Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 1 | /** |
Simon Butcher | 5b331b9 | 2016-01-03 16:14:14 +0000 | [diff] [blame] | 2 | * \file x509_crl.h |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 3 | * |
| 4 | * \brief X.509 certificate revocation list parsing |
Darryl Green | a40a101 | 2018-01-05 15:33:17 +0000 | [diff] [blame] | 5 | */ |
| 6 | /* |
Bence Szépkúti | 1e14827 | 2020-08-07 13:07:28 +0200 | [diff] [blame] | 7 | * Copyright The Mbed TLS Contributors |
Manuel Pégourié-Gonnard | 37ff140 | 2015-09-04 14:21:07 +0200 | [diff] [blame] | 8 | * SPDX-License-Identifier: Apache-2.0 |
| 9 | * |
| 10 | * Licensed under the Apache License, Version 2.0 (the "License"); you may |
| 11 | * not use this file except in compliance with the License. |
| 12 | * You may obtain a copy of the License at |
| 13 | * |
| 14 | * http://www.apache.org/licenses/LICENSE-2.0 |
| 15 | * |
| 16 | * Unless required by applicable law or agreed to in writing, software |
| 17 | * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT |
| 18 | * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 19 | * See the License for the specific language governing permissions and |
| 20 | * limitations under the License. |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 21 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 22 | #ifndef MBEDTLS_X509_CRL_H |
| 23 | #define MBEDTLS_X509_CRL_H |
Mateusz Starzyk | 846f021 | 2021-05-19 19:44:07 +0200 | [diff] [blame] | 24 | #include "mbedtls/private_access.h" |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 25 | |
Bence Szépkúti | c662b36 | 2021-05-27 11:25:03 +0200 | [diff] [blame] | 26 | #include "mbedtls/build_info.h" |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 27 | |
Jaeden Amero | 6609aef | 2019-07-04 20:01:14 +0100 | [diff] [blame] | 28 | #include "mbedtls/x509.h" |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 29 | |
| 30 | #ifdef __cplusplus |
| 31 | extern "C" { |
| 32 | #endif |
| 33 | |
| 34 | /** |
| 35 | * \addtogroup x509_module |
| 36 | * \{ */ |
| 37 | |
| 38 | /** |
| 39 | * \name Structures and functions for parsing CRLs |
| 40 | * \{ |
| 41 | */ |
| 42 | |
| 43 | /** |
| 44 | * Certificate revocation list entry. |
| 45 | * Contains the CA-specific serial numbers and revocation dates. |
Gilles Peskine | 842edf4 | 2021-08-04 21:56:10 +0200 | [diff] [blame] | 46 | * |
| 47 | * Some fields of this structure are publicly readable. Do not modify |
| 48 | * them except via Mbed TLS library functions: the effect of modifying |
| 49 | * those fields or the data that those fields points to is unspecified. |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 50 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 51 | typedef struct mbedtls_x509_crl_entry |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 52 | { |
Gilles Peskine | 842edf4 | 2021-08-04 21:56:10 +0200 | [diff] [blame] | 53 | /** Direct access to the whole entry inside the containing buffer. */ |
| 54 | mbedtls_x509_buf raw; |
| 55 | /** The serial number of the revoked certificate. */ |
| 56 | mbedtls_x509_buf serial; |
| 57 | /** The revocation date of this entry. */ |
| 58 | mbedtls_x509_time revocation_date; |
| 59 | /** Direct access to the list of CRL entry extensions |
| 60 | * (an ASN.1 constructed sequence). |
| 61 | * |
| 62 | * If there are no extensions, `entry_ext.len == 0` and |
| 63 | * `entry_ext.p == NULL`. */ |
| 64 | mbedtls_x509_buf entry_ext; |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 65 | |
Gilles Peskine | ca93995 | 2021-08-31 23:18:07 +0200 | [diff] [blame] | 66 | /** Next element in the linked list of entries. |
| 67 | * \p NULL indicates the end of the list. |
| 68 | * Do not modify this field directly. */ |
| 69 | struct mbedtls_x509_crl_entry *next; |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 70 | } |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 71 | mbedtls_x509_crl_entry; |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 72 | |
| 73 | /** |
| 74 | * Certificate revocation list structure. |
| 75 | * Every CRL may have multiple entries. |
| 76 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 77 | typedef struct mbedtls_x509_crl |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 78 | { |
Gilles Peskine | 842edf4 | 2021-08-04 21:56:10 +0200 | [diff] [blame] | 79 | mbedtls_x509_buf raw; /**< The raw certificate data (DER). */ |
| 80 | mbedtls_x509_buf tbs; /**< The raw certificate body (DER). The part that is To Be Signed. */ |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 81 | |
Gilles Peskine | 842edf4 | 2021-08-04 21:56:10 +0200 | [diff] [blame] | 82 | int version; /**< CRL version (1=v1, 2=v2) */ |
| 83 | mbedtls_x509_buf sig_oid; /**< CRL signature type identifier */ |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 84 | |
Gilles Peskine | 842edf4 | 2021-08-04 21:56:10 +0200 | [diff] [blame] | 85 | mbedtls_x509_buf issuer_raw; /**< The raw issuer data (DER). */ |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 86 | |
Gilles Peskine | 842edf4 | 2021-08-04 21:56:10 +0200 | [diff] [blame] | 87 | mbedtls_x509_name issuer; /**< The parsed issuer data (named information object). */ |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 88 | |
Gilles Peskine | 842edf4 | 2021-08-04 21:56:10 +0200 | [diff] [blame] | 89 | mbedtls_x509_time this_update; |
| 90 | mbedtls_x509_time next_update; |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 91 | |
Gilles Peskine | 842edf4 | 2021-08-04 21:56:10 +0200 | [diff] [blame] | 92 | mbedtls_x509_crl_entry entry; /**< The CRL entries containing the certificate revocation times for this CA. */ |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 93 | |
Gilles Peskine | 842edf4 | 2021-08-04 21:56:10 +0200 | [diff] [blame] | 94 | mbedtls_x509_buf crl_ext; |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 95 | |
Mateusz Starzyk | 846f021 | 2021-05-19 19:44:07 +0200 | [diff] [blame] | 96 | mbedtls_x509_buf MBEDTLS_PRIVATE(sig_oid2); |
| 97 | mbedtls_x509_buf MBEDTLS_PRIVATE(sig); |
| 98 | mbedtls_md_type_t MBEDTLS_PRIVATE(sig_md); /**< Internal representation of the MD algorithm of the signature algorithm, e.g. MBEDTLS_MD_SHA256 */ |
| 99 | mbedtls_pk_type_t MBEDTLS_PRIVATE(sig_pk); /**< Internal representation of the Public Key algorithm of the signature algorithm, e.g. MBEDTLS_PK_RSA */ |
| 100 | void *MBEDTLS_PRIVATE(sig_opts); /**< Signature options to be passed to mbedtls_pk_verify_ext(), e.g. for RSASSA-PSS */ |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 101 | |
Gilles Peskine | ca93995 | 2021-08-31 23:18:07 +0200 | [diff] [blame] | 102 | /** Next element in the linked list of CRL. |
| 103 | * \p NULL indicates the end of the list. |
| 104 | * Do not modify this field directly. */ |
| 105 | struct mbedtls_x509_crl *next; |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 106 | } |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 107 | mbedtls_x509_crl; |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 108 | |
| 109 | /** |
Manuel Pégourié-Gonnard | 426d4ae | 2014-11-19 16:58:28 +0100 | [diff] [blame] | 110 | * \brief Parse a DER-encoded CRL and append it to the chained list |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 111 | * |
| 112 | * \param chain points to the start of the chain |
Manuel Pégourié-Gonnard | 426d4ae | 2014-11-19 16:58:28 +0100 | [diff] [blame] | 113 | * \param buf buffer holding the CRL data in DER format |
Simon Butcher | 5b331b9 | 2016-01-03 16:14:14 +0000 | [diff] [blame] | 114 | * \param buflen size of the buffer |
Manuel Pégourié-Gonnard | ddbb166 | 2016-01-04 12:40:15 +0100 | [diff] [blame] | 115 | * (including the terminating null byte for PEM data) |
Manuel Pégourié-Gonnard | 426d4ae | 2014-11-19 16:58:28 +0100 | [diff] [blame] | 116 | * |
| 117 | * \return 0 if successful, or a specific X509 or PEM error code |
| 118 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 119 | int mbedtls_x509_crl_parse_der( mbedtls_x509_crl *chain, |
Manuel Pégourié-Gonnard | 426d4ae | 2014-11-19 16:58:28 +0100 | [diff] [blame] | 120 | const unsigned char *buf, size_t buflen ); |
| 121 | /** |
| 122 | * \brief Parse one or more CRLs and append them to the chained list |
| 123 | * |
Antonin Décimo | 36e89b5 | 2019-01-23 15:24:37 +0100 | [diff] [blame] | 124 | * \note Multiple CRLs are accepted only if using PEM format |
Manuel Pégourié-Gonnard | 426d4ae | 2014-11-19 16:58:28 +0100 | [diff] [blame] | 125 | * |
| 126 | * \param chain points to the start of the chain |
| 127 | * \param buf buffer holding the CRL data in PEM or DER format |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 128 | * \param buflen size of the buffer |
Manuel Pégourié-Gonnard | 43b37cb | 2015-05-12 11:20:10 +0200 | [diff] [blame] | 129 | * (including the terminating null byte for PEM data) |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 130 | * |
| 131 | * \return 0 if successful, or a specific X509 or PEM error code |
| 132 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 133 | int mbedtls_x509_crl_parse( mbedtls_x509_crl *chain, const unsigned char *buf, size_t buflen ); |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 134 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 135 | #if defined(MBEDTLS_FS_IO) |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 136 | /** |
Manuel Pégourié-Gonnard | 426d4ae | 2014-11-19 16:58:28 +0100 | [diff] [blame] | 137 | * \brief Load one or more CRLs and append them to the chained list |
| 138 | * |
Antonin Décimo | 36e89b5 | 2019-01-23 15:24:37 +0100 | [diff] [blame] | 139 | * \note Multiple CRLs are accepted only if using PEM format |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 140 | * |
| 141 | * \param chain points to the start of the chain |
Manuel Pégourié-Gonnard | 426d4ae | 2014-11-19 16:58:28 +0100 | [diff] [blame] | 142 | * \param path filename to read the CRLs from (in PEM or DER encoding) |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 143 | * |
| 144 | * \return 0 if successful, or a specific X509 or PEM error code |
| 145 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 146 | int mbedtls_x509_crl_parse_file( mbedtls_x509_crl *chain, const char *path ); |
| 147 | #endif /* MBEDTLS_FS_IO */ |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 148 | |
Hanno Becker | 612a2f1 | 2020-10-09 09:19:39 +0100 | [diff] [blame] | 149 | #if !defined(MBEDTLS_X509_REMOVE_INFO) |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 150 | /** |
Paul Bakker | ddf26b4 | 2013-09-18 13:46:23 +0200 | [diff] [blame] | 151 | * \brief Returns an informational string about the CRL. |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 152 | * |
| 153 | * \param buf Buffer to write to |
| 154 | * \param size Maximum size of buffer |
| 155 | * \param prefix A line prefix |
| 156 | * \param crl The X509 CRL to represent |
| 157 | * |
Manuel Pégourié-Gonnard | e244f9f | 2015-06-23 12:10:45 +0200 | [diff] [blame] | 158 | * \return The length of the string written (not including the |
| 159 | * terminated nul byte), or a negative error code. |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 160 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 161 | int mbedtls_x509_crl_info( char *buf, size_t size, const char *prefix, |
| 162 | const mbedtls_x509_crl *crl ); |
Hanno Becker | 88c2bf3 | 2019-06-14 17:21:24 +0100 | [diff] [blame] | 163 | #endif /* !MBEDTLS_X509_REMOVE_INFO */ |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 164 | |
| 165 | /** |
Paul Bakker | 369d2eb | 2013-09-18 11:58:25 +0200 | [diff] [blame] | 166 | * \brief Initialize a CRL (chain) |
| 167 | * |
| 168 | * \param crl CRL chain to initialize |
| 169 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 170 | void mbedtls_x509_crl_init( mbedtls_x509_crl *crl ); |
Paul Bakker | 369d2eb | 2013-09-18 11:58:25 +0200 | [diff] [blame] | 171 | |
| 172 | /** |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 173 | * \brief Unallocate all CRL data |
| 174 | * |
| 175 | * \param crl CRL chain to free |
| 176 | */ |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 177 | void mbedtls_x509_crl_free( mbedtls_x509_crl *crl ); |
Paul Bakker | 7c6b2c3 | 2013-09-16 13:49:26 +0200 | [diff] [blame] | 178 | |
| 179 | /* \} name */ |
| 180 | /* \} addtogroup x509_module */ |
| 181 | |
| 182 | #ifdef __cplusplus |
| 183 | } |
| 184 | #endif |
| 185 | |
Manuel Pégourié-Gonnard | 2cf5a7c | 2015-04-08 12:49:31 +0200 | [diff] [blame] | 186 | #endif /* mbedtls_x509_crl.h */ |