validation: add Rust-side certificate validation helpers #9757
Conversation
|
@woodruffw This should be good to go. Can you please give this a quick review? Then we can hand the review off to Alex and Paul. |
|
I have some WIP to breakout |
|
As far as I can tell, the remaining CI failure looks unrelated. |
|
re-started it |
| fn ca_pem() -> pem::Pem { | ||
| // From vectors/cryptography_vectors/x509/custom/ca/ca.pem | ||
| pem::parse( | ||
| "-----BEGIN CERTIFICATE----- | ||
| MIIBUTCB96ADAgECAgIDCTAKBggqhkjOPQQDAjAnMQswCQYDVQQGEwJVUzEYMBYG | ||
| A1UEAwwPY3J5cHRvZ3JhcGh5IENBMB4XDTE3MDEwMTEyMDEwMFoXDTM4MTIzMTA4 | ||
| MzAwMFowJzELMAkGA1UEBhMCVVMxGDAWBgNVBAMMD2NyeXB0b2dyYXBoeSBDQTBZ | ||
| MBMGByqGSM49AgEGCCqGSM49AwEHA0IABBj/z7v5Obj13cPuwECLBnUGq0/N2CxS | ||
| JE4f4BBGZ7VfFblivTvPDG++Gve0oQ+0uctuhrNQ+WxRv8GC177F+QWjEzARMA8G | ||
| A1UdEwEB/wQFMAMBAf8wCgYIKoZIzj0EAwIDSQAwRgIhANES742XWm64tkGnz8Dn | ||
| pG6u2lHkZFQr3oaVvPcemvlbAiEA0WGGzmYx5C9UvfXIK7NEziT4pQtyESE0uRVK | ||
| Xw4nMqk= | ||
| -----END CERTIFICATE-----", | ||
| ) | ||
| .unwrap() | ||
| } |
There was a problem hiding this comment.
Nitpick: maybe put this as a pub(crate) helper under ops::tests, like v1_cert_pem? But not strong opinion.
| struct PublicKeyErrorOps {} | ||
| impl CryptoOps for PublicKeyErrorOps { | ||
| type Key = (); | ||
| type Err = (); | ||
|
|
||
| fn public_key(&self, _cert: &Certificate<'_>) -> Result<Self::Key, Self::Err> { | ||
| // Simulate failing to retrieve a public key. | ||
| Err(()) | ||
| } | ||
|
|
||
| fn verify_signed_by( | ||
| &self, | ||
| _cert: &Certificate<'_>, | ||
| _key: Self::Key, | ||
| ) -> Result<(), Self::Err> { | ||
| Ok(()) | ||
| } | ||
| } |
There was a problem hiding this comment.
Same thought as https://github.com/pyca/cryptography/pull/9757/files#r1371940144.
| #[allow(dead_code)] | ||
| pub(crate) fn cert_is_self_issued(cert: &Certificate<'_>) -> bool { | ||
| cert.issuer() == cert.subject() | ||
| } | ||
|
|
||
| #[allow(dead_code)] |
There was a problem hiding this comment.
@alex or @reaperhulk can counterindicate, but IMO we could make these pub instead of allow(dead_code) to get around any warnings here (since this crate isn't published anywhere anyways).
Breakout from #8873.