Add some policy controls for VerifySignedData().

net/cert/internal/verification_policy.cc

Index: net/cert/internal/verification_policy.cc
diff --git a/net/cert/internal/verification_policy.cc b/net/cert/internal/verification_policy.cc
new file mode 100644
index 0000000000000000000000000000000000000000..1607d55a094302647e87aa113d7ff7a85c6c67e0
--- /dev/null
+++ b/net/cert/internal/verification_policy.cc
@@ -0,0 +1,55 @@
+// Copyright 2015 The Chromium Authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+#include "net/cert/internal/verification_policy.h"
+
+#include "base/logging.h"
+
+// TODO(eroman): There is no intention to implement this for non-OpenSSL. Remove
+// this branch once the migration is complete. This could have been done as a
+// conditional file (_openssl.cc) in the build file instead, but that is likely
+// not worth the effort at this point.
+
+#if defined(USE_OPENSSL)
+#include <openssl/obj_mac.h>
+#endif
+
+namespace net {
+
+BaseVerificationPolicy::BaseVerificationPolicy(
+    size_t min_rsa_modulus_length_bits)
+    : min_rsa_modulus_length_bits_(min_rsa_modulus_length_bits) {}
+
+bool BaseVerificationPolicy::IsAcceptableDigestAlgorithm(
+    DigestAlgorithm algorithm) const {
+  // This is all of the enum possible values so equivalent to just returning
+  // true. However it is a bit more explicit in case new algorithms are added.
+  switch (algorithm) {
+    case DigestAlgorithm::Sha1:
+    case DigestAlgorithm::Sha256:
+    case DigestAlgorithm::Sha384:
+    case DigestAlgorithm::Sha512:
+      return true;
+  }
+  return false;
+}
+
+bool BaseVerificationPolicy::IsAcceptableCurveForEcdsa(int curve_nid) const {
+#if defined(USE_OPENSSL)
+  switch (curve_nid) {
+    case NID_X9_62_prime256v1:
+    case NID_secp384r1:
+    case NID_secp521r1:
+      return true;
+  }
+#endif
+  return false;
+}
+
+bool BaseVerificationPolicy::IsAcceptableModulusLengthForRsa(
+    size_t modulus_length_bits) const {
+  return modulus_length_bits >= min_rsa_modulus_length_bits_;
+}
+
+}  // namespace net