1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
|
{-# LANGUAGE OverloadedStrings #-}
module TLSA
( TLSA(..)
, CertUsage(..)
, Selector(..)
, MatchingType(..)
, fromByteString
, toByteString
, match
) where
import qualified Data.ByteString as BS
import qualified Data.ByteString.Lazy as L
import qualified Crypto.Hash.SHA256 as SHA256
import qualified Crypto.Hash.SHA512 as SHA512
import Data.X509 ( certPubKey, Certificate )
import Data.ASN1.Types ( toASN1 )
import Data.ASN1.Encoding ( encodeASN1 )
import Data.ASN1.BinaryEncoding
import Control.Applicative
import Data.Word
import Data.Maybe
import Data.Monoid
{- INLINE fromWord8 #-}
fromWord8 :: Enum a => Word8 -> a
fromWord8 = toEnum . fromEnum
{- INLINE toWord8 -}
toWord8 :: Enum a => a -> Word8
toWord8 = toEnum . fromEnum
data CertUsage
= CAConstraint
| ServiceCertificateConstraint
| TrustAnchorAssertion
| DomainIssued
| CertUsage Word8
deriving (Eq, Ord, Show, Read)
instance Enum CertUsage where
fromEnum CAConstraint = 0
fromEnum ServiceCertificateConstraint = 1
fromEnum TrustAnchorAssertion = 2
fromEnum DomainIssued = 3
fromEnum (CertUsage n) = fromEnum n
toEnum 0 = CAConstraint
toEnum 1 = ServiceCertificateConstraint
toEnum 2 = TrustAnchorAssertion
toEnum 3 = DomainIssued
toEnum n = CertUsage (toEnum n)
data Selector
= FullCertificate
| SubjectPublicKeyInfo
| Selector Word8 -- Selector 255 reserved for private use
deriving (Eq,Ord,Show)
instance Enum Selector where
fromEnum FullCertificate = 0
fromEnum SubjectPublicKeyInfo = 1
fromEnum (Selector n) = fromEnum n
toEnum 0 = FullCertificate
toEnum 1 = SubjectPublicKeyInfo
toEnum n = Selector (toEnum n)
data MatchingType
= Match_Exact
| Match_SHA256
| Match_SHA512
| Match Word8 -- Match 255 reserved for private use
deriving (Eq,Ord,Show)
instance Enum MatchingType where
fromEnum Match_Exact = 0
fromEnum Match_SHA256 = 1
fromEnum Match_SHA512 = 2
fromEnum (Match n) = fromEnum n
toEnum 0 = Match_Exact
toEnum 1 = Match_SHA256
toEnum 2 = Match_SHA512
toEnum n = Match (toEnum n)
data TLSA = TLSA
{ tlsaCertUsage :: CertUsage
, tlsaSelector :: Selector
, tlsaMatchingType :: MatchingType
, tlsaAssociationData :: BS.ByteString
}
deriving (Eq, Ord, Show)
fromByteString :: BS.ByteString -> TLSA
fromByteString bs = TLSA (fromWord8 cu)
(fromWord8 sel)
(fromWord8 mat)
associationData
where
(csm,associationData) = BS.splitAt 3 bs
(cu,sel,mat) =
case BS.unpack csm of
[cu,sel,mat] -> (cu,sel,mat)
[cu,sel] -> (cu,sel,0)
[cu] -> (cu,0,0)
[] -> (0,0,0)
toByteString :: TLSA -> BS.ByteString
toByteString (TLSA cu sel mat associationData) = csm <> associationData
where
csm = BS.pack [ toWord8 cu
, toWord8 sel
, toWord8 mat ]
match :: Certificate -> TLSA -> Bool
match cert tlsa = fromMaybe False $
(== tlsaAssociationData tlsa) <$> (hash <*> material)
where
encode obj = encodeASN1 DER (toASN1 obj [])
material =
case tlsaSelector tlsa of
FullCertificate -> Just $ encode cert
SubjectPublicKeyInfo -> Just $ encode $ certPubKey cert
_ -> Nothing
hash =
case tlsaMatchingType tlsa of
Match_Exact -> Just L.toStrict
Match_SHA256 -> Just SHA256.hashlazy
Match_SHA512 -> Just SHA512.hashlazy
_ -> Nothing
|
