59 lines
2.3 KiB
C++
59 lines
2.3 KiB
C++
/* -*- Mode: C++; tab-width: 8; indent-tabs-mode: nil; c-basic-offset: 2 -*- */
|
||
/* This Source Code Form is subject to the terms of the Mozilla Public
|
||
* License, v. 2.0. If a copy of the MPL was not distributed with this
|
||
* file, You can obtain one at http://mozilla.org/MPL/2.0/. */
|
||
|
||
#ifndef BRNameMatchingPolicy_h
|
||
#define BRNameMatchingPolicy_h
|
||
|
||
#include "pkix/pkixtypes.h"
|
||
|
||
namespace mozilla { namespace psm {
|
||
|
||
// According to the Baseline Requirements version 1.3.3 section 7.1.4.2.2.a,
|
||
// the requirements of the subject common name field are as follows:
|
||
// "If present, this field MUST contain a single IP address or Fully‐Qualified
|
||
// Domain Name that is one of the values contained in the Certificate’s
|
||
// subjectAltName extension". Consequently, since any name information present
|
||
// in the common name must be present in the subject alternative name extension,
|
||
// when performing name matching, it should not be necessary to fall back to the
|
||
// common name. Because this consequence has not commonly been enforced, this
|
||
// implementation provides a mechanism to start enforcing it gradually while
|
||
// maintaining some backwards compatibility. If configured with the mode
|
||
// "EnforceAfter23August2016", name matching will only fall back to using the
|
||
// subject common name for certificates where the notBefore field is before 23
|
||
// August 2016. Similarly, the mode "EnforceAfter23August2015" is also
|
||
// available. This is to provide a balance between allowing preexisting
|
||
// long-lived certificates and detecting newly-issued problematic certificates.
|
||
// Note that this implementation does not actually directly enforce that if the
|
||
// subject common name is present, its value corresponds to a dNSName or
|
||
// iPAddress entry in the subject alternative name extension.
|
||
|
||
class BRNameMatchingPolicy : public mozilla::pkix::NameMatchingPolicy
|
||
{
|
||
public:
|
||
enum class Mode {
|
||
DoNotEnforce = 0,
|
||
EnforceAfter23August2016 = 1,
|
||
EnforceAfter23August2015 = 2,
|
||
Enforce = 3,
|
||
};
|
||
|
||
explicit BRNameMatchingPolicy(Mode mode)
|
||
: mMode(mode)
|
||
{
|
||
}
|
||
|
||
virtual mozilla::pkix::Result FallBackToCommonName(
|
||
mozilla::pkix::Time notBefore,
|
||
/*out*/ mozilla::pkix::FallBackToSearchWithinSubject& fallBacktoCommonName)
|
||
override;
|
||
|
||
private:
|
||
Mode mMode;
|
||
};
|
||
|
||
} } // namespace mozilla::psm
|
||
|
||
#endif // BRNameMatchingPolicy_h
|