Add public_key_type() accessor to quic::CertificateView.

This will be used later to disallow RSA certificates in WebTransport hash-based verifier.

PiperOrigin-RevId: 416387139

quic/core/crypto/certificate_view.cc

diff --git a/quic/core/crypto/certificate_view.cc b/quic/core/crypto/certificate_view.cc
index f0b1c18..e920cdb 100644
--- a/quic/core/crypto/certificate_view.cc
+++ b/quic/core/crypto/certificate_view.cc
@@ -49,14 +49,6 @@
 // 2.5.29.17
 constexpr uint8_t kSubjectAltNameOid[] = {0x55, 0x1d, 0x11};
 
-enum class PublicKeyType {
-  kRsa,
-  kP256,
-  kP384,
-  kEd25519,
-  kUnknown,
-};
-
 PublicKeyType PublicKeyTypeFromKey(EVP_PKEY* public_key) {
   switch (EVP_PKEY_id(public_key)) {
     case EVP_PKEY_RSA:
@@ -469,11 +461,13 @@
   }
 }
 
+PublicKeyType CertificateView::public_key_type() {
+  return PublicKeyTypeFromKey(public_key_.get());
+}
+
 bool CertificateView::ValidatePublicKeyParameters() {
-  // The profile here affects what certificates can be used:
-  // (1) when QUIC is used as a server library without any custom certificate
-  //     provider logic,
-  // (2) when QuicTransport is handling self-signed certificates.
+  // The profile here affects what certificates can be used when QUIC is used as
+  // a server library without any custom certificate provider logic.
   // The goal is to allow at minimum any certificate that would be allowed on a
   // regular Web session over TLS 1.3 while ensuring we do not expose any
   // algorithms we don't want to support long-term.

quic/core/crypto/certificate_view.h

diff --git a/quic/core/crypto/certificate_view.h b/quic/core/crypto/certificate_view.h
index f2826cd..4249258 100644
--- a/quic/core/crypto/certificate_view.h
+++ b/quic/core/crypto/certificate_view.h
@@ -34,6 +34,15 @@
 // Reads |input| line-by-line and returns the next available PEM message.
 QUIC_EXPORT_PRIVATE PemReadResult ReadNextPemMessage(std::istream* input);
 
+// Cryptograhpic algorithms recognized in X.509.
+enum class PublicKeyType {
+  kRsa,
+  kP256,
+  kP384,
+  kEd25519,
+  kUnknown,
+};
+
 // CertificateView represents a parsed version of a single X.509 certificate. As
 // the word "view" implies, it does not take ownership of the underlying strings
 // and consists primarily of pointers into the certificate that is passed into
@@ -69,6 +78,9 @@
                        absl::string_view signature,
                        uint16_t signature_algorithm) const;
 
+  // Returns the type of the key used in the certificate's SPKI.
+  PublicKeyType public_key_type();
+
  private:
   CertificateView() = default;
 

quic/core/crypto/certificate_view_test.cc

diff --git a/quic/core/crypto/certificate_view_test.cc b/quic/core/crypto/certificate_view_test.cc
index 5d743b2..33514f2 100644
--- a/quic/core/crypto/certificate_view_test.cc
+++ b/quic/core/crypto/certificate_view_test.cc
@@ -58,6 +58,7 @@
   const QuicWallTime validity_end = QuicWallTime::FromUNIXSeconds(
       *quiche::QuicheUtcDateTimeToUnixSeconds(2020, 2, 2, 18, 13, 59));
   EXPECT_EQ(view->validity_end(), validity_end);
+  EXPECT_EQ(view->public_key_type(), PublicKeyType::kRsa);
 
   EXPECT_EQ("C=US,ST=California,L=Mountain View,O=QUIC Server,CN=127.0.0.1",
             view->GetHumanReadableSubject());