Botan 2.19.5 Crypto and TLS for C&

Public Member Functions | Static Public Member Functions | List of all members
Botan::Cert_Extension::Name_Constraints Class Referencefinal

`#include <x509_ext.h>`

Inheritance diagram for Botan::Cert_Extension::Name_Constraints:

## Public Member Functions
Name_Constraints * | copy () const override
const NameConstraints & | get_name_constraints () const
| Name_Constraints ()=default
| Name_Constraints (const NameConstraints &nc)
OID | oid_of () const override
void | validate (const X509_Certificate &subject, const X509_Certificate &issuer, const std::vector< std::shared_ptr< const X509_Certificate > > &cert_path, std::vector< std::set< Certificate_Status_Code > > &cert_status, size_t pos) override

## Static Public Member Functions
static OID | static_oid ()

## Detailed Description

Name Constraints

Definition at line 230 of file x509_ext.h.

## Constructor & Destructor Documentation

## ◆ Name_Constraints() [1/2]

Botan::Cert_Extension::Name_Constraints::Name_Constraints | ( |  | ) |
| default

## ◆ Name_Constraints() [2/2]

Botan::Cert_Extension::Name_Constraints::Name_Constraints | ( | const NameConstraints & | nc | ) |
| inline

Definition at line 237 of file x509_ext.h.

237: m_name_constraints(nc) {}

## Member Function Documentation

## ◆ copy()

Name_Constraints * Botan::Cert_Extension::Name_Constraints::copy | ( |  | ) | const
| inline override virtual

Make a copy of this extension

Returns
  copy of this

Implements Botan::Certificate_Extension.

Definition at line 233 of file x509_ext.h.

234 { return new Name_Constraints(m_name_constraints); }
Botan::Cert_Extension::Name_Constraints::Name_Constraints
Name_Constraints()=default

## ◆ get_name_constraints()

const NameConstraints & Botan::Cert_Extension::Name_Constraints::get_name_constraints | ( |  | ) | const
| inline

Definition at line 244 of file x509_ext.h.

244{ return m_name_constraints; }

## ◆ oid_of()

OID Botan::Cert_Extension::Name_Constraints::oid_of | ( |  | ) | const
| inline override virtual

Returns
  OID representing this extension

Implements Botan::Certificate_Extension.

Definition at line 247 of file x509_ext.h.

247{ return static_oid(); }
Botan::Cert_Extension::Name_Constraints::static_oid
static OID static_oid()
Definition: x509_ext.h:246

## ◆ static_oid()

static OID Botan::Cert_Extension::Name_Constraints::static_oid | ( |  | ) |
| inline static

Definition at line 246 of file x509_ext.h.

246{ return OID("2.5.29.30"); }

## ◆ validate()

void Botan::Cert_Extension::Name_Constraints::validate | ( | const X509_Certificate & | subject,
|  | const X509_Certificate & | issuer,
|  | const std::vector< std::shared_ptr< const X509_Certificate > > & | cert_path,
|  | std::vector< std::set< Certificate_Status_Code > > & | cert_status,
|  | size_t | pos
| ) |  |
| override virtual

Reimplemented from Botan::Certificate_Extension.

Definition at line 654 of file x509_ext.cpp.

658 {
659 // This is much smaller limit than in Botan3 because here name constraint checks
660 // are much more expensive due to optimizations which would be difficult to
661 // backport here.
662 const size_t MAX_NC_COMPARES = (1 << 12);
663 const size_t total_constraints = m_name_constraints.permitted().size() + m_name_constraints.excluded().size();
664
665 if(!m_name_constraints.permitted().empty() || !m_name_constraints.excluded().empty())
666 {
667 if(!subject.is_CA_cert())
668 {
669 cert_status.at(pos).insert(Certificate_Status_Code::NAME_CONSTRAINT_ERROR);
670 }
671
672 const bool issuer_name_constraint_critical =
673 subject.is_critical("X509v3.NameConstraints");
674
675 // Check that all subordinate certs pass the name constraint
676 for(size_t j = 0; j < pos; ++j)
677 {
678 const auto& cert = cert_path.at(j);
679
680 const size_t total_names =
681 cert->subject_dn().dn_info().size() +
682 cert->subject_alt_name().get_attributes().size();
683
684 if(total_names * total_constraints >= MAX_NC_COMPARES) {
685 cert_status.at(j).insert(Certificate_Status_Code::NAME_CONSTRAINT_ERROR);
686 continue;
687 }
688
689 if(!m_name_constraints.is_permitted(*cert, issuer_name_constraint_critical)) {
690 cert_status.at(j).insert(Certificate_Status_Code::NAME_CONSTRAINT_ERROR);
691 continue;
692 }
693
694 if(m_name_constraints.is_excluded(*cert, issuer_name_constraint_critical)) {
695 cert_status.at(j).insert(Certificate_Status_Code::NAME_CONSTRAINT_ERROR);
696 continue;
697 }
698 }
699 }
700}
Botan::NameConstraints::is_permitted
bool is_permitted(const X509_Certificate &cert, bool reject_unknown) const
Definition: name_constraint.cpp:323
Botan::NameConstraints::is_excluded
bool is_excluded(const X509_Certificate &cert, bool reject_unknown) const
Definition: name_constraint.cpp:444
Botan::NameConstraints::permitted
const std::vector< GeneralSubtree > & permitted() const
Definition: pkix_types.h:345
Botan::NameConstraints::excluded
const std::vector< GeneralSubtree > & excluded() const
Definition: pkix_types.h:350
Botan::Certificate_Status_Code::NAME_CONSTRAINT_ERROR
@ NAME_CONSTRAINT_ERROR

References Botan::NameConstraints::excluded(), Botan::X509_Certificate::is_CA_cert(), Botan::X509_Certificate::is_critical(), Botan::NameConstraints::is_excluded(), Botan::NameConstraints::is_permitted(), Botan::NAME_CONSTRAINT_ERROR, and Botan::NameConstraints::permitted().

The documentation for this class was generated from the following files:

- src/lib/x509/x509_ext.h
- src/lib/x509/x509_ext.cpp