Botan::Cert_Extension::Name_Constraints Class Reference

#include <x509_ext.h>

Inheritance diagram for Botan::Cert_Extension::Name_Constraints:

Public Member Functions
Name_Constraints *	copy () const override
const NameConstraints &	get_name_constraints () const
	Name_Constraints ()=default
	Name_Constraints (const NameConstraints &nc)
OID	oid_of () const override
void	validate (const X509_Certificate &subject, const X509_Certificate &issuer, const std::vector< std::shared_ptr< const X509_Certificate >> &cert_path, std::vector< std::set< Certificate_Status_Code >> &cert_status, size_t pos) override

Static Public Member Functions
static OID	static_oid ()

Detailed Description

Name Constraints

Definition at line 494 of file x509_ext.h.

Constructor & Destructor Documentation

Name_Constraints() [1/2]

Botan::Cert_Extension::Name_Constraints::Name_Constraints ( )

default

Name_Constraints() [2/2]

Botan::Cert_Extension::Name_Constraints::Name_Constraints ( const NameConstraints &  nc )

inline

Definition at line 501 of file x509_ext.h.

: m_name_constraints(nc) {}

Member Function Documentation

copy()

Name_Constraints* Botan::Cert_Extension::Name_Constraints::copy ( ) const

inlineoverridevirtual

Make a copy of this extension

Returns

copy of this

Implements Botan::Certificate_Extension.

Definition at line 497 of file x509_ext.h.

         { return new Name_Constraints(m_name_constraints); }

get_name_constraints()

const NameConstraints& Botan::Cert_Extension::Name_Constraints::get_name_constraints ( ) const

inline

Definition at line 508 of file x509_ext.h.

{ return m_name_constraints; }

oid_of()

OID Botan::Cert_Extension::Name_Constraints::oid_of ( ) const

inlineoverridevirtual

Returns

OID representing this extension

Implements Botan::Certificate_Extension.

Definition at line 511 of file x509_ext.h.

{ return static_oid(); }

static_oid()

static OID Botan::Cert_Extension::Name_Constraints::static_oid ( )

inlinestatic

Definition at line 510 of file x509_ext.h.

{ return OID("2.5.29.30"); }

validate()

void Botan::Cert_Extension::Name_Constraints::validate ( const X509_Certificate &  subject, const X509_Certificate &  issuer, const std::vector< std::shared_ptr< const X509_Certificate >> &  cert_path, std::vector< std::set< Certificate_Status_Code >> &  cert_status, size_t  pos  )

overridevirtual

Reimplemented from Botan::Certificate_Extension.

Definition at line 628 of file x509_ext.cpp.

References Botan::NameConstraints::excluded(), Botan::X509_Certificate::is_CA_cert(), Botan::X509_Certificate::is_critical(), Botan::NAME_CONSTRAINT_ERROR, and Botan::NameConstraints::permitted().

   {
   if(!m_name_constraints.permitted().empty() || !m_name_constraints.excluded().empty())
      {
      if(!subject.is_CA_cert() || !subject.is_critical("X509v3.NameConstraints"))
         cert_status.at(pos).insert(Certificate_Status_Code::NAME_CONSTRAINT_ERROR);

      const bool issuer_name_constraint_critical =
         issuer.is_critical("X509v3.NameConstraints");

      const bool at_self_signed_root = (pos == cert_path.size() - 1);

      // Check that all subordinate certs pass the name constraint
      for(size_t j = 0; j <= pos; ++j)
         {
         if(pos == j && at_self_signed_root)
            continue;

         bool permitted = m_name_constraints.permitted().empty();
         bool failed = false;

         for(auto c: m_name_constraints.permitted())
            {
            switch(c.base().matches(*cert_path.at(j)))
               {
               case GeneralName::MatchResult::NotFound:
               case GeneralName::MatchResult::All:
                  permitted = true;
                  break;
               case GeneralName::MatchResult::UnknownType:
                  failed = issuer_name_constraint_critical;
                  permitted = true;
                  break;
               default:
                  break;
               }
            }

         for(auto c: m_name_constraints.excluded())
            {
            switch(c.base().matches(*cert_path.at(j)))
               {
               case GeneralName::MatchResult::All:
               case GeneralName::MatchResult::Some:
                  failed = true;
                  break;
               case GeneralName::MatchResult::UnknownType:
                  failed = issuer_name_constraint_critical;
                  break;
               default:
                  break;
               }
            }

         if(failed || !permitted)
            {
            cert_status.at(j).insert(Certificate_Status_Code::NAME_CONSTRAINT_ERROR);
            }
         }
      }
   }

---

The documentation for this class was generated from the following files:

• src/lib/x509/x509_ext.h
• src/lib/x509/x509_ext.cpp