Allow Cast certificates to have serial numbers greater than 20 bytes, as well as non-minimal INTEGE…

net/cert/internal/verify_certificate_chain.h

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_CERT_INTERNAL_VERIFY_CERTIFICATE_CHAIN_H_
 #define NET_CERT_INTERNAL_VERIFY_CERTIFICATE_CHAIN_H_
 
 #include <stdint.h>
 
 #include <memory>
 #include <string>
 #include <vector>
 
 #include "base/compiler_specific.h"
 #include "net/base/net_export.h"
 #include "net/cert/internal/parse_certificate.h"
 #include "net/der/input.h"
 
 namespace net {
 
 namespace der {
 struct GeneralizedTime;
 }
 
+struct ParseCertificateOptions;
 class SignaturePolicy;
 
 // Represents a trust anchor (i.e. a trusted root certificate).
 class NET_EXPORT TrustAnchor {
  public:
   // The certificate data for this trust anchor may either be owned internally
   // (INTERNAL_COPY) or owned externally (EXTERNAL_REFERENCE). When it is
   // owned internally the data is held by |cert_data_|
   enum class DataSource {
     INTERNAL_COPY,
     EXTERNAL_REFERENCE,
   };
 
   TrustAnchor();
   ~TrustAnchor();
 
   // Creates a TrustAnchor given a DER-encoded certificate. Returns nullptr on
   // failure. Failure will occur if the certificate data cannot be parsed to
   // find a subject.
   //
   // The provided certificate data is either copied, or aliased, depending on
   // the value of |source|. See the comments for DataSource for details.
   static std::unique_ptr<TrustAnchor> CreateFromCertificateData(
       const uint8_t* data,
       size_t length,
+      const ParseCertificateOptions& options,
       DataSource source);
 
   // Returns true if the trust anchor matches |name|. In other words, returns
   // true if the certificate's subject matches |name|.
   bool MatchesName(const der::Input& name) const;
 
   // Returns the DER-encoded certificate data for this trust anchor.
   const der::Input& cert() const { return cert_; }
 
  private:
@@ skipping 84 matching lines @@
 //
 //   time:
 //     The UTC time to use for expiration checks.
 //
 // ---------
 // Outputs
 // ---------
 //
 //   Returns true if the target certificate can be verified.
 NET_EXPORT bool VerifyCertificateChain(const std::vector<der::Input>& certs_der,
+                                       const ParseCertificateOptions& options,
                                        const TrustStore& trust_store,
                                        const SignaturePolicy* signature_policy,
                                        const der::GeneralizedTime& time)
     WARN_UNUSED_RESULT;
 
 }  // namespace net
 
 #endif  // NET_CERT_INTERNAL_VERIFY_CERTIFICATE_CHAIN_H_