cipherrun 0.3.0

A fast, modular, and scalable TLS/SSL security scanner written in Rust
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152

// Certificate Record Model
// Represents X.509 certificates with deduplication by fingerprint

use chrono::{DateTime, Utc};
use serde::{Deserialize, Serialize};
use sqlx::FromRow;

/// Certificate record in database (deduplicated by SHA256 fingerprint)
#[derive(Debug, Clone, Serialize, Deserialize, FromRow)]
pub struct CertificateRecord {
    #[serde(skip_serializing_if = "Option::is_none")]
    pub cert_id: Option<i64>,
    pub fingerprint_sha256: String, // Unique identifier
    pub subject: String,
    pub issuer: String,
    pub serial_number: Option<String>,
    pub not_before: DateTime<Utc>,
    pub not_after: DateTime<Utc>,
    pub signature_algorithm: Option<String>,
    pub public_key_algorithm: Option<String>,
    pub public_key_size: Option<i32>,
    #[sqlx(default)]
    pub san_domains: Vec<String>, // Array of SAN domains
    pub is_ca: bool,
    #[sqlx(default)]
    pub key_usage: Vec<String>,
    #[sqlx(default)]
    pub extended_key_usage: Vec<String>,
    pub der_bytes: Option<Vec<u8>>, // Full DER encoding
    pub created_at: DateTime<Utc>,
}

/// Certificate chain junction table record
#[derive(Debug, Clone, Serialize, Deserialize, FromRow)]
pub struct ScanCertificateRecord {
    #[serde(skip_serializing_if = "Option::is_none")]
    pub id: Option<i64>,
    pub scan_id: i64,
    pub cert_id: i64,
    pub chain_position: i32, // 0 = leaf, 1 = intermediate, etc.
}

impl CertificateRecord {
    /// Create new certificate record
    pub fn new(
        fingerprint_sha256: String,
        subject: String,
        issuer: String,
        not_before: DateTime<Utc>,
        not_after: DateTime<Utc>,
        is_ca: bool,
    ) -> Self {
        Self {
            cert_id: None,
            fingerprint_sha256,
            subject,
            issuer,
            serial_number: None,
            not_before,
            not_after,
            signature_algorithm: None,
            public_key_algorithm: None,
            public_key_size: None,
            san_domains: Vec::new(),
            is_ca,
            key_usage: Vec::new(),
            extended_key_usage: Vec::new(),
            der_bytes: None,
            created_at: Utc::now(),
        }
    }

    /// Set serial number
    pub fn with_serial(mut self, serial: String) -> Self {
        self.serial_number = Some(serial);
        self
    }

    /// Set algorithms
    pub fn with_algorithms(
        mut self,
        signature_algo: String,
        public_key_algo: String,
        key_size: usize,
    ) -> Self {
        self.signature_algorithm = Some(signature_algo);
        self.public_key_algorithm = Some(public_key_algo);
        self.public_key_size = Some(key_size as i32);
        self
    }

    /// Set SAN domains
    pub fn with_san_domains(mut self, domains: Vec<String>) -> Self {
        self.san_domains = domains;
        self
    }

    /// Set key usages
    pub fn with_key_usage(mut self, key_usage: Vec<String>, extended: Vec<String>) -> Self {
        self.key_usage = key_usage;
        self.extended_key_usage = extended;
        self
    }

    /// Set DER bytes
    pub fn with_der_bytes(mut self, der: Vec<u8>) -> Self {
        self.der_bytes = Some(der);
        self
    }
}

impl ScanCertificateRecord {
    /// Create new scan-certificate junction record
    pub fn new(scan_id: i64, cert_id: i64, chain_position: i32) -> Self {
        Self {
            id: None,
            scan_id,
            cert_id,
            chain_position,
        }
    }
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn test_certificate_record_creation() {
        let now = Utc::now();
        let cert = CertificateRecord::new(
            "abc123".to_string(),
            "CN=example.com".to_string(),
            "CN=CA".to_string(),
            now,
            now,
            false,
        );

        assert_eq!(cert.fingerprint_sha256, "abc123");
        assert_eq!(cert.subject, "CN=example.com");
        assert!(!cert.is_ca);
    }

    #[test]
    fn test_scan_certificate_junction() {
        let junction = ScanCertificateRecord::new(1, 100, 0);
        assert_eq!(junction.scan_id, 1);
        assert_eq!(junction.cert_id, 100);
        assert_eq!(junction.chain_position, 0);
    }
}