diff --git a/supernova/src/notification.rs b/supernova/src/notification.rs index e0f7020..14bd141 100644 --- a/supernova/src/notification.rs +++ b/supernova/src/notification.rs @@ -6,9 +6,9 @@ use axum::{ }; use base64::{ Engine, - prelude::{BASE64_STANDARD, BASE64_URL_SAFE_NO_PAD}, + prelude::BASE64_URL_SAFE_NO_PAD, }; -use reqwest::{Method, Request, RequestBuilder, StatusCode}; +use reqwest::StatusCode; use serde::Deserialize; use time::OffsetDateTime; use url::Origin; @@ -132,10 +132,10 @@ pub(super) async fn create_push_notification( let content_length = content.len(); //TODO might need different encoding //TODO use headermap - let salt_encoded = BASE64_URL_SAFE_NO_PAD.encode(&salt); + let _salt_encoded = BASE64_URL_SAFE_NO_PAD.encode(salt); let body = reqwest::Body::from(content); - let encoded_dh = BASE64_URL_SAFE_NO_PAD.encode(application_server_public_key.as_ref()); + let _encoded_dh = BASE64_URL_SAFE_NO_PAD.encode(application_server_public_key.as_ref()); let crypto_key_header_value = HeaderValue::from_str(&format!("p256ecdsa={application_server_signing_key}")).unwrap(); diff --git a/supernova/src/secrets.rs b/supernova/src/secrets.rs index 316bea9..8c3d369 100644 --- a/supernova/src/secrets.rs +++ b/supernova/src/secrets.rs @@ -95,7 +95,7 @@ pub(super) async fn setup() -> Result { ids: ids_by_variable.keys().copied().collect(), }; - let a = client.secrets().get_by_ids(request).await; + let _a = client.secrets().get_by_ids(request).await; todo!() // let responses = client.secrets().get_by_ids(request).await?; diff --git a/web-shove/src/authorization_header.rs b/web-shove/src/authorization_header.rs index f20aa4c..ee6ae1b 100644 --- a/web-shove/src/authorization_header.rs +++ b/web-shove/src/authorization_header.rs @@ -2,12 +2,11 @@ use std::time::SystemTime; use crate::{PRIVATE_KEY_LENGTH, PUBLIC_KEY_LENGTH}; use base64::prelude::*; -use http::{header, HeaderValue}; +use http::{HeaderValue, header}; use josekit::{ jws::JwsHeader, jwt::{self, JwtPayload}, }; -use p256::ecdsa::{signature::Signer, Signature, SigningKey}; use time::OffsetDateTime; //TODO support urgency header @@ -24,43 +23,7 @@ pub struct TokenData<'a> { pub issued_at: OffsetDateTime, } -impl<'a> TokenData<'a> { - fn encode(&self) -> String { - let formatted = format!( - r#"{{"aud":"{audience}","exp":"{expires}","sub":"{subject}"}}"#, - audience = self.push_service_origin, - // not_before = self.not_before.unix_timestamp(), - expires = self.expires.unix_timestamp(), - // issued_at = self.issued_at.unix_timestamp(), - subject = match self.subject { - Subject::Email(email) => format!(r#"mailto:{}"#, email), - Subject::Https(https) => format!(r#"{}"#, https), - } - ); - - BASE64_URL_SAFE_NO_PAD.encode(formatted.as_bytes()) - } -} - -fn create_jwt(data: TokenData, private_key: &[u8; PRIVATE_KEY_LENGTH]) -> String { - //TODO check if subject is optional - const JWT_INFO: &str = r#"{"typ":"JWT","alg":"ES256"}"#; - let jwt_info = BASE64_URL_SAFE_NO_PAD.encode(JWT_INFO); - // Can not be more than 24 hours - // Just naively format a string - let jwt_data = data.encode(); - let signing_material = format!("{}.{}", jwt_info, jwt_data); - - let key = SigningKey::from_slice(private_key).unwrap(); - - let signature: Signature = key.sign(signing_material.as_bytes()); - //TODO why is there only to_vec and no slice - let signature = BASE64_URL_SAFE_NO_PAD.encode(signature.to_vec()); - let token = format!("{}.{}", signing_material, signature); - - token -} -fn create_jwt_2( +fn create_jwt( data: TokenData, private_key: &[u8; PRIVATE_KEY_LENGTH], public_key: &[u8; PUBLIC_KEY_LENGTH], @@ -73,7 +36,7 @@ fn create_jwt_2( r#"{{"kty":"EC","crv":"P-256","x":"{x}","y":"{y}","d":"{d}"}}"#, x = BASE64_URL_SAFE_NO_PAD.encode(&public_key[1..33]), y = BASE64_URL_SAFE_NO_PAD.encode(&public_key[33..65]), - d = BASE64_URL_SAFE_NO_PAD.encode(&private_key) + d = BASE64_URL_SAFE_NO_PAD.encode(private_key) ); println!("{jwk}"); @@ -88,12 +51,12 @@ fn create_jwt_2( payload.set_issued_at(&now); payload.set_subject(match data.subject { Subject::Email(email) => format!(r#"mailto:{}"#, email), - Subject::Https(https) => format!(r#"{}"#, https), + Subject::Https(https) => https.to_string(), }); let signer = josekit::jws::ES256.signer_from_jwk(&jwk).unwrap(); - let encoded = jwt::encode_with_signer(&payload, &header, &signer).unwrap(); - encoded + + jwt::encode_with_signer(&payload, &header, &signer).unwrap() } pub fn create( @@ -102,7 +65,7 @@ pub fn create( public_key: &[u8; PUBLIC_KEY_LENGTH], ) -> (http::header::HeaderName, http::header::HeaderValue) { // http::header::AUTHORIZATION - let token = create_jwt_2(data, private_key, public_key); + let token = create_jwt(data, private_key, public_key); let value = HeaderValue::from_str(format!("WebPush {}", token).as_str()).unwrap(); (header::AUTHORIZATION, value) @@ -133,10 +96,10 @@ mod test { .try_into() .unwrap(); - const EXPECTED_TOKEN :&str = "eyJ0eXAiOiJKV1QiLCJhbGciOiJFUzI1NiJ9.eyJhdWQiOiJodHRwczovL2ZjbS5nb29nbGVhcGlzLmNvbSIsIm5iZiI6IjE3MzM2MDE4MDIiLCJleHAiOiIxNzMzNjAyMTAyIiwiaWF0IjoxNzMzNjAxODAyfQ.p9vmEmkAC38-mVPjS2MaZNOfFcVJPWo0v3K8S9ivTsADP_Oq1q5DmNow773HHWwO0VnQb_Hk84oTRzzrhjOq7g"; + const EXPECTED_TOKEN: &str = "eyJ0eXAiOiJKV1QiLCJhbGciOiJFUzI1NiJ9.eyJhdWQiOiJodHRwczovL2ZjbS5nb29nbGVhcGlzLmNvbSIsIm5iZiI6IjE3MzM2MDE4MDIiLCJleHAiOiIxNzMzNjAyMTAyIiwiaWF0IjoxNzMzNjAxODAyfQ.p9vmEmkAC38-mVPjS2MaZNOfFcVJPWo0v3K8S9ivTsADP_Oq1q5DmNow773HHWwO0VnQb_Hk84oTRzzrhjOq7g"; // Act - let actual_token = create_jwt_2( + let actual_token = create_jwt( TokenData { subject, push_service_origin, diff --git a/web-shove/src/encrypted_content_encoding.rs b/web-shove/src/encrypted_content_encoding.rs index e1025d9..29c1d5b 100644 --- a/web-shove/src/encrypted_content_encoding.rs +++ b/web-shove/src/encrypted_content_encoding.rs @@ -123,7 +123,7 @@ impl Record { let new_length = self.length + Self::PADDING_LENGTH; let mut buffer = &mut self.content[..new_length]; - provider.aes_128_gcm_encrypt(&mut buffer, key, nonce); + provider.aes_128_gcm_encrypt(buffer, key, nonce); Ok(CipherText { content: self.content, diff --git a/web-shove/src/lib.rs b/web-shove/src/lib.rs index 58192e1..d147c3a 100644 --- a/web-shove/src/lib.rs +++ b/web-shove/src/lib.rs @@ -53,7 +53,7 @@ pub fn create_push_message_payload( let key_info = create_key_info(application_server_public_key, user_agent_public_key); // # HKDF-Extract(salt=auth_secret, IKM=ecdh_secret) - let pseudo_random_key = create_pseudo_random_key(&authentication_secret, &ecdh_secret); + let pseudo_random_key = create_pseudo_random_key(authentication_secret, &ecdh_secret); // # HKDF-Expand(PRK_key, key_info, L_key=32) let input_keying_material = libcrux_hmac::hmac( libcrux_hmac::Algorithm::Sha256, @@ -91,12 +91,12 @@ pub fn create_push_message_payload( assert_eq!(12, nonce.len()); //TODO add padding to payload/plaintext? - let ciphertext = encrypt_plain_text(content_encryption_key, &plaintext, nonce); + let ciphertext = encrypt_plain_text(content_encryption_key, plaintext, nonce); let header = create_content_encoding_header( &salt, // Size might be fixed to add padding to avoid side channel by checking message size? &RECORD_SIZE, - &application_server_public_key, + application_server_public_key, ); //TODO reduce allocation diff --git a/web-shove/src/vapid.rs b/web-shove/src/vapid.rs index c366917..e6b7d14 100644 --- a/web-shove/src/vapid.rs +++ b/web-shove/src/vapid.rs @@ -18,7 +18,7 @@ impl Vapid { let private_bytes = private_key.to_bytes(); assert_eq!(32, private_bytes.len()); - let private_bytes = private_bytes.try_into().unwrap(); + let private_bytes = private_bytes.into(); let point = public_key.to_encoded_point(false); let public_bytes: &[u8] = point.as_bytes(); assert_eq!(65, public_bytes.len()); @@ -36,7 +36,7 @@ impl Vapid { let private_key = SigningKey::from_bytes(private_key.into()).unwrap(); let public_key = private_key.verifying_key(); let private_bytes = private_key.to_bytes(); - let private_bytes = private_bytes.try_into().unwrap(); + let private_bytes = private_bytes.into(); let point = public_key.to_encoded_point(false); let public_bytes = point.as_bytes(); assert_eq!(65, public_bytes.len());