internal static void PrepareNextCertG(
PkixCertPath certPath,
int index,
PkixNameConstraintValidator nameConstraintValidator)
//throws CertPathValidatorException
{
IList certs = certPath.Certificates;
X509Certificate cert = (X509Certificate)certs[index];
//
// (g) handle the name constraints extension
//
NameConstraints nc = null;
try
{
Asn1Sequence ncSeq = DerSequence.GetInstance(
PkixCertPathValidatorUtilities.GetExtensionValue(cert, X509Extensions.NameConstraints));
if (ncSeq != null)
{
nc = new NameConstraints(ncSeq);
}
}
catch (Exception e)
{
throw new PkixCertPathValidatorException(
"Name constraints extension could not be decoded.", e, certPath, index);
}
if (nc != null)
{
//
// (g) (1) permitted subtrees
//
Asn1Sequence permitted = nc.PermittedSubtrees;
if (permitted != null)
{
try
{
nameConstraintValidator.IntersectPermittedSubtree(permitted);
}
catch (Exception ex)
{
throw new PkixCertPathValidatorException(
"Permitted subtrees cannot be build from name constraints extension.", ex, certPath, index);
}
}
//
// (g) (2) excluded subtrees
//
Asn1Sequence excluded = nc.ExcludedSubtrees;
if (excluded != null)
{
IEnumerator e = excluded.GetEnumerator();
try
{
while (e.MoveNext())
{
GeneralSubtree subtree = GeneralSubtree.GetInstance(e.Current);
nameConstraintValidator.AddExcludedSubtree(subtree);
}
}
catch (Exception ex)
{
throw new PkixCertPathValidatorException(
"Excluded subtrees cannot be build from name constraints extension.", ex, certPath, index);
}
}
}
}
/// <summary>
/// Decode the name constraints and clone them if not null.
/// </summary>
private void setNameConstraints(
byte[] bytes)
{
if (bytes == null)
{
ncBytes = null;
nc = null;
}
else
{
ncBytes = (byte[]) bytes.Clone();
// validate DER encoding
//nc = new NameConstraintsExtension(Boolean.FALSE, bytes);
nc = NameConstraints.GetInstance(Asn1Object.FromByteArray(bytes));
}
}