NASP/rpki
84
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

20260418 优化去掉冗余存储repo object，mix quick最快170s

Browse Source
This commit is contained in:
yuyr
2026-04-18 14:10:47 +08:00
parent f485786470
commit 417c82bef6
34 changed files with 1482 additions and 328 deletions
Download Patch File Download Diff File Expand all files Collapse all files

43
src/validation/objects.rs
View File

@@ -11,7 +11,7 @@ use crate::data_model::signed_object::SignedObjectVerifyError;
use crate::policy::{Policy, SignedObjectFailurePolicy};
use crate::report::{RfcRef, Warning};
use crate::storage::{PackFile, PackTime, VcirLocalOutput, VcirOutputType};
use crate::validation::cert_path::{CertPathError, validate_ee_cert_path_with_predecoded_ee};
use crate::validation::cert_path::{CertPathError, validate_signed_object_ee_cert_path_fast};
use crate::validation::manifest::PublicationPointData;
use crate::validation::publication_point::PublicationPointSnapshot;
use x509_parser::prelude::FromDer;
@@ -221,10 +221,7 @@ pub fn process_publication_point_for_issuer<P: PublicationPointData>(
let bytes = f
.bytes_cloned()
.expect("snapshot CRL bytes must be loadable");
(
f.rsync_uri.clone(),
CachedIssuerCrl::Pending(bytes),
)
(f.rsync_uri.clone(), CachedIssuerCrl::Pending(bytes))
})
.collect();
@@ -605,18 +602,21 @@ fn process_roa_with_issuer(
roa.signed_object.verify()?;
drop(_verify);
let ee = &roa.signed_object.signed_data.certificates[0].resource_cert;
let ee_der = &roa.signed_object.signed_data.certificates[0].raw_der;
let ee_crldp_uris = ee.tbs.extensions.crl_distribution_points_uris.as_ref();
let ee = &roa.signed_object.signed_data.certificates[0];
let ee_crldp_uris = ee
.resource_cert
.tbs
.extensions
.crl_distribution_points_uris
.as_ref();
let issuer_crl_rsync_uri = choose_crl_uri_for_certificate(ee_crldp_uris, crl_cache)?;
let verified_crl = ensure_issuer_crl_verified(issuer_crl_rsync_uri, crl_cache, issuer_ca_der)?;
let _cert_path = timing
.as_ref()
.map(|t| t.span_phase("objects_roa_validate_ee_cert_path_total"));
validate_ee_cert_path_with_predecoded_ee(
validate_signed_object_ee_cert_path_fast(
ee,
ee_der,
issuer_ca,
issuer_spki,
&verified_crl.crl,
@@ -631,7 +631,7 @@ fn process_roa_with_issuer(
.as_ref()
.map(|t| t.span_phase("objects_roa_validate_ee_resources_subset_total"));
validate_ee_resources_subset(
&ee,
&ee.resource_cert,
issuer_effective_ip,
issuer_effective_as,
issuer_resources_index,
@@ -641,7 +641,8 @@ fn process_roa_with_issuer(
let vrps = roa_to_vrps(&roa);
let source_object_hash = sha256_hex_from_32(&file.sha256);
let source_ee_cert_hash = crate::audit::sha256_hex(ee.raw_der.as_slice());
let item_effective_until = PackTime::from_utc_offset_datetime(ee.tbs.validity_not_after);
let item_effective_until =
PackTime::from_utc_offset_datetime(ee.resource_cert.tbs.validity_not_after);
let local_outputs = vrps
.iter()
.map(|vrp| {
@@ -713,18 +714,21 @@ fn process_aspa_with_issuer(
aspa.signed_object.verify()?;
drop(_verify);
let ee = &aspa.signed_object.signed_data.certificates[0].resource_cert;
let ee_der = &aspa.signed_object.signed_data.certificates[0].raw_der;
let ee_crldp_uris = ee.tbs.extensions.crl_distribution_points_uris.as_ref();
let ee = &aspa.signed_object.signed_data.certificates[0];
let ee_crldp_uris = ee
.resource_cert
.tbs
.extensions
.crl_distribution_points_uris
.as_ref();
let issuer_crl_rsync_uri = choose_crl_uri_for_certificate(ee_crldp_uris, crl_cache)?;
let verified_crl = ensure_issuer_crl_verified(issuer_crl_rsync_uri, crl_cache, issuer_ca_der)?;
let _cert_path = timing
.as_ref()
.map(|t| t.span_phase("objects_aspa_validate_ee_cert_path_total"));
validate_ee_cert_path_with_predecoded_ee(
validate_signed_object_ee_cert_path_fast(
ee,
ee_der,
issuer_ca,
issuer_spki,
&verified_crl.crl,
@@ -739,7 +743,7 @@ fn process_aspa_with_issuer(
.as_ref()
.map(|t| t.span_phase("objects_aspa_validate_ee_resources_subset_total"));
validate_ee_resources_subset(
&ee,
&ee.resource_cert,
issuer_effective_ip,
issuer_effective_as,
issuer_resources_index,
@@ -752,7 +756,8 @@ fn process_aspa_with_issuer(
};
let source_object_hash = sha256_hex_from_32(&file.sha256);
let source_ee_cert_hash = crate::audit::sha256_hex(ee.raw_der.as_slice());
let item_effective_until = PackTime::from_utc_offset_datetime(ee.tbs.validity_not_after);
let item_effective_until =
PackTime::from_utc_offset_datetime(ee.resource_cert.tbs.validity_not_after);
let providers = attestation
.provider_as_ids
.iter()