Unexport GENERAL_NAME_cmp

This function was involved in both CVE-2020-1971 and CVE-2023-0286. Both
times, we've had to confirm there were no external callers. Unexport it
so we can be sure of this.

Change-Id: I37b756f5bd66e389f03540872371001c85a0b5af
Reviewed-on: https://boringssl-review.googlesource.com/c/boringssl/+/56987
Reviewed-by: Bob Beck <bbe@google.com>
Commit-Queue: David Benjamin <davidben@google.com>

crypto/x509v3/internal.h

diff --git a/crypto/x509v3/internal.h b/crypto/x509v3/internal.h
index 0c068a0..e9d601b 100644
--- a/crypto/x509v3/internal.h
+++ b/crypto/x509v3/internal.h
@@ -181,6 +181,14 @@
   ERR_add_error_data(6, "section:", (val)->section, ",name:", (val)->name, \
                      ",value:", (val)->value);
 
+// GENERAL_NAME_cmp returns zero if |a| and |b| are equal and a non-zero
+// value otherwise. Note this function does not provide a comparison suitable
+// for sorting.
+//
+// This function is exported for testing.
+OPENSSL_EXPORT int GENERAL_NAME_cmp(const GENERAL_NAME *a,
+                                    const GENERAL_NAME *b);
+
 
 #if defined(__cplusplus)
 }  // extern C

crypto/x509v3/v3_genn.c

diff --git a/crypto/x509v3/v3_genn.c b/crypto/x509v3/v3_genn.c
index aafad93..d593727 100644
--- a/crypto/x509v3/v3_genn.c
+++ b/crypto/x509v3/v3_genn.c
@@ -61,6 +61,8 @@
 #include <openssl/obj.h>
 #include <openssl/x509v3.h>
 
+#include "internal.h"
+
 
 ASN1_SEQUENCE(OTHERNAME) = {
     ASN1_SIMPLE(OTHERNAME, type_id, ASN1_OBJECT),
@@ -122,6 +124,22 @@
 }
 
 // Returns 0 if they are equal, != 0 otherwise.
+static int othername_cmp(OTHERNAME *a, OTHERNAME *b) {
+  int result = -1;
+
+  if (!a || !b) {
+    return -1;
+  }
+  // Check their type first.
+  if ((result = OBJ_cmp(a->type_id, b->type_id)) != 0) {
+    return result;
+  }
+  // Check the value.
+  result = ASN1_TYPE_cmp(a->value, b->value);
+  return result;
+}
+
+// Returns 0 if they are equal, != 0 otherwise.
 int GENERAL_NAME_cmp(const GENERAL_NAME *a, const GENERAL_NAME *b) {
   if (!a || !b || a->type != b->type) {
     return -1;
@@ -135,7 +153,7 @@
       return edipartyname_cmp(a->d.ediPartyName, b->d.ediPartyName);
 
     case GEN_OTHERNAME:
-      return OTHERNAME_cmp(a->d.otherName, b->d.otherName);
+      return othername_cmp(a->d.otherName, b->d.otherName);
 
     case GEN_EMAIL:
     case GEN_DNS:
@@ -155,22 +173,6 @@
   return -1;
 }
 
-// Returns 0 if they are equal, != 0 otherwise.
-int OTHERNAME_cmp(OTHERNAME *a, OTHERNAME *b) {
-  int result = -1;
-
-  if (!a || !b) {
-    return -1;
-  }
-  // Check their type first.
-  if ((result = OBJ_cmp(a->type_id, b->type_id)) != 0) {
-    return result;
-  }
-  // Check the value.
-  result = ASN1_TYPE_cmp(a->value, b->value);
-  return result;
-}
-
 void GENERAL_NAME_set0_value(GENERAL_NAME *a, int type, void *value) {
   switch (type) {
     case GEN_X400:

include/openssl/x509v3.h

diff --git a/include/openssl/x509v3.h b/include/openssl/x509v3.h
index 9002286..04b3cb9 100644
--- a/include/openssl/x509v3.h
+++ b/include/openssl/x509v3.h
@@ -426,12 +426,6 @@
 DECLARE_ASN1_FUNCTIONS(GENERAL_NAME)
 OPENSSL_EXPORT GENERAL_NAME *GENERAL_NAME_dup(GENERAL_NAME *a);
 
-// GENERAL_NAME_cmp returns zero if |a| and |b| are equal and a non-zero
-// value otherwise. Note this function does not provide a comparison suitable
-// for sorting.
-OPENSSL_EXPORT int GENERAL_NAME_cmp(const GENERAL_NAME *a,
-                                    const GENERAL_NAME *b);
-
 // i2v_GENERAL_NAME serializes |gen| as a |CONF_VALUE|. If |ret| is non-NULL, it
 // appends the value to |ret| and returns |ret| on success or NULL on error. If
 // it returns NULL, the caller is still responsible for freeing |ret|. If |ret|
@@ -468,7 +462,6 @@
 
 DECLARE_ASN1_FUNCTIONS_const(OTHERNAME)
 DECLARE_ASN1_FUNCTIONS_const(EDIPARTYNAME)
-OPENSSL_EXPORT int OTHERNAME_cmp(OTHERNAME *a, OTHERNAME *b);
 OPENSSL_EXPORT void GENERAL_NAME_set0_value(GENERAL_NAME *a, int type,
                                             void *value);
 OPENSSL_EXPORT void *GENERAL_NAME_get0_value(const GENERAL_NAME *a, int *ptype);