Merge pull request #1077 from snapview/X509-verify

X.509: add verify methods

openssl-sys/src/x509.rs

@@ -241,6 +241,7 @@ extern "C" {
     pub fn X509_REQ_add_extensions(req: *mut X509_REQ, exts: *mut stack_st_X509_EXTENSION)
         -> c_int;
     pub fn X509_set_pubkey(x: *mut X509, pkey: *mut EVP_PKEY) -> c_int;
+    pub fn X509_REQ_verify(req: *mut X509_REQ, pkey: *mut EVP_PKEY) -> c_int;
     #[cfg(any(ossl110, libressl273))]
     pub fn X509_getm_notBefore(x: *const X509) -> *mut ASN1_TIME;
     #[cfg(any(ossl110, libressl273))]

openssl-sys/src/x509v3.rs

@@ -76,6 +76,7 @@ cfg_if! {
 
 extern "C" {
     pub fn X509_check_issued(issuer: *mut X509, subject: *mut X509) -> c_int;
+    pub fn X509_verify(req: *mut X509, pkey: *mut EVP_PKEY) -> c_int;
 
     pub fn X509V3_set_nconf(ctx: *mut X509V3_CTX, conf: *mut CONF);
 

openssl/src/x509/mod.rs

@@ -531,6 +531,23 @@ impl X509Ref {
         }
     }
 
+    /// Check if the certificate is signed using the given public key.
+    ///
+    /// Only the signature is checked: no other checks (such as certificate chain validity)
+    /// are performed.
+    ///
+    /// Returns `true` if verification succeeds.
+    ///
+    /// This corresponds to [`X509_verify"].
+    ///
+    /// [`X509_verify`]: https://www.openssl.org/docs/man1.1.0/crypto/X509_verify.html
+    pub fn verify<T>(&self, key: &PKeyRef<T>) -> Result<bool, ErrorStack>
+    where
+        T: HasPublic,
+    {
+        unsafe { cvt_n(ffi::X509_verify(self.as_ptr(), key.as_ptr())).map(|n| n != 0) }
+    }
+
     /// Returns this certificate's serial number.
     ///
     /// This corresponds to [`X509_get_serialNumber`].
@@ -1128,6 +1145,20 @@ impl X509ReqRef {
         }
     }
 
+    /// Check if the certificate request is signed using the given public key.
+    ///
+    /// Returns `true` if verification succeeds.
+    ///
+    /// This corresponds to [`X509_REQ_verify"].
+    ///
+    /// [`X509_REQ_verify`]: https://www.openssl.org/docs/man1.1.0/crypto/X509_REQ_verify.html
+    pub fn verify<T>(&self, key: &PKeyRef<T>) -> Result<bool, ErrorStack>
+    where
+        T: HasPublic,
+    {
+        unsafe { cvt_n(ffi::X509_REQ_verify(self.as_ptr(), key.as_ptr())).map(|n| n != 0) }
+    }
+
     /// Returns the extensions of the certificate request.
     ///
     /// This corresponds to [`X509_REQ_get_extensions"]

openssl/src/x509/tests.rs

@@ -225,6 +225,7 @@ fn x509_builder() {
     let x509 = builder.build();
 
     assert!(pkey.public_eq(&x509.public_key().unwrap()));
+    assert!(x509.verify(&pkey).unwrap());
 
     let cn = x509
         .subject_name()
@@ -268,6 +269,7 @@ fn x509_req_builder() {
     let req = builder.build();
     assert!(req.public_key().unwrap().public_eq(&pkey));
     assert_eq!(req.extensions().unwrap().len(), extensions.len());
+    assert!(req.verify(&pkey).unwrap());
 }
 
 #[test]