1 /** 2 * \file x509_crl.h 3 * 4 * \brief X.509 certificate revocation list parsing 5 * 6 * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved 7 * SPDX-License-Identifier: GPL-2.0 8 * 9 * This program is free software; you can redistribute it and/or modify 10 * it under the terms of the GNU General Public License as published by 11 * the Free Software Foundation; either version 2 of the License, or 12 * (at your option) any later version. 13 * 14 * This program is distributed in the hope that it will be useful, 15 * but WITHOUT ANY WARRANTY; without even the implied warranty of 16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 17 * GNU General Public License for more details. 18 * 19 * You should have received a copy of the GNU General Public License along 20 * with this program; if not, write to the Free Software Foundation, Inc., 21 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA. 22 * 23 * This file is part of mbed TLS (https://tls.mbed.org) 24 */ 25 #ifndef MBEDTLS_X509_CRL_H 26 #define MBEDTLS_X509_CRL_H 27 28 #if !defined(MBEDTLS_CONFIG_FILE) 29 #include "config.h" 30 #else 31 #include MBEDTLS_CONFIG_FILE 32 #endif 33 34 #include "x509.h" 35 36 #ifdef __cplusplus 37 extern "C" { 38 #endif 39 40 /** 41 * \addtogroup x509_module 42 * \{ */ 43 44 /** 45 * \name Structures and functions for parsing CRLs 46 * \{ 47 */ 48 49 /** 50 * Certificate revocation list entry. 51 * Contains the CA-specific serial numbers and revocation dates. 52 */ 53 typedef struct mbedtls_x509_crl_entry 54 { 55 mbedtls_x509_buf raw; 56 57 mbedtls_x509_buf serial; 58 59 mbedtls_x509_time revocation_date; 60 61 mbedtls_x509_buf entry_ext; 62 63 struct mbedtls_x509_crl_entry *next; 64 } 65 mbedtls_x509_crl_entry; 66 67 /** 68 * Certificate revocation list structure. 69 * Every CRL may have multiple entries. 70 */ 71 typedef struct mbedtls_x509_crl 72 { 73 mbedtls_x509_buf raw; /**< The raw certificate data (DER). */ 74 mbedtls_x509_buf tbs; /**< The raw certificate body (DER). The part that is To Be Signed. */ 75 76 int version; /**< CRL version (1=v1, 2=v2) */ 77 mbedtls_x509_buf sig_oid; /**< CRL signature type identifier */ 78 79 mbedtls_x509_buf issuer_raw; /**< The raw issuer data (DER). */ 80 81 mbedtls_x509_name issuer; /**< The parsed issuer data (named information object). */ 82 83 mbedtls_x509_time this_update; 84 mbedtls_x509_time next_update; 85 86 mbedtls_x509_crl_entry entry; /**< The CRL entries containing the certificate revocation times for this CA. */ 87 88 mbedtls_x509_buf crl_ext; 89 90 mbedtls_x509_buf sig_oid2; 91 mbedtls_x509_buf sig; 92 mbedtls_md_type_t sig_md; /**< Internal representation of the MD algorithm of the signature algorithm, e.g. MBEDTLS_MD_SHA256 */ 93 mbedtls_pk_type_t sig_pk; /**< Internal representation of the Public Key algorithm of the signature algorithm, e.g. MBEDTLS_PK_RSA */ 94 void *sig_opts; /**< Signature options to be passed to mbedtls_pk_verify_ext(), e.g. for RSASSA-PSS */ 95 96 struct mbedtls_x509_crl *next; 97 } 98 mbedtls_x509_crl; 99 100 /** 101 * \brief Parse a DER-encoded CRL and append it to the chained list 102 * 103 * \param chain points to the start of the chain 104 * \param buf buffer holding the CRL data in DER format 105 * \param buflen size of the buffer 106 * (including the terminating null byte for PEM data) 107 * 108 * \return 0 if successful, or a specific X509 or PEM error code 109 */ 110 int mbedtls_x509_crl_parse_der( mbedtls_x509_crl *chain, 111 const unsigned char *buf, size_t buflen ); 112 /** 113 * \brief Parse one or more CRLs and append them to the chained list 114 * 115 * \note Mutliple CRLs are accepted only if using PEM format 116 * 117 * \param chain points to the start of the chain 118 * \param buf buffer holding the CRL data in PEM or DER format 119 * \param buflen size of the buffer 120 * (including the terminating null byte for PEM data) 121 * 122 * \return 0 if successful, or a specific X509 or PEM error code 123 */ 124 int mbedtls_x509_crl_parse( mbedtls_x509_crl *chain, const unsigned char *buf, size_t buflen ); 125 126 #if defined(MBEDTLS_FS_IO) 127 /** 128 * \brief Load one or more CRLs and append them to the chained list 129 * 130 * \note Mutliple CRLs are accepted only if using PEM format 131 * 132 * \param chain points to the start of the chain 133 * \param path filename to read the CRLs from (in PEM or DER encoding) 134 * 135 * \return 0 if successful, or a specific X509 or PEM error code 136 */ 137 int mbedtls_x509_crl_parse_file( mbedtls_x509_crl *chain, const char *path ); 138 #endif /* MBEDTLS_FS_IO */ 139 140 /** 141 * \brief Returns an informational string about the CRL. 142 * 143 * \param buf Buffer to write to 144 * \param size Maximum size of buffer 145 * \param prefix A line prefix 146 * \param crl The X509 CRL to represent 147 * 148 * \return The length of the string written (not including the 149 * terminated nul byte), or a negative error code. 150 */ 151 int mbedtls_x509_crl_info( char *buf, size_t size, const char *prefix, 152 const mbedtls_x509_crl *crl ); 153 154 /** 155 * \brief Initialize a CRL (chain) 156 * 157 * \param crl CRL chain to initialize 158 */ 159 void mbedtls_x509_crl_init( mbedtls_x509_crl *crl ); 160 161 /** 162 * \brief Unallocate all CRL data 163 * 164 * \param crl CRL chain to free 165 */ 166 void mbedtls_x509_crl_free( mbedtls_x509_crl *crl ); 167 168 /* \} name */ 169 /* \} addtogroup x509_module */ 170 171 #ifdef __cplusplus 172 } 173 #endif 174 175 #endif /* mbedtls_x509_crl.h */ 176