Botan::GeneralName Class Reference

X.509 GeneralName Type. More...

#include <pkix_types.h>

Inheritance diagram for Botan::GeneralName:

Public Types
enum	MatchResult : uint8_t {   All , Some , None , NotFound ,   UnknownType }
enum class	NameType : uint8_t {   Unknown = 0 , RFC822 = 1 , DNS = 2 , URI = 3 ,   DN = 4 , IPv4 = 5 , IPv6 = 6 , Other = 7 }

Public Member Functions
std::vector< uint8_t >	BER_encode () const
std::vector< uint8_t >	binary_name () const
void	decode_from (BER_Decoder &from) override
void	encode_into (DER_Encoder &to) const override
	GeneralName ()=default
MatchResult	matches (const X509_Certificate &cert) const
bool	matches_dn (const X509_DN &dn) const
bool	matches_dns (const std::string &dns_name) const
bool	matches_ipv4 (IPv4Address ip) const
bool	matches_ipv4 (uint32_t ip) const
bool	matches_ipv6 (const IPv6Address &ip) const
std::string	name () const
std::string	type () const
NameType	type_code () const

Static Public Member Functions
static GeneralName	directory_name (Botan::X509_DN dn)
static GeneralName	dns (std::string_view dns)
static GeneralName	email (std::string_view email)
static GeneralName	ipv4_address (const IPv4Subnet &subnet)
static GeneralName	ipv4_address (IPv4Address ipv4)
static GeneralName	ipv4_address (uint32_t ipv4)
static GeneralName	ipv4_address (uint32_t ipv4, uint32_t mask)
static GeneralName	ipv6_address (const IPv6Address &ipv6)
static GeneralName	ipv6_address (const IPv6Subnet &subnet)
static GeneralName	uri (std::string_view uri)

Friends
class	NameConstraints

Detailed Description

X.509 GeneralName Type.

Handles parsing GeneralName types in their BER and canonical string encoding. Allows matching GeneralNames against each other using the rules laid out in the RFC 5280, sec. 4.2.1.10 (Name Constraints).

This entire class is deprecated and will be removed in a future major release

Definition at line 286 of file pkix_types.h.

Member Enumeration Documentation

MatchResult

enum Botan::GeneralName::MatchResult : uint8_t

Enumerator
All
Some
None
NotFound
UnknownType

Definition at line 288 of file pkix_types.h.

                       : uint8_t /* NOLINT(*-use-enum-class) */ {
         All,
         Some,
         None,
         NotFound,
         UnknownType,
      };

NameType

enum class Botan::GeneralName::NameType : uint8_t

strong

Enumerator
Unknown
RFC822
DNS
URI
DN
IPv4
IPv6
Other

Definition at line 296 of file pkix_types.h.

                          : uint8_t {
         Unknown = 0,
         RFC822 = 1,
         DNS = 2,
         URI = 3,
         DN = 4,
         IPv4 = 5,
         IPv6 = 6,
         Other = 7,
      };

Constructor & Destructor Documentation

GeneralName()

Botan::GeneralName::GeneralName ( )

default

References decode_from(), directory_name(), dns(), email(), encode_into(), GeneralName(), ipv4_address(), ipv6_address(), and uri().

Referenced by directory_name(), dns(), email(), GeneralName(), ipv4_address(), ipv4_address(), ipv4_address(), ipv4_address(), ipv6_address(), ipv6_address(), NameConstraints, and uri().

Member Function Documentation

BER_encode()

std::vector< uint8_t > Botan::ASN1_Object::BER_encode ( ) const

inherited

Return the encoding of this object. This is a convenience method when just one object needs to be serialized. Use DER_Encoder for complicated encodings.

Definition at line 20 of file asn1_obj.cpp.

                                                 {
   std::vector<uint8_t> output;
   DER_Encoder der(output);
   this->encode_into(der);
   return output;
}

References encode_into().

Referenced by decode_from(), Botan::Certificate_Store_In_SQL::find_all_certs(), Botan::Certificate_Store_In_SQL::find_cert(), Botan::X509_Certificate::fingerprint(), Botan::Certificate_Store_In_SQL::insert_cert(), Botan::X509_Object::PEM_encode(), Botan::PSS_Params::PSS_Params(), and Botan::Certificate_Store_In_SQL::revoke_cert().

binary_name()

std::vector< uint8_t > Botan::GeneralName::binary_name

(

)

const

Returns

The name as binary string. Format depends on type.

Definition at line 123 of file name_constraint.cpp.

                                                  {
   return std::visit(Botan::overloaded{
                        [](const Botan::X509_DN& dn) { return Botan::ASN1::put_in_sequence(dn.get_bits()); },
                        [](const IPv4Subnet& subnet) { return subnet.serialize(); },
                        [](const IPv6Subnet& subnet) { return subnet.serialize(); },
                        [](const auto&) -> std::vector<uint8_t> {
                           throw Invalid_State("Cannot convert GeneralName to binary string");
                        },
                     },
                     m_name);
}

References Botan::ASN1::put_in_sequence().

Referenced by botan_x509_general_name_view_binary_value().

decode_from()

void Botan::GeneralName::decode_from ( BER_Decoder & from )

overridevirtual

Decode whatever this object is from from

Parameters

from	the BER_Decoder that will be read from

Implements Botan::ASN1_Object.

Definition at line 139 of file name_constraint.cpp.

                                              {
   const BER_Object obj = ber.get_next_object();
 
   if(obj.is_a(0, ASN1_Class::ExplicitContextSpecific)) {
      m_type = NameType::Other;
   } else if(obj.is_a(1, ASN1_Class::ContextSpecific)) {
      m_type = NameType::RFC822;
      m_name.emplace<RFC822_IDX>(ASN1::to_string(obj));
   } else if(obj.is_a(2, ASN1_Class::ContextSpecific)) {
      // Store it in case insensitive form so we don't have to do it
      // again while matching
      auto dns = canonicalize_dns_name(ASN1::to_string(obj));
      // An empty DNS subtree has no clear meaning, reject immediately
      if(dns.empty()) {
         throw Decoding_Error("Empty DNS name in GeneralName");
      }
      m_type = NameType::DNS;
      m_name.emplace<DNS_IDX>(std::move(dns));
   } else if(obj.is_a(6, ASN1_Class::ContextSpecific)) {
      m_type = NameType::URI;
      m_name.emplace<URI_IDX>(ASN1::to_string(obj));
   } else if(obj.is_a(4, ASN1_Class::ContextSpecific | ASN1_Class::Constructed)) {
      X509_DN dn;
      BER_Decoder dec(obj, ber.limits());
      dn.decode_from(dec);
      m_type = NameType::DN;
      m_name.emplace<DN_IDX>(dn);
   } else if(obj.is_a(7, ASN1_Class::ContextSpecific)) {
      if(obj.length() == 8) {
         const auto addr_and_mask = std::span<const uint8_t, 8>{obj.bits(), 8};
         auto subnet = IPv4Subnet::from_address_and_mask(addr_and_mask);
         if(!subnet.has_value()) {
            throw Decoding_Error("IPv4 name constraint mask is not a contiguous CIDR prefix");
         }
 
         m_type = NameType::IPv4;
         m_name.emplace<IPV4_IDX>(*subnet);
      } else if(obj.length() == 32) {
         const auto addr_and_mask = std::span<const uint8_t, 32>{obj.bits(), 32};
         auto subnet = IPv6Subnet::from_address_and_mask(addr_and_mask);
         if(!subnet.has_value()) {
            throw Decoding_Error("IPv6 name constraint mask is not a contiguous CIDR prefix");
         }
 
         m_type = NameType::IPv6;
         m_name.emplace<IPV6_IDX>(*subnet);
      } else {
         throw Decoding_Error("Invalid IP name constraint size " + std::to_string(obj.length()));
      }
   } else {
      m_type = NameType::Unknown;
   }
}

References Botan::BER_Object::bits(), Botan::Constructed, Botan::ContextSpecific, Botan::X509_DN::decode_from(), DN, DNS, dns(), Botan::ExplicitContextSpecific, Botan::IPv4Subnet::from_address_and_mask(), Botan::IPv6Subnet::from_address_and_mask(), Botan::BER_Decoder::get_next_object(), IPv4, IPv6, Botan::BER_Object::is_a(), Botan::BER_Object::length(), Botan::BER_Decoder::limits(), Other, RFC822, Botan::ASN1::to_string(), Unknown, and URI.

Referenced by GeneralName().

directory_name()

GeneralName Botan::GeneralName::directory_name ( Botan::X509_DN dn )

static

Definition at line 69 of file name_constraint.cpp.

                                                       {
   return GeneralName::make<DN_IDX>(std::move(dn));
}

References GeneralName().

Referenced by GeneralName().

dns()

GeneralName Botan::GeneralName::dns ( std::string_view dns )

static

Definition at line 61 of file name_constraint.cpp.

                                               {
   return GeneralName::make<DNS_IDX>(dns);
}

References dns(), and GeneralName().

Referenced by decode_from(), dns(), GeneralName(), and matches().

email()

GeneralName Botan::GeneralName::email ( std::string_view email )

static

Definition at line 57 of file name_constraint.cpp.

                                                   {
   return GeneralName::make<RFC822_IDX>(email);
}

References email(), and GeneralName().

Referenced by email(), and GeneralName().

encode_into()

void Botan::GeneralName::encode_into ( DER_Encoder & to ) const

overridevirtual

Encode whatever this object is into to

Parameters

to	the DER_Encoder that will be written to

Implements Botan::ASN1_Object.

Definition at line 135 of file name_constraint.cpp.

                                                  {
   throw Not_Implemented("GeneralName encoding");
}

Referenced by GeneralName().

ipv4_address() [1/4]

GeneralName Botan::GeneralName::ipv4_address ( const IPv4Subnet & subnet )

static

Definition at line 89 of file name_constraint.cpp.

                                                              {
   return GeneralName::make<IPV4_IDX>(subnet);
}

References GeneralName().

ipv4_address() [2/4]

GeneralName Botan::GeneralName::ipv4_address ( IPv4Address ipv4 )

static

Definition at line 85 of file name_constraint.cpp.

                                                      {
   return GeneralName::make<IPV4_IDX>(IPv4Subnet::host(ipv4));
}

References GeneralName(), and Botan::IPv4Subnet::host().

ipv4_address() [3/4]

GeneralName Botan::GeneralName::ipv4_address ( uint32_t ipv4 )

static

Definition at line 73 of file name_constraint.cpp.

                                                   {
   return GeneralName::ipv4_address(IPv4Address(ipv4));
}

References GeneralName(), and ipv4_address().

Referenced by GeneralName(), and ipv4_address().

ipv4_address() [4/4]

GeneralName Botan::GeneralName::ipv4_address ( uint32_t ipv4, uint32_t mask )

static

Definition at line 77 of file name_constraint.cpp.

                                                                  {
   auto subnet = IPv4Subnet::from_address_and_mask(ipv4, mask);
   if(!subnet.has_value()) {
      throw Invalid_Argument("IPv4 subnet mask is not a contiguous CIDR prefix");
   }
   return GeneralName::make<IPV4_IDX>(*subnet);
}

References Botan::IPv4Subnet::from_address_and_mask(), and GeneralName().

ipv6_address() [1/2]

GeneralName Botan::GeneralName::ipv6_address ( const IPv6Address & ipv6 )

static

Definition at line 93 of file name_constraint.cpp.

                                                             {
   return GeneralName::make<IPV6_IDX>(IPv6Subnet::host(ipv6));
}

References GeneralName(), and Botan::IPv6Subnet::host().

Referenced by GeneralName().

ipv6_address() [2/2]

GeneralName Botan::GeneralName::ipv6_address ( const IPv6Subnet & subnet )

static

Definition at line 97 of file name_constraint.cpp.

                                                              {
   return GeneralName::make<IPV6_IDX>(subnet);
}

References GeneralName().

matches()

GeneralName::MatchResult Botan::GeneralName::matches

(

const X509_Certificate &

cert

)

const

Checks whether a given certificate (partially) matches this name.

Parameters

cert	certificate to be matched

Returns

the match result

Definition at line 223 of file name_constraint.cpp.

                                                                              {
   class MatchScore final {
      public:
         MatchScore() : m_any(false), m_some(false), m_all(true) {}
 
         void add(bool m) {
            m_any = true;
            m_some |= m;
            m_all &= m;
         }
 
         MatchResult result() const {
            if(!m_any) {
               return MatchResult::NotFound;
            } else if(m_all) {
               return MatchResult::All;
            } else if(m_some) {
               return MatchResult::Some;
            } else {
               return MatchResult::None;
            }
         }
 
      private:
         bool m_any;
         bool m_some;
         bool m_all;
   };
 
   const X509_DN& dn = cert.subject_dn();
   const AlternativeName& alt_name = cert.subject_alt_name();
 
   MatchScore score;
 
   if(m_type == NameType::DNS) {
      const auto& constraint = std::get<DNS_IDX>(m_name);
 
      const auto& alt_names = alt_name.dns();
 
      for(const std::string& dns : alt_names) {
         score.add(matches_dns(dns, constraint));
      }
 
      if(alt_name.count() == 0) {
         // Check CN instead...
         for(const std::string& cn : dn.get_attribute("CN")) {
            if(!string_to_ipv4(cn).has_value()) {
               score.add(matches_dns(canonicalize_dns_name(cn), constraint));
            }
         }
      }
   } else if(m_type == NameType::DN) {
      const X509_DN& constraint = std::get<DN_IDX>(m_name);
      score.add(matches_dn(dn, constraint));
 
      for(const auto& alt_dn : alt_name.directory_names()) {
         score.add(matches_dn(alt_dn, constraint));
      }
   } else if(m_type == NameType::IPv4) {
      const auto& subnet = std::get<IPV4_IDX>(m_name);
 
      if(alt_name.count() == 0) {
         // Check CN instead...
         for(const std::string& cn : dn.get_attribute("CN")) {
            if(auto ipv4 = string_to_ipv4(cn)) {
               score.add(subnet.contains(IPv4Address(*ipv4)));
            }
         }
      } else {
         for(const uint32_t ipv4 : alt_name.ipv4_address()) {
            score.add(subnet.contains(IPv4Address(ipv4)));
         }
      }
   } else if(m_type == NameType::IPv6) {
      for(const auto& ipv6 : alt_name.ipv6_address()) {
         score.add(matches_ipv6(ipv6));
      }
   } else {
      // URI and email name constraint matching not implemented
      return MatchResult::UnknownType;
   }
 
   return score.result();
}

References All, Botan::AlternativeName::count(), Botan::AlternativeName::directory_names(), DN, DNS, Botan::AlternativeName::dns(), dns(), Botan::X509_DN::get_attribute(), IPv4, Botan::AlternativeName::ipv4_address(), IPv6, Botan::AlternativeName::ipv6_address(), matches_dn(), matches_dns(), matches_ipv6(), None, NotFound, Some, Botan::string_to_ipv4(), Botan::X509_Certificate::subject_alt_name(), Botan::X509_Certificate::subject_dn(), and UnknownType.

matches_dn()

bool Botan::GeneralName::matches_dn

(

const X509_DN &

dn

)

const

Definition at line 215 of file name_constraint.cpp.

                                                    {
   if(m_type == NameType::DN) {
      const X509_DN& constraint = std::get<DN_IDX>(m_name);
      return matches_dn(dn, constraint);
   }
   return false;
}

References DN, and matches_dn().

Referenced by matches(), and matches_dn().

matches_dns()

bool Botan::GeneralName::matches_dns

(

const std::string &

dns_name

)

const

Definition at line 193 of file name_constraint.cpp.

                                                             {
   if(m_type == NameType::DNS) {
      const auto& constraint = std::get<DNS_IDX>(m_name);
      return matches_dns(dns_name, constraint);
   }
   return false;
}

References DNS, and matches_dns().

Referenced by matches(), and matches_dns().

matches_ipv4() [1/2]

bool Botan::GeneralName::matches_ipv4 ( IPv4Address ip ) const

inline

Definition at line 355 of file pkix_types.h.

{ return matches_ipv4(ip.value()); }

References matches_ipv4(), and matches_ipv4().

Referenced by matches_ipv4().

matches_ipv4() [2/2]

bool Botan::GeneralName::matches_ipv4

(

uint32_t

ip

)

const

Definition at line 201 of file name_constraint.cpp.

                                                {
   if(m_type == NameType::IPv4) {
      return std::get<IPV4_IDX>(m_name).contains(IPv4Address(ip));
   }
   return false;
}

References IPv4.

Referenced by matches_ipv4().

matches_ipv6()

bool Botan::GeneralName::matches_ipv6

(

const IPv6Address &

ip

)

const

Definition at line 208 of file name_constraint.cpp.

                                                          {
   if(m_type == NameType::IPv6) {
      return std::get<IPV6_IDX>(m_name).contains(ip);
   }
   return false;
}

References IPv6.

Referenced by matches().

name()

std::string Botan::GeneralName::name

(

)

const

Returns

The name as string. Format depends on type.

Definition at line 101 of file name_constraint.cpp.

                                  {
   const size_t index = m_name.index();
 
   if(index == RFC822_IDX) {
      return std::get<RFC822_IDX>(m_name);
   } else if(index == DNS_IDX) {
      return std::get<DNS_IDX>(m_name);
   } else if(index == URI_IDX) {
      return std::get<URI_IDX>(m_name);
   } else if(index == DN_IDX) {
      return std::get<DN_IDX>(m_name).to_string();
   } else if(index == IPV4_IDX) {
      const auto& subnet = std::get<IPV4_IDX>(m_name);
      return subnet.is_host() ? subnet.address().to_string() : subnet.to_string();
   } else if(index == IPV6_IDX) {
      const auto& subnet = std::get<IPV6_IDX>(m_name);
      return subnet.is_host() ? subnet.address().to_string() : subnet.to_string();
   } else {
      BOTAN_ASSERT_UNREACHABLE();
   }
}

References BOTAN_ASSERT_UNREACHABLE.

Referenced by botan_x509_general_name_view_string_value(), NameConstraints, and Botan::operator<<().

type()

std::string Botan::GeneralName::type

(

)

const

Returns

Type of the name. Can be DN, DNS, IP, RFC822 or URI.

Definition at line 34 of file name_constraint.cpp.

                                  {
   switch(m_type) {
      case NameType::Unknown:
         throw Encoding_Error("Could not convert unknown NameType to string");
      case NameType::RFC822:
         return "RFC822";
      case NameType::DNS:
         return "DNS";
      case NameType::URI:
         return "URI";
      case NameType::DN:
         return "DN";
      case NameType::IPv4:
         return "IP";
      case NameType::IPv6:
         return "IPv6";
      case NameType::Other:
         return "Other";
   }
 
   BOTAN_ASSERT_UNREACHABLE();
}

References BOTAN_ASSERT_UNREACHABLE, DN, DNS, IPv4, IPv6, Other, RFC822, Unknown, and URI.

Referenced by NameConstraints, and Botan::operator<<().

type_code()

NameType Botan::GeneralName::type_code ( ) const

inline

Returns

Type of the name expressed in this restriction

Definition at line 328 of file pkix_types.h.

{ return m_type; }

References type_code().

Referenced by botan_x509_general_name_get_type(), botan_x509_general_name_view_binary_value(), botan_x509_general_name_view_string_value(), and type_code().

uri()

GeneralName Botan::GeneralName::uri ( std::string_view uri )

static

Definition at line 65 of file name_constraint.cpp.

                                               {
   return GeneralName::make<URI_IDX>(uri);
}

References GeneralName(), and uri().

Referenced by GeneralName(), and uri().

Friends And Related Symbol Documentation

NameConstraints

friend class NameConstraints

friend

Definition at line 361 of file pkix_types.h.

References GeneralName(), name(), NameConstraints, and type().

Referenced by NameConstraints.

---

The documentation for this class was generated from the following files:

• src/lib/x509/pkix_types.h
• src/lib/x509/name_constraint.cpp