Add X509Certificate::IsIssuedByEncoded()

net/base/x509_util_nss.h

 // Copyright (c) 2011 The Chromium Authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
 #ifndef NET_BASE_X509_UTIL_NSS_H_
 #define NET_BASE_X509_UTIL_NSS_H_
 
 #include <string>
 #include <vector>
 
 #include "base/time.h"
 #include "net/base/x509_certificate.h"
 
 class PickleIterator;
 
 typedef struct CERTCertificateStr CERTCertificate;
 typedef struct CERTNameStr CERTName;
+typedef struct PLArenaPool PLArenaPool;
 typedef struct SECKEYPrivateKeyStr SECKEYPrivateKey;
 typedef struct SECItemStr SECItem;
 typedef struct SECKEYPublicKeyStr SECKEYPublicKey;
 
 namespace net {
 
 namespace x509_util {
 
 // Creates a self-signed certificate containing |public_key|.  Subject, serial
 // number and validity period are given as parameters.  The certificate is
@@ skipping 35 matching lines @@
 // certificate handle. Returns an invalid handle, NULL, on failure.
 X509Certificate::OSCertHandle ReadOSCertHandleFromPickle(
     PickleIterator* pickle_iter);
 
 // Sets |*size_bits| to be the length of the public key in bits, and sets
 // |*type| to one of the |PublicKeyType| values. In case of
 // |kPublicKeyTypeUnknown|, |*size_bits| will be set to 0.
 void GetPublicKeyInfo(CERTCertificate* handle,
                       size_t* size_bits,
                       X509Certificate::PublicKeyType* type);
+
+// Create a list of CERTName objects from a list of DER-encoded X.509
+// DistinguishedName items. All objects are created in a given arena.
+// |encoded_issuers| is the list of encoded DNs.
+// |arena| is the arena used for all allocations.
+// |out| will receive the result list on success.
+// Return true on success. On failure, the caller must free the
+// intermediate CERTName objects pushed to |out|.
+bool GetIssuersFromEncodedList(
+    const std::vector<std::string>& issuers,
+    PLArenaPool* arena,
+    std::vector<CERTName*>* out);
+
+// Returns true iff a certificate is issued by any of the issuers listed
+// by name in |valid_issuers|.
+// |cert_chain| is the certificate's chain.
+// |valid_issuers| is a list of strings, where each string contains
+// a DER-encoded X.509 Distinguished Name.
+bool IsCertificateIssuedBy(const std::vector<CERTCertificate*>& cert_chain,
+                           const std::vector<CERTName*>& valid_issuers);
+
 #endif  // defined(USE_NSS) || defined(OS_IOS)
 
 } // namespace x509_util
 
 } // namespace net
 
 #endif  // NET_BASE_X509_UTIL_NSS_H_