Botan::NameConstraints Class Reference

Name Constraints. More...

#include <pkix_types.h>

Public Member Functions
const std::vector< GeneralSubtree > &	excluded () const
bool	is_excluded (const X509_Certificate &cert, bool reject_unknown) const
bool	is_permitted (const X509_Certificate &cert, bool reject_unknown) const
	NameConstraints ()=default
	NameConstraints (std::vector< GeneralSubtree > &&permitted_subtrees, std::vector< GeneralSubtree > &&excluded_subtrees)
const std::vector< GeneralSubtree > &	permitted () const

Detailed Description

Name Constraints.

Wraps the Name Constraints associated with a certificate.

Definition at line 367 of file pkix_types.h.

Constructor & Destructor Documentation

NameConstraints() [1/2]

Botan::NameConstraints::NameConstraints ( )

default

Creates an empty name NameConstraints.

References NameConstraints().

Referenced by NameConstraints().

NameConstraints() [2/2]

Botan::NameConstraints::NameConstraints	(	std::vector< GeneralSubtree > &&	permitted_subtrees,
		std::vector< GeneralSubtree > &&	excluded_subtrees )

Creates NameConstraints from a list of permitted and excluded subtrees.

Parameters

permitted_subtrees	names for which the certificate is permitted
excluded_subtrees	names for which the certificate is not permitted

Definition at line 297 of file name_constraint.cpp.

                                                                                :
      m_permitted_subtrees(std::move(permitted_subtrees)), m_excluded_subtrees(std::move(excluded_subtrees)) {
   for(const auto& c : m_permitted_subtrees) {
      m_permitted_name_types.insert(c.base().type_code());
   }
   for(const auto& c : m_excluded_subtrees) {
      m_excluded_name_types.insert(c.base().type_code());
   }
}

Member Function Documentation

excluded()

const std::vector< GeneralSubtree > & Botan::NameConstraints::excluded ( ) const

inline

Returns

excluded names

Definition at line 392 of file pkix_types.h.

                                                                                                      {
         return m_excluded_subtrees;
      }

References excluded().

Referenced by excluded(), and is_excluded().

is_excluded()

bool Botan::NameConstraints::is_excluded	(	const X509_Certificate &	cert,
		bool	reject_unknown ) const

Return true if any of the names in the certificate are excluded

Definition at line 446 of file name_constraint.cpp.

                                                                                         {
   if(excluded().empty()) {
      return false;
   }
 
   const auto& alt_name = cert.subject_alt_name();
 
   if(exceeds_limit(cert.subject_dn().count(), alt_name.count(), excluded().size())) {
      return true;
   }
 
   if(reject_unknown) {
      // This is one is overly broad: we should just reject if there is a name constraint
      // with the same OID as one of the other names
      if(m_excluded_name_types.contains(GeneralName::NameType::Other) && !alt_name.other_names().empty()) {
         return true;
      }
      if(m_excluded_name_types.contains(GeneralName::NameType::URI) && !alt_name.uris().empty()) {
         return true;
      }
      if(m_excluded_name_types.contains(GeneralName::NameType::RFC822) && !alt_name.email().empty()) {
         return true;
      }
   }
 
   auto is_excluded_dn = [&](const X509_DN& dn) {
      // If no restrictions, then immediate accept
      if(!m_excluded_name_types.contains(GeneralName::NameType::DN)) {
         return false;
      }
 
      for(const auto& c : m_excluded_subtrees) {
         if(c.base().matches_dn(dn)) {
            return true;
         }
      }
 
      // There is at least one excluded name and we didn't match
      return false;
   };
 
   auto is_excluded_dns_name = [&](const std::string& name) {
      if(name.empty() || name.starts_with(".")) {
         return true;
      }
 
      // If no restrictions, then immediate accept
      if(!m_excluded_name_types.contains(GeneralName::NameType::DNS)) {
         return false;
      }
 
      for(const auto& c : m_excluded_subtrees) {
         if(c.base().matches_dns(name)) {
            return true;
         }
      }
 
      // There is at least one excluded name and we didn't match
      return false;
   };
 
   auto is_excluded_ipv4 = [&](uint32_t ipv4) {
      // If no restrictions, then immediate accept
      if(!m_excluded_name_types.contains(GeneralName::NameType::IPv4)) {
         return false;
      }
 
      for(const auto& c : m_excluded_subtrees) {
         if(c.base().matches_ipv4(ipv4)) {
            return true;
         }
      }
 
      // There is at least one excluded name and we didn't match
      return false;
   };
 
   if(is_excluded_dn(cert.subject_dn())) {
      return true;
   }
 
   for(const auto& alt_dn : alt_name.directory_names()) {
      if(is_excluded_dn(alt_dn)) {
         return true;
      }
   }
 
   for(const auto& alt_dns : alt_name.dns()) {
      if(is_excluded_dns_name(alt_dns)) {
         return true;
      }
   }
 
   for(const auto& alt_ipv4 : alt_name.ipv4_address()) {
      if(is_excluded_ipv4(alt_ipv4)) {
         return true;
      }
   }
 
   if(alt_name.count() == 0) {
      for(const auto& cn : cert.subject_info("Name")) {
         if(cn.find(".") != std::string::npos) {
            if(auto ipv4 = string_to_ipv4(cn)) {
               if(is_excluded_ipv4(ipv4.value())) {
                  return true;
               }
            } else {
               if(is_excluded_dns_name(canonicalize_dns_name(cn))) {
                  return true;
               }
            }
         }
      }
   }
 
   // We didn't encounter a name that matched any prohibited name
   return false;
}

References Botan::X509_DN::count(), Botan::GeneralName::DN, Botan::GeneralName::DNS, excluded(), Botan::GeneralName::IPv4, Botan::GeneralName::Other, Botan::GeneralName::RFC822, Botan::string_to_ipv4(), Botan::X509_Certificate::subject_alt_name(), Botan::X509_Certificate::subject_dn(), Botan::X509_Certificate::subject_info(), and Botan::GeneralName::URI.

is_permitted()

bool Botan::NameConstraints::is_permitted	(	const X509_Certificate &	cert,
		bool	reject_unknown ) const

Return true if all of the names in the certificate are permitted

Definition at line 329 of file name_constraint.cpp.

                                                                                          {
   if(permitted().empty()) {
      return true;
   }
 
   const auto& alt_name = cert.subject_alt_name();
 
   if(exceeds_limit(cert.subject_dn().count(), alt_name.count(), permitted().size())) {
      return false;
   }
 
   if(reject_unknown) {
      if(m_permitted_name_types.contains(GeneralName::NameType::Other) && !alt_name.other_names().empty()) {
         return false;
      }
      if(m_permitted_name_types.contains(GeneralName::NameType::URI) && !alt_name.uris().empty()) {
         return false;
      }
      if(m_permitted_name_types.contains(GeneralName::NameType::RFC822) && !alt_name.email().empty()) {
         return false;
      }
   }
 
   auto is_permitted_dn = [&](const X509_DN& dn) {
      // If no restrictions, then immediate accept
      if(!m_permitted_name_types.contains(GeneralName::NameType::DN)) {
         return true;
      }
 
      for(const auto& c : m_permitted_subtrees) {
         if(c.base().matches_dn(dn)) {
            return true;
         }
      }
 
      // There is at least one permitted name and we didn't match
      return false;
   };
 
   auto is_permitted_dns_name = [&](const std::string& name) {
      if(name.empty() || name.starts_with(".")) {
         return false;
      }
 
      // If no restrictions, then immediate accept
      if(!m_permitted_name_types.contains(GeneralName::NameType::DNS)) {
         return true;
      }
 
      for(const auto& c : m_permitted_subtrees) {
         if(c.base().matches_dns(name)) {
            return true;
         }
      }
 
      // There is at least one permitted name and we didn't match
      return false;
   };
 
   auto is_permitted_ipv4 = [&](uint32_t ipv4) {
      // If no restrictions, then immediate accept
      if(!m_permitted_name_types.contains(GeneralName::NameType::IPv4)) {
         return true;
      }
 
      for(const auto& c : m_permitted_subtrees) {
         if(c.base().matches_ipv4(ipv4)) {
            return true;
         }
      }
 
      // There is at least one permitted name and we didn't match
      return false;
   };
 
   if(!is_permitted_dn(cert.subject_dn())) {
      return false;
   }
 
   for(const auto& alt_dn : alt_name.directory_names()) {
      if(!is_permitted_dn(alt_dn)) {
         return false;
      }
   }
 
   for(const auto& alt_dns : alt_name.dns()) {
      if(!is_permitted_dns_name(alt_dns)) {
         return false;
      }
   }
 
   for(const auto& alt_ipv4 : alt_name.ipv4_address()) {
      if(!is_permitted_ipv4(alt_ipv4)) {
         return false;
      }
   }
 
   if(alt_name.count() == 0) {
      for(const auto& cn : cert.subject_info("Name")) {
         if(cn.find(".") != std::string::npos) {
            if(auto ipv4 = string_to_ipv4(cn)) {
               if(!is_permitted_ipv4(ipv4.value())) {
                  return false;
               }
            } else {
               if(!is_permitted_dns_name(canonicalize_dns_name(cn))) {
                  return false;
               }
            }
         }
      }
   }
 
   // We didn't encounter a name that doesn't have a matching constraint
   return true;
}

References Botan::X509_DN::count(), Botan::GeneralName::DN, Botan::GeneralName::DNS, Botan::GeneralName::IPv4, Botan::GeneralName::Other, permitted(), Botan::GeneralName::RFC822, Botan::string_to_ipv4(), Botan::X509_Certificate::subject_alt_name(), Botan::X509_Certificate::subject_dn(), Botan::X509_Certificate::subject_info(), and Botan::GeneralName::URI.

permitted()

const std::vector< GeneralSubtree > & Botan::NameConstraints::permitted ( ) const

inline

Returns

permitted names

Definition at line 385 of file pkix_types.h.

                                                                                                       {
         return m_permitted_subtrees;
      }

References permitted().

Referenced by is_permitted(), permitted(), and Botan::X509_Certificate::to_string().

---

The documentation for this class was generated from the following files:

• src/lib/x509/pkix_types.h
• src/lib/x509/name_constraint.cpp