From ef63a77758e769dd205069d881b0556e142e11b1 Mon Sep 17 00:00:00 2001
From: "Dr. David von Oheimb" <dev@ddvo.net>
Date: Wed, 26 Feb 2025 18:56:21 +0100
Subject: [PATCH] crypto/{cmp,crmf}/: clean up unneeded #include directives

Reviewed-by: Paul Dale <ppzgs1@gmail.com>
Reviewed-by: Tom Cosgrove <tom.cosgrove@arm.com>
(Merged from https://github.com/openssl/openssl/pull/28035)
---
 crypto/cmp/cmp_asn.c     |  4 ----
 crypto/cmp/cmp_client.c  |  9 ---------
 crypto/cmp/cmp_ctx.c     | 10 +---------
 crypto/cmp/cmp_hdr.c     |  8 +-------
 crypto/cmp/cmp_http.c    | 15 ---------------
 crypto/cmp/cmp_local.h   | 11 +----------
 crypto/cmp/cmp_msg.c     | 10 +---------
 crypto/cmp/cmp_protect.c |  9 +--------
 crypto/cmp/cmp_server.c  |  6 ------
 crypto/cmp/cmp_status.c  | 13 -------------
 crypto/cmp/cmp_vfy.c     |  8 --------
 crypto/crmf/crmf_asn.c   |  4 ----
 crypto/crmf/crmf_lib.c   | 14 +++-----------
 crypto/crmf/crmf_local.h | 11 +----------
 crypto/crmf/crmf_pbm.c   | 18 +++---------------
 15 files changed, 12 insertions(+), 138 deletions(-)

diff --git a/crypto/cmp/cmp_asn.c b/crypto/cmp/cmp_asn.c
index a326320267..a2d3d3a849 100644
--- a/crypto/cmp/cmp_asn.c
+++ b/crypto/cmp/cmp_asn.c
@@ -14,10 +14,6 @@
 #include "cmp_local.h"
 #include "internal/crmf.h"
 
-/* explicit #includes not strictly needed since implied by the above: */
-#include <openssl/cmp.h>
-#include <openssl/crmf.h>
-
 /* ASN.1 declarations from RFC4210 */
 ASN1_SEQUENCE(OSSL_CMP_REVANNCONTENT) = {
     /* OSSL_CMP_PKISTATUS is effectively ASN1_INTEGER so it is used directly */
diff --git a/crypto/cmp/cmp_client.c b/crypto/cmp/cmp_client.c
index e129705e0e..2001414241 100644
--- a/crypto/cmp/cmp_client.c
+++ b/crypto/cmp/cmp_client.c
@@ -10,15 +10,6 @@
  */
 
 #include "cmp_local.h"
-#include "internal/cryptlib.h"
-
-/* explicit #includes not strictly needed since implied by the above: */
-#include <openssl/bio.h>
-#include <openssl/cmp.h>
-#include <openssl/err.h>
-#include <openssl/evp.h>
-#include <openssl/x509v3.h>
-#include <openssl/cmp_util.h>
 
 #define IS_CREP(t) ((t) == OSSL_CMP_PKIBODY_IP || (t) == OSSL_CMP_PKIBODY_CP \
                         || (t) == OSSL_CMP_PKIBODY_KUP)
diff --git a/crypto/cmp/cmp_ctx.c b/crypto/cmp/cmp_ctx.c
index 7b78ab1603..c619698727 100644
--- a/crypto/cmp/cmp_ctx.c
+++ b/crypto/cmp/cmp_ctx.c
@@ -9,16 +9,8 @@
  * https://www.openssl.org/source/license.html
  */
 
-#include <openssl/trace.h>
-#include <openssl/bio.h>
-#include <openssl/ocsp.h> /* for OCSP_REVOKED_STATUS_* */
-
 #include "cmp_local.h"
-
-/* explicit #includes not strictly needed since implied by the above: */
-#include <openssl/cmp.h>
-#include <openssl/crmf.h>
-#include <openssl/err.h>
+#include <openssl/ocsp.h> /* for OCSP_REVOKED_STATUS_* */
 
 #define DEFINE_OSSL_CMP_CTX_get0(FIELD, TYPE) \
     DEFINE_OSSL_CMP_CTX_get0_NAME(FIELD, FIELD, TYPE)
diff --git a/crypto/cmp/cmp_hdr.c b/crypto/cmp/cmp_hdr.c
index 74e97afe0f..51ce908f38 100644
--- a/crypto/cmp/cmp_hdr.c
+++ b/crypto/cmp/cmp_hdr.c
@@ -12,13 +12,7 @@
 /* CMP functions for PKIHeader handling */
 
 #include "cmp_local.h"
-
-#include <openssl/rand.h>
-
-/* explicit #includes not strictly needed since implied by the above: */
-#include <openssl/asn1t.h>
-#include <openssl/cmp.h>
-#include <openssl/err.h>
+#include <openssl/rand.h> /* for RAND_bytes_ex() */
 
 int ossl_cmp_hdr_set_pvno(OSSL_CMP_PKIHEADER *hdr, int pvno)
 {
diff --git a/crypto/cmp/cmp_http.c b/crypto/cmp/cmp_http.c
index d20ea618d8..809763e846 100644
--- a/crypto/cmp/cmp_http.c
+++ b/crypto/cmp/cmp_http.c
@@ -9,23 +9,8 @@
  * https://www.openssl.org/source/license.html
  */
 
-#include <string.h>
-#include <stdio.h>
-
-#include <openssl/asn1t.h>
-#include <openssl/http.h>
-
-#include <openssl/cmp.h>
 #include "cmp_local.h"
 
-/* explicit #includes not strictly needed since implied by the above: */
-#include <ctype.h>
-#include <fcntl.h>
-#include <stdlib.h>
-#include <openssl/bio.h>
-#include <openssl/buffer.h>
-#include <openssl/err.h>
-
 static int keep_alive(int keep_alive, int body_type, BIO **bios)
 {
     if (keep_alive != 0 && bios == NULL
diff --git a/crypto/cmp/cmp_local.h b/crypto/cmp/cmp_local.h
index bbca4e0ac5..e4185834b5 100644
--- a/crypto/cmp/cmp_local.h
+++ b/crypto/cmp/cmp_local.h
@@ -12,18 +12,9 @@
 #ifndef OSSL_CRYPTO_CMP_LOCAL_H
 # define OSSL_CRYPTO_CMP_LOCAL_H
 
-# include "internal/cryptlib.h"
-
 # include <openssl/cmp.h>
-# include <openssl/err.h>
-
-/* explicit #includes not strictly needed since implied by the above: */
-# include <openssl/crmf.h>
-# include <openssl/types.h>
-# include <openssl/safestack.h>
-# include <openssl/x509.h>
-# include <openssl/x509v3.h>
 # include "crypto/x509.h"
+# include "internal/cryptlib.h"
 
 # define IS_NULL_DN(name) (X509_NAME_get_entry(name, 0) == NULL)
 
diff --git a/crypto/cmp/cmp_msg.c b/crypto/cmp/cmp_msg.c
index 055f14c8f8..a3b6258f52 100644
--- a/crypto/cmp/cmp_msg.c
+++ b/crypto/cmp/cmp_msg.c
@@ -13,15 +13,7 @@
 
 #include "cmp_local.h"
 
-/* explicit #includes not strictly needed since implied by the above: */
-#include <openssl/asn1t.h>
-#include <openssl/cmp.h>
-#include <openssl/crmf.h>
-#include <openssl/err.h>
-#include <openssl/x509.h>
-#include <openssl/pem.h>
-#include <openssl/bio.h>
-#include <internal/cms.h>
+#include <internal/cms.h> /* for ossl_cms_sign_encrypt() */
 
 OSSL_CMP_MSG *OSSL_CMP_MSG_new(OSSL_LIB_CTX *libctx, const char *propq)
 {
diff --git a/crypto/cmp/cmp_protect.c b/crypto/cmp/cmp_protect.c
index f325c4505f..173b9ac55a 100644
--- a/crypto/cmp/cmp_protect.c
+++ b/crypto/cmp/cmp_protect.c
@@ -10,14 +10,7 @@
  */
 
 #include "cmp_local.h"
-#include "crypto/asn1.h"
-
-/* explicit #includes not strictly needed since implied by the above: */
-#include <openssl/asn1t.h>
-#include <openssl/cmp.h>
-#include <openssl/crmf.h>
-#include <openssl/err.h>
-#include <openssl/x509.h>
+#include "crypto/asn1.h" /* for ossl_X509_ALGOR_from_nid() */
 
 /*
  * This function is also used by the internal verify_PBMAC() in cmp_vfy.c.
diff --git a/crypto/cmp/cmp_server.c b/crypto/cmp/cmp_server.c
index 6a833f83c5..f4fed6743f 100644
--- a/crypto/cmp/cmp_server.c
+++ b/crypto/cmp/cmp_server.c
@@ -11,14 +11,8 @@
 
 /* general CMP server functions */
 
-#include <openssl/asn1t.h>
-
 #include "cmp_local.h"
 
-/* explicit #includes not strictly needed since implied by the above: */
-#include <openssl/cmp.h>
-#include <openssl/err.h>
-
 /* the context for the generic CMP server */
 struct ossl_cmp_srv_ctx_st {
     OSSL_CMP_CTX *ctx; /* CMP client context reused for transactionID etc. */
diff --git a/crypto/cmp/cmp_status.c b/crypto/cmp/cmp_status.c
index b9086d84f8..8084998308 100644
--- a/crypto/cmp/cmp_status.c
+++ b/crypto/cmp/cmp_status.c
@@ -11,21 +11,8 @@
 
 /* CMP functions for PKIStatusInfo handling and PKIMessage decomposition */
 
-#include <string.h>
-
 #include "cmp_local.h"
 
-/* explicit #includes not strictly needed since implied by the above: */
-#include <time.h>
-#include <openssl/cmp.h>
-#include <openssl/crmf.h>
-#include <openssl/err.h> /* needed in case config no-deprecated */
-#include <openssl/engine.h>
-#include <openssl/evp.h>
-#include <openssl/objects.h>
-#include <openssl/x509.h>
-#include <openssl/asn1err.h> /* for ASN1_R_TOO_SMALL and ASN1_R_TOO_LARGE */
-
 /* CMP functions related to PKIStatus */
 
 int ossl_cmp_pkisi_get_status(const OSSL_CMP_PKISI *si)
diff --git a/crypto/cmp/cmp_vfy.c b/crypto/cmp/cmp_vfy.c
index 47bf38b2af..fa1d9668b1 100644
--- a/crypto/cmp/cmp_vfy.c
+++ b/crypto/cmp/cmp_vfy.c
@@ -12,14 +12,6 @@
 /* CMP functions for PKIMessage checking */
 
 #include "cmp_local.h"
-#include <openssl/cmp_util.h>
-
-/* explicit #includes not strictly needed since implied by the above: */
-#include <openssl/asn1t.h>
-#include <openssl/cmp.h>
-#include <openssl/crmf.h>
-#include <openssl/err.h>
-#include <openssl/x509.h>
 
 /* Verify a message protected by signature according to RFC section 5.1.3.3 */
 static int verify_signature(const OSSL_CMP_CTX *cmp_ctx,
diff --git a/crypto/crmf/crmf_asn.c b/crypto/crmf/crmf_asn.c
index a4a0ff1b17..fb3f85a653 100644
--- a/crypto/crmf/crmf_asn.c
+++ b/crypto/crmf/crmf_asn.c
@@ -12,12 +12,8 @@
  */
 
 #include <openssl/asn1t.h>
-
 #include "crmf_local.h"
 
-/* explicit #includes not strictly needed since implied by the above: */
-#include <openssl/crmf.h>
-
 ASN1_SEQUENCE(OSSL_CRMF_PRIVATEKEYINFO) = {
     ASN1_SIMPLE(OSSL_CRMF_PRIVATEKEYINFO, version, ASN1_INTEGER),
     ASN1_SIMPLE(OSSL_CRMF_PRIVATEKEYINFO, privateKeyAlgorithm, X509_ALGOR),
diff --git a/crypto/crmf/crmf_lib.c b/crypto/crmf/crmf_lib.c
index 8238496e73..68432e5300 100644
--- a/crypto/crmf/crmf_lib.c
+++ b/crypto/crmf/crmf_lib.c
@@ -26,19 +26,11 @@
  * cases increases its link count) in the parent and so both should be freed up.
  */
 
-#include <openssl/asn1t.h>
-
 #include "crmf_local.h"
+#include <openssl/asn1t.h>
 #include "internal/constant_time.h"
-#include "internal/sizes.h"
-#include "crypto/evp.h"
-#include "crypto/x509.h"
-
-/* explicit #includes not strictly needed since implied by the above: */
-#include <openssl/crmf.h>
-#include <openssl/err.h>
-#include <openssl/evp.h>
-#include <openssl/cms.h>
+#include "internal/sizes.h" /* for OSSL_MAX_NAME_SIZE */
+#include "crypto/x509.h" /* for ossl_x509_check_private_key() */
 
 /*-
  * atyp = Attribute Type
diff --git a/crypto/crmf/crmf_local.h b/crypto/crmf/crmf_local.h
index 1cda2cb39e..d193368bd3 100644
--- a/crypto/crmf/crmf_local.h
+++ b/crypto/crmf/crmf_local.h
@@ -14,16 +14,7 @@
 #ifndef OSSL_CRYPTO_CRMF_LOCAL_H
 # define OSSL_CRYPTO_CRMF_LOCAL_H
 
-# include <openssl/crmf.h>
-# include <openssl/cms.h> /* for CMS_EnvelopedData and CMS_SignedData */
-# include <openssl/err.h>
-# include "internal/crmf.h" /* for ossl_crmf_attributetypeandvalue_st */
-
-/* explicit #includes not strictly needed since implied by the above: */
-# include <openssl/types.h>
-# include <openssl/safestack.h>
-# include <openssl/x509.h>
-# include <openssl/x509v3.h>
+# include "internal/crmf.h"
 
 /*-
  * EncryptedValue ::= SEQUENCE {
diff --git a/crypto/crmf/crmf_pbm.c b/crypto/crmf/crmf_pbm.c
index e65a3886f7..83f2c3163e 100644
--- a/crypto/crmf/crmf_pbm.c
+++ b/crypto/crmf/crmf_pbm.c
@@ -11,22 +11,10 @@
  * CRMF implementation by Martin Peylo, Miikka Viljanen, and David von Oheimb.
  */
 
-#include <string.h>
-
-#include <openssl/rand.h>
-#include <openssl/evp.h>
-#include <openssl/hmac.h>
-
-/* explicit #includes not strictly needed since implied by the above: */
-#include <openssl/asn1t.h>
-#include <openssl/crmf.h>
-#include <openssl/err.h>
-#include <openssl/params.h>
-#include <openssl/core_names.h>
-
-#include "internal/sizes.h"
-
 #include "crmf_local.h"
+#include <openssl/rand.h> /* for RAND_bytes_ex() */
+#include "internal/sizes.h" /* for OSSL_MAX_NAME_SIZE */
+#include <openssl/err.h>
 
 /*-
  * creates and initializes OSSL_CRMF_PBMPARAMETER (section 4.4)