structured_pkix/ocsp/
lookup.rs

1//! Applicable assertions are selected without discarding duplicate evidence.
2
3use super::{BasicResponse, CertId, CertMatch, SignedResponse, SingleResponse};
4use crate::algorithm::digest::AsnDigest;
5use crate::error::{CallbackResult, Error};
6use crate::{Certificate, revocation::RevocationTarget};
7use structured_asn1::memory::Work;
8
9/// Identity lookup within an authenticated response, not a complete verdict.
10#[derive(Debug, Clone, Copy)]
11pub enum Lookup<'r, 'a> {
12    /// No assertion matches the target and actual issuer.
13    Missing,
14    /// One matching original assertion. Time/extensions/authorization still
15    /// have to be checked before interpreting its revocation status.
16    Found(&'r SingleResponse<'a>),
17    /// Multiple matching assertions are retained, including identical repeats.
18    /// Selection must not silently pick first or last.
19    Ambiguous {
20        /// First matching assertion in wire order.
21        first: &'r SingleResponse<'a>,
22        /// Next matching assertion in wire order.
23        second: &'r SingleResponse<'a>,
24    },
25    /// A candidate identity uses a hash capability unavailable to this caller.
26    UnsupportedHash(&'r SingleResponse<'a>),
27    /// Known fixed-output hash width contradicts the original `CertID` bytes.
28    MalformedHashWidth(&'r SingleResponse<'a>),
29    /// A candidate's hash identifier writes parameters its algorithm does not take.
30    MalformedHashAlgorithm(&'r SingleResponse<'a>),
31}
32
33impl<'r, 'a> SignedResponse<'r, 'a> {
34    /// Locate the target's assertion using actual target/issuer bytes and the
35    /// selected provider. RFC6960 §3.2(1) requires binding to the requested
36    /// certificate. The caller binds these inputs to its actual request and
37    /// checks nonce/intended recipient separately; identity alone is insufficient.
38    /// <https://www.rfc-editor.org/rfc/rfc6960#section-3.2>
39    pub fn find<'t, 'd, T: RevocationTarget<'t>, D: AsnDigest<'d> + ?Sized, E: Work>(
40        self,
41        target: &T,
42        issuer: &Certificate<'_>,
43        digest: &'d D,
44        execution: &E,
45    ) -> CallbackResult<Lookup<'r, 'a>, D::Error> {
46        locate(self.response(), execution, |id| {
47            id.matches(target, issuer, digest, execution)
48        })
49    }
50
51    /// Locate an actual sent wire `CertID` without rehashing certificates or
52    /// losing duplicates. Full digest identity/width checks use the same
53    /// source-aware comparison as the complete request batch binding.
54    pub fn find_id<'d, D: AsnDigest<'d> + ?Sized, E: Work>(
55        self,
56        requested: &CertId<'_>,
57        digest: &'d D,
58        execution: &E,
59    ) -> CallbackResult<Lookup<'r, 'a>, D::Error> {
60        locate(self.response(), execution, |id| {
61            id.matches_id(requested, digest, execution)
62        })
63    }
64}
65
66fn locate<'r, 'a, E, W: Work>(
67    original: &'r BasicResponse<'a>,
68    execution: &W,
69    mut compare: impl FnMut(CertId<'a>) -> CallbackResult<CertMatch, E>,
70) -> CallbackResult<Lookup<'r, 'a>, E> {
71    let execution = &original.signature_algorithm().query_in(execution);
72    let mut first = None;
73    for response in original.responses() {
74        execution.charge_work(1).map_err(|reason| {
75            Error::resource(reason, "ocspResponse.responses", response.span().start)
76        })?;
77        match compare(response.id())? {
78            CertMatch::Differs => {}
79            CertMatch::UnsupportedHash => return Ok(Lookup::UnsupportedHash(response)),
80            CertMatch::MalformedHashWidth => return Ok(Lookup::MalformedHashWidth(response)),
81            CertMatch::MalformedHashAlgorithm => {
82                return Ok(Lookup::MalformedHashAlgorithm(response));
83            }
84            CertMatch::Matches => match first {
85                None => first = Some(response),
86                Some(first) => {
87                    return Ok(Lookup::Ambiguous {
88                        first,
89                        second: response,
90                    });
91                }
92            },
93        }
94    }
95    Ok(match first {
96        Some(response) => Lookup::Found(response),
97        None => Lookup::Missing,
98    })
99}
structured_pkix/ocsp/lookup.rs

structured_pkix/ocsp/
lookup.rs
