Botan::Cert_Extension::Name_Constraints Class Reference

#include <x509_ext.h>

Inheritance diagram for Botan::Cert_Extension::Name_Constraints:

Public Member Functions
std::unique_ptr< Certificate_Extension >	copy () const override
const NameConstraints &	get_name_constraints () const
	Name_Constraints ()=default
BOTAN_FUTURE_EXPLICIT	Name_Constraints (const NameConstraints &nc)
OID	oid_of () const override
void	validate (const X509_Certificate &subject, const std::optional< X509_Certificate > &issuer, const std::vector< X509_Certificate > &cert_path, std::vector< std::set< Certificate_Status_Code > > &cert_status, size_t pos) override

Static Public Member Functions
static OID	static_oid ()

Detailed Description

Name Constraints

Definition at line 250 of file x509_ext.h.

Constructor & Destructor Documentation

Name_Constraints() [1/2]

Botan::Cert_Extension::Name_Constraints::Name_Constraints ( )

default

Name_Constraints() [2/2]

BOTAN_FUTURE_EXPLICIT Botan::Cert_Extension::Name_Constraints::Name_Constraints ( const NameConstraints & nc )

inline

Definition at line 258 of file x509_ext.h.

: m_name_constraints(nc) {}

References BOTAN_FUTURE_EXPLICIT.

Member Function Documentation

copy()

std::unique_ptr< Certificate_Extension > Botan::Cert_Extension::Name_Constraints::copy ( ) const

inlineoverridevirtual

Make a copy of this extension

Returns

copy of this

Implements Botan::Certificate_Extension.

Definition at line 252 of file x509_ext.h.

                                                                 {
         return std::make_unique<Name_Constraints>(m_name_constraints);
      }

get_name_constraints()

const NameConstraints & Botan::Cert_Extension::Name_Constraints::get_name_constraints ( ) const

inline

Definition at line 266 of file x509_ext.h.

{ return m_name_constraints; }

oid_of()

OID Botan::Cert_Extension::Name_Constraints::oid_of ( ) const

inlineoverridevirtual

Returns

OID representing this extension

Implements Botan::Certificate_Extension.

Definition at line 270 of file x509_ext.h.

{ return static_oid(); }

References static_oid().

static_oid()

OID Botan::Cert_Extension::Name_Constraints::static_oid ( )

inlinestatic

Definition at line 268 of file x509_ext.h.

{ return OID({2, 5, 29, 30}); }

Referenced by oid_of().

validate()

void Botan::Cert_Extension::Name_Constraints::validate ( const X509_Certificate & subject, const std::optional< X509_Certificate > & issuer, const std::vector< X509_Certificate > & cert_path, std::vector< std::set< Certificate_Status_Code > > & cert_status, size_t pos )

overridevirtual

Reimplemented from Botan::Certificate_Extension.

Definition at line 634 of file x509_ext.cpp.

                                            {
   if(!m_name_constraints.permitted().empty() || !m_name_constraints.excluded().empty()) {
      if(!subject.is_CA_cert()) {
         cert_status.at(pos).insert(Certificate_Status_Code::NAME_CONSTRAINT_ERROR);
      }
 
      const bool issuer_name_constraint_critical = subject.is_critical("X509v3.NameConstraints");
 
      // Check that all subordinate certs pass the name constraint
      for(size_t j = 0; j < pos; ++j) {
         const auto& cert = cert_path.at(j);
 
         // RFC 5280 6.1.4(b): "Name constraints are not applied to self-issued
         // certificates (unless the certificate is the final certificate in the path)"
         // Position 0 is the end entity (final certificate); skip self-issued intermediates.
         if(j > 0 && cert.issuer_dn() == cert.subject_dn()) {
            continue;
         }
 
         if(!m_name_constraints.is_permitted(cert, issuer_name_constraint_critical)) {
            cert_status.at(j).insert(Certificate_Status_Code::NAME_CONSTRAINT_ERROR);
            continue;
         }
 
         if(m_name_constraints.is_excluded(cert, issuer_name_constraint_critical)) {
            cert_status.at(j).insert(Certificate_Status_Code::NAME_CONSTRAINT_ERROR);
            continue;
         }
      }
   }
}

References Botan::X509_Certificate::is_CA_cert(), Botan::X509_Certificate::is_critical(), and Botan::NAME_CONSTRAINT_ERROR.

---

The documentation for this class was generated from the following files:

• src/lib/x509/x509_ext.h
• src/lib/x509/x509_ext.cpp