657 {
658 if(!m_name_constraints.
permitted().empty() || !m_name_constraints.
excluded().empty())
659 {
660 if(!subject.is_CA_cert())
661 {
663 }
664
665 const bool issuer_name_constraint_critical =
666 issuer.is_critical("X509v3.NameConstraints");
667
668
669 for(size_t j = 0; j < pos; ++j)
670 {
671 bool permitted = m_name_constraints.
permitted().empty();
672 bool failed = false;
673
674 for(
auto c: m_name_constraints.
permitted())
675 {
676 switch(c.base().matches(*cert_path.at(j)))
677 {
678 case GeneralName::MatchResult::NotFound:
679 case GeneralName::MatchResult::All:
680 permitted = true;
681 break;
682 case GeneralName::MatchResult::UnknownType:
683 failed = issuer_name_constraint_critical;
684 permitted = true;
685 break;
686 default:
687 break;
688 }
689 }
690
691 for(
auto c: m_name_constraints.
excluded())
692 {
693 switch(c.base().matches(*cert_path.at(j)))
694 {
695 case GeneralName::MatchResult::All:
696 case GeneralName::MatchResult::Some:
697 failed = true;
698 break;
699 case GeneralName::MatchResult::UnknownType:
700 failed = issuer_name_constraint_critical;
701 break;
702 default:
703 break;
704 }
705 }
706
707 if(failed || !permitted)
708 {
710 }
711 }
712 }
713 }
const std::vector< GeneralSubtree > & permitted() const
const std::vector< GeneralSubtree > & excluded() const