Fix API mismatch between NameConstraints::IsPermittedCert's subjectAltName param and ParseExtension.

net/cert/internal/name_constraints_unittest.cc

 // Copyright 2015 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #include "net/cert/internal/name_constraints.h"
 
 #include "net/cert/internal/test_helpers.h"
 #include "testing/gtest/include/gtest/gtest.h"
 
 namespace net {
@@ skipping 105 matching lines @@
   EXPECT_TRUE(name_constraints->IsPermittedDNSName("permitted.example3.com."));
   EXPECT_TRUE(name_constraints->IsPermittedDNSName("a.permitted.example3.com"));
   EXPECT_TRUE(
       name_constraints->IsPermittedDNSName("a.permitted.example3.com."));
 
   EXPECT_EQ(GENERAL_NAME_DNS_NAME, name_constraints->ConstrainedNameTypes());
 
   std::string san;
   ASSERT_TRUE(LoadTestSubjectAltName("san-permitted.pem", &san));
   EXPECT_TRUE(
-      name_constraints->IsPermittedCert(der::Input(), der::Input(&san)));
+      name_constraints->IsPermittedCert(der::Input(), true, der::Input(&san)));
 
   ASSERT_TRUE(LoadTestSubjectAltName("san-excluded-dnsname.pem", &san));
   EXPECT_FALSE(
-      name_constraints->IsPermittedCert(der::Input(), der::Input(&san)));
+      name_constraints->IsPermittedCert(der::Input(), true, der::Input(&san)));
 
   ASSERT_TRUE(LoadTestSubjectAltName("san-excluded-directoryname.pem", &san));
   EXPECT_TRUE(
-      name_constraints->IsPermittedCert(der::Input(), der::Input(&san)));
+      name_constraints->IsPermittedCert(der::Input(), true, der::Input(&san)));
 
   ASSERT_TRUE(LoadTestSubjectAltName("san-excluded-ipaddress.pem", &san));
   EXPECT_TRUE(
-      name_constraints->IsPermittedCert(der::Input(), der::Input(&san)));
+      name_constraints->IsPermittedCert(der::Input(), true, der::Input(&san)));
 }
 
 TEST_P(ParseNameConstraints,
        DNSNamesWithMultipleLevelsBetweenExcludedAndPermitted) {
   std::string a;
   ASSERT_TRUE(LoadTestNameConstraint("dnsname2.pem", &a));
   scoped_ptr<NameConstraints> name_constraints(
       NameConstraints::CreateFromDer(der::Input(&a), is_critical()));
   ASSERT_TRUE(name_constraints);
 
@@ skipping 151 matching lines @@
       SequenceValueFromString(&name_jp)));
   // Within the permitted C=JP,ST=Tokyo subtree.
   EXPECT_TRUE(name_constraints->IsPermittedDirectoryName(
       SequenceValueFromString(&name_jp_tokyo)));
 
   EXPECT_EQ(GENERAL_NAME_DIRECTORY_NAME,
             name_constraints->ConstrainedNameTypes());
 
   // Within the permitted C=US subtree.
   EXPECT_TRUE(name_constraints->IsPermittedCert(
-      SequenceValueFromString(&name_us), der::Input()));
+      SequenceValueFromString(&name_us), false, der::Input()));
   // Within the permitted C=US subtree, however the excluded C=US,ST=California
   // subtree takes priority.
   EXPECT_FALSE(name_constraints->IsPermittedCert(
-      SequenceValueFromString(&name_us_ca), der::Input()));
+      SequenceValueFromString(&name_us_ca), false, der::Input()));
 
   std::string san;
   ASSERT_TRUE(LoadTestSubjectAltName("san-permitted.pem", &san));
   EXPECT_TRUE(
-      name_constraints->IsPermittedCert(der::Input(), der::Input(&san)));
+      name_constraints->IsPermittedCert(der::Input(), true, der::Input(&san)));
 
   ASSERT_TRUE(LoadTestSubjectAltName("san-excluded-dnsname.pem", &san));
   EXPECT_TRUE(
-      name_constraints->IsPermittedCert(der::Input(), der::Input(&san)));
+      name_constraints->IsPermittedCert(der::Input(), true, der::Input(&san)));
 
   ASSERT_TRUE(LoadTestSubjectAltName("san-excluded-directoryname.pem", &san));
   EXPECT_FALSE(
-      name_constraints->IsPermittedCert(der::Input(), der::Input(&san)));
+      name_constraints->IsPermittedCert(der::Input(), true, der::Input(&san)));
 
   ASSERT_TRUE(LoadTestSubjectAltName("san-excluded-ipaddress.pem", &san));
   EXPECT_TRUE(
-      name_constraints->IsPermittedCert(der::Input(), der::Input(&san)));
+      name_constraints->IsPermittedCert(der::Input(), true, der::Input(&san)));
 }
 
 TEST_P(ParseNameConstraints, DirectoryNamesExcludeOnly) {
   std::string constraints_der;
   ASSERT_TRUE(
       LoadTestNameConstraint("directoryname-excluded.pem", &constraints_der));
   scoped_ptr<NameConstraints> name_constraints(NameConstraints::CreateFromDer(
       der::Input(&constraints_der), is_critical()));
   ASSERT_TRUE(name_constraints);
 
@@ skipping 195 matching lines @@
     const uint8_t ip6[] = {1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 10, 5, 33, 0, 1};
     EXPECT_FALSE(name_constraints->IsPermittedIP(
         IPAddressNumber(ip6, ip6 + arraysize(ip6))));
   }
 
   EXPECT_EQ(GENERAL_NAME_IP_ADDRESS, name_constraints->ConstrainedNameTypes());
 
   std::string san;
   ASSERT_TRUE(LoadTestSubjectAltName("san-permitted.pem", &san));
   EXPECT_TRUE(
-      name_constraints->IsPermittedCert(der::Input(), der::Input(&san)));
+      name_constraints->IsPermittedCert(der::Input(), true, der::Input(&san)));
 
   ASSERT_TRUE(LoadTestSubjectAltName("san-excluded-dnsname.pem", &san));
   EXPECT_TRUE(
-      name_constraints->IsPermittedCert(der::Input(), der::Input(&san)));
+      name_constraints->IsPermittedCert(der::Input(), true, der::Input(&san)));
 
   ASSERT_TRUE(LoadTestSubjectAltName("san-excluded-directoryname.pem", &san));
   EXPECT_TRUE(
-      name_constraints->IsPermittedCert(der::Input(), der::Input(&san)));
+      name_constraints->IsPermittedCert(der::Input(), true, der::Input(&san)));
 
   ASSERT_TRUE(LoadTestSubjectAltName("san-excluded-ipaddress.pem", &san));
   EXPECT_FALSE(
-      name_constraints->IsPermittedCert(der::Input(), der::Input(&san)));
+      name_constraints->IsPermittedCert(der::Input(), true, der::Input(&san)));
 }
 
 TEST_P(ParseNameConstraints, IPAdressesExcludeOnly) {
   std::string a;
   ASSERT_TRUE(LoadTestNameConstraint("ipaddress-excluded.pem", &a));
 
   scoped_ptr<NameConstraints> name_constraints(
       NameConstraints::CreateFromDer(der::Input(&a), is_critical()));
   ASSERT_TRUE(name_constraints);
 
@@ skipping 225 matching lines @@
 
   if (is_critical()) {
     EXPECT_EQ(GENERAL_NAME_OTHER_NAME,
               name_constraints->ConstrainedNameTypes());
   } else {
     EXPECT_EQ(0, name_constraints->ConstrainedNameTypes());
   }
 
   std::string san;
   ASSERT_TRUE(LoadTestSubjectAltName("san-othername.pem", &san));
-  EXPECT_EQ(!is_critical(),
-            name_constraints->IsPermittedCert(der::Input(), der::Input(&san)));
+  EXPECT_EQ(!is_critical(), name_constraints->IsPermittedCert(
+                                der::Input(), true, der::Input(&san)));
 }
 
 TEST_P(ParseNameConstraints, OtherNamesInExcluded) {
   std::string constraints_der;
   ASSERT_TRUE(
       LoadTestNameConstraint("othername-excluded.pem", &constraints_der));
   scoped_ptr<NameConstraints> name_constraints(NameConstraints::CreateFromDer(
       der::Input(&constraints_der), is_critical()));
   ASSERT_TRUE(name_constraints);
 
   if (is_critical()) {
     EXPECT_EQ(GENERAL_NAME_OTHER_NAME,
               name_constraints->ConstrainedNameTypes());
   } else {
     EXPECT_EQ(0, name_constraints->ConstrainedNameTypes());
   }
 
   std::string san;
   ASSERT_TRUE(LoadTestSubjectAltName("san-othername.pem", &san));
-  EXPECT_EQ(!is_critical(),
-            name_constraints->IsPermittedCert(der::Input(), der::Input(&san)));
+  EXPECT_EQ(!is_critical(), name_constraints->IsPermittedCert(
+                                der::Input(), true, der::Input(&san)));
 }
 
 TEST_P(ParseNameConstraints, Rfc822NamesInPermitted) {
   std::string constraints_der;
   ASSERT_TRUE(
       LoadTestNameConstraint("rfc822name-permitted.pem", &constraints_der));
   scoped_ptr<NameConstraints> name_constraints(NameConstraints::CreateFromDer(
       der::Input(&constraints_der), is_critical()));
   ASSERT_TRUE(name_constraints);
 
   if (is_critical()) {
     EXPECT_EQ(GENERAL_NAME_RFC822_NAME,
               name_constraints->ConstrainedNameTypes());
   } else {
     EXPECT_EQ(0, name_constraints->ConstrainedNameTypes());
   }
 
   std::string san;
   ASSERT_TRUE(LoadTestSubjectAltName("san-rfc822name.pem", &san));
-  EXPECT_EQ(!is_critical(),
-            name_constraints->IsPermittedCert(der::Input(), der::Input(&san)));
+  EXPECT_EQ(!is_critical(), name_constraints->IsPermittedCert(
+                                der::Input(), true, der::Input(&san)));
 }
 
 TEST_P(ParseNameConstraints, Rfc822NamesInExcluded) {
   std::string constraints_der;
   ASSERT_TRUE(
       LoadTestNameConstraint("rfc822name-excluded.pem", &constraints_der));
   scoped_ptr<NameConstraints> name_constraints(NameConstraints::CreateFromDer(
       der::Input(&constraints_der), is_critical()));
   ASSERT_TRUE(name_constraints);
 
   if (is_critical()) {
     EXPECT_EQ(GENERAL_NAME_RFC822_NAME,
               name_constraints->ConstrainedNameTypes());
   } else {
     EXPECT_EQ(0, name_constraints->ConstrainedNameTypes());
   }
 
   std::string san;
   ASSERT_TRUE(LoadTestSubjectAltName("san-rfc822name.pem", &san));
-  EXPECT_EQ(!is_critical(),
-            name_constraints->IsPermittedCert(der::Input(), der::Input(&san)));
+  EXPECT_EQ(!is_critical(), name_constraints->IsPermittedCert(
+                                der::Input(), true, der::Input(&san)));
 }
 
 TEST_P(ParseNameConstraints, X400AddresssInPermitted) {
   std::string constraints_der;
   ASSERT_TRUE(
       LoadTestNameConstraint("x400address-permitted.pem", &constraints_der));
   scoped_ptr<NameConstraints> name_constraints(NameConstraints::CreateFromDer(
       der::Input(&constraints_der), is_critical()));
   ASSERT_TRUE(name_constraints);
 
   if (is_critical()) {
     EXPECT_EQ(GENERAL_NAME_X400_ADDRESS,
               name_constraints->ConstrainedNameTypes());
   } else {
     EXPECT_EQ(0, name_constraints->ConstrainedNameTypes());
   }
 
   std::string san;
   ASSERT_TRUE(LoadTestSubjectAltName("san-x400address.pem", &san));
-  EXPECT_EQ(!is_critical(),
-            name_constraints->IsPermittedCert(der::Input(), der::Input(&san)));
+  EXPECT_EQ(!is_critical(), name_constraints->IsPermittedCert(
+                                der::Input(), true, der::Input(&san)));
 }
 
 TEST_P(ParseNameConstraints, X400AddresssInExcluded) {
   std::string constraints_der;
   ASSERT_TRUE(
       LoadTestNameConstraint("x400address-excluded.pem", &constraints_der));
   scoped_ptr<NameConstraints> name_constraints(NameConstraints::CreateFromDer(
       der::Input(&constraints_der), is_critical()));
   ASSERT_TRUE(name_constraints);
 
   if (is_critical()) {
     EXPECT_EQ(GENERAL_NAME_X400_ADDRESS,
               name_constraints->ConstrainedNameTypes());
   } else {
     EXPECT_EQ(0, name_constraints->ConstrainedNameTypes());
   }
 
   std::string san;
   ASSERT_TRUE(LoadTestSubjectAltName("san-x400address.pem", &san));
-  EXPECT_EQ(!is_critical(),
-            name_constraints->IsPermittedCert(der::Input(), der::Input(&san)));
+  EXPECT_EQ(!is_critical(), name_constraints->IsPermittedCert(
+                                der::Input(), true, der::Input(&san)));
 }
 
 TEST_P(ParseNameConstraints, EdiPartyNamesInPermitted) {
   std::string constraints_der;
   ASSERT_TRUE(
       LoadTestNameConstraint("edipartyname-permitted.pem", &constraints_der));
   scoped_ptr<NameConstraints> name_constraints(NameConstraints::CreateFromDer(
       der::Input(&constraints_der), is_critical()));
   ASSERT_TRUE(name_constraints);
 
   if (is_critical()) {
     EXPECT_EQ(GENERAL_NAME_EDI_PARTY_NAME,
               name_constraints->ConstrainedNameTypes());
   } else {
     EXPECT_EQ(0, name_constraints->ConstrainedNameTypes());
   }
 
   std::string san;
   ASSERT_TRUE(LoadTestSubjectAltName("san-edipartyname.pem", &san));
-  EXPECT_EQ(!is_critical(),
-            name_constraints->IsPermittedCert(der::Input(), der::Input(&san)));
+  EXPECT_EQ(!is_critical(), name_constraints->IsPermittedCert(
+                                der::Input(), true, der::Input(&san)));
 }
 
 TEST_P(ParseNameConstraints, EdiPartyNamesInExcluded) {
   std::string constraints_der;
   ASSERT_TRUE(
       LoadTestNameConstraint("edipartyname-excluded.pem", &constraints_der));
   scoped_ptr<NameConstraints> name_constraints(NameConstraints::CreateFromDer(
       der::Input(&constraints_der), is_critical()));
   ASSERT_TRUE(name_constraints);
 
   if (is_critical()) {
     EXPECT_EQ(GENERAL_NAME_EDI_PARTY_NAME,
               name_constraints->ConstrainedNameTypes());
   } else {
     EXPECT_EQ(0, name_constraints->ConstrainedNameTypes());
   }
 
   std::string san;
   ASSERT_TRUE(LoadTestSubjectAltName("san-edipartyname.pem", &san));
-  EXPECT_EQ(!is_critical(),
-            name_constraints->IsPermittedCert(der::Input(), der::Input(&san)));
+  EXPECT_EQ(!is_critical(), name_constraints->IsPermittedCert(
+                                der::Input(), true, der::Input(&san)));
 }
 
 TEST_P(ParseNameConstraints, URIsInPermitted) {
   std::string constraints_der;
   ASSERT_TRUE(LoadTestNameConstraint("uri-permitted.pem", &constraints_der));
   scoped_ptr<NameConstraints> name_constraints(NameConstraints::CreateFromDer(
       der::Input(&constraints_der), is_critical()));
   ASSERT_TRUE(name_constraints);
 
   if (is_critical()) {
     EXPECT_EQ(GENERAL_NAME_UNIFORM_RESOURCE_IDENTIFIER,
               name_constraints->ConstrainedNameTypes());
   } else {
     EXPECT_EQ(0, name_constraints->ConstrainedNameTypes());
   }
 
   std::string san;
   ASSERT_TRUE(LoadTestSubjectAltName("san-uri.pem", &san));
-  EXPECT_EQ(!is_critical(),
-            name_constraints->IsPermittedCert(der::Input(), der::Input(&san)));
+  EXPECT_EQ(!is_critical(), name_constraints->IsPermittedCert(
+                                der::Input(), true, der::Input(&san)));
 }
 
 TEST_P(ParseNameConstraints, URIsInExcluded) {
   std::string constraints_der;
   ASSERT_TRUE(LoadTestNameConstraint("uri-excluded.pem", &constraints_der));
   scoped_ptr<NameConstraints> name_constraints(NameConstraints::CreateFromDer(
       der::Input(&constraints_der), is_critical()));
   ASSERT_TRUE(name_constraints);
 
   if (is_critical()) {
     EXPECT_EQ(GENERAL_NAME_UNIFORM_RESOURCE_IDENTIFIER,
               name_constraints->ConstrainedNameTypes());
   } else {
     EXPECT_EQ(0, name_constraints->ConstrainedNameTypes());
   }
 
   std::string san;
   ASSERT_TRUE(LoadTestSubjectAltName("san-uri.pem", &san));
-  EXPECT_EQ(!is_critical(),
-            name_constraints->IsPermittedCert(der::Input(), der::Input(&san)));
+  EXPECT_EQ(!is_critical(), name_constraints->IsPermittedCert(
+                                der::Input(), true, der::Input(&san)));
 }
 
 TEST_P(ParseNameConstraints, RegisteredIDsInPermitted) {
   std::string constraints_der;
   ASSERT_TRUE(
       LoadTestNameConstraint("registeredid-permitted.pem", &constraints_der));
   scoped_ptr<NameConstraints> name_constraints(NameConstraints::CreateFromDer(
       der::Input(&constraints_der), is_critical()));
   ASSERT_TRUE(name_constraints);
 
   if (is_critical()) {
     EXPECT_EQ(GENERAL_NAME_REGISTERED_ID,
               name_constraints->ConstrainedNameTypes());
   } else {
     EXPECT_EQ(0, name_constraints->ConstrainedNameTypes());
   }
 
   std::string san;
   ASSERT_TRUE(LoadTestSubjectAltName("san-registeredid.pem", &san));
-  EXPECT_EQ(!is_critical(),
-            name_constraints->IsPermittedCert(der::Input(), der::Input(&san)));
+  EXPECT_EQ(!is_critical(), name_constraints->IsPermittedCert(
+                                der::Input(), true, der::Input(&san)));
 }
 
 TEST_P(ParseNameConstraints, RegisteredIDsInExcluded) {
   std::string constraints_der;
   ASSERT_TRUE(
       LoadTestNameConstraint("registeredid-excluded.pem", &constraints_der));
   scoped_ptr<NameConstraints> name_constraints(NameConstraints::CreateFromDer(
       der::Input(&constraints_der), is_critical()));
   ASSERT_TRUE(name_constraints);
 
   if (is_critical()) {
     EXPECT_EQ(GENERAL_NAME_REGISTERED_ID,
               name_constraints->ConstrainedNameTypes());
   } else {
     EXPECT_EQ(0, name_constraints->ConstrainedNameTypes());
   }
 
   std::string san;
   ASSERT_TRUE(LoadTestSubjectAltName("san-registeredid.pem", &san));
-  EXPECT_EQ(!is_critical(),
-            name_constraints->IsPermittedCert(der::Input(), der::Input(&san)));
+  EXPECT_EQ(!is_critical(), name_constraints->IsPermittedCert(
+                                der::Input(), true, der::Input(&san)));
 }
 
 TEST_P(ParseNameConstraints,
        failsOnGeneralSubtreeWithMinimumZeroEncodedUnnecessarily) {
   std::string constraints_der;
   ASSERT_TRUE(
       LoadTestNameConstraint("dnsname-with_min_0.pem", &constraints_der));
   // The value should not be in the DER encoding if it is the default. But this
   // could be changed to allowed if there are buggy encoders out there that
   // include it anyway.
@@ skipping 70 matching lines @@
       der::Input(&constraints_der), is_critical()));
   ASSERT_TRUE(name_constraints);
 
   std::string name_us_arizona_email;
   ASSERT_TRUE(
       LoadTestName("name-us-arizona-email.pem", &name_us_arizona_email));
 
   // Name constraints don't contain rfc822Name, so emailAddress in subject is
   // allowed regardless.
   EXPECT_TRUE(name_constraints->IsPermittedCert(
-      SequenceValueFromString(&name_us_arizona_email), der::Input()));
+      SequenceValueFromString(&name_us_arizona_email), false, der::Input()));
 }
 
 TEST_P(ParseNameConstraints, IsPermittedCertSubjectEmailAddressIsNotOk) {
   std::string constraints_der;
   ASSERT_TRUE(
       LoadTestNameConstraint("rfc822name-permitted.pem", &constraints_der));
   scoped_ptr<NameConstraints> name_constraints(NameConstraints::CreateFromDer(
       der::Input(&constraints_der), is_critical()));
   ASSERT_TRUE(name_constraints);
 
   std::string name_us_arizona_email;
   ASSERT_TRUE(
       LoadTestName("name-us-arizona-email.pem", &name_us_arizona_email));
 
   // Name constraints contain rfc822Name, so emailAddress in subject is not
   // allowed if the constraints were critical.
-  EXPECT_EQ(!is_critical(),
-            name_constraints->IsPermittedCert(
-                SequenceValueFromString(&name_us_arizona_email), der::Input()));
+  EXPECT_EQ(!is_critical(), name_constraints->IsPermittedCert(
+                                SequenceValueFromString(&name_us_arizona_email),
+                                false, der::Input()));
 }
 
 // Hostname in commonName is not allowed (crbug.com/308330), so these are tests
 // are not particularly interesting, just verifying that the commonName is
 // ignored for dNSName constraints.
 TEST_P(ParseNameConstraints, IsPermittedCertSubjectDnsNames) {
   std::string constraints_der;
   ASSERT_TRUE(LoadTestNameConstraint("directoryname_and_dnsname.pem",
                                      &constraints_der));
   scoped_ptr<NameConstraints> name_constraints(NameConstraints::CreateFromDer(
       der::Input(&constraints_der), is_critical()));
   ASSERT_TRUE(name_constraints);
 
   std::string name_us_az_foocom;
   ASSERT_TRUE(LoadTestName("name-us-arizona-foo.com.pem", &name_us_az_foocom));
   // The subject is within permitted directoryName constraints, so permitted.
   // (The commonName hostname is not within permitted dNSName constraints, so
   // this would not be permitted if hostnames in commonName were checked.)
   EXPECT_TRUE(name_constraints->IsPermittedCert(
-      SequenceValueFromString(&name_us_az_foocom), der::Input()));
+      SequenceValueFromString(&name_us_az_foocom), false, der::Input()));
 
   std::string name_us_az_permitted;
   ASSERT_TRUE(LoadTestName("name-us-arizona-permitted.example.com.pem",
                            &name_us_az_permitted));
   // The subject is in permitted directoryName and the commonName is within
   // permitted dNSName constraints, so this should be permitted regardless if
   // hostnames in commonName are checked or not.
   EXPECT_TRUE(name_constraints->IsPermittedCert(
-      SequenceValueFromString(&name_us_az_permitted), der::Input()));
+      SequenceValueFromString(&name_us_az_permitted), false, der::Input()));
 
   std::string name_us_ca_permitted;
   ASSERT_TRUE(LoadTestName("name-us-california-permitted.example.com.pem",
                            &name_us_ca_permitted));
   // The subject is within the excluded C=US,ST=California directoryName, so
   // this should not be allowed, regardless of checking the
   // permitted.example.com in commonName.
   EXPECT_FALSE(name_constraints->IsPermittedCert(
-      SequenceValueFromString(&name_us_ca_permitted), der::Input()));
+      SequenceValueFromString(&name_us_ca_permitted), false, der::Input()));
 }
 
 // IP addresses in commonName are not allowed (crbug.com/308330), so these are
 // tests are not particularly interesting, just verifying that the commonName is
 // ignored for iPAddress constraints.
 TEST_P(ParseNameConstraints, IsPermittedCertSubjectIpAddresses) {
   std::string constraints_der;
   ASSERT_TRUE(LoadTestNameConstraint(
       "directoryname_and_dnsname_and_ipaddress.pem", &constraints_der));
   scoped_ptr<NameConstraints> name_constraints(NameConstraints::CreateFromDer(
       der::Input(&constraints_der), is_critical()));
   ASSERT_TRUE(name_constraints);
 
   std::string name_us_az_1_1_1_1;
   ASSERT_TRUE(LoadTestName("name-us-arizona-1.1.1.1.pem", &name_us_az_1_1_1_1));
   // The subject is within permitted directoryName constraints, so permitted.
   // (The commonName IP address is not within permitted iPAddresses constraints,
   // so this would not be permitted if IP addresses in commonName were checked.)
   EXPECT_TRUE(name_constraints->IsPermittedCert(
-      SequenceValueFromString(&name_us_az_1_1_1_1), der::Input()));
+      SequenceValueFromString(&name_us_az_1_1_1_1), false, der::Input()));
 
   std::string name_us_az_192_168_1_1;
   ASSERT_TRUE(
       LoadTestName("name-us-arizona-192.168.1.1.pem", &name_us_az_192_168_1_1));
   // The subject is in permitted directoryName and the commonName is within
   // permitted iPAddress constraints, so this should be permitted regardless if
   // IP addresses in commonName are checked or not.
   EXPECT_TRUE(name_constraints->IsPermittedCert(
-      SequenceValueFromString(&name_us_az_192_168_1_1), der::Input()));
+      SequenceValueFromString(&name_us_az_192_168_1_1), false, der::Input()));
 
   std::string name_us_ca_192_168_1_1;
   ASSERT_TRUE(LoadTestName("name-us-california-192.168.1.1.pem",
                            &name_us_ca_192_168_1_1));
   // The subject is within the excluded C=US,ST=California directoryName, so
   // this should not be allowed, regardless of checking the
   // IP address in commonName.
   EXPECT_FALSE(name_constraints->IsPermittedCert(
-      SequenceValueFromString(&name_us_ca_192_168_1_1), der::Input()));
+      SequenceValueFromString(&name_us_ca_192_168_1_1), false, der::Input()));
 
   std::string name_us_az_ipv6;
   ASSERT_TRUE(LoadTestName("name-us-arizona-ipv6.pem", &name_us_az_ipv6));
   // The subject is within permitted directoryName constraints, so permitted.
   // (The commonName is an ipv6 address which wasn't supported in the past, but
   // since commonName checking is ignored entirely, this is permitted.)
   EXPECT_TRUE(name_constraints->IsPermittedCert(
-      SequenceValueFromString(&name_us_az_ipv6), der::Input()));
+      SequenceValueFromString(&name_us_az_ipv6), false, der::Input()));
 }
 
 TEST_P(ParseNameConstraints, IsPermittedCertFailsOnEmptySubjectAltName) {
   std::string constraints_der;
   ASSERT_TRUE(LoadTestNameConstraint("dnsname.pem", &constraints_der));
   scoped_ptr<NameConstraints> name_constraints(NameConstraints::CreateFromDer(
       der::Input(&constraints_der), is_critical()));
   ASSERT_TRUE(name_constraints);
 
   std::string name_us_az;
   ASSERT_TRUE(LoadTestName("name-us-arizona.pem", &name_us_az));
 
   // No constraints on directoryName type, so name_us_az should be allowed when
   // subjectAltName is not present.
   EXPECT_TRUE(name_constraints->IsPermittedCert(
-      SequenceValueFromString(&name_us_az), der::Input()));
+      SequenceValueFromString(&name_us_az), false, der::Input()));
 
   std::string san;
   ASSERT_TRUE(LoadTestSubjectAltName("san-invalid-empty.pem", &san));
   // Should fail if subjectAltName is present but empty.
   EXPECT_FALSE(name_constraints->IsPermittedCert(
-      SequenceValueFromString(&name_us_az), der::Input(&san)));
+      SequenceValueFromString(&name_us_az), true, der::Input(&san)));
 }
 
 TEST_P(ParseNameConstraints, IsPermittedCertFailsOnInvalidIpInSubjectAltName) {
   std::string constraints_der;
   ASSERT_TRUE(LoadTestNameConstraint("ipaddress.pem", &constraints_der));
   scoped_ptr<NameConstraints> name_constraints(NameConstraints::CreateFromDer(
       der::Input(&constraints_der), is_critical()));
   ASSERT_TRUE(name_constraints);
 
   std::string name_us_az_192_168_1_1;
   ASSERT_TRUE(
       LoadTestName("name-us-arizona-192.168.1.1.pem", &name_us_az_192_168_1_1));
 
   // Without the invalid subjectAltName, it passes.
   EXPECT_TRUE(name_constraints->IsPermittedCert(
-      SequenceValueFromString(&name_us_az_192_168_1_1), der::Input()));
+      SequenceValueFromString(&name_us_az_192_168_1_1), false, der::Input()));
 
   std::string san;
   ASSERT_TRUE(LoadTestSubjectAltName("san-invalid-ipaddress.pem", &san));
   // Should fail if subjectAltName contains an invalid ip address.
   EXPECT_FALSE(name_constraints->IsPermittedCert(
-      SequenceValueFromString(&name_us_az_192_168_1_1), der::Input(&san)));
+      SequenceValueFromString(&name_us_az_192_168_1_1), true,
+      der::Input(&san)));
 }
 
 }  // namespace net