Pkcs7 add support for internal certificates

[daverodgman]

Description

Contributed by Joakim Sindholt [email protected] under the terms of the DCO, so I've signed it off: see https://lists.trustedfirmware.org/archives/list/[email protected]/thread/WKW5ODIOQKM6FKLFOAEZEFAO47GOTMWU/

I have verified that this doesn't break the existing tests, but haven't done any other checking. It does conflict with the latest version so will need some work to update it, as well as to add tests. This is implemented on top of #7159

Gatekeeper checklist

• changelog TODO
• backport not required - not in 2.28
• tests TODO

[LionNatsu]

I found some const to non-const changes, IMHO I think it's a better idea to correct the const-ness of mbedtls_x509_crt_verify, instead of letting it propagate the wrong things to your new code. And because it will further improve (relax) the const-ness restrictions, so that should be source-compatible to the existing code.

[LionNatsu]

Both can be const, this is a read-only function.

[LionNatsu]

Why?

[LionNatsu]

It seems a non-const cert is ONLY required by the call to mbedtls_x509_crt_verify here. I'm not sure about this, maybe parameters in mbedtls_x509_crt_*verify family:

mbedtls/library/x509_crt.c

Lines 3110 to 3122 in 3c0e4ef

	int mbedtls_x509_crt_verify(mbedtls_x509_crt *crt,
	mbedtls_x509_crt *trust_ca,
	mbedtls_x509_crl *ca_crl,
	const char *cn, uint32_t *flags,
	int (*f_vrfy)(void *, mbedtls_x509_crt *, int, uint32_t *),
	void *p_vrfy)
	{
	return x509_crt_verify_restartable_ca_cb(crt, trust_ca, ca_crl,
	NULL, NULL,
	&mbedtls_x509_crt_profile_default,
	cn, flags,
	f_vrfy, p_vrfy, NULL);
	}

should be changed to const at the same time too (which will also change x509_crt_verify_chain etc)?

[LionNatsu]

This makes the prototype stricter than the original const one, let alone incompatibilities, now it requires a mutable variable and implies potential writes and changes, therefore compiler will behave more conservatively, not good.