Add a key purpose parameter to Certificate PathBuilder.

net/cert/internal/trust_store.h

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_CERT_INTERNAL_TRUST_STORE_H_
 #define NET_CERT_INTERNAL_TRUST_STORE_H_
 
 #include <vector>
 
 #include "base/memory/ref_counted.h"
@@ skipping 57 matching lines @@
   // initialized using the source certificate's subject and SPKI as usual,
   // however other parts of the certificate are applied as anchor constraints.
   //
   // The implementation matches the properties identified by RFC 5937,
   // resulting in the following hodgepodge of enforcement on the source
   // certificate:
   //
   //  * Signature:             No
   //  * Validity (expiration): No
   //  * Key usage:             No
-  //  * Extended key usage:    No
+  //  * Extended key usage:    Yes (not part of RFC 5937)
   //  * Basic constraints:     Yes, but only the pathlen (CA=false is accepted)
   //  * Name constraints:      Yes
   //  * Certificate policies:  Not currently, TODO(crbug.com/634453)
   //  * inhibitAnyPolicy:      Not currently, TODO(crbug.com/634453)
   //  * PolicyConstraints:     Not currently, TODO(crbug.com/634452)
   //
   // The presence of any other unrecognized extension marked as critical fails
   // validation.
   static scoped_refptr<TrustAnchor> CreateFromCertificateWithConstraints(
       scoped_refptr<ParsedCertificate> cert);
@@ skipping 34 matching lines @@
       const scoped_refptr<ParsedCertificate>& cert,
       TrustAnchors* matches) const = 0;
 
  private:
   DISALLOW_COPY_AND_ASSIGN(TrustStore);
 };
 
 }  // namespace net
 
 #endif  // NET_CERT_INTERNAL_TRUST_STORE_H_