Enable trust anchor constraints for the built-in Cast roots.

Enable trust anchor constraints for the built-in Cast roots.

Cast Root CA
  * Now has its pathlen:2 constraint (once again) enforced

Cast CRL Root CA
  * Now has its pathlen:1 constraint (one again) enforced

BUG=635200
Committed: https://crrev.com/46826c6ee250b07ad5d0ef2ab7c9ea3281b40108
Cr-Commit-Position: refs/heads/master@{#413015}

[eroman, 2016-08-17 02:26:59]

The CQ bit was checked by eroman@chromium.org to run a CQ dry run

[commit-bot: I haz the power, 2016-08-17 02:27:13]

Dry run: CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[eroman, 2016-08-17 02:40:23]

eroman@chromium.org changed reviewers:
+ ryanchung@chromium.org, sheretov@chromium.org

[eroman, 2016-08-17 02:40:24]

The (convoluted) mapping from Certificate --> Anchor Constraints tries to follow
RFC 5937's description, with an overview given here:

https://chromium.googlesource.com/chromium/src/+/7f781f34f09fe2f3c5117f71de47...

The only effective difference from what we had previously (when cast's trust
anchors were being interpreted simply as another certificate in the chain) is
that there are no expiration checks on the trust anchor.

I can add an anchor constraint for expiration if you think you need that for
Cast, but there doesn't appear to be anything equivalent in RFC 5937 to point
to.

Note: I didn't add Cast CRL tests due to lack of familiarity with generating
protobufs for it. That said I think we have sufficient coverage between the cast
validator and the tests in //net that this isn't a blocker.

[commit-bot: I haz the power, 2016-08-17 03:16:14]

The CQ bit was unchecked by commit-bot@chromium.org

[commit-bot: I haz the power, 2016-08-17 03:16:15]

Dry run: This issue passed the CQ dry run.

[ryanchung, 2016-08-18 21:30:26]

lgtm

[sheretov, 2016-08-18 21:58:13]

lgtm

lgtm

[eroman, 2016-08-18 23:30:21]

The CQ bit was checked by eroman@chromium.org

[commit-bot: I haz the power, 2016-08-18 23:30:52]

CQ is trying da patch. Follow status at
 
https://chromium-cq-status.appspot.com/v2/patch-status/codereview.chromium.or...

[commit-bot: I haz the power, 2016-08-19 01:44:29]

Committed patchset #2 (id:20001)

[commit-bot: I haz the power, 2016-08-19 01:49:42]

Description was changed from

==========
Enable trust anchor constraints for the built-in Cast roots.

Cast Root CA
  * Now has its pathlen:2 constraint (once again) enforced

Cast CRL Root CA
  * Now has its pathlen:1 constraint (one again) enforced

BUG=635200
==========

to

==========
Enable trust anchor constraints for the built-in Cast roots.

Cast Root CA
  * Now has its pathlen:2 constraint (once again) enforced

Cast CRL Root CA
  * Now has its pathlen:1 constraint (one again) enforced

BUG=635200

Committed: https://crrev.com/46826c6ee250b07ad5d0ef2ab7c9ea3281b40108
Cr-Commit-Position: refs/heads/master@{#413015}
==========

[commit-bot: I haz the power, 2016-08-19 01:49:43]

Patchset 2 (id:??) landed as
https://crrev.com/46826c6ee250b07ad5d0ef2ab7c9ea3281b40108
Cr-Commit-Position: refs/heads/master@{#413015}