Add parsing code for RFC 5280 PolicyConstraints.

net/cert/internal/parsed_certificate.h

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_CERT_INTERNAL_PARSED_CERTIFICATE_H_
 #define NET_CERT_INTERNAL_PARSED_CERTIFICATE_H_
 
 #include <map>
 #include <memory>
 #include <vector>
 
 #include "base/memory/ref_counted.h"
 #include "net/base/net_export.h"
+#include "net/cert/internal/certificate_policies.h"
 #include "net/cert/internal/parse_certificate.h"
 #include "net/der/input.h"
 #include "third_party/boringssl/src/include/openssl/base.h"
 
 namespace net {
 
 struct GeneralNames;
 class NameConstraints;
 class ParsedCertificate;
 class SignatureAlgorithm;
@@ skipping 166 matching lines @@
   // Returns true if the certificate has a Policies extension.
   bool has_policy_oids() const { return has_policy_oids_; }
 
   // Returns the policy OIDs. Caller must check has_policy_oids() before
   // accessing this.
   const std::vector<der::Input>& policy_oids() const {
     DCHECK(has_policy_oids());
     return policy_oids_;
   }
 
+  // Returns true if the certificate has a PolicyConstraints extension.
+  bool has_policy_constraints() const { return has_policy_constraints_; }
+
+  // Returns the ParsedPolicyConstraints struct. Caller must check
+  // has_policy_constraints() before accessing this.
+  const ParsedPolicyConstraints& policy_constraints() const {
+    DCHECK(has_policy_constraints_);
+    return policy_constraints_;
+  }
+
   // Returns a map of all the extensions in the certificate.
   const ExtensionsMap& extensions() const { return extensions_; }
 
   // Gets the value for extension matching |extension_oid|. Returns false if the
   // extension is not present.
   bool GetExtension(const der::Input& extension_oid,
                     ParsedExtension* parsed_extension) const;
 
  private:
   friend class base::RefCountedThreadSafe<ParsedCertificate>;
@@ skipping 56 matching lines @@
   // CaIssuers and Ocsp URIs parsed from the AuthorityInfoAccess extension. Note
   // that the AuthorityInfoAccess may have contained other AccessDescriptions
   // which are not represented here.
   std::vector<base::StringPiece> ca_issuers_uris_;
   std::vector<base::StringPiece> ocsp_uris_;
 
   // Policies extension.
   bool has_policy_oids_ = false;
   std::vector<der::Input> policy_oids_;
 
+  // Policy constraints extension.
+  bool has_policy_constraints_ = false;
+  ParsedPolicyConstraints policy_constraints_;
+
   // All of the extensions.
   ExtensionsMap extensions_;
 
   DISALLOW_COPY_AND_ASSIGN(ParsedCertificate);
 };
 
 }  // namespace net
 
 #endif  // NET_CERT_INTERNAL_PARSED_CERTIFICATE_H_