From 562df401d3904dedb16c8e2357bf0c1c011e836c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Manuel=20P=C3=A9gouri=C3=A9-Gonnard?= Date: Tue, 8 Aug 2017 18:09:14 +0200 Subject: [PATCH] Improve some comments, fix some typos+whitespace --- include/mbedtls/x509_crt.h | 2 +- library/x509_crt.c | 15 +++++++-------- tests/scripts/depends-pkalgs.pl | 9 ++++++--- 3 files changed, 14 insertions(+), 12 deletions(-) diff --git a/include/mbedtls/x509_crt.h b/include/mbedtls/x509_crt.h index c589a5e17..2b4d3533f 100644 --- a/include/mbedtls/x509_crt.h +++ b/include/mbedtls/x509_crt.h @@ -291,7 +291,7 @@ int mbedtls_x509_crt_verify_info( char *buf, size_t size, const char *prefix, * chaining up to those CAs will be trusted, and (2) * self-signed end-entity certificates to be trusted (for * specific peers you know) - in that case, the self-signed - * certificate doens't need to have the CA bit set. + * certificate doesn't need to have the CA bit set. * * \param crt a certificate (chain) to be verified * \param trust_ca the list of trusted CAs (see note above) diff --git a/library/x509_crt.c b/library/x509_crt.c index aeeb109b6..418722364 100644 --- a/library/x509_crt.c +++ b/library/x509_crt.c @@ -1893,7 +1893,6 @@ static int x509_crt_check_signature( const mbedtls_x509_crt *child, * Return 0 if yes, -1 if not. * * top means parent is a locally-trusted certificate - * bottom means child is the end entity cert */ static int x509_crt_check_parent( const mbedtls_x509_crt *child, const mbedtls_x509_crt *parent, @@ -1935,9 +1934,9 @@ static int x509_crt_check_parent( const mbedtls_x509_crt *child, * 3. for trusted roots, the signature is correct * 4. pathlen constraints are satisfied * - * Stop at the first suitable candidate, except if it's not time-valid (not - * expired nor future) *and* there is a later suitable candidate that is - * time-valid. + * If there's a suitable candidate which is also time-valid, return the first + * such. Otherwise, return the first suitable candidate (or NULL if there is + * none). * * The rationale for this rule is that someone could have a list of trusted * roots with two versions on the same root with different validity periods. @@ -1979,7 +1978,7 @@ static mbedtls_x509_crt *x509_crt_find_parent_in( mbedtls_x509_crt *child, continue; } - /* optionnal time check */ + /* optional time check */ if( mbedtls_x509_time_is_past( &parent->valid_to ) || mbedtls_x509_time_is_future( &parent->valid_from ) ) { @@ -2059,7 +2058,7 @@ static int x509_crt_check_ee_locally_trusted( * * Given a peer-provided list of certificates EE, C1, ..., Cn and * a list of trusted certs R1, ... Rp, try to build and verify a chain - * EE, Ci1, ... Ciq, Rj + * EE, Ci1, ... Ciq [, Rj] * such that every cert in the chain is a child of the next one, * jumping to a trusted root as early as possible. * @@ -2074,7 +2073,7 @@ static int x509_crt_check_ee_locally_trusted( * - [in] crt: the cert list EE, C1, ..., Cn * - [in] trust_ca: the trusted list R1, ..., Rp * - [in] ca_crl, profile: as in verify_with_profile() - * - [out] ver_chain: the built and verified chain + * - [out] ver_chain, chain_len: the built and verified chain * * Return value: * - non-zero if the chain could not be fully built and examined @@ -2167,7 +2166,7 @@ static int x509_crt_verify_chain( #if defined(MBEDTLS_X509_CRL_PARSE_C) /* Check trusted CA's CRL for the given crt */ - *flags |= x509_crt_verifycrl(child, parent, ca_crl, profile ); + *flags |= x509_crt_verifycrl( child, parent, ca_crl, profile ); #else (void) ca_crl; #endif diff --git a/tests/scripts/depends-pkalgs.pl b/tests/scripts/depends-pkalgs.pl index 28f13787d..234c3e3f8 100755 --- a/tests/scripts/depends-pkalgs.pl +++ b/tests/scripts/depends-pkalgs.pl @@ -6,9 +6,10 @@ # # Purpose # -# To test the code dependencies on individual PK algs in each test suite. This -# is a verification step to ensure we don't ship test suites that do not work -# for some build options. +# To test the code dependencies on individual PK algs (those that can be used +# from the PK layer, so currently signature and encryption but not key +# exchange) in each test suite. This is a verification step to ensure we don't +# ship test suites that do not work for some build options. # # The process is: # for each possible PK alg @@ -38,6 +39,8 @@ my $ssl_sed = 's/^#define \(MBEDTLS_SSL.*\)/\1/p'; my $kex_sed = 's/^#define \(MBEDTLS_KEY_EXCHANGE.*\)/\1/p'; my @ssl = split( /\s+/, `sed -n -e '$ssl_sed' -e '$kex_sed' $config_h` ); +# Some algorithms can't be disabled on their own as others depend on them, so +# we list those reverse-dependencies here to keep check_config.h happy. my %algs = ( 'MBEDTLS_ECDSA_C' => [], 'MBEDTLS_ECP_C' => ['MBEDTLS_ECDSA_C', 'MBEDTLS_ECDH_C'],