Uprev NSS from 3.18.0 RTM to 3.19.0 RTM

nss/lib/certdb/cert.h

 /* This Source Code Form is subject to the terms of the Mozilla Public
  * License, v. 2.0. If a copy of the MPL was not distributed with this
  * file, You can obtain one at http://mozilla.org/MPL/2.0/. */
 
 /*
  * cert.h - public data structures and prototypes for the certificate library
  */
 
 #ifndef _CERT_H_
 #define _CERT_H_
@@ skipping 1154 matching lines @@
 
 extern CERTPrivKeyUsagePeriod *
 CERT_DecodePrivKeyUsagePeriodExtension(PLArenaPool *arena, SECItem *extnValue);
 
 extern CERTGeneralName *
 CERT_GetNextGeneralName(CERTGeneralName *current);
 
 extern CERTGeneralName *
 CERT_GetPrevGeneralName(CERTGeneralName *current);
 
+/*
+ * Look up name constraints for some certs that do not include name constraints
+ * (Most importantly, root certificates)
+ *
+ * If a matching subject is found, |extensions| will be populated with a copy of the
+ * DER-encoded name constraints extension. The data in |extensions| will point to
+ * memory that the caller owns.
+ *
+ * There is no mechanism to configure imposed name constraints right now.  All
+ * imposed name constraints are built into NSS.
+ */
+SECStatus
+CERT_GetImposedNameConstraints(const SECItem *derSubject, SECItem *extensions);
+
 CERTNameConstraint *
 CERT_GetNextNameConstraint(CERTNameConstraint *current);
 
 CERTNameConstraint *
 CERT_GetPrevNameConstraint(CERTNameConstraint *current);
 
 void
 CERT_DestroyUserNotice(CERTUserNotice *userNotice);
 
 typedef char * (* CERTPolicyStringCallback)(char *org,
@@ skipping 351 matching lines @@
  * Verify name against all the constraints relevant to that type of
  * the name.
  */
 extern SECStatus
 CERT_CheckNameSpace(PLArenaPool          *arena,
                     const CERTNameConstraints *constraints,
                     const CERTGeneralName *currentName);
 
 /*
  * Extract and allocate the name constraints extension from the CA cert.
+ * If the certificate contains no name constraints extension, but
+ * CERT_GetImposedNameConstraints returns a name constraints extension
+ * for the subject of the certificate, then that extension will be returned.
  */
 extern SECStatus
 CERT_FindNameConstraintsExten(PLArenaPool      *arena,
                               CERTCertificate  *cert,
                               CERTNameConstraints **constraints);
 
 /*
  * Initialize a new GERTGeneralName fields (link)
  */
 extern CERTGeneralName *
@@ skipping 104 matching lines @@
 /*
  * Destroy the arrays inside flags,
  * and destroy the object pointed to by flags, too.
  */
 extern void
 CERT_DestroyCERTRevocationFlags(CERTRevocationFlags *flags);
 
 SEC_END_PROTOS
 
 #endif /* _CERT_H_ */