kata-containers/s390-tools
1
0
Fork 0
mirror of https://github.com/ibm-s390-linux/s390-tools.git synced 2026-08-05 02:14:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

pvsecret: fix panic if empty file is used as host key document

Browse Source 
Fix a panic in `pvsecret` when a empty file is used as a host key
document.

$ touch hkd
$ pvsecret create --no-verify -k hkd --output req.bin --hdr sehdr
...
The host key document in 'bla' contains more than one certificate!
thread 'main' panicked at pvsecret/src/cmd/create.rs:192:31:

Fixes: dd82c26f87 ("rust: Add tool to manage UV-secrets")
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This commit is contained in:
Marc Hartmayer
2024-02-01 15:23:45 +01:00
committed by Jan Höppner
parent ab6bcad263
commit 0f433b1142
1 changed files with 9 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
rust/pvsecret/src/cmd/create.rs
View File

@@ -183,11 +183,18 @@ fn read_and_verify_hkds(
let certs = read_certs(&hk).with_context(|| {
format!("The provided Host Key Document in '{hkd}' is not in PEM or DER format")
})?;
if certs.len() != 1 {
if certs.is_empty() {
let msg = format!(
"The provided host key document in {} contains no certificate!",
hkd
);
return Err(anyhow!(msg));
}
if certs.len() > 1 {
warn!("The host key document in '{hkd}' contains more than one certificate!")
}
// len is 1 -> unwrap will succeed
// len is >= 1 -> unwrap will succeed
let c = certs.first().unwrap();
verifier.verify(c)?;
res.push(c.public_key()?);