Add parsing for RFC 5280's PolicyMappings certificate extension.

net/cert/internal/certificate_policies.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include <algorithm>
 
 #include "net/cert/internal/certificate_policies.h"
 
 #include "net/der/input.h"
 #include "net/der/parse_values.h"
@@ skipping 78 matching lines @@
 der::Input InhibitAnyPolicyOid() {
   // From RFC 5280:
   //
   //     id-ce-inhibitAnyPolicy OBJECT IDENTIFIER ::=  { id-ce 54 }
   //
   // In dotted notation: 2.5.29.54
   static const uint8_t oid[] = {0x55, 0x1d, 0x36};
   return der::Input(oid);
 }
 
+der::Input PolicyMappingsOid() {
+  // From RFC 5280:
+  //
+  //     id-ce-policyMappings OBJECT IDENTIFIER ::=  { id-ce 33 }
+  //
+  // In dotted notation: 2.5.29.33
+  static const uint8_t oid[] = {0x55, 0x1d, 0x21};
+  return der::Input(oid);
+}
+
 // RFC 5280 section 4.2.1.4.  Certificate Policies:
 //
 // certificatePolicies ::= SEQUENCE SIZE (1..MAX) OF PolicyInformation
 //
 // PolicyInformation ::= SEQUENCE {
 //      policyIdentifier   CertPolicyId,
 //      policyQualifiers   SEQUENCE SIZE (1..MAX) OF
 //                              PolicyQualifierInfo OPTIONAL }
 //
 // CertPolicyId ::= OBJECT IDENTIFIER
@@ skipping 153 matching lines @@
   if (!parser.ReadUint8(num_certs))
     return false;
 
   // There should be no remaining data.
   if (parser.HasMore())
     return false;
 
   return true;
 }
 
+// From RFC 5280:
+//
+//   PolicyMappings ::= SEQUENCE SIZE (1..MAX) OF SEQUENCE {
+//        issuerDomainPolicy      CertPolicyId,
+//        subjectDomainPolicy     CertPolicyId }
+bool ParsePolicyMappings(const der::Input& policy_mappings_tlv,
+                         std::vector<ParsedPolicyMapping>* mappings) {
+  mappings->clear();
+
+  der::Parser parser(policy_mappings_tlv);
+
+  //   PolicyMappings ::= SEQUENCE SIZE (1..MAX) OF SEQUENCE {
+  der::Parser sequence_parser;
+  if (!parser.ReadSequence(&sequence_parser))
+    return false;
+
+  // Must be at least 1 mapping.
+  if (!sequence_parser.HasMore())
+    return false;
+
+  while (sequence_parser.HasMore()) {
+    der::Parser mapping_parser;
+    if (!sequence_parser.ReadSequence(&mapping_parser))
+      return false;
+
+    ParsedPolicyMapping mapping;
+    if (!mapping_parser.ReadTag(der::kOid, &mapping.issuer_domain_policy))
+      return false;
+    if (!mapping_parser.ReadTag(der::kOid, &mapping.subject_domain_policy))
+      return false;
+
+    // There shouldn't be extra unconsumed data.
+    if (mapping_parser.HasMore())
+      return false;
+
+    mappings->push_back(mapping);
+  }
+
+  // There shouldn't be extra unconsumed data.
+  if (parser.HasMore())
+    return false;
+
+  return true;
+}
+
 }  // namespace net