silk/certificate_path

Profiles: aarch64-apple-darwin, aarch64-unknown-linux-gnu, aarch64-unknown-linux-gnu-no-libc, wasm32-unknown-unknown, x86_64-unknown-linux-gnu, x86_64-unknown-linux-gnu-no-libc.

Deterministic bounded TLS-server certificate paths to explicit trust authority.

When to use

Use CertificatePath.validate after certificate decoding and before HTTPS identity and TLS CertificateVerify checks. Supply every trust candidate explicitly as a TrustAnchor.

Details

Validation borrows all certificate input. It searches anchors first and then intermediates in caller order. All resource and work bounds are finite and inclusive. One caller-supplied Instant controls every date check.

Gotchas

A ValidatedPath does not authenticate a TLS connection. The caller must verify the service identity, CertificateVerify, and Finished before it accepts application data. Revocation, certificate transparency, network retrieval, and browser root policy are not checked.

Import as CertificatePath with import silk.certificate_path { CertificatePath }.

Public declarations: 9.

ValidationLimits

pub struct ValidationLimits

Inclusive input and work limits for one path-validation call.

Field peerCertificates

pub peerCertificates: usize

Maximum peer certificates, including the leaf.

Field certificateBytes

pub certificateBytes: usize

Maximum DER bytes in each peer certificate.

Field peerBytes

pub peerBytes: usize

Maximum aggregate peer certificate DER bytes.

Field anchors

pub anchors: usize

Maximum explicit trust-anchor candidates.

Field anchorBytes

pub anchorBytes: usize

Maximum aggregate encoded trust-anchor bytes.

Field pathCertificates

pub pathCertificates: usize

Maximum selected path certificates, excluding the anchor and including the leaf.

Field issuerCandidates

pub issuerCandidates: usize

Maximum issuer-candidate visits.

Field signatureVerifications

pub signatureVerifications: usize

Maximum primitive signature verifications.

Field completePaths

pub completePaths: usize

Maximum reached anchored candidate paths.

Field nameComparisons

pub nameComparisons: usize

Maximum DNS or IP name/subtree comparisons.

Field profile

pub profile: ProfileLimits

Bounds for each semantic certificate-profile inspection.

Associated function ValidationLimits.defaults

pub fn defaults() -> ValidationLimits

Returns the fixed default input, search, signature, path, comparison, and profile bounds.

Implementation Copy for ValidationLimits

impl Copy for ValidationLimits

ValidationClass

pub enum ValidationClass

The broad category of a path-validation failure.

InvalidInput

InvalidInput = 0

Caller input is invalid independently of trust-path selection.

Rejected

Rejected = 1

The fixed certificate policy rejects all deterministic candidate paths.

ResourceLimit

ResourceLimit = 2

An inclusive caller-supplied resource or work bound is exceeded.

ValidationReason

pub enum ValidationReason

Stable path-validation rejection reasons.

UnsupportedVersion

UnsupportedVersion = 0

The certificate version is outside the fixed role profile.

UnsupportedAlgorithm

UnsupportedAlgorithm = 1

A required signature or key algorithm is unsupported.

UnsupportedParameters

UnsupportedParameters = 2

Algorithm parameters are unsupported or inconsistent.

UnsupportedExtension

UnsupportedExtension = 3

An extension needs unsupported processing.

UnsupportedConstraint

UnsupportedConstraint = 4

A NameConstraints form is outside the DNS/IP subset.

UnsupportedPolicy

UnsupportedPolicy = 5

Certificate policy processing is required but not implemented.

InvalidKey

InvalidKey = 6

A public key is malformed or outside the admitted profile.

InvalidSignature

InvalidSignature = 7

A retained certificate signature does not verify.

InvalidSerial

InvalidSerial = 8

A path-certificate serial is invalid.

InvalidUsage

InvalidUsage = 9

KeyUsage or ExtendedKeyUsage rejects the selected role.

InvalidBasicConstraints

InvalidBasicConstraints = 10

BasicConstraints or CA-role policy rejects the certificate.

InvalidName

InvalidName = 11

A subject name or subjectAltName is invalid.

InvalidTime

InvalidTime = 12

A caller instant or certificate validity interval is invalid.

DuplicateExtension

DuplicateExtension = 13

Two extensions contain the same OID.

IssuerMismatch

IssuerMismatch = 14

Exact issuer and subject Name DER do not match.

NameConstraintViolation

NameConstraintViolation = 15

A subordinate SAN violates cumulative NameConstraints.

PathLengthExceeded

PathLengthExceeded = 16

An embedded or configured path-length restriction is exceeded.

Cycle

Cycle = 17

A linked candidate repeats certificate DER already on the current path.

NoIssuer

NoIssuer = 18

No supplied candidate has an exact linking subject Name.

NoValidPath

NoValidPath = 19

Every deterministically visited linked path is rejected.

SizeOverflow

SizeOverflow = 20

A checked length or counter sum is not representable.

ValidationLocation

pub union ValidationLocation

The input position associated with one validation failure.

Leaf

ValidationLocation.Leaf: ValidationLocation

The peer end-entity certificate.

Intermediate

ValidationLocation.Intermediate { index: usize }: ValidationLocation

One peer intermediate at its original caller index.

Field index

pub index: usize

The original caller index.

Anchor

ValidationLocation.Anchor { index: usize }: ValidationLocation

One explicit trust anchor at its original caller index.

Field index

pub index: usize

The original caller index.

Call

ValidationLocation.Call: ValidationLocation

The validation call rather than one certificate.

Implementation Copy for ValidationLocation

impl Copy for ValidationLocation

ValidationLimit

pub enum ValidationLimit

A named inclusive validation bound.

PeerCertificates

PeerCertificates = 0

Total peer certificate count, including the leaf.

CertificateBytes

CertificateBytes = 1

DER bytes in one peer certificate.

PeerBytes

PeerBytes = 2

Aggregate peer certificate DER bytes.

Anchors

Anchors = 3

Explicit trust-anchor count.

AnchorBytes

AnchorBytes = 4

Aggregate encoded trust-anchor bytes.

PathCertificates

PathCertificates = 5

Selected path certificate count, excluding the anchor.

IssuerCandidates

IssuerCandidates = 6

Issuer-candidate visits.

SignatureVerifications

SignatureVerifications = 7

Primitive signature verifications.

CompletePaths

CompletePaths = 8

Complete anchored candidate paths.

NameComparisons

NameComparisons = 9

DNS or IP name/subtree comparisons.

ProfileExtensions

ProfileExtensions = 10

Certificate-profile extension count.

ProfileExtensionBytes

ProfileExtensionBytes = 11

One certificate-profile extension value size.

ProfileSanNames

ProfileSanNames = 12

Certificate-profile subjectAltName count.

ProfileConstraintSubtrees

ProfileConstraintSubtrees = 13

Certificate-profile NameConstraints subtree count.

ProfileNodes

ProfileNodes = 14

Certificate-profile DER-node count.

ProfileDepth

ProfileDepth = 15

Certificate-profile DER nesting depth.

Arithmetic

Arithmetic = 16

Checked arithmetic representation.

ValidationError

pub struct ValidationError

Owned scalar evidence for one failed validation call.

Field kind

pub kind: ValidationClass

Broad failure category.

Field reason

pub reason: ValidationReason

Stable primary reason.

Field detailReason

pub detailReason: silk/option.Option<silk/certificate_path.ValidationReason>

First rejected-candidate detail when reason is NoValidPath.

Field location

pub location: ValidationLocation

Input position associated with the primary or retained detail.

Field extensionIndex

pub extensionIndex: silk/option.Option<usize>

Extension index when a profile failure belongs to an extension.

Field limit

pub limit: silk/option.Option<silk/certificate_path.ValidationLimit>

Named bound for a resource-limit failure.

Field offset

pub offset: usize

Byte offset in the relevant certificate or configured constraint input.

RevocationStatus

pub enum RevocationStatus

Revocation evidence attached to a validated path.

NotChecked

NotChecked = 0

No CRL, OCSP, must-staple, or other revocation check was performed.

ValidatedPath

pub struct ValidatedPath<'a>

One borrowed selected path plus owned caller-order intermediate indices.

Method ValidatedPath.leaf

pub fn leaf<'a, 'life1>(self: &'life1 ValidatedPath<'a>) -> &'a silk/certificate.Certificate

Borrows the exact caller-supplied leaf certificate.

Method ValidatedPath.anchorIndex

pub fn anchorIndex<'a, 'life1>(self: &'life1 ValidatedPath<'a>) -> usize

Returns the selected trust anchor's original caller index.

Method ValidatedPath.intermediateCount

pub fn intermediateCount<'a, 'life1>(self: &'life1 ValidatedPath<'a>) -> usize

Returns the number of selected peer intermediate certificates.

Method ValidatedPath.intermediateIndex

pub fn intermediateIndex<'a, 'life1>(self: &'life1 ValidatedPath<'a>, index: usize) -> silk/option.Option<usize>

Returns one selected intermediate's original caller index, in leaf-to-anchor order.

Method ValidatedPath.validationTime

pub fn validationTime<'a, 'life1>(self: &'life1 ValidatedPath<'a>) -> Instant

Returns the copied caller-supplied validation instant.

Method ValidatedPath.revocationStatus

pub fn revocationStatus<'a, 'life1>(self: &'life1 ValidatedPath<'a>) -> RevocationStatus

Returns NotChecked because path validation performs no revocation operation.

CertificatePath

pub struct CertificatePath

The namespace for bounded deterministic certificate-path validation.

Associated function CertificatePath.validate

pub effect<'env> fn validate<'a: 'env, 'life1: 'env, 'env>(leaf: &'a silk/certificate.Certificate, intermediates: &'a [silk/certificate.Certificate], anchors: &'a [silk/trust_anchor.TrustAnchor], at: &'life1 silk/system_clock.Instant, limits: ValidationLimits) -> silk/result.Result<silk/certificate_path.ValidatedPath<'a>, silk/certificate_path.ValidationError> ! OutOfMemoryError ? &mut Allocator

Builds and validates the first deterministic TLS-server path to explicit authority.

Details

The result borrows leaf, intermediates, and anchors for 'a. Search tries anchors in caller order before intermediates in caller order at each depth. Counters span the complete call and do not reset during backtracking.

Gotchas

Zero permits no corresponding input or operation. Work-budget exhaustion is terminal. An ordinary candidate rejection does not stop a later alternate path.