Henry Kleynhans 75216f239f crypto: only verify CA certs in chain of trust ...

The CA file provided to qemu may contain CA certificates which do not
form part of the chain of trust for the specific certificate we are
sanity checking.

This patch changes the sanity checking from validating every CA
certificate to only checking the CA certificates which are part of the
chain of trust (issuer chain).  Other certificates are ignored.

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Henry Kleynhans <hkleynhans@fb.com>
[DB: changed 'int' to 'bool' in 'checking_issuer' variable]
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>

2025-10-24 13:06:05 +01:00

..

check-block-qdict.c

qapi: Move include/qapi/qmp/ to include/qobject/

2025-02-10 15:33:16 +01:00

check-qdict.c

qapi: Move include/qapi/qmp/ to include/qobject/

2025-02-10 15:33:16 +01:00

check-qjson.c

qapi: Move include/qapi/qmp/ to include/qobject/

2025-02-10 15:33:16 +01:00

check-qlist.c

qapi: Move include/qapi/qmp/ to include/qobject/

2025-02-10 15:33:16 +01:00

check-qlit.c

qapi: Move include/qapi/qmp/ to include/qobject/

2025-02-10 15:33:16 +01:00

check-qnull.c

qapi: Move include/qapi/qmp/ to include/qobject/

2025-02-10 15:33:16 +01:00

check-qnum.c

qapi: Move include/qapi/qmp/ to include/qobject/

2025-02-10 15:33:16 +01:00

check-qobject.c

qapi: Move include/qapi/qmp/ to include/qobject/

2025-02-10 15:33:16 +01:00

check-qom-interface.c

qom: Make InterfaceInfo[] uses const

2025-04-25 17:00:41 +02:00

check-qom-proplist.c

qom: Make InterfaceInfo[] uses const

2025-04-25 17:00:41 +02:00

check-qstring.c

qapi: Move include/qapi/qmp/ to include/qobject/

2025-02-10 15:33:16 +01:00

crypto-tls-psk-helpers.c

crypto: Remove 'crypto-tls-x509-helpers.h' from crypto-tls-psk-helpers.c

2024-07-24 10:39:10 +01:00

crypto-tls-psk-helpers.h

…

crypto-tls-x509-helpers.c

tests/unit/crypto-tls-x509-helpers: deinit privkey in test_tls_cleanup

2024-09-03 16:24:34 -03:00

crypto-tls-x509-helpers.h

tests/qtest/migration-test: Free QCRyptoTLSTestCertReq objects

2024-09-03 16:24:34 -03:00

io-channel-helpers.c

treewide: handle result of qio_channel_set_blocking()

2025-09-19 12:46:07 +01:00

io-channel-helpers.h

…

iothread.c

…

iothread.h

…

meson.build

tests/unit: remove block layer code from test-nested-aio-poll

2024-10-02 12:58:46 +02:00

pkix_asn1_tab.c.inc

crypto: Restrict pkix_asn1_tab[] to crypto-tls-x509-helpers.c

2024-07-24 10:39:10 +01:00

ptimer-test-stubs.c

…

ptimer-test.c

hw/core/ptimer: fix timer zero period condition for freq > 1GHz

2024-08-12 11:40:16 +01:00

ptimer-test.h

…

rcutorture.c

…

socket-helpers.c

util: drop qemu_socket_set_nonblock()

2025-09-19 12:46:07 +01:00

socket-helpers.h

…

test-aio-multithread.c

futex: Support Windows

2025-06-06 14:32:55 +02:00

test-aio.c

…

test-authz-list.c

…

test-authz-listfile.c

…

test-authz-pam.c

…

test-authz-simple.c

…

test-base64.c

…

test-bdrv-drain.c

block: drop wrapper for bdrv_set_backing_hd_drained()

2025-07-14 15:41:58 +02:00

test-bdrv-graph-mod.c

block: drop wrapper for bdrv_set_backing_hd_drained()

2025-07-14 15:41:58 +02:00

test-bitcnt.c

…

test-bitmap.c

…

test-bitops.c

…

test-block-backend.c

include: Rename sysemu/ -> system/

2024-12-20 17:44:56 +01:00

test-block-iothread.c

mirror: Drop redundant zero_target parameter

2025-05-14 20:10:12 -05:00

test-blockjob-txn.c

qapi: Move include/qapi/qmp/ to include/qobject/

2025-02-10 15:33:16 +01:00

test-blockjob.c

qapi: Move include/qapi/qmp/ to include/qobject/

2025-02-10 15:33:16 +01:00

test-bufferiszero.c

…

test-char.c

tests: use macros for registering char tests for sockets

2025-10-24 13:04:31 +01:00

test-clone-visitor.c

…

test-coroutine.c

…

test-crypto-afsplit.c

qapi/crypto: Rename QCryptoHashAlgorithm to *Algo, and drop prefix

2024-09-10 14:02:16 +02:00

test-crypto-akcipher.c

qapi/crypto: Rename QCryptoRSAPaddingAlgorithm to *Algo, and drop prefix

2024-09-10 14:03:30 +02:00

test-crypto-block.c

tests: skip legacy qcow2 encryption test if AES is not available

2025-05-21 19:36:43 +01:00

test-crypto-cipher.c

tests: fix skipping cipher tests when AES is not available

2025-05-21 19:36:43 +01:00

test-crypto-der.c

…

test-crypto-hash.c

crypto: Introduce SM3 hash hmac pbkdf algorithm

2024-11-05 18:37:18 +00:00

test-crypto-hmac.c

crypto: Introduce SM3 hash hmac pbkdf algorithm

2024-11-05 18:37:18 +00:00

test-crypto-ivgen.c

qapi/crypto: Rename QCryptoIVGenAlgorithm to *Algo, and drop prefix

2024-09-10 14:03:30 +02:00

test-crypto-pbkdf.c

crypto: Introduce SM3 hash hmac pbkdf algorithm

2024-11-05 18:37:18 +00:00

test-crypto-secret.c

tests: skip encrypted secret tests if AES is not available

2025-05-21 19:36:43 +01:00

test-crypto-tlscredsx509.c

crypto: only verify CA certs in chain of trust

2025-10-24 13:06:05 +01:00

test-crypto-tlssession.c

util: drop qemu_socket_set_nonblock()

2025-09-19 12:46:07 +01:00

test-crypto-xts.c

…

test-cutils.c

…

test-div128.c

…

test-error-report.c

error: Kill @error_warn

2025-10-01 08:33:24 +02:00

test-fifo.c

tests/unit: Comment FIFO8 tests

2024-09-13 20:11:13 +02:00

test-forward-visitor.c

qapi: Move include/qapi/qmp/ to include/qobject/

2025-02-10 15:33:16 +01:00

test-hbitmap.c

…

test-image-locking.c

qapi: Move include/qapi/qmp/ to include/qobject/

2025-02-10 15:33:16 +01:00

test-int128.c

…

test-interval-tree.c

…

test-io-channel-buffer.c

…

test-io-channel-command.c

…

test-io-channel-file.c

…

test-io-channel-null.c

…

test-io-channel-socket.c

tests/unit: Add a assert for test_io_channel_unix_listen_cleanup

2024-10-10 13:41:45 +01:00

test-io-channel-tls.c

treewide: handle result of qio_channel_set_blocking()

2025-09-19 12:46:07 +01:00

test-io-task.c

…

test-iov.c

treewide: use qemu_set_blocking instead of g_unix_set_fd_nonblocking

2025-09-19 12:46:07 +01:00

test-keyval.c

qapi: Move include/qapi/qmp/ to include/qobject/

2025-02-10 15:33:16 +01:00

test-logging.c

…

test-mul64.c

…

test-nested-aio-poll.c

tests/unit: Remove debug statements in test-nested-aio-poll.c

2024-04-25 15:15:25 +02:00

test-opts-visitor.c

…

test-qapi-util.c

…

test-qdev-global-props.c

qom: Have class_init() take a const data argument

2025-04-25 17:00:41 +02:00

test-qdist.c

…

test-qemu-opts.c

qapi: Move include/qapi/qmp/ to include/qobject/

2025-02-10 15:33:16 +01:00

test-qga.c

qga: Add tests for guest-get-load command

2025-06-12 17:02:05 +03:00

test-qgraph.c

cleanup: Drop pointless return at end of function

2025-04-24 09:33:42 +02:00

test-qht.c

…

test-qmp-cmds.c

qapi: Move include/qapi/qmp/ to include/qobject/

2025-02-10 15:33:16 +01:00

test-qmp-event.c

qapi: Move include/qapi/qmp/ to include/qobject/

2025-02-10 15:33:16 +01:00

test-qobject-input-visitor.c

qapi: Move include/qapi/qmp/ to include/qobject/

2025-02-10 15:33:16 +01:00

test-qobject-output-visitor.c

qapi: Move include/qapi/qmp/ to include/qobject/

2025-02-10 15:33:16 +01:00

test-qtree.c

…

test-rcu-list.c

…

test-rcu-simpleq.c

…

test-rcu-slist.c

…

test-rcu-tailq.c

…

test-replication.c

qapi: Move include/qapi/qmp/ to include/qobject/

2025-02-10 15:33:16 +01:00

test-resv-mem.c

include/system: Move exec/memory.h to system/memory.h

2025-04-23 14:08:21 -07:00

test-seccomp.c

include: Rename sysemu/ -> system/

2024-12-20 17:44:56 +01:00

test-shift128.c

…

test-smp-parse.c

qom: Have class_init() take a const data argument

2025-04-25 17:00:41 +02:00

test-string-input-visitor.c

…

test-string-output-visitor.c

…

test-thread-pool.c

thread-pool: Remove thread_pool_submit() function

2025-03-06 06:47:33 +01:00

test-throttle.c

include: Rename sysemu/ -> system/

2024-12-20 17:44:56 +01:00

test-timed-average.c

include: Rename sysemu/ -> system/

2024-12-20 17:44:56 +01:00

test-util-filemonitor.c

…

test-util-sockets.c

tests/unit/test-util-sockets: fix mem-leak on error object

2025-05-30 09:52:08 +02:00

test-uuid.c

…

test-virtio-dmabuf.c

…

test-visitor-serialization.c

qapi: Move include/qapi/qmp/ to include/qobject/

2025-02-10 15:33:16 +01:00

test-vmstate.c

migration: Remove error variant of vmstate_save_state() function

2025-10-03 09:48:02 -04:00

test-write-threshold.c

…

test-x86-topo.c

tests: Add test case of APIC ID for module level parsing

2024-05-22 19:43:29 +02:00

test-xbzrle.c

…

test-xs-node.c

tests/unit: replace assert(0) with g_assert_not_reached()

2024-09-17 10:50:39 +02:00

test-yank.c

include: Rename sysemu/ -> system/

2024-12-20 17:44:56 +01:00