Skip to content

Commit 32c4cdc

Browse files
djcdjc
committed
Extract write_extensions() method, reducing rightward drift
1 parent aff6f74 commit 32c4cdc

File tree

1 file changed

+124
-133
lines changed

1 file changed

+124
-133
lines changed

‎rcgen/src/certificate.rs

Lines changed: 124 additions & 133 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@ use pem::Pem;
66
use pki_types::{CertificateDer, CertificateSigningRequestDer};
77
use time::{Date, Month, OffsetDateTime, PrimitiveDateTime, Time};
88
use yasna::models::ObjectIdentifier;
9-
use yasna::{DERWriter, Tag};
9+
use yasna::{DERWriter, DERWriterSeq, Tag};
1010

1111
use crate::crl::CrlDistributionPoint;
1212
use crate::csr::CertificateSigningRequest;
@@ -667,150 +667,141 @@ impl CertificateParams {
667667
}
668668

669669
writer.next().write_tagged(Tag::context(3), |writer| {
670-
writer.write_sequence(|writer| {
671-
if self.use_authority_key_identifier_extension {
672-
write_x509_authority_key_identifier(
673-
writer.next(),
674-
match issuer.key_identifier_method {
675-
KeyIdMethod::PreSpecified(aki) => aki.clone(),
676-
#[cfg(feature = "crypto")]
677-
_ => issuer
678-
.key_identifier_method
679-
.derive(issuer.key_pair.subject_public_key_info()),
680-
},
681-
);
682-
}
683-
// Write subject_alt_names
684-
if !self.subject_alt_names.is_empty() {
685-
self.write_subject_alt_names(writer.next());
686-
}
670+
writer
671+
.write_sequence(|writer| self.write_extensions(writer, &pub_key_spki, &issuer))
672+
})?;
687673

688-
// Write standard key usage
689-
self.write_key_usage(writer.next());
674+
Ok(())
675+
})?;
690676

691-
// Write extended key usage
692-
if !self.extended_key_usages.is_empty() {
693-
write_x509_extension(writer.next(), oid::EXT_KEY_USAGE, false, |writer| {
694-
writer.write_sequence(|writer| {
695-
for usage in self.extended_key_usages.iter() {
696-
let oid = ObjectIdentifier::from_slice(usage.oid());
697-
writer.next().write_oid(&oid);
698-
}
699-
});
700-
});
677+
Ok(der.into())
678+
}
679+
680+
fn write_extensions(
681+
&self,
682+
writer: &mut DERWriterSeq,
683+
pub_key_spki: &[u8],
684+
issuer: &Issuer<'_, impl SigningKey>,
685+
) -> Result<(), Error> {
686+
if self.use_authority_key_identifier_extension {
687+
write_x509_authority_key_identifier(
688+
writer.next(),
689+
match issuer.key_identifier_method {
690+
KeyIdMethod::PreSpecified(aki) => aki.clone(),
691+
#[cfg(feature = "crypto")]
692+
_ => issuer
693+
.key_identifier_method
694+
.derive(issuer.key_pair.subject_public_key_info()),
695+
},
696+
);
697+
}
698+
699+
// Write subject_alt_names
700+
self.write_subject_alt_names(writer.next());
701+
702+
// Write standard key usage
703+
self.write_key_usage(writer.next());
704+
705+
// Write extended key usage
706+
if !self.extended_key_usages.is_empty() {
707+
write_x509_extension(writer.next(), oid::EXT_KEY_USAGE, false, |writer| {
708+
writer.write_sequence(|writer| {
709+
for usage in self.extended_key_usages.iter() {
710+
let oid = ObjectIdentifier::from_slice(usage.oid());
711+
writer.next().write_oid(&oid);
701712
}
702-
if let Some(name_constraints) = &self.name_constraints {
703-
// If both trees are empty, the extension must be omitted.
704-
if !name_constraints.is_empty() {
705-
write_x509_extension(
713+
});
714+
});
715+
}
716+
717+
if let Some(name_constraints) = &self.name_constraints {
718+
// If both trees are empty, the extension must be omitted.
719+
if !name_constraints.is_empty() {
720+
write_x509_extension(writer.next(), oid::NAME_CONSTRAINTS, true, |writer| {
721+
writer.write_sequence(|writer| {
722+
if !name_constraints.permitted_subtrees.is_empty() {
723+
write_general_subtrees(
706724
writer.next(),
707-
oid::NAME_CONSTRAINTS,
708-
true,
709-
|writer| {
710-
writer.write_sequence(|writer| {
711-
if !name_constraints.permitted_subtrees.is_empty() {
712-
write_general_subtrees(
713-
writer.next(),
714-
0,
715-
&name_constraints.permitted_subtrees,
716-
);
717-
}
718-
if !name_constraints.excluded_subtrees.is_empty() {
719-
write_general_subtrees(
720-
writer.next(),
721-
1,
722-
&name_constraints.excluded_subtrees,
723-
);
724-
}
725-
});
726-
},
725+
0,
726+
&name_constraints.permitted_subtrees,
727727
);
728728
}
729-
}
730-
if !self.crl_distribution_points.is_empty() {
731-
write_x509_extension(
732-
writer.next(),
733-
oid::CRL_DISTRIBUTION_POINTS,
734-
false,
735-
|writer| {
736-
writer.write_sequence(|writer| {
737-
for distribution_point in &self.crl_distribution_points {
738-
distribution_point.write_der(writer.next());
739-
}
740-
})
741-
},
742-
);
743-
}
744-
match self.is_ca {
745-
IsCa::Ca(ref constraint) => {
746-
// Write subject_key_identifier
747-
write_x509_extension(
748-
writer.next(),
749-
oid::SUBJECT_KEY_IDENTIFIER,
750-
false,
751-
|writer| {
752-
writer.write_bytes(
753-
&self.key_identifier_method.derive(pub_key_spki),
754-
);
755-
},
756-
);
757-
// Write basic_constraints
758-
write_x509_extension(
759-
writer.next(),
760-
oid::BASIC_CONSTRAINTS,
761-
true,
762-
|writer| {
763-
writer.write_sequence(|writer| {
764-
writer.next().write_bool(true); // cA flag
765-
if let BasicConstraints::Constrained(path_len_constraint) =
766-
constraint
767-
{
768-
writer.next().write_u8(*path_len_constraint);
769-
}
770-
});
771-
},
772-
);
773-
},
774-
IsCa::ExplicitNoCa => {
775-
// Write subject_key_identifier
776-
write_x509_extension(
777-
writer.next(),
778-
oid::SUBJECT_KEY_IDENTIFIER,
779-
false,
780-
|writer| {
781-
writer.write_bytes(
782-
&self.key_identifier_method.derive(pub_key_spki),
783-
);
784-
},
785-
);
786-
// Write basic_constraints
787-
write_x509_extension(
729+
if !name_constraints.excluded_subtrees.is_empty() {
730+
write_general_subtrees(
788731
writer.next(),
789-
oid::BASIC_CONSTRAINTS,
790-
true,
791-
|writer| {
792-
writer.write_sequence(|writer| {
793-
writer.next().write_bool(false); // cA flag
794-
});
795-
},
732+
1,
733+
&name_constraints.excluded_subtrees,
796734
);
797-
},
798-
IsCa::NoCa => {},
799-
}
735+
}
736+
});
737+
});
738+
}
739+
}
800740

801-
// Write the custom extensions
802-
for ext in &self.custom_extensions {
803-
write_x509_extension(writer.next(), &ext.oid, ext.critical, |writer| {
804-
writer.write_der(ext.content())
805-
});
806-
}
741+
if !self.crl_distribution_points.is_empty() {
742+
write_x509_extension(
743+
writer.next(),
744+
oid::CRL_DISTRIBUTION_POINTS,
745+
false,
746+
|writer| {
747+
writer.write_sequence(|writer| {
748+
for distribution_point in &self.crl_distribution_points {
749+
distribution_point.write_der(writer.next());
750+
}
751+
})
752+
},
753+
);
754+
}
755+
756+
match self.is_ca {
757+
IsCa::Ca(ref constraint) => {
758+
// Write subject_key_identifier
759+
write_x509_extension(
760+
writer.next(),
761+
oid::SUBJECT_KEY_IDENTIFIER,
762+
false,
763+
|writer| {
764+
writer.write_bytes(&self.key_identifier_method.derive(pub_key_spki));
765+
},
766+
);
767+
// Write basic_constraints
768+
write_x509_extension(writer.next(), oid::BASIC_CONSTRAINTS, true, |writer| {
769+
writer.write_sequence(|writer| {
770+
writer.next().write_bool(true); // cA flag
771+
if let BasicConstraints::Constrained(path_len_constraint) = constraint {
772+
writer.next().write_u8(*path_len_constraint);
773+
}
774+
});
807775
});
808-
});
776+
},
777+
IsCa::ExplicitNoCa => {
778+
// Write subject_key_identifier
779+
write_x509_extension(
780+
writer.next(),
781+
oid::SUBJECT_KEY_IDENTIFIER,
782+
false,
783+
|writer| {
784+
writer.write_bytes(&self.key_identifier_method.derive(pub_key_spki));
785+
},
786+
);
787+
// Write basic_constraints
788+
write_x509_extension(writer.next(), oid::BASIC_CONSTRAINTS, true, |writer| {
789+
writer.write_sequence(|writer| {
790+
writer.next().write_bool(false); // cA flag
791+
});
792+
});
793+
},
794+
IsCa::NoCa => {},
795+
}
809796

810-
Ok(())
811-
})?;
797+
// Write the custom extensions
798+
for ext in &self.custom_extensions {
799+
write_x509_extension(writer.next(), &ext.oid, ext.critical, |writer| {
800+
writer.write_der(ext.content())
801+
});
802+
}
812803

813-
Ok(der.into())
804+
Ok(())
814805
}
815806

816807
/// Insert an extended key usage (EKU) into the parameters if it does not already exist

0 commit comments

Comments
 (0)