Re-implement verify chain if vrfy cbs are disabled
This commit re-implements the previously introduced internal
verification chain API in the case where verification callbacks
are disabled. In this situation, it is not necessary to maintain
the list of individual certificates and flags comprising the
verification chain - instead, it suffices to just keep track
of the length and the total (=merged) flags.
diff --git a/include/mbedtls/x509_crt.h b/include/mbedtls/x509_crt.h
index e90f6a0..aa0ec97 100644
--- a/include/mbedtls/x509_crt.h
+++ b/include/mbedtls/x509_crt.h
@@ -214,6 +214,8 @@
mbedtls_x509write_cert;
#endif /* MBEDTLS_X509_CRT_WRITE_C */
+#if !defined(MBEDTLS_X509_REMOVE_VERIFY_CALLBACK)
+
/**
* Item in a verification chain: cert and flags for it
*/
@@ -236,6 +238,16 @@
unsigned len;
} mbedtls_x509_crt_verify_chain;
+#else /* !MBEDTLS_X509_REMOVE_VERIFY_CALLBACK */
+
+typedef struct
+{
+ unsigned len;
+ uint32_t flags;
+} mbedtls_x509_crt_verify_chain;
+
+#endif /* !MBEDTLS_X509_REMOVE_VERIFY_CALLBACK */
+
#if defined(MBEDTLS_ECDSA_C) && defined(MBEDTLS_ECP_RESTARTABLE)
/**
diff --git a/library/x509_crt.c b/library/x509_crt.c
index a04e33c..5f2af7f 100644
--- a/library/x509_crt.c
+++ b/library/x509_crt.c
@@ -3185,6 +3185,8 @@
return( -1 );
}
+#if !defined(MBEDTLS_X509_REMOVE_VERIFY_CALLBACK)
+
/*
* Reset (init or clear) a verify_chain
*/
@@ -3261,6 +3263,62 @@
return( chain->len );
}
+#else
+
+/*
+ * Reset (init or clear) a verify_chain
+ */
+static void x509_crt_verify_chain_reset(
+ mbedtls_x509_crt_verify_chain *ver_chain )
+{
+ ver_chain->len = 0;
+ ver_chain->flags = 0;
+}
+
+/*
+ * Merge the flags for all certs in the chain, after calling callback
+ */
+static int x509_crt_verify_chain_get_flags(
+ const mbedtls_x509_crt_verify_chain *ver_chain,
+ uint32_t *flags,
+ int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *),
+ void *p_vrfy )
+{
+ ((void) f_vrfy);
+ ((void) p_vrfy);
+ *flags = ver_chain->flags;
+ return( 0 );
+}
+
+static void x509_crt_verify_chain_add_ee_flags(
+ mbedtls_x509_crt_verify_chain *chain,
+ uint32_t ee_flags )
+{
+ chain->flags |= ee_flags;
+}
+
+static void x509_crt_verify_chain_add_crt(
+ mbedtls_x509_crt_verify_chain *chain,
+ mbedtls_x509_crt *crt )
+{
+ ((void) crt);
+ chain->len++;
+}
+
+static uint32_t* x509_crt_verify_chain_get_cur_flags(
+ mbedtls_x509_crt_verify_chain *chain )
+{
+ return( &chain->flags );
+}
+
+static unsigned x509_crt_verify_chain_len(
+ mbedtls_x509_crt_verify_chain const *chain )
+{
+ return( chain->len );
+}
+
+#endif /* MBEDTLS_X509_REMOVE_VERIFY_CALLBACK */
+
/*
* Build and verify a certificate chain
*