Make Cast certificate verification enforce constraints specified in the trusted root certificate.

net/cert/internal/parse_certificate.h

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_CERT_INTERNAL_PARSE_CERTIFICATE_H_
 #define NET_CERT_INTERNAL_PARSE_CERTIFICATE_H_
 
 #include <stdint.h>
 
 #include <map>
@@ skipping 94 matching lines @@
   V2,
   V3,
 };
 
 // ParsedCertificate contains pointers to the main fields of a DER-encoded RFC
 // 5280 "Certificate".
 //
 // ParsedCertificate is expected to be filled by ParseCertificate(), so
 // subsequent field descriptions are in terms of what ParseCertificate() sets.
 struct NET_EXPORT ParsedCertificate {
+  ParsedCertificate();
+  ~ParsedCertificate();
+
   // Corresponds with "tbsCertificate" from RFC 5280:
   //         tbsCertificate       TBSCertificate,
   //
   // This contains the full (unverified) Tag-Length-Value for a SEQUENCE. No
   // guarantees are made regarding the value of this SEQUENCE.
   //
   // This can be further parsed using ParseTbsCertificate().
   der::Input tbs_certificate_tlv;
 
   // Corresponds with "signatureAlgorithm" from RFC 5280:
@@ skipping 266 matching lines @@
 // be set.
 //
 // To test if a particular key usage is set, call, e.g.:
 //     key_usage->AssertsBit(KEY_USAGE_BIT_DIGITAL_SIGNATURE);
 NET_EXPORT bool ParseKeyUsage(const der::Input& key_usage_tlv,
                               der::BitString* key_usage) WARN_UNUSED_RESULT;
 
 }  // namespace net
 
 #endif  // NET_CERT_INTERNAL_PARSE_CERTIFICATE_H_