secure_network 0.1.2

TLS policy validation, SPKI certificate pinning, and cleartext traffic detection.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51

use secure_network::{
    MtlsClientIdentity, MtlsClientIdentityStatus, MtlsRevocationLookup, NoMtlsRevocations,
};
use time::{Duration, OffsetDateTime};

#[derive(Clone, Debug)]
struct Revoked;

impl MtlsRevocationLookup for Revoked {
    fn is_revoked(&self, serial: &str, fingerprint: &str) -> bool {
        serial == "serial-1" && fingerprint == "fingerprint-1"
    }
}

fn now() -> OffsetDateTime {
    OffsetDateTime::from_unix_timestamp(1_778_000_000).expect("valid fixture time")
}

fn identity(trusted_edge: bool) -> MtlsClientIdentity {
    MtlsClientIdentity::new(
        "serial-1",
        "fingerprint-1",
        now() - Duration::minutes(1),
        now() + Duration::days(1),
        trusted_edge,
    )
}

#[test]
fn trusted_edge_identity_within_validity_window_is_valid() {
    assert_eq!(
        identity(true).validate_at(now(), &NoMtlsRevocations),
        MtlsClientIdentityStatus::Valid
    );
}

#[test]
fn untrusted_edge_identity_is_rejected_before_time_checks() {
    assert_eq!(
        identity(false).validate_at(now(), &NoMtlsRevocations),
        MtlsClientIdentityStatus::UntrustedEdge
    );
}

#[test]
fn revoked_identity_is_rejected() {
    assert_eq!(
        identity(true).validate_at(now(), &Revoked),
        MtlsClientIdentityStatus::Revoked
    );
}