4747extern "C" {
4848#endif
4949
50+ #if defined(MBEDTLS_DEPRECATED_REMOVED )
51+
5052/**
5153 * Context for PKCS #11 private keys.
5254 */
@@ -56,47 +58,71 @@ typedef struct mbedtls_pkcs11_context
5658 int len ;
5759} mbedtls_pkcs11_context ;
5860
61+ #if defined(MBEDTLS_DEPRECATED_WARNING )
62+ #define MBEDTLS_DEPRECATED __attribute__((deprecated))
63+ #else
64+ #define MBEDTLS_DEPRECATED
65+ #endif
66+
5967/**
6068 * Initialize a mbedtls_pkcs11_context.
6169 * (Just making memory references valid.)
70+ *
71+ * \deprecated This function is deprecated and will be removed in a
72+ * future version of the library.
6273 */
63- void mbedtls_pkcs11_init ( mbedtls_pkcs11_context * ctx );
74+ MBEDTLS_DEPRECATED void mbedtls_pkcs11_init ( mbedtls_pkcs11_context * ctx );
6475
6576/**
6677 * Fill in a mbed TLS certificate, based on the given PKCS11 helper certificate.
6778 *
79+ * \deprecated This function is deprecated and will be removed in a
80+ * future version of the library.
81+ *
6882 * \param cert X.509 certificate to fill
6983 * \param pkcs11h_cert PKCS #11 helper certificate
7084 *
7185 * \return 0 on success.
7286 */
73- int mbedtls_pkcs11_x509_cert_bind ( mbedtls_x509_crt * cert , pkcs11h_certificate_t pkcs11h_cert );
87+ MBEDTLS_DEPRECATED int mbedtls_pkcs11_x509_cert_bind ( mbedtls_x509_crt * cert ,
88+ pkcs11h_certificate_t pkcs11h_cert );
7489
7590/**
7691 * Set up a mbedtls_pkcs11_context storing the given certificate. Note that the
7792 * mbedtls_pkcs11_context will take over control of the certificate, freeing it when
7893 * done.
7994 *
95+ * \deprecated This function is deprecated and will be removed in a
96+ * future version of the library.
97+ *
8098 * \param priv_key Private key structure to fill.
8199 * \param pkcs11_cert PKCS #11 helper certificate
82100 *
83101 * \return 0 on success
84102 */
85- int mbedtls_pkcs11_priv_key_bind ( mbedtls_pkcs11_context * priv_key ,
86- pkcs11h_certificate_t pkcs11_cert );
103+ MBEDTLS_DEPRECATED int mbedtls_pkcs11_priv_key_bind (
104+ mbedtls_pkcs11_context * priv_key ,
105+ pkcs11h_certificate_t pkcs11_cert );
87106
88107/**
89108 * Free the contents of the given private key context. Note that the structure
90109 * itself is not freed.
91110 *
111+ * \deprecated This function is deprecated and will be removed in a
112+ * future version of the library.
113+ *
92114 * \param priv_key Private key structure to cleanup
93115 */
94- void mbedtls_pkcs11_priv_key_free ( mbedtls_pkcs11_context * priv_key );
116+ MBEDTLS_DEPRECATED void mbedtls_pkcs11_priv_key_free (
117+ mbedtls_pkcs11_context * priv_key );
95118
96119/**
97120 * \brief Do an RSA private key decrypt, then remove the message
98121 * padding
99122 *
123+ * \deprecated This function is deprecated and will be removed in a future
124+ * version of the library.
125+ *
100126 * \param ctx PKCS #11 context
101127 * \param mode must be MBEDTLS_RSA_PRIVATE, for compatibility with rsa.c's signature
102128 * \param input buffer holding the encrypted data
@@ -110,15 +136,18 @@ void mbedtls_pkcs11_priv_key_free( mbedtls_pkcs11_context *priv_key );
110136 * of ctx->N (eg. 128 bytes if RSA-1024 is used) otherwise
111137 * an error is thrown.
112138 */
113- int mbedtls_pkcs11_decrypt ( mbedtls_pkcs11_context * ctx ,
114- int mode , size_t * olen ,
115- const unsigned char * input ,
116- unsigned char * output ,
117- size_t output_max_len );
139+ MBEDTLS_DEPRECATED int mbedtls_pkcs11_decrypt ( mbedtls_pkcs11_context * ctx ,
140+ int mode , size_t * olen ,
141+ const unsigned char * input ,
142+ unsigned char * output ,
143+ size_t output_max_len );
118144
119145/**
120146 * \brief Do a private RSA to sign a message digest
121147 *
148+ * \deprecated This function is deprecated and will be removed in a future
149+ * version of the library.
150+ *
122151 * \param ctx PKCS #11 context
123152 * \param mode must be MBEDTLS_RSA_PRIVATE, for compatibility with rsa.c's signature
124153 * \param md_alg a MBEDTLS_MD_XXX (use MBEDTLS_MD_NONE for signing raw data)
@@ -132,40 +161,84 @@ int mbedtls_pkcs11_decrypt( mbedtls_pkcs11_context *ctx,
132161 * \note The "sig" buffer must be as large as the size
133162 * of ctx->N (eg. 128 bytes if RSA-1024 is used).
134163 */
135- int mbedtls_pkcs11_sign ( mbedtls_pkcs11_context * ctx ,
136- int mode ,
137- mbedtls_md_type_t md_alg ,
138- unsigned int hashlen ,
139- const unsigned char * hash ,
140- unsigned char * sig );
164+ MBEDTLS_DEPRECATED int mbedtls_pkcs11_sign ( mbedtls_pkcs11_context * ctx ,
165+ int mode ,
166+ mbedtls_md_type_t md_alg ,
167+ unsigned int hashlen ,
168+ const unsigned char * hash ,
169+ unsigned char * sig );
141170
142171/**
143172 * SSL/TLS wrappers for PKCS#11 functions
173+ *
174+ * \deprecated This function is deprecated and will be removed in a future
175+ * version of the library.
144176 */
145- static inline int mbedtls_ssl_pkcs11_decrypt ( void * ctx , int mode , size_t * olen ,
146- const unsigned char * input , unsigned char * output ,
147- size_t output_max_len )
177+ MBEDTLS_DEPRECATED static inline int mbedtls_ssl_pkcs11_decrypt ( void * ctx ,
178+ int mode , size_t * olen ,
179+ const unsigned char * input , unsigned char * output ,
180+ size_t output_max_len )
148181{
149182 return mbedtls_pkcs11_decrypt ( (mbedtls_pkcs11_context * ) ctx , mode , olen , input , output ,
150183 output_max_len );
151184}
152185
153- static inline int mbedtls_ssl_pkcs11_sign ( void * ctx ,
154- int (* f_rng )(void * , unsigned char * , size_t ), void * p_rng ,
155- int mode , mbedtls_md_type_t md_alg , unsigned int hashlen ,
156- const unsigned char * hash , unsigned char * sig )
186+ /**
187+ * \brief This function signs a message digest using RSA.
188+ *
189+ * \deprecated This function is deprecated and will be removed in a future
190+ * version of the library.
191+ *
192+ * \param ctx The PKCS #11 context.
193+ * \param f_rng The RNG function. This parameter is unused.
194+ * \param p_rng The RNG context. This parameter is unused.
195+ * \param mode The operation to run. This must be set to
196+ * MBEDTLS_RSA_PRIVATE, for compatibility with rsa.c's
197+ * signature.
198+ * \param md_alg The message digest algorithm. One of the MBEDTLS_MD_XXX
199+ * must be passed to this function and MBEDTLS_MD_NONE can be
200+ * used for signing raw data.
201+ * \param hashlen The message digest length (for MBEDTLS_MD_NONE only).
202+ * \param hash The buffer holding the message digest.
203+ * \param sig The buffer that will hold the ciphertext.
204+ *
205+ * \return \c 0 if the signing operation was successful.
206+ * \return A non-zero error code on failure.
207+ *
208+ * \note The \p sig buffer must be as large as the size of
209+ * <code>ctx->N</code>. For example, 128 bytes if RSA-1024 is
210+ * used.
211+ */
212+ MBEDTLS_DEPRECATED static inline int mbedtls_ssl_pkcs11_sign ( void * ctx ,
213+ int (* f_rng )(void * , unsigned char * , size_t ), void * p_rng ,
214+ int mode , mbedtls_md_type_t md_alg , unsigned int hashlen ,
215+ const unsigned char * hash , unsigned char * sig )
157216{
158217 ((void ) f_rng );
159218 ((void ) p_rng );
160219 return mbedtls_pkcs11_sign ( (mbedtls_pkcs11_context * ) ctx , mode , md_alg ,
161220 hashlen , hash , sig );
162221}
163222
164- static inline size_t mbedtls_ssl_pkcs11_key_len ( void * ctx )
223+ /**
224+ * This function gets the length of the private key.
225+ *
226+ * \deprecated This function is deprecated and will be removed in a future
227+ * version of the library.
228+ *
229+ * \param ctx The PKCS #11 context.
230+ *
231+ * \return The length of the private key.
232+ */
233+ MBEDTLS_DEPRECATED static inline size_t mbedtls_ssl_pkcs11_key_len ( void * ctx )
165234{
166235 return ( (mbedtls_pkcs11_context * ) ctx )-> len ;
167236}
168237
238+ #undef MBEDTLS_DEPRECATED
239+
240+ #endif /* MBEDTLS_DEPRECATED_REMOVED */
241+
169242#ifdef __cplusplus
170243}
171244#endif
0 commit comments