Botan::TLS::Certificate_13::Certificate_Entry Class Reference

#include <tls_messages_13.h>

Public Member Functions
const X509_Certificate &	certificate () const
	Certificate_Entry (Certificate_Entry &&other) noexcept
	Certificate_Entry (const Certificate_Entry &other)=delete
	Certificate_Entry (const X509_Certificate &cert)
	Certificate_Entry (std::shared_ptr< Public_Key > raw_public_key)
	Certificate_Entry (TLS_Data_Reader &reader, Connection_Side side, Certificate_Type cert_type)
Extensions &	extensions ()
const Extensions &	extensions () const
bool	has_certificate () const
Certificate_Entry &	operator= (Certificate_Entry &&other) noexcept
Certificate_Entry &	operator= (const Certificate_Entry &other)=delete
std::shared_ptr< const Public_Key >	public_key () const
std::vector< uint8_t >	serialize () const
	~Certificate_Entry ()

Detailed Description

Definition at line 172 of file tls_messages_13.h.

Constructor & Destructor Documentation

Certificate_Entry() [1/5]

Botan::TLS::Certificate_13::Certificate_Entry::Certificate_Entry	(	TLS_Data_Reader &	reader,
		Connection_Side	side,
		Certificate_Type	cert_type )

Definition at line 272 of file msg_certificate_13.cpp.

                                                                                 {
   if(cert_type == Certificate_Type::X509) {
      // RFC 8446 4.2.2
      //    [...] each CertificateEntry contains a DER-encoded X.509
      //    certificate.
      const auto cert_bytes = reader.get_tls_length_value(3);
      try {
         m_certificate = std::make_unique<X509_Certificate>(cert_bytes);
         m_raw_public_key = m_certificate->subject_public_key();
      } catch(Exception& e) {
         // bad_certificate would make more sense but BoGo expects decoding_error
         throw TLS_Exception(Alert::DecodeError, e.what());
      }
   } else if(cert_type == Certificate_Type::RawPublicKey) {
      // RFC 7250 3.
      //    This specification uses raw public keys whereby the already
      //    available encoding used in a PKIX certificate in the form of a
      //    SubjectPublicKeyInfo structure is reused.
      try {
         m_raw_public_key = X509::load_key(reader.get_tls_length_value(3));
      } catch(Exception& e) {
         throw TLS_Exception(Alert::DecodeError, e.what());
      }
   } else {
      throw TLS_Exception(Alert::InternalError, "Unknown certificate type");
   }
 
   // Extensions are simply tacked at the end of the certificate entry. This
   // is a departure from the typical "tag-length-value" in a sense that the
   // Extensions deserializer needs the length value of the extensions.
   const size_t extensions_length = reader.peek_uint16_t();
   const auto exts_buf = reader.get_fixed<uint8_t>(extensions_length + 2);
   TLS_Data_Reader exts_reader("extensions reader", exts_buf);
   m_extensions.deserialize(exts_reader, side, Handshake_Type::Certificate);
 
   if(cert_type == Certificate_Type::X509) {
      // RFC 8446 4.4.2
      //    Valid extensions for server certificates at present include the
      //    OCSP Status extension [RFC6066] and the SignedCertificateTimestamp
      //    extension [RFC6962]; future extensions may be defined for this
      //    message as well.
      //
      // RFC 8446 4.4.2.1
      //    A server MAY request that a client present an OCSP response with its
      //    certificate by sending an empty "status_request" extension in its
      //    CertificateRequest message.
      if(m_extensions.contains_implemented_extensions_other_than({
            Extension_Code::CertificateStatusRequest,
            // Extension_Code::SignedCertificateTimestamp
         })) {
         throw TLS_Exception(Alert::IllegalParameter, "Certificate Entry contained an extension that is not allowed");
      }
   } else if(m_extensions.contains_implemented_extensions_other_than({})) {
      throw TLS_Exception(
         Alert::IllegalParameter,
         "Certificate Entry holding something else than a certificate contained unexpected extensions");
   }
}

References Botan::TLS::Certificate, Certificate_Entry(), Botan::TLS::TLS_Data_Reader::get_fixed(), Botan::TLS::TLS_Data_Reader::get_tls_length_value(), Botan::X509::load_key(), Botan::TLS::TLS_Data_Reader::peek_uint16_t(), Botan::TLS::RawPublicKey, Botan::Exception::what(), and Botan::TLS::X509.

Referenced by Certificate_Entry(), Certificate_Entry(), Certificate_Entry(), Certificate_Entry(), operator=(), and operator=().

Certificate_Entry() [2/5]

Botan::TLS::Certificate_13::Certificate_Entry::Certificate_Entry ( const X509_Certificate & cert )

explicit

Definition at line 339 of file msg_certificate_13.cpp.

                                                                               :
      m_certificate(std::make_unique<X509_Certificate>(cert)), m_raw_public_key(m_certificate->subject_public_key()) {}

References Certificate_Entry().

Certificate_Entry() [3/5]

Botan::TLS::Certificate_13::Certificate_Entry::Certificate_Entry ( std::shared_ptr< Public_Key > raw_public_key )

explicit

Definition at line 342 of file msg_certificate_13.cpp.

                                                                                           :
      m_raw_public_key(std::move(raw_public_key)) {
   BOTAN_ASSERT_NONNULL(m_raw_public_key);
}

References BOTAN_ASSERT_NONNULL.

Certificate_Entry() [4/5]

Botan::TLS::Certificate_13::Certificate_Entry::Certificate_Entry ( const Certificate_Entry & other )

delete

References Certificate_Entry().

Certificate_Entry() [5/5]

Botan::TLS::Certificate_13::Certificate_Entry::Certificate_Entry ( Certificate_Entry && other )

defaultnoexcept

References Certificate_Entry().

~Certificate_Entry()

Botan::TLS::Certificate_13::Certificate_Entry::~Certificate_Entry ( )

default

Member Function Documentation

certificate()

const X509_Certificate & Botan::TLS::Certificate_13::Certificate_Entry::certificate

(

)

const

Definition at line 347 of file msg_certificate_13.cpp.

                                                                           {
   BOTAN_STATE_CHECK(has_certificate());
   return *m_certificate;
}

References BOTAN_STATE_CHECK, and has_certificate().

extensions() [1/2]

Extensions & Botan::TLS::Certificate_13::Certificate_Entry::extensions ( )

inline

Definition at line 185 of file tls_messages_13.h.

{ return m_extensions; }

extensions() [2/2]

const Extensions & Botan::TLS::Certificate_13::Certificate_Entry::extensions ( ) const

inline

Definition at line 187 of file tls_messages_13.h.

{ return m_extensions; }

has_certificate()

bool Botan::TLS::Certificate_13::Certificate_Entry::has_certificate ( ) const

inline

Definition at line 178 of file tls_messages_13.h.

{ return m_certificate != nullptr; }

Referenced by certificate(), and serialize().

operator=() [1/2]

Certificate_13::Certificate_Entry & Botan::TLS::Certificate_13::Certificate_Entry::operator= ( Certificate_Entry && other )

defaultnoexcept

References Certificate_Entry().

operator=() [2/2]

Certificate_Entry & Botan::TLS::Certificate_13::Certificate_Entry::operator= ( const Certificate_Entry & other )

delete

References Certificate_Entry().

public_key()

std::shared_ptr< const Public_Key > Botan::TLS::Certificate_13::Certificate_Entry::public_key

(

)

const

Definition at line 352 of file msg_certificate_13.cpp.

                                                                                  {
   BOTAN_ASSERT_NONNULL(m_raw_public_key);
   return m_raw_public_key;
}

References BOTAN_ASSERT_NONNULL.

serialize()

std::vector< uint8_t > Botan::TLS::Certificate_13::Certificate_Entry::serialize

(

)

const

Definition at line 357 of file msg_certificate_13.cpp.

                                                                    {
   return (has_certificate()) ? m_certificate->BER_encode() : X509::BER_encode(*m_raw_public_key);
}

References Botan::X509::BER_encode(), and has_certificate().

---

The documentation for this class was generated from the following files:

• src/lib/tls/tls13/tls_messages_13.h
• src/lib/tls/tls13/msg_certificate_13.cpp