Add parsing code for RFC 5280 PolicyConstraints.

net/cert/internal/parse_certificate.h

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_CERT_INTERNAL_PARSE_CERTIFICATE_H_
 #define NET_CERT_INTERNAL_PARSE_CERTIFICATE_H_
 
 #include <stdint.h>
 
 #include <map>
@@ skipping 439 matching lines @@
 // IA5String (ASCII strings), but no other validation is performed on them.
 //
 // accessMethods other than id-ad-caIssuers and id-ad-ocsp are silently ignored.
 // accessLocation types other than uniformResourceIdentifier are silently
 // ignored.
 NET_EXPORT bool ParseAuthorityInfoAccess(
     const der::Input& authority_info_access_tlv,
     std::vector<base::StringPiece>* out_ca_issuers_uris,
     std::vector<base::StringPiece>* out_ocsp_uris) WARN_UNUSED_RESULT;
 
+struct ParsedPolicyConstraints {

[mattm, 2017/05/10 20:01:23]

we don't really have a well-defined organization currently, but do you think it
would make sense to put the policy constraints stuff in
net/cert/internal/certificate_policies instead of parse_certificate?

[eroman, 2017/05/13 01:10:55]

Done.

+  bool has_require_explicit_policy = false;
+  uint8_t require_explicit_policy = 0;
+
+  bool has_inhibit_policy_mapping = false;
+  uint8_t inhibit_policy_mapping = 0;
+};
+
+// Parses a PolicyConstraints SEQUENCE as defined by RFC 5280. Returns true on
+// success, and sets |out|.
+NET_EXPORT bool ParsePolicyConstraints(const der::Input& policy_constraints_tlv,
+                                       ParsedPolicyConstraints* out)
+    WARN_UNUSED_RESULT;
+
 }  // namespace net
 
 #endif  // NET_CERT_INTERNAL_PARSE_CERTIFICATE_H_