Use Rust for CSR::is_signature_valid (#8161)

2 files changed, 10 insertions, 32 deletions

diff --git a/src/cryptography/hazmat/backends/openssl/backend.py b/src/cryptography/hazmat/backends/openssl/backend.py
index 26188aa0f..737415a35 100644
--- a/src/cryptography/hazmat/backends/openssl/backend.py
+++ b/src/cryptography/hazmat/backends/openssl/backend.py
@@ -1102,14 +1102,6 @@ class Backend:
         self.openssl_assert(res == 1)
         return rust_x509.load_der_x509_certificate(self._read_mem_bio(bio))
 
-    def _csr2ossl(self, csr: x509.CertificateSigningRequest) -> typing.Any:
-        data = csr.public_bytes(serialization.Encoding.DER)
-        mem_bio = self._bytes_to_bio(data)
-        x509_req = self._lib.d2i_X509_REQ_bio(mem_bio.bio, self._ffi.NULL)
-        self.openssl_assert(x509_req != self._ffi.NULL)
-        x509_req = self._ffi.gc(x509_req, self._lib.X509_REQ_free)
-        return x509_req
-
     def _crl2ossl(self, crl: x509.CertificateRevocationList) -> typing.Any:
         data = crl.public_bytes(serialization.Encoding.DER)
         mem_bio = self._bytes_to_bio(data)
@@ -1144,21 +1136,6 @@ class Backend:
 
         return True
 
-    def _csr_is_signature_valid(
-        self, csr: x509.CertificateSigningRequest
-    ) -> bool:
-        x509_req = self._csr2ossl(csr)
-        pkey = self._lib.X509_REQ_get_pubkey(x509_req)
-        self.openssl_assert(pkey != self._ffi.NULL)
-        pkey = self._ffi.gc(pkey, self._lib.EVP_PKEY_free)
-        res = self._lib.X509_REQ_verify(x509_req, pkey)
-
-        if res != 1:
-            self._consume_errors()
-            return False
-
-        return True
-
     def _check_keys_correspond(self, key1, key2):
         if self._lib.EVP_PKEY_cmp(key1._evp_pkey, key2._evp_pkey) != 1:
             raise ValueError("Keys do not correspond")
diff --git a/src/rust/src/x509/csr.rs b/src/rust/src/x509/csr.rs
index 7bc3dc98a..cb9056c80 100644
--- a/src/rust/src/x509/csr.rs
+++ b/src/rust/src/x509/csr.rs
@@ -4,7 +4,7 @@
 
 use crate::asn1::{encode_der_data, oid_to_py_oid, py_oid_to_oid, PyAsn1Error, PyAsn1Result};
 use crate::x509;
-use crate::x509::{certificate, oid};
+use crate::x509::{certificate, oid, sign};
 use asn1::SimpleAsn1Readable;
 use std::collections::hash_map::DefaultHasher;
 use std::hash::{Hash, Hasher};
@@ -266,14 +266,15 @@ impl CertificateSigningRequest {
     }
 
     #[getter]
-    fn is_signature_valid<'p>(
-        slf: pyo3::PyRef<'_, Self>,
-        py: pyo3::Python<'p>,
-    ) -> pyo3::PyResult<&'p pyo3::PyAny> {
-        let backend = py
-            .import("cryptography.hazmat.backends.openssl.backend")?
-            .getattr(crate::intern!(py, "backend"))?;
-        backend.call_method1("_csr_is_signature_valid", (slf,))
+    fn is_signature_valid(slf: pyo3::PyRef<'_, Self>, py: pyo3::Python<'_>) -> PyAsn1Result<bool> {
+        Ok(sign::verify_signature_with_oid(
+            py,
+            slf.public_key(py)?,
+            &slf.raw.borrow_value().signature_alg.oid,
+            slf.raw.borrow_value().signature.as_bytes(),
+            &asn1::write_single(&slf.raw.borrow_value().csr_info)?,
+        )
+        .is_ok())
     }
 }