Improve some comments, fix some typos+whitespace
diff --git a/include/mbedtls/x509_crt.h b/include/mbedtls/x509_crt.h
index c589a5e..2b4d353 100644
--- a/include/mbedtls/x509_crt.h
+++ b/include/mbedtls/x509_crt.h
@@ -291,7 +291,7 @@
* chaining up to those CAs will be trusted, and (2)
* self-signed end-entity certificates to be trusted (for
* specific peers you know) - in that case, the self-signed
- * certificate doens't need to have the CA bit set.
+ * certificate doesn't need to have the CA bit set.
*
* \param crt a certificate (chain) to be verified
* \param trust_ca the list of trusted CAs (see note above)
diff --git a/library/x509_crt.c b/library/x509_crt.c
index aeeb109..4187223 100644
--- a/library/x509_crt.c
+++ b/library/x509_crt.c
@@ -1893,7 +1893,6 @@
* Return 0 if yes, -1 if not.
*
* top means parent is a locally-trusted certificate
- * bottom means child is the end entity cert
*/
static int x509_crt_check_parent( const mbedtls_x509_crt *child,
const mbedtls_x509_crt *parent,
@@ -1935,9 +1934,9 @@
* 3. for trusted roots, the signature is correct
* 4. pathlen constraints are satisfied
*
- * Stop at the first suitable candidate, except if it's not time-valid (not
- * expired nor future) *and* there is a later suitable candidate that is
- * time-valid.
+ * If there's a suitable candidate which is also time-valid, return the first
+ * such. Otherwise, return the first suitable candidate (or NULL if there is
+ * none).
*
* The rationale for this rule is that someone could have a list of trusted
* roots with two versions on the same root with different validity periods.
@@ -1979,7 +1978,7 @@
continue;
}
- /* optionnal time check */
+ /* optional time check */
if( mbedtls_x509_time_is_past( &parent->valid_to ) ||
mbedtls_x509_time_is_future( &parent->valid_from ) )
{
@@ -2059,7 +2058,7 @@
*
* Given a peer-provided list of certificates EE, C1, ..., Cn and
* a list of trusted certs R1, ... Rp, try to build and verify a chain
- * EE, Ci1, ... Ciq, Rj
+ * EE, Ci1, ... Ciq [, Rj]
* such that every cert in the chain is a child of the next one,
* jumping to a trusted root as early as possible.
*
@@ -2074,7 +2073,7 @@
* - [in] crt: the cert list EE, C1, ..., Cn
* - [in] trust_ca: the trusted list R1, ..., Rp
* - [in] ca_crl, profile: as in verify_with_profile()
- * - [out] ver_chain: the built and verified chain
+ * - [out] ver_chain, chain_len: the built and verified chain
*
* Return value:
* - non-zero if the chain could not be fully built and examined
@@ -2167,7 +2166,7 @@
#if defined(MBEDTLS_X509_CRL_PARSE_C)
/* Check trusted CA's CRL for the given crt */
- *flags |= x509_crt_verifycrl(child, parent, ca_crl, profile );
+ *flags |= x509_crt_verifycrl( child, parent, ca_crl, profile );
#else
(void) ca_crl;
#endif
diff --git a/tests/scripts/depends-pkalgs.pl b/tests/scripts/depends-pkalgs.pl
index 28f1378..234c3e3f 100755
--- a/tests/scripts/depends-pkalgs.pl
+++ b/tests/scripts/depends-pkalgs.pl
@@ -6,9 +6,10 @@
#
# Purpose
#
-# To test the code dependencies on individual PK algs in each test suite. This
-# is a verification step to ensure we don't ship test suites that do not work
-# for some build options.
+# To test the code dependencies on individual PK algs (those that can be used
+# from the PK layer, so currently signature and encryption but not key
+# exchange) in each test suite. This is a verification step to ensure we don't
+# ship test suites that do not work for some build options.
#
# The process is:
# for each possible PK alg
@@ -38,6 +39,8 @@
my $kex_sed = 's/^#define \(MBEDTLS_KEY_EXCHANGE.*\)/\1/p';
my @ssl = split( /\s+/, `sed -n -e '$ssl_sed' -e '$kex_sed' $config_h` );
+# Some algorithms can't be disabled on their own as others depend on them, so
+# we list those reverse-dependencies here to keep check_config.h happy.
my %algs = (
'MBEDTLS_ECDSA_C' => [],
'MBEDTLS_ECP_C' => ['MBEDTLS_ECDSA_C', 'MBEDTLS_ECDH_C'],