| 1 | |
|
| 2 | |
|
| 3 | |
|
| 4 | |
|
| 5 | | use anyhow::{bail, Context, Result}; |
| 6 | | use oxy_core::identity::Identity; |
| 7 | | use serde_json::{json, Value as Json}; |
| 8 | | use spectra_core::event::Event; |
| 9 | | use spectra_core::keys::KeyPair; |
| 10 | | use spectra_core::ledger::Ledger; |
| 11 | | use spectra_core::proof::Proof; |
| 12 | |
|
| 13 | |
|
| 14 | 9× | pub async fn latest_tls(ledger: &Ledger) -> Result<Option<Event>> { |
| 15 | 9× | let mut last = None; |
| 16 | 9× | let mut from = 1; |
| 17 | | loop { |
| 18 | 15× | let rows = ledger.events_of_kinds(from, &["instance.tls"], 1000).await?; |
| 19 | 15× | match rows.last() { |
| 20 | 6× | Some(e) => { |
| 21 | 6× | from = e.seq + 1; |
| 22 | 6× | last = Some(e.clone()); |
| 23 | 6× | } |
| 24 | 9× | None => return Ok(last), |
| 25 | | } |
| 26 | | } |
| 27 | 9× | } |
| 28 | |
|
| 29 | |
|
| 30 | |
|
| 31 | 4× | pub async fn record_tls(ledger: &Ledger, instance: &KeyPair, spki: &[u8; 32], names: &[String]) -> Result<bool> { |
| 32 | 4× | let hex_spki = hex::encode(spki); |
| 33 | 4× | if let Some(e) = latest_tls(ledger).await? { |
| 34 | 1× | if e.json().get("spki_sha256").and_then(Json::as_str) == Some(hex_spki.as_str()) { |
| 35 | 1× | return Ok(false); |
| 36 | 0× | } |
| 37 | 3× | } |
| 38 | 3× | let payload = json!({ "spki_sha256": hex_spki, "names": names }); |
| 39 | 3× | ledger.append_one(spectra_core::principals::signed_event(instance, "system", "instance.tls", payload)).await?; |
| 40 | 3× | Ok(true) |
| 41 | 4× | } |
| 42 | |
|
| 43 | |
|
| 44 | | #[derive(Clone, Debug)] |
| 45 | | pub struct Checked { |
| 46 | | pub name: String, |
| 47 | | pub instance: Identity, |
| 48 | | pub owner: Option<String>, |
| 49 | | |
| 50 | | pub spki_sha256: [u8; 32], |
| 51 | | } |
| 52 | |
|
| 53 | |
|
| 54 | |
|
| 55 | 2× | pub fn check(answer: &Json, seen: &[u8; 32]) -> Result<Checked> { |
| 56 | 2× | let ip = answer.get("instance").context("no instance in the answer")?; |
| 57 | 2× | let bytes = ip.get("identity").and_then(Json::as_str).and_then(|h| hex::decode(h).ok()).context("no instance identity")?; |
| 58 | 2× | let instance = Identity::decode(&bytes).map_err(|e| anyhow::anyhow!("malformed instance identity: {e}"))?; |
| 59 | 2× | let tls = answer.get("tls").filter(|t| !t.is_null()).context("the server has not signed a TLS certificate")?; |
| 60 | 2× | let payload = tls.get("payload").context("no TLS payload")?; |
| 61 | 2× | let proof = tls.get("proof").and_then(Json::as_str).and_then(|h| hex::decode(h).ok()).context("no TLS proof")?; |
| 62 | 2× | let proof = Proof::decode(&proof).map_err(|e| anyhow::anyhow!(e))?; |
| 63 | 2× | if proof.key() != instance.hash().0 || proof.method != "cli" { |
| 64 | 0× | bail!("the certificate is not vouched for by the instance key"); |
| 65 | 2× | } |
| 66 | 2× | proof |
| 67 | 2× | .verify(&instance, Some(&spectra_core::event::canonical_json(payload))) |
| 68 | 2× | .map_err(|e| anyhow::anyhow!("the instance's signature on its certificate: {e}"))?; |
| 69 | 2× | let named = payload.get("spki_sha256").and_then(Json::as_str).context("no pin in the TLS record")?; |
| 70 | 2× | if named != hex::encode(seen) { |
| 71 | 1× | bail!("the server presented a certificate its instance key did not sign"); |
| 72 | 1× | } |
| 73 | 1× | Ok(Checked { |
| 74 | 1× | name: answer.get("name").and_then(Json::as_str).unwrap_or("").to_string(), |
| 75 | 1× | instance, |
| 76 | 1× | owner: answer.get("owner").and_then(Json::as_str).map(String::from), |
| 77 | 1× | spki_sha256: *seen, |
| 78 | 1× | }) |
| 79 | 2× | } |