From a9d4b1e1b9f8c012547335e63c31eed66be551c2 Mon Sep 17 00:00:00 2001 From: Steffen Eiden Date: Fri, 22 Mar 2024 14:12:36 +0100 Subject: [PATCH] rust/pv: Inline openssl_extensions sub-crate crates.io does not like sub-crates in a crate. Unpack the openssl-extensions sub-crate into a (private) module. While at it, fix some styling issues. Reviewed-by: Marc Hartmayer Signed-off-by: Steffen Eiden --- rust/Cargo.lock | 14 +----- rust/pv/Cargo.toml | 3 +- rust/pv/openssl_extensions/Cargo.toml | 12 ----- rust/pv/openssl_extensions/build.rs | 45 ------------------- rust/pv/openssl_extensions/src/lib.rs | 26 ----------- rust/pv/openssl_extensions/tests/assets | 1 - rust/pv/src/lib.rs | 1 + .../src => src/openssl_extensions}/akid.rs | 11 ++--- .../src => src/openssl_extensions}/crl.rs | 20 +++------ rust/pv/src/openssl_extensions/mod.rs | 13 ++++++ .../openssl_extensions}/stackable_crl.rs | 6 ++- rust/pv/src/utils.rs | 2 +- rust/pv/src/verify.rs | 2 +- rust/pv/src/verify/helper.rs | 2 +- 14 files changed, 35 insertions(+), 123 deletions(-) delete mode 100644 rust/pv/openssl_extensions/Cargo.toml delete mode 100644 rust/pv/openssl_extensions/build.rs delete mode 100644 rust/pv/openssl_extensions/src/lib.rs delete mode 120000 rust/pv/openssl_extensions/tests/assets rename rust/pv/{openssl_extensions/src => src/openssl_extensions}/akid.rs (89%) rename rust/pv/{openssl_extensions/src => src/openssl_extensions}/crl.rs (86%) create mode 100644 rust/pv/src/openssl_extensions/mod.rs rename rust/pv/{openssl_extensions/src => src/openssl_extensions}/stackable_crl.rs (98%) diff --git a/rust/Cargo.lock b/rust/Cargo.lock index 475007c5..68a49a3d 100644 --- a/rust/Cargo.lock +++ b/rust/Cargo.lock @@ -377,17 +377,6 @@ dependencies = [ "vcpkg", ] -[[package]] -name = "openssl_extensions" -version = "0.1.0" -dependencies = [ - "foreign-types", - "libc", - "log", - "openssl", - "openssl-sys", -] - [[package]] name = "pkg-config" version = "0.3.27" @@ -415,9 +404,10 @@ version = "1.0.0" dependencies = [ "byteorder", "curl", + "foreign-types", "log", "openssl", - "openssl_extensions", + "openssl-sys", "pv_core", "serde", "serde_test", diff --git a/rust/pv/Cargo.toml b/rust/pv/Cargo.toml index cc212875..79831f31 100644 --- a/rust/pv/Cargo.toml +++ b/rust/pv/Cargo.toml @@ -7,13 +7,14 @@ license.workspace = true [dependencies] byteorder = "1.3" curl = "0.4.44" +foreign-types = "0.3.1" log = { version = "0.4.6", features = ["std", "release_max_level_debug"] } openssl = "0.10.57" +openssl-sys = "0.9.92" serde = { version = "1.0.139", features = ["derive"] } thiserror = "1.0.33" zerocopy = { version="0.7", features = ["derive"] } -openssl_extensions = { path = "openssl_extensions" } pv_core = { path = "../pv_core" } [dev-dependencies] diff --git a/rust/pv/openssl_extensions/Cargo.toml b/rust/pv/openssl_extensions/Cargo.toml deleted file mode 100644 index 0ed2dd69..00000000 --- a/rust/pv/openssl_extensions/Cargo.toml +++ /dev/null @@ -1,12 +0,0 @@ -[package] -name = "openssl_extensions" -version = "0.1.0" -edition.workspace = true -license.workspace = true - -[dependencies] -foreign-types = "0.3.1" -libc = {version = "0.2.49", features = [ "extra_traits"] } -log = { version = "0.4.6", features = ["std", "release_max_level_debug"] } -openssl = "0.10.57" -openssl-sys = "0.9.92" diff --git a/rust/pv/openssl_extensions/build.rs b/rust/pv/openssl_extensions/build.rs deleted file mode 100644 index 622298d2..00000000 --- a/rust/pv/openssl_extensions/build.rs +++ /dev/null @@ -1,45 +0,0 @@ -// SPDX-License-Identifier: MIT -// -// Copyright IBM Corp. 2023 - -#![allow( - clippy::inconsistent_digit_grouping, - clippy::uninlined_format_args, - clippy::unusual_byte_groupings -)] - -use std::env; - -fn main() { - if let Ok(vars) = env::var("DEP_OPENSSL_CONF") { - for var in vars.split(',') { - println!("cargo:rustc-cfg=osslconf=\"{}\"", var); - } - } - - if let Ok(version) = env::var("DEP_OPENSSL_VERSION_NUMBER") { - let version = u64::from_str_radix(&version, 16).unwrap(); - - if version >= 0x1_00_01_00_0 { - println!("cargo:rustc-cfg=ossl101"); - } - if version >= 0x1_00_02_00_0 { - println!("cargo:rustc-cfg=ossl102"); - } - if version >= 0x1_01_00_00_0 { - println!("cargo:rustc-cfg=ossl110"); - } - if version >= 0x1_01_00_07_0 { - println!("cargo:rustc-cfg=ossl110g"); - } - if version >= 0x1_01_00_08_0 { - println!("cargo:rustc-cfg=ossl110h"); - } - if version >= 0x1_01_01_00_0 { - println!("cargo:rustc-cfg=ossl111"); - } - if version >= 0x3_00_00_00_0 { - println!("cargo:rustc-cfg=ossl300"); - } - } -} diff --git a/rust/pv/openssl_extensions/src/lib.rs b/rust/pv/openssl_extensions/src/lib.rs deleted file mode 100644 index 075319dc..00000000 --- a/rust/pv/openssl_extensions/src/lib.rs +++ /dev/null @@ -1,26 +0,0 @@ -// SPDX-License-Identifier: MIT -// -// Copyright IBM Corp. 2023 - -#![doc(hidden)] - -/// Extensions to the rust-openssl crate, that are not upstream yet -/// Upstreaming mostly work in progress -pub mod akid; -pub mod crl; -mod stackable_crl; - -/// Test if two CRLs are equal. -/// -/// relates to X509_CRL_match -/// (Upstream is missing that functionality) -pub fn x509_crl_eq(a: &openssl::x509::X509CrlRef, b: &openssl::x509::X509CrlRef) -> bool { - use foreign_types::ForeignTypeRef; - let cmp = unsafe { openssl_sys::X509_CRL_match(a.as_ptr(), b.as_ptr()) }; - cmp == 0 -} - -#[allow(dead_code)] -mod test_utils { - include!("../../src/test_utils.rs"); -} diff --git a/rust/pv/openssl_extensions/tests/assets b/rust/pv/openssl_extensions/tests/assets deleted file mode 120000 index c1a4e675..00000000 --- a/rust/pv/openssl_extensions/tests/assets +++ /dev/null @@ -1 +0,0 @@ -../../tests/assets \ No newline at end of file diff --git a/rust/pv/src/lib.rs b/rust/pv/src/lib.rs index b419424b..fad7b292 100644 --- a/rust/pv/src/lib.rs +++ b/rust/pv/src/lib.rs @@ -38,6 +38,7 @@ mod brcb; mod confidential; mod crypto; mod error; +mod openssl_extensions; mod req; mod utils; mod uvattest; diff --git a/rust/pv/openssl_extensions/src/akid.rs b/rust/pv/src/openssl_extensions/akid.rs similarity index 89% rename from rust/pv/openssl_extensions/src/akid.rs rename to rust/pv/src/openssl_extensions/akid.rs index e30b3b39..f486266a 100644 --- a/rust/pv/openssl_extensions/src/akid.rs +++ b/rust/pv/src/openssl_extensions/akid.rs @@ -39,21 +39,16 @@ impl fmt::Debug for AkidCheckResult { } impl AkidCheckResult { + pub const OK: AkidCheckResult = AkidCheckResult(openssl_sys::X509_V_OK); + /// Creates an `AkidCheckResult` from a raw error number. unsafe fn from_raw(err: c_int) -> AkidCheckResult { AkidCheckResult(err) } - - pub const OK: AkidCheckResult = AkidCheckResult(openssl_sys::X509_V_OK); - pub const ERR_AKID_ISSUER_SERIAL_MISMATCH: AkidCheckResult = - AkidCheckResult(openssl_sys::X509_V_ERR_AKID_ISSUER_SERIAL_MISMATCH); - pub const ERR_AKID_SKID_MISMATCH: AkidCheckResult = - AkidCheckResult(openssl_sys::X509_V_ERR_AKID_SKID_MISMATCH); } impl AkidRef { - ///Check if the `Akid` matches the issuer - /// + /// Check if the `Akid` matches the issuer pub fn check(&self, issuer: &X509Ref) -> AkidCheckResult { unsafe { let res = ffi::X509_check_akid(issuer.as_ptr(), self.as_ptr()); diff --git a/rust/pv/openssl_extensions/src/crl.rs b/rust/pv/src/openssl_extensions/crl.rs similarity index 86% rename from rust/pv/openssl_extensions/src/crl.rs rename to rust/pv/src/openssl_extensions/crl.rs index 81216716..6847f6f5 100644 --- a/rust/pv/openssl_extensions/src/crl.rs +++ b/rust/pv/src/openssl_extensions/crl.rs @@ -1,8 +1,7 @@ // SPDX-License-Identifier: MIT // // Copyright IBM Corp. 2023 - -pub use crate::stackable_crl::*; +pub use crate::openssl_extensions::stackable_crl::*; use foreign_types::{ForeignType, ForeignTypeRef}; use openssl::{ error::ErrorStack, @@ -22,7 +21,6 @@ pub fn opt_to_ptr(o: Option<&T>) -> *mut T::CType { mod ffi { extern "C" { - #[cfg(ossl110)] pub fn X509_STORE_CTX_get1_crls( ctx: *mut openssl_sys::X509_STORE_CTX, nm: *mut openssl_sys::X509_NAME, @@ -62,11 +60,8 @@ pub trait X509StoreContextExtension { with_context: F, ) -> Result where - F: FnOnce(&mut X509StoreContextRef) -> std::result::Result; - fn crls( - &mut self, - subj: &X509NameRef, - ) -> std::result::Result, ErrorStack>; + F: FnOnce(&mut X509StoreContextRef) -> Result; + fn crls(&mut self, subj: &X509NameRef) -> Result, ErrorStack>; } impl X509StoreContextExtension for X509StoreContextRef { @@ -78,7 +73,7 @@ impl X509StoreContextExtension for X509StoreContextRef { with_context: F, ) -> Result where - F: FnOnce(&mut X509StoreContextRef) -> std::result::Result, + F: FnOnce(&mut X509StoreContextRef) -> Result, { struct Cleanup<'a>(&'a mut X509StoreContextRef); @@ -108,12 +103,9 @@ impl X509StoreContextExtension for X509StoreContextRef { let cleanup = Cleanup(self); with_context(cleanup.0) } + /// Get all Certificate Revocation Lists with the subject currently stored - #[cfg(ossl110)] - fn crls( - &mut self, - subj: &X509NameRef, - ) -> std::result::Result, ErrorStack> { + fn crls(&mut self, subj: &X509NameRef) -> Result, ErrorStack> { unsafe { { let r = ffi::X509_STORE_CTX_get1_crls(self.as_ptr(), subj.as_ptr()); diff --git a/rust/pv/src/openssl_extensions/mod.rs b/rust/pv/src/openssl_extensions/mod.rs new file mode 100644 index 00000000..fab26638 --- /dev/null +++ b/rust/pv/src/openssl_extensions/mod.rs @@ -0,0 +1,13 @@ +// SPDX-License-Identifier: MIT +// +// Copyright IBM Corp. 2024 + +#![doc(hidden)] + +/// Extensions to the rust-openssl crate +mod akid; +mod crl; +mod stackable_crl; + +pub use akid::*; +pub use crl::*; diff --git a/rust/pv/openssl_extensions/src/stackable_crl.rs b/rust/pv/src/openssl_extensions/stackable_crl.rs similarity index 98% rename from rust/pv/openssl_extensions/src/stackable_crl.rs rename to rust/pv/src/openssl_extensions/stackable_crl.rs index 253cc159..0ad4bff6 100644 --- a/rust/pv/openssl_extensions/src/stackable_crl.rs +++ b/rust/pv/src/openssl_extensions/stackable_crl.rs @@ -13,14 +13,17 @@ use openssl::{ use openssl_sys::BIO_new_mem_buf; use std::ffi::c_int; +#[derive(Debug)] pub struct StackableX509Crl(*mut openssl_sys::X509_CRL); impl ForeignType for StackableX509Crl { type CType = openssl_sys::X509_CRL; type Ref = X509CrlRef; + unsafe fn from_ptr(ptr: *mut openssl_sys::X509_CRL) -> StackableX509Crl { StackableX509Crl(ptr) } + fn as_ptr(&self) -> *mut openssl_sys::X509_CRL { self.0 } @@ -32,6 +35,7 @@ impl Drop for StackableX509Crl { } impl ::std::ops::Deref for StackableX509Crl { type Target = X509CrlRef; + fn deref(&self) -> &X509CrlRef { unsafe { ForeignTypeRef::from_ptr(self.0) } } @@ -71,7 +75,7 @@ impl<'a> MemBioSlice<'a> { pub fn new(buf: &'a [u8]) -> Result, ErrorStack> { openssl_sys::init(); - assert!(buf.len() <= c_int::max_value() as usize); + assert!(buf.len() <= c_int::MAX as usize); let bio = unsafe { { let r = BIO_new_mem_buf(buf.as_ptr() as *const _, buf.len() as c_int); diff --git a/rust/pv/src/utils.rs b/rust/pv/src/utils.rs index 1b479c08..33cd55fd 100644 --- a/rust/pv/src/utils.rs +++ b/rust/pv/src/utils.rs @@ -14,7 +14,7 @@ use openssl::{ /// This function will return an error if the underlying OpenSSL implementation cannot parse `buf` /// as `DER` or `PEM`. pub fn read_crls(buf: &[u8]) -> Result> { - use openssl_extensions::crl::StackableX509Crl; + use crate::openssl_extensions::StackableX509Crl; X509Crl::from_der(buf) .map(|crl| vec![crl]) .or_else(|_| StackableX509Crl::stack_from_pem(buf)) diff --git a/rust/pv/src/verify.rs b/rust/pv/src/verify.rs index 53d2e8d8..a95f6fd6 100644 --- a/rust/pv/src/verify.rs +++ b/rust/pv/src/verify.rs @@ -2,13 +2,13 @@ // // Copyright IBM Corp. 2023 +use crate::openssl_extensions::{StackableX509Crl, X509StoreContextExtension, X509StoreExtension}; use core::slice; use log::{debug, trace}; use openssl::error::ErrorStack; use openssl::stack::Stack; use openssl::x509::store::X509Store; use openssl::x509::{CrlStatus, X509NameRef, X509Ref, X509StoreContext, X509StoreContextRef, X509}; -use openssl_extensions::crl::{StackableX509Crl, X509StoreContextExtension, X509StoreExtension}; use std::path::Path; #[cfg(not(test))] diff --git a/rust/pv/src/verify/helper.rs b/rust/pv/src/verify/helper.rs index 3b450c76..30e0392d 100644 --- a/rust/pv/src/verify/helper.rs +++ b/rust/pv/src/verify/helper.rs @@ -3,6 +3,7 @@ // Copyright IBM Corp. 2023 use crate::error::bail_hkd_verify; +use crate::openssl_extensions::{AkidCheckResult, AkidExtension}; use crate::HkdVerifyErrorType::*; use crate::{Error, Result}; use log::debug; @@ -19,7 +20,6 @@ use openssl::{ X509StoreContextRef, X509VerifyResult, X509, }, }; -use openssl_extensions::akid::{AkidCheckResult, AkidExtension}; use std::path::Path; use std::str::from_utf8; use std::{cmp::Ordering, ffi::c_int};