(&self, response: &Response)
| 112 | } |
| 113 | |
| 114 | async fn try_validate_attestation(&self, response: &Response) -> Result<()> { |
| 115 | let Some(validator) = &self.cert_validator else { |
| 116 | return Ok(()); |
| 117 | }; |
| 118 | |
| 119 | let Some(tls_info) = response.extensions().get::<TlsInfo>() else { |
| 120 | bail!("No TLS info in response"); |
| 121 | }; |
| 122 | let Some(cert) = tls_info.peer_certificate() else { |
| 123 | return validator(None); |
| 124 | }; |
| 125 | let cert_der = cert.to_vec(); |
| 126 | let (_, cert) = |
| 127 | x509_parser::parse_x509_certificate(cert).context("Failed to parse certificate")?; |
| 128 | let special_usage = cert |
| 129 | .get_special_usage() |
| 130 | .context("Failed to get special usage")?; |
| 131 | let app_id = cert.get_app_id().context("Failed to get app id")?; |
| 132 | let attestation = if !self.verify_server_attestation { |
| 133 | None |
| 134 | } else { |
| 135 | match ra_tls::attestation::from_cert(&cert).context("Failed to parse attestation")? { |
| 136 | None => None, |
| 137 | Some(attestation) => { |
| 138 | let verified_attestation = attestation |
| 139 | .into_v1() |
| 140 | .verify_with_ra_pubkey(cert.public_key().raw, self.pccs_url.as_deref()) |
| 141 | .await |
| 142 | .context("Failed to verify the attestation report")?; |
| 143 | Some(verified_attestation) |
| 144 | } |
| 145 | } |
| 146 | }; |
| 147 | let cert_info = CertInfo { |
| 148 | cert_der, |
| 149 | attestation, |
| 150 | special_usage, |
| 151 | app_id, |
| 152 | }; |
| 153 | validator(Some(cert_info)) |
| 154 | } |
| 155 | } |
| 156 | |
| 157 | impl RequestClient for RaClient { |
no test coverage detected