Remove X509_{PURPOSE,TRUST}_{MIN,MAX}

These tables are small enough that a linear scan is fine. This is one less thing we need to keep in sync, and means we can remove entries without renumbering them. Change-Id: If1a41397aac3917534529e7e704983489e266a0f Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/65150 Commit-Queue: David Benjamin <[email protected]> Reviewed-by: Bob Beck <[email protected]> (cherry picked from commit 0beff26c59e67e2e19d173f1bd23241a0e946fd9)
aws · Jun 17, 2024 · 8634c14 · 8634c14
1 parent 909f16b
commit 8634c14
Show file tree

Hide file tree

Showing 3 changed files with 17 additions and 18 deletions.
diff --git a/crypto/x509/v3_purp.c b/crypto/x509/v3_purp.c
@@ -54,8 +54,8 @@
  * ([email protected]).  This product includes software written by Tim
  * Hudson ([email protected]). */
 
-#include <stdio.h>
-
+#include <assert.h>
+#include <limits.h>
 #include <string.h>
 
 #include <openssl/digest.h>
@@ -171,8 +171,12 @@ int X509_PURPOSE_get_by_sname(const char *sname) {
 }
 
 int X509_PURPOSE_get_by_id(int purpose) {
-  if (purpose >= X509_PURPOSE_MIN && purpose <= X509_PURPOSE_MAX) {
-    return purpose - X509_PURPOSE_MIN;
+  for (size_t i = 0; i <OPENSSL_ARRAY_SIZE(xstandard); i++) {
+    if (xstandard[i].purpose == purpose) {
+      OPENSSL_STATIC_ASSERT(OPENSSL_ARRAY_SIZE(xstandard) <= INT_MAX,
+                    indices_must_fit_in_int);
+      return (int)i;
+    }
   }
   return -1;
 }

diff --git a/crypto/x509/x509_trs.c b/crypto/x509/x509_trs.c
@@ -54,6 +54,9 @@
  * ([email protected]).  This product includes software written by Tim
  * Hudson ([email protected]). */
 
+#include <assert.h>
+#include <limits.h>
+
 #include <openssl/err.h>
 #include <openssl/mem.h>
 #include <openssl/obj.h>
@@ -69,10 +72,6 @@ static int trust_compat(const X509_TRUST *trust, X509 *x, int flags);
 
 static int obj_trust(int id, X509 *x, int flags);
 
-// WARNING: the following table should be kept in order of trust and without
-// any gaps so we can just subtract the minimum trust value to get an index
-// into the table
-
 static const X509_TRUST trstandard[] = {
     {X509_TRUST_COMPAT, 0, trust_compat, (char *)"compatible", 0, NULL},
     {X509_TRUST_SSL_CLIENT, 0, trust_1oidany, (char *)"SSL Client",
@@ -122,8 +121,12 @@ const X509_TRUST *X509_TRUST_get0(int idx) {
 }
 
 int X509_TRUST_get_by_id(int id) {
-  if (id >= X509_TRUST_MIN && id <= X509_TRUST_MAX) {
-    return id - X509_TRUST_MIN;
+  for (size_t i = 0; i < OPENSSL_ARRAY_SIZE(trstandard); i++) {
+    if (trstandard[i].trust == id) {
+      OPENSSL_STATIC_ASSERT(OPENSSL_ARRAY_SIZE(trstandard) <= INT_MAX,
+                    indices_must_fit_in_int);
+      return (int)i;
+    }
   }
   return -1;
 }

diff --git a/include/openssl/x509.h b/include/openssl/x509.h
@@ -3653,11 +3653,6 @@ DEFINE_STACK_OF(X509_TRUST)
 #define X509_TRUST_OCSP_REQUEST 7
 #define X509_TRUST_TSA 8
 
-// Keep these up to date! (hidden)
-
-#define X509_TRUST_MIN 1
-#define X509_TRUST_MAX 8
-
 // check_trust return codes
 
 #define X509_TRUST_TRUSTED 1
@@ -4540,9 +4535,6 @@ typedef struct x509_purpose_st {
 #define X509_PURPOSE_OCSP_HELPER 8
 #define X509_PURPOSE_TIMESTAMP_SIGN 9
 
-#define X509_PURPOSE_MIN 1
-#define X509_PURPOSE_MAX 9
-
 DEFINE_STACK_OF(X509_PURPOSE)
 
 DECLARE_ASN1_FUNCTIONS_const(BASIC_CONSTRAINTS)