diff --git a/include/mbedtls/x509_internal.h b/include/mbedtls/x509_internal.h index ead688693..c69c5421c 100644 --- a/include/mbedtls/x509_internal.h +++ b/include/mbedtls/x509_internal.h @@ -37,66 +37,85 @@ struct mbedtls_x509_crt_frame; #define MBEDTLS_X509_CACHE_FRAME_READERS_MAX ((uint32_t) -1) /* Internal X.509 CRT cache handling functions. */ +#if defined(MBEDTLS_X509_CRT_PARSE_C) +static int mbedtls_x509_crt_flush_cache_frame( struct mbedtls_x509_crt const *crt ); +static int mbedtls_x509_crt_flush_cache_pk( struct mbedtls_x509_crt const *crt ); -int mbedtls_x509_crt_flush_cache_frame( struct mbedtls_x509_crt const *crt ); -int mbedtls_x509_crt_flush_cache_pk( struct mbedtls_x509_crt const *crt ); - -int mbedtls_x509_crt_cache_provide_frame( struct mbedtls_x509_crt const *crt ); -int mbedtls_x509_crt_cache_provide_pk( struct mbedtls_x509_crt const *crt ); +static int mbedtls_x509_crt_cache_provide_frame( struct mbedtls_x509_crt const *crt ); +static int mbedtls_x509_crt_cache_provide_pk( struct mbedtls_x509_crt const *crt ); +#endif /* MBEDTLS_X509_CRT_PARSE_C */ /* Uncategorized internal X.509 functions */ - -int mbedtls_x509_get_name( unsigned char *p, size_t len, +static int mbedtls_x509_get_name( unsigned char *p, size_t len, mbedtls_x509_name *cur ); -int mbedtls_x509_get_alg_null( unsigned char **p, const unsigned char *end, - mbedtls_x509_buf *alg ); -int mbedtls_x509_get_alg( unsigned char **p, const unsigned char *end, + +#if defined(MBEDTLS_X509_CRL_PARSE_C) || defined(MBEDTLS_X509_CSR_PARSE_C) || \ + ( !defined(MBEDTLS_X509_ON_DEMAND_PARSING) && defined(MBEDTLS_X509_CRT_PARSE_C) ) +static int mbedtls_x509_get_alg( unsigned char **p, const unsigned char *end, mbedtls_x509_buf *alg, mbedtls_x509_buf *params ); +#endif /* defined(MBEDTLS_X509_CRL_PARSE_C) || defined(MBEDTLS_X509_CSR_PARSE_C) || + ( !defined(MBEDTLS_X509_ON_DEMAND_PARSING) && defined(MBEDTLS_X509_CRT_PARSE_C) ) */ + #if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT) -int mbedtls_x509_get_rsassa_pss_params( const mbedtls_x509_buf *params, +static int mbedtls_x509_get_alg_null( unsigned char **p, const unsigned char *end, + mbedtls_x509_buf *alg ); +static int mbedtls_x509_get_rsassa_pss_params( const mbedtls_x509_buf *params, mbedtls_md_type_t *md_alg, mbedtls_md_type_t *mgf_md, int *salt_len ); #endif -int mbedtls_x509_get_sig( unsigned char **p, const unsigned char *end, mbedtls_x509_buf *sig ); -int mbedtls_x509_get_sig_alg_raw( unsigned char **p, unsigned char const *end, +static int mbedtls_x509_get_sig( unsigned char **p, const unsigned char *end, mbedtls_x509_buf *sig ); +static int mbedtls_x509_get_sig_alg_raw( unsigned char **p, unsigned char const *end, mbedtls_md_type_t *md_alg, mbedtls_pk_type_t *pk_alg, void **sig_opts ); -int mbedtls_x509_get_sig_alg( const mbedtls_x509_buf *sig_oid, const mbedtls_x509_buf *sig_params, +static int mbedtls_x509_get_sig_alg( const mbedtls_x509_buf *sig_oid, const mbedtls_x509_buf *sig_params, mbedtls_md_type_t *md_alg, mbedtls_pk_type_t *pk_alg, void **sig_opts ); -int mbedtls_x509_get_time( unsigned char **p, const unsigned char *end, + +#if ( !defined(MBEDTLS_X509_CRT_REMOVE_TIME) && defined(MBEDTLS_X509_CRT_PARSE_C) ) || \ + defined(MBEDTLS_X509_CRL_PARSE_C) +static int mbedtls_x509_get_time( unsigned char **p, const unsigned char *end, mbedtls_x509_time *t ); -int mbedtls_x509_get_serial( unsigned char **p, const unsigned char *end, +#endif /* ( !defined(MBEDTLS_X509_CRT_REMOVE_TIME) && defined(MBEDTLS_X509_CRT_PARSE_C) ) || + defined(MBEDTLS_X509_CRL_PARSE_C) */ + +static int mbedtls_x509_get_serial( unsigned char **p, const unsigned char *end, mbedtls_x509_buf *serial ); -int mbedtls_x509_name_cmp_raw( mbedtls_x509_buf_raw const *a, +static int mbedtls_x509_name_cmp_raw( mbedtls_x509_buf_raw const *a, mbedtls_x509_buf_raw const *b, int (*check)( void *ctx, mbedtls_x509_buf *oid, mbedtls_x509_buf *val, int next_merged ), void *check_ctx ); -int mbedtls_x509_memcasecmp( const void *s1, const void *s2, +static int mbedtls_x509_memcasecmp( const void *s1, const void *s2, size_t len1, size_t len2 ); -int mbedtls_x509_get_ext( unsigned char **p, const unsigned char *end, + +#if defined(MBEDTLS_X509_CRL_PARSE_C) +static int mbedtls_x509_get_ext( unsigned char **p, const unsigned char *end, mbedtls_x509_buf *ext, int tag ); +#endif /* defined(MBEDTLS_X509_CRL_PARSE_C) */ #if !defined(MBEDTLS_X509_REMOVE_INFO) -int mbedtls_x509_sig_alg_gets( char *buf, size_t size, +static int mbedtls_x509_sig_alg_gets( char *buf, size_t size, mbedtls_pk_type_t pk_alg, mbedtls_md_type_t md_alg, const void *sig_opts ); #endif -int mbedtls_x509_key_size_helper( char *buf, size_t buf_size, const char *name ); -int mbedtls_x509_string_to_names( mbedtls_asn1_named_data **head, const char *name ); -int mbedtls_x509_set_extension( mbedtls_asn1_named_data **head, const char *oid, size_t oid_len, +#if !defined(MBEDTLS_X509_REMOVE_INFO) +static int mbedtls_x509_key_size_helper( char *buf, size_t buf_size, const char *name ); +#endif /* !defined(MBEDTLS_X509_REMOVE_INFO) */ + +#if defined(MBEDTLS_X509_CREATE_C) +static int mbedtls_x509_string_to_names( mbedtls_asn1_named_data **head, const char *name ); +static int mbedtls_x509_set_extension( mbedtls_asn1_named_data **head, const char *oid, size_t oid_len, int critical, const unsigned char *val, size_t val_len ); -int mbedtls_x509_write_extensions( unsigned char **p, unsigned char *start, +static int mbedtls_x509_write_extensions( unsigned char **p, unsigned char *start, mbedtls_asn1_named_data *first ); int mbedtls_x509_write_names( unsigned char **p, unsigned char *start, mbedtls_asn1_named_data *first ); -int mbedtls_x509_write_sig( unsigned char **p, unsigned char *start, +static int mbedtls_x509_write_sig( unsigned char **p, unsigned char *start, const char *oid, size_t oid_len, unsigned char *sig, size_t size ); - +#endif /* MBEDTLS_X509_CREATE_C */ #endif /* MBEDTLS_X509_INTERNAL_H */ diff --git a/library/x509.c b/library/x509.c index 1310c9144..4448f4595 100644 --- a/library/x509.c +++ b/library/x509.c @@ -42,6 +42,11 @@ #include "mbedtls/asn1.h" #include "mbedtls/oid.h" +/* We include x509xxx.c files here so that x509.c is one compilation unit including + * all the x509 files. This is done because some of the internal functions are shared. + * For code size savings internal functions should be static so that compiler can do better job + * when optimizing. We don't wan't x509.c file to get too big so including .c files. + */ #include "x509_crl.c" #include "x509_crt.c" #include "x509_csr.c" @@ -88,7 +93,7 @@ /* * CertificateSerialNumber ::= INTEGER */ -int mbedtls_x509_get_serial( unsigned char **p, const unsigned char *end, +static int mbedtls_x509_get_serial( unsigned char **p, const unsigned char *end, mbedtls_x509_buf *serial ) { int ret; @@ -113,13 +118,32 @@ int mbedtls_x509_get_serial( unsigned char **p, const unsigned char *end, return( 0 ); } +#if defined(MBEDTLS_X509_CRL_PARSE_C) || defined(MBEDTLS_X509_CSR_PARSE_C) || \ + ( !defined(MBEDTLS_X509_ON_DEMAND_PARSING) && defined(MBEDTLS_X509_CRT_PARSE_C) ) +/* + * Parse an algorithm identifier with (optional) parameters + */ +static int mbedtls_x509_get_alg( unsigned char **p, const unsigned char *end, + mbedtls_x509_buf *alg, mbedtls_x509_buf *params ) +{ + int ret; + + if( ( ret = mbedtls_asn1_get_alg( p, end, alg, params ) ) != 0 ) + return( MBEDTLS_ERR_X509_INVALID_ALG + ret ); + + return( 0 ); +} +#endif /* defined(MBEDTLS_X509_CRL_PARSE_C) || defined(MBEDTLS_X509_CSR_PARSE_C) || + ( !defined(MBEDTLS_X509_ON_DEMAND_PARSING) && defined(MBEDTLS_X509_CRT_PARSE_C) ) */ + +#if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT) /* Get an algorithm identifier without parameters (eg for signatures) * * AlgorithmIdentifier ::= SEQUENCE { * algorithm OBJECT IDENTIFIER, * parameters ANY DEFINED BY algorithm OPTIONAL } */ -int mbedtls_x509_get_alg_null( unsigned char **p, const unsigned char *end, +static int mbedtls_x509_get_alg_null( unsigned char **p, const unsigned char *end, mbedtls_x509_buf *alg ) { int ret; @@ -130,21 +154,6 @@ int mbedtls_x509_get_alg_null( unsigned char **p, const unsigned char *end, return( 0 ); } -/* - * Parse an algorithm identifier with (optional) parameters - */ -int mbedtls_x509_get_alg( unsigned char **p, const unsigned char *end, - mbedtls_x509_buf *alg, mbedtls_x509_buf *params ) -{ - int ret; - - if( ( ret = mbedtls_asn1_get_alg( p, end, alg, params ) ) != 0 ) - return( MBEDTLS_ERR_X509_INVALID_ALG + ret ); - - return( 0 ); -} - -#if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT) /* * HashAlgorithm ::= AlgorithmIdentifier * @@ -213,7 +222,7 @@ static int x509_get_hash_alg( const mbedtls_x509_buf *alg, mbedtls_md_type_t *md * of trailerField MUST be 1, and PKCS#1 v2.2 doesn't even define any other * option. Enfore this at parsing time. */ -int mbedtls_x509_get_rsassa_pss_params( const mbedtls_x509_buf *params, +static int mbedtls_x509_get_rsassa_pss_params( const mbedtls_x509_buf *params, mbedtls_md_type_t *md_alg, mbedtls_md_type_t *mgf_md, int *salt_len ) { @@ -466,7 +475,7 @@ exit: /* * Like memcmp, but case-insensitive and always returns -1 if different */ -int mbedtls_x509_memcasecmp( const void *s1, const void *s2, +static int mbedtls_x509_memcasecmp( const void *s1, const void *s2, size_t len1, size_t len2 ) { size_t i; @@ -547,7 +556,7 @@ static int x509_string_cmp( const mbedtls_x509_buf *a, * This function can be used to verify that a buffer contains a well-formed * ASN.1 encoded X.509 name by calling it with equal parameters. */ -int mbedtls_x509_name_cmp_raw( mbedtls_x509_buf_raw const *a, +static int mbedtls_x509_name_cmp_raw( mbedtls_x509_buf_raw const *a, mbedtls_x509_buf_raw const *b, int (*abort_check)( void *ctx, mbedtls_x509_buf *oid, @@ -652,7 +661,7 @@ static int x509_get_name_cb( void *ctx, return( 0 ); } -int mbedtls_x509_get_name( unsigned char *p, +static int mbedtls_x509_get_name( unsigned char *p, size_t len, mbedtls_x509_name *cur ) { @@ -663,6 +672,8 @@ int mbedtls_x509_get_name( unsigned char *p, &cur ) ); } +#if ( !defined(MBEDTLS_X509_CRT_REMOVE_TIME) && defined(MBEDTLS_X509_CRT_PARSE_C) ) || \ + defined(MBEDTLS_X509_CRL_PARSE_C) static int x509_parse_int( unsigned char **p, size_t n, int *res ) { *res = 0; @@ -781,7 +792,7 @@ static int x509_parse_time( unsigned char **p, size_t len, size_t yearlen, * utcTime UTCTime, * generalTime GeneralizedTime } */ -int mbedtls_x509_get_time( unsigned char **p, const unsigned char *end, +static int mbedtls_x509_get_time( unsigned char **p, const unsigned char *end, mbedtls_x509_time *tm ) { int ret; @@ -810,8 +821,10 @@ int mbedtls_x509_get_time( unsigned char **p, const unsigned char *end, return x509_parse_time( p, len, year_len, tm ); } +#endif /* ( !defined(MBEDTLS_X509_CRT_REMOVE_TIME) && defined(MBEDTLS_X509_CRT_PARSE_C) ) || + defined(MBEDTLS_X509_CRL_PARSE_C) */ -int mbedtls_x509_get_sig( unsigned char **p, const unsigned char *end, mbedtls_x509_buf *sig ) +static int mbedtls_x509_get_sig( unsigned char **p, const unsigned char *end, mbedtls_x509_buf *sig ) { int ret; size_t len; @@ -835,7 +848,7 @@ int mbedtls_x509_get_sig( unsigned char **p, const unsigned char *end, mbedtls_x return( 0 ); } -int mbedtls_x509_get_sig_alg_raw( unsigned char **p, unsigned char const *end, +static int mbedtls_x509_get_sig_alg_raw( unsigned char **p, unsigned char const *end, mbedtls_md_type_t *md_alg, mbedtls_pk_type_t *pk_alg, void **sig_opts ) @@ -853,7 +866,7 @@ int mbedtls_x509_get_sig_alg_raw( unsigned char **p, unsigned char const *end, /* * Get signature algorithm from alg OID and optional parameters */ -int mbedtls_x509_get_sig_alg( const mbedtls_x509_buf *sig_oid, const mbedtls_x509_buf *sig_params, +static int mbedtls_x509_get_sig_alg( const mbedtls_x509_buf *sig_oid, const mbedtls_x509_buf *sig_params, mbedtls_md_type_t *md_alg, mbedtls_pk_type_t *pk_alg, void **sig_opts ) { @@ -901,11 +914,12 @@ int mbedtls_x509_get_sig_alg( const mbedtls_x509_buf *sig_oid, const mbedtls_x50 return( 0 ); } +#if defined(MBEDTLS_X509_CRL_PARSE_C) /* * X.509 Extensions (No parsing of extensions, pointer should * be either manually updated or extensions should be parsed!) */ -int mbedtls_x509_get_ext( unsigned char **p, const unsigned char *end, +static int mbedtls_x509_get_ext( unsigned char **p, const unsigned char *end, mbedtls_x509_buf *ext, int tag ) { int ret; @@ -936,7 +950,7 @@ int mbedtls_x509_get_ext( unsigned char **p, const unsigned char *end, return( 0 ); } - +#endif /* defined(MBEDTLS_X509_CRL_PARSE_C) */ /* * Store the name in printable form into buf; no more * than size characters will be written @@ -1038,7 +1052,7 @@ int mbedtls_x509_serial_gets( char *buf, size_t size, const mbedtls_x509_buf *se /* * Helper for writing signature algorithms */ -int mbedtls_x509_sig_alg_gets( char *buf, size_t size, mbedtls_pk_type_t pk_alg, +static int mbedtls_x509_sig_alg_gets( char *buf, size_t size, mbedtls_pk_type_t pk_alg, mbedtls_md_type_t md_alg, const void *sig_opts ) { int ret; @@ -1093,12 +1107,11 @@ int mbedtls_x509_sig_alg_gets( char *buf, size_t size, mbedtls_pk_type_t pk_alg, return( (int)( size - n ) ); } -#endif /* !MBEDTLS_X509_REMOVE_INFO */ /* * Helper for writing "RSA key size", "EC key size", etc */ -int mbedtls_x509_key_size_helper( char *buf, size_t buf_size, const char *name ) +static int mbedtls_x509_key_size_helper( char *buf, size_t buf_size, const char *name ) { char *p = buf; size_t n = buf_size; @@ -1109,6 +1122,7 @@ int mbedtls_x509_key_size_helper( char *buf, size_t buf_size, const char *name ) return( 0 ); } +#endif /* !MBEDTLS_X509_REMOVE_INFO */ #if defined(MBEDTLS_HAVE_TIME_DATE) /* diff --git a/library/x509_create.c b/library/x509_create.c index 1639630a2..88148a6f2 100644 --- a/library/x509_create.c +++ b/library/x509_create.c @@ -126,7 +126,7 @@ static const x509_attr_descriptor_t *x509_attr_descr_from_name( const char *name return( cur ); } -int mbedtls_x509_string_to_names( mbedtls_asn1_named_data **head, const char *name ) +static int mbedtls_x509_string_to_names( mbedtls_asn1_named_data **head, const char *name ) { int ret = 0; const char *s = name, *c = s; @@ -211,7 +211,7 @@ exit: /* The first byte of the value in the mbedtls_asn1_named_data structure is reserved * to store the critical boolean for us */ -int mbedtls_x509_set_extension( mbedtls_asn1_named_data **head, const char *oid, size_t oid_len, +static int mbedtls_x509_set_extension( mbedtls_asn1_named_data **head, const char *oid, size_t oid_len, int critical, const unsigned char *val, size_t val_len ) { mbedtls_asn1_named_data *cur; @@ -292,7 +292,7 @@ int mbedtls_x509_write_names( unsigned char **p, unsigned char *start, return( (int) len ); } -int mbedtls_x509_write_sig( unsigned char **p, unsigned char *start, +static int mbedtls_x509_write_sig( unsigned char **p, unsigned char *start, const char *oid, size_t oid_len, unsigned char *sig, size_t size ) { @@ -361,7 +361,7 @@ static int x509_write_extension( unsigned char **p, unsigned char *start, * -- by extnID * } */ -int mbedtls_x509_write_extensions( unsigned char **p, unsigned char *start, +static int mbedtls_x509_write_extensions( unsigned char **p, unsigned char *start, mbedtls_asn1_named_data *first ) { int ret; diff --git a/library/x509_crt.c b/library/x509_crt.c index 0d564f9bb..45107d478 100644 --- a/library/x509_crt.c +++ b/library/x509_crt.c @@ -109,7 +109,7 @@ static int x509_crt_subject_alt_from_frame( mbedtls_x509_crt_frame const *frame, static int x509_crt_ext_key_usage_from_frame( mbedtls_x509_crt_frame const *frame, mbedtls_x509_sequence *ext_key_usage ); -int mbedtls_x509_crt_flush_cache_pk( mbedtls_x509_crt const *crt ) +static int mbedtls_x509_crt_flush_cache_pk( mbedtls_x509_crt const *crt ) { #if defined(MBEDTLS_THREADING_C) if( mbedtls_mutex_lock( &crt->cache->pk_mutex ) != 0 ) @@ -145,7 +145,7 @@ int mbedtls_x509_crt_flush_cache_pk( mbedtls_x509_crt const *crt ) return( 0 ); } -int mbedtls_x509_crt_flush_cache_frame( mbedtls_x509_crt const *crt ) +static int mbedtls_x509_crt_flush_cache_frame( mbedtls_x509_crt const *crt ) { #if defined(MBEDTLS_THREADING_C) if( mbedtls_mutex_lock( &crt->cache->frame_mutex ) != 0 ) @@ -188,7 +188,7 @@ int mbedtls_x509_crt_flush_cache( mbedtls_x509_crt const *crt ) static int x509_crt_frame_parse_ext( mbedtls_x509_crt_frame *frame ); -int mbedtls_x509_crt_cache_provide_frame( mbedtls_x509_crt const *crt ) +static int mbedtls_x509_crt_cache_provide_frame( mbedtls_x509_crt const *crt ) { mbedtls_x509_crt_cache *cache = crt->cache; mbedtls_x509_crt_frame *frame; @@ -255,7 +255,7 @@ int mbedtls_x509_crt_cache_provide_frame( mbedtls_x509_crt const *crt ) #endif /* !MBEDTLS_X509_ON_DEMAND_PARSING */ } -int mbedtls_x509_crt_cache_provide_pk( mbedtls_x509_crt const *crt ) +static int mbedtls_x509_crt_cache_provide_pk( mbedtls_x509_crt const *crt ) { mbedtls_x509_crt_cache *cache = crt->cache; mbedtls_pk_context *pk; diff --git a/tests/suites/test_suite_x509parse.function b/tests/suites/test_suite_x509parse.function index b81c1b12a..7f5c45fde 100644 --- a/tests/suites/test_suite_x509parse.function +++ b/tests/suites/test_suite_x509parse.function @@ -9,6 +9,10 @@ #include "mbedtls/oid.h" #include "mbedtls/base64.h" #include "string.h" +/* We need to include x509.c because we are testing x509 internal + * functions from x509_internal.h which are static. With this include + * we get the tested functions defined. */ +#include "../library/x509.c" #if MBEDTLS_X509_MAX_INTERMEDIATE_CA > 19 #error "The value of MBEDTLS_X509_MAX_INTERMEDIATE_C is larger \ @@ -960,7 +964,7 @@ exit: } /* END_CASE */ -/* BEGIN_CASE depends_on:MBEDTLS_X509_USE_C */ +/* BEGIN_CASE depends_on:MBEDTLS_X509_USE_C:!MBEDTLS_X509_CRT_REMOVE_TIME */ void x509_get_time( int tag, char * time_str, int ret, int year, int mon, int day, int hour, int min, int sec ) { diff --git a/tests/suites/test_suite_x509parse_pthread.function b/tests/suites/test_suite_x509parse_pthread.function index 2728e9617..5ce0bf5ff 100644 --- a/tests/suites/test_suite_x509parse_pthread.function +++ b/tests/suites/test_suite_x509parse_pthread.function @@ -4,7 +4,6 @@ #include "mbedtls/x509_crt.h" #include "mbedtls/x509_crl.h" #include "mbedtls/x509_csr.h" -#include "mbedtls/x509_internal.h" #include "mbedtls/pem.h" #include "mbedtls/oid.h" #include "mbedtls/base64.h" diff --git a/tests/suites/test_suite_x509write.function b/tests/suites/test_suite_x509write.function index 923716594..3ff5c5f4b 100644 --- a/tests/suites/test_suite_x509write.function +++ b/tests/suites/test_suite_x509write.function @@ -6,6 +6,10 @@ #include "mbedtls/pem.h" #include "mbedtls/oid.h" #include "mbedtls/rsa.h" +/* We need to include x509.c because we are testing x509 internal + * functions from x509_internal.h which are static. With this include + * we get the tested functions defined. */ +#include "../library/x509.c" #if defined(MBEDTLS_RSA_C) int mbedtls_rsa_decrypt_func( void *ctx, int mode, size_t *olen,