mbedtls_pk_write_pubkey_der expects a mbedtls_pk_context that is non-const

[sithglan]

This bug comes from Ray Satiro from the libcurl malilinglist:

• mbedtls_pk_write_pubkey_der expects a mbedtls_pk_context that is non-const
  [3], but mbedtls_ssl_get_peer_cert returns a const certificate. I don't see a
  way to make a non-const copy of the public key but there is probably a way to
  do this, or copy the cert or some parent container.

Answer from Manuel:

Finally, regarding the fact that mbedtls_pk_write_pubkey_der() expects
a non-const pk_context, I think it is a bug on our side: that function
should work well with a const public key, and I'm afraid we just
forgot the const in the prototype :( So I think it should work if you
just cast the const away. If you want a more correct solution, then
the easiest thing to make a non-const copy of is the certificate, by
calling mbedtls_x509_crt_parse_der() on c->raw.p, c->raw.len if c is
the pointer returned by mbedtls_ssl_get_peer_cert().

References:
https://tls.mbed.org/discussions/generic/resumed-tls-handshake
http://article.gmane.org/gmane.comp.web.curl.library/46767

[ciarmcom]

ARM Internal Ref: IOTSSL-601

[aaronmdjones]

Bump. I just got bitten by this, and newer versions of Clang (3.8+) will warn even if you have an explicit cast, as it should.

warning: cast from 'const mbedtls_pk_context *' to 'mbedtls_pk_context *' drops const qualifier [-Wcast-qual]
                if ((ret = mbedtls_pk_write_pubkey_der((mbedtls_pk_context *) &certificate->pk, dk, sizeof dk)) < 0)
                                                                              ^
1 warning generated.

Adding const to the function prototype cannot change the ABI, and foo *bar can always be implicitly converted to const foo *bar (when bar is not a typedef to an array type), so it will not break the API either. In other words, you don't have to wait for the release of a new library version to fix this.

[jay]

FYI we worked around this in libcurl by making the copy.
https://github.com/curl/curl/blob/curl-7_53_1/lib/vtls/mbedtls.c#L550-L562

[RonEld]

#1194 addresses this issue

Unfortunately, since this is an API breaking change, it will probably take time to merge it

[RonEld]

The structure mbedtls_pk_context is planned to be removed with the introduction of mbed-crypto, therefore closing this issue as it won't be fixed.