bssl-tls: Use more representative test data for cert parsing

As a side effect, this seems to route around a false positive report
from some confused AV scanner. It seems to think these lines are
malicious:

    assert_eq!(certs[0].as_der_bytes(), b"Hello World!");
    assert_eq!(certs[1].as_der_bytes(), b"Awesome BoringSSL!");

While nonsense, better test data is better, so let's improve that
anyway.

Fixed: 541711731
Change-Id: I107b72831f82005715f5a75e0b41151f16472698
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/100127
Commit-Queue: Xiangfei Ding <xfding@google.com>
Reviewed-by: Xiangfei Ding <xfding@google.com>
Commit-Queue: David Benjamin <davidben@google.com>
Auto-Submit: David Benjamin <davidben@google.com>

rust/bssl-tls/src/credentials/tests.rs

diff --git a/rust/bssl-tls/src/credentials/tests.rs b/rust/bssl-tls/src/credentials/tests.rs
index 1f86382..c745173 100644
--- a/rust/bssl-tls/src/credentials/tests.rs
+++ b/rust/bssl-tls/src/credentials/tests.rs
@@ -45,8 +45,12 @@
     },
     errors::Error,
     tests::{
+        P256_SERVER_CERT,
+        P256_SERVER_CERT_DER,
         P256_SERVER_KEY,
         P256_SERVER_KEY_DER,
+        RSA_SERVER_CERT,
+        RSA_SERVER_CERT_DER,
         TEST_CA_DN,
         create_mock_pipe,
         load_trust_store,
@@ -63,51 +67,40 @@
 
 #[test]
 fn parse_one() {
-    const PEM: &'_ [u8] = b"
-Hello world!
------BEGIN CERTIFICATE-----
-SGVsbG8gV29ybGQh
------END CERTIFICATE-----
-";
-    let certs = Certificate::parse_all_from_pem(PEM, None).unwrap();
+    let pem = [b"extra data\n", P256_SERVER_CERT, b"\nextra data\n"].concat();
+    let certs = Certificate::parse_all_from_pem(&pem, None).unwrap();
     assert_eq!(certs.len(), 1);
-    assert_eq!(certs[0].as_der_bytes(), b"Hello World!");
+    assert_eq!(certs[0].as_der_bytes(), P256_SERVER_CERT_DER);
 }
 
 #[test]
 fn parse_all_pems() {
-    const PEM: &'_ [u8] = b"
-Hello world!
------BEGIN CERTIFICATE-----
-SGVsbG8gV29ybGQh
------END CERTIFICATE-----
-BoringSSL is ...
------BEGIN CERTIFICATE-----
-QXdlc29tZSBCb3JpbmdTU0wh
------END CERTIFICATE-----
-Trailing bits ...
-";
-    let certs = Certificate::parse_all_from_pem(PEM, None).unwrap();
+    let pem = [
+        b"extra data\n",
+        P256_SERVER_CERT,
+        b"\nextra data\n",
+        RSA_SERVER_CERT,
+        b"\nextra data\n",
+    ]
+    .concat();
+    let certs = Certificate::parse_all_from_pem(&pem, None).unwrap();
     assert_eq!(certs.len(), 2);
-    assert_eq!(certs[0].as_der_bytes(), b"Hello World!");
-    assert_eq!(certs[1].as_der_bytes(), b"Awesome BoringSSL!");
+    assert_eq!(certs[0].as_der_bytes(), P256_SERVER_CERT_DER);
+    assert_eq!(certs[1].as_der_bytes(), RSA_SERVER_CERT_DER);
 }
 
 #[test]
 fn parse_all_pems_fail() {
-    const PEM: &'_ [u8] = b"
-Hello world!
------BEGIN CERTIFICATE-----
-SGVsbG8gV29ybGQh
------END CERTIFICATE-----
-BoringSSL is ...
------BEGIN CERTIFICATE-----
-QXdlc29tZSBCb3JpbmdTU0wh
------END CERTIFICATE-----
-But something badddd...
------BEGIN CERTIFICATE-----
-";
-    let _ = Certificate::parse_all_from_pem(PEM, None).unwrap_err();
+    let pem = [
+        b"extra data\n",
+        P256_SERVER_CERT,
+        b"\nextra data\n",
+        RSA_SERVER_CERT,
+        // Invalid PEM block.
+        b"\n-----BEGIN CERTIFICATE-----\n",
+    ]
+    .concat();
+    let _ = Certificate::parse_all_from_pem(&pem, None).unwrap_err();
 }
 
 #[test]

rust/bssl-tls/src/tests.rs

diff --git a/rust/bssl-tls/src/tests.rs b/rust/bssl-tls/src/tests.rs
index a26934e..d319869 100644
--- a/rust/bssl-tls/src/tests.rs
+++ b/rust/bssl-tls/src/tests.rs
@@ -61,10 +61,14 @@
 pub(crate) const CA: &[u8] = include_bytes!("../../test-data/BoringSSLCATest.crt");
 pub(crate) const RSA_SERVER_CERT: &[u8] =
     include_bytes!("../../test-data/BoringSSLServerTest-RSA.crt");
+pub(crate) const RSA_SERVER_CERT_DER: &[u8] =
+    include_bytes!("../../test-data/BoringSSLServerTest-RSA-Cert.der");
 pub(crate) const RSA_SERVER_KEY: &[u8] =
     include_bytes!("../../test-data/BoringSSLServerTest-RSA.key");
 pub(crate) const P256_SERVER_CERT: &[u8] =
     include_bytes!("../../test-data/BoringSSLServerTest-ECDSA-P256.crt");
+pub(crate) const P256_SERVER_CERT_DER: &[u8] =
+    include_bytes!("../../test-data/BoringSSLServerTest-ECDSA-P256-Cert.der");
 pub(crate) const P256_SERVER_KEY: &[u8] =
     include_bytes!("../../test-data/BoringSSLServerTest-ECDSA-P256.key");
 pub(crate) const P256_SERVER_KEY_DER: &[u8] =

rust/test-data/BoringSSLServerTest-ECDSA-P256-Cert.der

diff --git a/rust/test-data/BoringSSLServerTest-ECDSA-P256-Cert.der b/rust/test-data/BoringSSLServerTest-ECDSA-P256-Cert.der
new file mode 100644
index 0000000..40d8a83
--- /dev/null
+++ b/rust/test-data/BoringSSLServerTest-ECDSA-P256-Cert.der
Binary files differ

rust/test-data/BoringSSLServerTest-RSA-Cert.der

diff --git a/rust/test-data/BoringSSLServerTest-RSA-Cert.der b/rust/test-data/BoringSSLServerTest-RSA-Cert.der
new file mode 100644
index 0000000..4b905bb
--- /dev/null
+++ b/rust/test-data/BoringSSLServerTest-RSA-Cert.der
Binary files differ