].max_version_exclusive.value().components(),
              std::vector<uint32_t>({31}));
  }

  {
    std::shared_ptr<const bssl::ParsedCertificate> parsed =
        ToParsedCertificate(*root4);
    ASSERT_TRUE(parsed);
    EXPECT_TRUE(trust_store_chrome->Contains(parsed.get()));

    base::span<const ChromeRootCertConstraints> constraints =
        trust_store_chrome->GetConstraintsForCert(parsed.get());
    ASSERT_EQ(constraints.size(), 1U);
    EXPECT_FALSE(constraints[0].min_version.has_value());
    EXPECT_EQ(constraints[0].max_version_exclusive.value().components(),
              std::vector<uint32_t>({41}));
  }

  {
    std::shared_ptr<const bssl::ParsedCertificate> parsed =
        ToParsedCertificate(*root5);
    ASSERT_TRUE(parsed);
    EXPECT_FALSE(trust_store_chrome->Contains(parsed.get()));
    EXPECT_TRUE(
        trust_store_chrome->GetConstraintsForCert(parsed.get()).empty());
  }

  {
    std::shared_ptr<const bssl::ParsedCertificate> parsed =
        ToParsedCertificate(*root6);
    ASSERT_TRUE(parsed);
    EXPECT_FALSE(trust_store_chrome->Contains(parsed.get()));

    base::span<const ChromeRootCertConstraints> constraints =
        trust_store_chrome->GetConstraintsForCert(parsed.get());
    ASSERT_EQ(constraints.size(), 1U);
    EXPECT_FALSE(constraints[0].min_version.has_value());
    EXPECT_EQ(constraints[0].max_version_exclusive.value().components(),
              std::vector<uint32_t>({61}));
  }
}

TEST(TrustStoreChromeTestNoFixture, ParseCommandLineConstraintsEmpty) {
  EXPECT_TRUE(TrustStoreChrome::ParseCrsConstraintsSwitch("").empty());
  EXPECT_TRUE(TrustStoreChrome::ParseCrsConstraintsSwitch("invalid").empty());
  EXPECT_TRUE(TrustStoreChrome::ParseCrsConstraintsSwitch(
                  "invalidhash:sctnotafter=123456")
                  .empty());
}

TEST(TrustStoreChromeTestNoFixture, ParseCommandLineConstraintsErrorHandling) {
  auto constraints = TrustStoreChrome::ParseCrsConstraintsSwitch(
      // Valid hash and valid constraint name with invalid value (missing `,`
      // between constraints, so sctallafter value will not be parsable as an
      // integer). Should result in a constraintset with every constraint
      // being nullopt.
      "568c8ef6b526d1394bca052ba3e4d1f4d7a8d9c88c55a1a9ab7ca0fae2dc5473:"
      "sctallafter=9876543sctnotafter=1234567890+"
      // Invalid hash (valid hex, but too short).
      "37a9761b69457987abbc8636182d8273498719659716397401f98e019b20a9:"
      "sctallafter=9876543+"
      // Invalid hash (valid hex, but too long).
      "37a9761b69457987abbc8636182d8273498719659716397401f98e019b20a91111:"
      "sctallafter=9876543+"
      // Invalid constraint mapping (missing `:` between hash and constraint).
      "737a9761b69457987abbc8636182d8273498719659716397401f98e019b20a98"
      "sctallafter=9876543+"
      // Invalid and valid hashes with both invalid and valid constraints.
      "11,a7e0c75d7f772fccf26a6ac1f7b0a86a482e2f3d326bc911c95d56ff3d4906d5,22:"
      "invalidconstraint=hello,sctnotafter=789012345+"
      // Missing `+` between constraint mappings.
      // This will parse the next hash and minversion all as an invalid
      // sctallafter value and then the maxversionexclusive will apply to the
      // previous root hash.
      "65ee41e8a8c27b71b6bfcf44653c8e8370ec5e106e272592c2fbcbadf8dc5763:"
      "sctnotafter=123456,sctallafter=54321"
      "3333333333333333333333333333333333333333333333333333333333333333:"
      "minversion=1,maxversionexclusive=2.3");
  EXPECT_EQ(constraints.size(), 3U);

  {
    constexpr uint8_t hash[] = {0x56, 0x8c, 0x8e, 0xf6, 0xb5, 0x26, 0xd1, 0x39,
                                0x4b, 0xca, 0x05, 0x2b, 0xa3, 0xe4, 0xd1, 0xf4,
                                0xd7, 0xa8, 0xd9, 0xc8, 0x8c, 0x55, 0xa1, 0xa9,
                                0xab, 0x7c, 0xa0, 0xfa, 0xe2, 0xdc, 0x54, 0x73};
    auto it = constraints.find(base::span(hash));
    ASSERT_NE(it, constraints.end());
    ASSERT_EQ(it->second.size(), 1U);
    const auto& constraint1 = it->second[0];
    EXPECT_FALSE(constraint1.sct_not_after.has_value());
    EXPECT_FALSE(constraint1.sct_all_after.has_value());
    EXPECT_FALSE(constraint1.min_version.has_value());
    EXPECT_FALSE(constraint1.max_version_exclusive.has_value());
    EXPECT_THAT(constraint1.permitted_dns_names, testing::IsEmpty());
  }
  {
    constexpr uint8_t hash[] = {0xa7, 0xe0, 0xc7, 0x5d, 0x7f, 0x77, 0x2f, 0xcc,
                                0xf2, 0x6a, 0x6a, 0xc1, 0xf7, 0xb0, 0xa8, 0x6a,
                                0x48, 0x2e, 0x2f, 0x3d, 0x32, 0x6b, 0xc9, 0x11,
                                0xc9, 0x5d, 0x56, 0xff, 0x3d, 0x49, 0x06, 0xd5};
    auto it = constraints.find(base::span(hash));
    ASSERT_NE(it, constraints.end());
    ASSERT_EQ(it->second.size(), 1U);

    const auto& constraint1 = it->second[0];
    ASSERT_TRUE(constraint1.sct_not_after.has_value());
    EXPECT_EQ(constraint1.sct_not_after->InMillisecondsSinceUnixEpoch() / 1000,
              789012345);
    EXPECT_FALSE(constraint1.sct_all_after.has_value());
    EXPECT_FALSE(constraint1.min_version.has_value());
    EXPECT_FALSE(constraint1.max_version_exclusive.has_value());
    EXPECT_THAT(constraint1.permitted_dns_names, testing::IsEmpty());
  }

  {
    unsigned char hash[] = {0x65, 0xee, 0x41, 0xe8, 0xa8, 0xc2, 0x7b, 0x71,
                            0xb6, 0xbf, 0xcf, 0x44, 0x65, 0x3c, 0x8e, 0x83,
                            0x70, 0xec, 0x5e, 0x10, 0x6e, 0x27, 0x25, 0x92,
                            0xc2, 0xfb, 0xcb, 0xad, 0xf8, 0xdc, 0x57, 0x63};

    auto it = constraints.find(base::span(hash));
    ASSERT_NE(it, constraints.end());
    ASSERT_EQ(it->second.size(), 1U);
    const auto& constraint = it->second[0];
    ASSERT_TRUE(constraint.sct_not_after.has_value());
    EXPECT_EQ(constraint.sct_not_after->InMillisecondsSinceUnixEpoch() / 1000,
              123456);
    EXPECT_FALSE(constraint.sct_all_after.has_value());
    EXPECT_FALSE(constraint.min_version.has_value());
    EXPECT_EQ(constraint.max_version_exclusive, base::Version({2, 3}));
    EXPECT_THAT(constraint.permitted_dns_names, testing::IsEmpty());
  }
}

TEST(TrustStoreChromeTestNoFixture,
     ParseCommandLineConstraintsOneRootOneConstraint) {
  auto constraints = TrustStoreChrome::ParseCrsConstraintsSwitch(
      "65ee41e8a8c27b71b6bfcf44653c8e8370ec5e106e272592c2fbcbadf8dc5763:"
      "sctnotafter=123456");
  EXPECT_EQ(constraints.size(), 1U);
  unsigned char hash[] = {0x65, 0xee, 0x41, 0xe8, 0xa8, 0xc2, 0x7b, 0x71,
                          0xb6, 0xbf, 0xcf, 0x44, 0x65, 0x3c, 0x8e, 0x83,
                          0x70, 0xec, 0x5e, 0x10, 0x6e, 0x27, 0x25, 0x92,
                          0xc2, 0xfb, 0xcb, 0xad, 0xf8, 0xdc, 0x57, 0x63};

  auto it = constraints.find(base::span(hash));
  ASSERT_NE(it, constraints.end());
  ASSERT_EQ(it->second.size(), 1U);
  const auto& constraint = it->second[0];
  ASSERT_TRUE(constraint.sct_not_after.has_value());
  EXPECT_EQ(constraint.sct_not_after->InMillisecondsSinceUnixEpoch() / 1000,
            123456);
  EXPECT_FALSE(constraint.sct_all_after.has_value());
  EXPECT_FALSE(constraint.min_version.has_value());
  EXPECT_FALSE(constraint.max_version_exclusive.has_value());
}

TEST(TrustStoreChromeTestNoFixture,
     ParseCommandLineConstraintsMultipleRootsMultipleConstraints) {
  auto constraints = TrustStoreChrome::ParseCrsConstraintsSwitch(
      "784ecaa8b9dfcc826547f806f759abd6b4481582fc7e377dc3e6a0a959025126,"
      "a7e0c75d7f772fccf26a6ac1f7b0a86a482e2f3d326bc911c95d56ff3d4906d5:"
      "sctnotafter=123456,sctallafter=7689,"
      "minversion=1.2.3.4,maxversionexclusive=10,"
      "dns=foo.com,dns=bar.com+"
      "a7e0c75d7f772fccf26a6ac1f7b0a86a482e2f3d326bc911c95d56ff3d4906d5,"
      "568c8ef6b526d1394bca052ba3e4d1f4d7a8d9c88c55a1a9ab7ca0fae2dc5473:"
      "sctallafter=9876543,sctnotafter=1234567890");
  EXPECT_EQ(constraints.size(), 3U);

  {
    constexpr uint8_t hash1[] = {
        0x78, 0x4e, 0xca, 0xa8, 0xb9, 0xdf, 0xcc, 0x82, 0x65, 0x47, 0xf8,
        0x06, 0xf7, 0x59, 0xab, 0xd6, 0xb4, 0x48, 0x15, 0x82, 0xfc, 0x7e,
        0x37, 0x7d, 0xc3, 0xe6, 0xa0, 0xa9, 0x59, 0x02, 0x51, 0x26};
    auto it = constraints.find(base::span(hash1));
    ASSERT_NE(it, constraints.end());
    ASSERT_EQ(it->second.size(), 1U);
    const auto& constraint1 = it->second[0];
    ASSERT_TRUE(constraint1.sct_not_after.has_value());
    EXPECT_EQ(constraint1.sct_not_after->InMillisecondsSinceUnixEpoch() / 1000,
              123456);
    ASSERT_TRUE(constraint1.sct_all_after.has_value());
    EXPECT_EQ(constraint1.sct_all_after->InMillisecondsSinceUnixEpoch() / 1000,
              7689);
    EXPECT_EQ(constraint1.min_version, base::Version({1, 2, 3, 4}));
    EXPECT_EQ(constraint1.max_version_exclusive, base::Version({10}));
    EXPECT_THAT(constraint1.permitted_dns_names,
                testing::ElementsAre("foo.com", "bar.com"));
  }

  {
    constexpr uint8_t hash2[] = {
        0xa7, 0xe0, 0xc7, 0x5d, 0x7f, 0x77, 0x2f, 0xcc, 0xf2, 0x6a, 0x6a,
        0xc1, 0xf7, 0xb0, 0xa8, 0x6a, 0x48, 0x2e, 0x2f, 0x3d, 0x32, 0x6b,
        0xc9, 0x11, 0xc9, 0x5d, 0x56, 0xff, 0x3d, 0x49, 0x06, 0xd5};
    auto it = constraints.find(base::span(hash2));
    ASSERT_NE(it, constraints.end());
    ASSERT_EQ(it->second.size(), 2U);

    const auto& constraint1 = it->second[0];
    ASSERT_TRUE(constraint1.sct_not_after.has_value());
    EXPECT_EQ(constraint1.sct_not_after->InMillisecondsSinceUnixEpoch() / 1000,
              123456);
    ASSERT_TRUE(constraint1.sct_all_after.has_value());
    EXPECT_EQ(constraint1.sct_all_after->InMillisecondsSinceUnixEpoch() / 1000,
              7689);
    EXPECT_EQ(constraint1.min_version, base::Version({1, 2, 3, 4}));
    EXPECT_EQ(constraint1.max_version_exclusive, base::Version({10}));
    EXPECT_THAT(constraint1.permitted_dns_names,
                testing::ElementsAre("foo.com", "bar.com"));

    const auto& constraint2 = it->second[1];
    ASSERT_TRUE(constraint2.sct_not_after.has_value());
    EXPECT_EQ(constraint2.sct_not_after->InMillisecondsSinceUnixEpoch() / 1000,
              1234567890);
    ASSERT_TRUE(constraint2.sct_all_after.has_value());
    EXPECT_EQ(constraint2.sct_all_after->InMillisecondsSinceUnixEpoch() / 1000,
              9876543);
    EXPECT_FALSE(constraint2.min_version.has_value());
    EXPECT_FALSE(constraint2.max_version_exclusive.has_value());
    EXPECT_THAT(constraint2.permitted_dns_names, testing::IsEmpty());
  }

  {
    constexpr uint8_t hash3[] = {
        0x56, 0x8c, 0x8e, 0xf6, 0xb5, 0x26, 0xd1, 0x39, 0x4b, 0xca, 0x05,
        0x2b, 0xa3, 0xe4, 0xd1, 0xf4, 0xd7, 0xa8, 0xd9, 0xc8, 0x8c, 0x55,
        0xa1, 0xa9, 0xab, 0x7c, 0xa0, 0xfa, 0xe2, 0xdc, 0x54, 0x73};
    auto it = constraints.find(base::span(hash3));
    ASSERT_NE(it, constraints.end());
    ASSERT_EQ(it->second.size(), 1U);
    const auto& constraint1 = it->second[0];
    ASSERT_TRUE(constraint1.sct_not_after.has_value());
    EXPECT_EQ(constraint1.sct_not_after->InMillisecondsSinceUnixEpoch() / 1000,
              1234567890);
    ASSERT_TRUE(constraint1.sct_all_after.has_value());
    EXPECT_EQ(constraint1.sct_all_after->InMillisecondsSinceUnixEpoch() / 1000,
              9876543);
    EXPECT_FALSE(constraint1.min_version.has_value());
    EXPECT_FALSE(constraint1.max_version_exclusive.has_value());
    EXPECT_THAT(constraint1.permitted_dns_names, testing::IsEmpty());
  }
}

}  // namespace
}  // namespace net