get extensions built

Author: baloo

x509-cert/src/builder.rs

@@ -7,10 +7,12 @@ use crate::{
         asn1::{BitString, BitStringRef, UIntRef},
         Decode, Encode, SliceReader,
     },
+    ext::{pkix::BasicConstraints, Extension},
     name::Name,
     spki::{AlgorithmIdentifier, SubjectPublicKeyInfo},
     time::Validity,
 };
+use const_oid::AssociatedOid;
 
 pub type Result<T> = core::result::Result<T, der::Error>;
 
@@ -34,10 +36,53 @@ impl UniqueIds {
     }
 }
 
+#[derive(Clone, Debug, PartialEq)]
+pub enum Profile<'i> {
+    Root,
+    SubCA { issuer: Name<'i> },
+    Leaf { issuer: Name<'i> },
+}
+
+impl<'i> Profile<'i> {
+    fn get_issuer<'s: 'i>(&'i self, subject: &'s Name<'_>) -> &'i Name<'_> {
+        match self {
+            Profile::Root => subject,
+            Profile::SubCA { issuer } => issuer,
+            Profile::Leaf { issuer } => issuer,
+        }
+    }
+
+    fn build_extensions(&self) -> Result<Vec<Vec<u8>>> {
+        let mut extensions = Vec::new();
+
+        match self {
+            Profile::Root => {
+                let ca_true = BasicConstraints {
+                    ca: true,
+                    path_len_constraint: None,
+                }
+                .to_vec()?;
+
+                extensions.push(
+                    Extension {
+                        extn_id: BasicConstraints::OID,
+                        critical: true,
+                        extn_value: &ca_true,
+                    }
+                    .to_vec()?,
+                );
+            }
+            _ => {}
+        };
+
+        Ok(extensions)
+    }
+}
+
 pub enum CertificateVersion {
     V1,
     V2(UniqueIds),
-    V3(UniqueIds),
+    V3 { uids: UniqueIds },
 }
 
 impl Into<Version> for CertificateVersion {
@@ -46,7 +91,7 @@ impl Into<Version> for CertificateVersion {
         match self {
             V1 => Version::V1,
             V2(_) => Version::V2,
-            V3(_) => Version::V3,
+            V3 { .. } => Version::V3,
         }
     }
 }
@@ -73,28 +118,29 @@ pub struct CertificateBuilder<SA: CertSignatureAlgorithm> {
 
 impl<SA: CertSignatureAlgorithm> CertificateBuilder<SA> {
     pub fn new(
+        profile: Profile<'_>,
         version: CertificateVersion,
         serial_number: UIntRef<'_>,
         signature_alg: SA,
         validity: Validity,
-        issuer: Name<'_>,
         subject: Name<'_>,
         subject_public_key_info: SubjectPublicKeyInfo<'_>,
     ) -> Result<Self> {
         let signature_alg = signature_alg.signature_algorithm().to_vec()?;
-        let issuer = issuer.to_vec()?;
+        let issuer = profile.get_issuer(&subject).to_vec()?;
         let subject = subject.to_vec()?;
         let serial_number = serial_number.to_vec()?;
         let subject_public_key_info = subject_public_key_info.to_vec()?;
 
-        let (version, (issuer_unique_id, subject_unique_id)) = match version {
-            CertificateVersion::V1 => (Version::V1, (None, None)),
-            CertificateVersion::V2(uids) => (Version::V2, uids.to_vec()?),
-            CertificateVersion::V3(uids) => (Version::V3, uids.to_vec()?),
+        let (version, (issuer_unique_id, subject_unique_id), extensions) = match version {
+            CertificateVersion::V1 => (Version::V1, (None, None), Vec::new()),
+            CertificateVersion::V2(uids) => (Version::V2, uids.to_vec()?, Vec::new()),
+            CertificateVersion::V3 { uids } => {
+                (Version::V3, uids.to_vec()?, profile.build_extensions()?)
+            }
         };
 
         let signature = Default::default();
-        let extensions = Default::default();
 
         Ok(Self {
             version,
@@ -119,7 +165,7 @@ impl<SA: CertSignatureAlgorithm> CertificateBuilder<SA> {
         let signature_alg =
             AlgorithmIdentifier::decode(&mut SliceReader::new(&self.signature_alg)?)?;
         let issuer = Name::decode(&mut SliceReader::new(&self.issuer)?)?;
-        let serial_number = UIntRef::new(&self.serial_number).unwrap();
+        let serial_number = UIntRef::decode(&mut SliceReader::new(&self.serial_number)?)?;
         let subject = Name::decode(&mut SliceReader::new(&self.subject)?)?;
         let subject_public_key_info =
             SubjectPublicKeyInfo::decode(&mut SliceReader::new(&self.subject_public_key_info)?)?;
@@ -135,6 +181,17 @@ impl<SA: CertSignatureAlgorithm> CertificateBuilder<SA> {
         let issuer_unique_id = unique_id_mapper(&self.issuer_unique_id)?;
         let subject_unique_id = unique_id_mapper(&self.subject_unique_id)?;
 
+        let extensions = if self.version == Version::V3 {
+            let mut extensions = Vec::new();
+            for extension in &self.extensions {
+                extensions.push(Extension::decode(&mut SliceReader::new(&extension)?)?);
+            }
+
+            Some(extensions)
+        } else {
+            None
+        };
+
         let tbs_certificate = TbsCertificate {
             version: self.version,
             serial_number,
@@ -145,7 +202,7 @@ impl<SA: CertSignatureAlgorithm> CertificateBuilder<SA> {
             subject_public_key_info,
             issuer_unique_id,
             subject_unique_id,
-            extensions: None,
+            extensions,
         };
 
         self.signature = signer.sign(&tbs_certificate);

x509-cert/tests/builder.rs

@@ -1,6 +1,6 @@
 #![cfg(all(feature = "builder", feature = "pem"))]
 
-use der::{asn1::UIntRef, pem::LineEnding, EncodePem};
+use der::{asn1::UIntRef, pem::LineEnding, Decode, EncodePem};
 use spki::SubjectPublicKeyInfo;
 use std::{
     fs::File,
@@ -10,7 +10,7 @@ use std::{
 };
 use tempfile::tempdir;
 use x509_cert::{
-    builder::{CertificateBuilder, CertificateVersion, Signer, UniqueIds},
+    builder::{CertificateBuilder, CertificateVersion, Profile, Signer, UniqueIds},
     certificate::{Certificate, TbsCertificate},
     constants,
     name::Name,
@@ -72,6 +72,8 @@ fn check_certificate(cert: &Certificate) {
         .read_to_end(&mut output_buf)
         .expect("read zlint output");
 
+    //println!("{}", String::from_utf8(output_buf.clone()).unwrap());
+
     let output: zlint::LintResult =
         serde_json::from_slice(&output_buf).expect("parse zlint output");
 
@@ -91,16 +93,19 @@ fn basic_certificate() {
     let serial_number = 42u32.to_be_bytes();
     let serial_number = UIntRef::new(&serial_number[..]).expect("create serial");
     let validity = Validity::from_now(Duration::new(5, 0)).unwrap();
-    let issuer = Name::default();
-    let subject = Name::default();
+    let profile = Profile::Root;
+    let subject =
+        Name::encode_from_string("CN=World domination task force,O=World domination Inc,C=US")
+            .unwrap();
+    let subject = Name::from_der(&subject).unwrap();
     let pub_key = SubjectPublicKeyInfo::try_from(RSA_2048_DER_EXAMPLE).expect("get rsa pub key");
 
     let mut builder = CertificateBuilder::new(
-        CertificateVersion::V3(uids),
+        profile,
+        CertificateVersion::V3 { uids },
         serial_number,
         constants::RsaWithSha256,
         validity,
-        issuer,
         subject,
         pub_key,
     )
@@ -116,7 +121,11 @@ fn basic_certificate() {
         }
     }
 
-    check_certificate(&builder.build(MockSigner).unwrap());
+    let certificate = builder.build(MockSigner).unwrap();
+
+    println!("{}", openssl::text_output(&certificate));
+
+    check_certificate(&certificate);
 }
 
 #[test]
@@ -140,11 +149,14 @@ mod zlint {
 
     #[derive(Debug, Copy, Clone, PartialEq)]
     pub enum Status {
-        NA,
+        NotApplicable,
+        NotEffective,
         Pass,
+        Notice,
         Info,
         Warn,
         Error,
+        Fatal,
     }
 
     impl Status {
@@ -176,8 +188,11 @@ mod zlint {
                     while let Some((key, value)) = access.next_entry::<&str, &str>()? {
                         if key == "result" {
                             value_output = Some(match value {
-                                "NA" => Status::NA,
+                                "NA" => Status::NotApplicable,
+                                "NE" => Status::NotEffective,
                                 "pass" => Status::Pass,
+                                "notice" => Status::Notice,
+                                "fatal" => Status::Fatal,
                                 "error" => Status::Error,
                                 "warn" => Status::Warn,
                                 "info" => Status::Info,
@@ -208,10 +223,11 @@ mod zlint {
 
     impl LintResult {
         pub fn check_lints(&self, ignored: &[&str]) -> bool {
-            let mut failed = Vec::new();
+            let mut failed = HashMap::<String, Status>::new();
+
             for (key, value) in &self.0 {
                 if !value.is_successful() && !ignored.contains(&key.as_str()) {
-                    failed.push(String::from(key));
+                    failed.insert(String::from(key), value.clone());
                 }
             }
 
@@ -221,3 +237,46 @@ mod zlint {
         }
     }
 }
+
+mod openssl {
+    use der::{pem::LineEnding, EncodePem};
+    use std::{
+        fs::File,
+        io::{Read, Write},
+        process::{Command, Stdio},
+    };
+    use tempfile::tempdir;
+    use x509_cert::certificate::Certificate;
+
+    pub fn text_output(cert: &Certificate) -> String {
+        let tmp_dir = tempdir().expect("create tempdir");
+        let cert_path = tmp_dir.path().join("cert.pem");
+
+        let pem = cert.to_pem(LineEnding::LF).expect("generate pem");
+        let mut cert_file = File::create(&cert_path).expect("create pem file");
+        cert_file
+            .write_all(pem.as_bytes())
+            .expect("Create pem file");
+
+        let mut child = Command::new("openssl")
+            .arg("x509")
+            .arg("-in")
+            .arg(&cert_path)
+            .arg("-noout")
+            .arg("-text")
+            .stderr(Stdio::inherit())
+            .stdout(Stdio::piped())
+            .spawn()
+            .expect("zlint failed");
+        let mut stdout = child.stdout.take().unwrap();
+        let exit_status = child.wait().expect("get openssl x509 status");
+
+        assert!(exit_status.success(), "openssl failed");
+        let mut output_buf = Vec::new();
+        stdout
+            .read_to_end(&mut output_buf)
+            .expect("read openssl output");
+
+        String::from_utf8(output_buf.clone()).unwrap()
+    }
+}