update main-with-bazel from master branch

src/pki/name_constraints.cc

@@ -288,6 +288,17 @@ std::unique_ptr<NameConstraints> NameConstraints::Create(
   return name_constraints;
 }
 
+std::unique_ptr<NameConstraints> NameConstraints::CreateFromPermittedSubtrees(
+    GeneralNames permitted_subtrees) {
+  auto name_constraints = std::make_unique<NameConstraints>();
+
+  name_constraints->constrained_name_types_ =
+      permitted_subtrees.present_name_types;
+  name_constraints->permitted_subtrees_ = std::move(permitted_subtrees);
+
+  return name_constraints;
+}
+
 bool NameConstraints::Parse(der::Input extension_value, bool is_critical,
                             CertErrors *errors) {
   BSSL_CHECK(errors);

src/pki/name_constraints.h

@@ -35,6 +35,11 @@ class OPENSSL_EXPORT NameConstraints {
                                                  bool is_critical,
                                                  CertErrors *errors);
 
+  // Create a NameConstraints object with only permitted names from the passed
+  // in |permitted_subtrees|. Should never return nullptr.
+  static std::unique_ptr<NameConstraints> CreateFromPermittedSubtrees(
+      GeneralNames permitted_subtrees);
+
   // Tests if a certificate is allowed by the name constraints.
   // |subject_rdn_sequence| should be the DER-encoded value of the subject's
   // RDNSequence (not including Sequence tag), and may be an empty ASN.1