Remove ParsedCertificate::unparsed_extensions().

net/cert/internal/verify_certificate_chain.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/internal/verify_certificate_chain.h"
 
 #include <memory>
 
 #include "base/logging.h"
 #include "base/memory/ptr_util.h"
@@ skipping 38 matching lines @@
                      "Does not have Basic Constraints");
 DEFINE_CERT_ERROR_ID(kNotPermittedByNameConstraints,
                      "Not permitted by name constraints");
 DEFINE_CERT_ERROR_ID(kSubjectDoesNotMatchIssuer,
                      "subject does not match issuer");
 DEFINE_CERT_ERROR_ID(kVerifySignedDataFailed, "VerifySignedData failed");
 DEFINE_CERT_ERROR_ID(kSignatureAlgorithmsDifferentEncoding,
                      "Certificate.signatureAlgorithm is encoded differently "
                      "than TBSCertificate.signature");
 
+bool IsHandledCriticalExtensionOid(const der::Input& oid) {
+  if (oid == BasicConstraintsOid())
+    return true;
+  if (oid == KeyUsageOid())
+    return true;
+  if (oid == NameConstraintsOid())
+    return true;
+  // TODO(eroman): SubjectAltName isn't actually used here, but rather is being
+  // checked by a higher layer.
+  if (oid == SubjectAltNameOid())
+    return true;
+
+  // TODO(eroman): Make this more complete.
+  return false;
+}
+
 // Adds errors to |errors| if the certificate contains unconsumed _critical_
 // extensions.
 void VerifyNoUnconsumedCriticalExtensions(const ParsedCertificate& cert,
                                           CertErrors* errors) {
-  for (const auto& entry : cert.unparsed_extensions()) {
-    if (entry.second.critical) {
+  for (const auto& it : cert.extensions()) {
+    const ParsedExtension& extension = it.second;
+    if (extension.critical && !IsHandledCriticalExtensionOid(extension.oid)) {
       errors->AddError(kUnconsumedCriticalExtension,
-                       CreateCertErrorParams2Der("oid", entry.second.oid,
-                                                 "value", entry.second.value));
+                       CreateCertErrorParams2Der("oid", extension.oid, "value",
+                                                 extension.value));
     }
   }
 }
 
 // Returns true if |cert| was self-issued. The definition of self-issuance
 // comes from RFC 5280 section 6.1:
 //
 //    A certificate is self-issued if the same DN appears in the subject
 //    and issuer fields (the two DNs are the same if they match according
 //    to the rules specified in Section 7.1).  In general, the issuer and
@@ skipping 470 matching lines @@
                             CertPathErrors* errors) {
   // TODO(eroman): This function requires that |errors| is empty upon entry,
   // which is not part of the API contract.
   DCHECK(!errors->ContainsHighSeverityErrors());
   VerifyCertificateChainNoReturnValue(certs, trust_anchor, signature_policy,
                                       time, errors);
   return !errors->ContainsHighSeverityErrors();
 }
 
 }  // namespace net