Resolve Clippy bugs, test short HS256 tokens

Cargo.toml

@@ -25,7 +25,7 @@ all-features = true
 [dependencies]
 base64 = "^0.22.1"
 base64urlsafedata = "^0.5.1"
-crypto-glue = "^0.1.7"
+crypto-glue = "^0.1.12"
 hex = "0.4"
 kanidm-hsm-crypto = "^0.3.2"
 openssl = { version = "^0.10.38", optional = true }

src/crypto/hs256.rs

@@ -213,8 +213,9 @@ fn kid(skey: &HmacSha256Key) -> String {
 
 #[cfg(test)]
 mod tests {
-    use super::JwsHs256Signer;
+    use super::{hmac_s256, JwsHs256Signer};
     use crate::compact::JwsCompact;
+    use crate::jws::JwsBuilder;
     use crate::traits::*;
     use base64::{engine::general_purpose, Engine as _};
     use std::convert::TryFrom;
@@ -295,4 +296,32 @@ mod tests {
         let released = jws_signer.verify(&jwsc).expect("Unable to validate jws");
         trace!("rel -> {:?}", released);
     }
+
+    #[test]
+    fn hs256_shortform() {
+        use uuid::Uuid;
+
+        let _ = tracing_subscriber::fmt::try_init();
+
+        let skey = hmac_s256::new_key();
+
+        let mut jws_signer = JwsHs256Signer::from(skey);
+        let mut kid = crate::traits::JwsSigner::get_kid(&jws_signer).to_string();
+        kid.truncate(12);
+        jws_signer.set_kid(&kid);
+
+        let id = Uuid::default();
+        let payload = id.as_bytes().to_vec();
+
+        let jws = JwsBuilder::from(payload)
+            // .set_typ(Some("a1"))
+            .build();
+
+        let jwsc = jws_signer.sign(&jws).expect("Failed to sign");
+
+        warn!(?jwsc, length = %jwsc.to_string().len());
+        warn!(%jwsc);
+
+        assert!(jwsc.to_string().len() < 128);
+    }
 }

src/crypto/mod.rs

@@ -33,7 +33,7 @@ mod ms_oapxbc;
 pub use es256::{JwsEs256Signer, JwsEs256Verifier};
 pub use hs256::JwsHs256Signer;
 pub use rs256::{JwsRs256Signer, JwsRs256Verifier};
-pub use x509::{JwsX509Verifier, JwsX509VerifierBuilder};
+pub use x509::{JwsX509Signer, JwsX509Verifier, JwsX509VerifierBuilder};
 
 pub use a128gcm::JweA128GCMEncipher;
 pub use a128kw::JweA128KWEncipher;

src/crypto/x509.rs

@@ -2,12 +2,16 @@
 
 // use crate::compact::JwaAlg;
 
+use crate::compact::ProtectedHeader;
 use crate::error::JwtError;
 use crate::traits::*;
-use crate::KID_LEN;
+use crate::{JwsCompact, KID_LEN};
+use base64::engine::general_purpose;
+use base64::Engine;
 use crypto_glue::{
+    ecdsa_p384::{EcdsaP384Digest, EcdsaP384PrivateKey, EcdsaP384Signature, EcdsaP384SigningKey},
     s256,
-    traits::Digest,
+    traits::{Digest, DigestSigner, EncodeDer, SignatureEncoding},
     x509::{x509_verify_signature, Certificate, SubjectKeyIdentifier, X509Store},
 };
 use std::time::SystemTime;
@@ -115,6 +119,98 @@ impl JwsVerifier for JwsX509Verifier {
     }
 }
 
+/// A builder for a verifier that will be rooted in a trusted ca chain.
+#[derive(Clone)]
+pub struct JwsX509Signer<K> {
+    kid: String,
+    signer: K,
+    leaf: Certificate,
+    chain: Vec<Certificate>,
+}
+
+impl<K> JwsX509Signer<K> {
+    /// Create a new X509 JWS Signer using this Key and Certificate.
+    pub fn new(signer: K, leaf: &Certificate, chain: &[Certificate]) -> Self {
+        let kid = certificate_to_kid(leaf);
+
+        Self {
+            kid,
+            signer,
+            leaf: leaf.clone(),
+            chain: chain.to_vec(),
+        }
+    }
+}
+
+impl JwsSigner for JwsX509Signer<EcdsaP384PrivateKey> {
+    fn get_kid(&self) -> &str {
+        self.kid.as_str()
+    }
+
+    fn set_kid(&mut self, kid: &str) {
+        self.kid = kid.to_string();
+    }
+
+    fn update_header(&self, header: &mut ProtectedHeader) -> Result<(), JwtError> {
+        // Embed the x5c/leaf
+        let x5c = std::iter::once(&self.leaf)
+            .chain(self.chain.iter())
+            .map(|cert| {
+                Certificate::to_der(cert)
+                    .map(|bytes| general_purpose::STANDARD.encode(bytes))
+                    .map_err(|err| {
+                        debug!(?err);
+                        JwtError::CryptoError
+                    })
+            })
+            .collect::<Result<Vec<_>, _>>()?;
+
+        header.x5c = Some(x5c);
+
+        Ok(())
+    }
+
+    fn sign<V: JwsSignable>(&self, jws: &V) -> Result<V::Signed, JwtError> {
+        let mut sign_data = jws.data()?;
+
+        // Let the signer update the header as required.
+        self.update_header(&mut sign_data.header)?;
+
+        let hdr_b64 = serde_json::to_vec(&sign_data.header)
+            .map_err(|e| {
+                debug!(?e);
+                JwtError::InvalidHeaderFormat
+            })
+            .map(|bytes| general_purpose::URL_SAFE_NO_PAD.encode(bytes))?;
+
+        let mut hasher = EcdsaP384Digest::new();
+
+        hasher.update(hdr_b64.as_bytes());
+        hasher.update(".".as_bytes());
+        hasher.update(sign_data.payload_b64.as_bytes());
+
+        let signer = EcdsaP384SigningKey::from(&self.signer);
+
+        let signature: EcdsaP384Signature = signer.try_sign_digest(hasher).map_err(|err| {
+            debug!(?err);
+            JwtError::CryptoError
+        })?;
+
+        let jwsc = JwsCompact {
+            header: sign_data.header,
+            hdr_b64,
+            payload_b64: sign_data.payload_b64,
+            signature: signature.to_der().to_vec(),
+        };
+
+        jws.post_process(jwsc)
+    }
+
+    fn set_sign_option_embed_kid(&self, _value: bool) -> Self {
+        self.clone()
+    }
+}
+
 fn certificate_to_kid(cert: &Certificate) -> String {
     let maybe_subject_key_id = cert
         .tbs_certificate

src/jwe.rs

@@ -65,19 +65,3 @@ impl Jwe {
         serde_json::from_slice(self.payload())
     }
 }
-
-mod tests {
-    use serde::{Deserialize, Serialize};
-
-    #[allow(dead_code)]
-    #[derive(Default, Debug, Serialize, Clone, Deserialize, PartialEq)]
-    struct CustomExtension {
-        my_exten: String,
-    }
-
-    #[test]
-    fn test_encrypt_and_decrypt() {
-
-        // TODO: work out if this is just not implemented yet, or if it's designed to trigger something weird?
-    }
-}