From 69e21cb648f140c173ba238a761ce700bef643f6 Mon Sep 17 00:00:00 2001 From: Pauli Date: Mon, 31 May 2021 14:28:45 +1000 Subject: x509: remove TODOs Reviewed-by: Tim Hudson (Merged from https://github.com/openssl/openssl/pull/15539) --- crypto/x509/t_x509.c | 6 ------ crypto/x509/v3_addr.c | 1 - crypto/x509/v3_bcons.c | 1 - crypto/x509/v3_utl.c | 1 - crypto/x509/x509_lu.c | 1 - crypto/x509/x509_vfy.c | 7 +++---- crypto/x509/x_pubkey.c | 1 - include/openssl/x509.h.in | 9 ++++----- 8 files changed, 7 insertions(+), 20 deletions(-) diff --git a/crypto/x509/t_x509.c b/crypto/x509/t_x509.c index bdfb4cb08b..8b84792b05 100644 --- a/crypto/x509/t_x509.c +++ b/crypto/x509/t_x509.c @@ -523,11 +523,5 @@ int X509_STORE_CTX_print_verify_cb(int ok, X509_STORE_CTX *ctx) BIO_free(bio); } - /* - * TODO we could check policies here too, e.g.: - * if (cert_error == X509_V_OK && ok == 2) - * policies_print(NULL, ctx); - */ - return ok; } diff --git a/crypto/x509/v3_addr.c b/crypto/x509/v3_addr.c index 4e0403844e..8bb35bd8a3 100644 --- a/crypto/x509/v3_addr.c +++ b/crypto/x509/v3_addr.c @@ -140,7 +140,6 @@ static int i2r_address(BIO *out, return 0; BIO_printf(out, "%d.%d.%d.%d", addr[0], addr[1], addr[2], addr[3]); break; - /* TODO possibly combine with ipaddr_to_asc() */ case IANA_AFI_IPV6: if (!addr_expand(addr, bs, 16, fill)) return 0; diff --git a/crypto/x509/v3_bcons.c b/crypto/x509/v3_bcons.c index 2fabcd900e..6e7a165f26 100644 --- a/crypto/x509/v3_bcons.c +++ b/crypto/x509/v3_bcons.c @@ -72,7 +72,6 @@ static BASIC_CONSTRAINTS *v2i_BASIC_CONSTRAINTS(X509V3_EXT_METHOD *method, } else if (strcmp(val->name, "pathlen") == 0) { if (!X509V3_get_value_int(val, &bcons->pathlen)) goto err; - /* TODO add sanity check on int value - at least, must be >= 0 */ } else { ERR_raise(ERR_LIB_X509V3, X509V3_R_INVALID_NAME); X509V3_conf_add_error_name_value(val); diff --git a/crypto/x509/v3_utl.c b/crypto/x509/v3_utl.c index 6da3fdfa52..255db422bd 100644 --- a/crypto/x509/v3_utl.c +++ b/crypto/x509/v3_utl.c @@ -991,7 +991,6 @@ char *ossl_ipaddr_to_asc(unsigned char *p, int len) case 4: /* IPv4 */ BIO_snprintf(buf, sizeof(buf), "%d.%d.%d.%d", p[0], p[1], p[2], p[3]); break; - /* TODO possibly combine with static i2r_address() in v3_addr.c */ case 16: /* IPv6 */ for (out = buf, i = 8, remain = sizeof(buf); i-- > 0 && bytes >= 0; diff --git a/crypto/x509/x509_lu.c b/crypto/x509/x509_lu.c index b36ddb69a1..3b76b92f71 100644 --- a/crypto/x509/x509_lu.c +++ b/crypto/x509/x509_lu.c @@ -541,7 +541,6 @@ STACK_OF(X509_OBJECT) *X509_STORE_get0_objects(const X509_STORE *v) return v->objs; } -/* TODO param type could be constified as change to lock is intermittent */ STACK_OF(X509) *X509_STORE_get1_all_certs(X509_STORE *store) { STACK_OF(X509) *sk; diff --git a/crypto/x509/x509_vfy.c b/crypto/x509/x509_vfy.c index 278b8b6765..bb54a064bc 100644 --- a/crypto/x509/x509_vfy.c +++ b/crypto/x509/x509_vfy.c @@ -553,7 +553,6 @@ static int check_extensions(X509_STORE_CTX *ctx) CB_FAIL_IF(x->altname != NULL && sk_GENERAL_NAME_num(x->altname) <= 0, ctx, x, i, X509_V_ERR_EMPTY_SUBJECT_ALT_NAME); - /* TODO add more checks on SAN entries */ /* Check sig alg consistency acc. to RFC 5280 section 4.1.1.2 */ CB_FAIL_IF(X509_ALGOR_cmp(&x->sig_alg, &x->cert_info.signature) != 0, ctx, x, i, X509_V_ERR_SIGNATURE_ALGORITHM_INCONSISTENCY); @@ -2088,8 +2087,9 @@ X509_CRL *X509_CRL_diff(X509_CRL *base, X509_CRL *newer, rvn = sk_X509_REVOKED_value(revs, i); /* - * Add only if not also in base. TODO: need something cleverer here - * for some more complex CRLs covering multiple CAs. + * Add only if not also in base. + * Need something cleverer here for some more complex CRLs covering + * multiple CAs. */ if (!X509_CRL_get0_by_serial(base, &rvtmp, &rvn->serialNumber)) { rvtmp = X509_REVOKED_dup(rvn); @@ -2101,7 +2101,6 @@ X509_CRL *X509_CRL_diff(X509_CRL *base, X509_CRL *newer, } } } - /* TODO: optionally prune deleted entries */ if (skey != NULL && md != NULL && !X509_CRL_sign(crl, skey, md)) goto memerr; diff --git a/crypto/x509/x_pubkey.c b/crypto/x509/x_pubkey.c index 7ae35f21fd..c21184d964 100644 --- a/crypto/x509/x_pubkey.c +++ b/crypto/x509/x_pubkey.c @@ -225,7 +225,6 @@ X509_PUBKEY *X509_PUBKEY_dup(const X509_PUBKEY *a) return pubkey; } -/* TODO should better be called X509_PUBKEY_set1 */ int X509_PUBKEY_set(X509_PUBKEY **x, EVP_PKEY *pkey) { X509_PUBKEY *pk = NULL; diff --git a/include/openssl/x509.h.in b/include/openssl/x509.h.in index 4877fb21f9..d5d3cdb719 100644 --- a/include/openssl/x509.h.in +++ b/include/openssl/x509.h.in @@ -661,7 +661,6 @@ X509_INFO *X509_INFO_new(void); void X509_INFO_free(X509_INFO *a); char *X509_NAME_oneline(const X509_NAME *a, char *buf, int size); -/* TODO move this block of decls to asn1.h when 'breaking change' is possible */ #ifndef OPENSSL_NO_DEPRECATED_3_0 OSSL_DEPRECATEDIN_3_0 int ASN1_verify(i2d_of_void *i2d, X509_ALGOR *algor1, @@ -699,9 +698,9 @@ int X509_set_serialNumber(X509 *x, ASN1_INTEGER *serial); ASN1_INTEGER *X509_get_serialNumber(X509 *x); const ASN1_INTEGER *X509_get0_serialNumber(const X509 *x); int X509_set_issuer_name(X509 *x, const X509_NAME *name); -X509_NAME *X509_get_issuer_name(const X509 *a); /* TODO change to get0_ */ +X509_NAME *X509_get_issuer_name(const X509 *a); int X509_set_subject_name(X509 *x, const X509_NAME *name); -X509_NAME *X509_get_subject_name(const X509 *a); /* TODO change to get0_ */ +X509_NAME *X509_get_subject_name(const X509 *a); const ASN1_TIME * X509_get0_notBefore(const X509 *x); ASN1_TIME *X509_getm_notBefore(const X509 *x); int X509_set1_notBefore(X509 *x, const ASN1_TIME *tm); @@ -738,7 +737,7 @@ ASN1_BIT_STRING *X509_get0_pubkey_bitstr(const X509 *x); long X509_REQ_get_version(const X509_REQ *req); int X509_REQ_set_version(X509_REQ *x, long version); -X509_NAME *X509_REQ_get_subject_name(const X509_REQ *req); /* TODO change to get0_ */ +X509_NAME *X509_REQ_get_subject_name(const X509_REQ *req); int X509_REQ_set_subject_name(X509_REQ *req, const X509_NAME *name); void X509_REQ_get0_signature(const X509_REQ *req, const ASN1_BIT_STRING **psig, const X509_ALGOR **palg); @@ -796,7 +795,7 @@ const ASN1_TIME *X509_CRL_get0_nextUpdate(const X509_CRL *crl); OSSL_DEPRECATEDIN_1_1_0 ASN1_TIME *X509_CRL_get_lastUpdate(X509_CRL *crl); OSSL_DEPRECATEDIN_1_1_0 ASN1_TIME *X509_CRL_get_nextUpdate(X509_CRL *crl); #endif -X509_NAME *X509_CRL_get_issuer(const X509_CRL *crl); /* TODO change to get0_ */ +X509_NAME *X509_CRL_get_issuer(const X509_CRL *crl); const STACK_OF(X509_EXTENSION) *X509_CRL_get0_extensions(const X509_CRL *crl); STACK_OF(X509_REVOKED) *X509_CRL_get_REVOKED(X509_CRL *crl); void X509_CRL_get0_signature(const X509_CRL *crl, const ASN1_BIT_STRING **psig, -- cgit v1.2.3