conec 0.2.0

COordinated NEtwork Channels
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62

// Copyright 2020 Riad S. Wahby <rsw@cs.stanford.edu>
//
// This file is part of conec.
//
// Licensed under the Apache License, Version 2.0 (see
// LICENSE or https://www.apache.org/licenses/LICENSE-2.0).
// This file may not be copied, modified, or distributed
// except according to those terms.

/*!
This module defines convenience functions for generating certificates.

See `examples/gencerts.rs` and `src/tests.rs` for more information.
*/

use crate::consts::VERSION;

use err_derive::Error;
use rand::{thread_rng, Rng};
use rcgen::{
    BasicConstraints, Certificate, CertificateParams, DistinguishedName, DnType, IsCa, RcgenError, SanType,
};

/// Errors during key generation
#[derive(Debug, Error)]
pub enum CertAuthError {
    /// Error during key generation
    #[error(display = "Error generating key")]
    KeyGen(#[source] RcgenError),
}
def_into_error!(CertAuthError);

/// Generate a new CA certificate for use with CONEC
pub fn generate_ca() -> Result<Certificate, CertAuthError> {
    let mut params = CertificateParams::default();
    params.is_ca = IsCa::Ca(BasicConstraints::Constrained(0));
    params.serial_number = Some(thread_rng().gen());
    params.distinguished_name = {
        let mut tmp = DistinguishedName::new();
        tmp.push(DnType::OrganizationName, VERSION);
        tmp.push(DnType::CommonName, "ca");
        tmp
    };
    params.subject_alt_names = vec![SanType::DnsName("ca".to_string())];
    Ok(Certificate::from_params(params)?)
}

/// Generate a client certificate signed by a given CA
pub fn generate_cert(name: String, ca: &Certificate) -> Result<(Vec<u8>, Vec<u8>), CertAuthError> {
    let mut params = CertificateParams::default();
    params.serial_number = Some(thread_rng().gen());
    params.distinguished_name = {
        let mut tmp = DistinguishedName::new();
        tmp.push(DnType::OrganizationName, VERSION);
        tmp.push(DnType::CommonName, &name);
        tmp
    };
    params.subject_alt_names = vec![SanType::DnsName(name)];

    let cert = Certificate::from_params(params)?;
    Ok((cert.serialize_der_with_signer(ca)?, cert.serialize_private_key_der()))
}