x509_cert/ext/pkix/constraints/
basic.rs

1use const_oid::{db::rfc5280::ID_CE_BASIC_CONSTRAINTS, AssociatedOid, ObjectIdentifier};
2use der::Sequence;
3
4/// BasicConstraints as defined in [RFC 5280 Section 4.2.1.9].
5///
6/// ```text
7/// BasicConstraints ::= SEQUENCE {
8///     cA                      BOOLEAN DEFAULT FALSE,
9///     pathLenConstraint       INTEGER (0..MAX) OPTIONAL
10/// }
11/// ```
12///
13/// [RFC 5280 Section 4.2.1.9]: https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.9
14#[derive(Clone, Debug, Eq, PartialEq, Sequence)]
15#[allow(missing_docs)]
16pub struct BasicConstraints {
17    #[asn1(default = "Default::default")]
18    pub ca: bool,
19    pub path_len_constraint: Option<u8>,
20}
21
22impl AssociatedOid for BasicConstraints {
23    const OID: ObjectIdentifier = ID_CE_BASIC_CONSTRAINTS;
24}
25
26impl crate::ext::AsExtension for BasicConstraints {
27    fn critical(
28        &self,
29        _subject: &crate::name::Name,
30        _extensions: &[crate::ext::Extension],
31    ) -> bool {
32        // https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.9
33        //   Conforming CAs MUST include this extension in all CA certificates
34        //   that contain public keys used to validate digital signatures on
35        //   certificates and MUST mark the extension as critical in such
36        //   certificates.  This extension MAY appear as a critical or non-
37        //   critical extension in CA certificates that contain public keys used
38        //   exclusively for purposes other than validating digital signatures on
39        //   certificates.  Such CA certificates include ones that contain public
40        //   keys used exclusively for validating digital signatures on CRLs and
41        //   ones that contain key management public keys used with certificate
42        //   enrollment protocols.  This extension MAY appear as a critical or
43        //   non-critical extension in end entity certificates.
44
45        // NOTE(baloo): from the spec, it doesn't appear to hurt if we force the extension
46        // to be critical.
47        true
48    }
49}