病院・出版社・工場を止めた
「VPN境界機器ゼロデイ侵入」の仕組みと防御の鉄則

#![forbid(unsafe_code)]

#[derive(Debug, Clone, PartialEq, Eq)]
pub struct MtlsBoundSession {
    pub session_id: [u8; 16],
    pub bound_cert_sha256: [u8; 32],
    pub allowed_vlan_id: u16,
    pub expires_at_unix: u64,
}

#[derive(Debug, Clone, PartialEq, Eq)]
pub struct IngressPacketContext {
    pub presented_cert_sha256: Option<[u8; 32]>,
    pub target_vlan_id: u16,
    pub target_port: u16,
    pub current_unix_ts: u64,
}

#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub enum PerimeterDecision {
    AllowForwarded,
    DenyExpiredSession,
    DenyMissingClientCertificate,
    DenyStolenTokenCertMismatch,
    DenyUnauthorizedLateralMovement,
}

pub fn verify_vpn_ingress(session: &MtlsBoundSession, ctx: &IngressPacketContext) -> PerimeterDecision {
    if ctx.current_unix_ts >= session.expires_at_unix {
        return PerimeterDecision::DenyExpiredSession;
    }

    let presented = match ctx.presented_cert_sha256 {
        Some(fp) => fp,
        None => return PerimeterDecision::DenyMissingClientCertificate,
    };

    let mut diff = 0u8;
    for i in 0..32 {
        diff |= session.bound_cert_sha256[i] ^ presented[i];
    }
    if diff != 0 {
        return PerimeterDecision::DenyStolenTokenCertMismatch;
    }

    if ctx.target_vlan_id != session.allowed_vlan_id || ctx.target_port == 445 || ctx.target_port == 3389 {
        return PerimeterDecision::DenyUnauthorizedLateralMovement;
    }

    PerimeterDecision::AllowForwarded
}