Skip to content

Commit 30a27f9

Browse files
ameba23ameba23
committed
Rename struct fields for clarity
1 parent 1905204 commit 30a27f9

File tree

1 file changed

+61
-62
lines changed

1 file changed

+61
-62
lines changed

‎src/lib.rs‎

Lines changed: 61 additions & 62 deletions
Original file line numberDiff line numberDiff line change
@@ -37,22 +37,26 @@ const EXPORTER_LABEL: &[u8; 24] = b"EXPORTER-Channel-Binding";
3737
/// The header name for giving measurements
3838
const MEASUREMENT_HEADER: &str = "X-Flashbots-Measurement";
3939

40+
/// TLS Credentials
4041
pub struct TlsCertAndKey {
42+
/// Der-encoded TLS certificate chain
4143
pub cert_chain: Vec<CertificateDer<'static>>,
44+
/// Der-encoded TLS private key
4245
pub key: PrivateKeyDer<'static>,
4346
}
4447

48+
/// Inner struct used by [ProxyClient] and [ProxyServer]
4549
struct Proxy<L, R>
4650
where
4751
L: QuoteGenerator,
4852
R: QuoteVerifier,
4953
{
5054
/// The underlying TCP listener
5155
listener: TcpListener,
52-
/// Type of CVM platform we run on (including none)
53-
local_attestation_platform: L,
54-
/// Type of CVM platform the remote party runs on (including none)
55-
remote_attestation_platform: R,
56+
/// Quote generation type to use (including none)
57+
local_quote_generator: L,
58+
/// Verifier for remote attestation (including none)
59+
remote_quote_verifier: R,
5660
}
5761

5862
/// A TLS over TCP server which provides an attestation before forwarding traffic to a given target address
@@ -75,11 +79,11 @@ impl<L: QuoteGenerator, R: QuoteVerifier> ProxyServer<L, R> {
7579
cert_and_key: TlsCertAndKey,
7680
local: impl ToSocketAddrs,
7781
target: SocketAddr,
78-
local_attestation_platform: L,
79-
remote_attestation_platform: R,
82+
local_quote_generator: L,
83+
remote_quote_verifier: R,
8084
client_auth: bool,
8185
) -> Result<Self, ProxyError> {
82-
if remote_attestation_platform.is_cvm() && !client_auth {
86+
if remote_quote_verifier.is_cvm() && !client_auth {
8387
return Err(ProxyError::NoClientAuth);
8488
}
8589

@@ -102,8 +106,8 @@ impl<L: QuoteGenerator, R: QuoteVerifier> ProxyServer<L, R> {
102106
server_config.into(),
103107
local,
104108
target,
105-
local_attestation_platform,
106-
remote_attestation_platform,
109+
local_quote_generator,
110+
remote_quote_verifier,
107111
)
108112
.await
109113
}
@@ -116,16 +120,16 @@ impl<L: QuoteGenerator, R: QuoteVerifier> ProxyServer<L, R> {
116120
server_config: Arc<ServerConfig>,
117121
local: impl ToSocketAddrs,
118122
target: SocketAddr,
119-
local_attestation_platform: L,
120-
remote_attestation_platform: R,
123+
local_quote_generator: L,
124+
remote_quote_verifier: R,
121125
) -> Result<Self, ProxyError> {
122126
let acceptor = tokio_rustls::TlsAcceptor::from(server_config);
123127
let listener = TcpListener::bind(local).await?;
124128

125129
let inner = Proxy {
126130
listener,
127-
local_attestation_platform,
128-
remote_attestation_platform,
131+
local_quote_generator,
132+
remote_quote_verifier,
129133
};
130134

131135
Ok(Self {
@@ -143,16 +147,16 @@ impl<L: QuoteGenerator, R: QuoteVerifier> ProxyServer<L, R> {
143147
let acceptor = self.acceptor.clone();
144148
let target = self.target;
145149
let cert_chain = self.cert_chain.clone();
146-
let local_attestation_platform = self.inner.local_attestation_platform.clone();
147-
let remote_attestation_platform = self.inner.remote_attestation_platform.clone();
150+
let local_quote_generator = self.inner.local_quote_generator.clone();
151+
let remote_quote_verifier = self.inner.remote_quote_verifier.clone();
148152
tokio::spawn(async move {
149153
if let Err(err) = Self::handle_connection(
150154
inbound,
151155
acceptor,
152156
target,
153157
cert_chain,
154-
local_attestation_platform,
155-
remote_attestation_platform,
158+
local_quote_generator,
159+
remote_quote_verifier,
156160
)
157161
.await
158162
{
@@ -172,8 +176,8 @@ impl<L: QuoteGenerator, R: QuoteVerifier> ProxyServer<L, R> {
172176
acceptor: TlsAcceptor,
173177
target: SocketAddr,
174178
cert_chain: Vec<CertificateDer<'static>>,
175-
local_attestation_platform: L,
176-
remote_attestation_platform: R,
179+
local_quote_generator: L,
180+
remote_quote_verifier: R,
177181
) -> Result<(), ProxyError> {
178182
let mut tls_stream = acceptor.accept(inbound).await?;
179183
let (_io, connection) = tls_stream.get_ref();
@@ -187,8 +191,8 @@ impl<L: QuoteGenerator, R: QuoteVerifier> ProxyServer<L, R> {
187191

188192
let remote_cert_chain = connection.peer_certificates().map(|c| c.to_owned());
189193

190-
let attestation = if local_attestation_platform.is_cvm() {
191-
local_attestation_platform.create_attestation(&cert_chain, exporter)?
194+
let attestation = if local_quote_generator.is_cvm() {
195+
local_quote_generator.create_attestation(&cert_chain, exporter)?
192196
} else {
193197
Vec::new()
194198
};
@@ -206,8 +210,8 @@ impl<L: QuoteGenerator, R: QuoteVerifier> ProxyServer<L, R> {
206210
let mut buf = vec![0; length];
207211
tls_stream.read_exact(&mut buf).await?;
208212

209-
let measurements = if remote_attestation_platform.is_cvm() {
210-
remote_attestation_platform
213+
let measurements = if remote_quote_verifier.is_cvm() {
214+
remote_quote_verifier
211215
.verify_attestation(
212216
buf,
213217
&remote_cert_chain.ok_or(ProxyError::NoClientAuth)?,
@@ -311,10 +315,10 @@ impl<L: QuoteGenerator, R: QuoteVerifier> ProxyClient<L, R> {
311315
cert_and_key: Option<TlsCertAndKey>,
312316
address: impl ToSocketAddrs,
313317
server_name: String,
314-
local_attestation_platform: L,
315-
remote_attestation_platform: R,
318+
local_quote_generator: L,
319+
remote_quote_verifier: R,
316320
) -> Result<Self, ProxyError> {
317-
if local_attestation_platform.is_cvm() && cert_and_key.is_none() {
321+
if local_quote_generator.is_cvm() && cert_and_key.is_none() {
318322
return Err(ProxyError::NoClientAuth);
319323
}
320324

@@ -337,8 +341,8 @@ impl<L: QuoteGenerator, R: QuoteVerifier> ProxyClient<L, R> {
337341
client_config.into(),
338342
address,
339343
server_name,
340-
local_attestation_platform,
341-
remote_attestation_platform,
344+
local_quote_generator,
345+
remote_quote_verifier,
342346
cert_and_key.map(|c| c.cert_chain),
343347
)
344348
.await
@@ -351,17 +355,17 @@ impl<L: QuoteGenerator, R: QuoteVerifier> ProxyClient<L, R> {
351355
client_config: Arc<ClientConfig>,
352356
local: impl ToSocketAddrs,
353357
target_name: String,
354-
local_attestation_platform: L,
355-
remote_attestation_platform: R,
358+
local_quote_generator: L,
359+
remote_quote_verifier: R,
356360
cert_chain: Option<Vec<CertificateDer<'static>>>,
357361
) -> Result<Self, ProxyError> {
358362
let listener = TcpListener::bind(local).await?;
359363
let connector = TlsConnector::from(client_config.clone());
360364

361365
let inner = Proxy {
362366
listener,
363-
local_attestation_platform,
364-
remote_attestation_platform,
367+
local_quote_generator,
368+
remote_quote_verifier,
365369
};
366370

367371
Ok(Self {
@@ -378,8 +382,8 @@ impl<L: QuoteGenerator, R: QuoteVerifier> ProxyClient<L, R> {
378382

379383
let connector = self.connector.clone();
380384
let target = self.target.clone();
381-
let local_attestation_platform = self.inner.local_attestation_platform.clone();
382-
let remote_attestation_platform = self.inner.remote_attestation_platform.clone();
385+
let local_quote_generator = self.inner.local_quote_generator.clone();
386+
let remote_quote_verifier = self.inner.remote_quote_verifier.clone();
383387
let cert_chain = self.cert_chain.clone();
384388

385389
tokio::spawn(async move {
@@ -388,8 +392,8 @@ impl<L: QuoteGenerator, R: QuoteVerifier> ProxyClient<L, R> {
388392
connector,
389393
target,
390394
cert_chain,
391-
local_attestation_platform,
392-
remote_attestation_platform,
395+
local_quote_generator,
396+
remote_quote_verifier,
393397
)
394398
.await
395399
{
@@ -411,24 +415,24 @@ impl<L: QuoteGenerator, R: QuoteVerifier> ProxyClient<L, R> {
411415
connector: TlsConnector,
412416
target: String,
413417
cert_chain: Option<Vec<CertificateDer<'static>>>,
414-
local_attestation_platform: L,
415-
remote_attestation_platform: R,
418+
local_quote_generator: L,
419+
remote_quote_verifier: R,
416420
) -> Result<(), ProxyError> {
417421
let http = Builder::new();
418422
let service = service_fn(move |req| {
419423
let connector = connector.clone();
420424
let target = target.clone();
421425
let cert_chain = cert_chain.clone();
422-
let local_attestation_platform = local_attestation_platform.clone();
423-
let remote_attestation_platform = remote_attestation_platform.clone();
426+
let local_quote_generator = local_quote_generator.clone();
427+
let remote_quote_verifier = remote_quote_verifier.clone();
424428
async move {
425429
match Self::handle_http_request(
426430
req,
427431
connector,
428432
target,
429433
cert_chain,
430-
local_attestation_platform,
431-
remote_attestation_platform,
434+
local_quote_generator,
435+
remote_quote_verifier,
432436
)
433437
.await
434438
{
@@ -455,8 +459,8 @@ impl<L: QuoteGenerator, R: QuoteVerifier> ProxyClient<L, R> {
455459
connector: TlsConnector,
456460
target: String,
457461
cert_chain: Option<Vec<CertificateDer<'static>>>,
458-
local_attestation_platform: L,
459-
remote_attestation_platform: R,
462+
local_quote_generator: L,
463+
remote_quote_verifier: R,
460464
) -> Result<
461465
(
462466
tokio_rustls::client::TlsStream<TcpStream>,
@@ -490,16 +494,16 @@ impl<L: QuoteGenerator, R: QuoteVerifier> ProxyClient<L, R> {
490494
let mut buf = vec![0; length];
491495
tls_stream.read_exact(&mut buf).await?;
492496

493-
let measurements = if remote_attestation_platform.is_cvm() {
494-
remote_attestation_platform
497+
let measurements = if remote_quote_verifier.is_cvm() {
498+
remote_quote_verifier
495499
.verify_attestation(buf, &remote_cert_chain, exporter)
496500
.await?
497501
} else {
498502
None
499503
};
500504

501-
let attestation = if local_attestation_platform.is_cvm() {
502-
local_attestation_platform
505+
let attestation = if local_quote_generator.is_cvm() {
506+
local_quote_generator
503507
.create_attestation(&cert_chain.ok_or(ProxyError::NoClientAuth)?, exporter)?
504508
} else {
505509
Vec::new()
@@ -520,15 +524,15 @@ impl<L: QuoteGenerator, R: QuoteVerifier> ProxyClient<L, R> {
520524
connector: TlsConnector,
521525
target: String,
522526
cert_chain: Option<Vec<CertificateDer<'static>>>,
523-
local_attestation_platform: L,
524-
remote_attestation_platform: R,
527+
local_quote_generator: L,
528+
remote_quote_verifier: R,
525529
) -> Result<Response<BoxBody<bytes::Bytes, hyper::Error>>, ProxyError> {
526530
let (tls_stream, measurements) = Self::setup_connection(
527531
connector,
528532
target,
529533
cert_chain,
530-
local_attestation_platform,
531-
remote_attestation_platform,
534+
local_quote_generator,
535+
remote_quote_verifier,
532536
)
533537
.await?;
534538

@@ -575,23 +579,18 @@ impl<L: QuoteGenerator, R: QuoteVerifier> ProxyClient<L, R> {
575579
/// Just get the attested remote certificate, with no client authentication
576580
pub async fn get_tls_cert<R: QuoteVerifier>(
577581
server_name: String,
578-
remote_attestation_platform: R,
582+
remote_quote_verifier: R,
579583
) -> Result<Vec<CertificateDer<'static>>, ProxyError> {
580584
let root_store = RootCertStore::from_iter(webpki_roots::TLS_SERVER_ROOTS.iter().cloned());
581585
let client_config = ClientConfig::builder()
582586
.with_root_certificates(root_store)
583587
.with_no_client_auth();
584-
get_tls_cert_with_config(
585-
server_name,
586-
remote_attestation_platform,
587-
client_config.into(),
588-
)
589-
.await
588+
get_tls_cert_with_config(server_name, remote_quote_verifier, client_config.into()).await
590589
}
591590

592591
async fn get_tls_cert_with_config<R: QuoteVerifier>(
593592
server_name: String,
594-
remote_attestation_platform: R,
593+
remote_quote_verifier: R,
595594
client_config: Arc<ClientConfig>,
596595
) -> Result<Vec<CertificateDer<'static>>, ProxyError> {
597596
let connector = TlsConnector::from(client_config);
@@ -622,8 +621,8 @@ async fn get_tls_cert_with_config<R: QuoteVerifier>(
622621
let mut buf = vec![0; length];
623622
tls_stream.read_exact(&mut buf).await?;
624623

625-
if remote_attestation_platform.is_cvm() {
626-
remote_attestation_platform
624+
if remote_quote_verifier.is_cvm() {
625+
remote_quote_verifier
627626
.verify_attestation(buf, &remote_cert_chain, exporter)
628627
.await?;
629628
}

0 commit comments

Comments
 (0)