Client certificates prove the device, not just the password

package main

import (
	"crypto/ed25519"
	"crypto/rand"
	"crypto/tls"
	"crypto/x509"
	"crypto/x509/pkix"
	"errors"
	"fmt"
	"io"
	"log"
	"math/big"
	"net/http"
	"net/http/httptest"
	"net/url"
	"runtime"
	"sync/atomic"
	"time"
)

func must(err error) {
	if err != nil {
		panic(err)
	}
}

func check(ok bool, message string) {
	if !ok {
		panic(message)
	}
}

func authority(serial int64) (*x509.Certificate, ed25519.PrivateKey) {
	public, private, err := ed25519.GenerateKey(rand.Reader)
	must(err)
	now := time.Now()
	template := &x509.Certificate{
		SerialNumber: big.NewInt(serial), Subject: pkix.Name{CommonName: fmt.Sprint("fixture-ca-", serial)},
		NotBefore: now.Add(-time.Minute), NotAfter: now.Add(time.Hour),
		IsCA: true, BasicConstraintsValid: true, KeyUsage: x509.KeyUsageCertSign,
	}
	der, err := x509.CreateCertificate(rand.Reader, template, template, public, private)
	must(err)
	certificate, err := x509.ParseCertificate(der)
	must(err)
	return certificate, private
}

func credential(serial int64, identity string, usage x509.ExtKeyUsage, ca *x509.Certificate, signer ed25519.PrivateKey) tls.Certificate {
	public, private, err := ed25519.GenerateKey(rand.Reader)
	must(err)
	name, err := url.Parse("urn:example:" + identity)
	must(err)
	now := time.Now()
	template := &x509.Certificate{
		SerialNumber: big.NewInt(serial), URIs: []*url.URL{name},
		NotBefore: now.Add(-time.Minute), NotAfter: now.Add(time.Hour),
		KeyUsage: x509.KeyUsageDigitalSignature, ExtKeyUsage: []x509.ExtKeyUsage{usage},
	}
	der, err := x509.CreateCertificate(rand.Reader, template, ca, public, signer)
	must(err)
	certificate, err := x509.ParseCertificate(der)
	must(err)
	return tls.Certificate{Certificate: [][]byte{der}, PrivateKey: private, Leaf: certificate}
}

func main() {
	ca, signer := authority(1)
	foreignCA, foreignSigner := authority(2)
	reader := credential(3, "reader", x509.ExtKeyUsageClientAuth, ca, signer)
	guest := credential(4, "guest", x509.ExtKeyUsageClientAuth, ca, signer)
	foreign := credential(5, "reader", x509.ExtKeyUsageClientAuth, foreignCA, foreignSigner)
	serverOnly := credential(6, "reader", x509.ExtKeyUsageServerAuth, ca, signer)
	roots := x509.NewCertPool()
	roots.AddCert(ca)
	options := x509.VerifyOptions{Roots: roots, KeyUsages: []x509.ExtKeyUsage{x509.ExtKeyUsageClientAuth}}
	_, err := foreign.Leaf.Verify(options)
	var unknown x509.UnknownAuthorityError
	check(errors.As(err, &unknown), "foreign issuer fixture must fail trust")
	_, err = serverOnly.Leaf.Verify(options)
	var invalid x509.CertificateInvalidError
	check(errors.As(err, &invalid) && invalid.Reason == x509.IncompatibleUsage, "server-only fixture must fail client usage")

	var handled atomic.Int64
	server := httptest.NewUnstartedServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
		handled.Add(1)
		check(len(r.TLS.VerifiedChains) > 0, "handler requires a verified client chain")
		identities := r.TLS.VerifiedChains[0][0].URIs
		if len(identities) != 1 || identities[0].String() != "urn:example:reader" {
			http.Error(w, "forbidden", http.StatusForbidden)
			return
		}
		fmt.Fprintln(w, "reader allowed")
	}))
	server.Config.ErrorLog = log.New(io.Discard, "", 0)
	server.TLS = &tls.Config{
		MinVersion: tls.VersionTLS13, MaxVersion: tls.VersionTLS13,
		ClientAuth: tls.RequireAndVerifyClientCert, ClientCAs: roots, SessionTicketsDisabled: true,
	}
	server.StartTLS()
	defer server.Close()
	request := func(certificate *tls.Certificate) (int, error) {
		config := server.Client().Transport.(*http.Transport).TLSClientConfig.Clone()
		check(!config.InsecureSkipVerify, "server identity verification must remain enabled")
		config.MinVersion = tls.VersionTLS13
		if certificate != nil {
			config.GetClientCertificate = func(*tls.CertificateRequestInfo) (*tls.Certificate, error) {
				return certificate, nil
			}
		}
		transport := &http.Transport{TLSClientConfig: config, DisableKeepAlives: true}
		defer transport.CloseIdleConnections()
		client := &http.Client{Transport: transport, Timeout: 2 * time.Second}
		request, err := http.NewRequest(http.MethodGet, server.URL, nil)
		must(err)
		request.Header.Set("X-Client-ID", "urn:example:reader")
		response, err := client.Do(request)
		if err != nil {
			return 0, err
		}
		defer response.Body.Close()
		_, err = io.Copy(io.Discard, response.Body)
		must(err)
		check(response.TLS.Version == tls.VersionTLS13 && len(response.TLS.VerifiedChains) > 0, "client requires a verified TLS 1.3 server")
		return response.StatusCode, nil
	}
	for _, test := range []struct {
		name        string
		certificate *tls.Certificate
		status      int
	}{
		{"reader", &reader, 200}, {"guest", &guest, 403},
		{"missing", nil, 0}, {"foreign issuer", &foreign, 0},
		{"wrong usage", &serverOnly, 0}, {"reader again", &reader, 200},
	} {
		status, err := request(test.certificate)
		if test.status == 0 {
			check(err != nil && status == 0, "invalid client must fail before HTTP")
		} else {
			must(err)
			check(status == test.status, "wrong authorization result")
		}
		fmt.Println(test.name, "HTTP status:", status)
	}
	check(handled.Load() == 3, "only reader, guest, and reader again may reach HTTP")
	fmt.Println("three TLS rejections; authenticated guest denied despite claimed reader header")
	fmt.Println(runtime.Version())
}