Add support for certificate name checking

net/base/x509_openssl_util.h

-// Copyright (c) 2006-2008 The Chromium Authors. All rights reserved.
+// Copyright (c) 2010 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_BASE_X509_OPENSSL_UTIL_H_
 #define NET_BASE_X509_OPENSSL_UTIL_H_
 #pragma once
 
 #include <openssl/asn1.h>
 #include <openssl/x509v3.h>
 
 #include <string>
+#include <vector>
 
 namespace base {
 class Time;
 }  // namespace base
 
 namespace net {
 
 // A collection of helper functions to fetch data from OpenSSL X509 certificates
 // into more convenient std / base datatypes.
 namespace x509_openssl_util {
 
 bool ParsePrincipalKeyAndValueByIndex(X509_NAME* name,
                                       int index,
                                       std::string* key,
                                       std::string* value);
 
 bool ParsePrincipalValueByIndex(X509_NAME* name, int index, std::string* value);
 
 bool ParsePrincipalValueByNID(X509_NAME* name, int nid, std::string* value);
 
 bool ParseDate(ASN1_TIME* x509_time, base::Time* time);
 
+// Verifies that |hostname| matches one of the names in |cert_names|, based on
+// TLS name matching rules. The members of |cert_names| must have been

[wtc, 2010/11/03 00:29:49]

Nit: cite the RFC or Internet-Draft that specifies the TLS name matching rules.

[joth, 2010/11/12 18:55:23]

Done.

+// extracted from the Subject CN or SAN fields of a certificate. See also
+// GetDNSNames.
+// TODO(joth): Investigate if we can upstream this into the OpenSSL library,
+// to avoid duplicating this logic across projects.
+bool VerifyHostname(const std::string& hostname,
+                    const std::vector<std::string>& cert_names);
+
 } // namespace x509_openssl_util
 
 } // namespace net
 
 #endif  // NET_BASE_X509_OPENSSL_UTIL_H_