x509_crl.h 5.2 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172173
  1. /**
  2. * \file x509_crl.h
  3. *
  4. * \brief X.509 certificate revocation list parsing
  5. *
  6. * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
  7. * SPDX-License-Identifier: Apache-2.0
  8. *
  9. * Licensed under the Apache License, Version 2.0 (the "License"); you may
  10. * not use this file except in compliance with the License.
  11. * You may obtain a copy of the License at
  12. *
  13. * http://www.apache.org/licenses/LICENSE-2.0
  14. *
  15. * Unless required by applicable law or agreed to in writing, software
  16. * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
  17. * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
  18. * See the License for the specific language governing permissions and
  19. * limitations under the License.
  20. *
  21. * This file is part of mbed TLS (https://tls.mbed.org)
  22. */
  23. #ifndef MBEDTLS_X509_CRL_H
  24. #define MBEDTLS_X509_CRL_H
  25. #if !defined(MBEDTLS_CONFIG_FILE)
  26. #include "config.h"
  27. #else
  28. #include MBEDTLS_CONFIG_FILE
  29. #endif
  30. #include "x509.h"
  31. #ifdef __cplusplus
  32. extern "C" {
  33. #endif
  34. /**
  35. * \addtogroup x509_module
  36. * \{ */
  37. /**
  38. * \name Structures and functions for parsing CRLs
  39. * \{
  40. */
  41. /**
  42. * Certificate revocation list entry.
  43. * Contains the CA-specific serial numbers and revocation dates.
  44. */
  45. typedef struct mbedtls_x509_crl_entry
  46. {
  47. mbedtls_x509_buf raw;
  48. mbedtls_x509_buf serial;
  49. mbedtls_x509_time revocation_date;
  50. mbedtls_x509_buf entry_ext;
  51. struct mbedtls_x509_crl_entry *next;
  52. }
  53. mbedtls_x509_crl_entry;
  54. /**
  55. * Certificate revocation list structure.
  56. * Every CRL may have multiple entries.
  57. */
  58. typedef struct mbedtls_x509_crl
  59. {
  60. mbedtls_x509_buf raw; /**< The raw certificate data (DER). */
  61. mbedtls_x509_buf tbs; /**< The raw certificate body (DER). The part that is To Be Signed. */
  62. int version; /**< CRL version (1=v1, 2=v2) */
  63. mbedtls_x509_buf sig_oid; /**< CRL signature type identifier */
  64. mbedtls_x509_buf issuer_raw; /**< The raw issuer data (DER). */
  65. mbedtls_x509_name issuer; /**< The parsed issuer data (named information object). */
  66. mbedtls_x509_time this_update;
  67. mbedtls_x509_time next_update;
  68. mbedtls_x509_crl_entry entry; /**< The CRL entries containing the certificate revocation times for this CA. */
  69. mbedtls_x509_buf crl_ext;
  70. mbedtls_x509_buf sig_oid2;
  71. mbedtls_x509_buf sig;
  72. mbedtls_md_type_t sig_md; /**< Internal representation of the MD algorithm of the signature algorithm, e.g. MBEDTLS_MD_SHA256 */
  73. mbedtls_pk_type_t sig_pk; /**< Internal representation of the Public Key algorithm of the signature algorithm, e.g. MBEDTLS_PK_RSA */
  74. void *sig_opts; /**< Signature options to be passed to mbedtls_pk_verify_ext(), e.g. for RSASSA-PSS */
  75. struct mbedtls_x509_crl *next;
  76. }
  77. mbedtls_x509_crl;
  78. /**
  79. * \brief Parse a DER-encoded CRL and append it to the chained list
  80. *
  81. * \param chain points to the start of the chain
  82. * \param buf buffer holding the CRL data in DER format
  83. * \param buflen size of the buffer
  84. * (including the terminating null byte for PEM data)
  85. *
  86. * \return 0 if successful, or a specific X509 or PEM error code
  87. */
  88. int mbedtls_x509_crl_parse_der( mbedtls_x509_crl *chain,
  89. const unsigned char *buf, size_t buflen );
  90. /**
  91. * \brief Parse one or more CRLs and append them to the chained list
  92. *
  93. * \note Mutliple CRLs are accepted only if using PEM format
  94. *
  95. * \param chain points to the start of the chain
  96. * \param buf buffer holding the CRL data in PEM or DER format
  97. * \param buflen size of the buffer
  98. * (including the terminating null byte for PEM data)
  99. *
  100. * \return 0 if successful, or a specific X509 or PEM error code
  101. */
  102. int mbedtls_x509_crl_parse( mbedtls_x509_crl *chain, const unsigned char *buf, size_t buflen );
  103. #if defined(MBEDTLS_FS_IO)
  104. /**
  105. * \brief Load one or more CRLs and append them to the chained list
  106. *
  107. * \note Mutliple CRLs are accepted only if using PEM format
  108. *
  109. * \param chain points to the start of the chain
  110. * \param path filename to read the CRLs from (in PEM or DER encoding)
  111. *
  112. * \return 0 if successful, or a specific X509 or PEM error code
  113. */
  114. int mbedtls_x509_crl_parse_file( mbedtls_x509_crl *chain, const char *path );
  115. #endif /* MBEDTLS_FS_IO */
  116. /**
  117. * \brief Returns an informational string about the CRL.
  118. *
  119. * \param buf Buffer to write to
  120. * \param size Maximum size of buffer
  121. * \param prefix A line prefix
  122. * \param crl The X509 CRL to represent
  123. *
  124. * \return The length of the string written (not including the
  125. * terminated nul byte), or a negative error code.
  126. */
  127. int mbedtls_x509_crl_info( char *buf, size_t size, const char *prefix,
  128. const mbedtls_x509_crl *crl );
  129. /**
  130. * \brief Initialize a CRL (chain)
  131. *
  132. * \param crl CRL chain to initialize
  133. */
  134. void mbedtls_x509_crl_init( mbedtls_x509_crl *crl );
  135. /**
  136. * \brief Unallocate all CRL data
  137. *
  138. * \param crl CRL chain to free
  139. */
  140. void mbedtls_x509_crl_free( mbedtls_x509_crl *crl );
  141. /* \} name */
  142. /* \} addtogroup x509_module */
  143. #ifdef __cplusplus
  144. }
  145. #endif
  146. #endif /* mbedtls_x509_crl.h */