public int constrains(GeneralNameInterface inputName)
    throws UnsupportedOperationException {
        int constraintType;
        if (inputName == null)
            constraintType = NAME_DIFF_TYPE;
        else if (inputName.getType() != NAME_IP)
            constraintType = NAME_DIFF_TYPE;
        else if (((IPAddressName)inputName).equals(this))
            constraintType = NAME_MATCH;
        else {
            byte[] otherAddress = ((IPAddressName)inputName).getBytes();
            if (otherAddress.length == 4 && address.length == 4)
                // Two host addresses
                constraintType = NAME_SAME_TYPE;
            else if ((otherAddress.length == 8 && address.length == 8) ||
                     (otherAddress.length == 32 && address.length == 32)) {
                // Two subnet addresses
                // See if one address fully encloses the other address
                boolean otherSubsetOfThis = true;
                boolean thisSubsetOfOther = true;
                boolean thisEmpty = false;
                boolean otherEmpty = false;
                int maskOffset = address.length/2;
                for (int i=0; i < maskOffset; i++) {
                    if ((byte)(address[i] & address[i+maskOffset]) != address[i])
                        thisEmpty=true;
                    if ((byte)(otherAddress[i] & otherAddress[i+maskOffset]) != otherAddress[i])
                        otherEmpty=true;
                    if (!(((byte)(address[i+maskOffset] & otherAddress[i+maskOffset]) == address[i+maskOffset]) &&
                          ((byte)(address[i]   & address[i+maskOffset])      == (byte)(otherAddress[i] & address[i+maskOffset])))) {
                        otherSubsetOfThis = false;
                    }
                    if (!(((byte)(otherAddress[i+maskOffset] & address[i+maskOffset])      == otherAddress[i+maskOffset]) &&
                          ((byte)(otherAddress[i]   & otherAddress[i+maskOffset]) == (byte)(address[i] & otherAddress[i+maskOffset])))) {
                        thisSubsetOfOther = false;
                    }
                }
                if (thisEmpty || otherEmpty) {
                    if (thisEmpty && otherEmpty)
                        constraintType = NAME_MATCH;
                    else if (thisEmpty)
                        constraintType = NAME_WIDENS;
                    else
                        constraintType = NAME_NARROWS;
                } else if (otherSubsetOfThis)
                    constraintType = NAME_NARROWS;
                else if (thisSubsetOfOther)
                    constraintType = NAME_WIDENS;
                else
                    constraintType = NAME_SAME_TYPE;
            } else if (otherAddress.length == 8 || otherAddress.length == 32) {
                //Other is a subnet, this is a host address
                int i = 0;
                int maskOffset = otherAddress.length/2;
                for (; i < maskOffset; i++) {
                    // Mask this address by other address mask and compare to other address
                    // If all match, then this address is in other address subnet
                    if ((address[i] & otherAddress[i+maskOffset]) != otherAddress[i])
                        break;
                }
                if (i == maskOffset)
                    constraintType = NAME_WIDENS;
                else
                    constraintType = NAME_SAME_TYPE;
            } else if (address.length == 8 || address.length == 32) {
                //This is a subnet, other is a host address
                int i = 0;
                int maskOffset = address.length/2;
                for (; i < maskOffset; i++) {
                    // Mask other address by this address mask and compare to this address
                    if ((otherAddress[i] & address[i+maskOffset]) != address[i])
                        break;
                }
                if (i == maskOffset)
                    constraintType = NAME_NARROWS;
                else
                    constraintType = NAME_SAME_TYPE;
            } else {
                constraintType = NAME_SAME_TYPE;
            }
        }
        return constraintType;
    }
public int constrains ( GeneralNameInterface inputName ) throws UnsupportedOperationException { int constraintType ; if ( inputName == null ) constraintType = NAME_DIFF_TYPE ; else if ( inputName . getType ( ) != NAME_IP ) constraintType = NAME_DIFF_TYPE ; else if ( ( ( IPAddressName ) inputName ) . equals ( this ) ) constraintType = NAME_MATCH ; else { byte [ ] otherAddress = ( ( IPAddressName ) inputName ) . getBytes ( ) ; if ( otherAddress . length == 4 && address . length == 4 ) constraintType = NAME_SAME_TYPE ; else if ( ( otherAddress . length == 8 && address . length == 8 ) || ( otherAddress . length == 32 && address . length == 32 ) ) { boolean otherSubsetOfThis = true ; boolean thisSubsetOfOther = true ; boolean thisEmpty = false ; boolean otherEmpty = false ; int maskOffset = address . length / 2 ; for ( int i = 0 ; i < maskOffset ; i ++ ) { if ( ( byte ) ( address [ i ] & address [ i + maskOffset ] ) != address [ i ] ) thisEmpty = true ; if ( ( byte ) ( otherAddress [ i ] & otherAddress [ i + maskOffset ] ) != otherAddress [ i ] ) otherEmpty = true ; if ( ! ( ( ( byte ) ( address [ i + maskOffset ] & otherAddress [ i + maskOffset ] ) == address [ i + maskOffset ] ) && ( ( byte ) ( address [ i ] & address [ i + maskOffset ] ) == ( byte ) ( otherAddress [ i ] & address [ i + maskOffset ] ) ) ) ) { otherSubsetOfThis = false ; } if ( ! ( ( ( byte ) ( otherAddress [ i + maskOffset ] & address [ i + maskOffset ] ) == otherAddress [ i + maskOffset ] ) && ( ( byte ) ( otherAddress [ i ] & otherAddress [ i + maskOffset ] ) == ( byte ) ( address [ i ] & otherAddress [ i + maskOffset ] ) ) ) ) { thisSubsetOfOther = false ; } } if ( thisEmpty || otherEmpty ) { if ( thisEmpty && otherEmpty ) constraintType = NAME_MATCH ; else if ( thisEmpty ) constraintType = NAME_WIDENS ; else constraintType = NAME_NARROWS ; } else if ( otherSubsetOfThis ) constraintType = NAME_NARROWS ; else if ( thisSubsetOfOther ) constraintType = NAME_WIDENS ; else constraintType = NAME_SAME_TYPE ; } else if ( otherAddress . length == 8 || otherAddress . length == 32 ) { int i = 0 ; int maskOffset = otherAddress . length / 2 ; for ( ; i < maskOffset ; i ++ ) { if ( ( address [ i ] & otherAddress [ i + maskOffset ] ) != otherAddress [ i ] ) break ; } if ( i == maskOffset ) constraintType = NAME_WIDENS ; else constraintType = NAME_SAME_TYPE ; } else if ( address . length == 8 || address . length == 32 ) { int i = 0 ; int maskOffset = address . length / 2 ; for ( ; i < maskOffset ; i ++ ) { if ( ( otherAddress [ i ] & address [ i + maskOffset ] ) != address [ i ] ) break ; } if ( i == maskOffset ) constraintType = NAME_NARROWS ; else constraintType = NAME_SAME_TYPE ; } else { constraintType = NAME_SAME_TYPE ; } } return constraintType ; }
Return type of constraint inputName places on this name:<ul>
<li>NAME_DIFF_TYPE = -1: input name is different type from name
(i.e. does not constrain).
<li>NAME_MATCH = 0: input name matches name.
<li>NAME_NARROWS = 1: input name narrows name (is lower in the naming
subtree)
<li>NAME_WIDENS = 2: input name widens name (is higher in the naming
subtree)
<li>NAME_SAME_TYPE = 3: input name does not match or narrow name, but
is same type.
</ul>.  These results are used in checking NameConstraints during
certification path verification.
<p>
[RFC2459] The syntax of iPAddress MUST be as described in section
4.2.1.7 with the following additions specifically for Name Constraints.
For IPv4 addresses, the ipAddress field of generalName MUST contain
eight (8) octets, encoded in the style of RFC 1519 (CIDR) to represent an
address range.[RFC 1519]  For IPv6 addresses, the ipAddress field
MUST contain 32 octets similarly encoded.  For example, a name
constraint for "class C" subnet 10.9.8.0 shall be represented as the
octets 0A 09 08 00 FF FF FF 00, representing the CIDR notation
10.9.8.0/255.255.255.0.
<p>
@param inputName to be checked for being constrained
@returns constraint type above
@throws UnsupportedOperationException if name is not exact match, but
narrowing and widening are not supported for this name type.