657 {
658 if(!m_name_constraints.
permitted().empty() || !m_name_constraints.
excluded().empty())
659 {
660 if(!subject.is_CA_cert())
661 {
663 }
664
665 const bool issuer_name_constraint_critical =
666 issuer.is_critical("X509v3.NameConstraints");
667
668
669 for(size_t j = 0; j < pos; ++j)
670 {
671 bool permitted = m_name_constraints.
permitted().empty();
672 bool failed = false;
673
674 for(auto c: m_name_constraints.permitted())
675 {
676 switch(c.base().matches(*cert_path.at(j)))
677 {
680 permitted = true;
681 break;
683 failed = issuer_name_constraint_critical;
684 permitted = true;
685 break;
686 default:
687 break;
688 }
689 }
690
691 for(auto c: m_name_constraints.excluded())
692 {
693 switch(c.base().matches(*cert_path.at(j)))
694 {
697 failed = true;
698 break;
700 failed = issuer_name_constraint_critical;
701 break;
702 default:
703 break;
704 }
705 }
706
707 if(failed || !permitted)
708 {
710 }
711 }
712 }
713 }
const std::vector< GeneralSubtree > & permitted() const
const std::vector< GeneralSubtree > & excluded() const