1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
|
/*
* X.509 Name Constraint
* (C) 2015 Kai Michaelis
*
* Botan is released under the Simplified BSD License (see license.txt)
*/
#ifndef BOTAN_NAME_CONSTRAINT_H_
#define BOTAN_NAME_CONSTRAINT_H_
#include <botan/asn1_obj.h>
#include <ostream>
#include <limits>
namespace Botan {
class BER_Encoder;
class DER_Encoder;
class X509_Certificate;
/**
* @brief X.509 GeneralName Type
*
* Handles parsing GeneralName types in their BER and canonical string
* encoding. Allows matching GeneralNames against each other using
* the rules laid out in the RFC 5280, sec. 4.2.1.10 (Name Contraints).
*/
class BOTAN_PUBLIC_API(2,0) GeneralName final : public ASN1_Object
{
public:
enum MatchResult : int
{
All,
Some,
None,
NotFound,
UnknownType,
};
/**
* Creates an empty GeneralName.
*/
GeneralName() = default;
/**
* Creates a new GeneralName for its string format.
* @param str type and name, colon-separated, e.g., "DNS:google.com"
*/
GeneralName(const std::string& str);
void encode_into(DER_Encoder&) const override;
void decode_from(BER_Decoder&) override;
/**
* @return Type of the name. Can be DN, DNS, IP, RFC822 or URI.
*/
const std::string& type() const { return m_type; }
/**
* @return The name as string. Format depends on type.
*/
const std::string& name() const { return m_name; }
/**
* Checks whether a given certificate (partially) matches this name.
* @param cert certificate to be matched
* @return the match result
*/
MatchResult matches(const X509_Certificate& cert) const;
private:
std::string m_type;
std::string m_name;
bool matches_dns(const std::string&) const;
bool matches_dn(const std::string&) const;
bool matches_ip(const std::string&) const;
};
std::ostream& operator<<(std::ostream& os, const GeneralName& gn);
/**
* @brief A single Name Constraint
*
* The Name Constraint extension adds a minimum and maximum path
* length to a GeneralName to form a constraint. The length limits
* are currently unused.
*/
class BOTAN_PUBLIC_API(2,0) GeneralSubtree final : public ASN1_Object
{
public:
/**
* Creates an empty name constraint.
*/
GeneralSubtree() : m_base(), m_minimum(0), m_maximum(std::numeric_limits<std::size_t>::max())
{}
/***
* Creates a new name constraint.
* @param base name
* @param min minimum path length
* @param max maximum path length
*/
GeneralSubtree(GeneralName base, size_t min, size_t max)
: m_base(base), m_minimum(min), m_maximum(max)
{}
/**
* Creates a new name constraint for its string format.
* @param str name constraint
*/
GeneralSubtree(const std::string& str);
void encode_into(DER_Encoder&) const override;
void decode_from(BER_Decoder&) override;
/**
* @return name
*/
GeneralName base() const { return m_base; }
/**
* @return minimum path length
*/
size_t minimum() const { return m_minimum; }
/**
* @return maximum path length
*/
size_t maximum() const { return m_maximum; }
private:
GeneralName m_base;
size_t m_minimum;
size_t m_maximum;
};
std::ostream& operator<<(std::ostream& os, const GeneralSubtree& gs);
/**
* @brief Name Constraints
*
* Wraps the Name Constraints associated with a certificate.
*/
class BOTAN_PUBLIC_API(2,0) NameConstraints final
{
public:
/**
* Creates an empty name NameConstraints.
*/
NameConstraints() : m_permitted_subtrees(), m_excluded_subtrees() {}
/**
* Creates NameConstraints from a list of permitted and excluded subtrees.
* @param permitted_subtrees names for which the certificate is permitted
* @param excluded_subtrees names for which the certificate is not permitted
*/
NameConstraints(std::vector<GeneralSubtree>&& permitted_subtrees,
std::vector<GeneralSubtree>&& excluded_subtrees)
: m_permitted_subtrees(permitted_subtrees), m_excluded_subtrees(excluded_subtrees)
{}
/**
* @return permitted names
*/
const std::vector<GeneralSubtree>& permitted() const { return m_permitted_subtrees; }
/**
* @return excluded names
*/
const std::vector<GeneralSubtree>& excluded() const { return m_excluded_subtrees; }
private:
std::vector<GeneralSubtree> m_permitted_subtrees;
std::vector<GeneralSubtree> m_excluded_subtrees;
};
}
#endif
|
