rust/pv: Inline openssl_extensions sub-crate

crates.io does not like sub-crates in a crate. Unpack the
openssl-extensions sub-crate into a (private) module.

While at it, fix some styling issues.

Reviewed-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>

rust/Cargo.lock

@@ -377,17 +377,6 @@ dependencies = [
  "vcpkg",
 ]
 
-[[package]]
-name = "openssl_extensions"
-version = "0.1.0"
-dependencies = [
- "foreign-types",
- "libc",
- "log",
- "openssl",
- "openssl-sys",
-]
-
 [[package]]
 name = "pkg-config"
 version = "0.3.27"
@@ -415,9 +404,10 @@ version = "1.0.0"
 dependencies = [
  "byteorder",
  "curl",
+ "foreign-types",
  "log",
  "openssl",
- "openssl_extensions",
+ "openssl-sys",
  "pv_core",
  "serde",
  "serde_test",

rust/pv/Cargo.toml

@@ -7,13 +7,14 @@ license.workspace = true
 [dependencies]
 byteorder = "1.3"
 curl = "0.4.44"
+foreign-types = "0.3.1"
 log = { version = "0.4.6", features = ["std", "release_max_level_debug"] }
 openssl = "0.10.57"
+openssl-sys = "0.9.92"
 serde = { version = "1.0.139", features = ["derive"]  }
 thiserror = "1.0.33"
 zerocopy = { version="0.7", features = ["derive"] }
 
-openssl_extensions = { path = "openssl_extensions" }
 pv_core = { path = "../pv_core" }
 
 [dev-dependencies]

rust/pv/openssl_extensions/Cargo.toml

@@ -1,12 +0,0 @@
-[package]
-name = "openssl_extensions"
-version = "0.1.0"
-edition.workspace = true
-license.workspace = true
-
-[dependencies]
-foreign-types = "0.3.1"
-libc = {version = "0.2.49", features = [ "extra_traits"] }
-log = { version = "0.4.6", features = ["std", "release_max_level_debug"] }
-openssl = "0.10.57"
-openssl-sys = "0.9.92"

rust/pv/openssl_extensions/build.rs

@@ -1,45 +0,0 @@
-// SPDX-License-Identifier: MIT
-//
-// Copyright IBM Corp. 2023
-
-#![allow(
-    clippy::inconsistent_digit_grouping,
-    clippy::uninlined_format_args,
-    clippy::unusual_byte_groupings
-)]
-
-use std::env;
-
-fn main() {
-    if let Ok(vars) = env::var("DEP_OPENSSL_CONF") {
-        for var in vars.split(',') {
-            println!("cargo:rustc-cfg=osslconf=\"{}\"", var);
-        }
-    }
-
-    if let Ok(version) = env::var("DEP_OPENSSL_VERSION_NUMBER") {
-        let version = u64::from_str_radix(&version, 16).unwrap();
-
-        if version >= 0x1_00_01_00_0 {
-            println!("cargo:rustc-cfg=ossl101");
-        }
-        if version >= 0x1_00_02_00_0 {
-            println!("cargo:rustc-cfg=ossl102");
-        }
-        if version >= 0x1_01_00_00_0 {
-            println!("cargo:rustc-cfg=ossl110");
-        }
-        if version >= 0x1_01_00_07_0 {
-            println!("cargo:rustc-cfg=ossl110g");
-        }
-        if version >= 0x1_01_00_08_0 {
-            println!("cargo:rustc-cfg=ossl110h");
-        }
-        if version >= 0x1_01_01_00_0 {
-            println!("cargo:rustc-cfg=ossl111");
-        }
-        if version >= 0x3_00_00_00_0 {
-            println!("cargo:rustc-cfg=ossl300");
-        }
-    }
-}

rust/pv/openssl_extensions/src/lib.rs

@@ -1,26 +0,0 @@
-// SPDX-License-Identifier: MIT
-//
-// Copyright IBM Corp. 2023
-
-#![doc(hidden)]
-
-/// Extensions to the rust-openssl crate, that are not upstream yet
-/// Upstreaming mostly work in progress
-pub mod akid;
-pub mod crl;
-mod stackable_crl;
-
-/// Test if two CRLs are equal.
-///
-/// relates to X509_CRL_match
-/// (Upstream is missing that functionality)
-pub fn x509_crl_eq(a: &openssl::x509::X509CrlRef, b: &openssl::x509::X509CrlRef) -> bool {
-    use foreign_types::ForeignTypeRef;
-    let cmp = unsafe { openssl_sys::X509_CRL_match(a.as_ptr(), b.as_ptr()) };
-    cmp == 0
-}
-
-#[allow(dead_code)]
-mod test_utils {
-    include!("../../src/test_utils.rs");
-}

rust/pv/openssl_extensions/tests/assets

@@ -1 +0,0 @@
-../../tests/assets

rust/pv/src/lib.rs

@@ -38,6 +38,7 @@ mod brcb;
 mod confidential;
 mod crypto;
 mod error;
+mod openssl_extensions;
 mod req;
 mod utils;
 mod uvattest;

rust/pv/src/openssl_extensions/akid.rs

@@ -39,21 +39,16 @@ impl fmt::Debug for AkidCheckResult {
 }
 
 impl AkidCheckResult {
+    pub const OK: AkidCheckResult = AkidCheckResult(openssl_sys::X509_V_OK);
+
     /// Creates an `AkidCheckResult` from a raw error number.
     unsafe fn from_raw(err: c_int) -> AkidCheckResult {
         AkidCheckResult(err)
     }
-
-    pub const OK: AkidCheckResult = AkidCheckResult(openssl_sys::X509_V_OK);
-    pub const ERR_AKID_ISSUER_SERIAL_MISMATCH: AkidCheckResult =
-        AkidCheckResult(openssl_sys::X509_V_ERR_AKID_ISSUER_SERIAL_MISMATCH);
-    pub const ERR_AKID_SKID_MISMATCH: AkidCheckResult =
-        AkidCheckResult(openssl_sys::X509_V_ERR_AKID_SKID_MISMATCH);
 }
 
 impl AkidRef {
-    ///Check if the `Akid` matches the issuer
-    ///
+    /// Check if the `Akid` matches the issuer
     pub fn check(&self, issuer: &X509Ref) -> AkidCheckResult {
         unsafe {
             let res = ffi::X509_check_akid(issuer.as_ptr(), self.as_ptr());

rust/pv/src/openssl_extensions/crl.rs

@@ -1,8 +1,7 @@
 // SPDX-License-Identifier: MIT
 //
 // Copyright IBM Corp. 2023
-
-pub use crate::stackable_crl::*;
+pub use crate::openssl_extensions::stackable_crl::*;
 use foreign_types::{ForeignType, ForeignTypeRef};
 use openssl::{
     error::ErrorStack,
@@ -22,7 +21,6 @@ pub fn opt_to_ptr<T: ForeignTypeRef>(o: Option<&T>) -> *mut T::CType {
 
 mod ffi {
     extern "C" {
-        #[cfg(ossl110)]
         pub fn X509_STORE_CTX_get1_crls(
             ctx: *mut openssl_sys::X509_STORE_CTX,
             nm: *mut openssl_sys::X509_NAME,
@@ -62,11 +60,8 @@ pub trait X509StoreContextExtension {
         with_context: F,
     ) -> Result<T, ErrorStack>
     where
-        F: FnOnce(&mut X509StoreContextRef) -> std::result::Result<T, ErrorStack>;
-    fn crls(
-        &mut self,
-        subj: &X509NameRef,
-    ) -> std::result::Result<Stack<StackableX509Crl>, ErrorStack>;
+        F: FnOnce(&mut X509StoreContextRef) -> Result<T, ErrorStack>;
+    fn crls(&mut self, subj: &X509NameRef) -> Result<Stack<StackableX509Crl>, ErrorStack>;
 }
 
 impl X509StoreContextExtension for X509StoreContextRef {
@@ -78,7 +73,7 @@ impl X509StoreContextExtension for X509StoreContextRef {
         with_context: F,
     ) -> Result<T, ErrorStack>
     where
-        F: FnOnce(&mut X509StoreContextRef) -> std::result::Result<T, ErrorStack>,
+        F: FnOnce(&mut X509StoreContextRef) -> Result<T, ErrorStack>,
     {
         struct Cleanup<'a>(&'a mut X509StoreContextRef);
 
@@ -108,12 +103,9 @@ impl X509StoreContextExtension for X509StoreContextRef {
         let cleanup = Cleanup(self);
         with_context(cleanup.0)
     }
+
     /// Get all Certificate Revocation Lists with the subject currently stored
-    #[cfg(ossl110)]
-    fn crls(
-        &mut self,
-        subj: &X509NameRef,
-    ) -> std::result::Result<Stack<StackableX509Crl>, ErrorStack> {
+    fn crls(&mut self, subj: &X509NameRef) -> Result<Stack<StackableX509Crl>, ErrorStack> {
         unsafe {
             {
                 let r = ffi::X509_STORE_CTX_get1_crls(self.as_ptr(), subj.as_ptr());

rust/pv/src/openssl_extensions/mod.rs

@@ -0,0 +1,13 @@
+// SPDX-License-Identifier: MIT
+//
+// Copyright IBM Corp. 2024
+
+#![doc(hidden)]
+
+/// Extensions to the rust-openssl crate
+mod akid;
+mod crl;
+mod stackable_crl;
+
+pub use akid::*;
+pub use crl::*;

rust/pv/src/openssl_extensions/stackable_crl.rs

@@ -13,14 +13,17 @@ use openssl::{
 use openssl_sys::BIO_new_mem_buf;
 use std::ffi::c_int;
 
+#[derive(Debug)]
 pub struct StackableX509Crl(*mut openssl_sys::X509_CRL);
 
 impl ForeignType for StackableX509Crl {
     type CType = openssl_sys::X509_CRL;
     type Ref = X509CrlRef;
+
     unsafe fn from_ptr(ptr: *mut openssl_sys::X509_CRL) -> StackableX509Crl {
         StackableX509Crl(ptr)
     }
+
     fn as_ptr(&self) -> *mut openssl_sys::X509_CRL {
         self.0
     }
@@ -32,6 +35,7 @@ impl Drop for StackableX509Crl {
 }
 impl ::std::ops::Deref for StackableX509Crl {
     type Target = X509CrlRef;
+
     fn deref(&self) -> &X509CrlRef {
         unsafe { ForeignTypeRef::from_ptr(self.0) }
     }
@@ -71,7 +75,7 @@ impl<'a> MemBioSlice<'a> {
     pub fn new(buf: &'a [u8]) -> Result<MemBioSlice<'a>, ErrorStack> {
         openssl_sys::init();
 
-        assert!(buf.len() <= c_int::max_value() as usize);
+        assert!(buf.len() <= c_int::MAX as usize);
         let bio = unsafe {
             {
                 let r = BIO_new_mem_buf(buf.as_ptr() as *const _, buf.len() as c_int);

rust/pv/src/utils.rs

@@ -14,7 +14,7 @@ use openssl::{
 /// This function will return an error if the underlying OpenSSL implementation cannot parse `buf`
 /// as `DER` or `PEM`.
 pub fn read_crls(buf: &[u8]) -> Result<Vec<X509Crl>> {
-    use openssl_extensions::crl::StackableX509Crl;
+    use crate::openssl_extensions::StackableX509Crl;
     X509Crl::from_der(buf)
         .map(|crl| vec![crl])
         .or_else(|_| StackableX509Crl::stack_from_pem(buf))

rust/pv/src/verify.rs

@@ -2,13 +2,13 @@
 //
 // Copyright IBM Corp. 2023
 
+use crate::openssl_extensions::{StackableX509Crl, X509StoreContextExtension, X509StoreExtension};
 use core::slice;
 use log::{debug, trace};
 use openssl::error::ErrorStack;
 use openssl::stack::Stack;
 use openssl::x509::store::X509Store;
 use openssl::x509::{CrlStatus, X509NameRef, X509Ref, X509StoreContext, X509StoreContextRef, X509};
-use openssl_extensions::crl::{StackableX509Crl, X509StoreContextExtension, X509StoreExtension};
 use std::path::Path;
 
 #[cfg(not(test))]

rust/pv/src/verify/helper.rs

@@ -3,6 +3,7 @@
 // Copyright IBM Corp. 2023
 
 use crate::error::bail_hkd_verify;
+use crate::openssl_extensions::{AkidCheckResult, AkidExtension};
 use crate::HkdVerifyErrorType::*;
 use crate::{Error, Result};
 use log::debug;
@@ -19,7 +20,6 @@ use openssl::{
         X509StoreContextRef, X509VerifyResult, X509,
     },
 };
-use openssl_extensions::akid::{AkidCheckResult, AkidExtension};
 use std::path::Path;
 use std::str::from_utf8;
 use std::{cmp::Ordering, ffi::c_int};