Skip to content

Implementation of x509_cert::ext::pkix::SubjectDirectoryAttributes is wrong/inaccurate #1210

@Taowyoo

Description

@Taowyoo

At recent master branch at cadf42a

According to https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.8:

SubjectDirectoryAttributes ::= SEQUENCE SIZE (1..MAX) OF Attribute

And https://datatracker.ietf.org/doc/html/rfc5280#appendix-A.2

-- attribute data types

Attribute               ::= SEQUENCE {
      type             AttributeType,
      values    SET OF AttributeValue }
            -- at least one value is required

But in code:

/// SubjectDirectoryAttributes as defined in [RFC 5280 Section 4.2.1.8].
///
/// ```text
/// SubjectDirectoryAttributes ::= SEQUENCE SIZE (1..MAX) OF AttributeSet
/// ```
///
/// [RFC 5280 Section 4.2.1.8]: https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.8
#[derive(Clone, Debug, Default, PartialEq, Eq)]
pub struct SubjectDirectoryAttributes(pub Vec<AttributeTypeAndValue>);

It's implemented by using Vec<AttributeTypeAndValue> , where AttributeTypeAndValue is:

AttributeTypeAndValue ::= SEQUENCE {
  type     AttributeType,
  value    AttributeValue
}

Although AttributeTypeAndValue is super set of Attribute, I still suggest to fully follow RFC and make implementation more precise so it avoid user from using it in a wrong way.

According to RFC, it should be Vec<Attribute>

Metadata

Metadata

Assignees

No one assigned

    Labels

    breakingChange to be merged with next release cycle

    Type

    No type
    No fields configured for issues without a type.

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions