lzc-sdk 0.1.1

Rust SDK for LazyCat application and device APIs
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98

use tonic::Request;
use tonic::transport::server::{TcpConnectInfo, TlsConnectInfo};
use x509_parser::oid_registry::Oid;
use x509_parser::parse_x509_certificate;
use x509_parser::x509::X509Name;

use crate::Error;

/// Identity encoded in a `LazyCat` application client certificate.
#[derive(Clone, Debug, Eq, PartialEq)]
pub struct Application {
    /// Application ID from the subject serial-number attribute.
    pub app_id: String,
    /// Box ID from the issuer serial-number attribute.
    pub box_id: String,
    /// Application domain from the subject common name.
    pub app_domain: String,
}

/// Extract the authenticated `LazyCat` application identity from a server request.
///
/// # Errors
///
/// Returns an error unless the request carries exactly one valid TLS peer
/// certificate.
pub fn peer_application<T>(request: &Request<T>) -> Result<Application, Error> {
    let certificates = request
        .extensions()
        .get::<TlsConnectInfo<TcpConnectInfo>>()
        .and_then(TlsConnectInfo::peer_certs);
    #[cfg(unix)]
    let certificates = certificates.or_else(|| {
        request
            .extensions()
            .get::<TlsConnectInfo<tonic::transport::server::UdsConnectInfo>>()
            .and_then(TlsConnectInfo::peer_certs)
    });
    let certificates = certificates.ok_or(Error::UnauthenticatedPeer)?;
    application_from_certificates(certificates.as_ref())
}

fn application_from_certificates(
    certificates: &[rustls::pki_types::CertificateDer<'static>],
) -> Result<Application, Error> {
    if certificates.len() != 1 {
        return Err(Error::InvalidPeerCertificateCount {
            count: certificates.len(),
        });
    }
    let (_, certificate) = parse_x509_certificate(certificates[0].as_ref())
        .map_err(|_| Error::InvalidPeerCertificate)?;
    Ok(Application {
        app_id: serial_number(certificate.subject()),
        box_id: serial_number(certificate.issuer()),
        app_domain: certificate
            .subject()
            .iter_common_name()
            .next()
            .and_then(|name| name.as_str().ok())
            .unwrap_or_default()
            .to_owned(),
    })
}

fn serial_number(name: &X509Name<'_>) -> String {
    let oid = Oid::from(&[2, 5, 4, 5]).expect("serialNumber OID is valid");
    name.iter_by_oid(&oid)
        .next()
        .and_then(|value| value.as_str().ok())
        .unwrap_or_default()
        .to_owned()
}

#[cfg(test)]
mod tests {
    use rustls::pki_types::CertificateDer;

    use crate::Error;

    use super::application_from_certificates;

    #[test]
    fn rejects_zero_or_multiple_peer_certificates() {
        let zero = application_from_certificates(&[]).expect_err("zero certificates");
        assert!(matches!(
            zero,
            Error::InvalidPeerCertificateCount { count: 0 }
        ));

        let invalid = CertificateDer::from(vec![0_u8]);
        let multiple = application_from_certificates(&[invalid.clone(), invalid])
            .expect_err("multiple certificates");
        assert!(matches!(
            multiple,
            Error::InvalidPeerCertificateCount { count: 2 }
        ));
    }
}