crypto_glue/x509/
mod.rs

1use crate::{
2    ecdsa_p256::{EcdsaP256PublicKey, EcdsaP256Signature, EcdsaP256VerifyingKey},
3    ecdsa_p384::{EcdsaP384PublicKey, EcdsaP384Signature, EcdsaP384VerifyingKey},
4    rsa::{RS256PublicKey, RS256Signature, RS256VerifyingKey},
5    s256::{Sha256, Sha256Output},
6    traits::{Digest, EncodeDer, OwnedToRef, Verifier},
7};
8use tracing::error;
9
10pub use self::chain::{X509Store, X509VerificationError};
11pub use self::display::X509Display;
12pub use self::serialise::{pkeyb64, x509b64};
13pub use const_oid::db as oiddb;
14pub use const_oid::{AssociatedOid, ObjectIdentifier};
15pub use der::asn1::{BitString, GeneralizedTime, Ia5String, OctetString};
16pub use x509_cert::builder::RequestBuilder as CertificateRequestBuilder;
17pub use x509_cert::builder::{
18    Builder, CertificateBuilder, Error as CertBuilderError, Profile, profile,
19};
20pub use x509_cert::certificate::{Certificate, TbsCertificate, Version};
21pub use x509_cert::ext::Extension;
22pub use x509_cert::ext::pkix::name::{DistributionPointName, GeneralName, OtherName};
23pub use x509_cert::ext::pkix::{
24    AccessDescription, AuthorityInfoAccessSyntax, AuthorityKeyIdentifier, BasicConstraints,
25    ExtendedKeyUsage, KeyUsage, KeyUsages, SubjectAltName, SubjectKeyIdentifier,
26    crl::CrlDistributionPoints, crl::dp::DistributionPoint,
27};
28pub use x509_cert::name::Name;
29pub use x509_cert::request::CertReq as CertificateRequest;
30pub use x509_cert::serial_number::SerialNumber;
31pub use x509_cert::spki::{
32    AlgorithmIdentifier, SignatureBitStringEncoding, SubjectPublicKeyInfoOwned,
33    SubjectPublicKeyInfoRef,
34};
35pub use x509_cert::time::{Time, Validity};
36
37mod chain;
38mod display;
39mod serialise;
40
41pub fn uuid_to_serial(serial_uuid: uuid::Uuid) -> SerialNumber {
42    let mut serial_bytes: [u8; 17] = [0; 17];
43    // The first byte must be a value else if the leading byte is a null then
44    // der is unhappy.
45    serial_bytes[0] = 0x01;
46    let update_bytes = &mut serial_bytes[1..];
47    update_bytes.copy_from_slice(serial_uuid.as_bytes());
48
49    #[allow(clippy::expect_used)]
50    SerialNumber::new(&serial_bytes).expect("Failed to create serial number from uuid")
51}
52
53pub fn x509_digest_public_key_sha256(certificate: &Certificate) -> Option<Sha256Output> {
54    let public_key_bytes = certificate
55        .tbs_certificate()
56        .subject_public_key_info()
57        .subject_public_key
58        .as_bytes()?;
59
60    let mut hasher = Sha256::new();
61    hasher.update(public_key_bytes);
62    Some(hasher.finalize())
63}
64
65pub fn x509_digest_cert_sha256(certificate: &Certificate) -> Result<Sha256Output, der::Error> {
66    let mut hasher = Sha256::new();
67    hasher.update(certificate.to_der()?);
68    Ok(hasher.finalize())
69}
70
71pub fn x509_verify_signature(
72    data: &[u8],
73    signature: &[u8],
74    certificate: &Certificate,
75) -> Result<(), X509VerificationError> {
76    let subject_public_key_info = certificate
77        .tbs_certificate()
78        .subject_public_key_info()
79        .owned_to_ref();
80
81    match subject_public_key_info.algorithm.oids() {
82        Ok((oiddb::rfc5912::ID_EC_PUBLIC_KEY, Some(oiddb::rfc5912::SECP_256_R_1))) => {
83            let signature = EcdsaP256Signature::from_der(signature)
84                .map_err(|_err| X509VerificationError::DerSignatureInvalid)?;
85
86            let verifier = EcdsaP256PublicKey::try_from(subject_public_key_info)
87                .map(EcdsaP256VerifyingKey::from)
88                .map_err(|_err| X509VerificationError::VerifyingKeyFromSpki)?;
89
90            verifier
91                .verify(data, &signature)
92                .map_err(|_err| X509VerificationError::SignatureVerificationFailed)?;
93        }
94        Ok((oiddb::rfc5912::ID_EC_PUBLIC_KEY, Some(oiddb::rfc5912::SECP_384_R_1))) => {
95            let signature = EcdsaP384Signature::from_der(signature)
96                .map_err(|_err| X509VerificationError::DerSignatureInvalid)?;
97
98            let verifier = EcdsaP384PublicKey::try_from(subject_public_key_info)
99                .map(EcdsaP384VerifyingKey::from)
100                .map_err(|_err| X509VerificationError::VerifyingKeyFromSpki)?;
101
102            verifier
103                .verify(data, &signature)
104                .map_err(|_err| X509VerificationError::SignatureVerificationFailed)?;
105        }
106        Ok((oiddb::rfc5912::RSA_ENCRYPTION, None))
107        | Ok((oiddb::rfc5912::SHA_256_WITH_RSA_ENCRYPTION, None)) => {
108            let signature = RS256Signature::try_from(signature)
109                .map_err(|_err| X509VerificationError::DerSignatureInvalid)?;
110
111            let verifier = RS256PublicKey::try_from(subject_public_key_info)
112                .map(RS256VerifyingKey::new)
113                .map_err(|_err| X509VerificationError::VerifyingKeyFromSpki)?;
114
115            verifier
116                .verify(data, &signature)
117                .map_err(|_err| X509VerificationError::SignatureVerificationFailed)?;
118        }
119        algo_oids => {
120            error!(?algo_oids);
121            return Err(X509VerificationError::SignatureAlgorithmNotImplemented);
122        }
123    }
124
125    Ok(())
126}
crypto_glue/x509/mod.rs

crypto_glue/x509/
mod.rs
