kata-containers/s390-tools
1
0
Fork 0
mirror of https://github.com/ibm-s390-linux/s390-tools.git synced 2026-08-05 02:14:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

rust: Refactoring and reduce API surface

Browse Source 
Prepare pv & pv_core crates to be released on crates.io:
* Remove any unused API to stay flexible
* Remove utils dependency
* Move cli, tmpfile and version utilities to local utils crate
* Use the new utilities in the pv tools
* Rename Secret into Confidential to avoid confusion of Secret (now
  Confidential) and AddSecret requests.
* Move the uvsecret module out of the request module and change the name
  to secret.
* Cleanup dependencies
* Precise and correct minimal dependency versions
* Inline `Aes256Key::from_digest`

The cleanup ensures that the code also compiles with the dependencies
resolved to their minimal versions using:

$ cargo +nightly -Z minimal-versions update
$ cargo build

For more information refer to this blog post:
https://users.rust-lang.org/t/psa-please-specify-precise-dependency-versions-in-cargo-toml/71277/8

Signed-off-by: Marc Hartmayer <mhartmay@de.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
This commit is contained in:
Steffen Eiden
2024-05-21 16:26:51 +02:00
parent 5648b924d6
commit 381fecfc44
44 changed files with 499 additions and 490 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rust/pv/tests/add_secret_request.rs
+4 -4
View File
@@ -10,12 +10,12 @@ use pv::{
get_test_asset,
request::{
openssl::pkey::{PKey, Public},
uvsecret::{
verify_asrcb_and_get_user_data, AddSecretFlags, AddSecretRequest, AddSecretVersion,
ExtSecret, GuestSecret,
},
BootHdrTags, ReqEncrCtx, Request, SymKey,
},
secret::{
verify_asrcb_and_get_user_data, AddSecretFlags, AddSecretRequest, AddSecretVersion,
ExtSecret, GuestSecret,
},
test_utils::get_test_keys,
uv::ConfigUid,
Result,
rust/pv/tests/cert_verifier.rs
+32 -42
View File
@@ -30,90 +30,80 @@ fn verify_sign_error_slice(exp_raw: &[c_int], obs: Error) {
#[test]
fn verifier_new() {
let root_chn_crt = get_cert_asset_path_string("root_ca.chained.crt");
let root_crt = get_cert_asset_path_string("root_ca.crt");
let inter_crt = get_cert_asset_path_string("inter_ca.crt");
let inter_fake_crt = get_cert_asset_path_string("fake_inter_ca.crt");
let inter_fake_crl = get_cert_asset_path_string("fake_inter_ca.crl");
let inter_crl = get_cert_asset_path_string("inter_ca.crl");
let ibm_crt = get_cert_asset_path_string("ibm.crt");
let ibm_early_crt = get_cert_asset_path_string("ibm_outdated_early.crl");
let ibm_late_crt = get_cert_asset_path_string("ibm_outdated_late.crl");
let ibm_rev_crt = get_cert_asset_path_string("ibm_rev.crt");
let root_chn_crt = get_cert_asset_path("root_ca.chained.crt");
let root_crt = get_cert_asset_path("root_ca.crt");
let inter_crt = get_cert_asset_path("inter_ca.crt");
let inter_fake_crt = get_cert_asset_path("fake_inter_ca.crt");
let inter_fake_crl = get_cert_asset_path("fake_inter_ca.crl");
let inter_crl = get_cert_asset_path("inter_ca.crl");
let ibm_crt = get_cert_asset_path("ibm.crt");
let ibm_early_crt = get_cert_asset_path("ibm_outdated_early.crl");
let ibm_late_crt = get_cert_asset_path("ibm_outdated_late.crl");
let ibm_rev_crt = get_cert_asset_path("ibm_rev.crt");
// Too many signing keys
let verifier = CertVerifier::new(&[ibm_crt.clone(), ibm_rev_crt.clone()], &[], &None, true);
let verifier = CertVerifier::new(&[&ibm_crt, &ibm_rev_crt], &[], None, true);
assert!(matches!(verifier, Err(Error::HkdVerify(ManyIbmSignKeys))));
// No CRL for each X509
let verifier = CertVerifier::new(
&[inter_crt.clone(), ibm_crt.clone()],
&[inter_crl.clone()],
&Some(root_crt),
&[&inter_crt, &ibm_crt],
&[&inter_crl],
Some(&root_crt),
false,
);
verify_sign_error(3, verifier.unwrap_err());
let verifier = CertVerifier::new(
&[inter_crt.clone(), ibm_crt.clone()],
&[],
&Some(root_chn_crt.clone()),
false,
);
let verifier = CertVerifier::new(&[&inter_crt, &ibm_crt], &[], Some(&root_chn_crt), false);
verify_sign_error(3, verifier.unwrap_err());
// Wrong intermediate (or ibm key)
let verifier = CertVerifier::new(
&[inter_fake_crt, ibm_crt.clone()],
&[inter_fake_crl],
&Some(root_chn_crt.clone()),
&[&inter_fake_crt, &ibm_crt],
&[&inter_fake_crl],
Some(&root_chn_crt),
true,
);
// Depending on the OpenSSL version different error codes can appear
verify_sign_error_slice(&[20, 30], verifier.unwrap_err());
// Wrong root ca
let verifier = CertVerifier::new(
&[inter_crt.clone(), ibm_crt.clone()],
&[inter_crl.clone()],
&None,
true,
);
let verifier = CertVerifier::new(&[&inter_crt, &ibm_crt], &[&inter_crl], None, true);
verify_sign_error(20, verifier.unwrap_err());
// Correct signing key + intermediate cert
let _verifier = CertVerifier::new(
&[inter_crt.clone(), ibm_crt.clone()],
&[inter_crl.clone()],
&Some(root_chn_crt.clone()),
&[&inter_crt, &ibm_crt],
&[&inter_crl],
Some(&root_chn_crt),
false,
)
.unwrap();
// No intermediate key
let verifier = CertVerifier::new(&[ibm_crt], &[], &Some(root_chn_crt.clone()), false);
let verifier = CertVerifier::new(&[&ibm_crt], &[], Some(&root_chn_crt), false);
verify_sign_error(20, verifier.unwrap_err());
// IBM Sign outdated
let verifier = CertVerifier::new(
&[inter_crt.clone(), ibm_early_crt],
&[inter_crl.clone()],
&Some(root_chn_crt.clone()),
&[&inter_crt, &ibm_early_crt],
&[&inter_crl],
Some(&root_chn_crt),
false,
);
assert!(matches!(verifier, Err(Error::HkdVerify(NoIbmSignKey))));
let verifier = CertVerifier::new(
&[inter_crt.clone(), ibm_late_crt],
&[inter_crl.clone()],
&Some(root_chn_crt.clone()),
&[&inter_crt, &ibm_late_crt],
&[&inter_crl],
Some(&root_chn_crt),
false,
);
assert!(matches!(verifier, Err(Error::HkdVerify(NoIbmSignKey))));
// Revoked
let verifier = CertVerifier::new(
&[inter_crt, ibm_rev_crt],
&[inter_crl],
&Some(root_chn_crt),
&[&inter_crt, &ibm_rev_crt],
&[&inter_crl],
Some(&root_chn_crt),
false,
);
verify_sign_error(23, verifier.unwrap_err());