#include <pkix_types.h>

Inheritance diagram for Botan::Extensions:

Public Member Functions
void	add (std::unique_ptr< Certificate_Extension > extn, bool critical=false)
bool	add_new (std::unique_ptr< Certificate_Extension > extn, bool critical=false)
std::vector< uint8_t >	BER_encode () const
size_t	count () const
bool	critical_extension_set (const OID &oid) const
std::vector< OID >	critical_extensions () const
void	decode_from (BER_Decoder &from) override
void	decode_from (BER_Decoder &from, std::optional< Extension_Context > context)
void	encode_into (DER_Encoder &to) const override
bool	extension_set (const OID &oid) const
	Extensions ()=default
	Extensions (const Extensions &)=default
	Extensions (Extensions &&)=default
std::vector< std::pair< std::unique_ptr< Certificate_Extension >, bool > >	extensions () const
std::map< OID, std::pair< std::vector< uint8_t >, bool > >	extensions_raw () const
std::unique_ptr< Certificate_Extension >	get (const OID &oid) const
std::vector< uint8_t >	get_extension_bits (const OID &oid) const
const Certificate_Extension *	get_extension_object (const OID &oid) const
template<typename T>
const T *	get_extension_object_as (const OID &oid=T::static_oid()) const
const std::vector< OID > &	get_extension_oids () const
template<typename T>
std::unique_ptr< T >	get_raw (const OID &oid) const
bool	has_unknown_critical_extension () const
Extensions &	operator= (const Extensions &)=default
Extensions &	operator= (Extensions &&)=default
bool	remove (const OID &oid)
void	replace (std::unique_ptr< Certificate_Extension > extn, bool critical=false)
void	validate (const X509_Certificate &subject, const std::optional< X509_Certificate > &issuer, const std::vector< X509_Certificate > &cert_path, std::vector< std::set< Certificate_Status_Code > > &cert_status, size_t pos) const
	~Extensions () override=default

Detailed Description

X.509 Certificate Extension List

Definition at line 872 of file pkix_types.h.

Constructor & Destructor Documentation

◆ Extensions() [1/3]

Botan::Extensions::Extensions ( )

default

Referenced by Extensions(), Extensions(), operator=(), and operator=().

◆ Extensions() [2/3]

Botan::Extensions::Extensions ( const Extensions & )

default

References Extensions().

◆ Extensions() [3/3]

Botan::Extensions::Extensions ( Extensions && )

default

References Extensions().

◆ ~Extensions()

Botan::Extensions::~Extensions ( )

overridedefault

References BOTAN_UNSTABLE_API.

Member Function Documentation

◆ add()

void Botan::Extensions::add	(	std::unique_ptr< Certificate_Extension >	extn,
		bool	critical = false )

Adds a new extension to the list.

Parameters

extn	pointer to the certificate extension (Extensions takes ownership)
critical	whether this extension should be marked as critical

Exceptions

Invalid_Argument if the extension is already present in the list

Definition at line 190 of file x509_ext.cpp.

                                                                             {
   // sanity check: we don't want to have the same extension more than once
   if(m_extension_info.contains(extn->oid_of())) {
      const std::string name = extn->oid_name();
      throw Invalid_Argument("Extension " + name + " already present in Extensions::add");
   }
 
   const OID oid = extn->oid_of();
   Extensions_Info info(critical, std::move(extn));
   m_extension_oids.push_back(oid);
   m_extension_info.emplace(oid, info);
}

◆ add_new()

bool Botan::Extensions::add_new	(	std::unique_ptr< Certificate_Extension >	extn,
		bool	critical = false )

Adds a new extension to the list unless it already exists. If the extension already exists within the Extensions object, the extn pointer will be deleted.

Parameters

extn	pointer to the certificate extension (Extensions takes ownership)
critical	whether this extension should be marked as critical

Returns: true if the object was added false if the extension was already used

Definition at line 203 of file x509_ext.cpp.

                                                                                 {
   if(m_extension_info.contains(extn->oid_of())) {
      return false;  // already exists
   }
 
   const OID oid = extn->oid_of();
   Extensions_Info info(critical, std::move(extn));
   m_extension_oids.push_back(oid);
   m_extension_info.emplace(oid, info);
   return true;
}

Referenced by Botan::X509::create_cert_req(), and Botan::X509::create_self_signed_cert().

◆ BER_encode()

std::vector< uint8_t > Botan::ASN1_Object::BER_encode ( ) const

inherited

Return the encoding of this object. This is a convenience method when just one object needs to be serialized. Use DER_Encoder for complicated encodings.

Definition at line 21 of file asn1_obj.cpp.

                                                 {
   std::vector<uint8_t> output;
   DER_Encoder der(output);
   this->encode_into(der);
   return output;
}

References encode_into().

Referenced by decode_from(), Botan::PKCS12::export_to(), Botan::Certificate_Store_In_SQL::find_all_certs(), Botan::Certificate_Store_In_SQL::find_cert(), Botan::X509_Certificate::fingerprint(), Botan::Certificate_Store_In_SQL::insert_cert(), Botan::X509_Object::PEM_encode(), and Botan::PSS_Params::PSS_Params().

◆ count()

size_t Botan::Extensions::count ( ) const

inline

Definition at line 1027 of file pkix_types.h.

1027{ return m_extension_oids.size(); }

◆ critical_extension_set()

bool Botan::Extensions::critical_extension_set ( const OID & oid ) const

Return true if an extension was set and marked critical

Definition at line 239 of file x509_ext.cpp.

                                                            {
   auto i = m_extension_info.find(oid);
   if(i != m_extension_info.end()) {
      return i->second.is_critical();
   }
   return false;
}

Referenced by Botan::X509_Certificate::is_critical().

◆ critical_extensions()

std::vector< OID > Botan::Extensions::critical_extensions ( ) const

Return the set of critical extensions in the order they appeared in the extension list (This may be an empty vector)

Definition at line 128 of file x509_ext.cpp.

                                                     {
   std::vector<OID> crit;
 
   for(const auto& oid : m_extension_oids) {
      auto ext_info = m_extension_info.find(oid);
      BOTAN_ASSERT_NOMSG(ext_info != m_extension_info.end());
      if(ext_info->second.is_critical()) {
         crit.push_back(oid);
      }
   }
 
   return crit;
}

References BOTAN_ASSERT_NOMSG.

Referenced by Botan::OCSP::SingleResponse::decode_from(), and Botan::OCSP::Response::Response().

◆ decode_from() [1/2]

void Botan::Extensions::decode_from ( BER_Decoder & from )

overridevirtual

Decode whatever this object is from from

Parameters

from	the BER_Decoder that will be read from

Implements Botan::ASN1_Object.

Definition at line 322 of file x509_ext.cpp.

                                                     {
   decode_from(from_source, std::nullopt);
}

References decode_from().

Referenced by decode_from(), Botan::OCSP::SingleResponse::decode_from(), and Botan::OCSP::Response::Response().

◆ decode_from() [2/2]

void Botan::Extensions::decode_from	(	BER_Decoder &	from,
		std::optional< Extension_Context >	context )

Definition at line 326 of file x509_ext.cpp.

                                                                                             {
   m_extension_oids.clear();
   m_extension_info.clear();
   m_has_unknown_critical_extension = false;
 
   BER_Decoder sequence = from_source.start_sequence();
 
   while(sequence.more_items()) {
      OID oid;
      bool critical = false;
      std::vector<uint8_t> bits;
 
      sequence.start_sequence()
         .decode(oid)
         .decode_optional(critical, ASN1_Type::Boolean, ASN1_Class::Universal, false)
         .decode(bits, ASN1_Type::OctetString)
         .end_cons();
 
      auto obj = create_extn_obj(oid, critical, bits, context);
      // Unknown_Extension is the only Certificate_Extension with an empty oid_name
      if(critical && obj->oid_name().empty()) {
         m_has_unknown_critical_extension = true;
      }
      Extensions_Info info(critical, bits, std::move(obj));
 
      // RFC 5280 4.2: "A certificate MUST NOT include more than one
      // instance of a particular extension."
      if(!m_extension_info.emplace(oid, info).second) {
         throw Decoding_Error("Duplicate certificate extension encountered");
      }
      m_extension_oids.push_back(oid);
   }
   sequence.verify_end();
}

References Botan::Boolean, Botan::BER_Decoder::decode(), Botan::BER_Decoder::decode_optional(), Botan::BER_Decoder::end_cons(), Botan::BER_Decoder::more_items(), Botan::OctetString, Botan::BER_Decoder::start_sequence(), Botan::Universal, and Botan::BER_Decoder::verify_end().

◆ encode_into()

void Botan::Extensions::encode_into ( DER_Encoder & to ) const

overridevirtual

Encode whatever this object is into to

Parameters

to	the DER_Encoder that will be written to

Implements Botan::ASN1_Object.

Definition at line 302 of file x509_ext.cpp.

                                                         {
   for(const auto& [oid, extn] : m_extension_info) {
      const bool should_encode = extn.obj().should_encode();
 
      if(should_encode) {
         const auto is_critical = extn.is_critical() ? std::optional<bool>{true} : std::nullopt;
         const std::vector<uint8_t>& ext_value = extn.bits();
 
         to_object.start_sequence()
            .encode(oid)
            .encode_optional(is_critical)
            .encode(ext_value, ASN1_Type::OctetString)
            .end_cons();
      }
   }
}

References Botan::DER_Encoder::encode(), Botan::DER_Encoder::encode_optional(), Botan::DER_Encoder::end_cons(), Botan::OctetString, and Botan::DER_Encoder::start_sequence().

◆ extension_set()

bool Botan::Extensions::extension_set ( const OID & oid ) const

Return true if an extension was set

Definition at line 235 of file x509_ext.cpp.

                                                   {
   return m_extension_info.contains(oid);
}

Referenced by botan_x509_cert_issuer_alternative_names(), botan_x509_cert_subject_alternative_names(), and Botan::Cert_Extension::NoRevocationAvailable::validate().

◆ extensions()

std::vector< std::pair< std::unique_ptr< Certificate_Extension >, bool > > Botan::Extensions::extensions ( ) const

Returns a copy of the list of extensions together with the corresponding criticality flag. All extensions are encoded as some object, falling back to Unknown_Extension class which simply allows reading the bytes as well as the criticality flag.

Definition at line 272 of file x509_ext.cpp.

                                                                                            {
   std::vector<std::pair<std::unique_ptr<Certificate_Extension>, bool>> exts;
   exts.reserve(m_extension_info.size());
   for(auto&& ext : m_extension_info) {
      exts.push_back(std::make_pair(ext.second.obj().copy(), ext.second.is_critical()));
   }
   return exts;
}

◆ extensions_raw()

std::map< OID, std::pair< std::vector< uint8_t >, bool > > Botan::Extensions::extensions_raw ( ) const

Returns the list of extensions as raw, encoded bytes together with the corresponding criticality flag. Contains all extensions, including any extensions encoded as Unknown_Extension

Definition at line 291 of file x509_ext.cpp.

                                                                                {
   std::map<OID, std::pair<std::vector<uint8_t>, bool>> out;
   for(auto&& ext : m_extension_info) {
      out.emplace(ext.first, std::make_pair(ext.second.bits(), ext.second.is_critical()));
   }
   return out;
}

◆ get()

std::unique_ptr< Certificate_Extension > Botan::Extensions::get ( const OID & oid ) const

Searches for an extension by OID and returns the result. Only the known extensions types declared in this header are searched for by this function.

Returns: Copy of extension with oid, nullptr if not found. Can avoid creating a copy by using get_extension_object function

Definition at line 265 of file x509_ext.cpp.

                                                                         {
   if(const Certificate_Extension* ext = this->get_extension_object(oid)) {
      return ext->copy();
   }
   return nullptr;
}

References get_extension_object().

◆ get_extension_bits()

std::vector< uint8_t > Botan::Extensions::get_extension_bits ( const OID & oid ) const

Return the raw bytes of the extension Will throw if OID was not set as an extension.

Definition at line 247 of file x509_ext.cpp.

                                                                      {
   auto i = m_extension_info.find(oid);
   if(i == m_extension_info.end()) {
      throw Invalid_Argument("Extensions::get_extension_bits no such extension set");
   }
 
   return i->second.bits();
}

◆ get_extension_object()

const Certificate_Extension * Botan::Extensions::get_extension_object ( const OID & oid ) const

Look up an object in the extensions, based on OID Returns nullptr if not set, if the extension was either absent or not handled. The pointer returned is owned by the Extensions object. This would be better with an optional<T> return value

Definition at line 256 of file x509_ext.cpp.

                                                                                  {
   auto extn = m_extension_info.find(oid);
   if(extn == m_extension_info.end()) {
      return nullptr;
   }
 
   return &extn->second.obj();
}

Referenced by get(), and get_extension_object_as().

◆ get_extension_object_as()

template<typename T>

const T * Botan::Extensions::get_extension_object_as ( const OID & oid = T::static_oid() ) const

inline

Definition at line 884 of file pkix_types.h.

                                                                           {
         if(const Certificate_Extension* extn = get_extension_object(oid)) {
            // Unknown_Extension oid_name is empty
            if(extn->oid_name().empty()) {
               return nullptr;
            } else if(const T* extn_as_T = dynamic_cast<const T*>(extn)) {
               return extn_as_T;
            } else {
               throw Decoding_Error("Exception::get_extension_object_as dynamic_cast failed");
            }
         }
 
         return nullptr;
      }

References get_extension_object().

Referenced by Botan::distribution_point_match(), and Botan::Cert_Extension::NoRevocationAvailable::validate().

◆ get_extension_oids()

const std::vector< OID > & Botan::Extensions::get_extension_oids ( ) const

inline

Return the set of extensions in the order they appeared in the certificate (or as they were added, if constructed)

Definition at line 903 of file pkix_types.h.

903{ return m_extension_oids; }

Referenced by Botan::PKIX::check_chain().

◆ get_raw()

template<typename T>

std::unique_ptr< T > Botan::Extensions::get_raw ( const OID & oid ) const

inline

Searches for an extension by OID and returns the result decoding it to some arbitrary extension type chosen by the application.

Only the unknown extensions, that is, extensions types that are not declared in this header, are searched for by this function.

Returns: Pointer to new extension with oid, nullptr if not found.

Definition at line 989 of file pkix_types.h.

                                                     {
         auto extn_info = m_extension_info.find(oid);
 
         if(extn_info != m_extension_info.end()) {
            // Unknown_Extension oid_name is empty
            if(extn_info->second.obj().oid_name().empty()) {
               auto ext = std::make_unique<T>();
               ext->decode_inner(extn_info->second.bits());
               return ext;
            }
         }
         return nullptr;
      }

◆ has_unknown_critical_extension()

bool Botan::Extensions::has_unknown_critical_extension ( ) const

inline

Return true if an unrecognized critical extension was encountered during the most recent decode_from. Resets on each call to decode_from and is not affected by subsequent calls to add/replace/remove.

Definition at line 936 of file pkix_types.h.

936{ return m_has_unknown_critical_extension; }

◆ operator=() [1/2]

Extensions & Botan::Extensions::operator= ( const Extensions & )

default

References Extensions().

◆ operator=() [2/2]

Extensions & Botan::Extensions::operator= ( Extensions && )

default

References Extensions().

◆ remove()

bool Botan::Extensions::remove ( const OID & oid )

Remove an extension from the list. Returns true if the extension had been set, false otherwise.

Definition at line 215 of file x509_ext.cpp.

                                      {
   const bool erased = m_extension_info.erase(oid) > 0;
 
   if(erased) {
      m_extension_oids.erase(std::find(m_extension_oids.begin(), m_extension_oids.end(), oid));
   }
 
   return erased;
}

Referenced by replace().

◆ replace()

void Botan::Extensions::replace	(	std::unique_ptr< Certificate_Extension >	extn,
		bool	critical = false )

Adds an extension to the list or replaces it.

Parameters

extn	the certificate extension
critical	whether this extension should be marked as critical

Definition at line 225 of file x509_ext.cpp.

                                                                                 {
   // Remove it if it existed
   remove(extn->oid_of());
 
   const OID oid = extn->oid_of();
   Extensions_Info info(critical, std::move(extn));
   m_extension_oids.push_back(oid);
   m_extension_info.emplace(oid, info);
}

References remove().

Referenced by Botan::X509_CA::choose_extensions(), Botan::X509::create_cert_req(), and Botan::X509::create_self_signed_cert().

◆ validate()

void Botan::Extensions::validate	(	const X509_Certificate &	subject,
		const std::optional< X509_Certificate > &	issuer,
		const std::vector< X509_Certificate > &	cert_path,
		std::vector< std::set< Certificate_Status_Code > > &	cert_status,
		size_t	pos ) const

Invoke the validation callback for each extension.

Definition at line 281 of file x509_ext.cpp.

                                            {
   for(const auto& ext : m_extension_info) {
      ext.second.obj().validate(subject, issuer, cert_path, cert_status, pos);
   }
}

Referenced by Botan::PKIX::check_chain().

The documentation for this class was generated from the following files:

src/lib/x509/pkix_types.h
src/lib/x509/x509_ext.cpp

Public Member Functions

Detailed Description

Constructor & Destructor Documentation

◆ Extensions() [1/3]

◆ Extensions() [2/3]

◆ Extensions() [3/3]

◆ ~Extensions()

Member Function Documentation

◆ add()

◆ add_new()

◆ BER_encode()

◆ count()

◆ critical_extension_set()

◆ critical_extensions()

◆ decode_from() [1/2]

◆ decode_from() [2/2]

◆ encode_into()

◆ extension_set()

◆ extensions()

◆ extensions_raw()

◆ get()

◆ get_extension_bits()

◆ get_extension_object()

◆ get_extension_object_as()

◆ get_extension_oids()

◆ get_raw()

◆ has_unknown_critical_extension()

◆ operator=() [1/2]

◆ operator=() [2/2]

◆ remove()

◆ replace()

◆ validate()