proksi 0.11.0

A batteries-included reverse proxy with automatic HTTPS using Cloudflare Pingora and Let's Encrypt.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139

use openssl::{
    base64,
    pkey::{PKey, Private},
    x509::X509,
};
use serde::{Deserialize, Serialize};
use std::error::Error;

#[derive(Debug, Clone)]
pub struct Certificate {
    pub key: PKey<Private>,
    pub leaf: X509,
    /// The intermediates, in the order they're sent after the leaf
    pub chain: Vec<X509>,
}

#[derive(Debug, Serialize, Deserialize)]
pub(crate) struct SerializableCertificate {
    key: String,
    leaf: String,
    /// The intermediates, concatenated (stored before they were all kept: only the first)
    chain: Option<String>,
}

impl Certificate {
    pub fn to_serializable(&self) -> Result<SerializableCertificate, Box<dyn Error>> {
        Ok(SerializableCertificate {
            key: base64::encode_block(&self.key.private_key_to_pem_pkcs8()?),
            leaf: base64::encode_block(&self.leaf.to_pem()?),
            chain: if self.chain.is_empty() {
                None
            } else {
                let pems = self
                    .chain
                    .iter()
                    .map(|c| c.to_pem())
                    .collect::<Result<Vec<_>, _>>()?;
                Some(base64::encode_block(&pems.concat()))
            },
        })
    }

    pub fn from_serializable(cert: SerializableCertificate) -> Result<Self, Box<dyn Error>> {
        let key_data = base64::decode_block(&cert.key)?;
        let leaf_data = base64::decode_block(&cert.leaf)?;

        let key = PKey::private_key_from_pem(&key_data)?;
        let leaf = X509::from_pem(&leaf_data)?;
        let chain = match cert.chain {
            Some(chain_b64) => X509::stack_from_pem(&base64::decode_block(&chain_b64)?)?,
            None => vec![],
        };

        Ok(Certificate { key, leaf, chain })
    }
}
#[cfg(test)]
pub(crate) mod tests {
    use openssl::{
        asn1::Asn1Time,
        ec::{EcGroup, EcKey},
        hash::MessageDigest,
        nid::Nid,
        pkey::{PKey, Private},
        x509::{X509Name, X509},
    };

    use super::Certificate;

    /// A certificate for `name`, signed by `issuer` (self-signed without one)
    pub(crate) fn signed(
        name: &str,
        issuer: Option<&(X509, PKey<Private>)>,
    ) -> (X509, PKey<Private>) {
        let group = EcGroup::from_curve_name(Nid::X9_62_PRIME256V1).unwrap();
        let key = PKey::from_ec_key(EcKey::generate(&group).unwrap()).unwrap();
        let mut subject = X509Name::builder().unwrap();
        subject.append_entry_by_text("CN", name).unwrap();
        let subject = subject.build();
        let mut builder = X509::builder().unwrap();
        builder.set_subject_name(&subject).unwrap();
        builder
            .set_issuer_name(issuer.map_or(&subject, |(issuer, _)| issuer.subject_name()))
            .unwrap();
        builder.set_pubkey(&key).unwrap();
        builder
            .set_not_before(&Asn1Time::days_from_now(0).unwrap())
            .unwrap();
        builder
            .set_not_after(&Asn1Time::days_from_now(30).unwrap())
            .unwrap();
        builder
            .sign(issuer.map_or(&key, |(_, key)| key), MessageDigest::sha256())
            .unwrap();
        (builder.build(), key)
    }

    fn pems(certificates: &[X509]) -> Vec<Vec<u8>> {
        certificates.iter().map(|c| c.to_pem().unwrap()).collect()
    }

    #[test]
    fn test_every_intermediate_is_stored() {
        let first = signed("intermediate 1", None);
        let second = signed("intermediate 2", Some(&first));
        let (leaf, key) = signed("a.test", Some(&second));
        let certificate = Certificate {
            key,
            leaf,
            chain: vec![second.0.clone(), first.0.clone()],
        };

        let json = serde_json::to_string(&certificate.to_serializable().unwrap()).unwrap();
        let stored = Certificate::from_serializable(serde_json::from_str(&json).unwrap()).unwrap();

        assert_eq!(pems(&stored.chain), pems(&[second.0, first.0]));
        assert_eq!(
            stored.leaf.to_pem().unwrap(),
            certificate.leaf.to_pem().unwrap()
        );
    }

    #[test]
    fn test_certificates_without_chain_are_stored() {
        let (leaf, key) = signed("a.test", None);
        let certificate = Certificate {
            key,
            leaf,
            chain: vec![],
        };

        let serializable = certificate.to_serializable().unwrap();
        assert!(serializable.chain.is_none());
        assert!(Certificate::from_serializable(serializable)
            .unwrap()
            .chain
            .is_empty());
    }
}