Re: [PATCH v10 08/30] crypto/x509-utils: Add helper functions for DIAG 320 subcode 2

["Daniel P. Berrangé" <berrange@redhat.com>]

On Thu, Apr 02, 2026 at 06:14:30PM -0400, Zhuoying Cai wrote:
> Introduce new helper functions to extract certificate metadata:
> 
> qcrypto_x509_check_cert_times() - validates the certificate's validity period against the current time
> qcrypto_x509_get_pk_algorithm() - returns the public key algorithm used in the certificate

This is no longer exported, so drop that mention.

> qcrypto_x509_get_cert_key_id() - extracts the key ID from the certificate
> qcrypto_x509_check_ecc_curve_p521() - determines the ECC public key algorithm uses P-521 curve
> 
> These functions provide support for metadata extraction and validity checking
> for X.509 certificates.
> 
> Signed-off-by: Zhuoying Cai <zycai@linux.ibm.com>
> Reviewed-by: Farhan Ali<alifm@linux.ibm.com>
> ---
>  crypto/x509-utils.c         | 236 ++++++++++++++++++++++++++++++++++++
>  include/crypto/x509-utils.h |  51 ++++++++
>  2 files changed, 287 insertions(+)
> 
> diff --git a/crypto/x509-utils.c b/crypto/x509-utils.c
> index 2696d48155..906d5e5e87 100644
> --- a/crypto/x509-utils.c
> +++ b/crypto/x509-utils.c
> +static int qcrypto_x509_get_ecc_curve(uint8_t *cert, size_t size, Error **errp)
> +{
> +    int rc;
> +    int ret = -1;
> +    gnutls_x509_crt_t crt;
> +    gnutls_datum_t datum = {.data = cert, .size = size};
> +    gnutls_ecc_curve_t curve_id;
> +    gnutls_datum_t x = {.data = NULL, .size = 0};
> +    gnutls_datum_t y = {.data = NULL, .size = 0};
> +
> +    rc = gnutls_x509_crt_init(&crt);
> +    if (rc < 0) {
> +        error_setg(errp, "Failed to initialize certificate: %s", gnutls_strerror(rc));
> +        return ret;
> +    }
> +
> +    rc = gnutls_x509_crt_import(crt, &datum, GNUTLS_X509_FMT_PEM);
> +    if (rc != 0) {
> +        error_setg(errp, "Failed to import certificate: %s", gnutls_strerror(rc));
> +        goto cleanup;
> +    }
> +
> +    rc = gnutls_x509_crt_get_pk_ecc_raw(crt, &curve_id, &x, &y);
> +    if (rc != 0) {
> +        error_setg(errp, "Failed to get ECC public key curve: %s", gnutls_strerror(rc));
> +        goto cleanup;
> +    }
> +
> +    ret = curve_id;
> +
> +cleanup:
> +    gnutls_x509_crt_deinit(crt);
> +    gnutls_free(x.data);
> +    gnutls_free(y.data);

Use g_free here instead of gnutls_free

> +    return ret;
> +}

With those two changes made

  Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
  Acked-by: Daniel P. Berrangé <berrange@redhat.com>
  

With regards,
Daniel
-- 
|: https://berrange.com       ~~        https://hachyderm.io/@berrange :|
|: https://libvirt.org          ~~          https://entangle-photo.org :|
|: https://pixelfed.art/berrange   ~~    https://fstop138.berrange.com :|