313namespace Cert_Extension {
321 throw Invalid_State(
"Basic_Constraints::get_path_limit: Not a CA");
328std::vector<uint8_t> Basic_Constraints::encode_inner()
const
330 std::vector<uint8_t> output;
336 .encode_optional(m_path_limit, NO_CERT_PATH_LIMIT)
345void Basic_Constraints::decode_inner(
const std::vector<uint8_t>& in)
360void Basic_Constraints::contents_to(Data_Store& subject, Data_Store&)
const
362 subject.add(
"X509v3.BasicConstraints.is_ca", (m_is_ca ? 1 : 0));
363 subject.add(
"X509v3.BasicConstraints.path_constraint",
static_cast<uint32_t
>(m_path_limit));
369std::vector<uint8_t> Key_Usage::encode_inner()
const
372 throw Encoding_Error(
"Cannot encode zero usage constraints");
374 const size_t unused_bits =
ctz(
static_cast<uint32_t
>(m_constraints));
376 std::vector<uint8_t> der;
378 der.push_back(2 + ((unused_bits < 8) ? 1 : 0));
379 der.push_back(unused_bits % 8);
380 der.push_back((m_constraints >> 8) & 0xFF);
381 if(m_constraints & 0xFF)
382 der.push_back(m_constraints & 0xFF);
390void Key_Usage::decode_inner(
const std::vector<uint8_t>& in)
394 BER_Object obj = ber.get_next_object();
398 if(obj.length() != 2 && obj.length() != 3)
399 throw BER_Decoding_Error(
"Bad size for BITSTRING in usage constraint");
403 const uint8_t* bits = obj.bits();
406 throw BER_Decoding_Error(
"Invalid unused bits in usage constraint");
408 const uint8_t mask =
static_cast<uint8_t
>(0xFF << bits[0]);
410 if(obj.length() == 2)
414 else if(obj.length() == 3)
425void Key_Usage::contents_to(Data_Store& subject, Data_Store&)
const
427 subject.add(
"X509v3.KeyUsage", m_constraints);
433std::vector<uint8_t> Subject_Key_ID::encode_inner()
const
435 std::vector<uint8_t> output;
443void Subject_Key_ID::decode_inner(
const std::vector<uint8_t>& in)
445 BER_Decoder(in).decode(m_key_id,
OCTET_STRING).verify_end();
451void Subject_Key_ID::contents_to(Data_Store& subject, Data_Store&)
const
453 subject.add(
"X509v3.SubjectKeyIdentifier", m_key_id);
463 m_key_id.resize(
hash->output_length());
465 hash->update(pub_key);
466 hash->final(m_key_id.data());
469 const size_t max_skid_len = (192 / 8);
470 if(m_key_id.size() > max_skid_len)
471 m_key_id.resize(max_skid_len);
477std::vector<uint8_t> Authority_Key_ID::encode_inner()
const
479 std::vector<uint8_t> output;
490void Authority_Key_ID::decode_inner(
const std::vector<uint8_t>& in)
500void Authority_Key_ID::contents_to(Data_Store&, Data_Store& issuer)
const
503 issuer.add(
"X509v3.AuthorityKeyIdentifier", m_key_id);
509std::vector<uint8_t> Subject_Alternative_Name::encode_inner()
const
511 std::vector<uint8_t> output;
512 DER_Encoder(output).encode(m_alt_name);
519std::vector<uint8_t> Issuer_Alternative_Name::encode_inner()
const
521 std::vector<uint8_t> output;
522 DER_Encoder(output).encode(m_alt_name);
529void Subject_Alternative_Name::decode_inner(
const std::vector<uint8_t>& in)
531 BER_Decoder(in).
decode(m_alt_name);
537void Issuer_Alternative_Name::decode_inner(
const std::vector<uint8_t>& in)
539 BER_Decoder(in).
decode(m_alt_name);
545void Subject_Alternative_Name::contents_to(Data_Store& subject_info,
554void Issuer_Alternative_Name::contents_to(Data_Store&, Data_Store& issuer_info)
const
562std::vector<uint8_t> Extended_Key_Usage::encode_inner()
const
564 std::vector<uint8_t> output;
575void Extended_Key_Usage::decode_inner(
const std::vector<uint8_t>& in)
583void Extended_Key_Usage::contents_to(Data_Store& subject, Data_Store&)
const
585 for(
size_t i = 0; i != m_oids.size(); ++i)
586 subject.add(
"X509v3.ExtendedKeyUsage", m_oids[i].to_string());
592std::vector<uint8_t> Name_Constraints::encode_inner()
const
594 throw Not_Implemented(
"Name_Constraints encoding");
601void Name_Constraints::decode_inner(
const std::vector<uint8_t>& in)
603 std::vector<GeneralSubtree> permit, exclude;
605 BER_Decoder inner = ber.start_cons(
SEQUENCE);
606 BER_Object per = inner.get_next_object();
608 inner.push_back(per);
613 throw Encoding_Error(
"Empty Name Contraint list");
616 BER_Object exc = inner.get_next_object();
617 inner.push_back(exc);
622 throw Encoding_Error(
"Empty Name Contraint list");
627 if(permit.empty() && exclude.empty())
628 throw Encoding_Error(
"Empty Name Contraint extension");
630 m_name_constraints = NameConstraints(std::move(permit),std::move(exclude));
636void Name_Constraints::contents_to(Data_Store& subject, Data_Store&)
const
638 std::stringstream ss;
640 for(
const GeneralSubtree& gs: m_name_constraints.permitted())
643 subject.add(
"X509v3.NameConstraints.permitted", ss.str());
644 ss.str(std::string());
646 for(
const GeneralSubtree& gs: m_name_constraints.excluded())
649 subject.add(
"X509v3.NameConstraints.excluded", ss.str());
650 ss.str(std::string());
655 const std::vector<std::shared_ptr<const X509_Certificate>>& cert_path,
656 std::vector<std::set<Certificate_Status_Code>>& cert_status,
662 const size_t MAX_NC_COMPARES = (1 << 12);
663 const size_t total_constraints = m_name_constraints.
permitted().size() + m_name_constraints.
excluded().size();
665 if(!m_name_constraints.
permitted().empty() || !m_name_constraints.
excluded().empty())
672 const bool issuer_name_constraint_critical =
676 for(
size_t j = 0; j < pos; ++j)
678 const auto& cert = cert_path.at(j);
680 const size_t total_names =
681 cert->subject_dn().dn_info().size() +
682 cert->subject_alt_name().get_attributes().size();
684 if(total_names * total_constraints >= MAX_NC_COMPARES) {
689 if(!m_name_constraints.
is_permitted(*cert, issuer_name_constraint_critical)) {
694 if(m_name_constraints.
is_excluded(*cert, issuer_name_constraint_critical)) {
710 Policy_Information() =
default;
711 explicit Policy_Information(
const OID& oid) : m_oid(oid) {}
713 const OID& oid()
const {
return m_oid; }
715 void encode_into(DER_Encoder& codec)
const override
722 void decode_from(BER_Decoder& codec)
override
739std::vector<uint8_t> Certificate_Policies::encode_inner()
const
741 std::vector<Policy_Information> policies;
743 for(
size_t i = 0; i != m_oids.size(); ++i)
744 policies.push_back(Policy_Information(m_oids[i]));
746 std::vector<uint8_t> output;
749 .encode_list(policies)
757void Certificate_Policies::decode_inner(
const std::vector<uint8_t>& in)
759 std::vector<Policy_Information> policies;
761 BER_Decoder(in).decode_list(policies);
763 for(
size_t i = 0; i != policies.size(); ++i)
764 m_oids.push_back(policies[i].oid());
770void Certificate_Policies::contents_to(Data_Store& info, Data_Store&)
const
772 for(
size_t i = 0; i != m_oids.size(); ++i)
773 info.add(
"X509v3.CertificatePolicies", m_oids[i].to_string());
779 const std::vector<std::shared_ptr<const X509_Certificate>>& ,
780 std::vector<std::set<Certificate_Status_Code>>& cert_status,
783 std::set<OID> oid_set(m_oids.begin(), m_oids.end());
784 if(oid_set.size() != m_oids.size())
790std::vector<uint8_t> Authority_Information_Access::encode_inner()
const
794 std::vector<uint8_t> output;
805void Authority_Information_Access::decode_inner(
const std::vector<uint8_t>& in)
839void Authority_Information_Access::contents_to(Data_Store& subject, Data_Store&)
const
841 if(!m_ocsp_responder.empty())
842 subject.add(
"OCSP.responder", m_ocsp_responder);
843 for(
const std::string& ca_issuer : m_ca_issuers)
844 subject.add(
"PKIX.CertificateAuthorityIssuers", ca_issuer);
870std::vector<uint8_t> CRL_Number::encode_inner()
const
872 std::vector<uint8_t> output;
880void CRL_Number::decode_inner(
const std::vector<uint8_t>& in)
889void CRL_Number::contents_to(Data_Store& info, Data_Store&)
const
891 info.add(
"X509v3.CRLNumber",
static_cast<uint32_t
>(m_crl_number));
897std::vector<uint8_t> CRL_ReasonCode::encode_inner()
const
899 std::vector<uint8_t> output;
907void CRL_ReasonCode::decode_inner(
const std::vector<uint8_t>& in)
909 size_t reason_code = 0;
911 m_reason =
static_cast<CRL_Code>(reason_code);
917void CRL_ReasonCode::contents_to(Data_Store& info, Data_Store&)
const
919 info.add(
"X509v3.CRLReasonCode", m_reason);
922std::vector<uint8_t> CRL_Distribution_Points::encode_inner()
const
924 throw Not_Implemented(
"CRL_Distribution_Points encoding");
927void CRL_Distribution_Points::decode_inner(
const std::vector<uint8_t>& buf)
930 .decode_list(m_distribution_points)
933 std::stringstream ss;
935 for(
size_t i = 0; i != m_distribution_points.size(); ++i)
937 auto contents = m_distribution_points[i].point().contents();
939 for(
const auto& pair : contents)
941 ss << pair.first <<
": " << pair.second <<
" ";
945 m_crl_distribution_urls.push_back(ss.str());
948void CRL_Distribution_Points::contents_to(Data_Store& subject, Data_Store&)
const
950 for(
const std::string& crl_url : m_crl_distribution_urls)
951 subject.add(
"CRL.DistributionPoint", crl_url);
969std::vector<uint8_t> CRL_Issuing_Distribution_Point::encode_inner()
const
974void CRL_Issuing_Distribution_Point::decode_inner(
const std::vector<uint8_t>& buf)
981 auto contents = m_distribution_point.point().contents();
982 std::stringstream ss;
984 for(
const auto& pair : contents)
986 ss << pair.first <<
": " << pair.second <<
" ";
989 info.
add(
"X509v3.CRLIssuingDistributionPoint", ss.str());
992std::vector<uint8_t> Unknown_Extension::encode_inner()
const
997void Unknown_Extension::decode_inner(
const std::vector<uint8_t>& bytes)
1003void Unknown_Extension::contents_to(Data_Store&, Data_Store&)
const