Add tests for keyUsage to the built-in cert verifier.

net/data/verify_certificate_chain_unittest/serverauth-rsa-ku-keyagreement.pem

Index: net/data/verify_certificate_chain_unittest/serverauth-rsa-ku-keyagreement.pem
diff --git a/net/data/verify_certificate_chain_unittest/serverauth-rsa-ku-keyagreement.pem b/net/data/verify_certificate_chain_unittest/serverauth-rsa-ku-keyagreement.pem
new file mode 100644
index 0000000000000000000000000000000000000000..af47df9bc050f78544478316df4c4448cf9541a1
--- /dev/null
+++ b/net/data/verify_certificate_chain_unittest/serverauth-rsa-ku-keyagreement.pem
@@ -0,0 +1,286 @@
+[Created by: generate-serverauth-rsa-ku-keyagreement.py]
+
+Certificate chain with 1 intermediate, a trusted root, and a target
+certificate for serverAuth that has only keyAgreement.
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 1 (0x1)
+    Signature Algorithm: sha256WithRSAEncryption
+        Issuer: CN=Intermediate
+        Validity
+            Not Before: Jan  1 12:00:00 2015 GMT
+            Not After : Jan  1 12:00:00 2016 GMT
+        Subject: CN=Target
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:c2:71:61:77:a3:d3:f2:28:4a:34:25:90:1c:f7:
+                    a1:1b:3f:69:d9:ff:ce:c2:4a:bd:e1:61:a1:25:5f:
+                    47:9e:61:0e:91:14:c6:b1:26:41:8c:2a:5f:6e:8c:
+                    2d:a7:89:89:55:95:58:44:6c:4f:87:6d:7b:64:77:
+                    de:1f:eb:51:ad:48:cf:16:44:93:89:1b:d7:6c:54:
+                    76:71:86:28:11:b9:bc:c5:39:72:9f:1e:6c:78:de:
+                    43:0a:d2:91:b4:65:a2:99:e1:97:f9:ef:ea:b6:71:
+                    90:c9:fd:ed:14:9a:55:ed:17:30:43:ee:45:b1:c5:
+                    03:42:74:6e:33:d9:68:f1:28:ff:7c:78:6f:84:73:
+                    39:a3:1e:53:e0:4a:ef:92:b2:53:30:83:1f:ec:08:
+                    81:60:6b:44:ea:7e:c1:c9:cc:9f:71:7d:b5:47:6d:
+                    50:05:56:28:96:39:d7:82:46:34:ad:a9:60:05:e3:
+                    e0:4c:d9:ba:a6:70:b2:cd:ba:f4:7a:09:c1:f1:bf:
+                    d0:3b:f2:46:e9:39:30:c2:d2:09:34:48:d9:1b:22:
+                    b8:ba:c6:38:29:89:9a:01:ea:9a:a2:4e:71:eb:62:
+                    3c:e3:8f:c5:e1:36:34:d0:b4:94:44:2e:c5:6b:fd:
+                    8e:6d:1d:bb:a6:9a:78:a2:60:36:c7:2c:15:64:6c:
+                    47:29
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                8B:F3:5A:A4:F4:0E:9C:EC:39:8A:A0:B0:B9:30:72:E9:8B:75:AB:71
+            X509v3 Authority Key Identifier: 
+                keyid:80:14:1E:04:C6:A0:C4:28:25:30:28:59:BD:40:1A:65:07:05:18:38
+
+            Authority Information Access: 
+                CA Issuers - URI:http://url-for-aia/Intermediate.cer
+
+            X509v3 CRL Distribution Points: 
+
+                Full Name:
+                  URI:http://url-for-crl/Intermediate.crl
+
+            X509v3 Key Usage: critical
+                Key Agreement
+            X509v3 Extended Key Usage: 
+                TLS Web Server Authentication
+    Signature Algorithm: sha256WithRSAEncryption
+         87:b2:f4:c9:6e:18:e1:0e:6c:52:46:e0:b9:e3:17:9b:fa:84:
+         52:da:41:17:dd:3f:5a:f2:95:1d:d8:2f:5f:73:65:0a:85:dd:
+         62:d8:a1:86:37:f0:40:81:57:09:ff:4d:1c:37:a5:1e:a8:75:
+         fb:6a:54:3d:03:92:28:2f:8c:ab:7e:fc:bb:a4:b9:1e:35:2c:
+         7c:fe:b0:f8:87:6b:11:e4:8f:72:00:68:54:bd:5e:f3:a8:4f:
+         d3:20:58:c9:b7:96:28:9c:44:f5:16:8d:24:17:d5:19:e8:73:
+         2b:55:cf:d5:ba:cd:ac:55:e5:ab:cc:6c:2b:1d:bb:bd:5c:80:
+         c0:cb:a3:5d:99:22:c8:ca:68:22:64:55:1c:46:fd:a9:27:a2:
+         46:0c:af:17:fb:65:bc:79:24:d9:a1:06:57:ea:c6:5f:15:2b:
+         c7:45:47:1a:c0:9c:d9:90:33:37:b4:7e:e9:51:ba:7f:f5:b0:
+         6a:c9:92:13:5d:da:b4:d6:f2:90:01:c3:a9:b7:bf:19:e3:13:
+         58:a3:e3:63:6d:aa:17:cf:17:a9:c6:db:ce:30:75:5d:e2:be:
+         16:57:04:a4:74:90:78:64:92:c5:68:d2:cc:5b:14:44:a6:01:
+         52:a2:6e:be:d6:f9:b0:5b:b5:22:36:78:41:73:a9:62:1b:0f:
+         77:34:a9:21
+-----BEGIN CERTIFICATE-----
+MIIDgzCCAmugAwIBAgIBATANBgkqhkiG9w0BAQsFADAXMRUwEwYDVQQDDAxJbnRl
+cm1lZGlhdGUwHhcNMTUwMTAxMTIwMDAwWhcNMTYwMTAxMTIwMDAwWjARMQ8wDQYD
+VQQDDAZUYXJnZXQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDCcWF3
+o9PyKEo0JZAc96EbP2nZ/87CSr3hYaElX0eeYQ6RFMaxJkGMKl9ujC2niYlVlVhE
+bE+HbXtkd94f61GtSM8WRJOJG9dsVHZxhigRubzFOXKfHmx43kMK0pG0ZaKZ4Zf5
+7+q2cZDJ/e0UmlXtFzBD7kWxxQNCdG4z2WjxKP98eG+EczmjHlPgSu+SslMwgx/s
+CIFga0TqfsHJzJ9xfbVHbVAFViiWOdeCRjStqWAF4+BM2bqmcLLNuvR6CcHxv9A7
+8kbpOTDC0gk0SNkbIri6xjgpiZoB6pqiTnHrYjzjj8XhNjTQtJRELsVr/Y5tHbum
+mniiYDbHLBVkbEcpAgMBAAGjgd8wgdwwHQYDVR0OBBYEFIvzWqT0DpzsOYqgsLkw
+cumLdatxMB8GA1UdIwQYMBaAFIAUHgTGoMQoJTAoWb1AGmUHBRg4MD8GCCsGAQUF
+BwEBBDMwMTAvBggrBgEFBQcwAoYjaHR0cDovL3VybC1mb3ItYWlhL0ludGVybWVk
+aWF0ZS5jZXIwNAYDVR0fBC0wKzApoCegJYYjaHR0cDovL3VybC1mb3ItY3JsL0lu
+dGVybWVkaWF0ZS5jcmwwDgYDVR0PAQH/BAQDAgMIMBMGA1UdJQQMMAoGCCsGAQUF
+BwMBMA0GCSqGSIb3DQEBCwUAA4IBAQCHsvTJbhjhDmxSRuC54xeb+oRS2kEX3T9a
+8pUd2C9fc2UKhd1i2KGGN/BAgVcJ/00cN6UeqHX7alQ9A5IoL4yrfvy7pLkeNSx8
+/rD4h2sR5I9yAGhUvV7zqE/TIFjJt5YonET1Fo0kF9UZ6HMrVc/Vus2sVeWrzGwr
+Hbu9XIDAy6NdmSLIymgiZFUcRv2pJ6JGDK8X+2W8eSTZoQZX6sZfFSvHRUcawJzZ
+kDM3tH7pUbp/9bBqyZITXdq01vKQAcOpt78Z4xNYo+NjbaoXzxepxtvOMHVd4r4W
+VwSkdJB4ZJLFaNLMWxREpgFSom6+1vmwW7UiNnhBc6liGw93NKkh
+-----END CERTIFICATE-----
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 2 (0x2)
+    Signature Algorithm: sha256WithRSAEncryption
+        Issuer: CN=Root
+        Validity
+            Not Before: Jan  1 12:00:00 2015 GMT
+            Not After : Jan  1 12:00:00 2016 GMT
+        Subject: CN=Intermediate
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:ad:ea:23:0c:dc:31:55:3d:23:7a:a3:0f:5e:16:
+                    9e:62:44:e4:28:bf:0b:b0:76:a3:5e:71:e7:a9:85:
+                    52:1e:ae:3b:2b:21:0d:95:35:73:c2:c0:a0:78:13:
+                    d3:fc:27:57:8a:98:de:83:e3:8f:a3:13:a5:20:a7:
+                    a9:bf:c8:f5:02:1b:08:1a:2e:a5:04:7a:11:24:a1:
+                    59:11:3d:c0:3b:57:35:62:cd:2a:41:cd:5c:15:35:
+                    ac:c8:66:f8:a9:f2:d4:1c:0c:b4:dc:9d:7b:99:f9:
+                    07:1b:c9:f0:03:6a:6c:71:d8:e6:cb:7a:ec:c7:a7:
+                    b7:36:0b:f0:49:22:37:22:f4:77:f3:1a:a6:57:59:
+                    0b:6c:6a:3b:b8:d1:47:df:48:ac:54:ee:82:1e:39:
+                    14:dc:a6:9c:ab:33:b7:87:4f:3b:70:55:af:db:40:
+                    e5:26:a9:0f:bc:59:8f:61:92:47:0a:34:73:de:fb:
+                    25:fa:f1:bd:a4:03:35:93:5e:57:a3:a3:3f:13:e6:
+                    09:68:c5:51:29:20:53:b8:5e:fa:8a:ce:e8:0a:ef:
+                    9e:07:6e:55:f7:f6:c1:e7:12:9f:22:c1:72:b8:2a:
+                    af:25:34:eb:08:28:36:73:8e:f6:80:70:21:16:8a:
+                    81:2b:69:47:62:c5:ef:7e:dd:80:7c:09:4e:6d:57:
+                    86:4f
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                80:14:1E:04:C6:A0:C4:28:25:30:28:59:BD:40:1A:65:07:05:18:38
+            X509v3 Authority Key Identifier: 
+                keyid:71:50:52:35:92:69:F7:54:B1:8A:0C:C1:93:87:3E:84:E9:BE:5C:80
+
+            Authority Information Access: 
+                CA Issuers - URI:http://url-for-aia/Root.cer
+
+            X509v3 CRL Distribution Points: 
+
+                Full Name:
+                  URI:http://url-for-crl/Root.crl
+
+            X509v3 Key Usage: critical
+                Certificate Sign, CRL Sign
+            X509v3 Basic Constraints: critical
+                CA:TRUE
+    Signature Algorithm: sha256WithRSAEncryption
+         13:bc:fc:4c:c8:34:97:a7:cb:9c:1f:4f:2d:bd:64:07:c0:2f:
+         9e:e2:1b:b5:d4:03:b9:3e:19:47:5d:35:e2:1a:76:76:0e:b6:
+         6c:18:00:43:64:53:6f:27:46:56:01:90:3f:2a:e5:7c:68:ea:
+         7c:3f:f1:ac:8f:2b:80:8c:d8:0e:fc:3d:4a:06:85:b1:c5:8a:
+         d4:d4:b2:f4:d3:20:b8:d3:6e:26:38:80:1c:01:ed:89:9c:0d:
+         d9:6f:be:34:e0:ba:cf:37:16:0b:f6:bf:fd:fd:05:79:c7:7b:
+         31:07:56:d3:70:bb:94:b8:36:08:35:ca:5e:10:14:db:1d:30:
+         53:1e:4a:bf:8a:1e:70:4e:77:4d:07:1e:c3:41:f4:7a:dc:a7:
+         4f:96:17:2a:b3:50:03:19:50:45:dd:68:f7:77:ca:78:14:84:
+         bd:6e:63:c0:e3:17:c0:7c:18:c3:cd:0a:48:aa:75:58:f6:76:
+         75:0a:92:e4:45:09:64:b3:f1:4e:40:dd:40:74:4b:75:cc:b3:
+         4c:e1:23:01:78:d3:d4:9a:d2:2e:8f:09:50:14:d8:bd:82:1f:
+         ea:f4:97:4d:c7:9a:d5:23:a0:7d:73:77:8c:4f:b3:78:d0:cf:
+         82:39:0d:26:8d:f6:33:20:0e:6d:78:c0:82:4f:2b:0a:ac:8d:
+         9b:23:1d:3a
+-----BEGIN CERTIFICATE-----
+MIIDbTCCAlWgAwIBAgIBAjANBgkqhkiG9w0BAQsFADAPMQ0wCwYDVQQDDARSb290
+MB4XDTE1MDEwMTEyMDAwMFoXDTE2MDEwMTEyMDAwMFowFzEVMBMGA1UEAwwMSW50
+ZXJtZWRpYXRlMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAreojDNwx
+VT0jeqMPXhaeYkTkKL8LsHajXnHnqYVSHq47KyENlTVzwsCgeBPT/CdXipjeg+OP
+oxOlIKepv8j1AhsIGi6lBHoRJKFZET3AO1c1Ys0qQc1cFTWsyGb4qfLUHAy03J17
+mfkHG8nwA2pscdjmy3rsx6e3NgvwSSI3IvR38xqmV1kLbGo7uNFH30isVO6CHjkU
+3KacqzO3h087cFWv20DlJqkPvFmPYZJHCjRz3vsl+vG9pAM1k15Xo6M/E+YJaMVR
+KSBTuF76is7oCu+eB25V9/bB5xKfIsFyuCqvJTTrCCg2c472gHAhFoqBK2lHYsXv
+ft2AfAlObVeGTwIDAQABo4HLMIHIMB0GA1UdDgQWBBSAFB4ExqDEKCUwKFm9QBpl
+BwUYODAfBgNVHSMEGDAWgBRxUFI1kmn3VLGKDMGThz6E6b5cgDA3BggrBgEFBQcB
+AQQrMCkwJwYIKwYBBQUHMAKGG2h0dHA6Ly91cmwtZm9yLWFpYS9Sb290LmNlcjAs
+BgNVHR8EJTAjMCGgH6AdhhtodHRwOi8vdXJsLWZvci1jcmwvUm9vdC5jcmwwDgYD
+VR0PAQH/BAQDAgEGMA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQELBQADggEB
+ABO8/EzINJeny5wfTy29ZAfAL57iG7XUA7k+GUddNeIadnYOtmwYAENkU28nRlYB
+kD8q5Xxo6nw/8ayPK4CM2A78PUoGhbHFitTUsvTTILjTbiY4gBwB7YmcDdlvvjTg
+us83Fgv2v/39BXnHezEHVtNwu5S4Ngg1yl4QFNsdMFMeSr+KHnBOd00HHsNB9Hrc
+p0+WFyqzUAMZUEXdaPd3yngUhL1uY8DjF8B8GMPNCkiqdVj2dnUKkuRFCWSz8U5A
+3UB0S3XMs0zhIwF409Sa0i6PCVAU2L2CH+r0l03HmtUjoH1zd4xPs3jQz4I5DSaN
+9jMgDm14wIJPKwqsjZsjHTo=
+-----END CERTIFICATE-----
+
+Certificate:
+    Data:
+        Version: 3 (0x2)
+        Serial Number: 1 (0x1)
+    Signature Algorithm: sha256WithRSAEncryption
+        Issuer: CN=Root
+        Validity
+            Not Before: Jan  1 12:00:00 2015 GMT
+            Not After : Jan  1 12:00:00 2016 GMT
+        Subject: CN=Root
+        Subject Public Key Info:
+            Public Key Algorithm: rsaEncryption
+                Public-Key: (2048 bit)
+                Modulus:
+                    00:b2:df:0b:0b:a2:8a:9c:9c:68:ad:24:f9:f9:e6:
+                    95:ef:e4:71:1e:00:fb:ec:bf:b1:cb:6e:d6:40:30:
+                    42:7a:38:87:9e:5b:cd:58:3e:b7:31:5c:8d:0d:84:
+                    7a:be:ef:e6:98:ba:4e:c5:ae:2b:2f:66:b2:b2:3f:
+                    e7:c0:a8:8b:75:60:61:2a:67:8a:d2:55:72:83:e2:
+                    ff:de:76:d6:63:58:79:ba:91:c1:80:e1:06:1b:35:
+                    9c:b3:e9:19:f8:c7:21:80:dd:9e:04:18:35:de:df:
+                    00:80:21:09:06:3c:6c:9a:de:10:d1:fd:4d:2f:27:
+                    5e:56:24:44:67:88:48:e4:25:52:cc:c7:17:3f:69:
+                    1f:76:fc:b1:83:45:48:5d:37:da:80:3e:3d:7f:f6:
+                    8d:ec:83:00:d6:2f:c4:41:5d:79:ae:ad:14:4c:24:
+                    b3:5e:1e:fe:ed:e8:39:17:4a:4b:ca:eb:10:5d:6e:
+                    af:38:58:b1:12:a5:69:bd:bd:63:dd:f5:21:71:2c:
+                    36:37:72:51:3b:3a:de:8f:1e:a0:e2:6b:45:da:02:
+                    ad:7e:04:b7:d3:c8:64:34:c6:f4:08:a0:e5:c9:02:
+                    1b:6f:42:22:be:d3:8b:7b:63:6e:39:c4:97:17:c6:
+                    9a:ba:9e:26:9b:e1:65:a6:4d:4a:93:5e:b2:4e:18:
+                    9d:c1
+                Exponent: 65537 (0x10001)
+        X509v3 extensions:
+            X509v3 Subject Key Identifier: 
+                71:50:52:35:92:69:F7:54:B1:8A:0C:C1:93:87:3E:84:E9:BE:5C:80
+            X509v3 Authority Key Identifier: 
+                keyid:71:50:52:35:92:69:F7:54:B1:8A:0C:C1:93:87:3E:84:E9:BE:5C:80
+
+            Authority Information Access: 
+                CA Issuers - URI:http://url-for-aia/Root.cer
+
+            X509v3 CRL Distribution Points: 
+
+                Full Name:
+                  URI:http://url-for-crl/Root.crl
+
+            X509v3 Key Usage: critical
+                Certificate Sign, CRL Sign
+            X509v3 Basic Constraints: critical
+                CA:TRUE
+    Signature Algorithm: sha256WithRSAEncryption
+         7a:ca:a0:87:28:94:f4:16:26:cb:1d:3b:96:f7:ad:17:71:18:
+         31:86:79:f0:f4:eb:57:33:61:58:33:ab:45:b4:40:50:05:a7:
+         c6:b6:a8:38:b7:50:9f:59:85:f2:57:33:e9:6a:62:2b:4d:5d:
+         c9:fb:fe:a1:ca:ce:59:25:5d:e7:fb:55:79:11:a5:ef:15:51:
+         90:94:9a:58:20:ef:a9:83:38:42:2d:11:e8:18:d9:2d:1f:3f:
+         1e:52:e3:59:25:d5:2d:f2:dd:ff:0c:89:07:68:05:45:3c:0e:
+         85:3c:1f:e9:81:5f:c3:f7:ea:c2:d1:ed:24:d8:55:83:14:75:
+         49:3f:52:e2:19:24:f6:d6:9f:82:75:74:e5:97:af:af:04:ab:
+         6b:41:c7:61:1c:9b:ed:3e:9c:c6:ff:e7:61:3b:20:29:30:5f:
+         5f:b5:47:71:c6:87:ae:aa:31:ce:d1:b1:3f:27:ee:ca:66:0e:
+         6d:2b:e1:99:66:66:94:81:10:18:28:4f:51:32:7a:c4:e1:ce:
+         16:ae:69:26:0e:ad:2e:e0:30:cc:52:00:18:3d:e2:75:76:83:
+         1f:19:02:7c:f6:54:1e:77:f8:18:e2:1e:c0:0b:2a:b9:6a:6a:
+         69:25:5d:a7:f9:c9:3b:bd:22:cc:3b:f1:fd:41:f1:a5:fc:6b:
+         65:9e:df:7c
+-----BEGIN TRUST_ANCHOR_UNCONSTRAINED-----
+MIIDZTCCAk2gAwIBAgIBATANBgkqhkiG9w0BAQsFADAPMQ0wCwYDVQQDDARSb290
+MB4XDTE1MDEwMTEyMDAwMFoXDTE2MDEwMTEyMDAwMFowDzENMAsGA1UEAwwEUm9v
+dDCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBALLfCwuiipycaK0k+fnm
+le/kcR4A++y/sctu1kAwQno4h55bzVg+tzFcjQ2Eer7v5pi6TsWuKy9msrI/58Co
+i3VgYSpnitJVcoPi/9521mNYebqRwYDhBhs1nLPpGfjHIYDdngQYNd7fAIAhCQY8
+bJreENH9TS8nXlYkRGeISOQlUszHFz9pH3b8sYNFSF032oA+PX/2jeyDANYvxEFd
+ea6tFEwks14e/u3oORdKS8rrEF1urzhYsRKlab29Y931IXEsNjdyUTs63o8eoOJr
+RdoCrX4Et9PIZDTG9Aig5ckCG29CIr7Ti3tjbjnElxfGmrqeJpvhZaZNSpNesk4Y
+ncECAwEAAaOByzCByDAdBgNVHQ4EFgQUcVBSNZJp91SxigzBk4c+hOm+XIAwHwYD
+VR0jBBgwFoAUcVBSNZJp91SxigzBk4c+hOm+XIAwNwYIKwYBBQUHAQEEKzApMCcG
+CCsGAQUFBzAChhtodHRwOi8vdXJsLWZvci1haWEvUm9vdC5jZXIwLAYDVR0fBCUw
+IzAhoB+gHYYbaHR0cDovL3VybC1mb3ItY3JsL1Jvb3QuY3JsMA4GA1UdDwEB/wQE
+AwIBBjAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQB6yqCHKJT0
+FibLHTuW960XcRgxhnnw9OtXM2FYM6tFtEBQBafGtqg4t1CfWYXyVzPpamIrTV3J
++/6hys5ZJV3n+1V5EaXvFVGQlJpYIO+pgzhCLRHoGNktHz8eUuNZJdUt8t3/DIkH
+aAVFPA6FPB/pgV/D9+rC0e0k2FWDFHVJP1LiGST21p+CdXTll6+vBKtrQcdhHJvt
+PpzG/+dhOyApMF9ftUdxxoeuqjHO0bE/J+7KZg5tK+GZZmaUgRAYKE9RMnrE4c4W
+rmkmDq0u4DDMUgAYPeJ1doMfGQJ89lQed/gY4h7ACyq5amppJV2n+ck7vSLMO/H9
+QfGl/Gtlnt98
+-----END TRUST_ANCHOR_UNCONSTRAINED-----
+
+150302120000Z
+-----BEGIN TIME-----
+MTUwMzAyMTIwMDAwWg==
+-----END TIME-----
+
+SUCCESS
+-----BEGIN VERIFY_RESULT-----
+U1VDQ0VTUw==
+-----END VERIFY_RESULT-----
+
+serverAuth
+-----BEGIN KEY_PURPOSE-----
+c2VydmVyQXV0aA==
+-----END KEY_PURPOSE-----