420a839a1e
- kvm-net-tap-linux.c-avoid-abort-when-setting-invalid-fd.patch [RHEL-113894] - kvm-crypto-only-verify-CA-certs-in-chain-of-trust.patch [RHEL-111934] - kvm-crypto-remove-extraneous-pointer-usage-in-gnutls-cer.patch [RHEL-111934] - kvm-crypto-fix-error-reporting-in-cert-chain-checks.patch [RHEL-111934] - kvm-crypto-allow-client-server-cert-chains.patch [RHEL-111934] - kvm-crypto-stop-requiring-key-encipherment-usage-in-x509.patch [RHEL-111934] - kvm-crypto-switch-to-newer-gnutls-API-for-distinguished-.patch [RHEL-111934] - kvm-crypto-remove-redundant-parameter-checking-CA-certs.patch [RHEL-111934] - kvm-crypto-add-missing-free-of-certs-array.patch [RHEL-111934] - kvm-crypto-replace-stat-with-access-for-credential-check.patch [RHEL-111934] - kvm-crypto-remove-redundant-access-checks-before-loading.patch [RHEL-111934] - kvm-crypto-move-check-for-TLS-creds-dir-property.patch [RHEL-111934] - kvm-crypto-use-g_autofree-when-loading-x509-credentials.patch [RHEL-111934] - kvm-crypto-remove-needless-indirection-via-parent_obj-fi.patch [RHEL-111934] - kvm-crypto-move-release-of-DH-parameters-into-TLS-creds-.patch [RHEL-111934] - kvm-crypto-shorten-the-endpoint-server-check-in-TLS-cred.patch [RHEL-111934] - kvm-crypto-remove-duplication-loading-x509-CA-cert.patch [RHEL-111934] - kvm-crypto-reduce-duplication-in-handling-TLS-priority-s.patch [RHEL-111934] - kvm-crypto-introduce-method-for-reloading-TLS-creds.patch [RHEL-111934] - kvm-crypto-introduce-a-wrapper-around-gnutls-credentials.patch [RHEL-111934] - kvm-crypto-fix-lifecycle-handling-of-gnutls-credentials-.patch [RHEL-111934] - kvm-crypto-make-TLS-credentials-structs-private.patch [RHEL-111934] - kvm-crypto-deprecate-use-of-external-dh-params.pem-file.patch [RHEL-111934] - kvm-crypto-avoid-loading-the-CA-certs-twice.patch [RHEL-111934] - kvm-crypto-avoid-loading-the-identity-certs-twice.patch [RHEL-111934] - kvm-crypto-expand-logic-to-cope-with-multiple-certificat.patch [RHEL-111934] - kvm-crypto-support-upto-5-parallel-certificate-identitie.patch [RHEL-111934] - kvm-docs-creation-of-x509-certs-compliant-with-post-quan.patch [RHEL-111934] - kvm-iommufd-Introduce-handler-for-device-ATS-support.patch [RHEL-184675] - kvm-vfio-pci-Add-ats-property.patch [RHEL-184675] - Resolves: RHEL-113894 ([RHEL.10.2][virual network] Hit qemu coredump when removed an interface that the guest is using from the host) - Resolves: RHEL-111934 (QEMU support for loading multiple sets of x509 certs for PQC hybrid mode) - Resolves: RHEL-184675 (NVIDIA:Backport vfio/pci: add vfio-pci ATS control property - RHEL 10.3)
69 lines
2.9 KiB
Diff
69 lines
2.9 KiB
Diff
From 1f13d21759e1e2172473d23653b8b86c886fc3a1 Mon Sep 17 00:00:00 2001
|
|
From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= <berrange@redhat.com>
|
|
Date: Wed, 29 Oct 2025 19:54:08 +0000
|
|
Subject: [PATCH 08/30] crypto: remove redundant parameter checking CA certs
|
|
MIME-Version: 1.0
|
|
Content-Type: text/plain; charset=UTF-8
|
|
Content-Transfer-Encoding: 8bit
|
|
|
|
RH-Author: Daniel P. Berrangé <berrange@redhat.com>
|
|
RH-MergeRequest: 460: crypto: changes to support multiple certificates for PQC
|
|
RH-Jira: RHEL-111934
|
|
RH-Acked-by: Miroslav Rezanina <mrezanin@redhat.com>
|
|
RH-Commit: [7/27] bb2ecd4d9c4db43aa97e7eab7b7eb1e868911fc6 (berrange/centos-src-qemu)
|
|
|
|
The only caller of qcrypto_tls_creds_check_authority_chain always
|
|
passes 'true' for the 'isCA' parameter. The point of this method
|
|
is to check the CA chani, so no other value would ever make sense.
|
|
|
|
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
|
|
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
|
|
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
|
|
(cherry picked from commit 3821a538f7ec0a7973fa7b751dcea65d0b9b3213)
|
|
---
|
|
crypto/tlscredsx509.c | 7 +++----
|
|
1 file changed, 3 insertions(+), 4 deletions(-)
|
|
|
|
diff --git a/crypto/tlscredsx509.c b/crypto/tlscredsx509.c
|
|
index db2b74bafa..847fd4d9fa 100644
|
|
--- a/crypto/tlscredsx509.c
|
|
+++ b/crypto/tlscredsx509.c
|
|
@@ -315,7 +315,6 @@ qcrypto_tls_creds_check_authority_chain(QCryptoTLSCredsX509 *creds,
|
|
unsigned int ncacerts,
|
|
const char *cacertFile,
|
|
bool isServer,
|
|
- bool isCA,
|
|
Error **errp)
|
|
{
|
|
gnutls_x509_crt_t cert_to_check = certs[ncerts - 1];
|
|
@@ -356,7 +355,7 @@ qcrypto_tls_creds_check_authority_chain(QCryptoTLSCredsX509 *creds,
|
|
*/
|
|
return qcrypto_tls_creds_check_cert(
|
|
creds, cert_to_check, cacertFile,
|
|
- isServer, isCA, errp);
|
|
+ isServer, true, errp);
|
|
}
|
|
for (int i = 0; i < ncacerts; i++) {
|
|
if (gnutls_x509_crt_check_issuer(cert_to_check,
|
|
@@ -370,7 +369,7 @@ qcrypto_tls_creds_check_authority_chain(QCryptoTLSCredsX509 *creds,
|
|
}
|
|
|
|
if (qcrypto_tls_creds_check_cert(creds, cert_issuer, cacertFile,
|
|
- isServer, isCA, errp) < 0) {
|
|
+ isServer, true, errp) < 0) {
|
|
return -1;
|
|
}
|
|
|
|
@@ -534,7 +533,7 @@ qcrypto_tls_creds_x509_sanity_check(QCryptoTLSCredsX509 *creds,
|
|
certs, ncerts,
|
|
cacerts, ncacerts,
|
|
cacertFile, isServer,
|
|
- true, errp) < 0) {
|
|
+ errp) < 0) {
|
|
goto cleanup;
|
|
}
|
|
|
|
--
|
|
2.52.0
|
|
|