Add tests for keyUsage to the built-in cert verifier.

net/cert/internal/verify_certificate_chain.h

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_CERT_INTERNAL_VERIFY_CERTIFICATE_CHAIN_H_
 #define NET_CERT_INTERNAL_VERIFY_CERTIFICATE_CHAIN_H_
 
 #include <vector>
 
 #include "base/compiler_specific.h"
@@ skipping 12 matching lines @@
 class SignaturePolicy;
 class TrustAnchor;
 
 // The key purpose (extended key usage) to check for during verification.
 enum class KeyPurpose {
   ANY_EKU,
   SERVER_AUTH,
   CLIENT_AUTH,
 };
 
-// VerifyCertificateChain() verifies a certificate path (chain) based on the
-// rules in RFC 5280. The caller is responsible for building the path and
-// finding the trust anchor.
+// VerifyCertificateChain() verifies an ordered certificate path in accordance
+// with RFC 5280 (with some modifications [1]).
+//
+// [1] Deviations from RFC 5280:
+//
+//   * If Extended Key Usage appears on intermediates it is treated as a
+//     restriction on subordinate certificates.
+//
+// The caller is responsible for additionally checking:
+//
+//  * The end-entity's KeyUsage before using its SPKI.
+//  * The end-entity's name/subjectAltName (note that name constraints from
+//    intermediates will have already been applied, so just need to check
+//    the end-entity for a match).
+//  * Policies
 //
 // WARNING: This implementation is in progress, and is currently incomplete.
 // Consult an OWNER before using it.
 //
 // TODO(eroman): Take a CertPath instead of ParsedCertificateList +
 //               TrustAnchor.
 //
 // ---------
 // Inputs
 // ---------
@@ skipping 39 matching lines @@
                                        KeyPurpose required_key_purpose,
                                        CertPathErrors* errors);
 
 // TODO(crbug.com/634443): Move exported errors to a central location?
 extern CertErrorId kValidityFailedNotAfter;
 extern CertErrorId kValidityFailedNotBefore;
 
 }  // namespace net
 
 #endif  // NET_CERT_INTERNAL_VERIFY_CERTIFICATE_CHAIN_H_