Class for parsing and evaluating RFC 5280 NameConstraints.

net/cert/internal/verify_name_match.h

Index: net/cert/internal/verify_name_match.h
diff --git a/net/cert/internal/verify_name_match.h b/net/cert/internal/verify_name_match.h
index 99d09f0e1077b7c8781c5de0ccca818c88e0eab7..67ea59e5f460cc7bf9d0f44aefd42701781d7970 100644
--- a/net/cert/internal/verify_name_match.h
+++ b/net/cert/internal/verify_name_match.h
@@ -5,6 +5,7 @@
 #ifndef NET_CERT_INTERNAL_VERIFY_NAME_MATCH_H_
 #define NET_CERT_INTERNAL_VERIFY_NAME_MATCH_H_
 
+#include "base/compiler_specific.h"
 #include "base/strings/string_piece.h"
 #include "net/base/net_export.h"
 
@@ -14,13 +15,36 @@ namespace der {
 class Input;
 }  // namespace der
 
-// Compare DER-encoded X.501 Name values according to RFC 5280 rules.
+// Compares DER-encoded X.501 Name values according to RFC 5280 rules.
 // |a_rdn_sequence| and |b_rdn_sequence| should be the DER-encoded RDNSequence
 // values (not including the Sequence tag).
 // Returns true if |a_rdn_sequence| and |b_rdn_sequence| match.
 NET_EXPORT bool VerifyNameMatch(const der::Input& a_rdn_sequence,
                                 const der::Input& b_rdn_sequence);
 
+// Compares |name_rdn_sequence| and |parent_rdn_sequence| and return true if
+// |name_rdn_sequence| is within the subtree defined by |parent_rdn_sequence| as
+// defined by RFC 5280 section 7.1.  |name_rdn_sequence| and

[Ryan Sleevi, 2015/09/24 22:06:20]

single space

[mattm, 2015/09/30 04:52:32]

Done.

+// |parent_rdn_sequence| should be the DER-encoded sequence values (not
+// including the Sequence tag).
+NET_EXPORT bool VerifyNameInSubtree(const der::Input& name_rdn_sequence,
+                                    const der::Input& parent_rdn_sequence);
+
+// Helper functions:
+
+// Sets |*contained_email_address| to true if |name_rdn_sequence| contains an
+// emailAddress attribute type. Returns false if there was a parsing error.

[Ryan Sleevi, 2015/09/24 22:06:20]

If it doesn't, does it set |*constrained_email_address| to false? Or does it
return true with the value unmutated?

// Sets |*contained_email_address| to indicate whether or not
// |name_rdn_sequence| contains an emailAddress attribute type, and
// returns true. Returns false if |name_rdn_sequence| could not be
// parsed.

[mattm, 2015/09/30 04:52:32]

Reworded. Went with a larger change that reads more natural to me.

+bool NameContainsEmailAddress(const der::Input& name_rdn_sequence,
+                              bool* contained_email_address) WARN_UNUSED_RESULT;
+
+// Extracts and normalizes the commonName attribute from |name_rdn_sequence|
+// and stores in |*normalized_common_name| as UTF-8.
+// Returns false if |name_rdn_sequence| did not contain a commonName or there
+// was a parsing or normalizing error.

[Ryan Sleevi, 2015/09/24 22:06:20]

This makes me even more confused for symmetry with NameContainsEmailAddress -
now I wonder whether or not that function returns false if there was no
emailAddress.

[mattm, 2015/09/30 04:52:32]

modified to also have an explicit contained_common_name return.

+bool GetNormalizedCommonNameFromName(const der::Input& name_rdn_sequence,
+                                     std::string* normalized_common_name)
+    WARN_UNUSED_RESULT;
+
 }  // namespace net
 
 #endif  // NET_CERT_INTERNAL_VERIFY_NAME_MATCH_H_