x509-cert: wip: adds a builder for certificate

Author: baloo

Cargo.lock

@@ -55,7 +55,7 @@ pub use self::{
     sequence_of::{SequenceOf, SequenceOfIter},
     set_of::{SetOf, SetOfIter},
     teletex_string::TeletexStringRef,
-    utc_time::UtcTime,
+    utc_time::{UtcTime, MAX_YEAR},
     utf8_string::Utf8StringRef,
     videotex_string::VideotexStringRef,
 };

der/src/asn1.rs

@@ -20,14 +20,22 @@ const-oid = { version = "=0.10.0-pre", features = ["db"], path = "../const-oid"
 der = { version = "=0.7.0-pre", features = ["derive", "alloc", "flagset"], path = "../der" }
 flagset = { version = "0.4.3" }
 spki = { version = "=0.7.0-pre", path = "../spki", features = ["alloc"] }
+sha-1 = { version = "0.10.0", optional = true }
 
 [dev-dependencies]
 hex-literal = "0.3"
+rand = "0.8.5"
+rsa = "0.7.2"
 rstest = "0.16"
+serde = { version = "1.0", features = ["derive"] }
+serde_json = "1.0.91"
+sha2 = { version = "0.10.6", features = ["oid"] }
+tempfile = "3.3.0"
 
 [features]
 alloc = ["der/alloc"]
 arbitrary = ["std", "dep:arbitrary", "const-oid/arbitrary", "der/arbitrary", "spki/arbitrary"]
+builder = ["std", "sha-1/default"]
 pem = ["alloc", "der/pem"]
 std = ["der/std", "spki/std"]
 

x509-cert/Cargo.toml

@@ -0,0 +1,350 @@
+//! X509 Certificate builder
+
+use alloc::vec::Vec;
+use der::asn1::{BitString, OctetString};
+use sha1::{Digest, Sha1};
+use spki::{AlgorithmIdentifierOwned, SubjectPublicKeyInfoOwned};
+
+use crate::{
+    certificate::{Certificate, TbsCertificate, Version},
+    ext::{
+        pkix::{
+            AuthorityKeyIdentifier, BasicConstraints, KeyUsage, KeyUsages, SubjectKeyIdentifier,
+        },
+        AsExtension, Extension,
+    },
+    name::Name,
+    serial_number::SerialNumber,
+    time::Validity,
+};
+
+type Result<T> = core::result::Result<T, der::Error>;
+
+/// UniqueIds holds the optional attributes `issuerUniqueID` and `subjectUniqueID`
+/// to be filled in the TBSCertificate if version v2 or v3.
+///
+/// See X.509 `TbsCertificate` as defined in [RFC 5280 Section 4.1]
+pub struct UniqueIds {
+    /// ```text
+    /// issuerUniqueID  [1]  IMPLICIT UniqueIdentifier OPTIONAL,
+    ///                      -- If present, version MUST be v2 or v3
+    /// ```
+    pub issuer_unique_id: Option<BitString>,
+    /// ```text
+    /// subjectUniqueID [2]  IMPLICIT UniqueIdentifier OPTIONAL,
+    ///                      -- If present, version MUST be v2 or v3
+    /// ```
+    pub subject_unique_id: Option<BitString>,
+}
+
+impl UniqueIds {
+    fn get_unique_ids(&self) -> (Option<BitString>, Option<BitString>) {
+        (
+            self.issuer_unique_id.clone(),
+            self.subject_unique_id.clone(),
+        )
+    }
+}
+
+/// The type of certificate to build
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub enum Profile {
+    /// Build a root CA certificate
+    Root,
+    /// Build an intermediate sub CA certificate
+    SubCA {
+        /// issuer   Name,
+        /// represents the name signing the certificate
+        issuer: Name,
+        /// pathLenConstraint       INTEGER (0..MAX) OPTIONAL
+        /// BasicConstraints as defined in [RFC 5280 Section 4.2.1.9].
+        path_len_constraint: Option<u8>,
+    },
+    /// Build an end certificate
+    Leaf {
+        /// issuer   Name,
+        /// represents the name signing the certificate
+        issuer: Name,
+    },
+}
+
+impl Profile {
+    fn get_issuer(&self, subject: &Name) -> Name {
+        match self {
+            Profile::Root => subject.clone(),
+            Profile::SubCA { issuer, .. } => issuer.clone(),
+            Profile::Leaf { issuer } => issuer.clone(),
+        }
+    }
+
+    fn build_extensions(
+        &self,
+        spk: &SubjectPublicKeyInfoOwned,
+        issuer_spk: &SubjectPublicKeyInfoOwned,
+    ) -> Result<Vec<Extension>> {
+        let mut extensions: Vec<Extension> = Vec::new();
+
+        extensions.push({
+            let result = Sha1::digest(spk.subject_public_key.raw_bytes());
+            SubjectKeyIdentifier(OctetString::new(result.to_vec())?).to_extension()?
+        });
+
+        // Build Authority Key Identifier
+        match self {
+            Profile::Root => {}
+            _ => {
+                let mut hasher = Sha1::new();
+                hasher.update(issuer_spk.subject_public_key.raw_bytes());
+                let result = hasher.finalize();
+
+                extensions.push(
+                    AuthorityKeyIdentifier {
+                        key_identifier: Some(OctetString::new(result.to_vec())?),
+                        authority_cert_issuer: None,
+                        authority_cert_serial_number: None,
+                    }
+                    .to_extension()?,
+                );
+            }
+        }
+
+        // Build Basic Contraints extensions
+        extensions.push(match self {
+            Profile::Root => BasicConstraints {
+                ca: true,
+                path_len_constraint: None,
+            }
+            .to_extension()?,
+            Profile::SubCA {
+                path_len_constraint,
+                ..
+            } => BasicConstraints {
+                ca: true,
+                path_len_constraint: *path_len_constraint,
+            }
+            .to_extension()?,
+            Profile::Leaf { .. } => BasicConstraints {
+                ca: false,
+                path_len_constraint: None,
+            }
+            .to_extension()?,
+        });
+
+        // Build Key Usage extension
+        match self {
+            Profile::Root | Profile::SubCA { .. } => {
+                extensions.push(
+                    KeyUsage(
+                        KeyUsages::DigitalSignature | KeyUsages::KeyCertSign | KeyUsages::CRLSign,
+                    )
+                    .to_extension()?,
+                );
+            }
+            Profile::Leaf { .. } => {
+                //todo!();
+            }
+        }
+
+        Ok(extensions)
+    }
+}
+
+/// The version of the Certificate to build.
+/// All newly built certificate should use `CertificateVersion::V3`
+pub enum CertificateVersion {
+    /// Generate a X509 version 1
+    V1,
+    /// Generate a X509 version 2
+    V2(UniqueIds),
+    /// Generate a X509 version 3
+    V3(UniqueIds),
+}
+
+impl From<CertificateVersion> for Version {
+    fn from(cv: CertificateVersion) -> Version {
+        use CertificateVersion::*;
+        match cv {
+            V1 => Version::V1,
+            V2(_) => Version::V2,
+            V3(_) => Version::V3,
+        }
+    }
+}
+
+/// X509 Certificate builder
+///
+/// ```
+/// use der::Decode;
+/// use x509_cert::spki::SubjectPublicKeyInfoOwned;
+/// use x509_cert::builder::{CertificateBuilder, CertificateVersion, Profile, UniqueIds};
+/// use x509_cert::name::Name;
+/// use x509_cert::serial_number::SerialNumber;
+/// use x509_cert::time::Validity;
+///
+/// # use std::time::Duration;
+/// # use x509_cert::constants;
+/// # use x509_cert::certificate::TbsCertificate;
+/// # use x509_cert::builder::Signer;
+/// # const RSA_2048_DER: &[u8] = include_bytes!("../tests/examples/rsa2048-pub.der");
+///
+/// # struct RsaCertSigner;
+/// # impl Signer for RsaCertSigner {
+/// #     type Alg = constants::RsaWithSha256;
+///
+/// #     fn signature_algorithm(&self) -> Self::Alg {
+/// #         constants::RsaWithSha256
+/// #     }
+///
+/// #     fn public_key(&self) -> SubjectPublicKeyInfoOwned {
+/// #         SubjectPublicKeyInfoOwned::try_from(RSA_2048_DER).expect("get rsa pub key")
+/// #     }
+///
+/// #     fn sign(&self, input: &TbsCertificate) -> Vec<u8> {
+/// #         todo!();
+/// #     }
+/// # }
+///
+/// let uids = UniqueIds {
+///     issuer_unique_id: None,
+///     subject_unique_id: None,
+/// };
+///
+/// let serial_number = SerialNumber::from(42u32);
+/// let validity = Validity::from_now(Duration::new(5, 0)).unwrap();
+/// let profile = Profile::Root;
+/// let subject =
+///     Name::encode_from_string("CN=World domination corporation,O=World domination Inc,C=US")
+///         .unwrap();
+/// let subject = Name::from_der(&subject).unwrap();
+/// let pub_key = SubjectPublicKeyInfoOwned::try_from(RSA_2048_DER).expect("get rsa pub key");
+///
+/// let mut builder = CertificateBuilder::new(
+///     profile,
+///     CertificateVersion::V3(uids),
+///     serial_number,
+///     validity,
+///     subject,
+///     pub_key,
+///     &RsaCertSigner,
+/// )
+/// .expect("Create certificate");
+/// ```
+pub struct CertificateBuilder<'s, S: Signer> {
+    version: Version,
+    serial_number: SerialNumber,
+    signature_alg: AlgorithmIdentifierOwned,
+    issuer: Name,
+    validity: Validity,
+    subject: Name,
+    subject_public_key_info: SubjectPublicKeyInfoOwned,
+    issuer_unique_id: Option<BitString>,
+    subject_unique_id: Option<BitString>,
+
+    extensions: Vec<Extension>,
+
+    signer: &'s S,
+}
+
+impl<'s, S: Signer> CertificateBuilder<'s, S> {
+    /// Creates a new certificate builder
+    pub fn new(
+        profile: Profile,
+        version: CertificateVersion,
+        serial_number: SerialNumber,
+        mut validity: Validity,
+        subject: Name,
+        subject_public_key_info: SubjectPublicKeyInfoOwned,
+        signer: &'s S,
+    ) -> Result<Self> {
+        let signer_pub = signer.public_key();
+
+        let signature_alg = signer.signature_algorithm().identifier();
+        let issuer = profile.get_issuer(&subject);
+
+        validity.not_before.rfc5280_adjust_utc_time()?;
+        validity.not_after.rfc5280_adjust_utc_time()?;
+
+        let (version, (issuer_unique_id, subject_unique_id), extensions) = match version {
+            CertificateVersion::V1 => (Version::V1, (None, None), Vec::new()),
+            CertificateVersion::V2(uids) => (Version::V2, uids.get_unique_ids(), Vec::new()),
+            CertificateVersion::V3(uids) => (
+                Version::V3,
+                uids.get_unique_ids(),
+                profile.build_extensions(&subject_public_key_info, &signer_pub)?,
+            ),
+        };
+
+        Ok(Self {
+            version,
+            issuer_unique_id,
+            subject_unique_id,
+            serial_number,
+            issuer,
+            subject,
+            validity,
+            subject_public_key_info,
+            signature_alg,
+            extensions,
+            signer,
+        })
+    }
+
+    /// Add an extension to this certificate
+    pub fn add_extension<E: AsExtension>(&mut self, extension: &E) -> Result<()> {
+        self.extensions.push(extension.to_extension()?);
+        Ok(())
+    }
+
+    /// Run the certificate through the signer and build the end certificate.
+    pub fn build(&mut self) -> Result<Certificate> {
+        let extensions = if self.version == Version::V3 {
+            Some(self.extensions.clone())
+        } else {
+            None
+        };
+
+        let tbs_certificate = TbsCertificate {
+            version: self.version,
+            serial_number: self.serial_number.clone(),
+            signature: self.signature_alg.clone(),
+            issuer: self.issuer.clone(),
+            validity: self.validity,
+            subject: self.subject.clone(),
+            subject_public_key_info: self.subject_public_key_info.clone(),
+            issuer_unique_id: self.issuer_unique_id.clone(),
+            subject_unique_id: self.subject_unique_id.clone(),
+            extensions,
+        };
+
+        let signature = BitString::from_bytes(&self.signer.sign(&tbs_certificate))?;
+
+        let cert = Certificate {
+            tbs_certificate,
+            signature_algorithm: self.signature_alg.clone(),
+            signature,
+        };
+
+        Ok(cert)
+    }
+}
+
+/// The certificate algorithm used to sign the certificate
+pub trait CertSignatureAlgorithm {
+    /// Returns the `AlgorithmIdentifierOwned` used to sign the certificate
+    fn identifier(&self) -> AlgorithmIdentifierOwned;
+}
+
+/// Signer to be used to for signing the certificates
+pub trait Signer {
+    /// The type of signature expected from this signer
+    type Alg: CertSignatureAlgorithm;
+
+    /// The signature expected from this signer
+    fn signature_algorithm(&self) -> Self::Alg;
+
+    /// The SPKI encoded public key used by this signer
+    fn public_key(&self) -> SubjectPublicKeyInfoOwned;
+
+    /// The sign method should return the signature of the payload.
+    fn sign(&self, input: &TbsCertificate) -> Vec<u8>;
+}