Make Cast certificate verification enforce constraints specified in the trusted root certificate.

net/data/verify_certificate_chain_unittest/generate-violates-pathlen-1-root.py

Index: net/data/verify_certificate_chain_unittest/generate-violates-pathlen-1-root.py
diff --git a/net/data/verify_certificate_chain_unittest/generate-violates-basic-constraints-pathlen-0.py b/net/data/verify_certificate_chain_unittest/generate-violates-pathlen-1-root.py
similarity index 55%
copy from net/data/verify_certificate_chain_unittest/generate-violates-basic-constraints-pathlen-0.py
copy to net/data/verify_certificate_chain_unittest/generate-violates-pathlen-1-root.py
index 0298956edb30a64db842971392faa7c3a8f01436..bda9c25d9eedebf69846d36764f44591a9a0d1a4 100755
--- a/net/data/verify_certificate_chain_unittest/generate-violates-basic-constraints-pathlen-0.py
+++ b/net/data/verify_certificate_chain_unittest/generate-violates-pathlen-1-root.py
@@ -1,27 +1,24 @@
 #!/usr/bin/python
-# Copyright (c) 2015 The Chromium Authors. All rights reserved.
+# Copyright (c) 2016 The Chromium Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
-"""Certificate chain with 2 intermediaries. The first intermediary has a basic
-constraints path length of 0, so it is a violation for it to have a subordinate
-intermediary."""
+"""Certificate chain with 2 intermediaries and one end entity certificate. The
+root certificate has a pathlen:1 restriction so this is an invalid chain."""
 
 import common
 
 # Self-signed root certificate (part of trust store).
 root = common.create_self_signed_root_certificate('Root')
+root.get_extensions().set_property('basicConstraints',
+                                   'critical,CA:true,pathlen:1')
 
-# Intermediary with pathlen 0
+# Intermediary 1 (no pathlen restriction).
 intermediary1 = common.create_intermediary_certificate('Intermediary1', root)
-intermediary1.get_extensions().set_property('basicConstraints',
-                                            'critical,CA:true,pathlen:0')
 
-# Another intermediary (with the same pathlen restriction)
+# Intermediary 2 (no pathlen restriction).
 intermediary2 = common.create_intermediary_certificate('Intermediary2',
                                                        intermediary1)
-intermediary2.get_extensions().set_property('basicConstraints',
-                                            'critical,CA:true,pathlen:0')
 
 # Target certificate.
 target = common.create_end_entity_certificate('Target', intermediary2)