iroh-fedimint 0.35.0

Fedimint's compatibility fork of iroh 0.35: p2p QUIC connections dialed by public key
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103

use std::sync::Arc;

use ed25519_dalek::pkcs8::{spki::der::pem::LineEnding, EncodePrivateKey};
use iroh_base::SecretKey;
use webpki::types::{pem::PemObject, CertificateDer, PrivatePkcs8KeyDer};

use super::certificate;
use crate::tls::Authentication;

#[derive(Debug)]
pub(super) struct AlwaysResolvesCert {
    key: Arc<rustls::sign::CertifiedKey>,
    auth: Authentication,
}

/// Error for generating TLS configs.
#[derive(Debug, thiserror::Error)]
pub(super) enum CreateConfigError {
    /// Error generating the certificate.
    #[error("Error generating the certificate")]
    CertError(#[from] certificate::GenError),
    /// Rustls configuration error
    #[error("rustls error")]
    Rustls(#[from] rustls::Error),
}

impl AlwaysResolvesCert {
    pub(super) fn new(
        auth: Authentication,
        secret_key: &SecretKey,
    ) -> Result<Self, CreateConfigError> {
        let key = match auth {
            Authentication::X509 => {
                let (cert, key) = certificate::generate(secret_key)?;
                let certified_key = rustls::sign::CertifiedKey::new(
                    vec![cert],
                    rustls::crypto::ring::sign::any_ecdsa_type(&key)?,
                );
                Arc::new(certified_key)
            }
            Authentication::RawPublicKey => {
                // Directly use the key
                let client_private_key = secret_key
                    .secret()
                    .to_pkcs8_pem(LineEnding::default())
                    .expect("key is valid");

                let client_private_key =
                    PrivatePkcs8KeyDer::from_pem_slice(client_private_key.as_bytes())
                        .expect("cannot open private key file");
                let client_private_key =
                    rustls::crypto::ring::sign::any_eddsa_type(&client_private_key)?;

                let client_public_key = client_private_key
                    .public_key()
                    .ok_or(rustls::Error::InconsistentKeys(
                        rustls::InconsistentKeys::Unknown,
                    ))
                    .expect("cannot load public key");
                let client_public_key_as_cert = CertificateDer::from(client_public_key.to_vec());

                let certified_key = rustls::sign::CertifiedKey::new(
                    vec![client_public_key_as_cert],
                    client_private_key,
                );

                Arc::new(certified_key)
            }
        };
        Ok(Self { key, auth })
    }
}

impl rustls::client::ResolvesClientCert for AlwaysResolvesCert {
    fn resolve(
        &self,
        _root_hint_subjects: &[&[u8]],
        _sigschemes: &[rustls::SignatureScheme],
    ) -> Option<Arc<rustls::sign::CertifiedKey>> {
        Some(Arc::clone(&self.key))
    }

    fn only_raw_public_keys(&self) -> bool {
        matches!(self.auth, Authentication::RawPublicKey)
    }

    fn has_certs(&self) -> bool {
        true
    }
}

impl rustls::server::ResolvesServerCert for AlwaysResolvesCert {
    fn resolve(
        &self,
        _client_hello: rustls::server::ClientHello<'_>,
    ) -> Option<Arc<rustls::sign::CertifiedKey>> {
        Some(Arc::clone(&self.key))
    }

    fn only_raw_public_keys(&self) -> bool {
        matches!(self.auth, Authentication::RawPublicKey)
    }
}