Trait x509_parser::validate::Validator

source · 
pub trait Validator<'a> {
    type Item;

    // Required method
    fn validate<L: Logger>(&self, item: &'a Self::Item, l: &mut L) -> bool;

    // Provided method
    fn chain<V2>(self, v2: V2) -> ChainValidator<'a, Self, V2, Self::Item>
       where Self: Sized,
             V2: Validator<'a, Item = Self::Item> { ... }
}
Available on crate feature validate only.
Expand description

Trait for build item validators (for ex. validate X.509 structure)

See X509StructureValidator for a default implementation, validating the DER structure of a X.509 Certificate.

See implementors of the Logger trait for methods to collect or handle warnings and errors.

Examples

Collecting warnings and errors to Vec:

use x509_parser::certificate::X509Certificate;
use x509_parser::validate::*;

#[cfg(feature = "validate")]
fn validate_certificate(x509: &X509Certificate<'_>) -> Result<(), &'static str> {
    let mut logger = VecLogger::default();
    println!("  Subject: {}", x509.subject());
    // validate and print warnings and errors to stderr
    let ok = X509StructureValidator.validate(&x509, &mut logger);
    print!("Structure validation status: ");
    if ok {
        println!("Ok");
    } else {
        println!("FAIL");
    }
    for warning in logger.warnings() {
        eprintln!("  [W] {}", warning);
    }
    for error in logger.errors() {
        eprintln!("  [E] {}", error);
    }
    println!();
    if !logger.errors().is_empty() {
        return Err("validation failed");
    }
    Ok(())
}

Required Associated Types§

source

type Item

The item to validate

Required Methods§

source

fn validate<L: Logger>(&self, item: &'a Self::Item, l: &mut L) -> bool

Attempts to validate current item.

Returns true if item was validated.

Call l.warn() if a non-fatal error was encountered, and l.err() if the error is fatal. These functions receive a description of the error.

Provided Methods§

source

fn chain<V2>(self, v2: V2) -> ChainValidator<'a, Self, V2, Self::Item>where Self: Sized, V2: Validator<'a, Item = Self::Item>,

Examples found in repository?
examples/print-cert.rs (line 188)
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227

fn print_x509_info(x509: &X509Certificate) -> io::Result<()> {
    let version = x509.version();
    if version.0 < 3 {
        println!("  Version: {}", version);
    } else {
        println!("  Version: INVALID({})", version.0);
    }
    println!("  Serial: {}", x509.tbs_certificate.raw_serial_as_string());
    println!("  Subject: {}", x509.subject());
    println!("  Issuer: {}", x509.issuer());
    println!("  Validity:");
    println!("    NotBefore: {}", x509.validity().not_before);
    println!("    NotAfter:  {}", x509.validity().not_after);
    println!("    is_valid:  {}", x509.validity().is_valid());
    println!("  Subject Public Key Info:");
    print_x509_ski(x509.public_key());
    print_x509_signature_algorithm(&x509.signature_algorithm, 4);

    println!("  Signature Value:");
    for l in format_number_to_hex_with_colon(&x509.signature_value.data, 16) {
        println!("      {}", l);
    }
    println!("  Extensions:");
    for ext in x509.extensions() {
        print_x509_extension(&ext.oid, ext);
    }
    println!();
    print!("Structure validation status: ");
    #[cfg(feature = "validate")]
    {
        let mut logger = VecLogger::default();
        // structure validation status
        let ok = X509StructureValidator
            .chain(X509CertificateValidator)
            .validate(x509, &mut logger);
        if ok {
            println!("Ok");
        } else {
            println!("FAIL");
        }
        for warning in logger.warnings() {
            println!("  [W] {}", warning);
        }
        for error in logger.errors() {
            println!("  [E] {}", error);
        }
        println!();
        if VALIDATE_ERRORS_FATAL && !logger.errors().is_empty() {
            return Err(io::Error::new(io::ErrorKind::Other, "validation failed"));
        }
    }
    #[cfg(not(feature = "validate"))]
    {
        println!("Unknown (feature 'validate' not enabled)");
    }
    #[cfg(feature = "verify")]
    {
        print!("Signature verification: ");
        if x509.subject() == x509.issuer() {
            if x509.verify_signature(None).is_ok() {
                println!("OK");
                println!("  [I] certificate is self-signed");
            } else if x509.subject() == x509.issuer() {
                println!("FAIL");
                println!("  [W] certificate looks self-signed, but signature verification failed");
            }
        } else {
            // if subject is different from issuer, we cannot verify certificate without the public key of the issuer
            println!("N/A");
        }
    }
    Ok(())
}

Implementors§