Trait x509_parser::validate::Validator

pub trait Validator<'a> {
    type Item;

    // Required method
    fn validate<L: Logger>(&self, item: &'a Self::Item, l: &mut L) -> bool;

    // Provided method
    fn chain<V2>(self, v2: V2) -> ChainValidator<'a, Self, V2, Self::Item>
       where Self: Sized,
             V2: Validator<'a, Item = Self::Item> { ... }
}

Available on crate feature validate only.

Trait for build item validators (for ex. validate X.509 structure)

See X509StructureValidator for a default implementation, validating the DER structure of a X.509 Certificate.

See implementors of the Logger trait for methods to collect or handle warnings and errors.

Examples

Collecting warnings and errors to Vec:

use x509_parser::certificate::X509Certificate;
use x509_parser::validate::*;

#[cfg(feature = "validate")]
fn validate_certificate(x509: &X509Certificate<'_>) -> Result<(), &'static str> {
    let mut logger = VecLogger::default();
    println!("  Subject: {}", x509.subject());
    // validate and print warnings and errors to stderr
    let ok = X509StructureValidator.validate(&x509, &mut logger);
    print!("Structure validation status: ");
    if ok {
        println!("Ok");
    } else {
        println!("FAIL");
    }
    for warning in logger.warnings() {
        eprintln!("  [W] {}", warning);
    }
    for error in logger.errors() {
        eprintln!("  [E] {}", error);
    }
    println!();
    if !logger.errors().is_empty() {
        return Err("validation failed");
    }
    Ok(())
}

Required Associated Types

type Item

The item to validate

Required Methods

fn validate<L: Logger>(&self, item: &'a Self::Item, l: &mut L) -> bool

Attempts to validate current item.

Returns true if item was validated.

Call l.warn() if a non-fatal error was encountered, and l.err() if the error is fatal. These functions receive a description of the error.

Provided Methods

fn chain<V2>(self, v2: V2) -> ChainValidator<'a, Self, V2, Self::Item>

where Self: Sized, V2: Validator<'a, Item = Self::Item>,

Examples found in repository

examples/print-cert.rs (line 188)

fn print_x509_info(x509: &X509Certificate) -> io::Result<()> {
    let version = x509.version();
    if version.0 < 3 {
        println!("  Version: {}", version);
    } else {
        println!("  Version: INVALID({})", version.0);
    }
    println!("  Serial: {}", x509.tbs_certificate.raw_serial_as_string());
    println!("  Subject: {}", x509.subject());
    println!("  Issuer: {}", x509.issuer());
    println!("  Validity:");
    println!("    NotBefore: {}", x509.validity().not_before);
    println!("    NotAfter:  {}", x509.validity().not_after);
    println!("    is_valid:  {}", x509.validity().is_valid());
    println!("  Subject Public Key Info:");
    print_x509_ski(x509.public_key());
    print_x509_signature_algorithm(&x509.signature_algorithm, 4);

    println!("  Signature Value:");
    for l in format_number_to_hex_with_colon(&x509.signature_value.data, 16) {
        println!("      {}", l);
    }
    println!("  Extensions:");
    for ext in x509.extensions() {
        print_x509_extension(&ext.oid, ext);
    }
    println!();
    print!("Structure validation status: ");
    #[cfg(feature = "validate")]
    {
        let mut logger = VecLogger::default();
        // structure validation status
        let ok = X509StructureValidator
            .chain(X509CertificateValidator)
            .validate(x509, &mut logger);
        if ok {
            println!("Ok");
        } else {
            println!("FAIL");
        }
        for warning in logger.warnings() {
            println!("  [W] {}", warning);
        }
        for error in logger.errors() {
            println!("  [E] {}", error);
        }
        println!();
        if VALIDATE_ERRORS_FATAL && !logger.errors().is_empty() {
            return Err(io::Error::new(io::ErrorKind::Other, "validation failed"));
        }
    }
    #[cfg(not(feature = "validate"))]
    {
        println!("Unknown (feature 'validate' not enabled)");
    }
    #[cfg(feature = "verify")]
    {
        print!("Signature verification: ");
        if x509.subject() == x509.issuer() {
            if x509.verify_signature(None).is_ok() {
                println!("OK");
                println!("  [I] certificate is self-signed");
            } else if x509.subject() == x509.issuer() {
                println!("FAIL");
                println!("  [W] certificate looks self-signed, but signature verification failed");
            }
        } else {
            // if subject is different from issuer, we cannot verify certificate without the public key of the issuer
            println!("N/A");
        }
    }
    Ok(())
}

Object Safety

This trait is not object safe.

Implementors

impl<'a> Validator<'a> for TbsCertificateStructureValidator

type Item = TbsCertificate<'a>

impl<'a> Validator<'a> for X509CertificateValidator

type Item = X509Certificate<'a>

impl<'a> Validator<'a> for X509ExtensionsValidator

type Item = &'a [X509Extension<'a>]

impl<'a> Validator<'a> for X509NameStructureValidator

type Item = X509Name<'a>

impl<'a> Validator<'a> for X509PublicKeyValidator

type Item = SubjectPublicKeyInfo<'a>

impl<'a> Validator<'a> for X509StructureValidator

type Item = X509Certificate<'a>

impl<'a, A, B, I> Validator<'a> for ChainValidator<'a, A, B, I>

where A: Validator<'a, Item = I>, B: Validator<'a, Item = I>,

type Item = I