658 {
659 if(!m_name_constraints.
permitted().empty() || !m_name_constraints.
excluded().empty())
660 {
661 if(!subject.is_CA_cert())
662 {
664 }
665
666 const bool issuer_name_constraint_critical =
667 issuer.is_critical("X509v3.NameConstraints");
668
669
670 for(size_t j = 0; j < pos; ++j)
671 {
672 bool permitted = m_name_constraints.
permitted().empty();
673 bool failed = false;
674
675 for(
auto c: m_name_constraints.
permitted())
676 {
677 switch(c.base().matches(*cert_path.at(j)))
678 {
679 case GeneralName::MatchResult::NotFound:
680 case GeneralName::MatchResult::All:
681 permitted = true;
682 break;
683 case GeneralName::MatchResult::UnknownType:
684 failed = issuer_name_constraint_critical;
685 permitted = true;
686 break;
687 default:
688 break;
689 }
690 }
691
692 for(
auto c: m_name_constraints.
excluded())
693 {
694 switch(c.base().matches(*cert_path.at(j)))
695 {
696 case GeneralName::MatchResult::All:
697 case GeneralName::MatchResult::Some:
698 failed = true;
699 break;
700 case GeneralName::MatchResult::UnknownType:
701 failed = issuer_name_constraint_critical;
702 break;
703 default:
704 break;
705 }
706 }
707
708 if(failed || !permitted)
709 {
711 }
712 }
713 }
714 }
const std::vector< GeneralSubtree > & permitted() const
const std::vector< GeneralSubtree > & excluded() const