Add X509Certificate::IsIssuedByEncoded()

net/base/x509_util_nss.h

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_BASE_X509_UTIL_NSS_H_
 #define NET_BASE_X509_UTIL_NSS_H_
 
 #include <string>
 #include <vector>
 
@@ skipping 52 matching lines @@
 // certificate handle. Returns an invalid handle, NULL, on failure.
 X509Certificate::OSCertHandle ReadOSCertHandleFromPickle(
     PickleIterator* pickle_iter);
 
 // Sets |*size_bits| to be the length of the public key in bits, and sets
 // |*type| to one of the |PublicKeyType| values. In case of
 // |kPublicKeyTypeUnknown|, |*size_bits| will be set to 0.
 void GetPublicKeyInfo(CERTCertificate* handle,
                       size_t* size_bits,
                       X509Certificate::PublicKeyType* type);
+
+// Returns true if |name| is listed in |valid_issuers|
+// |name| is a SECItem corresponding to a DER-encoded X.509
+// DistinguishedName.
+// |valid_issuers| is a list of strings, where each string contains also
+// a DER-encoded X.509 DN.
+bool IsCertNameItemInIssuerList(
+    SECItem* name,

[Ryan Sleevi, 2012/12/13 19:49:05]

see comments in iOS about making this a CERTName and saving some name parsing

+    const std::vector<std::string>& valid_issuers);

[Ryan Sleevi, 2012/12/13 19:49:05]

Perhaps rather then passing a single SECItem for a name, along with a vector of
strings, you have it pass in a vector of CERTName (collected from the
CERTCertificate*s) and a vector of strings (collected from the SSL handshake)

[digit1, 2012/12/14 17:54:33]

Yes, I've actually changed the function to take a vector of CERTCertificate*,
which makes it easier to reuse for iOS too.

[Ryan Sleevi, 2012/12/14 18:16:42]

That works too

+
 #endif  // defined(USE_NSS) || defined(OS_IOS)
 
 } // namespace x509_util
 
 } // namespace net
 
 #endif  // NET_BASE_X509_UTIL_NSS_H_