dice-mfg-msgs: Impliment PlatformId::TryFrom<&PkiPath>

This is useful for pulling the PlatformId out of the cert chain produced
by the RoT.

Author: flihp

Cargo.lock

@@ -4,12 +4,14 @@ version = "0.2.1"
 edition = "2021"
 
 [dependencies]
+const-oid = { workspace = true, optional = true }
 corncobs.workspace = true
 hubpack.workspace = true
 serde = { workspace = true, features = ["derive"] }
 serde-big-array.workspace = true
 thiserror = { workspace = true, optional = true }
+x509-cert = { workspace = true, optional = true }
 zerocopy.workspace = true
 
 [features]
-std = ["thiserror"]
+std = ["const-oid/db", "thiserror", "x509-cert"]

dice-mfg-msgs/Cargo.toml

@@ -4,10 +4,20 @@
 
 #![cfg_attr(not(any(test, feature = "std")), no_std)]
 
+#[cfg(feature = "std")]
+use const_oid::db::rfc4519::{COMMON_NAME, COUNTRY_NAME, ORGANIZATION_NAME};
 use core::fmt;
 use hubpack::SerializedSize;
 use serde::{Deserialize, Serialize};
 use serde_big_array::BigArray;
+#[cfg(feature = "std")]
+use x509_cert::{
+    der::{
+        asn1::{PrintableString, Utf8StringRef},
+        Error as DerError,
+    },
+    PkiPath,
+};
 
 pub type MessageHash = [u8; 32];
 pub const NULL_HASH: MessageHash = [0u8; 32];
@@ -262,6 +272,79 @@ impl TryFrom<&[u8]> for PlatformId {
     }
 }
 
+#[cfg(feature = "std")]
+#[cfg_attr(any(test, feature = "std"), derive(thiserror::Error))]
+#[derive(Debug)]
+pub enum PlatformIdPkiPathError {
+    #[error("Failed to decode CountryName")]
+    CountryNameDecode(DerError),
+    #[error("Expected CountryName \"US\", got {0}")]
+    InvalidCountryName(String),
+    #[error("Failed to decode OrganizationName")]
+    OrganizationNameDecode(DerError),
+    #[error("Expected CountryName \"US\", got {0}")]
+    InvalidOrganizationName(String),
+    #[error("Failed to decode OrganizationName")]
+    CommonNameDecode(DerError),
+    #[error("More than one PlatformId found in PkiPath")]
+    MultiplePlatformIds,
+    #[error("No PlatformId found in PkiPath")]
+    NoPlatformId,
+}
+
+#[cfg(feature = "std")]
+impl TryFrom<&PkiPath> for PlatformId {
+    type Error = PlatformIdPkiPathError;
+    // Find the PlatformId in the provided cert chain. This value is stored in
+    // cert's `Subject` field. The Subject field C / Country and O /
+    // Organization must always be'US' and 'Oxide Computer Company'
+    // respectively. The PlatformId string is stored in the Subject CN /
+    // commonName.
+    fn try_from(pki_path: &PkiPath) -> Result<Self, Self::Error> {
+        let mut platform_id: Option<PlatformId> = None;
+        for cert in pki_path {
+            for elm in &cert.tbs_certificate.subject.0 {
+                for atav in elm.0.iter() {
+                    if atav.oid == COUNTRY_NAME {
+                        let country = PrintableString::try_from(&atav.value)
+                            .map_err(Self::Error::CountryNameDecode)?;
+                        let country: &str = country.as_ref();
+                        if country != "US" {
+                            return Err(Self::Error::InvalidCountryName(
+                                country.to_string(),
+                            ));
+                        }
+                    } else if atav.oid == ORGANIZATION_NAME {
+                        let organization = Utf8StringRef::try_from(&atav.value)
+                            .map_err(|e| {
+                                Self::Error::OrganizationNameDecode(e)
+                            })?;
+                        let organization: &str = organization.as_ref();
+                        if organization != "Oxide Computer Company" {
+                            return Err(Self::Error::InvalidOrganizationName(
+                                organization.to_string(),
+                            ));
+                        }
+                    } else if atav.oid == COMMON_NAME {
+                        let common = Utf8StringRef::try_from(&atav.value)
+                            .map_err(Self::Error::CommonNameDecode)?;
+                        let common: &str = common.as_ref();
+                        if let Ok(id) = PlatformId::try_from(common) {
+                            if platform_id.is_none() {
+                                platform_id = Some(id);
+                            } else {
+                                return Err(Self::Error::MultiplePlatformIds);
+                            }
+                        }
+                    }
+                }
+            }
+        }
+
+        platform_id.ok_or(Self::Error::NoPlatformId)
+    }
+}
+
 impl PlatformId {
     pub fn as_bytes(&self) -> &[u8] {
         match &self.0[..PREFIX_LEN] {