Class for parsing and evaluating RFC 5280 NameConstraints.

net/cert/internal/test_helpers.h

Index: net/cert/internal/test_helpers.h
diff --git a/net/cert/internal/test_helpers.h b/net/cert/internal/test_helpers.h
index d10148191a4f8a1bb6c9a05ebaa2edaea3c291c5..ad010caa4139da0d4f57932ed6cc5ad97af7295c 100644
--- a/net/cert/internal/test_helpers.h
+++ b/net/cert/internal/test_helpers.h
@@ -33,6 +33,13 @@ bool operator==(const Input& a, const Input& b);
 // from accidentally passing an r-value.
 der::Input InputFromString(const std::string* s);
 
+// Parses |s| as a DER Sequence TLV and returns a der::Input corresponding to

[Ryan Sleevi, 2015/09/24 22:06:20]

s/Sequence/SEQUENCE/

[mattm, 2015/09/30 04:52:32]

Done.

+// the value portion. On error returns an empty der::Input and adds a gtest
+// failure.
+//
+// Returned value's lifetime validity is the same as for InputFromString.

[Ryan Sleevi, 2015/09/24 22:06:20]

Rather than back-reference to another function, it'd be helpful to be explicit
here.

[mattm, 2015/09/30 04:52:32]

Done.

+der::Input SequenceValueFromString(const std::string* s);

[Ryan Sleevi, 2015/09/24 22:06:20]

It's not entirely clear to me why this is needed; could you explain?

[mattm, 2015/09/30 04:52:32]

Depending on the context, Names can be implicitly tagged, or tagged normally as
a sequence. So the methods take only the value part. The test data is generated
as a normal sequence, so this helper is needed to extract the sequence value. We
could have the test data be just the sequence value, but there doesn't seem to
be a way with openssl asn1parse to do that directly so it'd require a bit of
extra hacking in the test data generation script.

+
 // Helper structure that maps a PEM block header (for instance "CERTIFICATE") to
 // the destination where the value for that block should be written.
 struct PemBlockMapping {