优化数据对象decode + profile validate；benchmark对比routinator geomean 0.8

src/validation/ca_instance.rs

@@ -78,23 +78,23 @@ pub fn ca_instance_uris_from_ca_certificate(
 
     for ad in access_descriptions {
         if ad.access_method_oid == OID_AD_CA_REPOSITORY {
-            let u = ad.access_location.to_string();
-            if ad.access_location.scheme() != "rsync" {
-                return Err(CaInstanceUrisError::CaRepositoryNotRsync(u));
+            let u = ad.access_location.as_str();
+            if !u.starts_with("rsync://") {
+                return Err(CaInstanceUrisError::CaRepositoryNotRsync(u.to_string()));
             }
-            ca_repo.get_or_insert(u);
+            ca_repo.get_or_insert(u.to_string());
         } else if ad.access_method_oid == OID_AD_RPKI_MANIFEST {
-            let u = ad.access_location.to_string();
-            if ad.access_location.scheme() != "rsync" {
-                return Err(CaInstanceUrisError::RpkiManifestNotRsync(u));
+            let u = ad.access_location.as_str();
+            if !u.starts_with("rsync://") {
+                return Err(CaInstanceUrisError::RpkiManifestNotRsync(u.to_string()));
             }
-            manifest.get_or_insert(u);
+            manifest.get_or_insert(u.to_string());
         } else if ad.access_method_oid == OID_AD_RPKI_NOTIFY {
-            let u = ad.access_location.to_string();
-            if ad.access_location.scheme() != "https" {
-                return Err(CaInstanceUrisError::RpkiNotifyNotHttps(u));
+            let u = ad.access_location.as_str();
+            if !u.starts_with("https://") {
+                return Err(CaInstanceUrisError::RpkiNotifyNotHttps(u.to_string()));
             }
-            notify.get_or_insert(u);
+            notify.get_or_insert(u.to_string());
         }
     }
 

src/validation/ca_path.rs

@@ -1,6 +1,6 @@
 use crate::data_model::common::BigUnsigned;
 use crate::data_model::crl::{CrlDecodeError, CrlVerifyError, RpkixCrl};
-use crate::data_model::oid::OID_KEY_USAGE;
+use crate::data_model::oid::OID_KEY_USAGE_RAW;
 use crate::data_model::rc::{
     AsIdentifierChoice, AsResourceSet, IpAddressChoice, IpResourceSet, ResourceCertKind,
     ResourceCertificate, ResourceCertificateDecodeError,
@@ -135,10 +135,10 @@ pub fn validate_subordinate_ca_cert(
         return Err(CaPathError::IssuerNotCa);
     }
 
-    if child_ca.tbs.issuer_dn != issuer_ca.tbs.subject_dn {
+    if child_ca.tbs.issuer_name != issuer_ca.tbs.subject_name {
         return Err(CaPathError::IssuerSubjectMismatch {
-            child_issuer_dn: child_ca.tbs.issuer_dn.clone(),
-            issuer_subject_dn: issuer_ca.tbs.subject_dn.clone(),
+            child_issuer_dn: child_ca.tbs.issuer_name.to_string(),
+            issuer_subject_dn: issuer_ca.tbs.subject_name.to_string(),
         });
     }
 
@@ -247,7 +247,7 @@ fn validate_child_ca_key_usage(child_ca_der: &[u8]) -> Result<(), CaPathError> {
 
     let mut ku_critical: Option<bool> = None;
     for ext in cert.extensions() {
-        if ext.oid.to_id_string() == OID_KEY_USAGE {
+        if ext.oid.as_bytes() == OID_KEY_USAGE_RAW {
             ku_critical = Some(ext.critical);
             break;
         }
@@ -695,9 +695,8 @@ mod tests {
     use crate::data_model::rc::{
         RcExtensions, ResourceCertKind, ResourceCertificate, RpkixTbsCertificate,
     };
+    use crate::data_model::common::X509NameDer;
     use der_parser::num_bigint::BigUint;
-    use url::Url;
-
     fn dummy_cert(
         kind: ResourceCertKind,
         subject_dn: &str,
@@ -707,16 +706,8 @@ mod tests {
         aia: Option<Vec<&str>>,
         crldp: Option<Vec<&str>>,
     ) -> ResourceCertificate {
-        let aia = aia.map(|v| {
-            v.into_iter()
-                .map(|s| Url::parse(s).expect("url"))
-                .collect::<Vec<_>>()
-        });
-        let crldp = crldp.map(|v| {
-            v.into_iter()
-                .map(|s| Url::parse(s).expect("url"))
-                .collect::<Vec<_>>()
-        });
+        let aia = aia.map(|v| v.into_iter().map(|s| s.to_string()).collect::<Vec<_>>());
+        let crldp = crldp.map(|v| v.into_iter().map(|s| s.to_string()).collect::<Vec<_>>());
 
         ResourceCertificate {
             raw_der: Vec::new(),
@@ -725,8 +716,8 @@ mod tests {
                 version: 2,
                 serial_number: BigUint::from(1u8),
                 signature_algorithm: "1.2.840.113549.1.1.11".to_string(),
-                issuer_dn: issuer_dn.to_string(),
-                subject_dn: subject_dn.to_string(),
+                issuer_name: X509NameDer(issuer_dn.as_bytes().to_vec()),
+                subject_name: X509NameDer(subject_dn.as_bytes().to_vec()),
                 validity_not_before: time::OffsetDateTime::UNIX_EPOCH,
                 validity_not_after: time::OffsetDateTime::UNIX_EPOCH,
                 subject_public_key_info: Vec::new(),

src/validation/cert_path.rs

@@ -112,10 +112,10 @@ pub fn validate_ee_cert_path(
         return Err(CertPathError::IssuerNotCa);
     }
 
-    if ee.tbs.issuer_dn != issuer_ca.tbs.subject_dn {
+    if ee.tbs.issuer_name != issuer_ca.tbs.subject_name {
         return Err(CertPathError::IssuerSubjectMismatch {
-            ee_issuer_dn: ee.tbs.issuer_dn.clone(),
-            issuer_subject_dn: issuer_ca.tbs.subject_dn.clone(),
+            ee_issuer_dn: ee.tbs.issuer_name.to_string(),
+            issuer_subject_dn: issuer_ca.tbs.subject_name.to_string(),
         });
     }
 
@@ -212,7 +212,7 @@ fn validate_ee_key_usage(ee_cert_der: &[u8]) -> Result<(), CertPathError> {
 
     let mut ku_critical: Option<bool> = None;
     for ext in cert.extensions() {
-        if ext.oid.to_id_string() == crate::data_model::oid::OID_KEY_USAGE {
+        if ext.oid.as_bytes() == crate::data_model::oid::OID_KEY_USAGE_RAW {
             ku_critical = Some(ext.critical);
             break;
         }
@@ -302,8 +302,8 @@ mod tests {
     use crate::data_model::rc::{
         RcExtensions, ResourceCertKind, ResourceCertificate, RpkixTbsCertificate,
     };
+    use crate::data_model::common::X509NameDer;
     use der_parser::num_bigint::BigUint;
-    use url::Url;
 
     fn dummy_cert(
         kind: ResourceCertKind,
@@ -314,16 +314,8 @@ mod tests {
         aia: Option<Vec<&str>>,
         crldp: Option<Vec<&str>>,
     ) -> ResourceCertificate {
-        let aia = aia.map(|v| {
-            v.into_iter()
-                .map(|s| Url::parse(s).expect("url"))
-                .collect::<Vec<_>>()
-        });
-        let crldp = crldp.map(|v| {
-            v.into_iter()
-                .map(|s| Url::parse(s).expect("url"))
-                .collect::<Vec<_>>()
-        });
+        let aia = aia.map(|v| v.into_iter().map(|s| s.to_string()).collect::<Vec<_>>());
+        let crldp = crldp.map(|v| v.into_iter().map(|s| s.to_string()).collect::<Vec<_>>());
         ResourceCertificate {
             raw_der: Vec::new(),
             kind,
@@ -331,8 +323,8 @@ mod tests {
                 version: 2,
                 serial_number: BigUint::from(1u8),
                 signature_algorithm: "1.2.840.113549.1.1.11".to_string(),
-                issuer_dn: issuer_dn.to_string(),
-                subject_dn: subject_dn.to_string(),
+                issuer_name: X509NameDer(issuer_dn.as_bytes().to_vec()),
+                subject_name: X509NameDer(subject_dn.as_bytes().to_vec()),
                 validity_not_before: time::OffsetDateTime::UNIX_EPOCH,
                 validity_not_after: time::OffsetDateTime::UNIX_EPOCH,
                 subject_public_key_info: Vec::new(),

src/validation/objects.rs

@@ -462,7 +462,7 @@ fn process_aspa_with_issuer(
 }
 
 fn choose_crl_for_certificate(
-    crldp_uris: Option<&Vec<url::Url>>,
+    crldp_uris: Option<&Vec<String>>,
     crl_files: &[(String, Vec<u8>)],
 ) -> Result<(String, Vec<u8>), ObjectValidateError> {
     if crl_files.is_empty() {