isomdl 0.2.0

ISO mDL implementation in Rust
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106

use const_oid::AssociatedOid;
use der::{flagset::FlagSet, Decode};
use x509_cert::ext::{
    pkix::{KeyUsage, KeyUsages},
    Extension,
};

use super::{Error, ExtensionValidator};

/// KeyUsage validation for all certificate profiles.
pub struct KeyUsageValidator {
    expected_flagset: FlagSet<KeyUsages>,
}

impl KeyUsageValidator {
    pub fn document_signer() -> Self {
        Self {
            expected_flagset: KeyUsages::DigitalSignature.into(),
        }
    }

    pub fn mdoc_reader() -> Self {
        Self {
            expected_flagset: KeyUsages::DigitalSignature.into(),
        }
    }

    pub fn iaca() -> Self {
        Self {
            expected_flagset: KeyUsages::CRLSign | KeyUsages::KeyCertSign,
        }
    }

    fn check(&self, ku: KeyUsage) -> Option<Error> {
        if ku.0 != self.expected_flagset {
            Some(format!(
                "unexpected usage: {:?}",
                ku.0.into_iter().collect::<Vec<KeyUsages>>()
            ))
        } else {
            None
        }
    }
}

impl ExtensionValidator for KeyUsageValidator {
    fn oid(&self) -> const_oid::ObjectIdentifier {
        KeyUsage::OID
    }

    fn ext_name(&self) -> &'static str {
        "KeyUsage"
    }

    fn validate(&self, extension: &Extension) -> Vec<Error> {
        let bytes = extension.extn_value.as_bytes();
        let key_usage = KeyUsage::from_der(bytes);

        if !extension.critical {
            tracing::warn!("expected KeyUsage extension to be critical",)
        }

        match key_usage {
            Ok(ku) => {
                if let Some(e) = self.check(ku) {
                    vec![e]
                } else {
                    vec![]
                }
            }
            Err(e) => {
                vec![format!("failed to decode: {e}")]
            }
        }
    }
}

#[cfg(test)]
#[rstest::rstest]
#[case::ds_ok(KeyUsageValidator::document_signer(), KeyUsage(KeyUsages::DigitalSignature.into()), true)]
#[case::iaca_ok(KeyUsageValidator::iaca(), KeyUsage(KeyUsages::CRLSign | KeyUsages::KeyCertSign), true)]
#[case::ds_extra(KeyUsageValidator::iaca(), KeyUsage( KeyUsages::KeyCertSign | KeyUsages::DigitalSignature), false)]
#[case::iaca_extra(KeyUsageValidator::iaca(), KeyUsage(KeyUsages::CRLSign | KeyUsages::KeyCertSign | KeyUsages::DigitalSignature), false)]
#[case::ds_missing(KeyUsageValidator::iaca(), KeyUsage(FlagSet::default()), false)]
#[case::iaca_missing(KeyUsageValidator::iaca(), KeyUsage(KeyUsages::KeyCertSign.into()), false)]
fn test(#[case] kuv: KeyUsageValidator, #[case] ku: KeyUsage, #[case] valid: bool) {
    let outcome = kuv.check(ku);
    assert_eq!(outcome.is_none(), valid)
}

#[cfg(test)]
#[test]
fn test_flagsets() {
    assert!(KeyUsageValidator::document_signer()
        .expected_flagset
        .contains(KeyUsages::DigitalSignature));
    assert!(KeyUsageValidator::mdoc_reader()
        .expected_flagset
        .contains(KeyUsages::DigitalSignature));
    assert!(KeyUsageValidator::iaca()
        .expected_flagset
        .contains(KeyUsages::CRLSign));
    assert!(KeyUsageValidator::iaca()
        .expected_flagset
        .contains(KeyUsages::KeyCertSign));
}