rustls/webpki/
anchors.rs

1use alloc::vec::Vec;
2use alloc::{fmt, format};
3
4use pki_types::{CertificateDer, TrustAnchor};
5use webpki::anchor_from_trusted_cert;
6
7use super::pki_error;
8use crate::log::{debug, trace};
9use crate::{DistinguishedName, Error};
10
11/// A container for root certificates able to provide a root-of-trust
12/// for connection authentication.
13#[allow(clippy::exhaustive_structs)]
14#[derive(Clone)]
15pub struct RootCertStore {
16    /// The list of roots.
17    pub roots: Vec<TrustAnchor<'static>>,
18}
19
20impl RootCertStore {
21    /// Make a new, empty `RootCertStore`.
22    pub fn empty() -> Self {
23        Self { roots: Vec::new() }
24    }
25
26    /// Parse the given DER-encoded certificates and add all that can be parsed
27    /// in a best-effort fashion.
28    ///
29    /// This is because large collections of root certificates often
30    /// include ancient or syntactically invalid certificates.
31    ///
32    /// Returns the number of certificates added, and the number that were ignored.
33    pub fn add_parsable_certificates<'a>(
34        &mut self,
35        der_certs: impl IntoIterator<Item = CertificateDer<'a>>,
36    ) -> (usize, usize) {
37        let mut valid_count = 0;
38        let mut invalid_count = 0;
39
40        for der_cert in der_certs {
41            #[cfg_attr(not(feature = "log"), allow(unused_variables))]
42            match anchor_from_trusted_cert(&der_cert) {
43                Ok(anchor) => {
44                    self.roots.push(anchor.to_owned());
45                    valid_count += 1;
46                }
47                Err(err) => {
48                    trace!("invalid cert der {:?}", der_cert.as_ref());
49                    debug!("certificate parsing failed: {err:?}");
50                    invalid_count += 1;
51                }
52            };
53        }
54
55        debug!(
56            "add_parsable_certificates processed {valid_count} valid and {invalid_count} invalid certs"
57        );
58
59        (valid_count, invalid_count)
60    }
61
62    /// Add a single DER-encoded certificate to the store.
63    ///
64    /// This is suitable for a small set of root certificates that are expected to parse
65    /// successfully. For large collections of roots (for example from a system store) it
66    /// is expected that some of them might not be valid according to the rules rustls
67    /// implements. As long as a relatively limited number of certificates are affected,
68    /// this should not be a cause for concern. Use [`RootCertStore::add_parsable_certificates`]
69    /// in order to add as many valid roots as possible and to understand how many certificates
70    /// have been diagnosed as malformed.
71    pub fn add(&mut self, der: CertificateDer<'_>) -> Result<(), Error> {
72        self.roots.push(
73            anchor_from_trusted_cert(&der)
74                .map_err(pki_error)?
75                .to_owned(),
76        );
77        Ok(())
78    }
79
80    /// Return the DER encoded [`DistinguishedName`] of each trust anchor subject in the root
81    /// cert store.
82    ///
83    /// Each [`DistinguishedName`] will be a DER-encoded X.500 distinguished name, per
84    /// [RFC 5280 A.1], including the outer `SEQUENCE`.
85    ///
86    /// [RFC 5280 A.1]: https://www.rfc-editor.org/rfc/rfc5280#appendix-A.1
87    pub fn subjects(&self) -> Vec<DistinguishedName> {
88        self.roots
89            .iter()
90            .map(|ta| DistinguishedName::in_sequence(ta.subject.as_ref()))
91            .collect()
92    }
93
94    /// Return true if there are no certificates.
95    pub fn is_empty(&self) -> bool {
96        self.len() == 0
97    }
98
99    /// Say how many certificates are in the container.
100    pub fn len(&self) -> usize {
101        self.roots.len()
102    }
103}
104
105impl FromIterator<TrustAnchor<'static>> for RootCertStore {
106    fn from_iter<T: IntoIterator<Item = TrustAnchor<'static>>>(iter: T) -> Self {
107        Self {
108            roots: iter.into_iter().collect(),
109        }
110    }
111}
112
113impl Extend<TrustAnchor<'static>> for RootCertStore {
114    fn extend<T: IntoIterator<Item = TrustAnchor<'static>>>(&mut self, iter: T) {
115        self.roots.extend(iter);
116    }
117}
118
119impl fmt::Debug for RootCertStore {
120    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
121        f.debug_struct("RootCertStore")
122            .field("roots", &format!("({} roots)", &self.roots.len()))
123            .finish()
124    }
125}
126
127#[test]
128fn root_cert_store_debug() {
129    use core::iter;
130
131    use pki_types::Der;
132
133    let ta = TrustAnchor {
134        subject: Der::from_slice(&[]),
135        subject_public_key_info: Der::from_slice(&[]),
136        name_constraints: None,
137    };
138    let store = RootCertStore::from_iter(iter::repeat(ta).take(138));
139
140    assert_eq!(
141        format!("{store:?}"),
142        "RootCertStore { roots: \"(138 roots)\" }"
143    );
144}
rustls/webpki/anchors.rs

rustls/webpki/
anchors.rs
