- Added CRL revocation support to x509parse_verify()
- Fixed an off-by-one allocation in ssl_set_hostname()
- Added CRL support to SSL/TLS code
diff --git a/include/polarssl/ssl.h b/include/polarssl/ssl.h
index f4d7d1a..b26e4ed 100644
--- a/include/polarssl/ssl.h
+++ b/include/polarssl/ssl.h
@@ -235,6 +235,7 @@
rsa_context *rsa_key; /*!< own RSA private key */
x509_cert *own_cert; /*!< own X.509 certificate */
x509_cert *ca_chain; /*!< own trusted CA chain */
+ x509_crl *ca_crl; /*!< trusted CA CRLs */
x509_cert *peer_cert; /*!< peer X.509 cert chain */
char *peer_cn; /*!< expected peer CN */
@@ -389,12 +390,13 @@
*
* \param ssl SSL context
* \param ca_chain trusted CA chain
+ * \param ca_crl trusted CA CRLs
* \param peer_cn expected peer CommonName (or NULL)
*
* \note TODO: add two more parameters: depth and crl
*/
void ssl_set_ca_chain( ssl_context *ssl, x509_cert *ca_chain,
- char *peer_cn );
+ x509_crl *ca_crl, char *peer_cn );
/**
* \brief Set own certificate and private key
diff --git a/include/polarssl/x509.h b/include/polarssl/x509.h
index c0a50b7..b7b971c 100644
--- a/include/polarssl/x509.h
+++ b/include/polarssl/x509.h
@@ -60,6 +60,8 @@
#define BADCERT_REVOKED 2
#define BADCERT_CN_MISMATCH 4
#define BADCERT_NOT_TRUSTED 8
+#define BADCRL_NOT_TRUSTED 16
+#define BADCRL_EXPIRED 32
/*
* DER constants
@@ -335,16 +337,17 @@
int x509parse_crl_info( char *buf, size_t size, char *prefix, x509_crl *crl );
/**
- * \brief Return 0 if the certificate is still valid,
- * or BADCERT_EXPIRED
+ * \brief Return 0 if the x509_time is still valid,
+ * or 1 otherwise.
*/
-int x509parse_expired( x509_cert *crt );
+int x509parse_time_expired( x509_time *time );
/**
* \brief Verify the certificate signature
*
* \param crt a certificate to be verified
* \param trust_ca the trusted CA chain
+ * \param ca_crl the CRL chain for trusted CA's
* \param cn expected Common Name (can be set to
* NULL if the CN must not be verified)
* \param flags result of the verification
@@ -361,6 +364,7 @@
*/
int x509parse_verify( x509_cert *crt,
x509_cert *trust_ca,
+ x509_crl *ca_crl,
char *cn, int *flags );
/**