Botan::Cert_Extension::IPAddressBlocks Class Reference

#include <x509_ext.h>

Inheritance diagram for Botan::Cert_Extension::IPAddressBlocks:

Classes
class	IPAddress
class	IPAddressChoice
class	IPAddressFamily
class	IPAddressOrRange

Public Types
enum class	Version : uint8_t { IPv4 = 4 , IPv6 = 16 }

Public Member Functions
template<Version V>
void	add_address (const std::array< uint8_t, static_cast< size_t >(V)> &address, std::optional< uint8_t > safi=std::nullopt)
	Add a single IP address to this extension (for the specified SAFI, if any)
template<Version V>
void	add_address (const std::array< uint8_t, static_cast< std::size_t >(V)> &min, const std::array< uint8_t, static_cast< std::size_t >(V)> &max, std::optional< uint8_t > safi=std::nullopt)
	Add an IP address range to this extension (for the specified SAFI, if any)
const std::vector< IPAddressFamily > &	addr_blocks () const
std::unique_ptr< Certificate_Extension >	copy () const override
template<Version V>
void	inherit (std::optional< uint8_t > safi=std::nullopt)
	Mark the specified IP version as 'inherit' (for the specified SAFI, if any)
	IPAddressBlocks ()=default
	IPAddressBlocks (const std::vector< IPAddressFamily > &blocks)
OID	oid_of () const override
template<Version V>
void	restrict (std::optional< uint8_t > safi=std::nullopt)
	Make the extension contain no allowed IP addresses for the specified IP version (and SAFI, if any)
void	validate (const X509_Certificate &subject, const std::optional< X509_Certificate > &issuer, const std::vector< X509_Certificate > &cert_path, std::vector< std::set< Certificate_Status_Code > > &cert_status, size_t pos) override

Static Public Member Functions
static OID	static_oid ()

Detailed Description

IP Address Blocks Extension

RFC 3779 X.509 Extensions for IP Addr

Definition at line 590 of file x509_ext.h.

Member Enumeration Documentation

Version

enum class Botan::Cert_Extension::IPAddressBlocks::Version : uint8_t

strong

Enumerator
IPv4
IPv6

Definition at line 592 of file x509_ext.h.

                         : uint8_t {
         IPv4 = 4,
         IPv6 = 16,
      };

Constructor & Destructor Documentation

IPAddressBlocks() [1/2]

Botan::Cert_Extension::IPAddressBlocks::IPAddressBlocks ( )

default

IPAddressBlocks() [2/2]

Botan::Cert_Extension::IPAddressBlocks::IPAddressBlocks ( const std::vector< IPAddressFamily > & blocks )

inlineexplicit

Definition at line 722 of file x509_ext.h.

                                                                         : m_ip_addr_blocks(blocks) {
         this->sort_and_merge();
      }

Member Function Documentation

add_address() [1/2]

template<Version V>

void Botan::Cert_Extension::IPAddressBlocks::add_address ( const std::array< uint8_t, static_cast< size_t >(V)> & address, std::optional< uint8_t > safi = std::nullopt )

inline

Add a single IP address to this extension (for the specified SAFI, if any)

Definition at line 740 of file x509_ext.h.

                                                               {
         add_address<V>(address, address, safi);
      }

add_address() [2/2]

template<Version V>

void Botan::Cert_Extension::IPAddressBlocks::add_address ( const std::array< uint8_t, static_cast< std::size_t >(V)> & min, const std::array< uint8_t, static_cast< std::size_t >(V)> & max, std::optional< uint8_t > safi = std::nullopt )

inline

Add an IP address range to this extension (for the specified SAFI, if any)

Definition at line 747 of file x509_ext.h.

                                                               {
         std::vector<IPAddressOrRange<V>> addresses = {IPAddressOrRange<V>(IPAddress<V>(min), IPAddress<V>(max))};
         m_ip_addr_blocks.push_back(IPAddressFamily(IPAddressChoice<V>(addresses), safi));
         sort_and_merge();
      }

addr_blocks()

const std::vector< IPAddressFamily > & Botan::Cert_Extension::IPAddressBlocks::addr_blocks ( ) const

inline

Definition at line 770 of file x509_ext.h.

{ return m_ip_addr_blocks; }

Referenced by validate().

copy()

std::unique_ptr< Certificate_Extension > Botan::Cert_Extension::IPAddressBlocks::copy ( ) const

inlineoverridevirtual

Make a copy of this extension

Returns

copy of this

Implements Botan::Certificate_Extension.

Definition at line 726 of file x509_ext.h.

{ return std::make_unique<IPAddressBlocks>(*this); }

inherit()

template<Version V>

void Botan::Cert_Extension::IPAddressBlocks::inherit ( std::optional< uint8_t > safi = std::nullopt )

inline

Mark the specified IP version as 'inherit' (for the specified SAFI, if any)

Definition at line 765 of file x509_ext.h.

                                                           {
         m_ip_addr_blocks.push_back(IPAddressFamily(IPAddressChoice<V>(), safi));
         sort_and_merge();
      }

oid_of()

OID Botan::Cert_Extension::IPAddressBlocks::oid_of ( ) const

inlineoverridevirtual

Returns

OID representing this extension

Implements Botan::Certificate_Extension.

Definition at line 730 of file x509_ext.h.

{ return static_oid(); }

restrict()

template<Version V>

void Botan::Cert_Extension::IPAddressBlocks::restrict ( std::optional< uint8_t > safi = std::nullopt )

inline

Make the extension contain no allowed IP addresses for the specified IP version (and SAFI, if any)

Definition at line 757 of file x509_ext.h.

                                                            {
         std::vector<IPAddressOrRange<V>> addresses = {};
         m_ip_addr_blocks.push_back(IPAddressFamily(IPAddressChoice<V>(addresses), safi));
         sort_and_merge();
      }

static_oid()

static OID Botan::Cert_Extension::IPAddressBlocks::static_oid ( )

inlinestatic

Definition at line 728 of file x509_ext.h.

{ return OID({1, 3, 6, 1, 5, 5, 7, 1, 7}); }

validate()

void Botan::Cert_Extension::IPAddressBlocks::validate ( const X509_Certificate & subject, const std::optional< X509_Certificate > & issuer, const std::vector< X509_Certificate > & cert_path, std::vector< std::set< Certificate_Status_Code > > & cert_status, size_t pos )

overridevirtual

Reimplemented from Botan::Certificate_Extension.

Definition at line 1390 of file x509_ext.cpp.

                                           {
   // maps in the form of (s)afi -> (needs_checking, ranges)
   auto [v4_needs_check, v6_needs_check] = create_validation_map(m_ip_addr_blocks);
 
   if(pos == cert_path.size() - 1) {
      // checks if any range / family has 'inherit' as a value somewhere, not allowed for the root cert
      auto validate_root_cert_ext = [&](const auto& map) {
         // check if any range has a value of 'false', indicating 'inherit'
         return std::any_of(map.begin(), map.end(), [&](const auto& it) {
            const auto& [_1, validation_info] = it;
            const auto& [needs_checking, _2] = validation_info;
            return !needs_checking;
         });
      };
      if(validate_root_cert_ext(v4_needs_check) || validate_root_cert_ext(v6_needs_check)) {
         cert_status.at(pos).insert(Certificate_Status_Code::IPADDR_BLOCKS_ERROR);
      }
      return;
   }
 
   // traverse the chain until we find a cert with concrete values for the extension (so not 'inherit')
   for(auto cert_path_it = cert_path.begin() + pos + 1; cert_path_it != cert_path.end(); cert_path_it++) {
      const IPAddressBlocks* const parent_ip = cert_path_it->v3_extensions().get_extension_object_as<IPAddressBlocks>();
      // extension not present for parent
      if(parent_ip == nullptr) {
         cert_status.at(pos).insert(Certificate_Status_Code::IPADDR_BLOCKS_ERROR);
         return;
      }
      auto [issuer_v4, issuer_v6] = create_validation_map(parent_ip->addr_blocks());
 
      auto validate_against_issuer = [&](auto& subject_map, const auto& issuer_map) {
         for(auto map_it = subject_map.begin(); map_it != subject_map.end(); map_it++) {
            auto& [afam, validation_info] = *map_it;
 
            // the issuer does not have this combination of afi/safi
            if(issuer_map.count(afam) == 0) {
               cert_status.at(pos).insert(Certificate_Status_Code::IPADDR_BLOCKS_ERROR);
               return false;
            }
 
            auto& [needs_check, subject_value] = validation_info;
            const auto& [issuer_has_value, issuer_value] = issuer_map.at(afam);
            BOTAN_ASSERT_NOMSG(!needs_check || subject_value != nullptr);
            BOTAN_ASSERT_NOMSG(!issuer_has_value || issuer_value != nullptr);
 
            // we still need to check this range and the issuer has an actual value for it (so not 'inherit')
            if(needs_check && issuer_has_value) {
               if(!validate_subject_in_issuer(std::span(*subject_value), std::span(*issuer_value))) {
                  cert_status.at(pos).insert(Certificate_Status_Code::IPADDR_BLOCKS_ERROR);
                  return false;
               }
               needs_check = false;
            }
         }
         return true;
      };
 
      if(!validate_against_issuer(v4_needs_check, issuer_v4) || !validate_against_issuer(v6_needs_check, issuer_v6)) {
         return;
      }
 
      auto validate_no_checks_left = [&](const auto& map) {
         // check if all ranges have been checked, either by comparing their ranges if they have any,
         // or if they are inherit, their parent(s) will be validated later
         return std::all_of(map.begin(), map.end(), [&](const auto& it) {
            const auto& [_1, validation_info] = it;
            const auto& [needs_checking, _2] = validation_info;
            return !needs_checking;
         });
      };
 
      if(validate_no_checks_left(v4_needs_check) && validate_no_checks_left(v6_needs_check)) {
         // we've validated what we need to and can stop traversing the cert chain
         return;
      }
   }
}

References addr_blocks(), BOTAN_ASSERT_NOMSG, and Botan::IPADDR_BLOCKS_ERROR.

---

The documentation for this class was generated from the following files:

• src/lib/x509/x509_ext.h
• src/lib/x509/x509_ext.cpp