cacert-gosigner/pkg/messages/messages.go

/*
Copyright 2022 CAcert Inc.
SPDX-License-Identifier: Apache-2.0

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

    http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/

//go:generate go run github.com/shamaton/msgpackgen

// Package messages contains structure definitions for protocol messages
package messages

import (
	"crypto/x509"
	"encoding/json"
	"encoding/pem"
	"fmt"
	"math/big"
	"sort"
	"strings"
	"time"

	// required for msgpackgen
	_ "github.com/dave/jennifer"
	"github.com/google/uuid"
)

type CommandCode int8

const (
	CmdUndef CommandCode = iota
	CmdHealth
	CmdFetchCRL
)

var commandNames = map[CommandCode]string{
	CmdUndef:    "UNDEFINED",
	CmdHealth:   "HEALTH",
	CmdFetchCRL: "FETCH CRL",
}

func (c CommandCode) String() string {
	if name, ok := commandNames[c]; ok {
		return name
	}

	return fmt.Sprintf("unknown %d", c)
}

type ResponseCode int8

const (
	RespError ResponseCode = -1
	RespUndef ResponseCode = iota
	RespHealth
	RespFetchCRL
)

var responseNames = map[ResponseCode]string{
	RespError:    "ERROR",
	RespUndef:    "UNDEFINED",
	RespHealth:   "HEALTH",
	RespFetchCRL: "FETCH CRL",
}

func (c ResponseCode) String() string {
	if name, ok := responseNames[c]; ok {
		return name
	}

	return fmt.Sprintf("unknown %d", c)
}

type CommandAnnounce struct {
	Code    CommandCode `msgpack:"code"`
	ID      string      `msgpack:"id"`
	Created time.Time   `msgpack:"created"`
}

func (r *CommandAnnounce) String() string {
	return fmt.Sprintf("code=%s, id=%s, created=%s", r.Code, r.ID, r.Created.Format(time.RFC3339))
}

func BuildCommandAnnounce(code CommandCode) *CommandAnnounce {
	commandID := uuid.NewString()

	return &CommandAnnounce{Code: code, ID: commandID, Created: time.Now().UTC()}
}

type ResponseAnnounce struct {
	Code    ResponseCode `msgpack:"code"`
	Created time.Time    `msgpack:"created"`
	ID      string       `msgpack:"id"`
}

func (r *ResponseAnnounce) String() string {
	return fmt.Sprintf("code=%s, id=%s, created=%s", r.Code, r.ID, r.Created.Format(time.RFC3339))
}

func BuildResponseAnnounce(code ResponseCode, commandID string) *ResponseAnnounce {
	return &ResponseAnnounce{Code: code, ID: commandID, Created: time.Now().UTC()}
}

type HealthCommand struct {
}

func (h *HealthCommand) String() string {
	return ""
}

type FetchCRLCommand struct {
	IssuerID    string `msgpack:"issuer_id"`
	LastKnownID []byte `msgpack:"last_known_id"`
}

func (f *FetchCRLCommand) String() string {
	builder := &strings.Builder{}

	_, _ = fmt.Fprintf(builder, "issuerId='%s'", f.IssuerID)

	if f.LastKnownID != nil {
		_, _ = fmt.Fprintf(builder, ", lastKnownId=0x%x", new(big.Int).SetBytes(f.LastKnownID))
	}

	return builder.String()
}

type ProfileUsage uint8

const (
	UsageInvalid ProfileUsage = iota

	UsageOCSP

	UsageClient
	UsageCode
	UsagePerson
	UsageServer
	UsageServerClient

	UsageOrgClient
	UsageOrgCode
	UsageOrgEmail
	UsageOrgPerson
	UsageOrgServer
	UsageOrgServerClient
)

var validProfileUsages = map[string]ProfileUsage{
	"ocsp": UsageOCSP,

	"client":        UsageClient,
	"code":          UsageCode,
	"person":        UsagePerson,
	"server":        UsageServer,
	"server_client": UsageServerClient,

	"org_client":        UsageOrgClient,
	"org_code":          UsageOrgCode,
	"org_email":         UsageOrgEmail,
	"org_person":        UsageOrgPerson,
	"org_server":        UsageOrgServer,
	"org_server_client": UsageOrgServerClient,
}

var profileUsageDetails = map[ProfileUsage]struct {
	Name        string
	Description string
}{
	UsageInvalid: {"invalid", "Invalid certificate profile, not to be used"},

	UsageOCSP: {"ocsp", "OCSP responder signing certificate"},

	UsageClient:       {"client", "machine TLS client certificate"},
	UsageCode:         {"code", "individual code signing certificate"},
	UsagePerson:       {"person", "person identity certificate"},
	UsageServer:       {"server", "TLS server certificate"},
	UsageServerClient: {"server_client", "combined TLS server and client certificate"},

	UsageOrgClient: {"org_client", "organization machine TLS client certificate"},
	UsageOrgCode:   {"org_code", "organization code signing certificate"},
	UsageOrgEmail:  {"org_email", "organization email certificate"},
	UsageOrgPerson: {"org_person", "organizational person identity certificate"},
	UsageOrgServer: {"org_server", "organization TLS server certificate"},
	UsageOrgServerClient: {
		"org_server_client",
		"combined organization TLS server and client certificate",
	},
}

func (p ProfileUsage) String() string {
	name, ok := profileUsageDetails[p]
	if !ok {
		return fmt.Sprintf("unknown profile usage %d", p)
	}

	return name.Name
}

func (p ProfileUsage) Description() string {
	name, ok := profileUsageDetails[p]
	if !ok {
		return fmt.Sprintf("unknown profile usage %d", p)
	}

	return name.Description
}

func ParseUsage(u string) (ProfileUsage, error) {
	usage, ok := validProfileUsages[u]
	if !ok {
		return UsageInvalid, fmt.Errorf("unsupported profile usage: %s", u)
	}

	return usage, nil
}

type CAProfile struct {
	Name   string       `json:"name"`
	UseFor ProfileUsage `json:"use-for"`
}

func (p CAProfile) String() string {
	return fmt.Sprintf("profile['%s': '%s']", p.Name, p.UseFor)
}

type CertificateStatus string

const (
	CertStatusOk     CertificateStatus = "ok"
	CertStatusFailed CertificateStatus = "failed"
)

type CertificateInfo struct {
	Status     CertificateStatus `json:"status"`
	Signing    bool              `json:"signing"`
	Profiles   []CAProfile       `json:"profiles,omitempty"`
	ValidUntil time.Time         `json:"valid-until"`
}

func (i CertificateInfo) String() string {
	marshal, _ := json.Marshal(i)

	return string(marshal)
}

var CertificateInfoFailed = CertificateInfo{
	Status:  CertStatusFailed,
	Signing: false,
}

func ParseCertificateInfo(info string) (*CertificateInfo, error) {
	certInfo := CertificateInfo{}

	err := json.Unmarshal([]byte(info), &certInfo)
	if err != nil {
		return nil, fmt.Errorf("could not parse certificate information: %w", err)
	}

	return &certInfo, nil
}

type HealthInfo struct {
	Source   string
	Healthy  bool
	MoreInfo map[string]string
}

func (i *HealthInfo) String() string {
	builder := &strings.Builder{}

	_, _ = fmt.Fprintf(builder, "source: %s, healthy: %v", i.Source, i.Healthy)

	if len(i.MoreInfo) > 0 {
		keys := make([]string, 0, len(i.MoreInfo))
		parts := make([]string, len(i.MoreInfo))

		for k := range i.MoreInfo {
			keys = append(keys, k)
		}

		sort.Strings(keys)

		for j, k := range keys {
			parts[j] = fmt.Sprintf("'%s': '%s'", k, i.MoreInfo[k])
		}

		builder.WriteRune('[')
		builder.WriteString(strings.Join(parts, ", "))
		builder.WriteRune(']')
	}

	return builder.String()
}

type HealthResponse struct {
	Version string `msgpack:"version"`
	Healthy bool   `msgpack:"healthy"`
	Info    []*HealthInfo
}

func (h *HealthResponse) String() string {
	builder := &strings.Builder{}

	_, _ = fmt.Fprintf(builder, "signer version=%s, healthy=%v, health data=[", h.Version, h.Healthy)

	infos := make([]string, len(h.Info))

	for i, info := range h.Info {
		infos[i] = fmt.Sprintf("{%s}", info)
	}

	builder.WriteString(strings.Join(infos, ", "))

	builder.WriteRune(']')

	return builder.String()
}

type FetchCRLResponse struct {
	IssuerID  string `msgpack:"issuer_id"`
	IsDelta   bool   `msgpack:"is_delta"`
	UnChanged bool   `msgpack:"unchanged"`
	CRLData   []byte `msgpack:"crl_data"`
	CRLNumber []byte `msgpack:"crl_number"`
}

func (r *FetchCRLResponse) String() string {
	builder := &strings.Builder{}

	_, _ = fmt.Fprintf(
		builder,
		"issuer id=%s, delta=%t, unchanged=%t, CRL number=0x%x",
		r.IssuerID,
		r.IsDelta,
		r.UnChanged,
		new(big.Int).SetBytes(r.CRLNumber),
	)

	if r.UnChanged {
		return builder.String()
	}

	if r.IsDelta {
		_, _ = fmt.Fprintf(builder, ", delta CRL data of %d bytes not shown", len(r.CRLData))

		return builder.String()
	}

	revocationList, err := x509.ParseRevocationList(r.CRLData)
	if err != nil {
		_, _ = fmt.Fprintf(builder, ", could not parse CRL: %s", err.Error())

		return builder.String()
	}

	_, _ = fmt.Fprintf(
		builder,
		", CRL info: issuer=%s, number=0x%x, next update=%s, revoked certificates=%d",
		revocationList.Issuer,
		revocationList.Number,
		revocationList.NextUpdate,
		len(revocationList.RevokedCertificates),
	)
	_, _ = builder.WriteString(", CRL data:\n")
	_ = pem.Encode(builder, &pem.Block{
		Type:  "CERTIFICATE REVOCATION LIST",
		Bytes: r.CRLData,
	})

	return builder.String()
}

type ErrorResponse struct {
	Message string `msgpack:"message"`
}

func (e *ErrorResponse) String() string {
	return fmt.Sprintf("message=%s", e.Message)
}