Class for parsing and evaluating RFC 5280 NameConstraints.

net/cert/internal/verify_name_match.h

Index: net/cert/internal/verify_name_match.h
diff --git a/net/cert/internal/verify_name_match.h b/net/cert/internal/verify_name_match.h
index 99d09f0e1077b7c8781c5de0ccca818c88e0eab7..5de0e9d7e45033116bfa03189f990e97692b7311 100644
--- a/net/cert/internal/verify_name_match.h
+++ b/net/cert/internal/verify_name_match.h
@@ -21,6 +21,25 @@ class Input;
 NET_EXPORT bool VerifyNameMatch(const der::Input& a_rdn_sequence,
                                 const der::Input& b_rdn_sequence);
 
+// Compare |name_rdn_sequence| and |parent_rdn_sequence| and return true if
+// |name_rdn_sequence| is within the subtree defined by |parent_rdn_sequence| as
+// defined by RFC 5280 section 7.1.  |name_rdn_sequence| and
+// |parent_rdn_sequence| should be the DER-encoded sequence values (not
+// including the Sequence tag).
+NET_EXPORT bool VerifyNameInSubtree(const der::Input& name_rdn_sequence,
+                                    const der::Input& parent_rdn_sequence);
+
+// Helper functions:
+
+// Returns true if |name_rdn_sequence| contains an emailAddress attribute type.
+bool NameContainsEmailAddress(const der::Input& name_rdn_sequence);
+
+// Returns the commonName attribute from |name_rdn_sequence| in normalized
+// UTF-8, or an empty string if |name_rdn_sequence| did not contain a commonName
+// or there was a parsing or normalizing error.
+std::string GetNormalizedCommonNameFromName(
+    const der::Input& name_rdn_sequence);
+
 }  // namespace net
 
 #endif  // NET_CERT_INTERNAL_VERIFY_NAME_MATCH_H_