#include <x509stor.h>

Public Types
enum	Cert_Usage { ANY = 0x00 , TLS_SERVER = 0x01 , TLS_CLIENT = 0x02 , CODE_SIGNING = 0x04 , EMAIL_PROTECTION = 0x08 , TIME_STAMPING = 0x10 , CRL_SIGNING = 0x20 }

Public Member Functions
void	add_cert (const X509_Certificate &, bool=false)
void	add_certs (DataSource &)
X509_Code	add_crl (const X509_CRL &)
void	add_new_certstore (Certificate_Store *)
void	add_trusted_certs (DataSource &)
std::vector< X509_Certificate >	get_cert_chain (const X509_Certificate &)
std::string	PEM_encode () const
X509_Code	validate_cert (const X509_Certificate &, Cert_Usage=ANY)
	X509_Store (const X509_Store &)
	X509_Store (u32bit time_slack=24 60 60, u32bit cache_results=30 *60)
	~X509_Store ()

Detailed Description

X.509 Certificate Store

Definition at line 48 of file x509stor.h.

Member Enumeration Documentation

◆ Cert_Usage

enum Botan::X509_Store::Cert_Usage

Enumerator
ANY
TLS_SERVER
TLS_CLIENT
CODE_SIGNING
EMAIL_PROTECTION
TIME_STAMPING
CRL_SIGNING

Definition at line 51 of file x509stor.h.

                      {
         ANY              = 0x00,
         TLS_SERVER       = 0x01,
         TLS_CLIENT       = 0x02,
         CODE_SIGNING     = 0x04,
         EMAIL_PROTECTION = 0x08,
         TIME_STAMPING    = 0x10,
         CRL_SIGNING      = 0x20
      };

Constructor & Destructor Documentation

◆ X509_Store() [1/2]

Botan::X509_Store::X509_Store	(	u32bit	time_slack = 246060,
		u32bit	cache_results = 30*60 )

Definition at line 171 of file x509stor.cpp.

   {
   revoked_info_valid = true;
 
   validation_cache_timeout = cache_timeout;
   time_slack = slack;
   }

Referenced by X509_Store().

◆ X509_Store() [2/2]

Botan::X509_Store::X509_Store ( const X509_Store & other )

Definition at line 182 of file x509stor.cpp.

   {
   certs = other.certs;
   revoked = other.revoked;
   revoked_info_valid = other.revoked_info_valid;
   for(size_t j = 0; j != other.stores.size(); ++j)
      stores[j] = other.stores[j]->clone();
   time_slack = other.time_slack;
   validation_cache_timeout = other.validation_cache_timeout;
   }

References X509_Store().

◆ ~X509_Store()

Botan::X509_Store::~X509_Store ( )

Definition at line 196 of file x509stor.cpp.

   {
   for(size_t j = 0; j != stores.size(); ++j)
      delete stores[j];
   }

Member Function Documentation

◆ add_cert()

void Botan::X509_Store::add_cert	(	const X509_Certificate &	cert,
		bool	trusted = false )

Definition at line 473 of file x509stor.cpp.

   {
   if(trusted && !cert.is_self_signed())
      throw Invalid_Argument("X509_Store: Trusted certs must be self-signed");
 
   if(find_cert(cert.subject_dn(), cert.subject_key_id()) == NO_CERT_FOUND)
      {
      revoked_info_valid = false;
      Cert_Info info(cert, trusted);
      certs.push_back(info);
      }
   else if(trusted)
      {
      for(size_t j = 0; j != certs.size(); ++j)
         {
         const X509_Certificate& this_cert = certs[j].cert;
         if(this_cert == cert)
            certs[j].trusted = trusted;
         }
      }
   }

References Botan::X509_Certificate::is_self_signed(), Botan::X509_Certificate::subject_dn(), and Botan::X509_Certificate::subject_key_id().

◆ add_certs()

void Botan::X509_Store::add_certs ( DataSource & source )

Definition at line 514 of file x509stor.cpp.

   {
   do_add_certs(source, false);
   }

◆ add_crl()

X509_Code Botan::X509_Store::add_crl ( const X509_CRL & crl )

Definition at line 530 of file x509stor.cpp.

   {
   s32bit time_check = validity_check(crl.this_update(), crl.next_update(),
                                      system_time(), time_slack);
 
   if(time_check < 0)      return CRL_NOT_YET_VALID;
   else if(time_check > 0) return CRL_HAS_EXPIRED;
 
   size_t cert_index = NO_CERT_FOUND;
 
   for(size_t j = 0; j != certs.size(); ++j)
      {
      const X509_Certificate& this_cert = certs[j].cert;
      if(compare_ids(this_cert.subject_key_id(), crl.authority_key_id()))
         {
         if(this_cert.subject_dn() == crl.issuer_dn())
            cert_index = j;
         }
      }
 
   if(cert_index == NO_CERT_FOUND)
      return CRL_ISSUER_NOT_FOUND;
 
   const X509_Certificate& ca_cert = certs[cert_index].cert;
 
   X509_Code verify_result = validate_cert(ca_cert, CRL_SIGNING);
   if(verify_result != VERIFIED)
      return verify_result;
 
   verify_result = check_sig(crl, ca_cert.subject_public_key());
   if(verify_result != VERIFIED)
      return verify_result;
 
   std::vector<CRL_Entry> revoked_certs = crl.get_revoked();
 
   for(size_t j = 0; j != revoked_certs.size(); ++j)
      {
      CRL_Data revoked_info;
      revoked_info.issuer = crl.issuer_dn();
      revoked_info.serial = revoked_certs[j].serial_number();
      revoked_info.auth_key_id = crl.authority_key_id();
 
      std::vector<CRL_Data>::iterator p =
         std::find(revoked.begin(), revoked.end(), revoked_info);
 
      if(revoked_certs[j].reason_code() == REMOVE_FROM_CRL)
         {
         if(p == revoked.end()) continue;
         revoked.erase(p);
         }
      else
         {
         if(p != revoked.end()) continue;
         revoked.push_back(revoked_info);
         }
      }
 
   std::sort(revoked.begin(), revoked.end());
   revoked_info_valid = false;
 
   return VERIFIED;
   }

References Botan::X509_CRL::authority_key_id(), Botan::CRL_HAS_EXPIRED, Botan::CRL_ISSUER_NOT_FOUND, Botan::CRL_NOT_YET_VALID, CRL_SIGNING, Botan::X509_CRL::get_revoked(), Botan::X509_CRL::issuer_dn(), Botan::X509_CRL::next_update(), Botan::REMOVE_FROM_CRL, Botan::X509_Certificate::subject_dn(), Botan::X509_Certificate::subject_key_id(), Botan::X509_Certificate::subject_public_key(), Botan::system_time(), Botan::X509_CRL::this_update(), validate_cert(), and Botan::VERIFIED.

◆ add_new_certstore()

void Botan::X509_Store::add_new_certstore ( Certificate_Store * certstore )

Definition at line 465 of file x509stor.cpp.

   {
   stores.push_back(certstore);
   }

◆ add_trusted_certs()

void Botan::X509_Store::add_trusted_certs ( DataSource & source )

Definition at line 522 of file x509stor.cpp.

   {
   do_add_certs(source, true);
   }

◆ get_cert_chain()

std::vector< X509_Certificate > Botan::X509_Store::get_cert_chain ( const X509_Certificate & cert )

Definition at line 448 of file x509stor.cpp.

   {
   std::vector<X509_Certificate> result;
   std::vector<size_t> indexes;
   X509_Code chaining_result = construct_cert_chain(cert, indexes, true);
 
   if(chaining_result != VERIFIED)
      throw Invalid_State("X509_Store::get_cert_chain: Can't construct chain");
 
   for(size_t j = 0; j != indexes.size(); ++j)
      result.push_back(certs[indexes[j]].cert);
   return result;
   }

References Botan::Invalid_State::Invalid_State(), and Botan::VERIFIED.

◆ PEM_encode()

std::string Botan::X509_Store::PEM_encode ( ) const

Definition at line 596 of file x509stor.cpp.

   {
   std::string cert_store;
   for(size_t j = 0; j != certs.size(); ++j)
      cert_store += certs[j].cert.PEM_encode();
   return cert_store;
   }

◆ validate_cert()

X509_Code Botan::X509_Store::validate_cert	(	const X509_Certificate &	cert,
		Cert_Usage	cert_usage = ANY )

Definition at line 205 of file x509stor.cpp.

   {
   recompute_revoked_info();
 
   std::vector<size_t> indexes;
   X509_Code chaining_result = construct_cert_chain(cert, indexes);
   if(chaining_result != VERIFIED)
      return chaining_result;
 
   const u64bit current_time = system_time();
 
   s32bit time_check = validity_check(cert.start_time(), cert.end_time(),
                                      current_time, time_slack);
   if(time_check < 0)      return CERT_NOT_YET_VALID;
   else if(time_check > 0) return CERT_HAS_EXPIRED;
 
   X509_Code sig_check_result = check_sig(cert, certs[indexes[0]]);
   if(sig_check_result != VERIFIED)
      return sig_check_result;
 
   if(is_revoked(cert))
      return CERT_IS_REVOKED;
 
   for(size_t j = 0; j != indexes.size() - 1; ++j)
      {
      const X509_Certificate& current_cert = certs[indexes[j]].cert;
 
      time_check = validity_check(current_cert.start_time(),
                                  current_cert.end_time(),
                                  current_time,
                                  time_slack);
 
      if(time_check < 0)      return CERT_NOT_YET_VALID;
      else if(time_check > 0) return CERT_HAS_EXPIRED;
 
      sig_check_result = check_sig(certs[indexes[j]], certs[indexes[j+1]]);
      if(sig_check_result != VERIFIED)
         return sig_check_result;
      }
 
   return usage_check(cert, cert_usage);
   }

References Botan::CERT_HAS_EXPIRED, Botan::CERT_IS_REVOKED, Botan::CERT_NOT_YET_VALID, Botan::X509_Certificate::end_time(), Botan::X509_Certificate::start_time(), Botan::system_time(), and Botan::VERIFIED.

Referenced by add_crl().

The documentation for this class was generated from the following files:

src/cert/x509store/x509stor.h
src/cert/x509store/x509stor.cpp

Public Types

Public Member Functions