Use a flag instead

Author: richardhuaaa

openmls/src/group/mls_group/tests_and_kats/tests/proposals.rs

@@ -45,7 +45,11 @@ fn proposal_queue_functions(
     let alice_update_key_package = alice_update_key_package_bundle.key_package();
     let kpi = KeyPackageIn::from(alice_update_key_package.clone());
     assert!(kpi
-        .validate(provider.crypto(), ProtocolVersion::Mls10)
+        .validate(
+            provider.crypto(),
+            ProtocolVersion::Mls10,
+            LeafNodeLifetimePolicy::Verify
+        )
         .is_ok());
 
     let group_context = GroupContext::new(
@@ -185,7 +189,11 @@ fn proposal_queue_order() {
     let alice_update_key_package = alice_update_key_package_bundle.key_package();
     let kpi = KeyPackageIn::from(alice_update_key_package.clone());
     assert!(kpi
-        .validate(provider.crypto(), ProtocolVersion::Mls10)
+        .validate(
+            provider.crypto(),
+            ProtocolVersion::Mls10,
+            crate::group::LeafNodeLifetimePolicy::Verify
+        )
         .is_ok());
 
     let group_context = GroupContext::new(

openmls/src/group/tests_and_kats/tests/proposal_validation.rs

@@ -1065,8 +1065,12 @@ fn test_valsem105() {
         let mut franken_key_package = FrankenKeyPackage::from(charlie_key_package.clone());
 
         let kpi = KeyPackageIn::from(charlie_key_package.clone());
-        kpi.validate(provider.crypto(), ProtocolVersion::Mls10)
-            .unwrap();
+        kpi.validate(
+            provider.crypto(),
+            ProtocolVersion::Mls10,
+            LeafNodeLifetimePolicy::Verify,
+        )
+        .unwrap();
 
         // Let's just pick a ciphersuite that's not the one we're testing right now.
         let wrong_ciphersuite = match ciphersuite {

openmls/src/key_packages/key_package_in.rs

@@ -5,6 +5,7 @@ use crate::{
     ciphersuite::{signable::*, *},
     credentials::*,
     extensions::Extensions,
+    group::LeafNodeLifetimePolicy,
     treesync::node::leaf_node::{LeafNodeIn, VerifiableLeafNode},
     versions::ProtocolVersion,
 };
@@ -136,6 +137,7 @@ impl KeyPackageIn {
         self,
         crypto: &impl OpenMlsCrypto,
         protocol_version: ProtocolVersion,
+        validate_lifetimes: LeafNodeLifetimePolicy,
     ) -> Result<KeyPackage, KeyPackageVerifyError> {
         // We first need to verify the LeafNode inside the KeyPackage
         let leaf_node = self.payload.leaf_node.clone().into_verifiable_leaf_node();
@@ -191,16 +193,18 @@ impl KeyPackageIn {
             }
         }
 
-        // Ensure validity of the life time extension in the leaf node.
-        // if let Some(life_time) = key_package.payload.leaf_node.life_time() {
-        //     if !life_time.is_valid() {
-        //         return Err(KeyPackageVerifyError::InvalidLifetime);
-        //     }
-        // } else {
-        //     // This assumes that we only verify key packages with leaf nodes
-        //     // that were created for the key package.
-        //     return Err(KeyPackageVerifyError::MissingLifetime);
-        // }
+        if validate_lifetimes == LeafNodeLifetimePolicy::Verify {
+            // Ensure validity of the life time extension in the leaf node.
+            if let Some(life_time) = key_package.payload.leaf_node.life_time() {
+                if !life_time.is_valid() {
+                    return Err(KeyPackageVerifyError::InvalidLifetime);
+                }
+            } else {
+                // This assumes that we only verify key packages with leaf nodes
+                // that were created for the key package.
+                return Err(KeyPackageVerifyError::MissingLifetime);
+            }
+        }
 
         Ok(key_package)
     }

openmls/src/key_packages/tests.rs

@@ -1,4 +1,4 @@
-use crate::test_utils::*;
+use crate::{test_utils::*, tree::tests_and_kats::kats::secret_tree::Leaf};
 use openmls_basic_credential::SignatureKeyPair;
 
 use tls_codec::Deserialize;
@@ -35,7 +35,11 @@ fn generate_key_package() {
 
     let kpi = KeyPackageIn::from(key_package.key_package().clone());
     assert!(kpi
-        .validate(provider.crypto(), ProtocolVersion::Mls10)
+        .validate(
+            provider.crypto(),
+            ProtocolVersion::Mls10,
+            crate::group::LeafNodeLifetimePolicy::Verify
+        )
         .is_ok());
 }
 
@@ -79,7 +83,11 @@ fn application_id_extension() {
 
     let kpi = KeyPackageIn::from(key_package.key_package().clone());
     assert!(kpi
-        .validate(provider.crypto(), ProtocolVersion::Mls10)
+        .validate(
+            provider.crypto(),
+            ProtocolVersion::Mls10,
+            crate::group::LeafNodeLifetimePolicy::Verify
+        )
         .is_ok());
 
     // Check ID
@@ -111,7 +119,11 @@ fn key_package_validation() {
     let key_package_in = KeyPackageIn::from(franken_key_package);
 
     let err = key_package_in
-        .validate(provider.crypto(), ProtocolVersion::Mls10)
+        .validate(
+            provider.crypto(),
+            ProtocolVersion::Mls10,
+            crate::group::LeafNodeLifetimePolicy::Verify,
+        )
         .unwrap_err();
 
     // Expect an invalid protocol version error

openmls/src/messages/proposals_in.rs

@@ -162,7 +162,11 @@ impl AddProposalIn {
         protocol_version: ProtocolVersion,
         ciphersuite: Ciphersuite,
     ) -> Result<AddProposal, ValidationError> {
-        let key_package = self.key_package.validate(crypto, protocol_version)?;
+        let key_package = self.key_package.validate(
+            crypto,
+            protocol_version,
+            crate::group::LeafNodeLifetimePolicy::Skip,
+        )?;
         // Verify that the ciphersuite is valid
         if key_package.ciphersuite() != ciphersuite {
             return Err(ValidationError::InvalidAddProposalCiphersuite);