structured-xades 0.20.2

XAdES mechanisms over caller-owned XML and explicit resource accounting
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115

//! DER syntax checks for optional certificate retrieval hints, not binding.

use super::{BasicError, Hint, HintSource, ProcessingResult};
use crate::{
    binary::BinaryXml,
    certificate,
    prepare::Prepared,
    validation::{self, ReferenceIdentifier},
    xml::Xml,
};
use structured_asn1::{
    Reader,
    memory::{OwnedVec, Work},
};

pub(super) struct EncodingChecks<N, D, G> {
    pub(super) items: OwnedVec<Hint<N, D, G>>,
    pub(super) all_conformant: bool,
}
type ResultFor<X> = ProcessingResult<
    EncodingChecks<<X as Xml>::Id, <X as Xml>::Document, <X as Xml>::Generation>,
    X,
>;

pub(super) fn check_encodings<X: BinaryXml>(
    prepared: &Prepared<X>,
    xml: &X,
    operation: &Reader<'_>,
) -> ResultFor<X> {
    let work = operation.execution();
    let signature = prepared.bound().containers().signature();
    let mut items = work.vector();
    // EN319132-1 §5.2.2 Note2 makes the digest authoritative; IssuerSerialV2
    // is only a retrieval hint. Do not import CMS ESS's identifier-binding
    // requirements just because that ASN.1 type supplies the common decoder.
    // https://www.etsi.org/deliver/etsi_en/319100_319199/31913201/01.03.01_60/en_31913201v010301p.pdf
    let mut all_conformant = true;
    for (index, reference) in prepared.certificates().entries().iter().enumerate() {
        let resource = |cause| BasicError::Resource {
            node: reference.node(),
            cause,
        };
        work.charge_work(1).map_err(resource)?;
        if reference.issuer_serial().is_none() {
            continue;
        }
        items.try_reserve(1).map_err(resource)?;
        let hint = certificate::with_issuer_serial(
            xml,
            prepared.certificates(),
            index,
            operation,
            |reading| Ok::<_, core::convert::Infallible>(reading.into_parts().1),
        )
        .map_err(BasicError::Hint)?
        .ok_or(BasicError::Foreign { signature })?;
        if !hint.value.is_empty() {
            all_conformant = false;
        }
        items
            .try_push(Hint {
                location: hint.location,
                faults: hint.value,
                source: HintSource::Protected(index),
            })
            .map_err(resource)?;
    }
    // Annex A.1.1/A.1.3 import §5.2.2's CertIDListV2 including the one
    // DER IssuerSerial rule. A retrieval hint is not authoritative binding,
    // but its optional placement does not waive its declared encoding.
    // https://www.etsi.org/deliver/etsi_en/319100_319199/31913201/01.03.01_60/en_31913201v010301p.pdf
    for (property, references) in prepared.validation_references().iter().enumerate() {
        work.charge_work(1).map_err(|cause| BasicError::Resource {
            node: references.node(),
            cause,
        })?;
        for (entry, reference) in references.entries().iter().enumerate() {
            let resource = |cause| BasicError::Resource {
                node: reference.node(),
                cause,
            };
            work.charge_work(1).map_err(resource)?;
            if !matches!(
                reference.identifier(),
                ReferenceIdentifier::Certificate { .. }
            ) {
                continue;
            }
            items.try_reserve(1).map_err(resource)?;
            let hint = validation::with_reference_issuer_serial(
                xml,
                references,
                entry,
                operation,
                |reading| Ok::<_, core::convert::Infallible>(reading.into_parts().1),
            )
            .map_err(BasicError::Hint)?
            .ok_or(BasicError::Foreign { signature })?;
            if !hint.value.is_empty() {
                all_conformant = false;
            }
            items
                .try_push(Hint {
                    location: hint.location,
                    faults: hint.value,
                    source: HintSource::ValidationReference { property, entry },
                })
                .map_err(resource)?;
        }
    }
    Ok(EncodingChecks {
        items: items.into_owned(),
        all_conformant,
    })
}