Botan::Cert_Extension::Name_Constraints Class Reference

#include <x509_ext.h>

Inheritance diagram for Botan::Cert_Extension::Name_Constraints:

Public Member Functions
std::unique_ptr< Certificate_Extension >	copy () const override
const NameConstraints &	get_name_constraints () const
	Name_Constraints ()=default
BOTAN_FUTURE_EXPLICIT	Name_Constraints (const NameConstraints &nc)
OID	oid_of () const override
void	validate (const X509_Certificate &subject, const std::optional< X509_Certificate > &issuer, const std::vector< X509_Certificate > &cert_path, std::vector< std::set< Certificate_Status_Code > > &cert_status, size_t pos) const override

Static Public Member Functions
static OID	static_oid ()

Detailed Description

Name Constraints

Definition at line 293 of file x509_ext.h.

Constructor & Destructor Documentation

Name_Constraints() [1/2]

Botan::Cert_Extension::Name_Constraints::Name_Constraints ( )

default

Name_Constraints() [2/2]

BOTAN_FUTURE_EXPLICIT Botan::Cert_Extension::Name_Constraints::Name_Constraints ( const NameConstraints & nc )

inline

Definition at line 301 of file x509_ext.h.

: m_name_constraints(nc) {}

References BOTAN_FUTURE_EXPLICIT.

Member Function Documentation

copy()

std::unique_ptr< Certificate_Extension > Botan::Cert_Extension::Name_Constraints::copy ( ) const

inlineoverridevirtual

Make a copy of this extension

Returns

copy of this

Implements Botan::Certificate_Extension.

Definition at line 295 of file x509_ext.h.

                                                                 {
         return std::make_unique<Name_Constraints>(m_name_constraints);
      }

get_name_constraints()

const NameConstraints & Botan::Cert_Extension::Name_Constraints::get_name_constraints ( ) const

inline

Definition at line 309 of file x509_ext.h.

{ return m_name_constraints; }

oid_of()

OID Botan::Cert_Extension::Name_Constraints::oid_of ( ) const

inlineoverridevirtual

Return object identifier for this extension

Returns

OID representing this extension

Implements Botan::Certificate_Extension.

Definition at line 313 of file x509_ext.h.

{ return static_oid(); }

References static_oid().

static_oid()

OID Botan::Cert_Extension::Name_Constraints::static_oid ( )

inlinestatic

Definition at line 311 of file x509_ext.h.

{ return OID({2, 5, 29, 30}); }

Referenced by oid_of().

validate()

void Botan::Cert_Extension::Name_Constraints::validate ( const X509_Certificate & subject, const std::optional< X509_Certificate > & issuer, const std::vector< X509_Certificate > & cert_path, std::vector< std::set< Certificate_Status_Code > > & cert_status, size_t pos ) const

overridevirtual

Callback visited during path validation.

An extension can implement this callback to inspect the path during path validation.

If an error occurs during validation of this extension, an appropriate status code shall be added to cert_status.

Parameters

subject	Subject certificate that contains this extension
issuer	Issuer certificate. nullopt for certificates with no available issuer (e.g. non self-signed trust anchors).
cert_path	Certificate path which is currently validated
cert_status	Certificate validation status codes for subject certificate
pos	Position of subject certificate in cert_path

Reimplemented from Botan::Certificate_Extension.

Definition at line 827 of file x509_ext.cpp.

                                                  {
   if(!m_name_constraints.permitted().empty() || !m_name_constraints.excluded().empty()) {
      if(!subject.is_CA_cert()) {
         cert_status.at(pos).insert(Certificate_Status_Code::NAME_CONSTRAINT_ERROR);
      }
 
      const bool issuer_name_constraint_critical = subject.is_critical("X509v3.NameConstraints");
 
      // Check that all subordinate certs pass the name constraint
      for(size_t j = 0; j < pos; ++j) {
         const auto& cert = cert_path.at(j);
 
         // RFC 5280 6.1.4(b): "Name constraints are not applied to self-issued
         // certificates (unless the certificate is the final certificate in the path)"
         // Position 0 is the end entity (final certificate); skip self-issued intermediates.
         if(j > 0 && cert.issuer_dn() == cert.subject_dn()) {
            continue;
         }
 
         if(!m_name_constraints.is_permitted(cert, issuer_name_constraint_critical)) {
            cert_status.at(j).insert(Certificate_Status_Code::NAME_CONSTRAINT_ERROR);
            continue;
         }
 
         if(m_name_constraints.is_excluded(cert, issuer_name_constraint_critical)) {
            cert_status.at(j).insert(Certificate_Status_Code::NAME_CONSTRAINT_ERROR);
            continue;
         }
      }
   }
}

References Botan::X509_Certificate::is_CA_cert(), Botan::X509_Certificate::is_critical(), and Botan::NAME_CONSTRAINT_ERROR.

---

The documentation for this class was generated from the following files:

• src/lib/x509/x509_ext.h
• src/lib/x509/x509_ext.cpp