name constraints: simplified gnutls_x509_name_constraints_check_crt()

diff --git a/lib/x509/name_constraints.c b/lib/x509/name_constraints.c
index 50ff310408b74ff8d5d63d0354742cb4a8b2a2db..26b3fcf25a29f2f28e0d73ec4862a8ab95b91c66 100644 (file)
--- a/lib/x509/name_constraints.c
+++ b/lib/x509/name_constraints.c
@@ -591,6 +591,46 @@ unsigned gnutls_x509_name_constraints_check(gnutls_x509_name_constraints_t nc,
        return check_unsupported_constraint(nc, type);
 }
 
+/* This function checks for unsupported constraints, that we also
+ * know their structure. That is it will fail only if the constraint
+ * is present in the CA, _and_ the name in the end certificate contains
+ * the constrained element. */
+static int check_unsupported_constraint2(gnutls_x509_crt_t cert, 
+                                        gnutls_x509_name_constraints_t nc,
+                                        gnutls_x509_subject_alt_name_t type)
+{
+       unsigned idx, found_one;
+       char name[MAX_CN];
+       size_t name_size;
+       unsigned san_type;
+       int ret;
+
+       idx = 0;
+       found_one = 0;
+
+       do {
+               name_size = sizeof(name);
+               ret = gnutls_x509_crt_get_subject_alt_name2(cert,
+                       idx++, name, &name_size, &san_type, NULL);
+               if (ret == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
+                       break;
+               else if (ret < 0)
+                       return gnutls_assert_val(0);
+
+               if (san_type != GNUTLS_SAN_URI)
+                       continue;
+
+               found_one = 1;
+               break;
+       } while(ret >= 0);
+
+       if (found_one != 0)
+               return check_unsupported_constraint(nc, type);
+
+       /* no name was found in the certificate, so accept */
+       return 1;
+}
+
 /**
  * gnutls_x509_name_constraints_check_crt:
  * @nc: the extracted name constraints
@@ -749,54 +789,8 @@ unsigned found_one;
                         */
                        return gnutls_assert_val(1);
                }
-       } else if (type == GNUTLS_SAN_IPADDRESS) {
-               /* Only check whether the IPAddress is present */
-               idx = found_one = 0;
-               do {
-                       name_size = sizeof(name);
-                       ret = gnutls_x509_crt_get_subject_alt_name2(cert,
-                               idx++, name, &name_size, &san_type, NULL);
-                       if (ret == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
-                               break;
-                       else if (ret < 0)
-                               return gnutls_assert_val(0);
-
-                       if (san_type != GNUTLS_SAN_IPADDRESS)
-                               continue;
-
-                       found_one = 1;
-                       break;
-               } while(ret >= 0);
-
-               if (found_one != 0)
-                       return check_unsupported_constraint(nc, type);
-
-               /* no IPaddress was found in the certificate, so accept */
-               return 1;
-       } else if (type == GNUTLS_SAN_URI) {
-               /* Only check whether the URI is present */
-               idx = found_one = 0;
-               do {
-                       name_size = sizeof(name);
-                       ret = gnutls_x509_crt_get_subject_alt_name2(cert,
-                               idx++, name, &name_size, &san_type, NULL);
-                       if (ret == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE)
-                               break;
-                       else if (ret < 0)
-                               return gnutls_assert_val(0);
-
-                       if (san_type != GNUTLS_SAN_URI)
-                               continue;
-
-                       found_one = 1;
-                       break;
-               } while(ret >= 0);
-
-               if (found_one != 0)
-                       return check_unsupported_constraint(nc, type);
-
-               /* no IPaddress was found in the certificate, so accept */
-               return 1;
+       } else if (type == GNUTLS_SAN_IPADDRESS || type == GNUTLS_SAN_URI) {
+               return check_unsupported_constraint2(cert, nc, type);
        } else
                return check_unsupported_constraint(nc, type);
 }