Add parsing code for RFC 5280 PolicyConstraints.

net/cert/internal/parsed_certificate_unittest.cc

 // Copyright 2017 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/internal/parsed_certificate.h"
 
 #include "net/cert/internal/cert_errors.h"
 #include "net/cert/internal/parse_certificate.h"
 #include "net/cert/internal/test_helpers.h"
 #include "net/der/input.h"
@@ skipping 288 matching lines @@
   scoped_refptr<ParsedCertificate> cert =
       ParseCertificateFromFile("basic_constraints_pathlen_not_ca.pem");
   ASSERT_TRUE(cert);
 
   EXPECT_TRUE(cert->has_basic_constraints());
   EXPECT_FALSE(cert->basic_constraints().is_ca);
   EXPECT_TRUE(cert->basic_constraints().has_path_len);
   EXPECT_EQ(1u, cert->basic_constraints().path_len);
 }
 
+// Tests parsing a certificate that contains a policyConstraints
+// extension having requireExplicitPolicy:3.
+TEST(ParsedCertificateTest, PolicyConstraintsRequire) {
+  scoped_refptr<ParsedCertificate> cert =
+      ParseCertificateFromFile("policy_constraints_require.pem");
+  ASSERT_TRUE(cert);
+
+  EXPECT_TRUE(cert->has_policy_constraints());
+  EXPECT_TRUE(cert->policy_constraints().has_require_explicit_policy);
+  EXPECT_EQ(3, cert->policy_constraints().require_explicit_policy);
+  EXPECT_FALSE(cert->policy_constraints().has_inhibit_policy_mapping);
+  EXPECT_EQ(0, cert->policy_constraints().inhibit_policy_mapping);
+}
+
+// Tests parsing a certificate that contains a policyConstraints
+// extension having inhibitPolicyMapping:1.
+TEST(ParsedCertificateTest, PolicyConstraintsInhibit) {
+  scoped_refptr<ParsedCertificate> cert =
+      ParseCertificateFromFile("policy_constraints_inhibit.pem");
+  ASSERT_TRUE(cert);
+
+  EXPECT_TRUE(cert->has_policy_constraints());
+  EXPECT_FALSE(cert->policy_constraints().has_require_explicit_policy);
+  EXPECT_EQ(0, cert->policy_constraints().require_explicit_policy);
+  EXPECT_TRUE(cert->policy_constraints().has_inhibit_policy_mapping);
+  EXPECT_EQ(1, cert->policy_constraints().inhibit_policy_mapping);
+}
+
+// Tests parsing a certificate that contains a policyConstraints
+// extension having requireExplicitPolicy:5,inhibitPolicyMapping:2.
+TEST(ParsedCertificateTest, PolicyConstraintsInhibitRequire) {
+  scoped_refptr<ParsedCertificate> cert =
+      ParseCertificateFromFile("policy_constraints_inhibit_require.pem");
+  ASSERT_TRUE(cert);
+
+  EXPECT_TRUE(cert->has_policy_constraints());
+  EXPECT_TRUE(cert->policy_constraints().has_require_explicit_policy);
+  EXPECT_EQ(5, cert->policy_constraints().require_explicit_policy);
+  EXPECT_TRUE(cert->policy_constraints().has_inhibit_policy_mapping);
+  EXPECT_EQ(2, cert->policy_constraints().inhibit_policy_mapping);
+}
+
+// Tests parsing a certificate that has a policyConstraints
+// extension with an empty sequence.
+TEST(ParsedCertificateTest, PolicyConstraintsEmpty) {
+  scoped_refptr<ParsedCertificate> cert =
+      ParseCertificateFromFile("policy_constraints_empty.pem");
+  ASSERT_FALSE(cert);
+}
+
 }  // namespace
 
 }  // namespace net