spiffe 0.13.0

Core SPIFFE identity types and Workload API sources
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151

//! `Certificate` and `PrivateKey` types and helpers.
//!
//! These types wrap DER-encoded bytes and validate them at construction time.

use crate::cert::error::{CertificateError, PrivateKeyError};
use crate::cert::parsing::{
    extract_spiffe_ids_from_uri_san, parse_der_encoded_bytes_as_x509_certificate,
};
use crate::SpiffeId;
use pkcs8::PrivateKeyInfo;
use x509_parser::certificate::X509Certificate;
use zeroize::Zeroize;

pub mod error;
pub(crate) mod parsing;

/// A single DER-encoded X.509 certificate.
///
/// Invariant: instances are always validated as parseable DER-encoded X.509.
#[derive(Debug, Clone, Eq, PartialEq)]
pub struct Certificate(Vec<u8>);

impl Certificate {
    /// Returns the certificate bytes.
    pub fn as_bytes(&self) -> &[u8] {
        &self.0
    }

    /// Extracts the SPIFFE ID from the certificate's URI SAN.
    ///
    /// This requires the certificate to contain **exactly one** URI SAN that parses
    /// as a SPIFFE ID.
    ///
    /// # Errors
    /// - [`CertificateError::MissingSpiffeId`] if no SPIFFE ID is present in the URI SAN.
    /// - [`CertificateError::MultipleUriSanEntries`] if the certificate contains multiple URI SAN entries.
    /// - [`CertificateError::ParseX509Certificate`] for parsing errors.
    pub fn spiffe_id(&self) -> Result<SpiffeId, CertificateError> {
        let x509 = parse_der_encoded_bytes_as_x509_certificate(self.as_bytes())?;
        extract_single_spiffe_id_from_uri_san(&x509)
    }
}

impl AsRef<[u8]> for Certificate {
    fn as_ref(&self) -> &[u8] {
        &self.0
    }
}

impl From<X509Certificate<'_>> for Certificate {
    fn from(cert: X509Certificate<'_>) -> Self {
        Self(cert.as_raw().to_vec())
    }
}

impl TryFrom<&[u8]> for Certificate {
    type Error = CertificateError;

    fn try_from(der_bytes: &[u8]) -> Result<Self, Self::Error> {
        parse_der_encoded_bytes_as_x509_certificate(der_bytes)?;
        Ok(Self(Vec::from(der_bytes)))
    }
}

impl TryFrom<Vec<u8>> for Certificate {
    type Error = CertificateError;

    fn try_from(der_bytes: Vec<u8>) -> Result<Self, Self::Error> {
        parse_der_encoded_bytes_as_x509_certificate(&der_bytes)?;
        Ok(Self(der_bytes))
    }
}

/// A DER-encoded private key in PKCS#8 format.
///
/// Invariant: instances are always validated as parseable PKCS#8.
///
/// This type is zeroized on drop.
#[derive(Clone, Eq, PartialEq, Zeroize)]
#[zeroize(drop)]
pub struct PrivateKey(Vec<u8>);

impl PrivateKey {
    /// Returns the private key bytes.
    pub fn as_bytes(&self) -> &[u8] {
        &self.0
    }
}

impl AsRef<[u8]> for PrivateKey {
    fn as_ref(&self) -> &[u8] {
        &self.0
    }
}

impl TryFrom<&[u8]> for PrivateKey {
    type Error = PrivateKeyError;

    fn try_from(bytes: &[u8]) -> Result<Self, Self::Error> {
        // Validate that the bytes are a valid PKCS#8 private key.
        PrivateKeyInfo::try_from(bytes).map_err(PrivateKeyError::DecodePkcs8)?;
        Ok(Self(Vec::from(bytes)))
    }
}

impl TryFrom<Vec<u8>> for PrivateKey {
    type Error = PrivateKeyError;

    fn try_from(bytes: Vec<u8>) -> Result<Self, Self::Error> {
        // Validate that the bytes are a valid PKCS#8 private key.
        PrivateKeyInfo::try_from(bytes.as_slice()).map_err(PrivateKeyError::DecodePkcs8)?;
        Ok(Self(bytes))
    }
}

impl std::fmt::Debug for PrivateKey {
    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
        f.debug_struct("PrivateKey")
            .field("len", &self.0.len())
            .finish()
    }
}

/// Extracts a SPIFFE ID from a DER-encoded X.509 certificate.
///
/// This requires the certificate to contain **exactly one** URI SAN that parses
/// as a SPIFFE ID.
///
/// # Errors
/// - [`CertificateError::MissingSpiffeId`] if no SPIFFE ID is present in the URI SAN.
/// - [`CertificateError::MultipleUriSanEntries`] if the certificate contains multiple URI SAN entries.
/// - [`CertificateError::ParseX509Certificate`] for parsing errors.
pub fn spiffe_id_from_der(der: &[u8]) -> Result<SpiffeId, CertificateError> {
    let x509 = parse_der_encoded_bytes_as_x509_certificate(der)?;
    extract_single_spiffe_id_from_uri_san(&x509)
}

pub(crate) fn extract_single_spiffe_id_from_uri_san(
    cert: &X509Certificate<'_>,
) -> Result<SpiffeId, CertificateError> {
    let mut ids = extract_spiffe_ids_from_uri_san(cert)?.into_iter();

    let Some(first) = ids.next() else {
        return Err(CertificateError::MissingSpiffeId);
    };
    if ids.next().is_some() {
        return Err(CertificateError::MultipleSpiffeIds);
    }

    Ok(first)
}