rust: Use AsRef<Path> and PathBuf in libraries

Use `AsRef<Path>` instead of `&Path`, &str, .... to be more versatile
and accept more input types. In addition, use `PathBuf` and `Path` for
paths instead of `String` and `str`.

Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>

rust/pv/src/error.rs

@@ -2,6 +2,8 @@
 //
 // Copyright IBM Corp. 2023, 2024
 
+use std::path::PathBuf;
+
 use crate::secret::UserDataType;
 
 /// Result type for this crate
@@ -26,7 +28,7 @@ pub enum Error {
 
     #[error("Cannot load {ty}  from {path}")]
     X509Load {
-        path: String,
+        path: PathBuf,
         ty: &'static str,
         source: openssl::error::ErrorStack,
     },

rust/pv/src/test_utils.rs

@@ -42,7 +42,7 @@ pub fn get_cert_asset_path<P: AsRef<Path>>(path: P) -> PathBuf {
 /// TEST ONLY! Load an cert
 ///
 /// panic on errors
-pub fn get_cert_asset(path: &'static str) -> Vec<u8> {
+pub fn get_cert_asset<P: AsRef<Path>>(path: P) -> Vec<u8> {
     let p = get_cert_asset_path(path);
     fs::read(p).unwrap()
 }
@@ -50,7 +50,7 @@ pub fn get_cert_asset(path: &'static str) -> Vec<u8> {
 /// TEST ONLY! Load cert found in the asset path
 ///
 /// panic on errors
-pub fn load_gen_cert(asset_path: &'static str) -> X509 {
+pub fn load_gen_cert<P: AsRef<Path>>(asset_path: P) -> X509 {
     let buf = get_cert_asset(asset_path);
     let mut cert = X509::from_der(&buf)
         .map(|crt| vec![crt])
@@ -63,7 +63,7 @@ pub fn load_gen_cert(asset_path: &'static str) -> X509 {
 /// TEST ONLY! Load the CRL found in the asset path
 ///
 /// panic on errors
-pub fn load_gen_crl(asset_path: &'static str) -> X509Crl {
+pub fn load_gen_crl<P: AsRef<Path>>(asset_path: P) -> X509Crl {
     let buf = get_cert_asset(asset_path);
 
     X509Crl::from_der(&buf)

rust/pv/src/utils.rs

@@ -13,11 +13,11 @@ use openssl::{
 ///
 /// This function will return an error if the underlying OpenSSL implementation cannot parse `buf`
 /// as `DER` or `PEM`.
-pub fn read_crls(buf: &[u8]) -> Result<Vec<X509Crl>> {
+pub fn read_crls<T: AsRef<[u8]>>(buf: T) -> Result<Vec<X509Crl>> {
     use crate::openssl_extensions::StackableX509Crl;
-    X509Crl::from_der(buf)
+    X509Crl::from_der(buf.as_ref())
         .map(|crl| vec![crl])
-        .or_else(|_| StackableX509Crl::stack_from_pem(buf))
+        .or_else(|_| StackableX509Crl::stack_from_pem(buf.as_ref()))
         .map_err(Error::Crypto)
 }
 
@@ -26,10 +26,10 @@ pub fn read_crls(buf: &[u8]) -> Result<Vec<X509Crl>> {
 /// # Errors
 ///
 /// This function will return an error if the underlying OpenSSL implementation cannot parse `buf`
-pub fn read_certs(buf: &[u8]) -> Result<Vec<X509>, ErrorStack> {
-    X509::from_der(buf)
+pub fn read_certs<T: AsRef<[u8]>>(buf: T) -> Result<Vec<X509>, ErrorStack> {
+    X509::from_der(buf.as_ref())
         .map(|crt| vec![crt])
-        .or_else(|_| X509::stack_from_pem(buf))
+        .or_else(|_| X509::stack_from_pem(buf.as_ref()))
 }
 
 #[cfg(test)]
@@ -41,9 +41,9 @@ mod tests {
         let crl = get_cert_asset("ibm.crl");
         let crl_der = get_cert_asset("der.crl");
         let fail = get_cert_asset("ibm.crt");
-        assert_eq!(super::read_crls(&crl).unwrap().len(), 1);
-        assert_eq!(super::read_crls(&crl_der).unwrap().len(), 1);
-        assert_eq!(super::read_crls(&fail).unwrap().len(), 0);
+        assert_eq!(super::read_crls(crl).unwrap().len(), 1);
+        assert_eq!(super::read_crls(crl_der).unwrap().len(), 1);
+        assert_eq!(super::read_crls(fail).unwrap().len(), 0);
     }
 
     #[test]
@@ -51,8 +51,8 @@ mod tests {
         let crt = get_cert_asset("ibm.crt");
         let crt_der = get_cert_asset("der.crt");
         let fail = get_cert_asset("ibm.crl");
-        assert_eq!(super::read_certs(&crt).unwrap().len(), 1);
-        assert_eq!(super::read_certs(&crt_der).unwrap().len(), 1);
-        assert_eq!(super::read_certs(&fail).unwrap().len(), 0);
+        assert_eq!(super::read_certs(crt).unwrap().len(), 1);
+        assert_eq!(super::read_certs(crt_der).unwrap().len(), 1);
+        assert_eq!(super::read_certs(fail).unwrap().len(), 0);
     }
 }

rust/pv/src/verify.rs

@@ -173,12 +173,17 @@ impl CertVerifier {
     /// # Errors
     ///
     /// This function will return an error if the chain of trust could not be established.
-    pub fn new(
-        cert_paths: &[&Path],
-        crl_paths: &[&Path],
-        root_ca_path: Option<&Path>,
+    pub fn new<P, Q, R>(
+        cert_paths: &[P],
+        crl_paths: &[Q],
+        root_ca_path: Option<R>,
         offline: bool,
-    ) -> Result<Self> {
+    ) -> Result<Self>
+    where
+        P: AsRef<Path>,
+        Q: AsRef<Path>,
+        R: AsRef<Path>,
+    {
         let mut store = helper::store_setup(root_ca_path, crl_paths, cert_paths)?;
         let mut untr_certs = Vec::with_capacity(cert_paths.len());
         for path in cert_paths {

rust/pv/src/verify/helper.rs

@@ -75,10 +75,10 @@ pub fn verify_crl(crl: &X509CrlRef, issuer: &X509Ref) -> Option<()> {
 }
 
 /// Setup the x509Store such that it can be used it for verifying certificates
-pub fn store_setup(
-    root_ca_path: Option<&Path>,
-    crl_paths: &[&Path],
-    cert_w_crl_paths: &[&Path],
+pub fn store_setup<P: AsRef<Path>, Q: AsRef<Path>, R: AsRef<Path>>(
+    root_ca_path: Option<P>,
+    crl_paths: &[Q],
+    cert_w_crl_paths: &[R],
 ) -> Result<X509StoreBuilder> {
     let mut x509store = X509StoreBuilder::new()?;
 
@@ -89,7 +89,7 @@ pub fn store_setup(
 
     for crl in crl_paths {
         load_crl_to_store(&mut x509store, crl, true).map_err(|source| Error::X509Load {
-            path: crl.display().to_string(),
+            path: crl.as_ref().into(),
             ty: Error::CRL,
             source,
         })?;
@@ -97,7 +97,7 @@ pub fn store_setup(
 
     for crl in cert_w_crl_paths {
         load_crl_to_store(&mut x509store, crl, false).map_err(|source| Error::X509Load {
-            path: crl.display().to_string(),
+            path: crl.as_ref().into(),
             ty: Error::CRL,
             source,
         })?;
@@ -236,35 +236,35 @@ fn get_ibm_z_sign_key(certs: &[X509]) -> Result<X509> {
     }
 }
 
-fn load_root_ca(path: &Path, x509_store: &mut X509StoreBuilder) -> Result<()> {
+fn load_root_ca<P: AsRef<Path>>(path: P, x509_store: &mut X509StoreBuilder) -> Result<()> {
     let lu = x509_store.add_lookup(X509Lookup::<File>::file())?;
 
     // Try to load cert as PEM file
-    match lu.load_cert_file(path, SslFiletype::PEM) {
+    match lu.load_cert_file(&path, SslFiletype::PEM) {
         Ok(_) => lu
-            .load_crl_file(path, SslFiletype::PEM)
+            .load_crl_file(&path, SslFiletype::PEM)
             .map(|_| ())
             .or(Ok(())),
         // Not a PEM file? try ASN1
         Err(_) => lu
-            .load_cert_file(path, SslFiletype::ASN1)
+            .load_cert_file(&path, SslFiletype::ASN1)
             .map(|_| ())
             .map_err(|source| Error::X509Load {
-                path: path.display().to_string(),
+                path: path.as_ref().into(),
                 ty: Error::CERT,
                 source,
             }),
     }
 }
 
-fn load_crl_to_store(
+fn load_crl_to_store<P: AsRef<Path>>(
     x509_store: &mut X509StoreBuilder,
-    path: &Path,
+    path: P,
     err_out_empty_crl: bool,
 ) -> std::result::Result<(), ErrorStack> {
     let lu = x509_store.add_lookup(X509Lookup::<File>::file())?;
     // Try to load cert as PEM file
-    if lu.load_crl_file(path, SslFiletype::PEM).is_err() {
+    if lu.load_crl_file(&path, SslFiletype::PEM).is_err() {
         // Not a PEM file? try read as ASN1
         let res = lu.load_crl_file(path, SslFiletype::ASN1);
         if err_out_empty_crl {

rust/pv/src/verify/test.rs

@@ -14,7 +14,7 @@ use crate::test_utils::*;
 // Mock function
 pub fn download_first_crl_from_x509(cert: &X509Ref) -> Result<Option<Vec<X509Crl>>> {
     fn mock_download<P: AsRef<Path>>(path: P) -> Result<Vec<X509Crl>> {
-        read_crls(&std::fs::read(path)?)
+        read_crls(std::fs::read(path)?)
     }
 
     for dist_point in x509_dist_points(cert) {
@@ -35,8 +35,9 @@ pub fn download_first_crl_from_x509(cert: &X509Ref) -> Result<Option<Vec<X509Crl
 fn store_setup() {
     let ibm_path = get_cert_asset_path("ibm.crt");
     let inter_path = get_cert_asset_path("inter.crt");
+    let crls: [String; 0] = [];
 
-    let store = helper::store_setup(None, &[], &[&ibm_path, &inter_path]);
+    let store = helper::store_setup(None::<String>, &crls, &[&ibm_path, &inter_path]);
     assert!(store.is_ok());
 }
 
@@ -45,8 +46,9 @@ fn verify_chain_online() {
     let ibm_crt = get_cert_asset_path("ibm.crt");
     let inter_crt = get_cert_asset_path("inter_ca.crt");
     let root_crt = get_cert_asset_path("root_ca.chained.crt");
+    let crls: [String; 0] = [];
 
-    let ret = CertVerifier::new(&[&ibm_crt, &inter_crt], &[], Some(&root_crt), false);
+    let ret = CertVerifier::new(&[&ibm_crt, &inter_crt], &crls, Some(&root_crt), false);
     assert!(ret.is_ok(), "CertVerifier::new failed: {ret:?}");
 }
 
@@ -56,8 +58,9 @@ fn verify_chain_offline() {
     let inter_crl = get_cert_asset_path("inter_ca.crl");
     let inter_crt = load_gen_cert("inter_ca.crt");
     let root_crt = get_cert_asset_path("root_ca.chained.crt");
+    let certs: [String; 0] = [];
 
-    let store = helper::store_setup(Some(&root_crt), &[&inter_crl], &[])
+    let store = helper::store_setup(Some(&root_crt), &[&inter_crl], &certs)
         .unwrap()
         .build();
 
@@ -84,10 +87,10 @@ fn verify(offline: bool, ibm_crt: &'static str, ibm_crl: &'static str, hkd: &'st
     let hkd_exp = load_gen_cert("host_crt_expired.crt");
     let hkd = load_gen_cert(hkd);
 
-    let crls = &[ibm_crl.as_path(), inter_crl.as_path()];
+    let crls = [&ibm_crl, &inter_crl];
     let verifier = CertVerifier::new(
         &[&ibm_crt, &inter_crt],
-        if offline { crls } else { &[] },
+        if offline { &crls } else { &[] },
         Some(&root_crt),
         offline,
     )