tlspuffin/tls/
fn_cert.rs

1#![allow(clippy::ptr_arg)]
2
3use puffin::algebra::error::FnError;
4
5use crate::static_certs::{
6    ALICE_CERT, ALICE_PRIVATE_KEY, BOB_CERT, BOB_PRIVATE_KEY, EVE_CERT, RANDOM_EC_CERT,
7    RANDOM_EC_PRIVATE_KEY_PKCS8,
8};
9use crate::tls::rustls::hash_hs::HandshakeHash;
10use crate::tls::rustls::key::Certificate;
11use crate::tls::rustls::msgs::enums::SignatureScheme;
12use crate::tls::rustls::msgs::handshake::{
13    CertificateEntry, CertificateExtensions, HandshakePayload,
14};
15use crate::tls::rustls::msgs::message::{Message, MessagePayload};
16use crate::tls::rustls::verify::{
17    construct_tls13_client_verify_message_raw, construct_tls13_server_verify_message_raw,
18};
19use crate::tls::sign;
20
21pub fn fn_bob_cert() -> Result<Vec<u8>, FnError> {
22    Ok(BOB_CERT.1.into())
23}
24
25pub fn fn_bob_key() -> Result<Vec<u8>, FnError> {
26    Ok(BOB_PRIVATE_KEY.1.into())
27}
28
29pub fn fn_alice_cert() -> Result<Vec<u8>, FnError> {
30    Ok(ALICE_CERT.1.into())
31}
32
33pub fn fn_alice_key() -> Result<Vec<u8>, FnError> {
34    Ok(ALICE_PRIVATE_KEY.1.into())
35}
36
37pub fn fn_eve_cert() -> Result<Vec<u8>, FnError> {
38    Ok(EVE_CERT.1.into())
39}
40
41pub fn fn_random_ec_cert() -> Result<Vec<u8>, FnError> {
42    Ok(RANDOM_EC_CERT.1.into())
43}
44
45pub fn fn_random_ec_key() -> Result<Vec<u8>, FnError> {
46    Ok(RANDOM_EC_PRIVATE_KEY_PKCS8.1.into())
47}
48
49pub fn fn_certificate_entry_extensions(
50    cert: &Vec<u8>,
51    extensions: &CertificateExtensions,
52) -> Result<CertificateEntry, FnError> {
53    Ok(CertificateEntry {
54        cert: Certificate(cert.clone()),
55        exts: extensions.clone(),
56    })
57}
58
59pub fn fn_certificate_from_vec_u8(cert: &Vec<u8>) -> Result<Certificate, FnError> {
60    Ok(Certificate(cert.clone()))
61}
62
63pub fn fn_empty_certificate_chain() -> Result<Vec<CertificateEntry>, FnError> {
64    Ok(Vec::new())
65}
66
67pub fn fn_chain_append_certificate_entry(
68    chain: &Vec<CertificateEntry>,
69    cert: &CertificateEntry,
70) -> Result<Vec<CertificateEntry>, FnError> {
71    let mut res = chain.clone();
72    res.push(cert.clone());
73    Ok(res)
74}
75
76pub fn fn_get_context(certificate_request: &Message) -> Result<Vec<u8>, FnError> {
77    match certificate_request.payload.clone() {
78        MessagePayload::Handshake(payload) => match payload.payload {
79            HandshakePayload::CertificateRequestTLS13(payload) => Some(payload.context.0),
80            _ => None,
81        },
82        _ => None,
83    }
84    .ok_or_else(|| FnError::Malformed("Could not find context in message".to_owned()))
85}
86
87pub fn fn_eve_pkcs1_signature() -> Result<Vec<u8>, FnError> {
88    Ok(include_bytes!("../../assets/eve-signature").to_vec())
89}
90pub fn fn_rsa_sign_client(
91    transcript: &HandshakeHash,
92    private_key: &Vec<u8>,
93    scheme: &SignatureScheme,
94) -> Result<Vec<u8>, FnError> {
95    sign::rsa_sign(
96        &construct_tls13_client_verify_message_raw(&transcript.get_current_hash_raw()),
97        private_key,
98        scheme,
99    )
100}
101
102pub fn fn_rsa_sign_server(
103    transcript: &HandshakeHash,
104    private_key: &Vec<u8>,
105    scheme: &SignatureScheme,
106) -> Result<Vec<u8>, FnError> {
107    sign::rsa_sign(
108        &construct_tls13_server_verify_message_raw(&transcript.get_current_hash_raw()),
109        private_key,
110        scheme,
111    )
112}
113
114pub fn fn_ecdsa_sign_client(
115    transcript: &HandshakeHash,
116    private_key: &Vec<u8>,
117) -> Result<Vec<u8>, FnError> {
118    let message = construct_tls13_client_verify_message_raw(&transcript.get_current_hash_raw());
119    sign::ecdsa_sign(&message, private_key)
120}
121
122pub fn fn_ecdsa_sign_server(
123    transcript: &HandshakeHash,
124    private_key: &Vec<u8>,
125) -> Result<Vec<u8>, FnError> {
126    let message = construct_tls13_server_verify_message_raw(&transcript.get_current_hash_raw());
127    sign::ecdsa_sign(&message, private_key)
128}
129
130pub fn fn_rsa_pss_signature_algorithm() -> Result<SignatureScheme, FnError> {
131    Ok(SignatureScheme::RSA_PSS_SHA256)
132}
133
134pub fn fn_rsa_pkcs1_signature_algorithm() -> Result<SignatureScheme, FnError> {
135    Ok(SignatureScheme::RSA_PKCS1_SHA256)
136}
137
138pub fn fn_invalid_signature_algorithm() -> Result<SignatureScheme, FnError> {
139    Ok(SignatureScheme::Unknown(0x0100))
140}
141
142pub fn fn_ecdsa_signature_algorithm() -> Result<SignatureScheme, FnError> {
143    Ok(SignatureScheme::ECDSA_NISTP256_SHA256)
144}
tlspuffin/tls/fn_cert.rs

tlspuffin/tls/
fn_cert.rs
