Add private_key() helper

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "rustls-pemfile"
-version = "2.0.0-alpha.0"
+version = "2.0.0-alpha.1"
 edition = "2018"
 license = "Apache-2.0 OR ISC OR MIT"
 readme = "README.md"

src/lib.rs

@@ -47,6 +47,7 @@ mod tests;
 /// --- Main crate APIs:
 mod pemfile;
 pub use pemfile::{read_all, read_one, Item};
+use pki_types::PrivateKeyDer;
 use pki_types::{
     CertificateDer, CertificateRevocationListDer, PrivatePkcs1KeyDer, PrivatePkcs8KeyDer,
     PrivateSec1KeyDer,
@@ -56,11 +57,10 @@ use pki_types::{
 use std::io;
 use std::iter;
 
-/// Extract all the certificates from `rd`, and return a vec of byte vecs
-/// containing the der-format contents.
+/// Return an iterator over certificates from `rd`.
 ///
-/// This function does not fail if there are no certificates in the file --
-/// it returns an empty vector.
+/// Filters out any PEM sections that are not certificates and yields errors if a problem
+/// occurs while trying to extract a certificate.
 pub fn certs(
     rd: &mut dyn io::BufRead,
 ) -> impl Iterator<Item = Result<CertificateDer<'static>, io::Error>> + '_ {
@@ -71,11 +71,27 @@ pub fn certs(
     })
 }
 
-/// Extract all the certificate revocation lists (CRLs) from `rd`, and return a vec of byte vecs
-/// containing the der-format contents.
+/// Return the first private key found in `rd`.
 ///
-/// This function does not fail if there are no CRLs in the file --
-/// it returns an empty vector.
+/// Yields the first PEM section describing a private key (of any type), or an error if a
+/// problem occurs while trying to read PEM sections.
+pub fn private_key(rd: &mut dyn io::BufRead) -> Result<Option<PrivateKeyDer<'static>>, io::Error> {
+    for result in iter::from_fn(move || read_one(rd).transpose()) {
+        match result? {
+            Item::Pkcs1Key(key) => return Ok(Some(key.into())),
+            Item::Pkcs8Key(key) => return Ok(Some(key.into())),
+            Item::Sec1Key(key) => return Ok(Some(key.into())),
+            Item::X509Certificate(_) | Item::Crl(_) => continue,
+        }
+    }
+
+    Ok(None)
+}
+
+/// Return an iterator certificate revocation lists (CRLs) from `rd`.
+///
+/// Filters out any PEM sections that are not CRLs and yields errors if a problem occurs
+/// while trying to extract a CRL.
 pub fn crls(
     rd: &mut dyn io::BufRead,
 ) -> impl Iterator<Item = Result<CertificateRevocationListDer<'static>, io::Error>> + '_ {
@@ -86,11 +102,10 @@ pub fn crls(
     })
 }
 
-/// Extract all RSA private keys from `rd`, and return a vec of byte vecs
-/// containing the der-format contents.
+/// Return an iterator over RSA private keys from `rd`.
 ///
-/// This function does not fail if there are no keys in the file -- it returns an
-/// empty vector.
+/// Filters out any PEM sections that are not RSA private keys and yields errors if a problem
+/// occurs while trying to extract an RSA private key.
 pub fn rsa_private_keys(
     rd: &mut dyn io::BufRead,
 ) -> impl Iterator<Item = Result<PrivatePkcs1KeyDer<'static>, io::Error>> + '_ {
@@ -101,11 +116,10 @@ pub fn rsa_private_keys(
     })
 }
 
-/// Extract all PKCS8-encoded private keys from `rd`, and return a vec of
-/// byte vecs containing the der-format contents.
+/// Return an iterator over PKCS8-encoded private keys from `rd`.
 ///
-/// This function does not fail if there are no keys in the file -- it returns an
-/// empty vector.
+/// Filters out any PEM sections that are not PKCS8-encoded private keys and yields errors if a
+/// problem occurs while trying to extract an RSA private key.
 pub fn pkcs8_private_keys(
     rd: &mut dyn io::BufRead,
 ) -> impl Iterator<Item = Result<PrivatePkcs8KeyDer<'static>, io::Error>> + '_ {
@@ -116,11 +130,10 @@ pub fn pkcs8_private_keys(
     })
 }
 
-/// Extract all SEC1-encoded EC private keys from `rd`, and return a vec of
-/// byte vecs containing the der-format contents.
+/// Return an iterator over SEC1-encoded EC private keys from `rd`.
 ///
-/// This function does not fail if there are no keys in the file -- it returns an
-/// empty vector.
+/// Filters out any PEM sections that are not SEC1-encoded EC private keys and yields errors if a
+/// problem occurs while trying to extract a SEC1-encoded EC private key.
 pub fn ec_private_keys(
     rd: &mut dyn io::BufRead,
 ) -> impl Iterator<Item = Result<PrivateSec1KeyDer<'static>, io::Error>> + '_ {

tests/integration.rs

@@ -15,6 +15,17 @@ fn test_rsa_private_keys() {
     );
 }
 
+#[test]
+fn private_key() {
+    let data = include_bytes!("data/zen2.pem");
+    let mut reader = BufReader::new(&data[..]);
+    rustls_pemfile::private_key(&mut reader).unwrap().unwrap();
+
+    let data = include_bytes!("data/certificate.chain.pem");
+    let mut reader = BufReader::new(&data[..]);
+    assert!(rustls_pemfile::private_key(&mut reader).unwrap().is_none());
+}
+
 #[test]
 fn test_certs() {
     let data = include_bytes!("data/certificate.chain.pem");