X.509 Name Constraints

24 files changed, 1011 insertions, 23 deletions

diff --git a/src/lib/asn1/oid_lookup/default.cpp b/src/lib/asn1/oid_lookup/default.cpp
index 5bd268e5b..fe7a42748 100644
--- a/src/lib/asn1/oid_lookup/default.cpp
+++ b/src/lib/asn1/oid_lookup/default.cpp
@@ -177,6 +177,7 @@ const char* default_oid_list()
       "2.5.29.21 = X509v3.ReasonCode" "\n"
       "2.5.29.23 = X509v3.HoldInstructionCode" "\n"
       "2.5.29.24 = X509v3.InvalidityDate" "\n"
+      "2.5.29.30 = X509v3.NameConstraints" "\n"
       "2.5.29.31 = X509v3.CRLDistributionPoints" "\n"
       "2.5.29.32 = X509v3.CertificatePolicies" "\n"
       "2.5.29.35 = X509v3.AuthorityKeyIdentifier" "\n"
diff --git a/src/lib/asn1/x509_dn.cpp b/src/lib/asn1/x509_dn.cpp
index 9c36cd695..e9a4731b3 100644
--- a/src/lib/asn1/x509_dn.cpp
+++ b/src/lib/asn1/x509_dn.cpp
@@ -12,6 +12,7 @@
 #include <botan/internal/stl_util.h>
 #include <botan/oids.h>
 #include <ostream>
+#include <cctype>
 
 namespace Botan {
 
@@ -117,15 +118,15 @@ std::vector<byte> X509_DN::get_bits() const
 */
 std::string X509_DN::deref_info_field(const std::string& info)
    {
-   if(info == "Name" || info == "CommonName") return "X520.CommonName";
-   if(info == "SerialNumber")                 return "X520.SerialNumber";
-   if(info == "Country")                      return "X520.Country";
-   if(info == "Organization")                 return "X520.Organization";
-   if(info == "Organizational Unit" || info == "OrgUnit")
+   if(info == "Name" || info == "CommonName" || info == "CN") return "X520.CommonName";
+   if(info == "SerialNumber" || info == "SN")                 return "X520.SerialNumber";
+   if(info == "Country" || info == "C")                       return "X520.Country";
+   if(info == "Organization" || info == "O")                  return "X520.Organization";
+   if(info == "Organizational Unit" || info == "OrgUnit" || info == "OU")
       return "X520.OrganizationalUnit";
-   if(info == "Locality")                     return "X520.Locality";
-   if(info == "State" || info == "Province")  return "X520.State";
-   if(info == "Email")                        return "RFC822";
+   if(info == "Locality" || info == "L")                      return "X520.Locality";
+   if(info == "State" || info == "Province" || info == "ST")  return "X520.State";
+   if(info == "Email")                                        return "RFC822";
    return info;
    }
 
@@ -303,9 +304,93 @@ std::ostream& operator<<(std::ostream& out, const X509_DN& dn)
    for(std::multimap<std::string, std::string>::const_iterator i = contents.begin();
        i != contents.end(); ++i)
       {
-      out << to_short_form(i->first) << "=" << i->second << ' ';
+      out << to_short_form(i->first) << "=\"";
+      for(char c: i->second)
+         {
+         if(c == '\\' || c == '\"')
+            {
+            out << "\\";
+            }
+         out << c;
+         }
+      out << "\"";
+
+      if(std::next(i) != contents.end())
+         {
+         out << ",";
+         }
       }
    return out;
    }
 
+std::istream& operator>>(std::istream& in, X509_DN& dn)
+   {
+   in >> std::noskipws;
+   do
+      {
+      std::string key;
+      std::string val;
+      char c;
+
+      while(in.good())
+         {
+         in >> c;
+
+         if(std::isspace(c) && key.empty())
+            continue;
+         else if(!std::isspace(c))
+            {
+            key.push_back(c);
+            break;
+            }
+         else
+            break;
+         }
+
+      while(in.good())
+         {
+         in >> c;
+
+         if(!std::isspace(c) && c != '=')
+            key.push_back(c);
+         else if(c == '=')
+            break;
+         else
+            throw Invalid_Argument("Ill-formed X.509 DN");
+         }
+
+      bool in_quotes = false;
+      while(in.good())
+         {
+         in >> c;
+
+         if(std::isspace(c))
+            {
+            if(!in_quotes && !val.empty())
+               break;
+            else if(in_quotes)
+               val.push_back(' ');
+            }
+         else if(c == '"')
+            in_quotes = !in_quotes;
+         else if(c == '\\')
+            {
+            if(in.good())
+               in >> c;
+            val.push_back(c);
+            }
+         else if(c == ',' && !in_quotes)
+            break;
+         else
+            val.push_back(c);
+         }
+
+      if(!key.empty() && !val.empty())
+         dn.add_attribute(X509_DN::deref_info_field(key),val);
+      else
+         break;
+      }
+   while(in.good());
+   return in;
+   }
 }
diff --git a/src/lib/asn1/x509_dn.h b/src/lib/asn1/x509_dn.h
index a86cc6417..dafe72f51 100644
--- a/src/lib/asn1/x509_dn.h
+++ b/src/lib/asn1/x509_dn.h
@@ -50,6 +50,7 @@ bool BOTAN_DLL operator!=(const X509_DN&, const X509_DN&);
 bool BOTAN_DLL operator<(const X509_DN&, const X509_DN&);
 
 BOTAN_DLL std::ostream& operator<<(std::ostream& out, const X509_DN& dn);
+BOTAN_DLL std::istream& operator>>(std::istream& in, X509_DN& dn);
 
 }
 
diff --git a/src/lib/cert/x509/cert_status.h b/src/lib/cert/x509/cert_status.h
index 5028af384..6e8635237 100644
--- a/src/lib/cert/x509/cert_status.h
+++ b/src/lib/cert/x509/cert_status.h
@@ -38,6 +38,7 @@ enum class Certificate_Status_Code {
    INVALID_USAGE,
    CERT_CHAIN_TOO_LONG,
    CA_CERT_NOT_FOR_CERT_ISSUER,
+   NAME_CONSTRAINT_ERROR,
 
    // Revocation errors
    CA_CERT_NOT_FOR_CRL_ISSUER,
diff --git a/src/lib/cert/x509/name_constraint.cpp b/src/lib/cert/x509/name_constraint.cpp
new file mode 100644
index 000000000..d763076cb
--- /dev/null
+++ b/src/lib/cert/x509/name_constraint.cpp
@@ -0,0 +1,269 @@
+/*
+* X.509 Name Constraint
+* (C) 2015 Kai Michaelis
+*
+* Botan is released under the Simplified BSD License (see license.txt)
+*/
+
+#include <botan/name_constraint.h>
+#include <botan/ber_dec.h>
+#include <botan/der_enc.h>
+#include <botan/charset.h>
+#include <botan/loadstor.h>
+#include <botan/x509_dn.h>
+#include <botan/x509cert.h>
+#include <sstream>
+
+namespace Botan {
+
+GeneralName::GeneralName(const std::string& v) : GeneralName()
+   {
+   size_t p = v.find(':');
+
+   if(p != std::string::npos)
+      {
+      m_type = v.substr(0,p);
+      m_name = v.substr(p + 1,std::string::npos);
+      }
+   else
+      {
+      throw Invalid_Argument("Failed to decode Name Constraint");
+      }
+   }
+
+void GeneralName::encode_into(class DER_Encoder&) const
+   {
+   throw std::runtime_error("General Name encoding not implemented");
+   }
+
+void GeneralName::decode_from(class BER_Decoder& ber)
+   {
+   BER_Object obj = ber.get_next_object();
+   if((obj.class_tag != CONTEXT_SPECIFIC) &&
+      (obj.class_tag != (CONTEXT_SPECIFIC | CONSTRUCTED)))
+      throw Decoding_Error("Invalid class tag while decoding GeneralName");
+
+   const ASN1_Tag tag = obj.type_tag;
+
+   if(tag == 1 || tag == 2 || tag == 6)
+      {
+      m_name = Charset::transcode(ASN1::to_string(obj),LATIN1_CHARSET,LOCAL_CHARSET);
+
+      if(tag == 1)
+         {
+         m_type = "RFC822";
+         }
+      else if(tag == 2)
+         {
+         m_type = "DNS";
+         }
+      else if(tag == 6)
+         {
+         m_type = "URI";
+         }
+      }
+   else if(tag == 4)
+      {
+      X509_DN dn;
+      std::multimap<std::string, std::string> nam;
+      BER_Decoder dec(obj.value);
+      std::stringstream ss;
+
+      dn.decode_from(dec);
+      ss << dn;
+
+      m_name = ss.str();
+      m_type = "DN";
+      }
+   else if(tag == 7)
+      {
+      if(obj.value.size() == 8)
+         {
+         const std::vector<byte> ip(obj.value.begin(),obj.value.begin() + 4);
+         const std::vector<byte> net(obj.value.begin() + 4,obj.value.end());
+         m_type = "IP";
+         m_name = ipv4_to_string(load_be<u32bit>(ip.data(),0)) + "/" + ipv4_to_string(load_be<u32bit>(net.data(),0));
+         }
+      }
+   else
+      {
+      throw Decoding_Error("Found unknown GeneralName type");
+      }
+   }
+
+GeneralName::MatchResult GeneralName::matches(const X509_Certificate& cert) const
+   {
+   if(type() == "DNS" || type() == "DN" || type() == "IP")
+      {
+      std::vector<std::string> nam;
+      std::function<bool(const GeneralName*,const std::string&)> match_fn;
+
+      if(type() == "DNS")
+         {
+         match_fn = std::mem_fn(&GeneralName::matches_dns);
+         nam = cert.subject_info("DNS");
+
+         if(nam.empty())
+            {
+            nam = cert.subject_info("CN");
+            }
+         }
+      else if(type() == "DN")
+         {
+         std::stringstream ss;
+
+         match_fn = std::mem_fn(&GeneralName::matches_dn);
+         ss << cert.subject_dn();
+
+         nam.push_back(ss.str());
+         }
+      else if(type() == "IP")
+         {
+         match_fn = std::mem_fn(&GeneralName::matches_ip);
+         nam = cert.subject_info("IP");
+         }
+
+      else
+         {
+         throw Unsupported_Argument("Unsupported Name Constraint");
+         }
+
+      if(nam.empty())
+         {
+         return MatchResult::NotFound;
+         }
+
+      bool some = false;
+      bool all = true;
+
+      for(const std::string& n: nam)
+         {
+         bool m = match_fn(this,n);
+
+         some |= m;
+         all &= m;
+         }
+
+      if(all)
+         {
+         return MatchResult::All;
+         }
+      else if(some)
+         {
+         return MatchResult::Some;
+         }
+      else
+         {
+         return MatchResult::None;
+         }
+      }
+   else
+      {
+      return MatchResult::UnknownType;
+      }
+   }
+
+bool GeneralName::matches_dns(const std::string& nam) const
+   {
+      if(nam.size() == name().size())
+         return nam == name();
+      else if(name().size() > nam.size())
+         return false;
+      else // nam.size() > name().size()
+         {
+         std::string constr = name().front() == '.' ? name() : "." + name();
+         // constr is suffix of nam
+         return constr == nam.substr(nam.size() - constr.size(),constr.size());
+         }
+   }
+
+bool GeneralName::matches_dn(const std::string& nam) const
+   {
+   std::stringstream ss(nam);
+   std::stringstream tt(name());
+   X509_DN nam_dn, my_dn;
+
+   ss >> nam_dn;
+   tt >> my_dn;
+
+   auto attr = nam_dn.get_attributes();
+   bool ret = true;
+   int trys = 0;
+
+   for(const std::pair<OID,std::string>& c: my_dn.get_attributes())
+      {
+      auto i = attr.equal_range(c.first);
+
+      if(i.first != i.second)
+         {
+         trys += 1;
+         ret &= i.first->second == c.second;
+         }
+      }
+
+   return trys > 0 && ret;
+   }
+
+bool GeneralName::matches_ip(const std::string& nam) const
+   {
+   u32bit ip = string_to_ipv4(nam);
+   std::vector<std::string> p = split_on(name(),'/');
+
+   if(p.size() != 2)
+      throw Decoding_Error("failed to parse IPv4 address");
+
+   u32bit net = string_to_ipv4(p.at(0));
+   u32bit mask = string_to_ipv4(p.at(1));
+
+   return (ip & mask) == net;
+   }
+
+std::ostream& operator<<(std::ostream& os, const GeneralName& gn)
+   {
+   os << gn.type() << ":" << gn.name();
+   return os;
+   }
+
+GeneralSubtree::GeneralSubtree(const std::string& v) : GeneralSubtree()
+   {
+   size_t p0, p1;
+   size_t min = stoull(v,&p0,10);
+   size_t max = stoull(v.substr(p0 + 1),&p1,10);
+   GeneralName gn(v.substr(p0 + p1 + 2));
+
+   if(p0 > 0 && p1 > 0)
+      {
+      m_minimum = min;
+      m_maximum = max;
+      m_base = gn;
+      }
+   else
+      {
+      throw Invalid_Argument("Failed to decode Name Constraint");
+      }
+   }
+
+void GeneralSubtree::encode_into(class DER_Encoder&) const
+   {
+   throw std::runtime_error("General Subtree encoding not implemented");
+   }
+
+void GeneralSubtree::decode_from(class BER_Decoder& ber)
+   {
+   ber.start_cons(SEQUENCE)
+      .decode(m_base)
+      .decode_optional(m_minimum,ASN1_Tag(0),CONTEXT_SPECIFIC,size_t(0))
+   .end_cons();
+
+   if(m_minimum != 0)
+     throw Decoding_Error("GeneralSubtree minimum must be 0");
+
+   m_maximum = std::numeric_limits<std::size_t>::max();
+   }
+
+std::ostream& operator<<(std::ostream& os, const GeneralSubtree& gs)
+   {
+   os << gs.minimum() << "," << gs.maximum() << "," << gs.base();
+   return os;
+   }
+}
diff --git a/src/lib/cert/x509/name_constraint.h b/src/lib/cert/x509/name_constraint.h
new file mode 100644
index 000000000..345e64ff5
--- /dev/null
+++ b/src/lib/cert/x509/name_constraint.h
@@ -0,0 +1,132 @@
+/*
+* X.509 Name Constraint
+* (C) 2015 Kai Michaelis
+*
+* Botan is released under the Simplified BSD License (see license.txt)
+*/
+
+#ifndef BOTAN_NAME_CONSTRAINT_H__
+#define BOTAN_NAME_CONSTRAINT_H__
+
+#include <botan/asn1_obj.h>
+#include <ostream>
+
+namespace Botan {
+
+   class X509_Certificate;
+
+   /**
+    * @brief X.509 GeneralName Type
+    *
+    * Handles parsing GeneralName types in their BER and canonical string
+    * encoding. Allows matching GeneralNames against each other using
+    * the rules laid out in the X.509 4.2.1.10 (Name Contraints).
+    */
+   class BOTAN_DLL GeneralName : public ASN1_Object
+      {
+      public:
+         enum MatchResult : int
+            {
+            All,
+            Some,
+            None,
+            NotFound,
+            UnknownType,
+            };
+
+         GeneralName() : m_type(), m_name() {}
+
+         /// Constructs a new GeneralName for its string format.
+         GeneralName(const std::string& s);
+
+         void encode_into(class DER_Encoder&) const override;
+         void decode_from(class BER_Decoder&) override;
+
+         /// Type of the name. Can be DN, DNS, IP, RFC822, URI.
+         const std::string& type() const { return m_type; }
+
+         /// The name as string. Format depends on type.
+         const std::string& name() const { return m_name; }
+
+         /// Checks whenever a given certificate (partially) matches this name.
+         MatchResult matches(const X509_Certificate&) const;
+
+      private:
+         std::string m_type;
+         std::string m_name;
+
+         bool matches_dns(const std::string&) const;
+         bool matches_dn(const std::string&) const;
+         bool matches_ip(const std::string&) const;
+      };
+
+   std::ostream& operator<<(std::ostream& os, const GeneralName& gn);
+
+   /**
+    * @brief A single Name Constraints
+    *
+    * THe Name Constraint extension adds a minimum and maximum path
+    * length to a GeneralName to form a constraint. The length limits
+    * are currently unused.
+    */
+   class BOTAN_DLL GeneralSubtree : public ASN1_Object
+      {
+      public:
+         GeneralSubtree() : m_base(), m_minimum(0), m_maximum(std::numeric_limits<std::size_t>::max())
+         {}
+
+         /// Constructs a new Name Constraint
+         GeneralSubtree(GeneralName b,size_t min,size_t max)
+         : m_base(b), m_minimum(min), m_maximum(max)
+         {}
+
+         /// Constructs a new GeneralSubtree for its string format.
+         GeneralSubtree(const std::string&);
+
+         void encode_into(class DER_Encoder&) const override;
+         void decode_from(class BER_Decoder&) override;
+
+         /// Name
+         GeneralName base() const { return m_base; }
+
+         // Minimum path length
+         size_t minimum() const { return m_minimum; }
+
+         // Maximum path length
+         size_t maximum() const { return m_maximum; }
+
+      private:
+         GeneralName m_base;
+         size_t m_minimum;
+         size_t m_maximum;
+      };
+
+   std::ostream& operator<<(std::ostream& os, const GeneralSubtree& gs);
+
+   /**
+    * @brief Name Constraints
+    *
+    * Wraps the Name Constraints associated with a certificate.
+    */
+   class BOTAN_DLL NameConstraints
+      {
+      public:
+         NameConstraints() : m_permitted_subtrees(), m_excluded_subtrees() {}
+
+         NameConstraints(std::vector<GeneralSubtree>&& ps, std::vector<GeneralSubtree>&& es)
+         : m_permitted_subtrees(ps), m_excluded_subtrees(es)
+         {}
+
+         /// Permitted names
+         const std::vector<GeneralSubtree>& permitted() const { return m_permitted_subtrees; }
+
+         /// Excluded names
+         const std::vector<GeneralSubtree>& excluded() const { return m_excluded_subtrees; }
+
+      private:
+        std::vector<GeneralSubtree> m_permitted_subtrees;
+        std::vector<GeneralSubtree> m_excluded_subtrees;
+      };
+}
+
+#endif
diff --git a/src/lib/cert/x509/x509_ext.cpp b/src/lib/cert/x509/x509_ext.cpp
index b4b918529..765ad1786 100644
--- a/src/lib/cert/x509/x509_ext.cpp
+++ b/src/lib/cert/x509/x509_ext.cpp
@@ -13,6 +13,7 @@
 #include <botan/charset.h>
 #include <botan/internal/bit_ops.h>
 #include <algorithm>
+#include <sstream>
 
 namespace Botan {
 
@@ -32,6 +33,7 @@ Certificate_Extension* Extensions::get_extension(const OID& oid)
    X509_EXTENSION("X509v3.ExtendedKeyUsage", Extended_Key_Usage);
    X509_EXTENSION("X509v3.IssuerAlternativeName", Issuer_Alternative_Name);
    X509_EXTENSION("X509v3.SubjectAlternativeName", Subject_Alternative_Name);
+   X509_EXTENSION("X509v3.NameConstraints", Name_Constraints);
    X509_EXTENSION("X509v3.CertificatePolicies", Certificate_Policies);
    X509_EXTENSION("X509v3.CRLDistributionPoints", CRL_Distribution_Points);
    X509_EXTENSION("PKIX.AuthorityInformationAccess", Authority_Information_Access);
@@ -160,7 +162,10 @@ void Extensions::contents_to(Data_Store& subject_info,
                              Data_Store& issuer_info) const
    {
    for(size_t i = 0; i != m_extensions.size(); ++i)
+      {
       m_extensions[i].first->contents_to(subject_info, issuer_info);
+      subject_info.add(m_extensions[i].first->oid_name() + ".is_critical", (m_extensions[i].second ? 1 : 0));
+      }
    }
 
 /*
@@ -436,6 +441,71 @@ void Extended_Key_Usage::contents_to(Data_Store& subject, Data_Store&) const
       subject.add("X509v3.ExtendedKeyUsage", m_oids[i].as_string());
    }
 
+/*
+* Encode the extension
+*/
+std::vector<byte> Name_Constraints::encode_inner() const
+   {
+   throw std::runtime_error("Name_Constraints encoding not implemented");
+   }
+
+
+/*
+* Decode the extension
+*/
+void Name_Constraints::decode_inner(const std::vector<byte>& in)
+   {
+   std::vector<GeneralSubtree> permit, exclude;
+   BER_Decoder ber(in);
+   BER_Decoder ext = ber.start_cons(SEQUENCE);
+   BER_Object per = ext.get_next_object();
+
+   ext.push_back(per);
+   if(per.type_tag == 0 && per.class_tag == ASN1_Tag(CONSTRUCTED | CONTEXT_SPECIFIC))
+      {
+      ext.decode_list(permit,ASN1_Tag(0),ASN1_Tag(CONSTRUCTED | CONTEXT_SPECIFIC));
+      if(permit.empty())
+         throw Encoding_Error("Empty Name Contraint list");
+      }
+
+   BER_Object exc = ext.get_next_object();
+   ext.push_back(exc);
+   if(per.type_tag == 1 && per.class_tag == ASN1_Tag(CONSTRUCTED | CONTEXT_SPECIFIC))
+      {
+      ext.decode_list(exclude,ASN1_Tag(1),ASN1_Tag(CONSTRUCTED | CONTEXT_SPECIFIC));
+      if(exclude.empty())
+         throw Encoding_Error("Empty Name Contraint list");
+      }
+
+   ext.end_cons();
+
+   if(permit.empty() && exclude.empty())
+      throw Encoding_Error("Empty Name Contraint extension");
+
+   m_name_constraints = NameConstraints(std::move(permit),std::move(exclude));
+   }
+
+/*
+* Return a textual representation
+*/
+void Name_Constraints::contents_to(Data_Store& subject, Data_Store&) const
+   {
+   std::stringstream ss;
+
+   for(const GeneralSubtree& gs: m_name_constraints.permitted())
+      {
+      ss << gs;
+      subject.add("X509v3.NameConstraints.permitted", ss.str());
+      ss.str(std::string());
+      }
+   for(const GeneralSubtree& gs: m_name_constraints.excluded())
+      {
+      ss << gs;
+      subject.add("X509v3.NameConstraints.excluded", ss.str());
+      ss.str(std::string());
+      }
+   }
+
 namespace {
 
 /*
diff --git a/src/lib/cert/x509/x509_ext.h b/src/lib/cert/x509/x509_ext.h
index e9e718014..64d290fc2 100644
--- a/src/lib/cert/x509/x509_ext.h
+++ b/src/lib/cert/x509/x509_ext.h
@@ -256,6 +256,29 @@ class BOTAN_DLL Extended_Key_Usage final : public Certificate_Extension
    };
 
 /**
+* Name Constraints
+*/
+class BOTAN_DLL Name_Constraints : public Certificate_Extension
+   {
+   public:
+      Name_Constraints* copy() const override
+         { return new Name_Constraints(m_name_constraints); }
+
+      Name_Constraints() {}
+      Name_Constraints(const NameConstraints &nc) : m_name_constraints(nc) {}
+   private:
+      std::string oid_name() const override
+         { return "X509v3.NameConstraints"; }
+
+      bool should_encode() const override { return true; }
+      std::vector<byte> encode_inner() const override;
+      void decode_inner(const std::vector<byte>&) override;
+      void contents_to(Data_Store&, Data_Store&) const override;
+
+      NameConstraints m_name_constraints;
+   };
+
+/**
 * Certificate Policies Extension
 */
 class BOTAN_DLL Certificate_Policies final : public Certificate_Extension
diff --git a/src/lib/cert/x509/x509cert.cpp b/src/lib/cert/x509/x509cert.cpp
index cb24a7a03..73aa02cf3 100644
--- a/src/lib/cert/x509/x509cert.cpp
+++ b/src/lib/cert/x509/x509cert.cpp
@@ -279,6 +279,14 @@ u32bit X509_Certificate::path_limit() const
    }
 
 /*
+* Return if a certificate extension is marked critical
+*/
+bool X509_Certificate::is_critical(const std::string& ex_name) const
+   {
+   return !!m_subject.get1_u32bit(ex_name + ".is_critical",0);
+   }
+
+/*
 * Return the key usage constraints
 */
 Key_Constraints X509_Certificate::constraints() const
@@ -296,6 +304,26 @@ std::vector<std::string> X509_Certificate::ex_constraints() const
    }
 
 /*
+* Return the name constraints
+*/
+NameConstraints X509_Certificate::name_constraints() const
+   {
+   std::vector<GeneralSubtree> permit, exclude;
+
+   for(const std::string& v: m_subject.get("X509v3.NameConstraints.permitted"))
+      {
+      permit.push_back(GeneralSubtree(v));
+      }
+
+   for(const std::string& v: m_subject.get("X509v3.NameConstraints.excluded"))
+      {
+      exclude.push_back(GeneralSubtree(v));
+      }
+
+   return NameConstraints(std::move(permit),std::move(exclude));
+   }
+
+/*
 * Return the list of certificate policies
 */
 std::vector<std::string> X509_Certificate::policies() const
@@ -508,6 +536,33 @@ std::string X509_Certificate::to_string() const
          out << "   " << ex_constraints[i] << "\n";
       }
 
+   NameConstraints name_constraints = this->name_constraints();
+   if(!name_constraints.permitted().empty() ||
+         !name_constraints.excluded().empty())
+      {
+      out << "Name Constraints:\n";
+
+      if(!name_constraints.permitted().empty())
+         {
+         out << "   Permit";
+         for(auto st: name_constraints.permitted())
+            {
+            out << " " << st.base();
+            }
+         out << "\n";
+         }
+
+      if(!name_constraints.excluded().empty())
+         {
+         out << "   Exclude";
+         for(auto st: name_constraints.excluded())
+            {
+            out << " " << st.base();
+            }
+         out << "\n";
+         }
+      }
+
    if(!ocsp_responder().empty())
       out << "OCSP responder " << ocsp_responder() << "\n";
    if(!crl_distribution_point().empty())
diff --git a/src/lib/cert/x509/x509cert.h b/src/lib/cert/x509/x509cert.h
index d5784f427..aa910f665 100644
--- a/src/lib/cert/x509/x509cert.h
+++ b/src/lib/cert/x509/x509cert.h
@@ -14,6 +14,7 @@
 #include <botan/asn1_alt_name.h>
 #include <botan/datastor.h>
 #include <botan/key_constraint.h>
+#include <botan/name_constraint.h>
 #include <map>
 
 namespace Botan {
@@ -64,9 +65,9 @@ class BOTAN_DLL X509_Certificate final : public X509_Object
       * "X509.Certificate.start", "X509.Certificate.end",
       * "X509.Certificate.v2.key_id", "X509.Certificate.public_key",
       * "X509v3.BasicConstraints.path_constraint",
-      * "X509v3.BasicConstraints.is_ca", "X509v3.ExtendedKeyUsage",
-      * "X509v3.CertificatePolicies", "X509v3.SubjectKeyIdentifier" or
-      * "X509.Certificate.serial".
+      * "X509v3.BasicConstraints.is_ca", "X509v3.NameConstraints",
+      * "X509v3.ExtendedKeyUsage", "X509v3.CertificatePolicies",
+      * "X509v3.SubjectKeyIdentifier" or "X509.Certificate.serial".
       * @return value(s) of the specified parameter
       */
       std::vector<std::string> subject_info(const std::string& name) const;
@@ -156,6 +157,12 @@ class BOTAN_DLL X509_Certificate final : public X509_Object
       u32bit path_limit() const;
 
       /**
+      * Check whenever a given X509 Extension is marked critical in this
+      * certificate.
+      */
+      bool is_critical(const std::string& ex_name) const;
+
+      /**
       * Get the key constraints as defined in the KeyUsage extension of this
       * certificate.
       * @return key constraints
@@ -164,13 +171,19 @@ class BOTAN_DLL X509_Certificate final : public X509_Object
 
       /**
       * Get the key constraints as defined in the ExtendedKeyUsage
-      * extension of this
-      * certificate.
+      * extension of this certificate.
       * @return key constraints
       */
       std::vector<std::string> ex_constraints() const;
 
       /**
+      * Get the name constraints as defined in the NameConstraints
+      * extension of this certificate.
+      * @return name constraints
+      */
+      NameConstraints name_constraints() const;
+
+      /**
       * Get the policies as defined in the CertificatePolicies extension
       * of this certificate.
       * @return certificate policies
diff --git a/src/lib/cert/x509/x509path.cpp b/src/lib/cert/x509/x509path.cpp
index 71c025280..df286cfd7 100644
--- a/src/lib/cert/x509/x509path.cpp
+++ b/src/lib/cert/x509/x509path.cpp
@@ -16,8 +16,6 @@
 #include <vector>
 #include <set>
 
-#include <iostream>
-
 namespace Botan {
 
 namespace {
@@ -143,6 +141,62 @@ check_chain(const std::vector<X509_Certificate>& cert_path,
          if(!trusted_hashes.count(subject.hash_used_for_signature()))
             status.insert(Certificate_Status_Code::UNTRUSTED_HASH);
          }
+
+      const NameConstraints& name_constr = issuer.name_constraints();
+
+      if(!name_constr.permitted().empty() || !name_constr.excluded().empty())
+         {
+         if(!issuer.is_CA_cert() || !issuer.is_critical("X509v3.NameConstraints"))
+            cert_status.at(i).insert(Certificate_Status_Code::NAME_CONSTRAINT_ERROR);
+
+         // Check that all subordinate certs pass the name constraint
+         for(int j = i; j >= 0; j--)
+            {
+            if(i == j && at_self_signed_root)
+               continue;
+
+            bool permitted = name_constr.permitted().empty();
+            bool failed = false;
+
+            for(auto c: name_constr.permitted())
+               {
+               switch(c.base().matches(cert_path.at(j)))
+                  {
+                  case GeneralName::MatchResult::NotFound:
+                  case GeneralName::MatchResult::All:
+                     permitted = true;
+                     break;
+                  case GeneralName::MatchResult::UnknownType:
+                     failed = issuer.is_critical("X509v3.NameConstraints");
+                     permitted = true;
+                     break;
+                  default:
+                     break;
+                  }
+               }
+
+            for(auto c: name_constr.excluded())
+               {
+               switch(c.base().matches(cert_path.at(j)))
+                  {
+                  case GeneralName::MatchResult::All:
+                  case GeneralName::MatchResult::Some:
+                     failed = true;
+                     break;
+                  case GeneralName::MatchResult::UnknownType:
+                     failed = issuer.is_critical("X509v3.NameConstraints");
+                     break;
+                  default:
+                     break;
+                  }
+               }
+
+            if(failed || !permitted)
+               {
+               cert_status.at(j).insert(Certificate_Status_Code::NAME_CONSTRAINT_ERROR);
+               }
+            }
+         }
       }
 
    for(size_t i = 0; i != cert_path.size() - 1; ++i)
@@ -416,6 +470,8 @@ const char* Path_Validation_Result::status_string(Certificate_Status_Code code)
          return "OCSP bad status";
       case Certificate_Status_Code::CERT_NAME_NOMATCH:
          return "Certificate does not match provided name";
+      case Certificate_Status_Code::NAME_CONSTRAINT_ERROR:
+         return "Certificate does not pass name constraint";
 
       case Certificate_Status_Code::CERT_IS_REVOKED:
          return "Certificate is revoked";
diff --git a/src/tests/data/name_constraint/Invalid_DN_Name_Constraint.crt b/src/tests/data/name_constraint/Invalid_DN_Name_Constraint.crt
new file mode 100644
index 000000000..7c8c0aabc
--- /dev/null
+++ b/src/tests/data/name_constraint/Invalid_DN_Name_Constraint.crt
@@ -0,0 +1,18 @@
+-----BEGIN CERTIFICATE-----
+MIIC7DCCAdSgAwIBAgIBAzANBgkqhkiG9w0BAQUFADAiMSAwHgYDVQQDExdSb290
+IEROIE5hbWUgQ29uc3RyYWludDAeFw0xNjAzMDMxNjI1MDBaFw0xNzAzMDMxNjI1
+MDBaMFExCzAJBgNVBAYTAkRFMQwwCgYDVQQIEwNOUlcxDzANBgNVBAcTBkJvY2h1
+bTEjMCEGA1UEAxMaSW52YWxpZCBETiBOYW1lIENvbnN0cmFpbnQwggEiMA0GCSqG
+SIb3DQEBAQUAA4IBDwAwggEKAoIBAQCsHLRRWXgXFv0rpmrqjELvS8jrCjObZkML
+uWHpgJIev59IEXcf/WXQyMNSzSudFB2JKNatyEUxKshD5eGSHYTb5qNPfEBYEMC3
+GCp+yXA3xKd1K7hnKOpdApTKN305K1ubZqkrY9SH2EdtMMfTqPIqTmG8VWtCtlOp
+svK6v8uwI17QdlC0pi39bkR/z2EZfZPkEHgB0rqK37FaWBgLoTsTEb0PL1aZkEYO
+Q8Wyvz7VieakIhDk/QMX22AEp8ig1LI99FvS8o4VOAYgjjCzIKWEos+p/hCYKrCe
+EpZ5GMI0O/13PCDaXRNywo20fhrV3Byzg57WSfsewnd/SztiY5t1AgMBAAEwDQYJ
+KoZIhvcNAQEFBQADggEBABZCqDTZdTy8KgOvpZCUaST52iAHIGFkqhi3XYF1gaj2
+ADgMzonuttj+DAiYzS2wMts+TdrHFVuytmMsbIoWNXtRq/CAoQIg/tmpeb7AB5iS
+LGc5nxf+9nnCW276XmmA2cA8GCfbL0WDPZrfHRsw8jEAtyOP4bQEO3iqNcnQBK63
+nP0fdCfqM9ImN0eVhxA04IkP8d6utC1CoIlDyqqike7+2o+PXCrWlmb/WeZD+Hym
+4eJe8y5Q5YJ6G5F03Z1zuU5SVLKYJImdx1qiTXqUX2qBh4NKmVFgAImJOrbtj1qk
+//pH1Fb3w5xK9akaGcXYTTDUDZu1HM06LbAd0pwlRBI=
+-----END CERTIFICATE-----
diff --git a/src/tests/data/name_constraint/Invalid_Email_Name_Constraint.crt b/src/tests/data/name_constraint/Invalid_Email_Name_Constraint.crt
new file mode 100644
index 000000000..c7083a3dd
--- /dev/null
+++ b/src/tests/data/name_constraint/Invalid_Email_Name_Constraint.crt
@@ -0,0 +1,18 @@
+-----BEGIN CERTIFICATE-----
+MIIC5zCCAc+gAwIBAgIBAjANBgkqhkiG9w0BAQUFADAlMSMwIQYDVQQDExpSb290
+IEVtYWlsIE5hbWUgQ29uc3RyYWludDAeFw0xNjAzMDMxNjIxMDBaFw0xNzAzMDMx
+NjIxMDBaMCgxJjAkBgNVBAMTHUludmFsaWQgRW1haWwgTmFtZSBDb25zdHJhaW50
+MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEApLQNwVt6i6aYP67ZyaAH
+u/uqKg7P6K9xocb/aSlnfj3A4ee5nmxi3xoCghuXKV4lSXIE68Rppak81dCG9Bou
+x8S5K2DZ20AX11Pk5ulMMZGaQdOPZEBbPIxSqPdWKHwSLtkLxw7F+KN1MdB5lCf0
+YbXn4niqTF8eGrGEcfatYDFOYI5NVwlRHMqPoyv9JaJC68a/njhFV33DM/J1cTvM
+gIMbF8nnUKqfzyGwP1q5A2ep9DmH6LpOzpEzcp3d7DPCTAK7q64vSr/uOALt6Vsg
+LAHAOmberdVB/GUBCqa3F/eDo8s4lw+kdq5ow72hM1jSP7LeRb2OHcUJa3bl1cKj
+cQIDAQABox8wHTAbBgNVHREEFDASgRB0ZXN0QGV4YW1wbGUubmV0MA0GCSqGSIb3
+DQEBBQUAA4IBAQBit9P5NiMg8jjBtoXTBwUHBFA/B/KdxXx2AFsS6rx2xb5m09WG
+joFvv2le+GixwKUHAyseTtYshO+s1HiCSHcnp7j5RfcjMdraJWrACKzmEqA6J+KM
+mSa4opop91JFEY7ydnNqGf9biJ1dxiAs8XQ+ldbMuFxYc5CrNG8uoNvWGFZRegGS
+rR3pLEHeG5waGVExBMzMSIA3k4qIeh1JsiXIorQGwLfSQEPkCVIbRw9dpUOWLmDK
+SIlnL86z+OZDQDScOuLdh9j5mNWNIS9GH+VH7H+f7l8F0y96IbFumzby8DdTZiXf
+MuLW1n9aD7h787KRc6ExRx4qw4uWMl0tXSmd
+-----END CERTIFICATE-----
diff --git a/src/tests/data/name_constraint/Invalid_IP_Name_Constraint.crt b/src/tests/data/name_constraint/Invalid_IP_Name_Constraint.crt
new file mode 100644
index 000000000..fad54841e
--- /dev/null
+++ b/src/tests/data/name_constraint/Invalid_IP_Name_Constraint.crt
@@ -0,0 +1,18 @@
+-----BEGIN CERTIFICATE-----
+MIIC1TCCAb2gAwIBAgIBAzANBgkqhkiG9w0BAQUFADAiMSAwHgYDVQQDExdSb290
+IElQIE5hbWUgQ29uc3RyYWludDAeFw0xNjAzMDkxMDUzMDBaFw0xNzAzMDkxMDUz
+MDBaMCUxIzAhBgNVBAMTGkludmFsaWQgSVAgTmFtZSBDb25zdHJhaW50MIIBIjAN
+BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAqPSMstg2PL5m4NlT2sVweNGmpRl1
+2qZaV8VF01WweYdvE0DRw1aNzBzkbeIpbrVdvgxZIPeEOpusQQJPUtBuemMuKoNt
+O2zCEheILKwsESq3YhrXvpgs2679nK62Dfr4PbT1KUfsP4Kruf2cAuHsRO0hhT4i
+tZUcU6JCw5KDPihk+joALcZ4qdeKuAZHSopPlg5LFoRKb2mXDfm6j25bngMiysew
+XdCXeYCoL9+ROthrgz4H3t5mEcSAVS8dwqfjUIZznVlUwYfw5ThqIHJYWZHOOozr
+sgTicfiFKSje/XIGoHmgdrT6HI5ZOufKtXMgpco1vjdnnRuxG99ilYboPQIDAQAB
+oxMwETAPBgNVHREECDAGhwQKAAEDMA0GCSqGSIb3DQEBBQUAA4IBAQAi6yVuppWf
+kPQNWRjW45/6AB/yH9HPN46saVHHuGREaH4kxhmzrEBjS1CdbinvbtHm5SfN3qau
+eUWwabGvgvSBqxRxhV7HyagZTP1rfMDqjkQSICjOM24NJRBn+OxC87kxwtbi8z4d
+zcL4bULErtzZS70A8xuEemEt6LEBSOkrsDfN3sN2UJWQ5ifAgLELXr05FVHyt6Rf
+8xzbu5uvO8nUfRNCYEkrzSAU6oREwYpbJkimpoLiykERRNd6hJmd2xxupBKL6Cf0
+vXk/uaVeiHjchk4cFwpDPgK7PQJlWUb9HVEGjJQY/7STcVMl0Rk9NDmta6kW57q1
+Y6gSmXgGZBt1
+-----END CERTIFICATE-----
diff --git a/src/tests/data/name_constraint/Root_DNS_Name_Constraint.crt b/src/tests/data/name_constraint/Root_DNS_Name_Constraint.crt
new file mode 100644
index 000000000..dd57ded87
--- /dev/null
+++ b/src/tests/data/name_constraint/Root_DNS_Name_Constraint.crt
@@ -0,0 +1,20 @@
+-----BEGIN CERTIFICATE-----
+MIIDVDCCAjygAwIBAgIBATANBgkqhkiG9w0BAQUFADAjMSEwHwYDVQQDExhSb290
+IEROUyBOYW1lIENvbnN0cmFpbnQwHhcNMTYwMzAzMTYzMzAwWhcNMjYwMzAzMTYz
+MzAwWjAjMSEwHwYDVQQDExhSb290IEROUyBOYW1lIENvbnN0cmFpbnQwggEiMA0G
+CSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQCnc8QujqwM6w/QoC8fAEIXrWIf6+IV
+WznKMPwCqogoq1dw+9Url/4yhUqFNWZiPf7h8Cxm2oqLesq0LJ4IQcTrqwDfflZw
+dHiw9Tj6woks5YEq8k4cxDOVjJPftPOL+drVCMDQnpRctEtcNcbOmNFsCrWSGl7t
+bBvhWjARAfQvCfMTILkhJj6Bh3wHdxbxzy5m4rqQuG+gyAzEQBIPbhIYkrjhaFdx
+FUnPmk2uhYXDmpOuln2zuE1BKi/HqG1iytRgm0DfuayrqPKHustUhdcOQdJnxy/q
+3wthcsP6i8YX5eeV332BDXPVijWHJ9AHilGITYfRssUwyoI+sxEZB035AgMBAAGj
+gZIwgY8wDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUcvuTsCu3ovZJQRVo6494
+7kehuVUwCwYDVR0PBAQDAgEGMB0GA1UdHgEB/wQTMBGhDzANggtleGFtcGxlLmNv
+bTARBglghkgBhvhCAQEEBAMCAAcwHgYJYIZIAYb4QgENBBEWD3hjYSBjZXJ0aWZp
+Y2F0ZTANBgkqhkiG9w0BAQUFAAOCAQEAB7JEZgAGO3jLaXWFUdV9k1nXvngKR/yV
+AKvr1KIl8f7azR6khnnIY/UpbYQJHSNCKt3J+DEmWzrI8/ayfDW1Ty7/2u+IT0iw
+P44TOFIFSN7q4x1nLiHN1PFZvNc8ENHpqSubqF2ooGWIakSbO1LrmHqVgPMkcMJk
+5tUIcwmlCMOdFvy6ejVjw/l7aawAG+sOLTzjheYeKIngilejPthBhMxsniqVlzCY
+5dTV+jplLzOqOANSyhzhlu0cywJbhifG+Vzq59raPzzk9tXEXKsi3qO0B7J+5Y9f
+fwIHNf8ZZ/4ODDBYS7BHAemgXcXrVMtJfwHQCjracE6RYx5NpzRU1g==
+-----END CERTIFICATE-----
diff --git a/src/tests/data/name_constraint/Root_DN_Name_Constraint.crt b/src/tests/data/name_constraint/Root_DN_Name_Constraint.crt
new file mode 100644
index 000000000..7dc1c4c72
--- /dev/null
+++ b/src/tests/data/name_constraint/Root_DN_Name_Constraint.crt
@@ -0,0 +1,20 @@
+-----BEGIN CERTIFICATE-----
+MIIDVjCCAj6gAwIBAgIBATANBgkqhkiG9w0BAQUFADAiMSAwHgYDVQQDExdSb290
+IEROIE5hbWUgQ29uc3RyYWludDAeFw0xNjAzMDMxNjIzMDBaFw0yNjAzMDMxNjIz
+MDBaMCIxIDAeBgNVBAMTF1Jvb3QgRE4gTmFtZSBDb25zdHJhaW50MIIBIjANBgkq
+hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAtbIHfxTBz1AVs6kMHeeOeiNy+RC4EDuT
+ArRrD0NpATiYOM+O0MTwk+pJtlCge77dTEnXEhHfXpYV5MLDvPx4B95v49BGshLn
+2GOUcMuP4rextDb12hr/5oBKksFiWgBuuKc+XwDD8yh7i8KbOtJelWiRg7ge97sr
+Hw6eiPmKlDDmTN39aN5O68YIJfkpDIr08ncLWCC6WRpjMU/eRdYMce6LIaB+bHEx
+P5uwQD10e6XCnOVHaOc3kTmhbivIugrrE7VS4lq+t42amSDf9V4NWZ7d65dvIzGK
+DEics4ZGaizeN3BYMMNfPUfjJ0iqTbPYi+29gkE5/AQKVs1b4b4G/QIDAQABo4GW
+MIGTMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFOYXX2m7K9gJL3EE2CtZdlut
+kC6cMAsGA1UdDwQEAwIBBjAhBgNVHR4BAf8EFzAVoRMwEaQPMA0xCzAJBgNVBAYT
+AkRFMBEGCWCGSAGG+EIBAQQEAwIABzAeBglghkgBhvhCAQ0EERYPeGNhIGNlcnRp
+ZmljYXRlMA0GCSqGSIb3DQEBBQUAA4IBAQALCFfBog6/kTwd1gGBnVhxJ9eKzzVS
+NyOl0T1SVjVHRul9AK8kP/8pyw7GtZE/hdAwSjyYbO6VaOT6muVtiAy9TQrGPSpA
+LPbk9RVLEn0vqnUBUkE3kX2T9WVM4jJqh7CsvO6OPTczCf1EqiJmmNhp91jCAPgX
+C375wkZEEI5thOZnblD5zDWpM+tp3RiIiFUZiZ1IT8ALgT3elFnqNePuOYZ/daaK
++ehnF0gpr0KoLkgZ+HRoXoBIK0rz1TNCDzIfnc2Lx2G/SftBtuoVSp3TgPJO/7SP
+X9zsKBv3St40ZQ8ZUi3DqTwOCFYm6ODbESJPR3uJQhil1XVCr1GlGBYl
+-----END CERTIFICATE-----
diff --git a/src/tests/data/name_constraint/Root_Email_Name_Constraint.crt b/src/tests/data/name_constraint/Root_Email_Name_Constraint.crt
new file mode 100644
index 000000000..d1181a837
--- /dev/null
+++ b/src/tests/data/name_constraint/Root_Email_Name_Constraint.crt
@@ -0,0 +1,20 @@
+-----BEGIN CERTIFICATE-----
+MIIDUTCCAjmgAwIBAgIBATANBgkqhkiG9w0BAQUFADAlMSMwIQYDVQQDExpSb290
+IEVtYWlsIE5hbWUgQ29uc3RyYWludDAeFw0xNjAzMDMxNjIxMDBaFw0yNjAzMDMx
+NjIxMDBaMCUxIzAhBgNVBAMTGlJvb3QgRW1haWwgTmFtZSBDb25zdHJhaW50MIIB
+IjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA3fLWMKDgTjWtsla75PAa4yvB
+4LMkiaYfXdKSAE3MNgoY64o1LhajQ0/LrJ8USY/2GLv9vVIufBqFFHwHTiUYiyAM
+odLGphQ/YitGE/ZAkef0NKkzRh5InCQSopP7SntZ//QoqsaJqKgdZl6UN+5eP9SA
+o9AbTDhpZxYmEWpT8Sk+5igBvepr7mBQ7ZAnJnTeGJE/IjrjCx7C2pInV2FxJNph
+3Ou5LpqH3SBFOMnzootP6AWcPIfVgIY9CxJdITReQ7o3vFs/pn08DONV08eH4fDd
+8xJWjNk7GfhhYEKfFP1Fk5CXAwlurPoydVuyU53SA3ICTpnstbUnJGAedUhBnwID
+AQABo4GLMIGIMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFL5lAY1YFiV6918j
+DM0v+NcRNuV/MAsGA1UdDwQEAwIBBjAWBgNVHR4BAf8EDDAKoAgwBoEELmNvbTAR
+BglghkgBhvhCAQEEBAMCAAcwHgYJYIZIAYb4QgENBBEWD3hjYSBjZXJ0aWZpY2F0
+ZTANBgkqhkiG9w0BAQUFAAOCAQEA2QfSxzwYMYdSzs4Ntsda3mhroewzjf//LYbg
+DxXYw6QocnMkQnp3JIokaoTlcvh0FnqlxwVeXI7DYssNFBeEM9tkl9/KTqNWzZxq
+R3Ui5jpW3wuEnIJLN3Z3xnhH1dTXKlnuYc28aQuwmMySemJ6PD06HbntJRcu8qCY
+XbEHlwRoueGtFsRyHylOcdFrSS4XWKcSZ0O4dd2GdDYy1oSo5B/7uad/OBV7lAX9
+iww0t64k+grM/mM+OgBJTj9cQCR0CP0cAVsVdSCw0y1asvoc7ainpEuYWT7H/3/d
+uG1lewFoWdDXkSkppwLO1h2wvkffBmzPgnjfkZ/ByLGeBLk2og==
+-----END CERTIFICATE-----
diff --git a/src/tests/data/name_constraint/Root_IP_Name_Constraint.crt b/src/tests/data/name_constraint/Root_IP_Name_Constraint.crt
new file mode 100644
index 000000000..580ce508c
--- /dev/null
+++ b/src/tests/data/name_constraint/Root_IP_Name_Constraint.crt
@@ -0,0 +1,20 @@
+-----BEGIN CERTIFICATE-----
+MIIDTzCCAjegAwIBAgIBATANBgkqhkiG9w0BAQUFADAiMSAwHgYDVQQDExdSb290
+IElQIE5hbWUgQ29uc3RyYWludDAeFw0xNjAzMDkxMDQ5MDBaFw0yNjAzMDkxMDQ5
+MDBaMCIxIDAeBgNVBAMTF1Jvb3QgSVAgTmFtZSBDb25zdHJhaW50MIIBIjANBgkq
+hkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0qbHmORvktt3Z3/wu+RgO3bSqIb1tIKy
+QVOCAFz52gpFoI1PL7Sqs+O6rz9iQN57ntIpBw9WfydMk98UWFOsM5ICLci4J5jz
+gm0Go8clJRe/gL1q3ORRgM8CPAdt8eZrvZzO3SM1rhUC5QLjzzdCs+xzBmiJRzq0
+hyiQZl6FSlQEwrGuBfPKFuRA56zYyXISLftm2wHwXK+9sF/sErghaFUUDIGfalfs
+6TnsdvghrTlkcTfHg1ftsXq8YnxuCS+yWuKhbiMcoj7eNaGmc4/qY4oyxMkciprN
+Jir4eowwSklG7RR6tEz32K2yfUaOlx206KtT9r4AAwaNX7VX8RZ5qwIDAQABo4GP
+MIGMMA8GA1UdEwEB/wQFMAMBAf8wHQYDVR0OBBYEFHJ0ggZC8ZUlgwPyCQZHM7sQ
+DcE9MAsGA1UdDwQEAwIBBjAaBgNVHR4BAf8EEDAOoAwwCocIwKgAAP//AAAwEQYJ
+YIZIAYb4QgEBBAQDAgAHMB4GCWCGSAGG+EIBDQQRFg94Y2EgY2VydGlmaWNhdGUw
+DQYJKoZIhvcNAQEFBQADggEBAL2zm2nBuKk/OH32bdzAy8TILh+b2ZiiGCWy+7QQ
+CCfRyKpCb6zoMq6uTqlFmXoQ5iUFih51fleP3qeQ4H3mMqIqoThPA1suQzgha/O8
+jO6TIFYIo3+XTSfleGNpNUxfm8SqsZc0K6huerZZJW8e89dMddHxFa43T/RLKGpY
+P6VIu0JIweavOZTsUcd0JAqCSEnlyTJF3o5hP3thfbZMUZxgXM9sV4ucVBUE/o+U
+q3JMWLkE5OxrRG37z8+5yIOZi7Y8uOKncueUvyTzyHPp9S5SUombIOg/K8NoaCEt
+HkqILLcDJAihb7/odRS35Zw8ZPDVHCL0LtS1c2zEVnXbETc=
+-----END CERTIFICATE-----
diff --git a/src/tests/data/name_constraint/Valid_DNS_Name_Constraint.crt b/src/tests/data/name_constraint/Valid_DNS_Name_Constraint.crt
new file mode 100644
index 000000000..77d30879a
--- /dev/null
+++ b/src/tests/data/name_constraint/Valid_DNS_Name_Constraint.crt
@@ -0,0 +1,18 @@
+-----BEGIN CERTIFICATE-----
+MIIC3TCCAcWgAwIBAgIBAzANBgkqhkiG9w0BAQUFADAjMSEwHwYDVQQDExhSb290
+IEROUyBOYW1lIENvbnN0cmFpbnQwHhcNMTYwMzAzMTY0MzAwWhcNMTcwMzAzMTY0
+MzAwWjAkMSIwIAYDVQQDExlWYWxpZCBETlMgTmFtZSBDb25zdHJhaW50MIIBIjAN
+BgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAxPaa6o2mZoq85YKSUYWFP9Ttl8Ux
+X+hDEKzvVS9+V0dbdAE0WHLxZnq22UAVsQ/a2RlYcXGMGOyztJ+zTKqjyeSadNat
+gIyh0BD3B2xhKxz1Zf2ZixVWZcwu5t/ZcboIF4Q8IKgiEzPUjcWRErk88ldMh7Zt
+9vIZMcGNnlzCWeuk7I91WoS9qs5mLXRecL/SrGm2gS+ByhirNNpSlPMC+4hvFShE
+/Z82BEM2gqR6YOsfGjlz65DBqAfME8Pd/IWuHA9sb1t6s0/dTCYQ5RWoCkKBHe9Q
+CWtBK7MezgYcJqFFzPlMjMS1K/z51RXBHOetxqsommSJiKg189NKX0xYhwIDAQAB
+oxswGTAXBgNVHREEEDAOggxhZXhhbXBsZS5jb20wDQYJKoZIhvcNAQEFBQADggEB
+AErxPj6k5vksK5msdV+0dCFr3j7L/qCBU5vAwuGQF+qW7P/3tG2GKbsTtDW64fDn
+coWDA3P/LU9Rat4qh36VGVOlAOfGLxfA6QbFeGpIj9oQ+LLQrcWovELGaQoXMJly
+r4VRpCzoe4B2xDp1ivJo5tprwmskRiL1kRkVauQ9tlCn1b0EyDfr2iX4CEZESlDm
+my7BVAM6zOGBMs76R8mobP8YtB7zRsC5EVuvDz0j0YDfPKTedMKtP1Po+sYfNmHy
+4EBgYjdh83zOzUXhG4qxaAn7LlnEjzrI+b22ouKXucXShNeEtQdBa6QSAWlAyqyS
+MxdsIT7d9oSqYMIBvWHx89I=
+-----END CERTIFICATE-----
diff --git a/src/tests/data/name_constraint/Valid_DN_Name_Constraint.crt b/src/tests/data/name_constraint/Valid_DN_Name_Constraint.crt
new file mode 100644
index 000000000..c3575b376
--- /dev/null
+++ b/src/tests/data/name_constraint/Valid_DN_Name_Constraint.crt
@@ -0,0 +1,18 @@
+-----BEGIN CERTIFICATE-----
+MIIC6jCCAdKgAwIBAgIBAjANBgkqhkiG9w0BAQUFADAiMSAwHgYDVQQDExdSb290
+IEROIE5hbWUgQ29uc3RyYWludDAeFw0xNjAzMDMxNjI0MDBaFw0xNzAzMDMxNjI0
+MDBaME8xCzAJBgNVBAYTAlVLMQwwCgYDVQQIEwNYWFgxDzANBgNVBAcTBkxvbmRv
+bjEhMB8GA1UEAxMYVmFsaWQgRE4gTmFtZSBDb25zdHJhaW50MIIBIjANBgkqhkiG
+9w0BAQEFAAOCAQ8AMIIBCgKCAQEApu0vAiLdowRssVHCzK31e3A3vso8wECeBY/1
+esASJqMjusWjxPq9tp002KT+1CAYD0Du6I6KPjAXUp38AXglQTcA/JjL3LTQrGXw
+DCwL1vzK6WzJew6beQnyskscbAQ+iPxzsWn7Nb9fCUQF5fSoZBVP06KEh4Q3dgxb
+feYbGQC3cZIR93YHUm2wiO27mCE9xx7xwqIGux+V/Kzt4+tsUpduJn/tPGJVUq9n
+oCmSb8rW9B0pbtwXt1QmxjShBGodXefExY8JAmkNmOLxARCgddyK0Xmoyl7Teo+L
+BBtosdV23VNe3L+oQi/OAb1pn82u1hOgbQhttUyzlungnsWjfwIDAQABMA0GCSqG
+SIb3DQEBBQUAA4IBAQBwWrY+5e+tjYokgNpWZHV3buxqOt2CAjN7FvPcd6adJeDV
+GFcBjCGX2qmh1AvqYXliBZTl9rh406Wfz7ssBAzPrxlgyAPInSCfrAbPIH+wpx2G
+DR2xNp+uybtIPXMH8LRSGuRZIkaWAvFTKtJMDq96xXUt0iPZJ7gUDS26QQnTFKqz
+/ctGxQgno7R+0/8OT/FjwRV2zesB9PI1vJA2Vo082cPyLrSnc4B1/awJy1GGnSyr
+XwCyrwYVU17fjhyjYRpIWF4W9WGRbzSOCCRZvxtxPvTpMeC83hDr0i5ZzgjNrxjg
+gwheK0rKj14494bf3S3WHQBsFKuoQ/2/kNbzr/OW
+-----END CERTIFICATE-----
diff --git a/src/tests/data/name_constraint/Valid_IP_Name_Constraint.crt b/src/tests/data/name_constraint/Valid_IP_Name_Constraint.crt
new file mode 100644
index 000000000..76a461ec4
--- /dev/null
+++ b/src/tests/data/name_constraint/Valid_IP_Name_Constraint.crt
@@ -0,0 +1,18 @@
+-----BEGIN CERTIFICATE-----
+MIIC0zCCAbugAwIBAgIBAjANBgkqhkiG9w0BAQUFADAiMSAwHgYDVQQDExdSb290
+IElQIE5hbWUgQ29uc3RyYWludDAeFw0xNjAzMDkxMDUyMDBaFw0xNzAzMDkxMDUy
+MDBaMCMxITAfBgNVBAMTGFZhbGlkIElQIE5hbWUgQ29uc3RyYWludDCCASIwDQYJ
+KoZIhvcNAQEBBQADggEPADCCAQoCggEBALYPp5KI+Bhr+jJwg33UWg1Pdr8hbBCg
+AWWyulQW++LlmjnlhGNGOTBW8L4p4rCBbBJ5EHgsLdOpm24fFw4G/yj4cakQKZyf
+1eIgvJ5nHmFSTJH2TNWZppeRCK2zbFa3ZaBuiOoyNPVsFii35NLVNiHy8xjRDerw
+SjkB9PIxwdB5/jZiAYU5FPE8Y1zsaIXOIC+RaPygdt/qwnsDrqqJLQDCuN7WLeYO
+zxZfs306z1FT7uZOfOEzfFrqS9ZiQA5ZhWc38IhmkGDdjJlZtKb6abLdDHR/QjWH
+upnm/wJ+w2AtBfhIU1aLHSduX8MVvJRRSkAl68o6HJUKRayWA+5t8ksCAwEAAaMT
+MBEwDwYDVR0RBAgwBocEwKgBATANBgkqhkiG9w0BAQUFAAOCAQEAa4ZrteRtAghe
+Lvwr1hgg+MKG3U3+1kq9VWbM6TbjcB6YuWWbWD/pPeMeq3k8+5xDw7eTWLkYyyAL
+nyFSKUHhYppabmkvtxmYpwIzqdhrm7a3Ej+3FDwAjvjgB2DoT60oQ6TB6P1do43O
+LcnAIDOmuknAml5wz8jndNHGcYPy2oJLq0lzWjVxmdhF3KbfSTa50yj9CeXkLD1C
+Dvf53AVpcsQXxI92omp+OFvx5d7uc8iIE2KD2d0gKGw0vZPQsdA0VMDwTxcSNbeZ
+KlMIV0lhRVLX41vjU9J+Ax7Izt4EymoMD8UWqI/w1Hv2RwHvy3IGNOjPsMVCs06A
+2dWXjqwbWg==
+-----END CERTIFICATE-----
diff --git a/src/tests/data/name_constraint/testcases.xdb b/src/tests/data/name_constraint/testcases.xdb
new file mode 100644
index 000000000..03604785d
--- /dev/null
+++ b/src/tests/data/name_constraint/testcases.xdb
diff --git a/src/tests/data/x509test/expected.txt b/src/tests/data/x509test/expected.txt
index 67e2937eb..23cc9daf1 100644
--- a/src/tests/data/x509test/expected.txt
+++ b/src/tests/data/x509test/expected.txt
@@ -10,6 +10,10 @@ InvalidKeyUsage.pem:Invalid usage
 InvalidName.pem:Certificate does not match provided name
 InvalidNameAltName.pem:Certificate does not match provided name
 InvalidNameAltNameWithSubj.pem:Certificate does not match provided name
+InvalidNameConstraintExclude.pem:Certificate does not pass name constraint
+InvalidNameConstraintPermit.pem:Certificate does not pass name constraint
+InvalidNameConstraintPermitRight.pem:Certificate does not pass name constraint
+InvalidNameConstraintPermitThenExclude.pem:Certificate does not pass name constraint
 InvalidNotAfter.pem:Certificate has expired
 InvalidNotAfterChained.pem:Certificate has expired
 InvalidSelfSign.pem:Cannot establish trust
@@ -28,16 +32,10 @@ MissingIntCAExtensions.pem:CA certificate not allowed to issue certs
 ValidAltName.pem:Verified
 ValidCert.pem:Verified
 ValidChained.pem:Verified
+ValidNameConstraint.pem:Verified
 ValidIntCALen.pem:Verified
 ValidWildcard.pem:Verified
 
 # Need to fix date settings in x509test and regen
 #InvalidNotBefore.pem:Certificate is not yet valid
 #InvalidNotBeforeChained.pem:Certificate is not yet valid
-
-# Missing name constraints
-InvalidNameConstraintExclude.pem:Certificate issuer not found
-InvalidNameConstraintPermit.pem:Certificate issuer not found
-InvalidNameConstraintPermitRight.pem:Certificate issuer not found
-InvalidNameConstraintPermitThenExclude.pem:Certificate issuer not found
-ValidNameConstraint.pem:Certificate issuer not found
diff --git a/src/tests/test_name_constraint.cpp b/src/tests/test_name_constraint.cpp
new file mode 100644
index 000000000..01bdfc3ef
--- /dev/null
+++ b/src/tests/test_name_constraint.cpp
@@ -0,0 +1,96 @@
+/*
+* (C) 2015,2016 Kai Michaelis
+*
+* Botan is released under the Simplified BSD License (see license.txt)
+*/
+
+#include "tests.h"
+
+#if defined(BOTAN_HAS_X509_CERTIFICATES)
+  #include <botan/x509path.h>
+  #include <botan/internal/filesystem.h>
+#endif
+
+#include <algorithm>
+#include <fstream>
+#include <iomanip>
+#include <string>
+#include <vector>
+#include <map>
+#include <cstdlib>
+
+namespace Botan_Tests {
+
+namespace {
+
+#if defined(BOTAN_HAS_X509_CERTIFICATES)
+
+class Name_Constraint_Tests : public Test
+   {
+   public:
+      std::vector<Test::Result> run() override
+         {
+         const std::vector<std::tuple<std::string,std::string,std::string,std::string>> test_cases = {
+         std::make_tuple(
+            "Root_Email_Name_Constraint.crt",
+            "Invalid_Email_Name_Constraint.crt",
+            "Invalid Email Name Constraint",
+            "Certificate does not pass name constraint"),
+         std::make_tuple(
+            "Root_DN_Name_Constraint.crt",
+            "Invalid_DN_Name_Constraint.crt",
+            "Invalid DN Name Constraint",
+            "Certificate does not pass name constraint"),
+         std::make_tuple(
+            "Root_DN_Name_Constraint.crt",
+            "Valid_DN_Name_Constraint.crt",
+            "Valid DN Name Constraint",
+            "Verified"),
+         std::make_tuple(
+            "Root_DNS_Name_Constraint.crt",
+            "Valid_DNS_Name_Constraint.crt",
+            "aexample.com",
+            "Verified"),
+         std::make_tuple(
+            "Root_IP_Name_Constraint.crt",
+            "Valid_IP_Name_Constraint.crt",
+            "Valid IP Name Constraint",
+            "Verified"),
+         std::make_tuple(
+            "Root_IP_Name_Constraint.crt",
+            "Invalid_IP_Name_Constraint.crt",
+            "Invalid IP Name Constraint",
+            "Certificate does not pass name constraint"),
+         };
+         std::vector<Test::Result> results;
+         const Botan::Path_Validation_Restrictions default_restrictions;
+
+         for(const auto& t: test_cases)
+            {
+            Botan::X509_Certificate root(Test::data_file("name_constraint/" + std::get<0>(t)));
+            Botan::X509_Certificate sub(Test::data_file("name_constraint/" + std::get<1>(t)));
+            Botan::Certificate_Store_In_Memory trusted;
+            Test::Result result("X509v3 Name Constraints: " + std::get<1>(t));
+
+            trusted.add_certificate(root);
+            Botan::Path_Validation_Result path_result = Botan::x509_path_validate(
+               sub, default_restrictions, trusted, std::get<2>(t), Botan::Usage_Type::TLS_SERVER_AUTH);
+
+            if(path_result.successful_validation() && path_result.trust_root() != root)
+               path_result = Botan::Path_Validation_Result(Botan::Certificate_Status_Code::CANNOT_ESTABLISH_TRUST);
+
+            result.test_eq("validation result", path_result.result_string(), std::get<3>(t));
+            results.push_back(result);
+            }
+
+         return results;
+         }
+   };
+
+BOTAN_REGISTER_TEST("x509_path_name_constraint", Name_Constraint_Tests);
+
+#endif
+
+}
+
+}