#include <pkix_types.h>

Inheritance diagram for Botan::GeneralName:

Public Types
enum	MatchResult : uint8_t { All , Some , None , NotFound , UnknownType }
enum class	NameType : uint8_t { Unknown = 0 , RFC822 = 1 , DNS = 2 , URI = 3 , DN = 4 , IPv4 = 5 , Other = 6 }

Public Member Functions
std::vector< uint8_t >	BER_encode () const
std::vector< uint8_t >	binary_name () const
void	decode_from (BER_Decoder &from) override
void	encode_into (DER_Encoder &to) const override
	GeneralName ()=default
MatchResult	matches (const X509_Certificate &cert) const
bool	matches_dn (const X509_DN &dn) const
bool	matches_dns (const std::string &dns_name) const
bool	matches_ipv4 (uint32_t ip) const
std::string	name () const
std::string	type () const
NameType	type_code () const

Static Public Member Functions
static GeneralName	directory_name (Botan::X509_DN dn)
static GeneralName	dns (std::string_view dns)
static GeneralName	email (std::string_view email)
static GeneralName	ipv4_address (uint32_t ipv4)
static GeneralName	ipv4_address (uint32_t ipv4, uint32_t mask)
static GeneralName	uri (std::string_view uri)

Detailed Description

X.509 GeneralName Type.

Handles parsing GeneralName types in their BER and canonical string encoding. Allows matching GeneralNames against each other using the rules laid out in the RFC 5280, sec. 4.2.1.10 (Name Constraints).

This entire class is deprecated and will be removed in a future major release

Definition at line 274 of file pkix_types.h.

Member Enumeration Documentation

◆ MatchResult

enum Botan::GeneralName::MatchResult : uint8_t

Enumerator
All
Some
None
NotFound
UnknownType

Definition at line 276 of file pkix_types.h.

                       : uint8_t /* NOLINT(*-use-enum-class) */ {
         All,
         Some,
         None,
         NotFound,
         UnknownType,
      };

◆ NameType

enum class Botan::GeneralName::NameType : uint8_t

strong

Enumerator
Unknown
RFC822
DNS
URI
DN
IPv4
Other

Definition at line 284 of file pkix_types.h.

                          : uint8_t {
         Unknown = 0,
         RFC822 = 1,
         DNS = 2,
         URI = 3,
         DN = 4,
         IPv4 = 5,
         Other = 6,
      };

Constructor & Destructor Documentation

◆ GeneralName()

Botan::GeneralName::GeneralName ( )

default

References decode_from(), directory_name(), dns(), email(), encode_into(), GeneralName(), ipv4_address(), and uri().

Referenced by directory_name(), dns(), email(), GeneralName(), ipv4_address(), ipv4_address(), and uri().

Member Function Documentation

◆ BER_encode()

std::vector< uint8_t > Botan::ASN1_Object::BER_encode ( ) const

inherited

Return the encoding of this object. This is a convenience method when just one object needs to be serialized. Use DER_Encoder for complicated encodings.

Definition at line 20 of file asn1_obj.cpp.

                                                 {
   std::vector<uint8_t> output;
   DER_Encoder der(output);
   this->encode_into(der);
   return output;
}

References encode_into().

Referenced by decode_from(), Botan::Certificate_Store_In_SQL::find_all_certs(), Botan::Certificate_Store_In_SQL::find_cert(), Botan::Certificate_Store_Windows::find_cert_by_issuer_dn_and_serial_number(), Botan::X509_Certificate::fingerprint(), Botan::Certificate_Store_In_SQL::insert_cert(), Botan::X509_Object::PEM_encode(), Botan::PSS_Params::PSS_Params(), and Botan::Certificate_Store_In_SQL::revoke_cert().

◆ binary_name()

std::vector< uint8_t > Botan::GeneralName::binary_name ( ) const

Returns: The name as binary string. Format depends on type.

Definition at line 109 of file name_constraint.cpp.

                                                  {
   return std::visit(Botan::overloaded{
                        [](const Botan::X509_DN& dn) { return Botan::ASN1::put_in_sequence(dn.get_bits()); },
                        [](const std::pair<uint32_t, uint32_t>& ip) {
                           if(ip.second == blind_mask) {
                              return store_be<std::vector<uint8_t>>(ip.first);
                           } else {
                              return concat<std::vector<uint8_t>>(store_be(ip.first), store_be(ip.second));
                           }
                        },
                        [](const auto&) -> std::vector<uint8_t> {
                           throw Invalid_State("Cannot convert GeneralName to binary string");
                        },
                     },
                     m_name);
}

References Botan::concat(), Botan::ASN1::put_in_sequence(), and Botan::store_be().

Referenced by botan_x509_general_name_view_binary_value().

◆ decode_from()

void Botan::GeneralName::decode_from ( BER_Decoder & from )

overridevirtual

Decode whatever this object is from from

Parameters

from	the BER_Decoder that will be read from

Implements Botan::ASN1_Object.

Definition at line 130 of file name_constraint.cpp.

                                              {
   const BER_Object obj = ber.get_next_object();
 
   if(obj.is_a(0, ASN1_Class::ExplicitContextSpecific)) {
      m_type = NameType::Other;
   } else if(obj.is_a(1, ASN1_Class::ContextSpecific)) {
      m_type = NameType::RFC822;
      m_name.emplace<RFC822_IDX>(ASN1::to_string(obj));
   } else if(obj.is_a(2, ASN1_Class::ContextSpecific)) {
      m_type = NameType::DNS;
      // Store it in case insensitive form so we don't have to do it
      // again while matching
      m_name.emplace<DNS_IDX>(canonicalize_dns_name(ASN1::to_string(obj)));
   } else if(obj.is_a(6, ASN1_Class::ContextSpecific)) {
      m_type = NameType::URI;
      m_name.emplace<URI_IDX>(ASN1::to_string(obj));
   } else if(obj.is_a(4, ASN1_Class::ContextSpecific | ASN1_Class::Constructed)) {
      X509_DN dn;
      BER_Decoder dec(obj);
      dn.decode_from(dec);
      m_type = NameType::DN;
      m_name.emplace<DN_IDX>(dn);
   } else if(obj.is_a(7, ASN1_Class::ContextSpecific)) {
      if(obj.length() == 8) {
         const uint32_t net = load_be<uint32_t>(obj.bits(), 0);
         const uint32_t mask = load_be<uint32_t>(obj.bits(), 1);
 
         m_type = NameType::IPv4;
         m_name.emplace<IPV4_IDX>(std::make_pair(net, mask));
      } else if(obj.length() == 32) {
         // IPv6 name constraints are not implemented
         m_type = NameType::Unknown;
      } else {
         throw Decoding_Error("Invalid IP name constraint size " + std::to_string(obj.length()));
      }
   } else {
      m_type = NameType::Unknown;
   }
}

References Botan::BER_Object::bits(), Botan::Constructed, Botan::ContextSpecific, Botan::X509_DN::decode_from(), DN, DNS, Botan::ExplicitContextSpecific, Botan::BER_Decoder::get_next_object(), IPv4, Botan::BER_Object::is_a(), Botan::BER_Object::length(), Botan::load_be(), Other, RFC822, Botan::ASN1::to_string(), Unknown, and URI.

Referenced by GeneralName().

◆ directory_name()

GeneralName Botan::GeneralName::directory_name ( Botan::X509_DN dn )

static

Definition at line 74 of file name_constraint.cpp.

                                                       {
   return GeneralName::make<DN_IDX>(std::move(dn));
}

References GeneralName().

Referenced by GeneralName().

◆ dns()

GeneralName Botan::GeneralName::dns ( std::string_view dns )

static

Definition at line 66 of file name_constraint.cpp.

                                               {
   return GeneralName::make<DNS_IDX>(dns);
}

References dns(), and GeneralName().

Referenced by dns(), GeneralName(), and matches().

◆ email()

GeneralName Botan::GeneralName::email ( std::string_view email )

static

Definition at line 62 of file name_constraint.cpp.

                                                   {
   return GeneralName::make<RFC822_IDX>(email);
}

References email(), and GeneralName().

Referenced by email(), and GeneralName().

◆ encode_into()

void Botan::GeneralName::encode_into ( DER_Encoder & to ) const

overridevirtual

Encode whatever this object is into to

Parameters

to	the DER_Encoder that will be written to

Implements Botan::ASN1_Object.

Definition at line 126 of file name_constraint.cpp.

                                                  {
   throw Not_Implemented("GeneralName encoding");
}

Referenced by GeneralName().

◆ ipv4_address() [1/2]

GeneralName Botan::GeneralName::ipv4_address ( uint32_t ipv4 )

static

Definition at line 78 of file name_constraint.cpp.

                                                   {
   return GeneralName::ipv4_address(ipv4, blind_mask);
}

References GeneralName(), and ipv4_address().

Referenced by GeneralName(), and ipv4_address().

◆ ipv4_address() [2/2]

GeneralName Botan::GeneralName::ipv4_address	(	uint32_t	ipv4,
		uint32_t	mask )

static

Definition at line 82 of file name_constraint.cpp.

                                                                  {
   return GeneralName::make<IPV4_IDX>(std::pair{ipv4, mask});
}

References GeneralName().

◆ matches()

GeneralName::MatchResult Botan::GeneralName::matches ( const X509_Certificate & cert ) const

Checks whether a given certificate (partially) matches this name.

Parameters

cert	certificate to be matched

Returns: the match result

Definition at line 194 of file name_constraint.cpp.

                                                                              {
   class MatchScore final {
      public:
         MatchScore() : m_any(false), m_some(false), m_all(true) {}
 
         void add(bool m) {
            m_any = true;
            m_some |= m;
            m_all &= m;
         }
 
         MatchResult result() const {
            if(!m_any) {
               return MatchResult::NotFound;
            } else if(m_all) {
               return MatchResult::All;
            } else if(m_some) {
               return MatchResult::Some;
            } else {
               return MatchResult::None;
            }
         }
 
      private:
         bool m_any;
         bool m_some;
         bool m_all;
   };
 
   const X509_DN& dn = cert.subject_dn();
   const AlternativeName& alt_name = cert.subject_alt_name();
 
   MatchScore score;
 
   if(m_type == NameType::DNS) {
      const auto& constraint = std::get<DNS_IDX>(m_name);
 
      const auto& alt_names = alt_name.dns();
 
      for(const std::string& dns : alt_names) {
         score.add(matches_dns(dns, constraint));
      }
 
      if(alt_name.count() == 0) {
         // Check CN instead...
         for(const std::string& cn : dn.get_attribute("CN")) {
            if(!string_to_ipv4(cn).has_value()) {
               score.add(matches_dns(canonicalize_dns_name(cn), constraint));
            }
         }
      }
   } else if(m_type == NameType::DN) {
      const X509_DN& constraint = std::get<DN_IDX>(m_name);
      score.add(matches_dn(dn, constraint));
 
      for(const auto& alt_dn : alt_name.directory_names()) {
         score.add(matches_dn(alt_dn, constraint));
      }
   } else if(m_type == NameType::IPv4) {
      auto [net, mask] = std::get<IPV4_IDX>(m_name);
 
      if(alt_name.count() == 0) {
         // Check CN instead...
         for(const std::string& cn : dn.get_attribute("CN")) {
            if(auto ipv4 = string_to_ipv4(cn)) {
               const bool match = (ipv4.value() & mask) == net;
               score.add(match);
            }
         }
      } else {
         for(const uint32_t ipv4 : alt_name.ipv4_address()) {
            const bool match = (ipv4 & mask) == net;
            score.add(match);
         }
      }
   } else {
      // URI and email name constraint matching not implemented
      return MatchResult::UnknownType;
   }
 
   return score.result();
}

References All, Botan::AlternativeName::count(), Botan::AlternativeName::directory_names(), DN, DNS, Botan::AlternativeName::dns(), dns(), Botan::X509_DN::get_attribute(), IPv4, Botan::AlternativeName::ipv4_address(), matches_dn(), matches_dns(), None, NotFound, Some, Botan::string_to_ipv4(), Botan::X509_Certificate::subject_alt_name(), Botan::X509_Certificate::subject_dn(), and UnknownType.

◆ matches_dn()

bool Botan::GeneralName::matches_dn ( const X509_DN & dn ) const

Definition at line 186 of file name_constraint.cpp.

                                                    {
   if(m_type == NameType::DN) {
      const X509_DN& constraint = std::get<DN_IDX>(m_name);
      return matches_dn(dn, constraint);
   }
   return false;
}

References DN, and matches_dn().

Referenced by matches(), and matches_dn().

◆ matches_dns()

bool Botan::GeneralName::matches_dns ( const std::string & dns_name ) const

Definition at line 170 of file name_constraint.cpp.

                                                             {
   if(m_type == NameType::DNS) {
      const auto& constraint = std::get<DNS_IDX>(m_name);
      return matches_dns(dns_name, constraint);
   }
   return false;
}

References DNS, and matches_dns().

Referenced by matches(), and matches_dns().

◆ matches_ipv4()

bool Botan::GeneralName::matches_ipv4 ( uint32_t ip ) const

Definition at line 178 of file name_constraint.cpp.

                                                {
   if(m_type == NameType::IPv4) {
      auto [net, mask] = std::get<IPV4_IDX>(m_name);
      return (ip & mask) == net;
   }
   return false;
}

References IPv4.

◆ name()

std::string Botan::GeneralName::name ( ) const

Returns: The name as string. Format depends on type.

Definition at line 86 of file name_constraint.cpp.

                                  {
   const size_t index = m_name.index();
 
   if(index == RFC822_IDX) {
      return std::get<RFC822_IDX>(m_name);
   } else if(index == DNS_IDX) {
      return std::get<DNS_IDX>(m_name);
   } else if(index == URI_IDX) {
      return std::get<URI_IDX>(m_name);
   } else if(index == DN_IDX) {
      return std::get<DN_IDX>(m_name).to_string();
   } else if(index == IPV4_IDX) {
      auto [net, mask] = std::get<IPV4_IDX>(m_name);
      if(mask == blind_mask) {
         return ipv4_to_string(net);
      } else {
         return fmt("{}/{}", ipv4_to_string(net), ipv4_to_string(mask));
      }
   } else {
      BOTAN_ASSERT_UNREACHABLE();
   }
}

References BOTAN_ASSERT_UNREACHABLE, Botan::fmt(), and Botan::ipv4_to_string().

Referenced by botan_x509_general_name_view_string_value(), and Botan::operator<<().

◆ type()

std::string Botan::GeneralName::type ( ) const

Returns: Type of the name. Can be DN, DNS, IP, RFC822 or URI.

Definition at line 33 of file name_constraint.cpp.

                                  {
   switch(m_type) {
      case NameType::Unknown:
         throw Encoding_Error("Could not convert unknown NameType to string");
      case NameType::RFC822:
         return "RFC822";
      case NameType::DNS:
         return "DNS";
      case NameType::URI:
         return "URI";
      case NameType::DN:
         return "DN";
      case NameType::IPv4:
         return "IP";
      case NameType::Other:
         return "Other";
   }
 
   BOTAN_ASSERT_UNREACHABLE();
}

References BOTAN_ASSERT_UNREACHABLE, DN, DNS, IPv4, Other, RFC822, Unknown, and URI.

Referenced by Botan::operator<<().

◆ type_code()

NameType Botan::GeneralName::type_code ( ) const

inline

Returns: Type of the name expressed in this restriction

Definition at line 311 of file pkix_types.h.

311{ return m_type; }

References type_code().

Referenced by botan_x509_general_name_get_type(), botan_x509_general_name_view_binary_value(), botan_x509_general_name_view_string_value(), and type_code().

◆ uri()

GeneralName Botan::GeneralName::uri ( std::string_view uri )

static

Definition at line 70 of file name_constraint.cpp.

                                               {
   return GeneralName::make<URI_IDX>(uri);
}

References GeneralName(), and uri().

Referenced by GeneralName(), and uri().

The documentation for this class was generated from the following files:

src/lib/x509/pkix_types.h
src/lib/x509/name_constraint.cpp

Public Types

Public Member Functions

Static Public Member Functions

Detailed Description

Member Enumeration Documentation

◆ MatchResult

◆ NameType

Constructor & Destructor Documentation

◆ GeneralName()

Member Function Documentation

◆ BER_encode()

◆ binary_name()

◆ decode_from()

◆ directory_name()

◆ dns()

◆ email()

◆ encode_into()

◆ ipv4_address() [1/2]

◆ ipv4_address() [2/2]

◆ matches()

◆ matches_dn()

◆ matches_dns()

◆ matches_ipv4()

◆ name()

◆ type()

◆ type_code()

◆ uri()