verification: fill in policy API internals

src/rust/cryptography-x509-validation/Cargo.toml

@@ -11,3 +11,6 @@ rust-version = "1.63.0"
 asn1 = { version = "0.15.5", default-features = false }
 cryptography-x509 = { path = "../cryptography-x509" }
 once_cell = "1"
+
+[dev-dependencies]
+pem = { version = "3", default-features = false }

src/rust/cryptography-x509-validation/src/ops.rs

@@ -20,3 +20,53 @@ pub trait CryptoOps {
     /// `Key`.
     fn verify_signed_by(&self, cert: &Certificate<'_>, key: Self::Key) -> Result<(), Self::Err>;
 }
+
+#[cfg(test)]
+pub(crate) mod tests {
+    use cryptography_x509::certificate::Certificate;
+
+    use super::CryptoOps;
+
+    pub(crate) struct NullOps {}
+    impl CryptoOps for NullOps {
+        type Key = ();
+        type Err = ();
+
+        fn public_key(&self, _cert: &Certificate<'_>) -> Result<Self::Key, Self::Err> {
+            Ok(())
+        }
+
+        fn verify_signed_by(
+            &self,
+            _cert: &Certificate<'_>,
+            _key: Self::Key,
+        ) -> Result<(), Self::Err> {
+            Ok(())
+        }
+    }
+
+    #[test]
+    fn test_nullops() {
+        // Arbitrary relatively small cert (v1_cert.pem from cryptography_vectors).
+        let v1_cert = "
+-----BEGIN CERTIFICATE-----
+MIIBWzCCAQYCARgwDQYJKoZIhvcNAQEEBQAwODELMAkGA1UEBhMCQVUxDDAKBgNV
+BAgTA1FMRDEbMBkGA1UEAxMSU1NMZWF5L3JzYSB0ZXN0IENBMB4XDTk1MDYxOTIz
+MzMxMloXDTk1MDcxNzIzMzMxMlowOjELMAkGA1UEBhMCQVUxDDAKBgNVBAgTA1FM
+RDEdMBsGA1UEAxMUU1NMZWF5L3JzYSB0ZXN0IGNlcnQwXDANBgkqhkiG9w0BAQEF
+AANLADBIAkEAqtt6qS5GTxVxGZYWa0/4u+IwHf7p2LNZbcPBp9/OfIcYAXBQn8hO
+/Re1uwLKXdCjIoaGs4DLdG88rkzfyK5dPQIDAQABMAwGCCqGSIb3DQIFBQADQQAE
+Wc7EcF8po2/ZO6kNCwK/ICH6DobgLekA5lSLr5EvuioZniZp5lFzAw4+YzPQ7XKJ
+zl9HYIMxATFyqSiD9jsx
+-----END CERTIFICATE-----";
+
+        let pem = pem::parse(v1_cert.as_bytes()).unwrap();
+        let cert = asn1::parse_single::<Certificate<'_>>(pem.contents()).unwrap();
+
+        let ops = NullOps {};
+        assert_eq!(ops.public_key(&cert), Ok(()));
+        assert!(ops
+            .verify_signed_by(&cert, ops.public_key(&cert).unwrap())
+            .is_ok());
+    }
+}