kata-containers/s390-tools
1
0
Fork 0
mirror of https://github.com/ibm-s390-linux/s390-tools.git synced 2026-08-05 02:14:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

pv: Add root CA organization pinning to certificate verification

Browse Source 
Enforce root CA organization name requirements during certificate chain
validation to prevent accepting certificates from unexpected root CAs.

Add RootCaVerification enum with RootCaOrganizationPinning and
SkipPinning variants. Extend verify_chain() to validate root CA
organization. Default to pinning "DigiCert" for standard trust chains,
skip pinning when custom root CA is provided.

Assisted-by: IBM Bob:1.0.6
Signed-off-by: Marc Hartmayer <marc@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This commit is contained in:
Marc Hartmayer
2026-07-08 16:08:45 +02:00
committed by Jan Höppner
parent 42eba67268
commit ff19180f03
3 changed files with 340 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rust/pv/src/verify.rs
+11 -1
View File
@@ -187,6 +187,10 @@ impl CertVerifier {
untr_certs.append(&mut crt);
}
let (ibm_z_sign_key, chain) = helper::extract_ibm_sign_key(untr_certs.clone())?;
let root_ca_verification = match root_ca_path {
Some(_) => helper::RootCaVerification::SkipPinning,
None => helper::RootCaVerification::RootCaOrganizationPinning("DigiCert"),
};
// Two-round verification:
//
@@ -202,6 +206,7 @@ impl CertVerifier {
&store_builder.build(),
&chain,
slice::from_ref(&ibm_z_sign_key),
&root_ca_verification,
)?;
// Round 2: Download CRLs and verify again, but this time with CRL checks
@@ -220,7 +225,12 @@ impl CertVerifier {
}
let store = store_builder.build();
helper::verify_chain(&store, &chain, slice::from_ref(&ibm_z_sign_key))?;
helper::verify_chain(
&store,
&chain,
slice::from_ref(&ibm_z_sign_key),
&root_ca_verification,
)?;
Ok(Self {
store,