Skip to content

Commit 46e8c72

Browse files
PataterPatater
committed
config: Remove X.509 options
Note that this fails check-names.sh because options that TLS and X.509 files use are no longer present in config.h.
1 parent 1194b8a commit 46e8c72

File tree

8 files changed

+2
-622
lines changed

8 files changed

+2
-622
lines changed

‎configs/config-psa-crypto.h

Lines changed: 1 addition & 207 deletions
Original file line numberDiff line numberDiff line change
@@ -1024,64 +1024,6 @@
10241024
*/
10251025
#define MBEDTLS_VERSION_FEATURES
10261026

1027-
/**
1028-
* \def MBEDTLS_X509_ALLOW_EXTENSIONS_NON_V3
1029-
*
1030-
* If set, the X509 parser will not break-off when parsing an X509 certificate
1031-
* and encountering an extension in a v1 or v2 certificate.
1032-
*
1033-
* Uncomment to prevent an error.
1034-
*/
1035-
//#define MBEDTLS_X509_ALLOW_EXTENSIONS_NON_V3
1036-
1037-
/**
1038-
* \def MBEDTLS_X509_ALLOW_UNSUPPORTED_CRITICAL_EXTENSION
1039-
*
1040-
* If set, the X509 parser will not break-off when parsing an X509 certificate
1041-
* and encountering an unknown critical extension.
1042-
*
1043-
* \warning Depending on your PKI use, enabling this can be a security risk!
1044-
*
1045-
* Uncomment to prevent an error.
1046-
*/
1047-
//#define MBEDTLS_X509_ALLOW_UNSUPPORTED_CRITICAL_EXTENSION
1048-
1049-
/**
1050-
* \def MBEDTLS_X509_CHECK_KEY_USAGE
1051-
*
1052-
* Enable verification of the keyUsage extension (CA and leaf certificates).
1053-
*
1054-
* Disabling this avoids problems with mis-issued and/or misused
1055-
* (intermediate) CA and leaf certificates.
1056-
*
1057-
* \warning Depending on your PKI use, disabling this can be a security risk!
1058-
*
1059-
* Comment to skip keyUsage checking for both CA and leaf certificates.
1060-
*/
1061-
#define MBEDTLS_X509_CHECK_KEY_USAGE
1062-
1063-
/**
1064-
* \def MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE
1065-
*
1066-
* Enable verification of the extendedKeyUsage extension (leaf certificates).
1067-
*
1068-
* Disabling this avoids problems with mis-issued and/or misused certificates.
1069-
*
1070-
* \warning Depending on your PKI use, disabling this can be a security risk!
1071-
*
1072-
* Comment to skip extendedKeyUsage checking for certificates.
1073-
*/
1074-
#define MBEDTLS_X509_CHECK_EXTENDED_KEY_USAGE
1075-
1076-
/**
1077-
* \def MBEDTLS_X509_RSASSA_PSS_SUPPORT
1078-
*
1079-
* Enable parsing and verification of X.509 certificates, CRLs and CSRS
1080-
* signed with RSASSA-PSS (aka PKCS#1 v2.1).
1081-
*
1082-
* Comment this macro to disallow using RSASSA-PSS in certificates.
1083-
*/
1084-
#define MBEDTLS_X509_RSASSA_PSS_SUPPORT
10851027
/* \} name SECTION: mbed TLS feature support */
10861028

10871029
/**
@@ -1212,8 +1154,7 @@
12121154
* Enable the generic ASN1 parser.
12131155
*
12141156
* Module: library/asn1.c
1215-
* Caller: library/x509.c
1216-
* library/dhm.c
1157+
* Caller: library/dhm.c
12171158
* library/pkcs12.c
12181159
* library/pkcs5.c
12191160
* library/pkparse.c
@@ -1228,9 +1169,6 @@
12281169
* Module: library/asn1write.c
12291170
* Caller: library/ecdsa.c
12301171
* library/pkwrite.c
1231-
* library/x509_create.c
1232-
* library/x509write_crt.c
1233-
* library/x509write_csr.c
12341172
*/
12351173
#define MBEDTLS_ASN1_WRITE_C
12361174

@@ -1388,18 +1326,6 @@
13881326
*/
13891327
#define MBEDTLS_CCM_C
13901328

1391-
/**
1392-
* \def MBEDTLS_CERTS_C
1393-
*
1394-
* Enable the test certificates.
1395-
*
1396-
* Module: library/certs.c
1397-
* Caller:
1398-
*
1399-
* This module is used for testing (ssl_client/server).
1400-
*/
1401-
#define MBEDTLS_CERTS_C
1402-
14031329
/**
14041330
* \def MBEDTLS_CHACHA20_C
14051331
*
@@ -1767,13 +1693,6 @@
17671693
* library/pkparse.c
17681694
* library/pkwrite.c
17691695
* library/rsa.c
1770-
* library/x509.c
1771-
* library/x509_create.c
1772-
* library/x509_crl.c
1773-
* library/x509_crt.c
1774-
* library/x509_csr.c
1775-
* library/x509write_crt.c
1776-
* library/x509write_csr.c
17771696
*
17781697
* This modules translates between OIDs and internal values.
17791698
*/
@@ -1801,9 +1720,6 @@
18011720
* Module: library/pem.c
18021721
* Caller: library/dhm.c
18031722
* library/pkparse.c
1804-
* library/x509_crl.c
1805-
* library/x509_crt.c
1806-
* library/x509_csr.c
18071723
*
18081724
* Requires: MBEDTLS_BASE64_C
18091725
*
@@ -1818,8 +1734,6 @@
18181734
*
18191735
* Module: library/pem.c
18201736
* Caller: library/pkwrite.c
1821-
* library/x509write_crt.c
1822-
* library/x509write_csr.c
18231737
*
18241738
* Requires: MBEDTLS_BASE64_C
18251739
*
@@ -1846,8 +1760,6 @@
18461760
* Enable the generic public (asymetric) key parser.
18471761
*
18481762
* Module: library/pkparse.c
1849-
* Caller: library/x509_crt.c
1850-
* library/x509_csr.c
18511763
*
18521764
* Requires: MBEDTLS_PK_C
18531765
*
@@ -1861,7 +1773,6 @@
18611773
* Enable the generic public (asymetric) key writer.
18621774
*
18631775
* Module: library/pkwrite.c
1864-
* Caller: library/x509write.c
18651776
*
18661777
* Requires: MBEDTLS_PK_C
18671778
*
@@ -1882,21 +1793,6 @@
18821793
*/
18831794
#define MBEDTLS_PKCS5_C
18841795

1885-
/**
1886-
* \def MBEDTLS_PKCS11_C
1887-
*
1888-
* Enable wrapper for PKCS#11 smartcard support.
1889-
*
1890-
* Module: library/pkcs11.c
1891-
* Caller: library/pk.c
1892-
*
1893-
* Requires: MBEDTLS_PK_C
1894-
*
1895-
* This module enables SSL/TLS PKCS #11 smartcard support.
1896-
* Requires the presence of the PKCS#11 helper library (libpkcs11-helper)
1897-
*/
1898-
//#define MBEDTLS_PKCS11_C
1899-
19001796
/**
19011797
* \def MBEDTLS_PKCS12_C
19021798
*
@@ -1998,7 +1894,6 @@
19981894
*
19991895
* Module: library/rsa.c
20001896
* library/rsa_internal.c
2001-
* Caller: library/x509.c
20021897
*
20031898
* This module is used by the following key exchanges:
20041899
* RSA, DHE-RSA, ECDHE-RSA, RSA-PSK
@@ -2014,7 +1909,6 @@
20141909
*
20151910
* Module: library/sha1.c
20161911
* Caller: library/md.c
2017-
* library/x509write_crt.c
20181912
*
20191913
* This module is required for SSL/TLS up to version 1.1, for TLS 1.2
20201914
* depending on the handshake parameters, and for SHA1-signed certificates.
@@ -2109,106 +2003,6 @@
21092003
*/
21102004
#define MBEDTLS_VERSION_C
21112005

2112-
/**
2113-
* \def MBEDTLS_X509_USE_C
2114-
*
2115-
* Enable X.509 core for using certificates.
2116-
*
2117-
* Module: library/x509.c
2118-
* Caller: library/x509_crl.c
2119-
* library/x509_crt.c
2120-
* library/x509_csr.c
2121-
*
2122-
* Requires: MBEDTLS_ASN1_PARSE_C, MBEDTLS_BIGNUM_C, MBEDTLS_OID_C,
2123-
* MBEDTLS_PK_PARSE_C
2124-
*
2125-
* This module is required for the X.509 parsing modules.
2126-
*/
2127-
#define MBEDTLS_X509_USE_C
2128-
2129-
/**
2130-
* \def MBEDTLS_X509_CRT_PARSE_C
2131-
*
2132-
* Enable X.509 certificate parsing.
2133-
*
2134-
* Module: library/x509_crt.c
2135-
* Caller: library/ssl_cli.c
2136-
* library/ssl_srv.c
2137-
* library/ssl_tls.c
2138-
*
2139-
* Requires: MBEDTLS_X509_USE_C
2140-
*
2141-
* This module is required for X.509 certificate parsing.
2142-
*/
2143-
#define MBEDTLS_X509_CRT_PARSE_C
2144-
2145-
/**
2146-
* \def MBEDTLS_X509_CRL_PARSE_C
2147-
*
2148-
* Enable X.509 CRL parsing.
2149-
*
2150-
* Module: library/x509_crl.c
2151-
* Caller: library/x509_crt.c
2152-
*
2153-
* Requires: MBEDTLS_X509_USE_C
2154-
*
2155-
* This module is required for X.509 CRL parsing.
2156-
*/
2157-
#define MBEDTLS_X509_CRL_PARSE_C
2158-
2159-
/**
2160-
* \def MBEDTLS_X509_CSR_PARSE_C
2161-
*
2162-
* Enable X.509 Certificate Signing Request (CSR) parsing.
2163-
*
2164-
* Module: library/x509_csr.c
2165-
* Caller: library/x509_crt_write.c
2166-
*
2167-
* Requires: MBEDTLS_X509_USE_C
2168-
*
2169-
* This module is used for reading X.509 certificate request.
2170-
*/
2171-
#define MBEDTLS_X509_CSR_PARSE_C
2172-
2173-
/**
2174-
* \def MBEDTLS_X509_CREATE_C
2175-
*
2176-
* Enable X.509 core for creating certificates.
2177-
*
2178-
* Module: library/x509_create.c
2179-
*
2180-
* Requires: MBEDTLS_BIGNUM_C, MBEDTLS_OID_C, MBEDTLS_PK_WRITE_C
2181-
*
2182-
* This module is the basis for creating X.509 certificates and CSRs.
2183-
*/
2184-
#define MBEDTLS_X509_CREATE_C
2185-
2186-
/**
2187-
* \def MBEDTLS_X509_CRT_WRITE_C
2188-
*
2189-
* Enable creating X.509 certificates.
2190-
*
2191-
* Module: library/x509_crt_write.c
2192-
*
2193-
* Requires: MBEDTLS_X509_CREATE_C
2194-
*
2195-
* This module is required for X.509 certificate creation.
2196-
*/
2197-
#define MBEDTLS_X509_CRT_WRITE_C
2198-
2199-
/**
2200-
* \def MBEDTLS_X509_CSR_WRITE_C
2201-
*
2202-
* Enable creating X.509 Certificate Signing Requests (CSR).
2203-
*
2204-
* Module: library/x509_csr_write.c
2205-
*
2206-
* Requires: MBEDTLS_X509_CREATE_C
2207-
*
2208-
* This module is required for X.509 certificate request writing.
2209-
*/
2210-
#define MBEDTLS_X509_CSR_WRITE_C
2211-
22122006
/**
22132007
* \def MBEDTLS_XTEA_C
22142008
*

‎configs/config-suite-b.h

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -66,12 +66,9 @@
6666
#define MBEDTLS_PK_PARSE_C
6767
#define MBEDTLS_SHA256_C
6868
#define MBEDTLS_SHA512_C
69-
#define MBEDTLS_X509_CRT_PARSE_C
70-
#define MBEDTLS_X509_USE_C
7169

7270
/* For test certificates */
7371
#define MBEDTLS_BASE64_C
74-
#define MBEDTLS_CERTS_C
7572
#define MBEDTLS_PEM_PARSE_C
7673

7774
/* Save RAM at the expense of ROM */

‎include/mbedtls/check_config.h

Lines changed: 0 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -255,10 +255,6 @@
255255
#error "MBEDTLS_PK_WRITE_C defined, but not all prerequisites"
256256
#endif
257257

258-
#if defined(MBEDTLS_PKCS11_C) && !defined(MBEDTLS_PK_C)
259-
#error "MBEDTLS_PKCS11_C defined, but not all prerequisites"
260-
#endif
261-
262258
#if defined(MBEDTLS_PLATFORM_EXIT_ALT) && !defined(MBEDTLS_PLATFORM_C)
263259
#error "MBEDTLS_PLATFORM_EXIT_ALT defined, but not all prerequisites"
264260
#endif
@@ -493,11 +489,6 @@
493489
#error "MBEDTLS_RSA_C defined, but none of the PKCS1 versions enabled"
494490
#endif
495491

496-
#if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT) && \
497-
( !defined(MBEDTLS_RSA_C) || !defined(MBEDTLS_PKCS1_V21) )
498-
#error "MBEDTLS_X509_RSASSA_PSS_SUPPORT defined, but not all prerequisites"
499-
#endif
500-
501492
#if defined(MBEDTLS_THREADING_PTHREAD)
502493
#if !defined(MBEDTLS_THREADING_C) || defined(MBEDTLS_THREADING_IMPL)
503494
#error "MBEDTLS_THREADING_PTHREAD defined, but not all prerequisites"
@@ -525,38 +516,6 @@
525516
#error "MBEDTLS_VERSION_FEATURES defined, but not all prerequisites"
526517
#endif
527518

528-
#if defined(MBEDTLS_X509_USE_C) && ( !defined(MBEDTLS_BIGNUM_C) || \
529-
!defined(MBEDTLS_OID_C) || !defined(MBEDTLS_ASN1_PARSE_C) || \
530-
!defined(MBEDTLS_PK_PARSE_C) )
531-
#error "MBEDTLS_X509_USE_C defined, but not all prerequisites"
532-
#endif
533-
534-
#if defined(MBEDTLS_X509_CREATE_C) && ( !defined(MBEDTLS_BIGNUM_C) || \
535-
!defined(MBEDTLS_OID_C) || !defined(MBEDTLS_ASN1_WRITE_C) || \
536-
!defined(MBEDTLS_PK_WRITE_C) )
537-
#error "MBEDTLS_X509_CREATE_C defined, but not all prerequisites"
538-
#endif
539-
540-
#if defined(MBEDTLS_X509_CRT_PARSE_C) && ( !defined(MBEDTLS_X509_USE_C) )
541-
#error "MBEDTLS_X509_CRT_PARSE_C defined, but not all prerequisites"
542-
#endif
543-
544-
#if defined(MBEDTLS_X509_CRL_PARSE_C) && ( !defined(MBEDTLS_X509_USE_C) )
545-
#error "MBEDTLS_X509_CRL_PARSE_C defined, but not all prerequisites"
546-
#endif
547-
548-
#if defined(MBEDTLS_X509_CSR_PARSE_C) && ( !defined(MBEDTLS_X509_USE_C) )
549-
#error "MBEDTLS_X509_CSR_PARSE_C defined, but not all prerequisites"
550-
#endif
551-
552-
#if defined(MBEDTLS_X509_CRT_WRITE_C) && ( !defined(MBEDTLS_X509_CREATE_C) )
553-
#error "MBEDTLS_X509_CRT_WRITE_C defined, but not all prerequisites"
554-
#endif
555-
556-
#if defined(MBEDTLS_X509_CSR_WRITE_C) && ( !defined(MBEDTLS_X509_CREATE_C) )
557-
#error "MBEDTLS_X509_CSR_WRITE_C defined, but not all prerequisites"
558-
#endif
559-
560519
#if defined(MBEDTLS_HAVE_INT32) && defined(MBEDTLS_HAVE_INT64)
561520
#error "MBEDTLS_HAVE_INT32 and MBEDTLS_HAVE_INT64 cannot be defined simultaneously"
562521
#endif /* MBEDTLS_HAVE_INT32 && MBEDTLS_HAVE_INT64 */

0 commit comments

Comments
 (0)