From 0e85ff2aac5fb2a2fdce9d43c29cb075e9058b8d Mon Sep 17 00:00:00 2001 From: nworbnhoj Date: Tue, 27 Jun 2023 18:54:16 +1000 Subject: [PATCH] refactor `tls::rota` --- libs/tls/src/lib.rs | 88 ++--------------------------------------- libs/tls/src/rota.rs | 75 +++++++++++++++++++++++++++++++++++ libs/tls/src/trusted.rs | 4 +- 3 files changed, 81 insertions(+), 86 deletions(-) create mode 100644 libs/tls/src/rota.rs diff --git a/libs/tls/src/lib.rs b/libs/tls/src/lib.rs index 7de729951..6d6d92698 100644 --- a/libs/tls/src/lib.rs +++ b/libs/tls/src/lib.rs @@ -1,107 +1,27 @@ pub mod cmd; pub mod danger; +pub mod rota; pub mod trusted; +use crate::rota::RustlsOwnedTrustAnchor; use modals::Modals; use rkyv::{ de::deserializers::AllocDeserializer, ser::{serializers::WriteSerializer, Serializer}, - AlignedVec, Archive, Deserialize, Serialize, + AlignedVec, Deserialize }; -use rustls::{Certificate, RootCertStore}; -use std::cmp::min; +use rustls::Certificate; use std::convert::{Into, TryFrom}; use std::fs::File; use std::io::{Error, ErrorKind, Read, Write}; use std::path::PathBuf; use x509_parser::prelude::{FromDer, X509Certificate}; -use x509_parser::der_parser::der::Tag; use xous_names::XousNames; /// PDDB Dict for tls trusted certificates keys const TLS_CERT_DICT: &str = "tls/cert"; const CURRENT_VERSION_KEY: &str = "__version"; -#[derive(Archive, Serialize, Deserialize, Debug)] -pub struct RustlsOwnedTrustAnchor { - pub subject: Vec, - pub spki: Vec, - pub name_constraints: Option>, -} - -impl RustlsOwnedTrustAnchor { - -pub fn from_subject_spki_name_constraints( - subject: impl Into>, - spki: impl Into>, - name_constraints: Option>>, -) -> Self { - Self { - subject: subject.into(), - spki: spki.into(), - name_constraints: name_constraints.map(|x| x.into()) - } -} - - - pub fn subject(&self) -> String { - let der = self.subject.clone(); - let len = min(der.len(), 127); - let mut der = der[..len].to_owned(); - der.insert(0, len as u8); - der.insert(0, Tag::Sequence.0 as u8); - match x509_parser::x509::X509Name::from_der(&der) { - Ok((_, decoded)) => decoded.to_string(), - Err(e) => format!("der parse failed: {e}").to_string(), - } - } - - - - } -} -impl<'a> From<&X509Certificate<'a>> for RustlsOwnedTrustAnchor { - fn from(x509: &X509Certificate) -> Self { - RustlsOwnedTrustAnchor { - subject: x509.subject().as_raw().to_vec(), - spki: x509.public_key().raw.to_vec(), - name_constraints: None::>, - // may have to pass value thru from certificates parameter - // name_constraints: match x509.name_constraints() { - // Ok(Some(nc)) => Some(nc.value), - // Ok(None) => None, - // Err(e) => { - // log::warn!("failed to extract x509 name_constraints: {}", e); - // None - // } - // }, - } - } -} - -impl Into for RustlsOwnedTrustAnchor { - fn into(self) -> rustls::OwnedTrustAnchor { - rustls::OwnedTrustAnchor::from_subject_spki_name_constraints( - self.subject, - self.spki, - self.name_constraints, - ) - } -} - - - - - - - - - - - - } -} - // presents a modal to the user to select trusted tls certificates // and saves the selected certificates to the pddb // returns false if no certificates are trusted - and true otherwise diff --git a/libs/tls/src/rota.rs b/libs/tls/src/rota.rs new file mode 100644 index 000000000..8f954c92d --- /dev/null +++ b/libs/tls/src/rota.rs @@ -0,0 +1,75 @@ +// A mirror of rustls::OwnedTrustAnchor + +use rkyv::{Archive, Deserialize, Serialize,}; +use std::cmp::min; +use std::fmt; +use x509_parser::der_parser::der::Tag; +use x509_parser::prelude::{FromDer, X509Certificate}; + +#[derive(Archive, Serialize, Deserialize, Debug)] +pub struct RustlsOwnedTrustAnchor { + pub subject: Vec, + pub spki: Vec, + pub name_constraints: Option>, +} + +impl RustlsOwnedTrustAnchor { + pub fn from_subject_spki_name_constraints( + subject: impl Into>, + spki: impl Into>, + name_constraints: Option>>, + ) -> Self { + Self { + subject: subject.into(), + spki: spki.into(), + name_constraints: name_constraints.map(|x| x.into()), + } + } + + pub fn subject(&self) -> String { + let der = self.subject.clone(); + let len = min(der.len(), 127); + let mut der = der[..len].to_owned(); + der.insert(0, len as u8); + der.insert(0, Tag::Sequence.0 as u8); + match x509_parser::x509::X509Name::from_der(&der) { + Ok((_, decoded)) => decoded.to_string(), + Err(e) => format!("der parse failed: {e}").to_string(), + } + } +} + +impl<'a> From<&X509Certificate<'a>> for RustlsOwnedTrustAnchor { + fn from(x509: &X509Certificate) -> Self { + RustlsOwnedTrustAnchor { + subject: x509.subject().as_raw().to_vec(), + spki: x509.public_key().raw.to_vec(), + name_constraints: None, + // may have to pass value thru from certificates parameter + // name_constraints: match x509.name_constraints() { + // Ok(Some(nc)) => Some(nc.value), + // Ok(None) => None, + // Err(e) => { + // log::warn!("failed to extract x509 name_constraints: {}", e); + // None + // } + // }, + } + } +} + +impl<'a> From<&webpki::TrustAnchor<'a>> for RustlsOwnedTrustAnchor { + fn from(ta: &webpki::TrustAnchor) -> Self { + Self::from_subject_spki_name_constraints(ta.subject, ta.spki, ta.name_constraints) + } +} + +impl Into for RustlsOwnedTrustAnchor { + fn into(self) -> rustls::OwnedTrustAnchor { + rustls::OwnedTrustAnchor::from_subject_spki_name_constraints( + self.subject, + self.spki, + self.name_constraints, + ) + } +} diff --git a/libs/tls/src/trusted.rs b/libs/tls/src/trusted.rs index 763026792..bbef8516e 100644 --- a/libs/tls/src/trusted.rs +++ b/libs/tls/src/trusted.rs @@ -1,7 +1,7 @@ use crate::get_cert; -use crate::{RustlsOwnedTrustAnchor, TLS_CERT_DICT}; +use crate::{rota::RustlsOwnedTrustAnchor, TLS_CERT_DICT}; use rustls::RootCertStore; -use std::io::{Error, ErrorKind, Read, Write}; +use std::io::Error; use std::path::PathBuf; pub struct Trusted {