Wire up certificate policies support in PathBuilder.

net/cert/internal/path_builder.cc

 // Copyright 2016 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/internal/path_builder.h"
 
 #include <set>
 #include <unordered_set>
 
 #include "base/logging.h"
 #include "base/memory/ptr_util.h"
 #include "net/base/net_errors.h"
 #include "net/cert/internal/cert_issuer_source.h"
+#include "net/cert/internal/certificate_policies.h"
 #include "net/cert/internal/parse_certificate.h"
 #include "net/cert/internal/parse_name.h"  // For CertDebugString.
 #include "net/cert/internal/signature_policy.h"
 #include "net/cert/internal/trust_store.h"
 #include "net/cert/internal/verify_certificate_chain.h"
 #include "net/cert/internal/verify_name_match.h"
 #include "net/der/parser.h"
 #include "net/der/tag.h"
 
 namespace net {
@@ skipping 513 matching lines @@
     return result_path;
 
   return nullptr;
 }
 
 void CertPathBuilder::Result::Clear() {
   paths.clear();
   best_result_index = 0;
 }
 
-CertPathBuilder::CertPathBuilder(scoped_refptr<ParsedCertificate> cert,
-                                 TrustStore* trust_store,
-                                 const SignaturePolicy* signature_policy,
-                                 const der::GeneralizedTime& time,
-                                 KeyPurpose key_purpose,
-                                 Result* result)
+CertPathBuilder::CertPathBuilder(
+    scoped_refptr<ParsedCertificate> cert,
+    TrustStore* trust_store,
+    const SignaturePolicy* signature_policy,
+    const der::GeneralizedTime& time,
+    KeyPurpose key_purpose,
+    InitialExplicitPolicy initial_explicit_policy,
+    const std::set<der::Input>& user_initial_policy_set,
+    InitialPolicyMappingInhibit initial_policy_mapping_inhibit,
+    InitialAnyPolicyInhibit initial_any_policy_inhibit,
+    Result* result)
     : cert_path_iter_(new CertPathIter(std::move(cert), trust_store)),
       signature_policy_(signature_policy),
       time_(time),
       key_purpose_(key_purpose),
+      initial_explicit_policy_(initial_explicit_policy),
+      user_initial_policy_set_(user_initial_policy_set),
+      initial_policy_mapping_inhibit_(initial_policy_mapping_inhibit),
+      initial_any_policy_inhibit_(initial_any_policy_inhibit),
       next_state_(STATE_NONE),
       out_result_(result) {
   result->Clear();
   // The TrustStore also implements the CertIssuerSource interface.
   AddCertIssuerSource(trust_store);
 }
 
 CertPathBuilder::~CertPathBuilder() {}
 
 void CertPathBuilder::AddCertIssuerSource(
@@ skipping 30 matching lines @@
 
 void CertPathBuilder::DoGetNextPathComplete() {
   if (next_path_.IsEmpty()) {
     // No more paths to check, signal completion.
     next_state_ = STATE_NONE;
     return;
   }
 
   // Verify the entire certificate chain.
   auto result_path = base::MakeUnique<ResultPath>();
-  // TODO(eroman): don't pass placeholder for policy.
   VerifyCertificateChain(
       next_path_.certs, next_path_.last_cert_trust, signature_policy_, time_,
-      key_purpose_, InitialExplicitPolicy::kFalse, {AnyPolicy()},
-      InitialPolicyMappingInhibit::kFalse, InitialAnyPolicyInhibit::kFalse,
-      nullptr /*user_constrained_policy_set*/, &result_path->errors);
+      key_purpose_, initial_explicit_policy_, user_initial_policy_set_,
+      initial_policy_mapping_inhibit_, initial_any_policy_inhibit_,
+      &result_path->user_constrained_policy_set, &result_path->errors);
   bool verify_result = !result_path->errors.ContainsHighSeverityErrors();
 
   DVLOG(1) << "CertPathBuilder VerifyCertificateChain result = "
            << verify_result << "\n"
            << result_path->errors.ToDebugString(next_path_.certs);
   result_path->path = next_path_;
   AddResultPath(std::move(result_path));
 
   if (verify_result) {
     // Found a valid path, return immediately.
@@ skipping 10 matching lines @@
 
 void CertPathBuilder::AddResultPath(std::unique_ptr<ResultPath> result_path) {
   // TODO(mattm): set best_result_index based on number or severity of errors.
   if (result_path->IsValid())
     out_result_->best_result_index = out_result_->paths.size();
   // TODO(mattm): add flag to only return a single path or all attempted paths?
   out_result_->paths.push_back(std::move(result_path));
 }
 
 }  // namespace net