pq-map 0.2.3

Domain service and cryptography discovery from Certificate Transparency and DNS
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124

use std::collections::BTreeMap;
use std::fs;
use std::path::PathBuf;

use chrono::{DateTime, Utc};
use serde::{Deserialize, Serialize};

use crate::model::ChainEntry;

use super::cache;

pub const SNAPSHOT_VERSION: u32 = 1;

#[derive(Debug, Serialize, Deserialize)]
pub struct Snapshot {
    pub version: u32,
    pub fetched_at: DateTime<Utc>,
    pub chains: BTreeMap<u64, Vec<ChainEntry>>,
}

fn cache_dir() -> PathBuf {
    if let Ok(dir) = std::env::var("CHAIN_CACHE_DIR") {
        return PathBuf::from(dir);
    }
    let base = std::env::var("XDG_CACHE_HOME")
        .ok()
        .filter(|s| !s.is_empty())
        .map(PathBuf::from)
        .or_else(|| {
            std::env::var("HOME")
                .ok()
                .map(|h| PathBuf::from(h).join(".cache"))
        });
    base.unwrap_or_else(std::env::temp_dir)
        .join("pq-map")
        .join("chain")
}

pub fn load(domain: &str) -> Option<Snapshot> {
    cache::migrate_legacy_file(&cache_dir(), domain);
    let file = cache::latest_file(&cache_dir(), domain)?;
    let body = fs::read_to_string(&file).ok()?;
    let snap: Snapshot = serde_json::from_str(&body).ok()?;
    if snap.version != SNAPSHOT_VERSION {
        return None;
    }
    match cache::age(&file) {
        Some(age) => eprintln!(
            "CT: loading chain snapshot {} ({domain}, {} min old)",
            file.display(),
            age / 60
        ),
        None => eprintln!("CT: loading chain snapshot {} ({domain})", file.display()),
    }
    Some(snap)
}

pub fn age(domain: &str) -> Option<u64> {
    cache::age(&cache::latest_file(&cache_dir(), domain)?)
}

pub fn store(domain: &str, chains: &BTreeMap<u64, Vec<ChainEntry>>) {
    let snapshot = Snapshot {
        version: SNAPSHOT_VERSION,
        fetched_at: Utc::now(),
        chains: chains.clone(),
    };
    let Ok(body) = serde_json::to_string_pretty(&snapshot) else {
        eprintln!("CT: chain caching failed: serialization error");
        return;
    };
    cache::migrate_legacy_file(&cache_dir(), domain);
    match cache::domain_store(&cache_dir(), domain, &body) {
        Ok(path) => eprintln!("CT: chain snapshot cached: {}", path.display()),
        Err(e) => eprintln!("CT: chain caching failed: {e}"),
    }
}

#[cfg(test)]
mod tests {
    use super::*;

    fn entry(leaf: u64, depth: u32) -> (u64, ChainEntry) {
        (
            leaf,
            ChainEntry {
                depth,
                certificate_id: leaf * 10 + depth as u64,
                common_name: Some(format!("ca{depth}")),
                ski: Some("aa".to_string()),
                aki: None,
                not_before: None,
                not_after: None,
                key_algorithm: Some("RSA".to_string()),
                key_size: Some(2048),
                signature_key_algorithm: Some("RSA".to_string()),
                signature_hash_algorithm: Some("SHA-256".to_string()),
                issuer_ca_name: None,
            },
        )
    }

    #[test]
    fn snapshot_roundtrip() {
        let dir = std::env::temp_dir().join("pq-chain-cache-test");
        fs::create_dir_all(&dir).unwrap();
        unsafe { std::env::set_var("CHAIN_CACHE_DIR", &dir) };

        let mut chains = BTreeMap::new();
        let (leaf, e0) = entry(9612296601, 0);
        let (_, e1) = entry(9612296601, 1);
        chains.insert(leaf, vec![e0, e1]);

        store("roundtrip.example.pl", &chains);
        let loaded = load("roundtrip.example.pl").expect("snapshot loads");
        let entries = loaded.chains.get(&leaf).unwrap();
        assert_eq!(entries.len(), 2);
        assert_eq!(entries[1].depth, 1);
        assert_eq!(entries[1].common_name.as_deref(), Some("ca1"));

        fs::remove_dir_all(&dir).unwrap();
        unsafe { std::env::remove_var("CHAIN_CACHE_DIR") };
    }
}