Botan 2.13.0 Crypto and TLS for C++11

- Main Page
- Namespaces
- Classes
- Files

- Class List
- Class Index
- Class Hierarchy
- Class Members

Public Member Functions | Static Public Member Functions | List of all members
Botan::Cert_Extension::Name_Constraints Class Referencefinal

`#include <x509_ext.h>`

Inheritance diagram for Botan::Cert_Extension::Name_Constraints:

## Public Member Functions
Name_Constraints * | copy () const override
const NameConstraints & | get_name_constraints () const
| Name_Constraints ()=default
| Name_Constraints (const NameConstraints &nc)
OID | oid_of () const override
void | validate (const X509_Certificate &subject, const X509_Certificate &issuer, const std::vector< std::shared_ptr< const X509_Certificate >> &cert_path, std::vector< std::set< Certificate_Status_Code >> &cert_status, size_t pos) override

## Static Public Member Functions
static OID | static_oid ()

## Detailed Description

Name Constraints

Definition at line 500 of file x509_ext.h.

## Constructor & Destructor Documentation

Botan::Cert_Extension::Name_Constraints::Name_Constraints | ( |  | ) |
| default

Botan::Cert_Extension::Name_Constraints::Name_Constraints | ( | const NameConstraints & | nc | ) |
| inline

Definition at line 507 of file x509_ext.h.

507 : m_name_constraints(nc) {}

## Member Function Documentation

Name_Constraints* Botan::Cert_Extension::Name_Constraints::copy | ( |  | ) | const
| inline override virtual

Make a copy of this extension

Returns
  copy of this

Implements Botan::Certificate_Extension.

Definition at line 503 of file x509_ext.h.

504 { return new Name_Constraints(m_name_constraints); }
Botan::Cert_Extension::Name_Constraints::Name_Constraints
Name_Constraints()=default

const NameConstraints& Botan::Cert_Extension::Name_Constraints::get_name_constraints | ( |  | ) | const
| inline

Definition at line 514 of file x509_ext.h.

514 { return m_name_constraints; }

OID Botan::Cert_Extension::Name_Constraints::oid_of | ( |  | ) | const
| inline override virtual

Returns
  OID representing this extension

Implements Botan::Certificate_Extension.

Definition at line 517 of file x509_ext.h.

517 { return static_oid(); }
Botan::Cert_Extension::Name_Constraints::static_oid
static OID static_oid()
Definition: x509_ext.h:516

static OID Botan::Cert_Extension::Name_Constraints::static_oid | ( |  | ) |
| inline static

Definition at line 516 of file x509_ext.h.

516 { return OID("2.5.29.30"); }

void Botan::Cert_Extension::Name_Constraints::validate | ( | const X509_Certificate & | subject,
|  | const X509_Certificate & | issuer,
|  | const std::vector< std::shared_ptr< const X509_Certificate >> & | cert_path,
|  | std::vector< std::set< Certificate_Status_Code >> & | cert_status,
|  | size_t | pos
| ) |  |
| override virtual

Reimplemented from Botan::Certificate_Extension.

Definition at line 653 of file x509_ext.cpp.

References Botan::NameConstraints::excluded(), Botan::X509_Certificate::is_CA_cert(), Botan::X509_Certificate::is_critical(), Botan::NAME_CONSTRAINT_ERROR, and Botan::NameConstraints::permitted().

657 {
658 if(!m_name_constraints.permitted().empty() || !m_name_constraints.excluded().empty())
659 {
660 if(!subject.is_CA_cert() || !subject.is_critical("X509v3.NameConstraints"))
661 cert_status.at(pos).insert(Certificate_Status_Code::NAME_CONSTRAINT_ERROR);
662
663 const bool issuer_name_constraint_critical =
664 issuer.is_critical("X509v3.NameConstraints");
665
666 const bool at_self_signed_root = (pos == cert_path.size() - 1);
667
668 // Check that all subordinate certs pass the name constraint
669 for(size_t j = 0; j <= pos; ++j)
670 {
671 if(pos == j && at_self_signed_root)
672 continue;
673
674 bool permitted = m_name_constraints.permitted().empty();
675 bool failed = false;
676
677 for(auto c: m_name_constraints.permitted())
678 {
679 switch(c.base().matches(*cert_path.at(j)))
680 {
681 case GeneralName::MatchResult::NotFound:
682 case GeneralName::MatchResult::All:
683 permitted = true;
684 break;
685 case GeneralName::MatchResult::UnknownType:
686 failed = issuer_name_constraint_critical;
687 permitted = true;
688 break;
689 default:
690 break;
691 }
692 }
693
694 for(auto c: m_name_constraints.excluded())
695 {
696 switch(c.base().matches(*cert_path.at(j)))
697 {
698 case GeneralName::MatchResult::All:
699 case GeneralName::MatchResult::Some:
700 failed = true;
701 break;
702 case GeneralName::MatchResult::UnknownType:
703 failed = issuer_name_constraint_critical;
704 break;
705 default:
706 break;
707 }
708 }
709
710 if(failed || !permitted)
711 {
712 cert_status.at(j).insert(Certificate_Status_Code::NAME_CONSTRAINT_ERROR);
713 }
714 }
715 }
716 }
Botan::Certificate_Status_Code::NAME_CONSTRAINT_ERROR
Botan::NameConstraints::permitted
const std::vector< GeneralSubtree > & permitted() const
Definition: name_constraint.h:168
Botan::NameConstraints::excluded
const std::vector< GeneralSubtree > & excluded() const
Definition: name_constraint.h:173

The documentation for this class was generated from the following files:

- src/lib/x509/x509_ext.h
- src/lib/x509/x509_ext.cpp