1 /** 2 * \file x509_crl.h 3 * 4 * \brief X.509 certificate revocation list parsing 5 */ 6 /* 7 * Copyright The Mbed TLS Contributors 8 * SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later 9 */ 10 #ifndef MBEDTLS_X509_CRL_H 11 #define MBEDTLS_X509_CRL_H 12 13 #if !defined(MBEDTLS_CONFIG_FILE) 14 #include "mbedtls/config.h" 15 #else 16 #include MBEDTLS_CONFIG_FILE 17 #endif 18 19 #include "mbedtls/x509.h" 20 21 #ifdef __cplusplus 22 extern "C" { 23 #endif 24 25 /** 26 * \addtogroup x509_module 27 * \{ */ 28 29 /** 30 * \name Structures and functions for parsing CRLs 31 * \{ 32 */ 33 34 /** 35 * Certificate revocation list entry. 36 * Contains the CA-specific serial numbers and revocation dates. 37 */ 38 typedef struct mbedtls_x509_crl_entry { 39 mbedtls_x509_buf raw; 40 41 mbedtls_x509_buf serial; 42 43 mbedtls_x509_time revocation_date; 44 45 mbedtls_x509_buf entry_ext; 46 47 struct mbedtls_x509_crl_entry *next; 48 } 49 mbedtls_x509_crl_entry; 50 51 /** 52 * Certificate revocation list structure. 53 * Every CRL may have multiple entries. 54 */ 55 typedef struct mbedtls_x509_crl { 56 mbedtls_x509_buf raw; /**< The raw certificate data (DER). */ 57 mbedtls_x509_buf tbs; /**< The raw certificate body (DER). The part that is To Be Signed. */ 58 59 int version; /**< CRL version (1=v1, 2=v2) */ 60 mbedtls_x509_buf sig_oid; /**< CRL signature type identifier */ 61 62 mbedtls_x509_buf issuer_raw; /**< The raw issuer data (DER). */ 63 64 mbedtls_x509_name issuer; /**< The parsed issuer data (named information object). */ 65 66 mbedtls_x509_time this_update; 67 mbedtls_x509_time next_update; 68 69 mbedtls_x509_crl_entry entry; /**< The CRL entries containing the certificate revocation times for this CA. */ 70 71 mbedtls_x509_buf crl_ext; 72 73 mbedtls_x509_buf sig_oid2; 74 mbedtls_x509_buf sig; 75 mbedtls_md_type_t sig_md; /**< Internal representation of the MD algorithm of the signature algorithm, e.g. MBEDTLS_MD_SHA256 */ 76 mbedtls_pk_type_t sig_pk; /**< Internal representation of the Public Key algorithm of the signature algorithm, e.g. MBEDTLS_PK_RSA */ 77 void *sig_opts; /**< Signature options to be passed to mbedtls_pk_verify_ext(), e.g. for RSASSA-PSS */ 78 79 struct mbedtls_x509_crl *next; 80 } 81 mbedtls_x509_crl; 82 83 /** 84 * \brief Parse a DER-encoded CRL and append it to the chained list 85 * 86 * \note If #MBEDTLS_USE_PSA_CRYPTO is enabled, the PSA crypto 87 * subsystem must have been initialized by calling 88 * psa_crypto_init() before calling this function. 89 * 90 * \param chain points to the start of the chain 91 * \param buf buffer holding the CRL data in DER format 92 * \param buflen size of the buffer 93 * (including the terminating null byte for PEM data) 94 * 95 * \return 0 if successful, or a specific X509 or PEM error code 96 */ 97 int mbedtls_x509_crl_parse_der(mbedtls_x509_crl *chain, 98 const unsigned char *buf, size_t buflen); 99 /** 100 * \brief Parse one or more CRLs and append them to the chained list 101 * 102 * \note Multiple CRLs are accepted only if using PEM format 103 * 104 * \note If #MBEDTLS_USE_PSA_CRYPTO is enabled, the PSA crypto 105 * subsystem must have been initialized by calling 106 * psa_crypto_init() before calling this function. 107 * 108 * \param chain points to the start of the chain 109 * \param buf buffer holding the CRL data in PEM or DER format 110 * \param buflen size of the buffer 111 * (including the terminating null byte for PEM data) 112 * 113 * \return 0 if successful, or a specific X509 or PEM error code 114 */ 115 int mbedtls_x509_crl_parse(mbedtls_x509_crl *chain, const unsigned char *buf, size_t buflen); 116 117 #if defined(MBEDTLS_FS_IO) 118 /** 119 * \brief Load one or more CRLs and append them to the chained list 120 * 121 * \note Multiple CRLs are accepted only if using PEM format 122 * 123 * \note If #MBEDTLS_USE_PSA_CRYPTO is enabled, the PSA crypto 124 * subsystem must have been initialized by calling 125 * psa_crypto_init() before calling this function. 126 * 127 * \param chain points to the start of the chain 128 * \param path filename to read the CRLs from (in PEM or DER encoding) 129 * 130 * \return 0 if successful, or a specific X509 or PEM error code 131 */ 132 int mbedtls_x509_crl_parse_file(mbedtls_x509_crl *chain, const char *path); 133 #endif /* MBEDTLS_FS_IO */ 134 135 /** 136 * \brief Returns an informational string about the CRL. 137 * 138 * \param buf Buffer to write to 139 * \param size Maximum size of buffer 140 * \param prefix A line prefix 141 * \param crl The X509 CRL to represent 142 * 143 * \return The length of the string written (not including the 144 * terminated nul byte), or a negative error code. 145 */ 146 int mbedtls_x509_crl_info(char *buf, size_t size, const char *prefix, 147 const mbedtls_x509_crl *crl); 148 149 /** 150 * \brief Initialize a CRL (chain) 151 * 152 * \param crl CRL chain to initialize 153 */ 154 void mbedtls_x509_crl_init(mbedtls_x509_crl *crl); 155 156 /** 157 * \brief Unallocate all CRL data 158 * 159 * \param crl CRL chain to free 160 */ 161 void mbedtls_x509_crl_free(mbedtls_x509_crl *crl); 162 163 /** \} name Structures and functions for parsing CRLs */ 164 /** \} addtogroup x509_module */ 165 166 #ifdef __cplusplus 167 } 168 #endif 169 170 #endif /* mbedtls_x509_crl.h */ 171