Struct Extensions 

pub struct Extensions<'a> { /* private fields */ }

The extensions of one certificate, in the order it holds them.

Implementations

impl<'a> Extensions<'a>

pub fn memory(&self) -> &Memory

Account retaining this collection’s storage. Deferred decoding may explicitly use a different current execution domain.

pub fn iter<'r, 'e, W: Work + 'e>( &'r self, execution: &'e W, ) -> impl Iterator<Item = Result<&'r Extension<'a>>> + 'e

where 'r: 'e,

Every extension in order, funded by this query’s current execution. The constructor allocates/clones nothing. Each metadata step is paid before advancing; a resource failure is yielded once, then traversal stops. Empty/exhausted catalogues perform no additional charged work. Recognition and payload parsing must fund their own data-dependent work.

pub fn len(&self) -> usize

How many there are.

pub fn is_empty(&self) -> bool

Whether there are none.

pub fn get<W: Work>( &self, kind: Oid<'_>, execution: &W, ) -> Result<Option<&Extension<'a>>>

One extension by identifier. There is at most one of each: a certificate carrying two copies is refused when it is read, because which of them applies would have no answer.

pub fn unhandled_critical<'r, E, W: Work>( &'r self, recognizer: &impl Recognizer<W, Error = E>, execution: &W, ) -> CallbackResult<OwnedVec<&'r Extension<'a>>, E>

The critical extensions this run did not understand: the ones nobody knows, and the ones this crate knows by identifier but whose values do not parse.

A non-empty answer is what blocks a verdict. Knowing the identifier is not understanding the extension: a critical key usage whose value never parsed was never understood, and filtering it out by identifier alone would leave a validator seeing no blocker for a demand the certificate marked as one. Extensions a recognizer claims are that scheme’s to decode and are taken at its word.

The answer is returned rather than acted on, because what to do about it belongs to the policy layer and the report has to name them. An error is a spent budget and only that: it says this run gave up before the question was answered, which must not be reported as a demand nobody understood.

pub fn criticals<'r, 'e, W: Work + 'e>( &'r self, execution: &'e W, ) -> impl Iterator<Item = Result<&'r Extension<'a>>> + 'e

where 'r: 'e,

The critical extensions, in the order the certificate wrote them and without reading any of their values.

Separate from Self::understands because working out whether one was understood decodes its value, and how much that value holds is a document’s to decide. A caller holding a budget charges for an entry and then asks: the two joined into one step would decode before the charge could refuse it, since asking for the next entry is what would do the decoding. Each metadata entry is admitted before testing its critical flag, including skipped entries and a complete miss. A resource error is yielded once, then iteration permanently ends without further charges.

Examples

use structured_asn1::memory::Memory;
use structured_pkix::{Certificate, Result};
fn has_critical(certificate: &Certificate<'_>, execution: &Memory) -> Result<bool> {
    match certificate.tbs().extensions().criticals(execution).next() {
        Some(item) => { item?; Ok(true) }
        None => Ok(false),
    }
}

pub fn understands<E, W: Work>( &self, item: &Extension<'a>, recognizer: &impl Recognizer<W, Error = E>, execution: &W, ) -> CallbackResult<bool, E>

Whether this run understood one extension: this crate decodes it, or a scheme claims it and it holds one complete value.

Knowing the identifier is not understanding the extension: a critical key usage whose value never parsed was never understood, and taking it by identifier alone would leave a validator seeing no blocker for a demand the certificate marked as one.

impl<'a> Extensions<'a>

The extensions this crate reads into structures of their own.

Each is read when it is asked for rather than when the certificate is, because an extension that cannot be read is not a certificate that cannot be read. Lookup and decoding use the caller’s current execution domain; the original parser’s cumulative local ceilings still apply.

pub fn read_element( parent: &ScopedReader<'a, '_>, element: &Element<'a>, field: &'static str, ) -> Result<Self>

Reads one original Extensions SEQUENCE with the certificate catalogue invariants: nonempty, no duplicate OIDs, primitive extnValue, and the producing encoding’s DEFAULT rules. This does not recognize/trust values.

pub fn read_implicit( parent: &ScopedReader<'a, '_>, element: &Element<'a>, number: u32, field: &'static str, ) -> Result<Self>

Reads [number] IMPLICIT Extensions without changing original bytes. The number is selected by the enclosing schema (RFC3161 §§2.4.1–2.4.2). This strict catalogue is suitable for requests, not TSTInfo inspection recovery; use read_with there before deciding duplicate/fault policy. Original source/depth and producing local/current aggregate work survive. https://www.rfc-editor.org/rfc/rfc3161#section-2.4.1

pub fn basic_constraints<W: Work>( &self, execution: &W, ) -> Result<Option<BasicConstraints>>

Whether this is a certification authority, and how deep a path below it may go.

pub fn key_usage<W: Work>(&self, execution: &W) -> Result<Option<KeyUsage<'a>>>

What the key may be used for.

pub fn extended_key_usage<W: Work>( &self, execution: &W, ) -> Result<Option<ExtendedKeyUsage<'a>>>

The further purposes the key is named for.

pub fn subject_alt_name<W: Work>( &self, execution: &W, ) -> Result<Option<OwnedVec<GeneralName<'a>>>>

The further names for the subject.

pub fn issuer_alt_name<W: Work>( &self, execution: &W, ) -> Result<Option<OwnedVec<GeneralName<'a>>>>

The further names for the issuer.

pub fn subject_key_identifier<W: Work>( &self, execution: &W, ) -> Result<Option<SubjectKeyIdentifier<'a>>>

The identifier for the key this certificate carries.

pub fn authority_key_identifier<W: Work>( &self, execution: &W, ) -> Result<Option<AuthorityKeyIdentifier<'a>>>

The identifier for the key that signed it.

pub fn name_constraints<W: Work>( &self, execution: &W, ) -> Result<Option<NameConstraints<'a>>>

The name space this authority may certify within.

pub fn certificate_policies<W: Work>( &self, execution: &W, ) -> Result<Option<CertificatePolicies<'a>>>

The policies the certificate was issued under.

pub fn policy_mappings<W: Work>( &self, execution: &W, ) -> Result<Option<PolicyMappings<'a>>>

The policies of one domain treated as equivalent to another’s.

pub fn policy_constraints<W: Work>( &self, execution: &W, ) -> Result<Option<PolicyConstraints>>

The limits on policy processing below this certificate.

pub fn inhibit_any_policy<W: Work>( &self, execution: &W, ) -> Result<Option<InhibitAnyPolicy>>

After how many certificates the identifier standing for any policy stops being accepted.

pub fn authority_info_access<W: Work>( &self, execution: &W, ) -> Result<Option<InfoAccess<'a>>>

Where the issuer’s certificate and status service are published.

pub fn subject_info_access<W: Work>( &self, execution: &W, ) -> Result<Option<InfoAccess<'a>>>

Where services belonging to the subject are published.

pub fn crl_distribution_points<W: Work>( &self, execution: &W, ) -> Result<Option<DistributionPoints<'a>>>

Where revocation lists covering this certificate are published.

pub fn freshest_crl<W: Work>( &self, execution: &W, ) -> Result<Option<DistributionPoints<'a>>>

Where the delta revocation list is published.

pub fn qc_statements<W: Work>( &self, execution: &W, ) -> Result<Option<QcStatements<'a>>>

What the issuer claims about this being a qualified certificate.

Trait Implementations

impl<'a> Debug for Extensions<'a>

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.