Skip to content

Commit f9bff59

Browse files
liuw1jyao1
liuw1
authored and
jyao1
committed
Upgrade der to version 0.7.9
Signed-off-by: Wei Liu <[email protected]>
1 parent 1142fe2 commit f9bff59

File tree

11 files changed

+257
-458
lines changed

11 files changed

+257
-458
lines changed

‎Cargo.lock

Lines changed: 137 additions & 151 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎src/attestation/Cargo.toml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ edition = "2021"
77

88
[dependencies]
99
crypto = { path = "../crypto" }
10-
der = { version = "0.5.1", features = ["oid", "alloc", "derive"] }
10+
der = { version = "0.7.9", features = ["oid", "alloc", "derive"] }
1111
spin = "0.9.2"
1212
tdx-tdcall = { path = "../../deps/td-shim/tdx-tdcall"}
1313
td-payload = { path = "../../deps/td-shim/td-payload", features = ["tdx"] }

‎src/attestation/src/root_ca.rs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
// SPDX-License-Identifier: BSD-2-Clause-Patent
44

55
use crypto::x509::Certificate;
6-
use der::Decodable;
6+
use der::Decode;
77
use spin::Once;
88

99
use crate::Error;

‎src/crypto/Cargo.toml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ edition = "2021"
77

88
[dependencies]
99
bytes = { version="1", default-features=false }
10-
der = {version = "0.5.1", features = ["oid", "alloc", "derive"]}
10+
der = {version = "0.7.9", features = ["oid", "alloc", "derive"]}
1111
global = { path = "../global" }
1212
log = "0.4.13"
1313
ring = { version = "0.17.6" }

‎src/crypto/fuzz/Cargo.toml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ libfuzzer-sys = {version = "0.4", optional = true }
1313
afl = {version = "*", optional = true }
1414
log = "0.4.13"
1515
arbitrary = "=1.1.3"
16-
der = {version = "0.5.1", features = ["oid", "alloc", "derive"]}
16+
der = {version = "0.7.9", features = ["oid", "alloc", "derive"]}
1717
serde = "=1.0.198"
1818

1919
[dependencies.crypto]

‎src/crypto/fuzz/fuzz_targets/afl_certchain.rs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
use crypto::resolve::{get_cert_from_certchain, parse_extensions};
22
use crypto::x509::Certificate;
3-
use der::Decodable;
3+
use der::Decode;
44

55

66
fn main() {

‎src/crypto/fuzz/fuzz_targets/certchain.rs

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ use libfuzzer_sys::fuzz_target;
33

44
use crypto::resolve::{get_cert_from_certchain, parse_extensions};
55
use crypto::x509::Certificate;
6-
use der::Decodable;
6+
use der::Decode;
77

88
fuzz_target!(|data: &[u8]| {
99
// fuzzed code goes here

‎src/crypto/src/ek_cert.rs

Lines changed: 25 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,8 @@
33
// SPDX-License-Identifier: Apache-2.0
44

55
use alloc::vec;
6-
use der::asn1::{BitString, ObjectIdentifier, OctetString, SetOfVec, Utf8String};
7-
use der::{Any, Encodable, Tag};
6+
use der::asn1::{BitStringRef, ObjectIdentifier, OctetStringRef, SetOfVec, Utf8StringRef};
7+
use der::{AnyRef, Encode, Tag};
88
use global::GLOBAL_TPM_DATA;
99
use ring::digest;
1010
use ring::rand::SystemRandom;
@@ -21,10 +21,10 @@ use crate::{
2121
x509::{AlgorithmIdentifier, X509Error},
2222
};
2323

24-
const SUBJECT_ALT_NAME: ObjectIdentifier = ObjectIdentifier::new("2.5.29.17");
25-
const TCG_TPM_MANUFACTURER: ObjectIdentifier = ObjectIdentifier::new("2.23.133.2.1");
26-
const TCG_TPM_MODEL: ObjectIdentifier = ObjectIdentifier::new("2.23.133.2.2");
27-
const TCG_TPM_VERSION: ObjectIdentifier = ObjectIdentifier::new("2.23.133.2.3");
24+
const SUBJECT_ALT_NAME: ObjectIdentifier = ObjectIdentifier::new_unwrap("2.5.29.17");
25+
const TCG_TPM_MANUFACTURER: ObjectIdentifier = ObjectIdentifier::new_unwrap("2.23.133.2.1");
26+
const TCG_TPM_MODEL: ObjectIdentifier = ObjectIdentifier::new_unwrap("2.23.133.2.2");
27+
const TCG_TPM_VERSION: ObjectIdentifier = ObjectIdentifier::new_unwrap("2.23.133.2.3");
2828

2929
pub fn generate_ca_cert(
3030
td_quote: &[u8],
@@ -41,7 +41,7 @@ pub fn generate_ca_cert(
4141
// Generate x.509 certificate
4242
let algorithm = AlgorithmIdentifier {
4343
algorithm: ID_EC_PUBKEY_OID,
44-
parameters: Some(Any::new(Tag::ObjectIdentifier, SECP384R1_OID.as_bytes()).unwrap()),
44+
parameters: Some(AnyRef::new(Tag::ObjectIdentifier, SECP384R1_OID.as_bytes()).unwrap()),
4545
};
4646

4747
let sig_alg = AlgorithmIdentifier {
@@ -52,13 +52,13 @@ pub fn generate_ca_cert(
5252
// extended key usage
5353
let eku: alloc::vec::Vec<ObjectIdentifier> = vec![VTPMTD_CA_EXTENDED_KEY_USAGE];
5454
let eku = eku
55-
.to_vec()
55+
.to_der()
5656
.map_err(|e| ResolveError::GenerateCertificate(X509Error::DerEncoding(e)))?;
5757

5858
// basic constrains
5959
let basic_constrains: alloc::vec::Vec<bool> = vec![true];
6060
let basic_constrains = basic_constrains
61-
.to_vec()
61+
.to_der()
6262
.map_err(|e| ResolveError::GenerateCertificate(X509Error::DerEncoding(e)))?;
6363

6464
let x509_certificate = x509::CertificateBuilder::new(
@@ -95,19 +95,19 @@ pub fn generate_ca_cert(
9595
.build();
9696

9797
x509_certificate
98-
.to_vec()
98+
.to_der()
9999
.map_err(|e| ResolveError::GenerateCertificate(X509Error::DerEncoding(e)))
100100
}
101101

102102
fn gen_auth_key_identifier(ek_pub: &[u8]) -> Result<alloc::vec::Vec<u8>, ResolveError> {
103103
// authority key identifier
104104
let ek_pub_sha1 = digest::digest(&digest::SHA1_FOR_LEGACY_USE_ONLY, ek_pub);
105-
let pub_sha1 = OctetString::new(ek_pub_sha1.as_ref())
105+
let pub_sha1 = OctetStringRef::new(ek_pub_sha1.as_ref())
106106
.map_err(|e| ResolveError::GenerateCertificate(X509Error::DerEncoding(e)))?;
107107
let auth_key_identifier: AuthorityKeyIdentifier = AuthorityKeyIdentifier(pub_sha1);
108108
let auth_key_identifier = vec![auth_key_identifier];
109109
auth_key_identifier
110-
.to_vec()
110+
.to_der()
111111
.map_err(|e| ResolveError::GenerateCertificate(X509Error::DerEncoding(e)))
112112
}
113113

@@ -117,9 +117,9 @@ fn gen_subject_alt_name() -> Result<alloc::vec::Vec<u8>, ResolveError> {
117117
let mut tcg_tpm_manufaturer = SetOfVec::new();
118118
let mut manufacturer = alloc::vec::Vec::new();
119119
manufacturer.extend_from_slice(&tpm2_caps.manufacturer.to_be_bytes());
120-
let _ = tcg_tpm_manufaturer.add(DistinguishedName {
120+
let _ = tcg_tpm_manufaturer.insert(DistinguishedName {
121121
attribute_type: TCG_TPM_MANUFACTURER,
122-
value: Utf8String::new(manufacturer.as_slice()).unwrap().into(),
122+
value: Utf8StringRef::new(manufacturer.as_slice()).unwrap().into(),
123123
});
124124

125125
let mut tcg_tpm_model = SetOfVec::new();
@@ -128,25 +128,25 @@ fn gen_subject_alt_name() -> Result<alloc::vec::Vec<u8>, ResolveError> {
128128
model.extend_from_slice(&tpm2_caps.vendor_2.to_be_bytes());
129129
model.extend_from_slice(&tpm2_caps.vendor_3.to_be_bytes());
130130
model.extend_from_slice(&tpm2_caps.vendor_4.to_be_bytes());
131-
let _ = tcg_tpm_model.add(DistinguishedName {
131+
let _ = tcg_tpm_model.insert(DistinguishedName {
132132
attribute_type: TCG_TPM_MODEL,
133-
value: Utf8String::new(model.as_slice()).unwrap().into(),
133+
value: Utf8StringRef::new(model.as_slice()).unwrap().into(),
134134
});
135135

136136
let mut tcg_tpm_version = SetOfVec::new();
137137
let mut version = alloc::vec::Vec::new();
138138
version.extend_from_slice(&tpm2_caps.version_1.to_be_bytes());
139139
version.extend_from_slice(&tpm2_caps.version_2.to_be_bytes());
140-
let _ = tcg_tpm_version.add(DistinguishedName {
140+
let _ = tcg_tpm_version.insert(DistinguishedName {
141141
attribute_type: TCG_TPM_VERSION,
142-
value: Utf8String::new(version.as_slice()).unwrap().into(),
142+
value: Utf8StringRef::new(version.as_slice()).unwrap().into(),
143143
});
144144

145145
let sub_alt_name = vec![tcg_tpm_manufaturer, tcg_tpm_model, tcg_tpm_version];
146146
let sub_alt_name: SubjectAltName = SubjectAltName(sub_alt_name);
147147
let sub_alt_name = vec![sub_alt_name];
148148
sub_alt_name
149-
.to_vec()
149+
.to_der()
150150
.map_err(|e| ResolveError::GenerateCertificate(X509Error::DerEncoding(e)))
151151
}
152152

@@ -164,7 +164,7 @@ pub fn generate_ek_cert(
164164
// Generate x.509 certificate
165165
let algorithm = AlgorithmIdentifier {
166166
algorithm: ID_EC_PUBKEY_OID,
167-
parameters: Some(Any::new(Tag::ObjectIdentifier, SECP384R1_OID.as_bytes()).unwrap()),
167+
parameters: Some(AnyRef::new(Tag::ObjectIdentifier, SECP384R1_OID.as_bytes()).unwrap()),
168168
};
169169

170170
let sig_alg = AlgorithmIdentifier {
@@ -175,24 +175,24 @@ pub fn generate_ek_cert(
175175
// basic constrains
176176
let basic_constrains: alloc::vec::Vec<bool> = vec![false];
177177
let basic_constrains = basic_constrains
178-
.to_vec()
178+
.to_der()
179179
.map_err(|e| ResolveError::GenerateCertificate(X509Error::DerEncoding(e)))?;
180180

181181
// extended key usage
182182
let eku: alloc::vec::Vec<ObjectIdentifier> = vec![TCG_EK_CERTIFICATE];
183183
let eku = eku
184-
.to_vec()
184+
.to_der()
185185
.map_err(|e| ResolveError::GenerateCertificate(X509Error::DerEncoding(e)))?;
186186

187187
// authority key identifier
188188
let auth_key_identifier = gen_auth_key_identifier(ek_pub)?;
189189

190190
// follow ek-credential spec Section 3.2.
191191
// keyAgreement (4) refers to https://datatracker.ietf.org/doc/html/rfc5280#section-4.2.1.3
192-
let ku = BitString::new(0, &[0x08])
192+
let ku = BitStringRef::new(0, &[0x08])
193193
.map_err(|e| ResolveError::GenerateCertificate(X509Error::DerEncoding(e)))?;
194194
let ku = ku
195-
.to_vec()
195+
.to_der()
196196
.map_err(|e| ResolveError::GenerateCertificate(X509Error::DerEncoding(e)))?;
197197

198198
// subject alt name
@@ -228,6 +228,6 @@ pub fn generate_ek_cert(
228228
.build();
229229

230230
x509_certificate
231-
.to_vec()
231+
.to_der()
232232
.map_err(|e| ResolveError::GenerateCertificate(X509Error::DerEncoding(e)))
233233
}

‎src/crypto/src/resolve.rs

Lines changed: 23 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ use super::x509::{AlgorithmIdentifier, ExtendedKeyUsage, Extensions};
88
use crate::x509::Certificate;
99
use alloc::vec;
1010
use der::asn1::ObjectIdentifier;
11-
use der::{Any, Decodable, Encodable, Tag};
11+
use der::{AnyRef, Decode, Encode, Tag};
1212
use ring::digest;
1313
use ring::pkcs8::Document;
1414
use ring::rand::SystemRandom;
@@ -17,46 +17,46 @@ use spdmlib::error::{SpdmResult, SPDM_STATUS_INVALID_CERT};
1717

1818
use tdx_tdcall::tdreport::TD_REPORT_SIZE;
1919

20-
pub const BASIC_CONSTRAINTS: ObjectIdentifier = ObjectIdentifier::new("2.5.29.19");
21-
pub const SUBJECT_KEY_IDENTIFIER: ObjectIdentifier = ObjectIdentifier::new("2.5.29.14");
22-
pub const KEY_USAGE: ObjectIdentifier = ObjectIdentifier::new("2.5.29.15");
23-
pub const AUTHORITY_KEY_IDENTIFIER: ObjectIdentifier = ObjectIdentifier::new("2.5.29.35");
24-
pub const EXTENDED_KEY_USAGE: ObjectIdentifier = ObjectIdentifier::new("2.5.29.37");
20+
pub const BASIC_CONSTRAINTS: ObjectIdentifier = ObjectIdentifier::new_unwrap("2.5.29.19");
21+
pub const SUBJECT_KEY_IDENTIFIER: ObjectIdentifier = ObjectIdentifier::new_unwrap("2.5.29.14");
22+
pub const KEY_USAGE: ObjectIdentifier = ObjectIdentifier::new_unwrap("2.5.29.15");
23+
pub const AUTHORITY_KEY_IDENTIFIER: ObjectIdentifier = ObjectIdentifier::new_unwrap("2.5.29.35");
24+
pub const EXTENDED_KEY_USAGE: ObjectIdentifier = ObjectIdentifier::new_unwrap("2.5.29.37");
2525

2626
pub const VTPMTD_EXTENDED_KEY_USAGE: ObjectIdentifier =
27-
ObjectIdentifier::new("2.16.840.1.113741.1.5.5.2.1");
27+
ObjectIdentifier::new_unwrap("2.16.840.1.113741.1.5.5.2.1");
2828
pub const VTPMTD_CA_EXTENDED_KEY_USAGE: ObjectIdentifier =
29-
ObjectIdentifier::new("2.16.840.1.113741.1.5.5.2.5");
29+
ObjectIdentifier::new_unwrap("2.16.840.1.113741.1.5.5.2.5");
3030
pub const EXTNID_VTPMTD_REPORT: ObjectIdentifier =
31-
ObjectIdentifier::new("2.16.840.1.113741.1.5.5.2.4");
31+
ObjectIdentifier::new_unwrap("2.16.840.1.113741.1.5.5.2.4");
3232
pub const EXTNID_VTPMTD_QUOTE: ObjectIdentifier =
33-
ObjectIdentifier::new("2.16.840.1.113741.1.5.5.2.2");
33+
ObjectIdentifier::new_unwrap("2.16.840.1.113741.1.5.5.2.2");
3434
pub const EXTNID_VTPMTD_EVENT_LOG: ObjectIdentifier =
35-
ObjectIdentifier::new("2.16.840.1.113741.1.5.5.2.3");
35+
ObjectIdentifier::new_unwrap("2.16.840.1.113741.1.5.5.2.3");
3636

3737
pub const TDVF_EXTENDED_KEY_USAGE: ObjectIdentifier =
38-
ObjectIdentifier::new("2.16.840.1.113741.1.5.5.3.1");
38+
ObjectIdentifier::new_unwrap("2.16.840.1.113741.1.5.5.3.1");
3939
pub const EXTNID_TDVF_REPORT: ObjectIdentifier =
40-
ObjectIdentifier::new("2.16.840.1.113741.1.5.5.3.4");
40+
ObjectIdentifier::new_unwrap("2.16.840.1.113741.1.5.5.3.4");
4141
pub const EXTNID_TDVF_QUOTE: ObjectIdentifier =
42-
ObjectIdentifier::new("2.16.840.1.113741.1.5.5.3.2");
42+
ObjectIdentifier::new_unwrap("2.16.840.1.113741.1.5.5.3.2");
4343

44-
pub const SERVER_AUTH: ObjectIdentifier = ObjectIdentifier::new("1.3.6.1.5.5.7.3.1");
45-
pub const CLIENT_AUTH: ObjectIdentifier = ObjectIdentifier::new("1.3.6.1.5.5.7.3.2");
44+
pub const SERVER_AUTH: ObjectIdentifier = ObjectIdentifier::new_unwrap("1.3.6.1.5.5.7.3.1");
45+
pub const CLIENT_AUTH: ObjectIdentifier = ObjectIdentifier::new_unwrap("1.3.6.1.5.5.7.3.2");
4646

47-
pub const TCG_EK_CERTIFICATE: ObjectIdentifier = ObjectIdentifier::new("2.23.133.8.1");
47+
pub const TCG_EK_CERTIFICATE: ObjectIdentifier = ObjectIdentifier::new_unwrap("2.23.133.8.1");
4848

4949
// As specified in https://datatracker.ietf.org/doc/html/rfc5480#appendix-A
5050
// id-ecPublicKey OBJECT IDENTIFIER ::= {
5151
// iso(1) member-body(2) us(840) ansi-X9-62(10045) keyType(2) 1
5252
// }
53-
pub const ID_EC_PUBKEY_OID: ObjectIdentifier = ObjectIdentifier::new("1.2.840.10045.2.1");
53+
pub const ID_EC_PUBKEY_OID: ObjectIdentifier = ObjectIdentifier::new_unwrap("1.2.840.10045.2.1");
5454
// secp384r1 OBJECT IDENTIFIER ::= {
5555
// iso(1) identified-organization(3) certicom(132) curve(0) 34
5656
// }
57-
pub const SECP384R1_OID: ObjectIdentifier = ObjectIdentifier::new("1.3.132.0.34");
57+
pub const SECP384R1_OID: ObjectIdentifier = ObjectIdentifier::new_unwrap("1.3.132.0.34");
5858

59-
pub const ID_EC_SIG_OID: ObjectIdentifier = ObjectIdentifier::new("1.2.840.10045.4.3.3");
59+
pub const ID_EC_SIG_OID: ObjectIdentifier = ObjectIdentifier::new_unwrap("1.2.840.10045.4.3.3");
6060

6161
#[derive(Debug)]
6262
pub enum ResolveError {
@@ -115,7 +115,7 @@ pub fn generate_certificate(
115115
// Generate x.509 certificate
116116
let algorithm = AlgorithmIdentifier {
117117
algorithm: ID_EC_PUBKEY_OID,
118-
parameters: Some(Any::new(Tag::ObjectIdentifier, SECP384R1_OID.as_bytes()).unwrap()),
118+
parameters: Some(AnyRef::new(Tag::ObjectIdentifier, SECP384R1_OID.as_bytes()).unwrap()),
119119
};
120120

121121
let sig_alg = AlgorithmIdentifier {
@@ -125,7 +125,7 @@ pub fn generate_certificate(
125125

126126
let eku = vec![VTPMTD_EXTENDED_KEY_USAGE];
127127
let eku = eku
128-
.to_vec()
128+
.to_der()
129129
.map_err(|e| ResolveError::GenerateCertificate(X509Error::DerEncoding(e)))?;
130130
let x509_certificate =
131131
x509::CertificateBuilder::new(sig_alg, algorithm, key_pair.public_key().as_ref(), true)?
@@ -152,7 +152,7 @@ pub fn generate_certificate(
152152
.build();
153153

154154
x509_certificate
155-
.to_vec()
155+
.to_der()
156156
.map_err(|e| ResolveError::GenerateCertificate(X509Error::DerEncoding(e)))
157157
}
158158

0 commit comments

Comments
 (0)