Botan::NameConstraints Class Reference

Name Constraints. More...

#include <pkix_types.h>

Public Member Functions
const std::vector< GeneralSubtree > &	excluded () const
bool	is_excluded (const X509_Certificate &cert, bool reject_unknown) const
bool	is_permitted (const X509_Certificate &cert, bool reject_unknown) const
	NameConstraints ()=default
	NameConstraints (std::vector< GeneralSubtree > &&permitted_subtrees, std::vector< GeneralSubtree > &&excluded_subtrees)
const std::vector< GeneralSubtree > &	permitted () const

Detailed Description

Name Constraints.

Wraps the Name Constraints associated with a certificate.

Definition at line 431 of file pkix_types.h.

Constructor & Destructor Documentation

NameConstraints() [1/2]

Botan::NameConstraints::NameConstraints ( )

default

Creates an empty name NameConstraints.

References NameConstraints().

Referenced by NameConstraints().

NameConstraints() [2/2]

Botan::NameConstraints::NameConstraints	(	std::vector< GeneralSubtree > &&	permitted_subtrees,
		std::vector< GeneralSubtree > &&	excluded_subtrees )

Creates NameConstraints from a list of permitted and excluded subtrees.

Parameters

permitted_subtrees	names for which the certificate is permitted
excluded_subtrees	names for which the certificate is not permitted

Definition at line 395 of file name_constraint.cpp.

                                                                                :
      m_permitted_subtrees(std::move(permitted_subtrees)), m_excluded_subtrees(std::move(excluded_subtrees)) {
   for(const auto& c : m_permitted_subtrees) {
      m_permitted_name_types.insert(c.base().type_code());
   }
   for(const auto& c : m_excluded_subtrees) {
      m_excluded_name_types.insert(c.base().type_code());
   }
}

Member Function Documentation

excluded()

const std::vector< GeneralSubtree > & Botan::NameConstraints::excluded ( ) const

inline

Returns

excluded names

Definition at line 456 of file pkix_types.h.

                                                                                                      {
         return m_excluded_subtrees;
      }

References excluded().

Referenced by botan_x509_cert_excluded_name_constraints(), excluded(), and is_excluded().

is_excluded()

bool Botan::NameConstraints::is_excluded	(	const X509_Certificate &	cert,
		bool	reject_unknown ) const

Return true if any of the names in the certificate are excluded

Definition at line 591 of file name_constraint.cpp.

                                                                                         {
   if(excluded().empty()) {
      return false;
   }
 
   const auto& alt_name = cert.subject_alt_name();
 
   if(exceeds_limit(cert.subject_dn().count(), alt_name.count(), excluded().size())) {
      return true;
   }
 
   if(reject_unknown) {
      // This is one is overly broad: we should just reject if there is a name constraint
      // with the same OID as one of the other names
      if(m_excluded_name_types.contains(GeneralName::NameType::Other) && !alt_name.other_names().empty()) {
         return true;
      }
      if(m_excluded_name_types.contains(GeneralName::NameType::URI) && !alt_name.uris().empty()) {
         return true;
      }
      if(m_excluded_name_types.contains(GeneralName::NameType::RFC822) && !alt_name.email().empty()) {
         return true;
      }
   }
 
   auto is_excluded_dn = [&](const X509_DN& dn) {
      // If no restrictions, then immediate accept
      if(!m_excluded_name_types.contains(GeneralName::NameType::DN)) {
         return false;
      }
 
      for(const auto& c : m_excluded_subtrees) {
         if(c.base().matches_dn(dn)) {
            return true;
         }
      }
 
      // There is at least one excluded name and we didn't match
      return false;
   };
 
   auto is_excluded_dns_name = [&](const std::string& name) {
      if(name.empty() || name.starts_with(".")) {
         return true;
      }
 
      // If no restrictions, then immediate accept
      if(!m_excluded_name_types.contains(GeneralName::NameType::DNS)) {
         return false;
      }
 
      const bool name_has_wildcard = (name.find('*') != std::string::npos);
 
      for(const auto& c : m_excluded_subtrees) {
         if(c.base().matches_dns(name)) {
            return true;
         }
 
         /*
         RFC 5280 4.2.1.10 - "any name matching a restriction in the
         excludedSubtrees field is invalid".
 
         If the cert has a wildcard SAN (*.example.com), and that wildcard
         could be matched against an excluded name, it must be rejected.
         */
         if(name_has_wildcard && c.base().m_type == GeneralName::NameType::DNS) {
            const auto& constraint = std::get<GeneralName::DNS_IDX>(c.base().m_name);
            if(host_wildcard_match(name, constraint)) {
               return true;
            }
         }
      }
 
      // There is at least one excluded name and we didn't match
      return false;
   };
 
   auto is_excluded_ipv4 = [&](uint32_t ipv4) {
      if(m_excluded_name_types.contains(GeneralName::NameType::IPv4)) {
         for(const auto& c : m_excluded_subtrees) {
            if(c.base().matches_ipv4(ipv4)) {
               return true;
            }
         }
      }
 
      // This name did not match any of the excluded names
      return false;
   };
 
   auto is_excluded_ipv6 = [&](const IPv6Address& ipv6) {
      if(m_excluded_name_types.contains(GeneralName::NameType::IPv6)) {
         for(const auto& c : m_excluded_subtrees) {
            if(c.base().matches_ipv6(ipv6)) {
               return true;
            }
         }
      }
 
      // An IPv4-mapped IPv6 address names an IPv4 address so verify that
      // address is not restricted by an IPv4 excludes rule
      if(m_excluded_name_types.contains(GeneralName::NameType::IPv4)) {
         if(auto embedded_v4 = ipv6.as_ipv4()) {
            for(const auto& c : m_excluded_subtrees) {
               if(c.base().matches_ipv4(*embedded_v4)) {
                  return true;
               }
            }
         }
      }
 
      // This name did not match any of the excluded names
      return false;
   };
 
   if(is_excluded_dn(cert.subject_dn())) {
      return true;
   }
 
   for(const auto& alt_dn : alt_name.directory_names()) {
      if(is_excluded_dn(alt_dn)) {
         return true;
      }
   }
 
   for(const auto& alt_dns : alt_name.dns()) {
      if(is_excluded_dns_name(alt_dns)) {
         return true;
      }
   }
 
   for(const auto& alt_ipv4 : alt_name.ipv4_address()) {
      if(is_excluded_ipv4(alt_ipv4)) {
         return true;
      }
   }
 
   for(const auto& alt_ipv6 : alt_name.ipv6_address()) {
      if(is_excluded_ipv6(alt_ipv6)) {
         return true;
      }
   }
 
   if(alt_name.count() == 0) {
      for(const auto& cn : cert.subject_info("Name")) {
         if(cn.find(".") != std::string::npos) {
            if(auto ipv4 = string_to_ipv4(cn)) {
               if(is_excluded_ipv4(ipv4.value())) {
                  return true;
               }
            } else {
               if(is_excluded_dns_name(canonicalize_dns_name(cn))) {
                  return true;
               }
            }
         }
      }
   }
 
   // We didn't encounter a name that matched any prohibited name
   return false;
}

References Botan::X509_DN::count(), Botan::GeneralName::DN, Botan::GeneralName::DNS, excluded(), Botan::host_wildcard_match(), Botan::GeneralName::IPv4, Botan::GeneralName::IPv6, Botan::GeneralName::Other, Botan::GeneralName::RFC822, Botan::string_to_ipv4(), Botan::X509_Certificate::subject_alt_name(), Botan::X509_Certificate::subject_dn(), Botan::X509_Certificate::subject_info(), and Botan::GeneralName::URI.

is_permitted()

bool Botan::NameConstraints::is_permitted	(	const X509_Certificate &	cert,
		bool	reject_unknown ) const

Return true if all of the names in the certificate are permitted

Definition at line 427 of file name_constraint.cpp.

                                                                                          {
   if(permitted().empty()) {
      return true;
   }
 
   const auto& alt_name = cert.subject_alt_name();
 
   if(exceeds_limit(cert.subject_dn().count(), alt_name.count(), permitted().size())) {
      return false;
   }
 
   if(reject_unknown) {
      if(m_permitted_name_types.contains(GeneralName::NameType::Other) && !alt_name.other_names().empty()) {
         return false;
      }
      if(m_permitted_name_types.contains(GeneralName::NameType::URI) && !alt_name.uris().empty()) {
         return false;
      }
      if(m_permitted_name_types.contains(GeneralName::NameType::RFC822) && !alt_name.email().empty()) {
         return false;
      }
   }
 
   auto is_permitted_dn = [&](const X509_DN& dn) {
      // If no restrictions, then immediate accept
      if(!m_permitted_name_types.contains(GeneralName::NameType::DN)) {
         return true;
      }
 
      for(const auto& c : m_permitted_subtrees) {
         if(c.base().matches_dn(dn)) {
            return true;
         }
      }
 
      // There is at least one permitted name and we didn't match
      return false;
   };
 
   auto is_permitted_dns_name = [&](const std::string& name) {
      if(name.empty() || name.starts_with(".")) {
         return false;
      }
 
      // If no restrictions, then immediate accept
      if(!m_permitted_name_types.contains(GeneralName::NameType::DNS)) {
         return true;
      }
 
      for(const auto& c : m_permitted_subtrees) {
         if(c.base().matches_dns(name)) {
            return true;
         }
      }
 
      // There is at least one permitted name and we didn't match
      return false;
   };
 
   /*
   RFC 5280 4.2.1.10: iPAddress is a single GeneralName element where
   IPv4 and IPv6 are distinguished only by the length.
 
   An iPAddress subtree of either version therefore restricts the iPAddress name
   form for both versions.
   */
   const bool ip_form_restricted = m_permitted_name_types.contains(GeneralName::NameType::IPv4) ||
                                   m_permitted_name_types.contains(GeneralName::NameType::IPv6);
 
   auto is_permitted_ipv4 = [&](uint32_t ipv4) {
      if(!ip_form_restricted) {
         return true;
      }
 
      for(const auto& c : m_permitted_subtrees) {
         if(c.base().matches_ipv4(ipv4)) {
            return true;
         }
      }
 
      // We might here check if there are any IPv6 permitted names which are
      // mapped IPv4 addresses, and if so check if any of those apply. It's not
      // clear if this is desirable, and RFC 5280 is completely silent on the issue.
 
      // There is at least one permitted iPAddress name and we didn't match
      return false;
   };
 
   auto is_permitted_ipv6 = [&](const IPv6Address& ipv6) {
      if(!ip_form_restricted) {
         return true;
      }
 
      for(const auto& c : m_permitted_subtrees) {
         if(c.base().matches_ipv6(ipv6)) {
            return true;
         }
      }
 
      // There is at least one permitted iPAddress name and we didn't match
      return false;
   };
 
   /*
   RFC 5280 4.1.2.6:
      If subject naming information is present only in the
      subjectAltName extension (e.g., a key bound only to an email
      address or URI), then the subject name MUST be an empty
      sequence and the subjectAltName extension MUST be critical.
 
   RFC 5280 4.2.1.10:
      Restrictions of the form directoryName MUST be applied to the subject
      field in the certificate (when the certificate includes a non-empty
      subject field) and to any names of type directoryName in the
      subjectAltName extension.
   */
   if(!cert.subject_dn().empty() && !is_permitted_dn(cert.subject_dn())) {
      return false;
   }
 
   for(const auto& alt_dn : alt_name.directory_names()) {
      if(!is_permitted_dn(alt_dn)) {
         return false;
      }
   }
 
   for(const auto& alt_dns : alt_name.dns()) {
      if(!is_permitted_dns_name(alt_dns)) {
         return false;
      }
   }
 
   for(const auto& alt_ipv4 : alt_name.ipv4_address()) {
      if(!is_permitted_ipv4(alt_ipv4)) {
         return false;
      }
   }
 
   for(const auto& alt_ipv6 : alt_name.ipv6_address()) {
      if(!is_permitted_ipv6(alt_ipv6)) {
         return false;
      }
   }
 
   if(alt_name.count() == 0) {
      for(const auto& cn : cert.subject_info("Name")) {
         if(cn.find(".") != std::string::npos) {
            if(auto ipv4 = string_to_ipv4(cn)) {
               if(!is_permitted_ipv4(ipv4.value())) {
                  return false;
               }
            } else {
               if(!is_permitted_dns_name(canonicalize_dns_name(cn))) {
                  return false;
               }
            }
         }
      }
   }
 
   // We didn't encounter a name that doesn't have a matching constraint
   return true;
}

References Botan::X509_DN::count(), Botan::GeneralName::DN, Botan::GeneralName::DNS, Botan::X509_DN::empty(), Botan::GeneralName::IPv4, Botan::GeneralName::IPv6, Botan::GeneralName::Other, permitted(), Botan::GeneralName::RFC822, Botan::string_to_ipv4(), Botan::X509_Certificate::subject_alt_name(), Botan::X509_Certificate::subject_dn(), Botan::X509_Certificate::subject_info(), and Botan::GeneralName::URI.

permitted()

const std::vector< GeneralSubtree > & Botan::NameConstraints::permitted ( ) const

inline

Returns

permitted names

Definition at line 449 of file pkix_types.h.

                                                                                                       {
         return m_permitted_subtrees;
      }

References permitted().

Referenced by botan_x509_cert_permitted_name_constraints(), is_permitted(), permitted(), and Botan::X509_Certificate::to_string().

---

The documentation for this class was generated from the following files:

• src/lib/x509/pkix_types.h
• src/lib/x509/name_constraint.cpp