1 // Copyright 2015 The Chromium Authors 2 // Use of this source code is governed by a BSD-style license that can be 3 // found in the LICENSE file. 4 5 #ifndef BSSL_PKI_NAME_CONSTRAINTS_H_ 6 #define BSSL_PKI_NAME_CONSTRAINTS_H_ 7 8 #include "fillins/openssl_util.h" 9 #include <memory> 10 11 12 #include "general_names.h" 13 14 namespace bssl { 15 16 class CertErrors; 17 18 namespace der { 19 class Input; 20 } // namespace der 21 22 // Parses a NameConstraints extension value and allows testing whether names are 23 // allowed under those constraints as defined by RFC 5280 section 4.2.1.10. 24 class OPENSSL_EXPORT NameConstraints { 25 public: 26 ~NameConstraints(); 27 28 // Parses a DER-encoded NameConstraints extension and initializes this object. 29 // |extension_value| should be the extnValue from the extension (not including 30 // the OCTET STRING tag). |is_critical| should be true if the extension was 31 // marked critical. Returns nullptr if parsing the the extension failed. 32 // The object may reference data from |extension_value|, so is only valid as 33 // long as |extension_value| is. 34 static std::unique_ptr<NameConstraints> Create( 35 const der::Input& extension_value, 36 bool is_critical, 37 CertErrors* errors); 38 39 // Tests if a certificate is allowed by the name constraints. 40 // |subject_rdn_sequence| should be the DER-encoded value of the subject's 41 // RDNSequence (not including Sequence tag), and may be an empty ASN.1 42 // sequence. |subject_alt_names| should be the parsed representation of the 43 // subjectAltName extension or nullptr if the extension was not present. 44 // If the certificate is not allowed, an error will be added to |errors|. 45 // Note that this method does not check hostname or IP address in commonName, 46 // which is deprecated (crbug.com/308330). 47 void IsPermittedCert(const der::Input& subject_rdn_sequence, 48 const GeneralNames* subject_alt_names, 49 CertErrors* errors) const; 50 51 // Returns true if the ASCII email address |name| is permitted. |name| should 52 // be a "mailbox" as specified by RFC 2821, with the additional restriction 53 // that quoted names and whitespace are not allowed by this implementation. 54 bool IsPermittedRfc822Name(std::string_view name, 55 bool case_insensitive_exclude_localpart) const; 56 57 // Returns true if the ASCII hostname |name| is permitted. 58 // |name| may be a wildcard hostname (starts with "*."). Eg, "*.bar.com" 59 // would not be permitted if "bar.com" is permitted and "foo.bar.com" is 60 // excluded, while "*.baz.com" would only be permitted if "baz.com" is 61 // permitted. 62 bool IsPermittedDNSName(std::string_view name) const; 63 64 // Returns true if the directoryName |name_rdn_sequence| is permitted. 65 // |name_rdn_sequence| should be the DER-encoded RDNSequence value (not 66 // including the Sequence tag.) 67 bool IsPermittedDirectoryName(const der::Input& name_rdn_sequence) const; 68 69 // Returns true if the iPAddress |ip| is permitted. 70 bool IsPermittedIP(const der::Input& ip) const; 71 72 // Returns a bitfield of GeneralNameTypes of all the types constrained by this 73 // NameConstraints. Name types that aren't supported will only be present if 74 // the name constraint they appeared in was marked critical. 75 // 76 // RFC 5280 section 4.2.1.10 says: 77 // Applications conforming to this profile MUST be able to process name 78 // constraints that are imposed on the directoryName name form and SHOULD be 79 // able to process name constraints that are imposed on the rfc822Name, 80 // uniformResourceIdentifier, dNSName, and iPAddress name forms. 81 // If a name constraints extension that is marked as critical 82 // imposes constraints on a particular name form, and an instance of 83 // that name form appears in the subject field or subjectAltName 84 // extension of a subsequent certificate, then the application MUST 85 // either process the constraint or reject the certificate. constrained_name_types()86 int constrained_name_types() const { return constrained_name_types_; } 87 permitted_subtrees()88 const GeneralNames& permitted_subtrees() const { return permitted_subtrees_; } excluded_subtrees()89 const GeneralNames& excluded_subtrees() const { return excluded_subtrees_; } 90 91 private: 92 [[nodiscard]] bool Parse(const der::Input& extension_value, 93 bool is_critical, 94 CertErrors* errors); 95 96 GeneralNames permitted_subtrees_; 97 GeneralNames excluded_subtrees_; 98 int constrained_name_types_ = GENERAL_NAME_NONE; 99 }; 100 101 } // namespace net 102 103 #endif // BSSL_PKI_NAME_CONSTRAINTS_H_ 104