crl: retain issuing distribution point extension

.github/workflows/testgen.yml

@@ -72,5 +72,9 @@ jobs:
         working-directory: ./tests/crl_distrib_point/
         run: python3 make_testcerts.py
 
+      - name: Generate CRL test files
+        working-directory: ./tests/crls/
+        run: python3 make_testcrls.py
+
       - name: Enforce no diff
         run: git diff --exit-code

src/cert.rs

@@ -15,8 +15,7 @@
 use crate::der::Tag;
 use crate::der::{self, CONSTRUCTED, CONTEXT_SPECIFIC};
 use crate::signed_data::SignedData;
-use crate::subject_name::GeneralName;
-use crate::x509::{remember_extension, set_extension_once, Extension};
+use crate::x509::{remember_extension, set_extension_once, DistributionPointName, Extension};
 use crate::Error;
 
 /// An enumeration indicating whether a [`Cert`] is a leaf end-entity cert, or a linked
@@ -322,59 +321,15 @@ impl<'a> CrlDistributionPoint<'a> {
     }
 }
 
-/// A certificate revocation list (CRL) distribution point name, describing a source of
-/// CRL information for a given certificate as described in RFC 5280 section 4.2.3.13[^1].
-///
-/// [^1]: <https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.13>
-#[allow(dead_code)] // TODO(@cpu): remove this once used in CRL validation.
-pub(crate) enum DistributionPointName<'a> {
-    /// The distribution point name is a relative distinguished name, relative to the CRL issuer.
-    NameRelativeToCrlIssuer(untrusted::Input<'a>),
-    /// The distribution point name is a sequence of [GeneralNames].
-    FullName(GeneralNames<'a>),
-}
-
-impl<'a> DistributionPointName<'a> {
-    fn from_der(der: untrusted::Input<'_>) -> Result<DistributionPointName, Error> {
-        const FULL_NAME_TAG: u8 = CONTEXT_SPECIFIC | CONSTRUCTED;
-        const NAME_RELATIVE_TO_CRL_ISSUER_TAG: u8 = CONTEXT_SPECIFIC | CONSTRUCTED | 1;
-
-        let (tag, value) = der::read_tag_and_get_value(&mut untrusted::Reader::new(der))?;
-        match tag {
-            FULL_NAME_TAG => Ok(DistributionPointName::FullName(GeneralNames {
-                reader: untrusted::Reader::new(value),
-            })),
-            NAME_RELATIVE_TO_CRL_ISSUER_TAG => {
-                Ok(DistributionPointName::NameRelativeToCrlIssuer(value))
-            }
-            _ => Err(Error::BadDer),
-        }
-    }
-}
-
-/// An iterator over a series of X.509 [GeneralName] instances describing locations that can be used
-/// to fetch a certificate revocation list for a certificate.
-pub(crate) struct GeneralNames<'a> {
-    reader: untrusted::Reader<'a>,
-}
-
-impl<'a> Iterator for GeneralNames<'a> {
-    type Item = Result<GeneralName<'a>, Error>;
-
-    fn next(&mut self) -> Option<Self::Item> {
-        (!self.reader.at_end()).then(|| GeneralName::from_der(&mut self.reader))
-    }
-}
-
 #[cfg(test)]
 mod tests {
     use crate::cert::{Cert, EndEntityOrCa};
     #[cfg(feature = "alloc")]
     use crate::{
-        cert::{CrlDistributionPoint, DistributionPointName, GeneralNames},
-        crl,
+        cert::{CrlDistributionPoint, DistributionPointName},
         subject_name::GeneralName,
-        Error,
+        x509::GeneralNames,
+        Error, RevocationReason,
     };
 
     #[test]
@@ -488,24 +443,20 @@ mod tests {
             .expect("missing distribution point");
 
         // The distribution point should include the expected revocation reasons, and no others.
-        match &crl_distribution_point.reasons {
-            None => panic!("missing revocation reasons"),
-            Some(reasons) => {
-                let expected = &[
-                    crl::RevocationReason::KeyCompromise,
-                    crl::RevocationReason::AffiliationChanged,
-                ];
-                for reason in 0..=10 {
-                    if reason == 7 {
-                        continue; // revocation code 7 is unused
-                    }
-                    let revocation_reason = crl::RevocationReason::try_from(reason).unwrap();
-                    #[allow(clippy::as_conversions)] // Safe in this range.
-                    match expected.contains(&revocation_reason) {
-                        true => assert!(reasons.bit_set(reason as usize)),
-                        false => assert!(!reasons.bit_set(reason as usize)),
-                    }
-                }
+        let reasons = crl_distribution_point
+            .reasons
+            .as_ref()
+            .expect("missing revocation reasons");
+        let expected = &[
+            RevocationReason::KeyCompromise,
+            RevocationReason::AffiliationChanged,
+        ];
+        for reason in RevocationReason::iter() {
+            #[allow(clippy::as_conversions)]
+            // revocation reason is u8, infallible to convert to usize.
+            match expected.contains(&reason) {
+                true => assert!(reasons.bit_set(reason as usize)),
+                false => assert!(!reasons.bit_set(reason as usize)),
             }
         }
     }