Make Cast certificate verification enforce constraints specified in the trusted root certificate.

net/cert/internal/verify_certificate_chain_pkits_unittest.cc

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 // TODO(eroman): Because VerifySignedData() is only implemented for BoringSSL
 // these tests also depend on BoringSSL.
 #if defined(USE_OPENSSL)
 
 #include "net/cert/internal/verify_certificate_chain.h"
 
@@ skipping 29 matching lines @@
   DISABLED_Section7InvalidkeyUsageCriticalcRLSignFalseTest4
 #define Section7InvalidkeyUsageNotCriticalcRLSignFalseTest5 \
   DISABLED_Section7InvalidkeyUsageNotCriticalcRLSignFalseTest5
 
 #include "net/cert/internal/nist_pkits_unittest.h"
 
 namespace net {
 
 namespace {
 
-// Adds the certificate |cert_der| as a trust anchor to |trust_store|.
-void AddCertificateToTrustStore(const std::string& cert_der,
-                                TrustStore* trust_store) {
-  ParsedCertificate cert;
-  ASSERT_TRUE(ParseCertificate(der::Input(&cert_der), &cert));
-
-  ParsedTbsCertificate tbs;
-  ASSERT_TRUE(ParseTbsCertificate(cert.tbs_certificate_tlv, &tbs));
-  TrustAnchor anchor = {tbs.spki_tlv.AsString(), tbs.subject_tlv.AsString()};
-  trust_store->anchors.push_back(anchor);
-}
-
 class VerifyCertificateChainPkitsTestDelegate {
  public:
   static bool Verify(std::vector<std::string> cert_ders,
                      std::vector<std::string> crl_ders) {
     if (cert_ders.empty()) {
       ADD_FAILURE() << "cert_ders is empty";
       return false;
     }
     // First entry in the PKITS chain is the trust anchor.
     TrustStore trust_store;
-    AddCertificateToTrustStore(cert_ders[0], &trust_store);
+    EXPECT_TRUE(trust_store.AddTrustedCertificate(cert_ders[0]));
 
     // PKITS lists chains from trust anchor to target, VerifyCertificateChain
     // takes them starting with the target and not including the trust anchor.
     std::vector<der::Input> input_chain;
     for (size_t i = cert_ders.size() - 1; i > 0; --i)
       input_chain.push_back(der::Input(&cert_ders[i]));
 
     SimpleSignaturePolicy signature_policy(1024);
 
     // Run all tests at the time the PKITS was published.
@@ skipping 131 matching lines @@
 // PkitsTest05VerifyingPathswithSelfIssuedCertificates,
 // PkitsTest14DistributionPoints, PkitsTest15DeltaCRLs
 
 // TODO(mattm): Certificate Policies support: PkitsTest08CertificatePolicies,
 // PkitsTest09RequireExplicitPolicy PkitsTest10PolicyMappings,
 // PkitsTest11InhibitPolicyMapping, PkitsTest12InhibitAnyPolicy
 
 }  // namespace net
 
 #endif  // USE_OPENSSL