silk/certificate_identities

Profiles: aarch64-apple-darwin, aarch64-unknown-linux-gnu, aarch64-unknown-linux-gnu-no-libc, wasm32-unknown-unknown, x86_64-unknown-linux-gnu, x86_64-unknown-linux-gnu-no-libc.

Bounded decoding of certificate subjectAltName values into borrowed identity descriptors.

Details

CertificateSan.decode scans all extensions before decoding one SAN value into caller storage. CertificateSan.decodeValue accepts a complete DER GeneralNames value without a certificate owner. Both operations preserve source order and return a count. Descriptor payloads borrow the input owner.

Gotchas

Failure can leave partial descriptors in storage. Use storage only after a successful result. This module checks encoding, not DNS syntax, identity matches, or certificate trust. Other universal content and legacy string repertoires remain opaque after complete framing checks. Schema-specific defaults, SET ordering, and implicit-tag content semantics require their owning schema.

Import as CertificateSan with import silk.certificate_identities { CertificateSan }.

Public declarations: 6.

SanDecodeLimits

pub struct SanDecodeLimits

Finite resource budgets for one SAN decode operation.

Field extensions

pub extensions: usize

Maximum extension count scanned, including unrelated extensions.

Field inputBytes

pub inputBytes: usize

Maximum sum of all extension OID and value lengths, or raw GeneralNames length.

Field identities

pub identities: usize

Maximum number of GeneralName descriptors.

Field nodes

pub nodes: usize

Maximum number of traversed DER nodes.

Field depth

pub depth: usize

Maximum DER depth. The implementation also enforces a ceiling of 32.

Associated function SanDecodeLimits.standard

pub fn standard() -> SanDecodeLimits

Returns budgets of 256 extensions, 1 MiB input, 256 identities, 4096 nodes, and depth 32.

Implementation Copy for SanDecodeLimits

impl Copy for SanDecodeLimits

SanDecodeClass

pub enum SanDecodeClass

The category of a SAN adapter failure.

Malformed

Malformed = 0

The SAN DER or GeneralName schema is malformed.

ResourceLimit

ResourceLimit = 1

Input, traversal, or descriptor storage exceeds a budget.

SanDecodeReason

pub enum SanDecodeReason

The adapter-specific cause of a SAN failure.

InvalidDer

InvalidDer = 0

DER encoding or GeneralName schema is invalid.

DuplicateSan

DuplicateSan = 1

More than one subjectAltName extension is present.

EmptySan

EmptySan = 2

A present SAN contains no names.

Extensions

Extensions = 3

The extension count exceeds its budget.

InputBytes

InputBytes = 4

Input bytes exceed their budget.

Identities

Identities = 5

The descriptor count exceeds its budget.

Storage

Storage = 6

Caller storage cannot hold every descriptor.

Nodes

Nodes = 7

DER node count exceeds its budget.

Depth

Depth = 8

DER depth exceeds its budget or the hard ceiling of 32.

SanDecodeError

pub struct SanDecodeError

An owned SAN error with an offset in GeneralNames DER, or zero for extension-list failures.

Field kind

pub kind: SanDecodeClass

The category of this failure.

Field reason

pub reason: SanDecodeReason

The failed adapter rule.

Field offset

pub offset: usize

The failed DER offset; extension-list failures use zero.

SanDecodeSummary

pub struct SanDecodeSummary

The initialized descriptor prefix after successful decoding.

Field present

pub present: bool

Whether a subjectAltName extension was present.

Field count

pub count: usize

Number of initialized entries in caller storage.

Field nodes

pub nodes: usize

Number of DER nodes traversed while validating the selected GeneralNames value.

CertificateSan

pub struct CertificateSan

Operations that decode complete SAN values without allocation or identity matching.

Associated function CertificateSan.validateValue

pub fn validateValue<'life0>(value: &'life0 [u8], limits: SanDecodeLimits) -> silk/result.Result<silk/certificate_identities.SanDecodeSummary, silk/certificate_identities.SanDecodeError>

Validates one complete DER GeneralNames value without descriptor storage or allocation.

Details

This performs the same complete framing and GeneralName schema checks as decodeValue, enforces the supplied input, identity, node, and depth budgets, and returns the name count. Payload syntax such as DNS label policy and IP address width remains the consumer's job.

Associated function CertificateSan.decodeValue

pub fn decodeValue<'a, 'life1>(value: &'a [u8], storage: &'life1 mut [silk/https_identity.PresentedIdentity<'a>], limits: SanDecodeLimits) -> silk/result.Result<silk/certificate_identities.SanDecodeSummary, silk/certificate_identities.SanDecodeError>

Decodes one complete DER GeneralNames value into a caller-owned descriptor prefix.

Details

Payloads borrow value; storage remains caller-owned. Success reports the initialized prefix length. All names retain source order. Unsupported alternatives retain their complete content octets. Complete DER framing and GeneralName wrappers are checked before success. Universal checks cover BOOLEAN, INTEGER, ENUMERATED, REAL, BIT STRING, NULL, OID, relative OID, and canonical UTC/GeneralizedTime. UTF8String, NumericString, PrintableString, IA5String, VisibleString, UniversalString, and BMPString encodings are checked. ORAddress attribute semantics and otherName open-value semantics remain outside this decoder. Other universal contents and T61, Videotex, GraphicString, and GeneralString repertoires remain opaque. Schema-dependent SET ordering, default values, and implicit content rules require the owning schema.

Gotchas

An error can leave partial descriptors. Never consume them after failure. DNS syntax and IP lengths require HttpsIdentity.verify; this operation does not establish trust.

Associated function CertificateSan.decode

pub fn decode<'a, 'life1>(certificate: &'a silk/certificate.Certificate, storage: &'life1 mut [silk/https_identity.PresentedIdentity<'a>], limits: SanDecodeLimits) -> silk/result.Result<silk/certificate_identities.SanDecodeSummary, silk/certificate_identities.SanDecodeError>

Scans every certificate extension and decodes the unique subjectAltName value into caller storage.

Details

Extension count and aggregate OID/value bytes are bounded before SAN parsing. Duplicate SAN extensions fail before any descriptor is written. Absence returns present = false and zero count. The result prefix borrows certificate; retain that owner while descriptors are in use.

Gotchas

Parsing failure can leave partial storage. Consume descriptors only after success, then perform identity and trust verification separately.