Botan::Cert_Extension::IPAddressBlocks Class Reference

#include <x509_ext.h>

Inheritance diagram for Botan::Cert_Extension::IPAddressBlocks:

Classes
class	IPAddress
class	IPAddressChoice
class	IPAddressFamily
class	IPAddressOrRange

Public Types
enum class	Version : uint8_t { IPv4 = 4 , IPv6 = 16 }

Public Member Functions
template<Version V>
void	add_address (const std::array< uint8_t, static_cast< size_t >(V)> &address, std::optional< uint8_t > safi=std::nullopt)
	Add a single IP address to this extension (for the specified SAFI, if any).
template<Version V>
void	add_address (const std::array< uint8_t, static_cast< std::size_t >(V)> &min, const std::array< uint8_t, static_cast< std::size_t >(V)> &max, std::optional< uint8_t > safi=std::nullopt)
	Add an IP address range to this extension (for the specified SAFI, if any).
const std::vector< IPAddressFamily > &	addr_blocks () const
std::unique_ptr< Certificate_Extension >	copy () const override
template<Version V>
void	inherit (std::optional< uint8_t > safi=std::nullopt)
	Mark the specified IP version as 'inherit' (for the specified SAFI, if any).
	IPAddressBlocks ()=default
	IPAddressBlocks (const std::vector< IPAddressFamily > &blocks)
OID	oid_of () const override
template<Version V>
void	restrict (std::optional< uint8_t > safi=std::nullopt)
	Make the extension contain no allowed IP addresses for the specified IP version (and SAFI, if any).
size_t	v4_count () const
	The number of IPv4 families contained in the extension.
size_t	v6_count () const
	The number of IPv6 families contained in the extension.
void	validate (const X509_Certificate &subject, const std::optional< X509_Certificate > &issuer, const std::vector< X509_Certificate > &cert_path, std::vector< std::set< Certificate_Status_Code > > &cert_status, size_t pos) const override

Static Public Member Functions
static OID	static_oid ()

Detailed Description

IP Address Blocks Extension

RFC 3779 X.509 Extensions for IP Addr

Definition at line 926 of file x509_ext.h.

Member Enumeration Documentation

Version

enum class Botan::Cert_Extension::IPAddressBlocks::Version : uint8_t

strong

Enumerator
IPv4
IPv6

Definition at line 928 of file x509_ext.h.

                         : uint8_t {
         IPv4 = 4,
         IPv6 = 16,
      };

Constructor & Destructor Documentation

IPAddressBlocks() [1/2]

Botan::Cert_Extension::IPAddressBlocks::IPAddressBlocks ( )

default

Referenced by validate().

IPAddressBlocks() [2/2]

Botan::Cert_Extension::IPAddressBlocks::IPAddressBlocks ( const std::vector< IPAddressFamily > & blocks )

inlineexplicit

Definition at line 1058 of file x509_ext.h.

                                                                         : m_ip_addr_blocks(blocks) {
         this->sort_and_merge();
      }

Member Function Documentation

add_address() [1/2]

template<Version V>

void Botan::Cert_Extension::IPAddressBlocks::add_address ( const std::array< uint8_t, static_cast< size_t >(V)> & address, std::optional< uint8_t > safi = std::nullopt )

inline

Add a single IP address to this extension (for the specified SAFI, if any).

Definition at line 1076 of file x509_ext.h.

                                                             {
         add_address<V>(address, address, safi);
      }

References add_address().

Referenced by add_address().

add_address() [2/2]

template<Version V>

void Botan::Cert_Extension::IPAddressBlocks::add_address ( const std::array< uint8_t, static_cast< std::size_t >(V)> & min, const std::array< uint8_t, static_cast< std::size_t >(V)> & max, std::optional< uint8_t > safi = std::nullopt )

inline

Add an IP address range to this extension (for the specified SAFI, if any).

Definition at line 1083 of file x509_ext.h.

                                                             {
         std::vector<IPAddressOrRange<V>> addresses = {IPAddressOrRange<V>(IPAddress<V>(min), IPAddress<V>(max))};
         m_ip_addr_blocks.push_back(IPAddressFamily(IPAddressChoice<V>(addresses), safi));
         sort_and_merge();
      }

addr_blocks()

const std::vector< IPAddressFamily > & Botan::Cert_Extension::IPAddressBlocks::addr_blocks ( ) const

inline

Definition at line 1106 of file x509_ext.h.

{ return m_ip_addr_blocks; }

Referenced by validate().

copy()

std::unique_ptr< Certificate_Extension > Botan::Cert_Extension::IPAddressBlocks::copy ( ) const

inlineoverridevirtual

Make a copy of this extension

Returns

copy of this

Implements Botan::Certificate_Extension.

Definition at line 1062 of file x509_ext.h.

{ return std::make_unique<IPAddressBlocks>(*this); }

inherit()

template<Version V>

void Botan::Cert_Extension::IPAddressBlocks::inherit ( std::optional< uint8_t > safi = std::nullopt )

inline

Mark the specified IP version as 'inherit' (for the specified SAFI, if any).

Definition at line 1101 of file x509_ext.h.

                                                         {
         m_ip_addr_blocks.push_back(IPAddressFamily(IPAddressChoice<V>(), safi));
         sort_and_merge();
      }

oid_of()

OID Botan::Cert_Extension::IPAddressBlocks::oid_of ( ) const

inlineoverridevirtual

Return object identifier for this extension

Returns

OID representing this extension

Implements Botan::Certificate_Extension.

Definition at line 1066 of file x509_ext.h.

{ return static_oid(); }

References static_oid().

restrict()

template<Version V>

void Botan::Cert_Extension::IPAddressBlocks::restrict ( std::optional< uint8_t > safi = std::nullopt )

inline

Make the extension contain no allowed IP addresses for the specified IP version (and SAFI, if any).

Definition at line 1093 of file x509_ext.h.

                                                          {
         std::vector<IPAddressOrRange<V>> addresses = {};
         m_ip_addr_blocks.push_back(IPAddressFamily(IPAddressChoice<V>(addresses), safi));
         sort_and_merge();
      }

static_oid()

OID Botan::Cert_Extension::IPAddressBlocks::static_oid ( )

inlinestatic

Definition at line 1064 of file x509_ext.h.

{ return OID({1, 3, 6, 1, 5, 5, 7, 1, 7}); }

Referenced by oid_of().

v4_count()

size_t Botan::Cert_Extension::IPAddressBlocks::v4_count ( ) const

inline

The number of IPv4 families contained in the extension.

Definition at line 1109 of file x509_ext.h.

{ return m_v4_count; }

Referenced by botan_x509_ext_ip_addr_blocks_get_address(), botan_x509_ext_ip_addr_blocks_get_counts(), and botan_x509_ext_ip_addr_blocks_get_family().

v6_count()

size_t Botan::Cert_Extension::IPAddressBlocks::v6_count ( ) const

inline

The number of IPv6 families contained in the extension.

Definition at line 1112 of file x509_ext.h.

{ return m_v6_count; }

validate()

void Botan::Cert_Extension::IPAddressBlocks::validate ( const X509_Certificate & subject, const std::optional< X509_Certificate > & issuer, const std::vector< X509_Certificate > & cert_path, std::vector< std::set< Certificate_Status_Code > > & cert_status, size_t pos ) const

overridevirtual

Callback visited during path validation.

An extension can implement this callback to inspect the path during path validation.

If an error occurs during validation of this extension, an appropriate status code shall be added to cert_status.

Parameters

subject	Subject certificate that contains this extension
issuer	Issuer certificate. nullopt for certificates with no available issuer (e.g. non self-signed trust anchors).
cert_path	Certificate path which is currently validated
cert_status	Certificate validation status codes for subject certificate
pos	Position of subject certificate in cert_path

Reimplemented from Botan::Certificate_Extension.

Definition at line 2199 of file x509_ext.cpp.

                                                 {
   // maps in the form of (s)afi -> (needs_checking, ranges)
   auto [v4_needs_check, v6_needs_check] = create_validation_map(m_ip_addr_blocks);
 
   if(pos == cert_path.size() - 1) {
      // checks if any range / family has 'inherit' as a value somewhere, not allowed for the root cert
      auto validate_root_cert_ext = [&](const auto& map) {
         // check if any range has a value of 'false', indicating 'inherit'
         return std::any_of(map.begin(), map.end(), [&](const auto& it) {
            const auto& [_1, validation_info] = it;
            const auto& [needs_checking, _2] = validation_info;
            return !needs_checking;
         });
      };
      if(validate_root_cert_ext(v4_needs_check) || validate_root_cert_ext(v6_needs_check)) {
         cert_status.at(pos).insert(Certificate_Status_Code::IPADDR_BLOCKS_ERROR);
      }
      return;
   }
 
   // traverse the chain until we find a cert with concrete values for the extension (so not 'inherit')
   for(auto cert_path_it = cert_path.begin() + pos + 1; cert_path_it != cert_path.end(); cert_path_it++) {
      const IPAddressBlocks* const parent_ip = cert_path_it->v3_extensions().get_extension_object_as<IPAddressBlocks>();
      // extension not present for parent
      if(parent_ip == nullptr) {
         cert_status.at(pos).insert(Certificate_Status_Code::IPADDR_BLOCKS_ERROR);
         return;
      }
      auto [issuer_v4, issuer_v6] = create_validation_map(parent_ip->addr_blocks());
 
      auto validate_against_issuer = [&](auto& subject_map, const auto& issuer_map) {
         for(auto map_it = subject_map.begin(); map_it != subject_map.end(); map_it++) {
            auto& [afam, validation_info] = *map_it;
 
            // the issuer does not have this combination of afi/safi
            if(issuer_map.count(afam) == 0) {
               cert_status.at(pos).insert(Certificate_Status_Code::IPADDR_BLOCKS_ERROR);
               return false;
            }
 
            auto& [needs_check, subject_value] = validation_info;
            const auto& [issuer_has_value, issuer_value] = issuer_map.at(afam);
            BOTAN_ASSERT_NOMSG(!needs_check || subject_value != nullptr);
            BOTAN_ASSERT_NOMSG(!issuer_has_value || issuer_value != nullptr);
 
            // we still need to check this range and the issuer has an actual value for it (so not 'inherit')
            if(needs_check && issuer_has_value) {
               if(!validate_subject_in_issuer(std::span(*subject_value), std::span(*issuer_value))) {
                  cert_status.at(pos).insert(Certificate_Status_Code::IPADDR_BLOCKS_ERROR);
                  return false;
               }
               needs_check = false;
            }
         }
         return true;
      };
 
      if(!validate_against_issuer(v4_needs_check, issuer_v4) || !validate_against_issuer(v6_needs_check, issuer_v6)) {
         return;
      }
 
      auto validate_no_checks_left = [&](const auto& map) {
         // check if all ranges have been checked, either by comparing their ranges if they have any,
         // or if they are inherit, their parent(s) will be validated later
         return std::all_of(map.begin(), map.end(), [&](const auto& it) {
            const auto& [_1, validation_info] = it;
            const auto& [needs_checking, _2] = validation_info;
            return !needs_checking;
         });
      };
 
      if(validate_no_checks_left(v4_needs_check) && validate_no_checks_left(v6_needs_check)) {
         // we've validated what we need to and can stop traversing the cert chain
         return;
      }
   }
}

References addr_blocks(), BOTAN_ASSERT_NOMSG, Botan::IPADDR_BLOCKS_ERROR, and IPAddressBlocks().

---

The documentation for this class was generated from the following files:

• src/lib/x509/x509_ext.h
• src/lib/x509/x509_ext.cpp