Botan::GeneralName Class Reference

X.509 GeneralName Type. More...

#include <pkix_types.h>

Inheritance diagram for Botan::GeneralName:

Public Types
enum	MatchResult : int {   All , Some , None , NotFound ,   UnknownType }
enum class	NameType : uint8_t {   Unknown = 0 , RFC822 = 1 , DNS = 2 , URI = 3 ,   DN = 4 , IPv4 = 5 , Other = 6 }

Public Member Functions
std::vector< uint8_t >	BER_encode () const
void	decode_from (BER_Decoder &) override
void	encode_into (DER_Encoder &) const override
	GeneralName ()=default
MatchResult	matches (const X509_Certificate &cert) const
bool	matches_dn (const X509_DN &dn) const
bool	matches_dns (const std::string &dns_name) const
bool	matches_ipv4 (uint32_t ip) const
std::string	name () const
std::string	type () const
NameType	type_code () const

Detailed Description

X.509 GeneralName Type.

Handles parsing GeneralName types in their BER and canonical string encoding. Allows matching GeneralNames against each other using the rules laid out in the RFC 5280, sec. 4.2.1.10 (Name Contraints).

This entire class is deprecated and will be removed in a future major release

Definition at line 251 of file pkix_types.h.

Member Enumeration Documentation

MatchResult

enum Botan::GeneralName::MatchResult : int

Enumerator
All
Some
None
NotFound
UnknownType

Definition at line 253 of file pkix_types.h.

                       : int {
         All,
         Some,
         None,
         NotFound,
         UnknownType,
      };

NameType

enum class Botan::GeneralName::NameType : uint8_t

strong

Enumerator
Unknown
RFC822
DNS
URI
DN
IPv4
Other

Definition at line 261 of file pkix_types.h.

                          : uint8_t {
         Unknown = 0,
         RFC822 = 1,
         DNS = 2,
         URI = 3,
         DN = 4,
         IPv4 = 5,
         Other = 6,
      };

Constructor & Destructor Documentation

GeneralName()

Botan::GeneralName::GeneralName ( )

default

Member Function Documentation

BER_encode()

std::vector< uint8_t > Botan::ASN1_Object::BER_encode ( ) const

inherited

Return the encoding of this object. This is a convenience method when just one object needs to be serialized. Use DER_Encoder for complicated encodings.

Definition at line 19 of file asn1_obj.cpp.

                                                 {
   std::vector<uint8_t> output;
   DER_Encoder der(output);
   this->encode_into(der);
   return output;
}

References Botan::ASN1_Object::encode_into().

Referenced by Botan::PSS_Params::decode_from(), Botan::Certificate_Store_In_SQL::find_all_certs(), Botan::Certificate_Store_In_SQL::find_cert(), Botan::X509_Certificate::fingerprint(), Botan::Certificate_Store_In_SQL::insert_cert(), Botan::X509_Object::PEM_encode(), and Botan::Certificate_Store_In_SQL::revoke_cert().

decode_from()

void Botan::GeneralName::decode_from ( BER_Decoder & from )

overridevirtual

Decode whatever this object is from from

Parameters

from	the BER_Decoder that will be read from

Implements Botan::ASN1_Object.

Definition at line 68 of file name_constraint.cpp.

                                              {
   BER_Object obj = ber.get_next_object();
 
   if(obj.is_a(0, ASN1_Class::ExplicitContextSpecific)) {
      m_type = NameType::Other;
   } else if(obj.is_a(1, ASN1_Class::ContextSpecific)) {
      m_type = NameType::RFC822;
      m_name.emplace<RFC822_IDX>(ASN1::to_string(obj));
   } else if(obj.is_a(2, ASN1_Class::ContextSpecific)) {
      m_type = NameType::DNS;
      // Store it in case insensitive form so we don't have to do it
      // again while matching
      m_name.emplace<DNS_IDX>(tolower_string(ASN1::to_string(obj)));
   } else if(obj.is_a(6, ASN1_Class::ContextSpecific)) {
      m_type = NameType::URI;
      m_name.emplace<URI_IDX>(ASN1::to_string(obj));
   } else if(obj.is_a(4, ASN1_Class::ContextSpecific | ASN1_Class::Constructed)) {
      X509_DN dn;
      BER_Decoder dec(obj);
      dn.decode_from(dec);
      m_type = NameType::DN;
      m_name.emplace<DN_IDX>(dn);
   } else if(obj.is_a(7, ASN1_Class::ContextSpecific)) {
      if(obj.length() == 8) {
         const uint32_t net = load_be<uint32_t>(obj.bits(), 0);
         const uint32_t mask = load_be<uint32_t>(obj.bits(), 1);
 
         m_type = NameType::IPv4;
         m_name.emplace<IPV4_IDX>(std::make_pair(net, mask));
      } else if(obj.length() == 32) {
         // IPv6 name constraints are not implemented
         m_type = NameType::Unknown;
      } else {
         throw Decoding_Error("Invalid IP name constraint size " + std::to_string(obj.length()));
      }
   } else {
      m_type = NameType::Unknown;
   }
}

References Botan::BER_Object::bits(), Botan::Constructed, Botan::ContextSpecific, Botan::X509_DN::decode_from(), DN, DNS, Botan::ExplicitContextSpecific, Botan::BER_Decoder::get_next_object(), IPv4, Botan::BER_Object::is_a(), Botan::BER_Object::length(), Botan::load_be(), Other, RFC822, Botan::ASN1::to_string(), Botan::tolower_string(), Unknown, and URI.

encode_into()

void Botan::GeneralName::encode_into ( DER_Encoder & to ) const

overridevirtual

Encode whatever this object is into to

Parameters

to	the DER_Encoder that will be written to

Implements Botan::ASN1_Object.

Definition at line 64 of file name_constraint.cpp.

                                                  {
   throw Not_Implemented("GeneralName encoding");
}

matches()

GeneralName::MatchResult Botan::GeneralName::matches

(

const X509_Certificate &

cert

)

const

Checks whether a given certificate (partially) matches this name.

Parameters

cert	certificate to be matched

Returns

the match result

Definition at line 132 of file name_constraint.cpp.

                                                                              {
   class MatchScore final {
      public:
         MatchScore() : m_any(false), m_some(false), m_all(true) {}
 
         void add(bool m) {
            m_any = true;
            m_some |= m;
            m_all &= m;
         }
 
         MatchResult result() const {
            if(!m_any) {
               return MatchResult::NotFound;
            } else if(m_all) {
               return MatchResult::All;
            } else if(m_some) {
               return MatchResult::Some;
            } else {
               return MatchResult::None;
            }
         }
 
      private:
         bool m_any;
         bool m_some;
         bool m_all;
   };
 
   const X509_DN& dn = cert.subject_dn();
   const AlternativeName& alt_name = cert.subject_alt_name();
 
   MatchScore score;
 
   if(m_type == NameType::DNS) {
      const auto& constraint = std::get<DNS_IDX>(m_name);
 
      const auto& alt_names = alt_name.dns();
 
      for(const std::string& dns : alt_names) {
         score.add(matches_dns(dns, constraint));
      }
 
      if(alt_name.count() == 0) {
         // Check CN instead...
         for(const std::string& cn : dn.get_attribute("CN")) {
            if(!string_to_ipv4(cn).has_value()) {
               score.add(matches_dns(cn, constraint));
            }
         }
      }
   } else if(m_type == NameType::DN) {
      const X509_DN& constraint = std::get<DN_IDX>(m_name);
      score.add(matches_dn(dn, constraint));
 
      for(const auto& alt_dn : alt_name.directory_names()) {
         score.add(matches_dn(alt_dn, constraint));
      }
   } else if(m_type == NameType::IPv4) {
      auto [net, mask] = std::get<IPV4_IDX>(m_name);
 
      if(alt_name.count() == 0) {
         // Check CN instead...
         for(const std::string& cn : dn.get_attribute("CN")) {
            if(auto ipv4 = string_to_ipv4(cn)) {
               bool match = (ipv4.value() & mask) == net;
               score.add(match);
            }
         }
      } else {
         for(uint32_t ipv4 : alt_name.ipv4_address()) {
            bool match = (ipv4 & mask) == net;
            score.add(match);
         }
      }
   } else {
      // URI and email name constraint matching not implemented
      return MatchResult::UnknownType;
   }
 
   return score.result();
}

References Botan::AlternativeName::count(), Botan::AlternativeName::directory_names(), DN, DNS, Botan::AlternativeName::dns(), final, Botan::X509_DN::get_attribute(), IPv4, Botan::AlternativeName::ipv4_address(), matches_dn(), matches_dns(), Botan::string_to_ipv4(), Botan::X509_Certificate::subject_alt_name(), Botan::X509_Certificate::subject_dn(), and UnknownType.

matches_dn()

bool Botan::GeneralName::matches_dn

(

const X509_DN &

dn

)

const

Definition at line 124 of file name_constraint.cpp.

                                                    {
   if(m_type == NameType::DN) {
      const X509_DN& constraint = std::get<DN_IDX>(m_name);
      return matches_dn(dn, constraint);
   }
   return false;
}

References DN, and matches_dn().

Referenced by matches(), and matches_dn().

matches_dns()

bool Botan::GeneralName::matches_dns

(

const std::string &

dns_name

)

const

Definition at line 108 of file name_constraint.cpp.

                                                             {
   if(m_type == NameType::DNS) {
      const auto& constraint = std::get<DNS_IDX>(m_name);
      return matches_dns(dns_name, constraint);
   }
   return false;
}

References DNS, and matches_dns().

Referenced by matches(), and matches_dns().

matches_ipv4()

bool Botan::GeneralName::matches_ipv4

(

uint32_t

ip

)

const

Definition at line 116 of file name_constraint.cpp.

                                                {
   if(m_type == NameType::IPv4) {
      auto [net, mask] = std::get<IPV4_IDX>(m_name);
      return (ip & mask) == net;
   }
   return false;
}

References IPv4.

name()

std::string Botan::GeneralName::name

(

)

const

Returns

The name as string. Format depends on type.

Definition at line 45 of file name_constraint.cpp.

                                  {
   const size_t index = m_name.index();
 
   if(index == RFC822_IDX) {
      return std::get<RFC822_IDX>(m_name);
   } else if(index == DNS_IDX) {
      return std::get<DNS_IDX>(m_name);
   } else if(index == URI_IDX) {
      return std::get<URI_IDX>(m_name);
   } else if(index == DN_IDX) {
      return std::get<DN_IDX>(m_name).to_string();
   } else if(index == IPV4_IDX) {
      auto [net, mask] = std::get<IPV4_IDX>(m_name);
      return fmt("{}/{}", ipv4_to_string(net), ipv4_to_string(mask));
   } else {
      BOTAN_ASSERT_UNREACHABLE();
   }
}

References BOTAN_ASSERT_UNREACHABLE, Botan::fmt(), and Botan::ipv4_to_string().

Referenced by Botan::operator<<().

type()

std::string Botan::GeneralName::type

(

)

const

Returns

Type of the name. Can be DN, DNS, IP, RFC822 or URI.

Definition at line 24 of file name_constraint.cpp.

                                  {
   switch(m_type) {
      case NameType::Unknown:
         throw Encoding_Error("Could not convert unknown NameType to string");
      case NameType::RFC822:
         return "RFC822";
      case NameType::DNS:
         return "DNS";
      case NameType::URI:
         return "URI";
      case NameType::DN:
         return "DN";
      case NameType::IPv4:
         return "IP";
      case NameType::Other:
         return "Other";
   }
 
   BOTAN_ASSERT_UNREACHABLE();
}

References BOTAN_ASSERT_UNREACHABLE, DN, DNS, IPv4, Other, RFC822, Unknown, and URI.

Referenced by Botan::operator<<().

type_code()

NameType Botan::GeneralName::type_code ( ) const

inline

Returns

Type of the name expressed in this restriction

Definition at line 281 of file pkix_types.h.

{ return m_type; }

---

The documentation for this class was generated from the following files:

• src/lib/x509/pkix_types.h
• src/lib/x509/name_constraint.cpp