rama-boring 0.6.0

BoringSSL bindings for Rama
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93

//! See
//! <https://github.com/google/boringssl/blob/cc696073cffe7978d489297fbdeac4c0030384aa/crypto/x509/x509_test.cc#L3977-L3980>

use crate::stack::Stack;
use crate::x509::store::X509StoreBuilder;
use crate::x509::verify::{X509VerifyFlags, X509VerifyParamRef};
use crate::x509::{X509Ref, X509StoreContext, X509VerifyError, X509VerifyResult, X509};

#[test]
fn test_verify_cert() {
    let root2 = X509::from_pem(include_bytes!("../../../test/root-ca-2.pem")).unwrap();
    let root1 = X509::from_pem(include_bytes!("../../../test/root-ca.pem")).unwrap();
    let root1_cross = X509::from_pem(include_bytes!("../../../test/root-ca-cross.pem")).unwrap();
    let intermediate = X509::from_pem(include_bytes!("../../../test/intermediate-ca.pem")).unwrap();
    let leaf = X509::from_pem(include_bytes!("../../../test/cert-with-intermediate.pem")).unwrap();

    assert_eq!(Ok(()), verify(&leaf, &[&root1], &[&intermediate], |_| {}));

    assert_eq!(
        Ok(()),
        verify(
            &leaf,
            &[&root1, &root2],
            &[&intermediate, &root1_cross],
            |_| {}
        )
    );

    assert_eq!(
        Ok(()),
        verify(
            &leaf,
            &[&root1, &root2],
            &[&intermediate, &root1_cross],
            |param| param.set_flags(X509VerifyFlags::TRUSTED_FIRST),
        )
    );

    assert_eq!(
        Err(X509VerifyError::CERT_HAS_EXPIRED),
        verify(
            &leaf,
            &[&root1, &root2],
            &[&intermediate, &root1_cross],
            |param| param.clear_flags(X509VerifyFlags::TRUSTED_FIRST),
        )
    );

    assert_eq!(
        Ok(()),
        verify(&leaf, &[&root1], &[&intermediate, &root1_cross], |param| {
            param.clear_flags(X509VerifyFlags::TRUSTED_FIRST)
        })
    );
}

fn verify(
    cert: &X509Ref,
    trusted: &[&X509Ref],
    untrusted: &[&X509Ref],
    configure: impl FnOnce(&mut X509VerifyParamRef),
) -> X509VerifyResult {
    let trusted = {
        let mut builder = X509StoreBuilder::new().unwrap();

        for cert in trusted {
            builder.add_cert(cert).unwrap();
        }

        builder.build()
    };

    let untrusted = {
        let mut stack = Stack::new().unwrap();

        for cert in untrusted {
            stack.push((**cert).to_owned()).unwrap();
        }

        stack
    };

    let mut store_ctx = X509StoreContext::new().unwrap();

    store_ctx
        .init(&trusted, cert, &untrusted, |ctx| {
            configure(ctx.verify_param_mut());
            ctx.verify_cert().unwrap();

            Ok(ctx.verify_result())
        })
        .expect("failed to obtain X509VerifyResult")
}