Reject certificates that contain unknown policy qualifiers if the

net/cert/internal/certificate_policies.h

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_CERT_INTERNAL_CERTIFICATE_POLICIES_H_
 #define NET_CERT_INTERNAL_CERTIFICATE_POLICIES_H_
 
 #include <stdint.h>
 
 #include <vector>
@@ skipping 16 matching lines @@
 NET_EXPORT der::Input InhibitAnyPolicyOid();
 
 // From RFC 5280:
 //
 //     id-ce-policyMappings OBJECT IDENTIFIER ::=  { id-ce 33 }
 //
 // In dotted notation: 2.5.29.33
 NET_EXPORT der::Input PolicyMappingsOid();
 
 // Parses a certificatePolicies extension and stores the policy OIDs in
-// |*policies|, in sorted order. If policyQualifiers are present,
-// they are ignored. (RFC 5280 section 4.2.1.4 says "optional qualifiers, which
-// MAY be present, are not expected to change the definition of the policy.",
-// furthermore policyQualifiers do not affect the success or failure of the
-// section 6 Certification Path Validation algorithm.)
+// |*policies|, in sorted order.
+//
+// If policyQualifiers for User Notice or CPS are present then they are
+// ignored (RFC 5280 section 4.2.1.4 says "optional qualifiers, which MAY
+// be present, are not expected to change the definition of the policy."
+//
+// If a policy qualifier other than User Notice/CPS is present, parsing
+// will fail if |fail_parsing_unknown_qualifier_oids| was set to true,
+// otherwise the unrecognized qualifiers wil be skipped and not parsed
+// any further.
 //
 // The returned values is only valid as long as |extension_value| is.
 NET_EXPORT bool ParseCertificatePoliciesExtension(
     const der::Input& extension_value,
+    bool fail_parsing_unknown_qualifier_oids,
     std::vector<der::Input>* policies);
 
 struct ParsedPolicyConstraints {
   bool has_require_explicit_policy = false;
   uint8_t require_explicit_policy = 0;
 
   bool has_inhibit_policy_mapping = false;
   uint8_t inhibit_policy_mapping = 0;
 };
 
@@ skipping 15 matching lines @@
 
 // Parses a PolicyMappings SEQUENCE as defined by RFC 5280. Returns true on
 // success, and sets |mappings|.
 NET_EXPORT bool ParsePolicyMappings(const der::Input& policy_mappings_tlv,
                                     std::vector<ParsedPolicyMapping>* mappings)
     WARN_UNUSED_RESULT;
 
 }  // namespace net
 
 #endif  // NET_CERT_INTERNAL_CERTIFICATE_POLICIES_H_