mirror of
https://github.com/pcvolkmer/cert-tools.git
synced 2025-07-01 22:12:55 +00:00
refactor: move implementation into lib.rs
This commit is contained in:
353
src/lib.rs
Normal file
353
src/lib.rs
Normal file
@ -0,0 +1,353 @@
|
||||
/*
|
||||
* This file is part of cert-tools
|
||||
*
|
||||
* Copyright (C) 2025 the original author or authors.
|
||||
*
|
||||
* This program is free software: you can redistribute it and/or modify
|
||||
* it under the terms of the GNU General Public License as published by
|
||||
* the Free Software Foundation, either version 3 of the License, or
|
||||
* (at your option) any later version.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* along with this program. If not, see <https://www.gnu.org/licenses/>.
|
||||
*/
|
||||
|
||||
use console::style;
|
||||
use openssl::asn1::Asn1Time;
|
||||
use openssl::hash::MessageDigest;
|
||||
use openssl::nid::Nid;
|
||||
use openssl::pkey::{PKey, PKeyRef, Public};
|
||||
use openssl::x509::X509;
|
||||
use std::fmt::Display;
|
||||
use std::fs;
|
||||
use std::hash::{Hash, Hasher};
|
||||
use std::path::Path;
|
||||
use std::time::{SystemTime, UNIX_EPOCH};
|
||||
|
||||
pub fn print_cert(cert: &Certificate) {
|
||||
println!(
|
||||
"{}
|
||||
Issuer: {}
|
||||
Gültigkeit: Gültig von: {} bis: {}
|
||||
SHA-1-Fingerprint: {}
|
||||
SHA-256-Fingerprint: {}
|
||||
Subject-Key-Id: {}
|
||||
Authority-Key-Id: {}",
|
||||
style(format!("Name: {}", cert.name()))
|
||||
.bold()
|
||||
.underlined(),
|
||||
cert.issuer(),
|
||||
if cert.is_valid_not_before(&SystemTime::now()) {
|
||||
style(cert.not_before().to_string())
|
||||
} else {
|
||||
style(cert.not_before().to_string()).red()
|
||||
},
|
||||
if cert.is_valid_not_after(&SystemTime::now()) {
|
||||
style(cert.not_after().to_string())
|
||||
} else {
|
||||
style(cert.not_after().to_string()).red()
|
||||
},
|
||||
cert.fingerprint().sha1,
|
||||
cert.fingerprint().sha256,
|
||||
cert.subject_key_id(),
|
||||
cert.authority_key_id(),
|
||||
);
|
||||
if !cert.dns_names().is_empty() {
|
||||
println!(
|
||||
"DNS Names: {}",
|
||||
style(cert.dns_names().join(", "))
|
||||
);
|
||||
}
|
||||
}
|
||||
|
||||
pub fn hex_encode<T: AsRef<[u8]>>(s: T) -> String {
|
||||
s.as_ref()
|
||||
.iter()
|
||||
.map(|b| format!("{:02x}", b))
|
||||
.collect::<Vec<_>>()
|
||||
.join(":")
|
||||
.to_ascii_uppercase()
|
||||
}
|
||||
|
||||
fn asn1time(time: &SystemTime) -> Asn1Time {
|
||||
Asn1Time::from_unix(
|
||||
time.duration_since(UNIX_EPOCH)
|
||||
.expect("time not went backwards")
|
||||
.as_secs() as i64,
|
||||
)
|
||||
.unwrap()
|
||||
}
|
||||
|
||||
#[derive(PartialEq)]
|
||||
pub enum StringValue {
|
||||
Valid(String),
|
||||
Invalid,
|
||||
Empty,
|
||||
}
|
||||
|
||||
impl Display for StringValue {
|
||||
fn fmt(&self, f: &mut std::fmt::Formatter) -> std::fmt::Result {
|
||||
match self {
|
||||
StringValue::Valid(val) => write!(f, "{}", val),
|
||||
StringValue::Invalid => write!(f, "*Invalid*"),
|
||||
StringValue::Empty => write!(f, "*Empty*"),
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
impl From<String> for StringValue {
|
||||
fn from(value: String) -> Self {
|
||||
if value.trim().is_empty() {
|
||||
return StringValue::Empty;
|
||||
}
|
||||
StringValue::Valid(value)
|
||||
}
|
||||
}
|
||||
|
||||
pub struct PrivateKey {
|
||||
modulus: StringValue,
|
||||
}
|
||||
|
||||
impl PrivateKey {
|
||||
pub fn read(path: &Path) -> Result<Self, String> {
|
||||
let file = fs::read(path).map_err(|err| err.to_string())?;
|
||||
let key = PKey::private_key_from_pem(&file).map_err(|err| err.to_string())?;
|
||||
|
||||
Ok(Self {
|
||||
modulus: hex_encode(key.rsa().unwrap().n().to_vec()).into(),
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
pub struct Fingerprint {
|
||||
pub sha1: StringValue,
|
||||
pub sha256: StringValue,
|
||||
}
|
||||
|
||||
#[derive(Clone, Eq, PartialEq)]
|
||||
pub struct Certificate {
|
||||
cert: X509,
|
||||
}
|
||||
|
||||
impl Certificate {
|
||||
pub fn from_x509(x509: &X509) -> Result<Self, String> {
|
||||
let result = Self { cert: x509.clone() };
|
||||
Ok(result)
|
||||
}
|
||||
|
||||
pub fn to_pem(&self) -> Result<String, ()> {
|
||||
match self.cert.to_pem() {
|
||||
Ok(pem) => String::from_utf8(pem).map_err(|_| ()),
|
||||
Err(_) => Err(()),
|
||||
}
|
||||
}
|
||||
|
||||
pub fn name(&self) -> StringValue {
|
||||
match self
|
||||
.cert
|
||||
.subject_name()
|
||||
.entries_by_nid(Nid::COMMONNAME)
|
||||
.last()
|
||||
{
|
||||
None => StringValue::Invalid,
|
||||
Some(cn) => match String::from_utf8(cn.data().as_slice().to_vec()) {
|
||||
Ok(value) => StringValue::Valid(value),
|
||||
_ => StringValue::Invalid,
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
pub fn fingerprint(&self) -> Fingerprint {
|
||||
Fingerprint {
|
||||
sha1: match self.cert.digest(MessageDigest::sha1()) {
|
||||
Ok(value) => StringValue::Valid(hex_encode(value)),
|
||||
_ => StringValue::Empty,
|
||||
},
|
||||
sha256: match self.cert.digest(MessageDigest::sha256()) {
|
||||
Ok(value) => StringValue::Valid(hex_encode(value)),
|
||||
_ => StringValue::Empty,
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
pub fn issuer(&self) -> StringValue {
|
||||
match self
|
||||
.cert
|
||||
.issuer_name()
|
||||
.entries_by_nid(Nid::COMMONNAME)
|
||||
.last()
|
||||
{
|
||||
None => StringValue::Invalid,
|
||||
Some(cn) => match String::from_utf8(cn.data().as_slice().to_vec()) {
|
||||
Ok(value) => StringValue::Valid(value),
|
||||
_ => StringValue::Invalid,
|
||||
},
|
||||
}
|
||||
}
|
||||
|
||||
pub fn not_before(&self) -> StringValue {
|
||||
StringValue::Valid(self.cert.not_before().to_string())
|
||||
}
|
||||
|
||||
pub fn is_valid_not_before(&self, time: &SystemTime) -> bool {
|
||||
self.cert.not_before().lt(&asn1time(time))
|
||||
}
|
||||
|
||||
pub fn not_after(&self) -> StringValue {
|
||||
StringValue::Valid(self.cert.not_after().to_string())
|
||||
}
|
||||
|
||||
pub fn is_valid_not_after(&self, time: &SystemTime) -> bool {
|
||||
self.cert.not_after().gt(&asn1time(time))
|
||||
}
|
||||
|
||||
pub fn dns_names(&self) -> Vec<String> {
|
||||
match self.cert.subject_alt_names() {
|
||||
Some(names) => names
|
||||
.iter()
|
||||
.map(|name| name.dnsname().unwrap_or_default().to_string())
|
||||
.filter(|name| !name.trim().is_empty())
|
||||
.collect::<Vec<_>>(),
|
||||
_ => vec![],
|
||||
}
|
||||
}
|
||||
|
||||
pub fn key_modulo(&self) -> StringValue {
|
||||
match self.cert.public_key() {
|
||||
Ok(key) => match key.rsa() {
|
||||
Ok(rsa) => StringValue::Valid(hex_encode(rsa.n().to_vec())),
|
||||
_ => StringValue::Invalid,
|
||||
},
|
||||
_ => StringValue::Empty,
|
||||
}
|
||||
}
|
||||
|
||||
pub fn subject_key_id(&self) -> StringValue {
|
||||
match self.cert.subject_key_id() {
|
||||
Some(id) => StringValue::Valid(hex_encode(id.as_slice())),
|
||||
_ => StringValue::Empty,
|
||||
}
|
||||
}
|
||||
|
||||
pub fn authority_key_id(&self) -> StringValue {
|
||||
match self.cert.authority_key_id() {
|
||||
Some(id) => StringValue::Valid(hex_encode(id.as_slice())),
|
||||
_ => StringValue::Empty,
|
||||
}
|
||||
}
|
||||
|
||||
fn public_key(&self) -> Result<PKey<Public>, ()> {
|
||||
self.cert.public_key().map_err(drop)
|
||||
}
|
||||
|
||||
#[allow(dead_code)]
|
||||
pub fn is_ca(&self) -> bool {
|
||||
if let Some(text) = self.to_text() {
|
||||
return text.contains("CA:TRUE");
|
||||
}
|
||||
false
|
||||
}
|
||||
|
||||
fn verify(&self, key: &PKeyRef<Public>) -> bool {
|
||||
if let Ok(value) = self.cert.verify(key) {
|
||||
return value;
|
||||
}
|
||||
false
|
||||
}
|
||||
|
||||
pub fn within_timerange(&self, time: &SystemTime) -> bool {
|
||||
self.is_valid_not_before(time) && self.is_valid_not_after(time)
|
||||
}
|
||||
|
||||
#[allow(dead_code)]
|
||||
pub fn to_text(&self) -> Option<String> {
|
||||
match self.cert.to_text() {
|
||||
Ok(text) => match String::from_utf8(text) {
|
||||
Ok(value) => Some(value),
|
||||
_ => None,
|
||||
},
|
||||
_ => None,
|
||||
}
|
||||
}
|
||||
|
||||
pub fn public_key_matches(&self, private_key: PrivateKey) -> bool {
|
||||
if self.key_modulo().to_string() == private_key.modulus.to_string() {
|
||||
return true;
|
||||
}
|
||||
false
|
||||
}
|
||||
}
|
||||
|
||||
impl Hash for Certificate {
|
||||
fn hash<H: Hasher>(&self, state: &mut H) {
|
||||
self.fingerprint().sha256.to_string().hash(state);
|
||||
}
|
||||
}
|
||||
|
||||
pub struct Chain {
|
||||
certs: Vec<Certificate>,
|
||||
}
|
||||
|
||||
impl Chain {
|
||||
pub fn read(path: &Path) -> Result<Self, String> {
|
||||
let file = fs::read(path).map_err(|err| err.to_string())?;
|
||||
let certs = X509::stack_from_pem(&file).map_err(|err| err.to_string())?;
|
||||
|
||||
let certs = certs
|
||||
.iter()
|
||||
.map(|cert| Certificate::from_x509(cert).unwrap())
|
||||
.collect::<Vec<_>>();
|
||||
|
||||
Ok(Self { certs })
|
||||
}
|
||||
|
||||
pub fn from(certs: Vec<Certificate>) -> Self {
|
||||
Self { certs }
|
||||
}
|
||||
|
||||
pub fn certs(&self) -> &Vec<Certificate> {
|
||||
&self.certs
|
||||
}
|
||||
|
||||
pub fn into_vec(self) -> Vec<Certificate> {
|
||||
self.certs
|
||||
}
|
||||
|
||||
pub fn push(&mut self, cert: Certificate) {
|
||||
self.certs.push(cert);
|
||||
}
|
||||
|
||||
pub fn is_valid(&self) -> bool {
|
||||
let mut x: Option<PKey<Public>> = None;
|
||||
let mut time_issue = false;
|
||||
for cert in self.certs.iter().rev() {
|
||||
if !cert.within_timerange(&SystemTime::now()) {
|
||||
time_issue = true;
|
||||
}
|
||||
if let Some(x) = &x {
|
||||
if !cert.verify(x) {
|
||||
return false;
|
||||
}
|
||||
}
|
||||
x = match cert.public_key() {
|
||||
Ok(public_key) => Some(public_key),
|
||||
Err(_) => None,
|
||||
}
|
||||
}
|
||||
!time_issue && !self.certs.is_empty()
|
||||
}
|
||||
|
||||
pub fn has_missing_tail(&self) -> bool {
|
||||
match self.certs.last() {
|
||||
Some(cert) => {
|
||||
matches!(cert.authority_key_id(), StringValue::Valid(_))
|
||||
}
|
||||
_ => false,
|
||||
}
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user