commit 9ec3fe0d4371b3d384b53da199775def7ab3abee
author Hanno Becker <hanno.becker@arm.com> Mon Jul 01 17:36:12 2019 +0100
committer Hanno Becker <hanno.becker@arm.com> Mon Sep 09 09:55:31 2019 +0100
tree 1b9623cc2ef68484502afb0a1befe907bb51db39
parent 0e895727be97b3679e8bfef86a264e3300700db1

Introduce configuration option to remove CRT verification callbacks

programs/x509/cert_app.c

diff --git a/programs/x509/cert_app.c b/programs/x509/cert_app.c
index 74efea3..b82f83f 100644
--- a/programs/x509/cert_app.c
+++ b/programs/x509/cert_app.c
@@ -129,6 +129,7 @@
 }
 #endif /* MBEDTLS_DEBUG_C */
 
+#if !defined(MBEDTLS_X509_REMOVE_VERIFY_CALLBACK)
 static int my_verify( void *data, mbedtls_x509_crt *crt, int depth, uint32_t *flags )
 {
     char buf[1024];
@@ -148,6 +149,7 @@
 
     return( 0 );
 }
+#endif /* !MBEDTLS_X509_REMOVE_VERIFY_CALLBACK */
 
 #if defined(MBEDTLS_SSL_CONF_RNG)
 int rng_wrap( void *ctx, unsigned char *dst, size_t len );
@@ -363,11 +365,21 @@
         {
             mbedtls_printf( "  . Verifying X.509 certificate..." );
 
-            if( ( ret = mbedtls_x509_crt_verify( &crt, &cacert, &cacrl,
+#if !defined(MBEDTLS_X509_REMOVE_VERIFY_CALLBACK)
+            ret = mbedtls_x509_crt_verify( &crt, &cacert, &cacrl,
 #if !defined(MBEDTLS_X509_REMOVE_HOSTNAME_VERIFICATION)
                                         NULL,
 #endif /* !MBEDTLS_X509_REMOVE_HOSTNAME_VERIFICATION */
-                                        &flags, my_verify, NULL ) ) != 0 )
+                                        &flags,
+                                        my_verify, NULL );
+#else /* !MBEDTLS_X509_REMOVE_VERIFY_CALLBACK */
+            ret = mbedtls_x509_crt_verify( &crt, &cacert, &cacrl,
+#if !defined(MBEDTLS_X509_REMOVE_HOSTNAME_VERIFICATION)
+                                           NULL,
+#endif /* !MBEDTLS_X509_REMOVE_HOSTNAME_VERIFICATION */
+                                           &flags );
+#endif /* MBEDTLS_X509_REMOVE_VERIFY_CALLBACK */
+            if( ret != 0 )
             {
                 char vrfy_buf[512];
 
@@ -436,7 +448,10 @@
         {
             mbedtls_ssl_conf_authmode( &conf, MBEDTLS_SSL_VERIFY_REQUIRED );
             mbedtls_ssl_conf_ca_chain( &conf, &cacert, NULL );
+
+#if !defined(MBEDTLS_X509_REMOVE_VERIFY_CALLBACK)
             mbedtls_ssl_conf_verify( &conf, my_verify, NULL );
+#endif
         }
         else
             mbedtls_ssl_conf_authmode( &conf, MBEDTLS_SSL_VERIFY_NONE );