1 /**
2  * \file x509_crl.h
3  *
4  * \brief X.509 certificate revocation list parsing
5  *
6  *  Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
7  *  SPDX-License-Identifier: Apache-2.0
8  *
9  *  Licensed under the Apache License, Version 2.0 (the "License"); you may
10  *  not use this file except in compliance with the License.
11  *  You may obtain a copy of the License at
12  *
13  *  http://www.apache.org/licenses/LICENSE-2.0
14  *
15  *  Unless required by applicable law or agreed to in writing, software
16  *  distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
17  *  WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
18  *  See the License for the specific language governing permissions and
19  *  limitations under the License.
20  *
21  *  This file is part of mbed TLS (https://tls.mbed.org)
22  */
23 #ifndef MBEDTLS_X509_CRL_H
24 #define MBEDTLS_X509_CRL_H
25 
26 #if !defined(MBEDTLS_CONFIG_FILE)
27 #include "config.h"
28 #else
29 #include MBEDTLS_CONFIG_FILE
30 #endif
31 
32 #include "x509.h"
33 
34 #ifdef __cplusplus
35 extern "C" {
36 #endif
37 
38 /**
39  * \addtogroup x509_module
40  * \{ */
41 
42 /**
43  * \name Structures and functions for parsing CRLs
44  * \{
45  */
46 
47 /**
48  * Certificate revocation list entry.
49  * Contains the CA-specific serial numbers and revocation dates.
50  */
51 typedef struct mbedtls_x509_crl_entry
52 {
53     mbedtls_x509_buf raw;
54 
55     mbedtls_x509_buf serial;
56 
57     mbedtls_x509_time revocation_date;
58 
59     mbedtls_x509_buf entry_ext;
60 
61     struct mbedtls_x509_crl_entry *next;
62 }
63 mbedtls_x509_crl_entry;
64 
65 /**
66  * Certificate revocation list structure.
67  * Every CRL may have multiple entries.
68  */
69 typedef struct mbedtls_x509_crl
70 {
71     mbedtls_x509_buf raw;           /**< The raw certificate data (DER). */
72     mbedtls_x509_buf tbs;           /**< The raw certificate body (DER). The part that is To Be Signed. */
73 
74     int version;            /**< CRL version (1=v1, 2=v2) */
75     mbedtls_x509_buf sig_oid;       /**< CRL signature type identifier */
76 
77     mbedtls_x509_buf issuer_raw;    /**< The raw issuer data (DER). */
78 
79     mbedtls_x509_name issuer;       /**< The parsed issuer data (named information object). */
80 
81     mbedtls_x509_time this_update;
82     mbedtls_x509_time next_update;
83 
84     mbedtls_x509_crl_entry entry;   /**< The CRL entries containing the certificate revocation times for this CA. */
85 
86     mbedtls_x509_buf crl_ext;
87 
88     mbedtls_x509_buf sig_oid2;
89     mbedtls_x509_buf sig;
90     mbedtls_md_type_t sig_md;           /**< Internal representation of the MD algorithm of the signature algorithm, e.g. MBEDTLS_MD_SHA256 */
91     mbedtls_pk_type_t sig_pk;           /**< Internal representation of the Public Key algorithm of the signature algorithm, e.g. MBEDTLS_PK_RSA */
92     void *sig_opts;             /**< Signature options to be passed to mbedtls_pk_verify_ext(), e.g. for RSASSA-PSS */
93 
94     struct mbedtls_x509_crl *next;
95 }
96 mbedtls_x509_crl;
97 
98 /**
99  * \brief          Parse a DER-encoded CRL and append it to the chained list
100  *
101  * \param chain    points to the start of the chain
102  * \param buf      buffer holding the CRL data in DER format
103  * \param buflen   size of the buffer
104  *                 (including the terminating null byte for PEM data)
105  *
106  * \return         0 if successful, or a specific X509 or PEM error code
107  */
108 int mbedtls_x509_crl_parse_der( mbedtls_x509_crl *chain,
109                         const unsigned char *buf, size_t buflen );
110 /**
111  * \brief          Parse one or more CRLs and append them to the chained list
112  *
113  * \note           Mutliple CRLs are accepted only if using PEM format
114  *
115  * \param chain    points to the start of the chain
116  * \param buf      buffer holding the CRL data in PEM or DER format
117  * \param buflen   size of the buffer
118  *                 (including the terminating null byte for PEM data)
119  *
120  * \return         0 if successful, or a specific X509 or PEM error code
121  */
122 int mbedtls_x509_crl_parse( mbedtls_x509_crl *chain, const unsigned char *buf, size_t buflen );
123 
124 #if defined(MBEDTLS_FS_IO)
125 /**
126  * \brief          Load one or more CRLs and append them to the chained list
127  *
128  * \note           Mutliple CRLs are accepted only if using PEM format
129  *
130  * \param chain    points to the start of the chain
131  * \param path     filename to read the CRLs from (in PEM or DER encoding)
132  *
133  * \return         0 if successful, or a specific X509 or PEM error code
134  */
135 int mbedtls_x509_crl_parse_file( mbedtls_x509_crl *chain, const char *path );
136 #endif /* MBEDTLS_FS_IO */
137 
138 /**
139  * \brief          Returns an informational string about the CRL.
140  *
141  * \param buf      Buffer to write to
142  * \param size     Maximum size of buffer
143  * \param prefix   A line prefix
144  * \param crl      The X509 CRL to represent
145  *
146  * \return         The length of the string written (not including the
147  *                 terminated nul byte), or a negative error code.
148  */
149 int mbedtls_x509_crl_info( char *buf, size_t size, const char *prefix,
150                    const mbedtls_x509_crl *crl );
151 
152 /**
153  * \brief          Initialize a CRL (chain)
154  *
155  * \param crl      CRL chain to initialize
156  */
157 void mbedtls_x509_crl_init( mbedtls_x509_crl *crl );
158 
159 /**
160  * \brief          Unallocate all CRL data
161  *
162  * \param crl      CRL chain to free
163  */
164 void mbedtls_x509_crl_free( mbedtls_x509_crl *crl );
165 
166 /* \} name */
167 /* \} addtogroup x509_module */
168 
169 #ifdef __cplusplus
170 }
171 #endif
172 
173 #endif /* mbedtls_x509_crl.h */
174