Add policies support to VerifyCertificateChain().

net/third_party/nist-pkits/generate_tests.py

 # Copyright 2016 The Chromium Authors. All rights reserved.
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
 '''Generates a test suite from NIST PKITS test descriptions.
 
 The output is a set of Type Parameterized Tests which are included by
 pkits_unittest.h. See pkits_unittest.h for information on using the tests.
 GoogleTest has a limit of 50 tests per type parameterized testcase, so the tests
 are split up by section number (this also makes it possible to easily skip
@@ skipping 670 matching lines @@
     # The path should validate successfully.
     TestInfo(True, initial_policy_set=[TEST_POLICY_1],
                    user_constrained_policy_set=[TEST_POLICY_1]),
 
     # 2. default settings, but with initial-policy-set = {NIST-test-policy-6}.
     # The path should not validate successfully. 
     TestInfo(False, initial_policy_set=[TEST_POLICY_6],
              user_constrained_policy_set=[]),
   ],
 
+  '4.10.7': [ # Invalid Mapping From anyPolicy Test7 
+    # Procedure: Validate Invalid Mapping From anyPolicy Test7 EE using the
+    # default settings or open and verify Signed Test Message 6.2.2.100 using
+    # the default settings.
+    #
+    # Expected Result: The path should not validate successfully since the
+    # intermediate certificate includes a policy mapping extension in which
+    # anyPolicy appears as an issuerDomainPolicy. 
+    TestInfo(False, user_constrained_policy_set=[]),
+  ],
+
   '4.10.8': [ # Invalid Mapping To anyPolicy Test8
     # Procedure: Validate Invalid Mapping To anyPolicy Test8 EE using the
     # default settings or open and verify Signed Test Message 6.2.2.101 using
     # the default settings.
     #
     # Expected Result: The path should not validate successfully since the
     # intermediate certificate includes a policy mapping extension in which
     # anyPolicy appears as an subjectDomainPolicy.
-    #
-    # TODO(eroman): What should user_constrained_policy_set be?
     TestInfo(False, user_constrained_policy_set=[]),
   ],
 
   '4.10.9': [ # Valid Policy Mapping Test9
     # Procedure: Validate Valid Policy Mapping Test9 EE using the default
     # settings or open and verify Signed Test Message 6.2.2.102 using the
     # default settings.
     #
     # Expected Result: The authorities-constrained-policy-set will be
     # {NIST-test-policy-1} and the explicit-policy-indicator will be set (if
@@ skipping 500 matching lines @@
         continue
       i, parse_test(lines, i, test_case_name, test_number,
                     test_name, sanitized_test_names, output)
 
   if test_case_name:
     finalize_test_case(test_case_name, sanitized_test_names, output)
 
 
 if __name__ == '__main__':
   main()