blob: bef905470a1727d48011372ba42c0b1acc70f60c [file] [log] [blame]
// Copyright 2015 The Chromium Authors
// Use of this source code is governed by a BSD-style license that can be
// found in the LICENSE file.
#ifndef BSSL_PKI_VERIFY_NAME_MATCH_H_
#define BSSL_PKI_VERIFY_NAME_MATCH_H_
#include <string>
#include <vector>
#include <openssl/base.h>
namespace bssl {
class CertErrors;
namespace der {
class Input;
} // namespace der
// Normalizes DER-encoded X.501 Name |name_rdn_sequence| (which should not
// include the Sequence tag). If successful, returns true and stores the
// normalized DER-encoded Name into |normalized_rdn_sequence| (not including an
// outer Sequence tag). Returns false if there was an error parsing or
// normalizing the input, and adds error information to |errors|. |errors| must
// be non-null.
OPENSSL_EXPORT bool NormalizeName(const der::Input &name_rdn_sequence,
std::string *normalized_rdn_sequence,
CertErrors *errors);
// Compares DER-encoded X.501 Name values according to RFC 5280 rules.
// |a_rdn_sequence| and |b_rdn_sequence| should be the DER-encoded RDNSequence
// values (not including the Sequence tag).
// Returns true if |a_rdn_sequence| and |b_rdn_sequence| match.
OPENSSL_EXPORT bool VerifyNameMatch(const der::Input &a_rdn_sequence,
const der::Input &b_rdn_sequence);
// Compares |name_rdn_sequence| and |parent_rdn_sequence| and return true if
// |name_rdn_sequence| is within the subtree defined by |parent_rdn_sequence| as
// defined by RFC 5280 section 7.1. |name_rdn_sequence| and
// |parent_rdn_sequence| should be the DER-encoded sequence values (not
// including the Sequence tag).
OPENSSL_EXPORT bool VerifyNameInSubtree(const der::Input &name_rdn_sequence,
const der::Input &parent_rdn_sequence);
// Helper functions:
// Find all emailAddress attribute values in |name_rdn_sequence|.
// Returns true if parsing was successful, in which case
// |*contained_email_address| will contain zero or more values. The values
// returned in |*contained_email_addresses| will be UTF8 strings and have been
// checked that they were valid strings for the string type of the attribute
// tag, but otherwise have not been validated.
// Returns false if there was a parsing error.
[[nodiscard]] bool FindEmailAddressesInName(
const der::Input &name_rdn_sequence,
std::vector<std::string> *contained_email_addresses);
} // namespace bssl
#endif // BSSL_PKI_VERIFY_NAME_MATCH_H_