kata-containers/s390-tools
1
0
Fork 0
mirror of https://github.com/ibm-s390-linux/s390-tools.git synced 2026-08-05 02:14:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

pv: Increase flexibility of verify_chain()

Browse Source 
Increase the flexibility of verify_chain and reduce the need of using
clone.

Signed-off-by: Marc Hartmayer <marc@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This commit is contained in:
Marc Hartmayer
2026-07-08 16:38:08 +02:00
committed by Jan Höppner
parent dcece3f980
commit 603a2b1762
3 changed files with 13 additions and 19 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
rust/pv/src/verify.rs
View File

@@ -2,7 +2,6 @@
//
// Copyright IBM Corp. 2023
use core::slice;
use std::path::Path;
use helper::{download_first_crl_from_x509, StoreSetupMode};
@@ -205,7 +204,7 @@ impl CertVerifier {
helper::verify_chain(
&store_builder.build(),
&chain,
slice::from_ref(&ibm_z_sign_key),
&[&ibm_z_sign_key],
&root_ca_verification,
)?;
@@ -225,12 +224,7 @@ impl CertVerifier {
}
let store = store_builder.build();
helper::verify_chain(
&store,
&chain,
slice::from_ref(&ibm_z_sign_key),
&root_ca_verification,
)?;
helper::verify_chain(&store, &chain, &[&ibm_z_sign_key], &root_ca_verification)?;
Ok(Self {
store,

14
rust/pv/src/verify/helper.rs
View File

@@ -13,7 +13,7 @@ use openssl::asn1::{Asn1Time, Asn1TimeRef};
use openssl::error::ErrorStack;
use openssl::nid::Nid;
use openssl::ssl::SslFiletype;
use openssl::stack::Stack;
use openssl::stack::{Stack, StackRef};
use openssl::x509::store::{File, X509Lookup, X509StoreBuilder, X509StoreRef};
use openssl::x509::verify::{X509VerifyFlags, X509VerifyParam};
use openssl::x509::{
@@ -209,8 +209,8 @@ fn check_x509_org_name(cert: &X509Ref, expected_org: &str) -> bool {
/// * `root_ca_verification` - Root CA verification mode
pub fn verify_chain(
store: &X509StoreRef,
untrusted_certs: &Stack<X509>,
sign_keys: &[X509],
untrusted_certs: &StackRef<X509>,
sign_keys: &[&X509Ref],
root_ca_verification: &RootCaVerification,
) -> Result<()> {
fn verify_fun(
@@ -1500,7 +1500,7 @@ mod tests {
let result = verify_chain(
&store,
&untrusted,
&[ibm_cert],
&[&ibm_cert],
&RootCaVerification::SkipPinning,
);
@@ -1537,7 +1537,7 @@ mod tests {
let result = verify_chain(
&store,
&untrusted,
&[ibm_cert],
&[&ibm_cert],
&RootCaVerification::SkipPinning,
);
@@ -1576,7 +1576,7 @@ mod tests {
let result = verify_chain(
&store,
&untrusted,
&[ibm_cert.clone()],
&[&ibm_cert.clone()],
&RootCaVerification::RootCaOrganizationPinning(wrong_org),
);
@@ -1586,7 +1586,7 @@ mod tests {
let result = verify_chain(
&store,
&untrusted,
&[ibm_cert],
&[&ibm_cert],
&RootCaVerification::RootCaOrganizationPinning(
"International Business Machines Corporation",
),

8
rust/pv/src/verify/test.rs
View File

@@ -61,7 +61,7 @@ fn verify_chain_offline() {
assert!(verify_chain(
&store,
&sk,
&[ibm_crt.clone()],
&[&ibm_crt],
&RootCaVerification::RootCaOrganizationPinning(
"International Business Machines Corporationn"
)
@@ -70,21 +70,21 @@ fn verify_chain_offline() {
assert!(verify_chain(
&store,
&sk,
&[ibm_crt.clone()],
&[&ibm_crt],
&RootCaVerification::RootCaOrganizationPinning("International")
)
.is_err());
assert!(verify_chain(
&store,
&sk,
&[ibm_crt.clone()],
&[&ibm_crt],
&RootCaVerification::RootCaOrganizationPinning(
"International Business Machines Corporation"
)
)
.is_ok());
assert!(verify_chain(&store, &sk, &[ibm_crt], &RootCaVerification::SkipPinning).is_ok());
assert!(verify_chain(&store, &sk, &[&ibm_crt], &RootCaVerification::SkipPinning).is_ok());
}
#[test]