1 /* $OpenBSD: x_crl.c,v 1.42 2024/01/06 17:37:23 tb Exp $ */ 2 /* Copyright (C) 1995-1998 Eric Young (eay@cryptsoft.com) 3 * All rights reserved. 4 * 5 * This package is an SSL implementation written 6 * by Eric Young (eay@cryptsoft.com). 7 * The implementation was written so as to conform with Netscapes SSL. 8 * 9 * This library is free for commercial and non-commercial use as long as 10 * the following conditions are aheared to. The following conditions 11 * apply to all code found in this distribution, be it the RC4, RSA, 12 * lhash, DES, etc., code; not just the SSL code. The SSL documentation 13 * included with this distribution is covered by the same copyright terms 14 * except that the holder is Tim Hudson (tjh@cryptsoft.com). 15 * 16 * Copyright remains Eric Young's, and as such any Copyright notices in 17 * the code are not to be removed. 18 * If this package is used in a product, Eric Young should be given attribution 19 * as the author of the parts of the library used. 20 * This can be in the form of a textual message at program startup or 21 * in documentation (online or textual) provided with the package. 22 * 23 * Redistribution and use in source and binary forms, with or without 24 * modification, are permitted provided that the following conditions 25 * are met: 26 * 1. Redistributions of source code must retain the copyright 27 * notice, this list of conditions and the following disclaimer. 28 * 2. Redistributions in binary form must reproduce the above copyright 29 * notice, this list of conditions and the following disclaimer in the 30 * documentation and/or other materials provided with the distribution. 31 * 3. All advertising materials mentioning features or use of this software 32 * must display the following acknowledgement: 33 * "This product includes cryptographic software written by 34 * Eric Young (eay@cryptsoft.com)" 35 * The word 'cryptographic' can be left out if the rouines from the library 36 * being used are not cryptographic related :-). 37 * 4. If you include any Windows specific code (or a derivative thereof) from 38 * the apps directory (application code) you must include an acknowledgement: 39 * "This product includes software written by Tim Hudson (tjh@cryptsoft.com)" 40 * 41 * THIS SOFTWARE IS PROVIDED BY ERIC YOUNG ``AS IS'' AND 42 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 43 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 44 * ARE DISCLAIMED. IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE 45 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 46 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 47 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 48 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 49 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 50 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 51 * SUCH DAMAGE. 52 * 53 * The licence and distribution terms for any publically available version or 54 * derivative of this code cannot be changed. i.e. this code cannot simply be 55 * copied and put under another distribution licence 56 * [including the GNU Public Licence.] 57 */ 58 59 #include <stdio.h> 60 61 #include <openssl/opensslconf.h> 62 63 #include <openssl/asn1t.h> 64 #include <openssl/err.h> 65 #include <openssl/x509.h> 66 #include <openssl/x509v3.h> 67 68 #include "asn1_local.h" 69 #include "x509_local.h" 70 71 static int X509_REVOKED_cmp(const X509_REVOKED * const *a, 72 const X509_REVOKED * const *b); 73 static void setup_idp(X509_CRL *crl, ISSUING_DIST_POINT *idp); 74 75 static const ASN1_TEMPLATE X509_REVOKED_seq_tt[] = { 76 { 77 .offset = offsetof(X509_REVOKED, serialNumber), 78 .field_name = "serialNumber", 79 .item = &ASN1_INTEGER_it, 80 }, 81 { 82 .offset = offsetof(X509_REVOKED, revocationDate), 83 .field_name = "revocationDate", 84 .item = &ASN1_TIME_it, 85 }, 86 { 87 .flags = ASN1_TFLG_SEQUENCE_OF | ASN1_TFLG_OPTIONAL, 88 .offset = offsetof(X509_REVOKED, extensions), 89 .field_name = "extensions", 90 .item = &X509_EXTENSION_it, 91 }, 92 }; 93 94 const ASN1_ITEM X509_REVOKED_it = { 95 .itype = ASN1_ITYPE_SEQUENCE, 96 .utype = V_ASN1_SEQUENCE, 97 .templates = X509_REVOKED_seq_tt, 98 .tcount = sizeof(X509_REVOKED_seq_tt) / sizeof(ASN1_TEMPLATE), 99 .size = sizeof(X509_REVOKED), 100 .sname = "X509_REVOKED", 101 }; 102 103 /* The X509_CRL_INFO structure needs a bit of customisation. 104 * Since we cache the original encoding the signature wont be affected by 105 * reordering of the revoked field. 106 */ 107 static int 108 crl_inf_cb(int operation, ASN1_VALUE **pval, const ASN1_ITEM *it, void *exarg) 109 { 110 X509_CRL_INFO *a = (X509_CRL_INFO *)*pval; 111 112 if (!a || !a->revoked) 113 return 1; 114 switch (operation) { 115 /* Just set cmp function here. We don't sort because that 116 * would affect the output of X509_CRL_print(). 117 */ 118 case ASN1_OP_D2I_POST: 119 (void)sk_X509_REVOKED_set_cmp_func(a->revoked, X509_REVOKED_cmp); 120 break; 121 } 122 return 1; 123 } 124 125 126 static const ASN1_AUX X509_CRL_INFO_aux = { 127 .flags = ASN1_AFLG_ENCODING, 128 .asn1_cb = crl_inf_cb, 129 .enc_offset = offsetof(X509_CRL_INFO, enc), 130 }; 131 static const ASN1_TEMPLATE X509_CRL_INFO_seq_tt[] = { 132 { 133 .flags = ASN1_TFLG_OPTIONAL, 134 .offset = offsetof(X509_CRL_INFO, version), 135 .field_name = "version", 136 .item = &ASN1_INTEGER_it, 137 }, 138 { 139 .offset = offsetof(X509_CRL_INFO, sig_alg), 140 .field_name = "sig_alg", 141 .item = &X509_ALGOR_it, 142 }, 143 { 144 .offset = offsetof(X509_CRL_INFO, issuer), 145 .field_name = "issuer", 146 .item = &X509_NAME_it, 147 }, 148 { 149 .offset = offsetof(X509_CRL_INFO, lastUpdate), 150 .field_name = "lastUpdate", 151 .item = &ASN1_TIME_it, 152 }, 153 { 154 .flags = ASN1_TFLG_OPTIONAL, 155 .offset = offsetof(X509_CRL_INFO, nextUpdate), 156 .field_name = "nextUpdate", 157 .item = &ASN1_TIME_it, 158 }, 159 { 160 .flags = ASN1_TFLG_SEQUENCE_OF | ASN1_TFLG_OPTIONAL, 161 .offset = offsetof(X509_CRL_INFO, revoked), 162 .field_name = "revoked", 163 .item = &X509_REVOKED_it, 164 }, 165 { 166 .flags = ASN1_TFLG_EXPLICIT | ASN1_TFLG_SEQUENCE_OF | ASN1_TFLG_OPTIONAL, 167 .offset = offsetof(X509_CRL_INFO, extensions), 168 .field_name = "extensions", 169 .item = &X509_EXTENSION_it, 170 }, 171 }; 172 173 const ASN1_ITEM X509_CRL_INFO_it = { 174 .itype = ASN1_ITYPE_SEQUENCE, 175 .utype = V_ASN1_SEQUENCE, 176 .templates = X509_CRL_INFO_seq_tt, 177 .tcount = sizeof(X509_CRL_INFO_seq_tt) / sizeof(ASN1_TEMPLATE), 178 .funcs = &X509_CRL_INFO_aux, 179 .size = sizeof(X509_CRL_INFO), 180 .sname = "X509_CRL_INFO", 181 }; 182 183 /* Set CRL entry issuer according to CRL certificate issuer extension. 184 * Check for unhandled critical CRL entry extensions. 185 */ 186 187 static int 188 crl_set_issuers(X509_CRL *crl) 189 { 190 int i, j; 191 GENERAL_NAMES *gens, *gtmp; 192 STACK_OF(X509_REVOKED) *revoked; 193 194 revoked = X509_CRL_get_REVOKED(crl); 195 196 gens = NULL; 197 for (i = 0; i < sk_X509_REVOKED_num(revoked); i++) { 198 X509_REVOKED *rev = sk_X509_REVOKED_value(revoked, i); 199 STACK_OF(X509_EXTENSION) *exts; 200 ASN1_ENUMERATED *reason; 201 X509_EXTENSION *ext; 202 gtmp = X509_REVOKED_get_ext_d2i(rev, NID_certificate_issuer, 203 &j, NULL); 204 if (!gtmp && (j != -1)) { 205 crl->flags |= EXFLAG_INVALID; 206 return 1; 207 } 208 209 if (gtmp) { 210 gens = gtmp; 211 if (!crl->issuers) { 212 crl->issuers = sk_GENERAL_NAMES_new_null(); 213 if (!crl->issuers) 214 return 0; 215 } 216 if (!sk_GENERAL_NAMES_push(crl->issuers, gtmp)) 217 return 0; 218 } 219 rev->issuer = gens; 220 221 reason = X509_REVOKED_get_ext_d2i(rev, NID_crl_reason, 222 &j, NULL); 223 if (!reason && (j != -1)) { 224 crl->flags |= EXFLAG_INVALID; 225 return 1; 226 } 227 228 if (reason) { 229 rev->reason = ASN1_ENUMERATED_get(reason); 230 ASN1_ENUMERATED_free(reason); 231 } else 232 rev->reason = CRL_REASON_NONE; 233 234 /* Check for critical CRL entry extensions */ 235 236 exts = rev->extensions; 237 238 for (j = 0; j < sk_X509_EXTENSION_num(exts); j++) { 239 ext = sk_X509_EXTENSION_value(exts, j); 240 if (ext->critical > 0) { 241 if (OBJ_obj2nid(ext->object) == 242 NID_certificate_issuer) 243 continue; 244 crl->flags |= EXFLAG_CRITICAL; 245 break; 246 } 247 } 248 } 249 250 return 1; 251 } 252 253 /* The X509_CRL structure needs a bit of customisation. Cache some extensions 254 * and hash of the whole CRL. 255 */ 256 static int 257 crl_cb(int operation, ASN1_VALUE **pval, const ASN1_ITEM *it, void *exarg) 258 { 259 X509_CRL *crl = (X509_CRL *)*pval; 260 STACK_OF(X509_EXTENSION) *exts; 261 X509_EXTENSION *ext; 262 int idx; 263 int rc = 1; 264 265 switch (operation) { 266 case ASN1_OP_NEW_POST: 267 crl->idp = NULL; 268 crl->akid = NULL; 269 crl->flags = 0; 270 crl->idp_flags = 0; 271 crl->idp_reasons = CRLDP_ALL_REASONS; 272 crl->issuers = NULL; 273 crl->crl_number = NULL; 274 crl->base_crl_number = NULL; 275 break; 276 277 case ASN1_OP_D2I_POST: 278 X509_CRL_digest(crl, X509_CRL_HASH_EVP, crl->hash, NULL); 279 crl->idp = X509_CRL_get_ext_d2i(crl, 280 NID_issuing_distribution_point, NULL, NULL); 281 if (crl->idp) 282 setup_idp(crl, crl->idp); 283 284 crl->akid = X509_CRL_get_ext_d2i(crl, 285 NID_authority_key_identifier, NULL, NULL); 286 287 crl->crl_number = X509_CRL_get_ext_d2i(crl, 288 NID_crl_number, NULL, NULL); 289 290 crl->base_crl_number = X509_CRL_get_ext_d2i(crl, 291 NID_delta_crl, NULL, NULL); 292 /* Delta CRLs must have CRL number */ 293 if (crl->base_crl_number && !crl->crl_number) 294 crl->flags |= EXFLAG_INVALID; 295 296 /* See if we have any unhandled critical CRL extensions and 297 * indicate this in a flag. We only currently handle IDP, 298 * AKID and deltas, so anything else critical sets the flag. 299 * 300 * This code accesses the X509_CRL structure directly: 301 * applications shouldn't do this. 302 */ 303 304 exts = crl->crl->extensions; 305 306 for (idx = 0; idx < sk_X509_EXTENSION_num(exts); idx++) { 307 int nid; 308 ext = sk_X509_EXTENSION_value(exts, idx); 309 nid = OBJ_obj2nid(ext->object); 310 if (nid == NID_freshest_crl) 311 crl->flags |= EXFLAG_FRESHEST; 312 if (ext->critical > 0) { 313 /* We handle IDP, AKID and deltas */ 314 if (nid == NID_issuing_distribution_point || 315 nid == NID_authority_key_identifier || 316 nid == NID_delta_crl) 317 break; 318 crl->flags |= EXFLAG_CRITICAL; 319 break; 320 } 321 } 322 323 if (!crl_set_issuers(crl)) 324 return 0; 325 break; 326 327 case ASN1_OP_FREE_POST: 328 if (crl->akid) 329 AUTHORITY_KEYID_free(crl->akid); 330 if (crl->idp) 331 ISSUING_DIST_POINT_free(crl->idp); 332 ASN1_INTEGER_free(crl->crl_number); 333 ASN1_INTEGER_free(crl->base_crl_number); 334 sk_GENERAL_NAMES_pop_free(crl->issuers, GENERAL_NAMES_free); 335 break; 336 } 337 return rc; 338 } 339 340 /* Convert IDP into a more convenient form */ 341 342 static void 343 setup_idp(X509_CRL *crl, ISSUING_DIST_POINT *idp) 344 { 345 int idp_only = 0; 346 347 /* Set various flags according to IDP */ 348 crl->idp_flags |= IDP_PRESENT; 349 if (idp->onlyuser > 0) { 350 idp_only++; 351 crl->idp_flags |= IDP_ONLYUSER; 352 } 353 if (idp->onlyCA > 0) { 354 idp_only++; 355 crl->idp_flags |= IDP_ONLYCA; 356 } 357 if (idp->onlyattr > 0) { 358 idp_only++; 359 crl->idp_flags |= IDP_ONLYATTR; 360 } 361 362 if (idp_only > 1) 363 crl->idp_flags |= IDP_INVALID; 364 365 if (idp->indirectCRL > 0) 366 crl->idp_flags |= IDP_INDIRECT; 367 368 if (idp->onlysomereasons) { 369 crl->idp_flags |= IDP_REASONS; 370 if (idp->onlysomereasons->length > 0) 371 crl->idp_reasons = idp->onlysomereasons->data[0]; 372 if (idp->onlysomereasons->length > 1) 373 crl->idp_reasons |= 374 (idp->onlysomereasons->data[1] << 8); 375 crl->idp_reasons &= CRLDP_ALL_REASONS; 376 } 377 378 DIST_POINT_set_dpname(idp->distpoint, X509_CRL_get_issuer(crl)); 379 } 380 381 static const ASN1_AUX X509_CRL_aux = { 382 .app_data = NULL, 383 .flags = ASN1_AFLG_REFCOUNT, 384 .ref_offset = offsetof(X509_CRL, references), 385 .ref_lock = CRYPTO_LOCK_X509_CRL, 386 .asn1_cb = crl_cb, 387 }; 388 static const ASN1_TEMPLATE X509_CRL_seq_tt[] = { 389 { 390 .offset = offsetof(X509_CRL, crl), 391 .field_name = "crl", 392 .item = &X509_CRL_INFO_it, 393 }, 394 { 395 .offset = offsetof(X509_CRL, sig_alg), 396 .field_name = "sig_alg", 397 .item = &X509_ALGOR_it, 398 }, 399 { 400 .offset = offsetof(X509_CRL, signature), 401 .field_name = "signature", 402 .item = &ASN1_BIT_STRING_it, 403 }, 404 }; 405 406 const ASN1_ITEM X509_CRL_it = { 407 .itype = ASN1_ITYPE_SEQUENCE, 408 .utype = V_ASN1_SEQUENCE, 409 .templates = X509_CRL_seq_tt, 410 .tcount = sizeof(X509_CRL_seq_tt) / sizeof(ASN1_TEMPLATE), 411 .funcs = &X509_CRL_aux, 412 .size = sizeof(X509_CRL), 413 .sname = "X509_CRL", 414 }; 415 416 417 X509_REVOKED * 418 d2i_X509_REVOKED(X509_REVOKED **a, const unsigned char **in, long len) 419 { 420 return (X509_REVOKED *)ASN1_item_d2i((ASN1_VALUE **)a, in, len, 421 &X509_REVOKED_it); 422 } 423 424 int 425 i2d_X509_REVOKED(X509_REVOKED *a, unsigned char **out) 426 { 427 return ASN1_item_i2d((ASN1_VALUE *)a, out, &X509_REVOKED_it); 428 } 429 430 X509_REVOKED * 431 X509_REVOKED_new(void) 432 { 433 return (X509_REVOKED *)ASN1_item_new(&X509_REVOKED_it); 434 } 435 436 void 437 X509_REVOKED_free(X509_REVOKED *a) 438 { 439 ASN1_item_free((ASN1_VALUE *)a, &X509_REVOKED_it); 440 } 441 442 X509_REVOKED * 443 X509_REVOKED_dup(X509_REVOKED *a) 444 { 445 return ASN1_item_dup(&X509_REVOKED_it, a); 446 } 447 448 X509_CRL_INFO * 449 d2i_X509_CRL_INFO(X509_CRL_INFO **a, const unsigned char **in, long len) 450 { 451 return (X509_CRL_INFO *)ASN1_item_d2i((ASN1_VALUE **)a, in, len, 452 &X509_CRL_INFO_it); 453 } 454 455 int 456 i2d_X509_CRL_INFO(X509_CRL_INFO *a, unsigned char **out) 457 { 458 return ASN1_item_i2d((ASN1_VALUE *)a, out, &X509_CRL_INFO_it); 459 } 460 461 X509_CRL_INFO * 462 X509_CRL_INFO_new(void) 463 { 464 return (X509_CRL_INFO *)ASN1_item_new(&X509_CRL_INFO_it); 465 } 466 467 void 468 X509_CRL_INFO_free(X509_CRL_INFO *a) 469 { 470 ASN1_item_free((ASN1_VALUE *)a, &X509_CRL_INFO_it); 471 } 472 473 X509_CRL * 474 d2i_X509_CRL(X509_CRL **a, const unsigned char **in, long len) 475 { 476 return (X509_CRL *)ASN1_item_d2i((ASN1_VALUE **)a, in, len, 477 &X509_CRL_it); 478 } 479 480 int 481 i2d_X509_CRL(X509_CRL *a, unsigned char **out) 482 { 483 return ASN1_item_i2d((ASN1_VALUE *)a, out, &X509_CRL_it); 484 } 485 486 X509_CRL * 487 X509_CRL_new(void) 488 { 489 return (X509_CRL *)ASN1_item_new(&X509_CRL_it); 490 } 491 492 void 493 X509_CRL_free(X509_CRL *a) 494 { 495 ASN1_item_free((ASN1_VALUE *)a, &X509_CRL_it); 496 } 497 498 X509_CRL * 499 X509_CRL_dup(X509_CRL *x) 500 { 501 return ASN1_item_dup(&X509_CRL_it, x); 502 } 503 504 static int 505 X509_REVOKED_cmp(const X509_REVOKED * const *a, const X509_REVOKED * const *b) 506 { 507 return(ASN1_INTEGER_cmp((*a)->serialNumber, (*b)->serialNumber)); 508 } 509 510 int 511 X509_CRL_add0_revoked(X509_CRL *crl, X509_REVOKED *rev) 512 { 513 X509_CRL_INFO *inf; 514 515 inf = crl->crl; 516 if (!inf->revoked) 517 inf->revoked = sk_X509_REVOKED_new(X509_REVOKED_cmp); 518 if (!inf->revoked || !sk_X509_REVOKED_push(inf->revoked, rev)) { 519 ASN1error(ERR_R_MALLOC_FAILURE); 520 return 0; 521 } 522 inf->enc.modified = 1; 523 return 1; 524 } 525 526 int 527 X509_CRL_verify(X509_CRL *crl, EVP_PKEY *pkey) 528 { 529 return ASN1_item_verify(&X509_CRL_INFO_it, crl->sig_alg, crl->signature, 530 crl->crl, pkey); 531 } 532 533 static int 534 crl_revoked_issuer_match(X509_CRL *crl, X509_NAME *nm, X509_REVOKED *rev) 535 { 536 int i; 537 538 if (!rev->issuer) { 539 if (!nm) 540 return 1; 541 if (!X509_NAME_cmp(nm, X509_CRL_get_issuer(crl))) 542 return 1; 543 return 0; 544 } 545 546 if (!nm) 547 nm = X509_CRL_get_issuer(crl); 548 549 for (i = 0; i < sk_GENERAL_NAME_num(rev->issuer); i++) { 550 GENERAL_NAME *gen = sk_GENERAL_NAME_value(rev->issuer, i); 551 if (gen->type != GEN_DIRNAME) 552 continue; 553 if (!X509_NAME_cmp(nm, gen->d.directoryName)) 554 return 1; 555 } 556 return 0; 557 558 } 559 560 static int 561 crl_lookup(X509_CRL *crl, X509_REVOKED **ret, ASN1_INTEGER *serial, 562 X509_NAME *issuer) 563 { 564 X509_REVOKED rtmp, *rev; 565 int idx; 566 567 rtmp.serialNumber = serial; 568 if (!sk_X509_REVOKED_is_sorted(crl->crl->revoked)) { 569 CRYPTO_w_lock(CRYPTO_LOCK_X509_CRL); 570 sk_X509_REVOKED_sort(crl->crl->revoked); 571 CRYPTO_w_unlock(CRYPTO_LOCK_X509_CRL); 572 } 573 idx = sk_X509_REVOKED_find(crl->crl->revoked, &rtmp); 574 if (idx < 0) 575 return 0; 576 /* Need to look for matching name */ 577 for (; idx < sk_X509_REVOKED_num(crl->crl->revoked); idx++) { 578 rev = sk_X509_REVOKED_value(crl->crl->revoked, idx); 579 if (ASN1_INTEGER_cmp(rev->serialNumber, serial)) 580 return 0; 581 if (crl_revoked_issuer_match(crl, issuer, rev)) { 582 if (ret) 583 *ret = rev; 584 if (rev->reason == CRL_REASON_REMOVE_FROM_CRL) 585 return 2; 586 return 1; 587 } 588 } 589 return 0; 590 } 591 592 int 593 X509_CRL_get0_by_serial(X509_CRL *crl, X509_REVOKED **ret, 594 ASN1_INTEGER *serial) 595 { 596 return crl_lookup(crl, ret, serial, NULL); 597 } 598 599 int 600 X509_CRL_get0_by_cert(X509_CRL *crl, X509_REVOKED **ret, X509 *x) 601 { 602 return crl_lookup(crl, ret, X509_get_serialNumber(x), 603 X509_get_issuer_name(x)); 604 } 605 606 void 607 X509_CRL_set_default_method(const X509_CRL_METHOD *meth) 608 { 609 } 610 611 X509_CRL_METHOD * 612 X509_CRL_METHOD_new(int (*crl_init)(X509_CRL *crl), 613 int (*crl_free)(X509_CRL *crl), 614 int (*crl_lookup)(X509_CRL *crl, X509_REVOKED **ret, 615 ASN1_INTEGER *ser, X509_NAME *issuer), 616 int (*crl_verify)(X509_CRL *crl, EVP_PKEY *pk)) 617 { 618 X509error(ERR_R_DISABLED); 619 return NULL; 620 } 621 622 void 623 X509_CRL_METHOD_free(X509_CRL_METHOD *m) 624 { 625 } 626 627 void 628 X509_CRL_set_meth_data(X509_CRL *crl, void *dat) 629 { 630 } 631 632 void * 633 X509_CRL_get_meth_data(X509_CRL *crl) 634 { 635 X509error(ERR_R_DISABLED); 636 return NULL; 637 } 638 639 int 640 X509_CRL_get_signature_nid(const X509_CRL *crl) 641 { 642 return OBJ_obj2nid(crl->sig_alg->algorithm); 643 } 644 645 const STACK_OF(X509_EXTENSION) * 646 X509_CRL_get0_extensions(const X509_CRL *crl) 647 { 648 return crl->crl->extensions; 649 } 650 651 long 652 X509_CRL_get_version(const X509_CRL *crl) 653 { 654 return ASN1_INTEGER_get(crl->crl->version); 655 } 656 657 const ASN1_TIME * 658 X509_CRL_get0_lastUpdate(const X509_CRL *crl) 659 { 660 return crl->crl->lastUpdate; 661 } 662 663 ASN1_TIME * 664 X509_CRL_get_lastUpdate(X509_CRL *crl) 665 { 666 return crl->crl->lastUpdate; 667 } 668 669 const ASN1_TIME * 670 X509_CRL_get0_nextUpdate(const X509_CRL *crl) 671 { 672 return crl->crl->nextUpdate; 673 } 674 675 ASN1_TIME * 676 X509_CRL_get_nextUpdate(X509_CRL *crl) 677 { 678 return crl->crl->nextUpdate; 679 } 680 681 X509_NAME * 682 X509_CRL_get_issuer(const X509_CRL *crl) 683 { 684 return crl->crl->issuer; 685 } 686 687 STACK_OF(X509_REVOKED) * 688 X509_CRL_get_REVOKED(X509_CRL *crl) 689 { 690 return crl->crl->revoked; 691 } 692 693 void 694 X509_CRL_get0_signature(const X509_CRL *crl, const ASN1_BIT_STRING **psig, 695 const X509_ALGOR **palg) 696 { 697 if (psig != NULL) 698 *psig = crl->signature; 699 if (palg != NULL) 700 *palg = crl->sig_alg; 701 } 702 703 const X509_ALGOR * 704 X509_CRL_get0_tbs_sigalg(const X509_CRL *crl) 705 { 706 return crl->crl->sig_alg; 707 } 708