#include <name_constraint.h>

Inheritance diagram for Botan::GeneralName:

Public Types
enum	MatchResult : int { All, Some, None, NotFound, UnknownType }

Public Member Functions
std::vector< uint8_t >	BER_encode () const

void	decode_from (BER_Decoder &) override

void	encode_into (DER_Encoder &) const override

	GeneralName ()=default

	GeneralName (const std::string &str)

MatchResult	matches (const X509_Certificate &cert) const

const std::string &	name () const

const std::string &	type () const

Detailed Description

X.509 GeneralName Type.

Handles parsing GeneralName types in their BER and canonical string encoding. Allows matching GeneralNames against each other using the rules laid out in the RFC 5280, sec. 4.2.1.10 (Name Contraints).

Definition at line 28 of file name_constraint.h.

Member Enumeration Documentation

enum Botan::GeneralName::MatchResult : int

Enumerator
All
Some
None
NotFound
UnknownType

Definition at line 31 of file name_constraint.h.

                        : int
             {
             All,
             Some,
             None,
             NotFound,
             UnknownType,
             };

Constructor & Destructor Documentation

Botan::GeneralName::GeneralName ( )

default

Creates an empty GeneralName.

Botan::GeneralName::GeneralName ( const std::string & str )

Creates a new GeneralName for its string format.

Parameters

str	type and name, colon-separated, e.g., "DNS:google.com"

Definition at line 21 of file name_constraint.cpp.

References m_name.

                                              : GeneralName()
    {
    size_t p = str.find(':');
 
    if(p != std::string::npos)
       {
       m_type = str.substr(0, p);
       m_name = str.substr(p + 1, std::string::npos);
       }
    else
       {
       throw Invalid_Argument("Failed to decode Name Constraint");
       }
    }

Member Function Documentation

std::vector< uint8_t > Botan::ASN1_Object::BER_encode ( ) const

inherited

Return the encoding of this object. This is a convenience method when just one object needs to be serialized. Use DER_Encoder for complicated encodings.

Definition at line 16 of file asn1_obj.cpp.

References Botan::ASN1_Object::encode_into().

Referenced by Botan::PSSR::config_for_x509(), Botan::Certificate_Store_In_SQL::find_all_certs(), Botan::Certificate_Store_In_SQL::find_cert(), Botan::X509_Certificate::fingerprint(), Botan::Certificate_Store_In_SQL::insert_cert(), Botan::X509_Object::PEM_encode(), and Botan::Certificate_Store_In_SQL::revoke_cert().

    {
    std::vector<uint8_t> output;
    DER_Encoder der(output);
    this->encode_into(der);
    return output;
    }

void Botan::GeneralName::decode_from ( BER_Decoder & from )

overridevirtual

Decode whatever this object is from from

Parameters

from	the BER_Decoder that will be read from

Implements Botan::ASN1_Object.

Definition at line 41 of file name_constraint.cpp.

References Botan::BER_Object::bits(), Botan::CONSTRUCTED, Botan::CONTEXT_SPECIFIC, Botan::X509_DN::decode_from(), Botan::BER_Decoder::get_next_object(), Botan::ipv4_to_string(), Botan::BER_Object::is_a(), Botan::BER_Object::length(), Botan::load_be< uint32_t >(), m_name, and Botan::ASN1::to_string().

    {
    BER_Object obj = ber.get_next_object();
 
    if(obj.is_a(1, CONTEXT_SPECIFIC))
       {
       m_type = "RFC822";
       m_name = ASN1::to_string(obj);
       }
    else if(obj.is_a(2, CONTEXT_SPECIFIC))
       {
       m_type = "DNS";
       m_name = ASN1::to_string(obj);
       }
    else if(obj.is_a(6, CONTEXT_SPECIFIC))
       {
       m_type = "URI";
       m_name = ASN1::to_string(obj);
       }
    else if(obj.is_a(4, ASN1_Tag(CONTEXT_SPECIFIC | CONSTRUCTED)))
       {
       m_type = "DN";
       X509_DN dn;
       BER_Decoder dec(obj);
       std::stringstream ss;
 
       dn.decode_from(dec);
       ss << dn;
 
       m_name = ss.str();
       }
    else if(obj.is_a(7, CONTEXT_SPECIFIC))
       {
       if(obj.length() == 8)
          {
          m_type = "IP";
          m_name = ipv4_to_string(load_be<uint32_t>(obj.bits(), 0)) + "/" +
                   ipv4_to_string(load_be<uint32_t>(obj.bits(), 1));
          }
       else if(obj.length() == 32)
          {
          throw Decoding_Error("Unsupported IPv6 name constraint");
          }
       else
          {
          throw Decoding_Error("Invalid IP name constraint size " + std::to_string(obj.length()));
          }
       }
    else
       {
       throw Decoding_Error("Found unknown GeneralName type");
       }
    }

void Botan::GeneralName::encode_into ( DER_Encoder & to ) const

overridevirtual

Encode whatever this object is into to

Parameters

to	the DER_Encoder that will be written to

Implements Botan::ASN1_Object.

Definition at line 36 of file name_constraint.cpp.

    {
    throw Not_Implemented("GeneralName encoding");
    }

GeneralName::MatchResult Botan::GeneralName::matches ( const X509_Certificate & cert ) const

Checks whether a given certificate (partially) matches this name.

Parameters

cert	certificate to be matched

Returns: the match result

Definition at line 95 of file name_constraint.cpp.

References Botan::AlternativeName::get_attribute(), Botan::X509_DN::get_attribute(), Botan::X509_Certificate::subject_alt_name(), Botan::X509_Certificate::subject_dn(), and type().

    {
    std::vector<std::string> nam;
    std::function<bool(const GeneralName*, const std::string&)> match_fn;
 
    const X509_DN& dn = cert.subject_dn();
    const AlternativeName& alt_name = cert.subject_alt_name();
 
    if(type() == "DNS")
       {
       match_fn = std::mem_fn(&GeneralName::matches_dns);
 
       nam = alt_name.get_attribute("DNS");
 
       if(nam.empty())
          {
          nam = dn.get_attribute("CN");
          }
       }
    else if(type() == "DN")
       {
       match_fn = std::mem_fn(&GeneralName::matches_dn);
 
       std::stringstream ss;
       ss << dn;
       nam.push_back(ss.str());
       }
    else if(type() == "IP")
       {
       match_fn = std::mem_fn(&GeneralName::matches_ip);
       nam = alt_name.get_attribute("IP");
       }
    else
       {
       return MatchResult::UnknownType;
       }
 
    if(nam.empty())
       {
       return MatchResult::NotFound;
       }
 
    bool some = false;
    bool all = true;
 
    for(const std::string& n: nam)
       {
       bool m = match_fn(this, n);
 
       some |= m;
       all &= m;
       }
 
    if(all)
       {
       return MatchResult::All;
       }
    else if(some)
       {
       return MatchResult::Some;
       }
    else
       {
       return MatchResult::None;
       }
    }