1 /*
2  *  X.509 Certidicate Revocation List (CRL) parsing
3  *
4  *  Copyright The Mbed TLS Contributors
5  *  SPDX-License-Identifier: Apache-2.0
6  *
7  *  Licensed under the Apache License, Version 2.0 (the "License"); you may
8  *  not use this file except in compliance with the License.
9  *  You may obtain a copy of the License at
10  *
11  *  http://www.apache.org/licenses/LICENSE-2.0
12  *
13  *  Unless required by applicable law or agreed to in writing, software
14  *  distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
15  *  WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
16  *  See the License for the specific language governing permissions and
17  *  limitations under the License.
18  */
19 /*
20  *  The ITU-T X.509 standard defines a certificate format for PKI.
21  *
22  *  http://www.ietf.org/rfc/rfc5280.txt (Certificates and CRLs)
23  *  http://www.ietf.org/rfc/rfc3279.txt (Alg IDs for CRLs)
24  *  http://www.ietf.org/rfc/rfc2986.txt (CSRs, aka PKCS#10)
25  *
26  *  http://www.itu.int/ITU-T/studygroups/com17/languages/X.680-0207.pdf
27  *  http://www.itu.int/ITU-T/studygroups/com17/languages/X.690-0207.pdf
28  */
29 
30 #include "common.h"
31 
32 #if defined(MBEDTLS_X509_CRL_PARSE_C)
33 
34 #include "mbedtls/x509_crl.h"
35 #include "mbedtls/error.h"
36 #include "mbedtls/oid.h"
37 #include "mbedtls/platform_util.h"
38 
39 #include <string.h>
40 
41 #if defined(MBEDTLS_PEM_PARSE_C)
42 #include "mbedtls/pem.h"
43 #endif
44 
45 #if defined(MBEDTLS_PLATFORM_C)
46 #include "mbedtls/platform.h"
47 #else
48 #include <stdlib.h>
49 #include <stdio.h>
50 #define mbedtls_free       free
51 #define mbedtls_calloc    calloc
52 #define mbedtls_snprintf   snprintf
53 #endif
54 
55 #if defined(_WIN32) && !defined(EFIX64) && !defined(EFI32)
56 #include <windows.h>
57 #else
58 #include <time.h>
59 #endif
60 
61 #if defined(MBEDTLS_FS_IO) || defined(EFIX64) || defined(EFI32)
62 #include <stdio.h>
63 #endif
64 
65 /*
66  *  Version  ::=  INTEGER  {  v1(0), v2(1)  }
67  */
x509_crl_get_version(unsigned char ** p,const unsigned char * end,int * ver)68 static int x509_crl_get_version( unsigned char **p,
69                              const unsigned char *end,
70                              int *ver )
71 {
72     int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
73 
74     if( ( ret = mbedtls_asn1_get_int( p, end, ver ) ) != 0 )
75     {
76         if( ret == MBEDTLS_ERR_ASN1_UNEXPECTED_TAG )
77         {
78             *ver = 0;
79             return( 0 );
80         }
81 
82         return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_VERSION, ret ) );
83     }
84 
85     return( 0 );
86 }
87 
88 /*
89  * X.509 CRL v2 extensions
90  *
91  * We currently don't parse any extension's content, but we do check that the
92  * list of extensions is well-formed and abort on critical extensions (that
93  * are unsupported as we don't support any extension so far)
94  */
x509_get_crl_ext(unsigned char ** p,const unsigned char * end,mbedtls_x509_buf * ext)95 static int x509_get_crl_ext( unsigned char **p,
96                              const unsigned char *end,
97                              mbedtls_x509_buf *ext )
98 {
99     int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
100 
101     if( *p == end )
102         return( 0 );
103 
104     /*
105      * crlExtensions           [0]  EXPLICIT Extensions OPTIONAL
106      *                              -- if present, version MUST be v2
107      */
108     if( ( ret = mbedtls_x509_get_ext( p, end, ext, 0 ) ) != 0 )
109         return( ret );
110 
111     end = ext->p + ext->len;
112 
113     while( *p < end )
114     {
115         /*
116          * Extension  ::=  SEQUENCE  {
117          *      extnID      OBJECT IDENTIFIER,
118          *      critical    BOOLEAN DEFAULT FALSE,
119          *      extnValue   OCTET STRING  }
120          */
121         int is_critical = 0;
122         const unsigned char *end_ext_data;
123         size_t len;
124 
125         /* Get enclosing sequence tag */
126         if( ( ret = mbedtls_asn1_get_tag( p, end, &len,
127                 MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
128             return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret ) );
129 
130         end_ext_data = *p + len;
131 
132         /* Get OID (currently ignored) */
133         if( ( ret = mbedtls_asn1_get_tag( p, end_ext_data, &len,
134                                           MBEDTLS_ASN1_OID ) ) != 0 )
135         {
136             return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret ) );
137         }
138         *p += len;
139 
140         /* Get optional critical */
141         if( ( ret = mbedtls_asn1_get_bool( p, end_ext_data,
142                                            &is_critical ) ) != 0 &&
143             ( ret != MBEDTLS_ERR_ASN1_UNEXPECTED_TAG ) )
144         {
145             return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret ) );
146         }
147 
148         /* Data should be octet string type */
149         if( ( ret = mbedtls_asn1_get_tag( p, end_ext_data, &len,
150                 MBEDTLS_ASN1_OCTET_STRING ) ) != 0 )
151             return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret ) );
152 
153         /* Ignore data so far and just check its length */
154         *p += len;
155         if( *p != end_ext_data )
156             return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_EXTENSIONS,
157                     MBEDTLS_ERR_ASN1_LENGTH_MISMATCH ) );
158 
159         /* Abort on (unsupported) critical extensions */
160         if( is_critical )
161             return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_EXTENSIONS,
162                     MBEDTLS_ERR_ASN1_UNEXPECTED_TAG ) );
163     }
164 
165     if( *p != end )
166         return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_EXTENSIONS,
167                 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH ) );
168 
169     return( 0 );
170 }
171 
172 /*
173  * X.509 CRL v2 entry extensions (no extensions parsed yet.)
174  */
x509_get_crl_entry_ext(unsigned char ** p,const unsigned char * end,mbedtls_x509_buf * ext)175 static int x509_get_crl_entry_ext( unsigned char **p,
176                              const unsigned char *end,
177                              mbedtls_x509_buf *ext )
178 {
179     int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
180     size_t len = 0;
181 
182     /* OPTIONAL */
183     if( end <= *p )
184         return( 0 );
185 
186     ext->tag = **p;
187     ext->p = *p;
188 
189     /*
190      * Get CRL-entry extension sequence header
191      * crlEntryExtensions      Extensions OPTIONAL  -- if present, MUST be v2
192      */
193     if( ( ret = mbedtls_asn1_get_tag( p, end, &ext->len,
194             MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
195     {
196         if( ret == MBEDTLS_ERR_ASN1_UNEXPECTED_TAG )
197         {
198             ext->p = NULL;
199             return( 0 );
200         }
201         return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret ) );
202     }
203 
204     end = *p + ext->len;
205 
206     if( end != *p + ext->len )
207         return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_EXTENSIONS,
208                 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH ) );
209 
210     while( *p < end )
211     {
212         if( ( ret = mbedtls_asn1_get_tag( p, end, &len,
213                 MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
214             return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret ) );
215 
216         *p += len;
217     }
218 
219     if( *p != end )
220         return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_EXTENSIONS,
221                 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH ) );
222 
223     return( 0 );
224 }
225 
226 /*
227  * X.509 CRL Entries
228  */
x509_get_entries(unsigned char ** p,const unsigned char * end,mbedtls_x509_crl_entry * entry)229 static int x509_get_entries( unsigned char **p,
230                              const unsigned char *end,
231                              mbedtls_x509_crl_entry *entry )
232 {
233     int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
234     size_t entry_len;
235     mbedtls_x509_crl_entry *cur_entry = entry;
236 
237     if( *p == end )
238         return( 0 );
239 
240     if( ( ret = mbedtls_asn1_get_tag( p, end, &entry_len,
241             MBEDTLS_ASN1_SEQUENCE | MBEDTLS_ASN1_CONSTRUCTED ) ) != 0 )
242     {
243         if( ret == MBEDTLS_ERR_ASN1_UNEXPECTED_TAG )
244             return( 0 );
245 
246         return( ret );
247     }
248 
249     end = *p + entry_len;
250 
251     while( *p < end )
252     {
253         size_t len2;
254         const unsigned char *end2;
255 
256         cur_entry->raw.tag = **p;
257         if( ( ret = mbedtls_asn1_get_tag( p, end, &len2,
258                 MBEDTLS_ASN1_SEQUENCE | MBEDTLS_ASN1_CONSTRUCTED ) ) != 0 )
259         {
260             return( ret );
261         }
262 
263         cur_entry->raw.p = *p;
264         cur_entry->raw.len = len2;
265         end2 = *p + len2;
266 
267         if( ( ret = mbedtls_x509_get_serial( p, end2, &cur_entry->serial ) ) != 0 )
268             return( ret );
269 
270         if( ( ret = mbedtls_x509_get_time( p, end2,
271                                    &cur_entry->revocation_date ) ) != 0 )
272             return( ret );
273 
274         if( ( ret = x509_get_crl_entry_ext( p, end2,
275                                             &cur_entry->entry_ext ) ) != 0 )
276             return( ret );
277 
278         if( *p < end )
279         {
280             cur_entry->next = mbedtls_calloc( 1, sizeof( mbedtls_x509_crl_entry ) );
281 
282             if( cur_entry->next == NULL )
283                 return( MBEDTLS_ERR_X509_ALLOC_FAILED );
284 
285             cur_entry = cur_entry->next;
286         }
287     }
288 
289     return( 0 );
290 }
291 
292 /*
293  * Parse one  CRLs in DER format and append it to the chained list
294  */
mbedtls_x509_crl_parse_der(mbedtls_x509_crl * chain,const unsigned char * buf,size_t buflen)295 int mbedtls_x509_crl_parse_der( mbedtls_x509_crl *chain,
296                         const unsigned char *buf, size_t buflen )
297 {
298     int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
299     size_t len;
300     unsigned char *p = NULL, *end = NULL;
301     mbedtls_x509_buf sig_params1, sig_params2, sig_oid2;
302     mbedtls_x509_crl *crl = chain;
303 
304     /*
305      * Check for valid input
306      */
307     if( crl == NULL || buf == NULL )
308         return( MBEDTLS_ERR_X509_BAD_INPUT_DATA );
309 
310     memset( &sig_params1, 0, sizeof( mbedtls_x509_buf ) );
311     memset( &sig_params2, 0, sizeof( mbedtls_x509_buf ) );
312     memset( &sig_oid2, 0, sizeof( mbedtls_x509_buf ) );
313 
314     /*
315      * Add new CRL on the end of the chain if needed.
316      */
317     while( crl->version != 0 && crl->next != NULL )
318         crl = crl->next;
319 
320     if( crl->version != 0 && crl->next == NULL )
321     {
322         crl->next = mbedtls_calloc( 1, sizeof( mbedtls_x509_crl ) );
323 
324         if( crl->next == NULL )
325         {
326             mbedtls_x509_crl_free( crl );
327             return( MBEDTLS_ERR_X509_ALLOC_FAILED );
328         }
329 
330         mbedtls_x509_crl_init( crl->next );
331         crl = crl->next;
332     }
333 
334     /*
335      * Copy raw DER-encoded CRL
336      */
337     if( buflen == 0 )
338         return( MBEDTLS_ERR_X509_INVALID_FORMAT );
339 
340     p = mbedtls_calloc( 1, buflen );
341     if( p == NULL )
342         return( MBEDTLS_ERR_X509_ALLOC_FAILED );
343 
344     memcpy( p, buf, buflen );
345 
346     crl->raw.p = p;
347     crl->raw.len = buflen;
348 
349     end = p + buflen;
350 
351     /*
352      * CertificateList  ::=  SEQUENCE  {
353      *      tbsCertList          TBSCertList,
354      *      signatureAlgorithm   AlgorithmIdentifier,
355      *      signatureValue       BIT STRING  }
356      */
357     if( ( ret = mbedtls_asn1_get_tag( &p, end, &len,
358             MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
359     {
360         mbedtls_x509_crl_free( crl );
361         return( MBEDTLS_ERR_X509_INVALID_FORMAT );
362     }
363 
364     if( len != (size_t) ( end - p ) )
365     {
366         mbedtls_x509_crl_free( crl );
367         return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_FORMAT,
368                 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH ) );
369     }
370 
371     /*
372      * TBSCertList  ::=  SEQUENCE  {
373      */
374     crl->tbs.p = p;
375 
376     if( ( ret = mbedtls_asn1_get_tag( &p, end, &len,
377             MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
378     {
379         mbedtls_x509_crl_free( crl );
380         return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_FORMAT, ret ) );
381     }
382 
383     end = p + len;
384     crl->tbs.len = end - crl->tbs.p;
385 
386     /*
387      * Version  ::=  INTEGER  OPTIONAL {  v1(0), v2(1)  }
388      *               -- if present, MUST be v2
389      *
390      * signature            AlgorithmIdentifier
391      */
392     if( ( ret = x509_crl_get_version( &p, end, &crl->version ) ) != 0 ||
393         ( ret = mbedtls_x509_get_alg( &p, end, &crl->sig_oid, &sig_params1 ) ) != 0 )
394     {
395         mbedtls_x509_crl_free( crl );
396         return( ret );
397     }
398 
399     if( crl->version < 0 || crl->version > 1 )
400     {
401         mbedtls_x509_crl_free( crl );
402         return( MBEDTLS_ERR_X509_UNKNOWN_VERSION );
403     }
404 
405     crl->version++;
406 
407     if( ( ret = mbedtls_x509_get_sig_alg( &crl->sig_oid, &sig_params1,
408                                   &crl->sig_md, &crl->sig_pk,
409                                   &crl->sig_opts ) ) != 0 )
410     {
411         mbedtls_x509_crl_free( crl );
412         return( MBEDTLS_ERR_X509_UNKNOWN_SIG_ALG );
413     }
414 
415     /*
416      * issuer               Name
417      */
418     crl->issuer_raw.p = p;
419 
420     if( ( ret = mbedtls_asn1_get_tag( &p, end, &len,
421             MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
422     {
423         mbedtls_x509_crl_free( crl );
424         return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_FORMAT, ret ) );
425     }
426 
427     if( ( ret = mbedtls_x509_get_name( &p, p + len, &crl->issuer ) ) != 0 )
428     {
429         mbedtls_x509_crl_free( crl );
430         return( ret );
431     }
432 
433     crl->issuer_raw.len = p - crl->issuer_raw.p;
434 
435     /*
436      * thisUpdate          Time
437      * nextUpdate          Time OPTIONAL
438      */
439     if( ( ret = mbedtls_x509_get_time( &p, end, &crl->this_update ) ) != 0 )
440     {
441         mbedtls_x509_crl_free( crl );
442         return( ret );
443     }
444 
445     if( ( ret = mbedtls_x509_get_time( &p, end, &crl->next_update ) ) != 0 )
446     {
447         if( ret != ( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_DATE,
448                         MBEDTLS_ERR_ASN1_UNEXPECTED_TAG ) ) &&
449             ret != ( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_DATE,
450                         MBEDTLS_ERR_ASN1_OUT_OF_DATA ) ) )
451         {
452             mbedtls_x509_crl_free( crl );
453             return( ret );
454         }
455     }
456 
457     /*
458      * revokedCertificates    SEQUENCE OF SEQUENCE   {
459      *      userCertificate        CertificateSerialNumber,
460      *      revocationDate         Time,
461      *      crlEntryExtensions     Extensions OPTIONAL
462      *                                   -- if present, MUST be v2
463      *                        } OPTIONAL
464      */
465     if( ( ret = x509_get_entries( &p, end, &crl->entry ) ) != 0 )
466     {
467         mbedtls_x509_crl_free( crl );
468         return( ret );
469     }
470 
471     /*
472      * crlExtensions          EXPLICIT Extensions OPTIONAL
473      *                              -- if present, MUST be v2
474      */
475     if( crl->version == 2 )
476     {
477         ret = x509_get_crl_ext( &p, end, &crl->crl_ext );
478 
479         if( ret != 0 )
480         {
481             mbedtls_x509_crl_free( crl );
482             return( ret );
483         }
484     }
485 
486     if( p != end )
487     {
488         mbedtls_x509_crl_free( crl );
489         return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_FORMAT,
490                 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH ) );
491     }
492 
493     end = crl->raw.p + crl->raw.len;
494 
495     /*
496      *  signatureAlgorithm   AlgorithmIdentifier,
497      *  signatureValue       BIT STRING
498      */
499     if( ( ret = mbedtls_x509_get_alg( &p, end, &sig_oid2, &sig_params2 ) ) != 0 )
500     {
501         mbedtls_x509_crl_free( crl );
502         return( ret );
503     }
504 
505     if( crl->sig_oid.len != sig_oid2.len ||
506         memcmp( crl->sig_oid.p, sig_oid2.p, crl->sig_oid.len ) != 0 ||
507         sig_params1.len != sig_params2.len ||
508         ( sig_params1.len != 0 &&
509           memcmp( sig_params1.p, sig_params2.p, sig_params1.len ) != 0 ) )
510     {
511         mbedtls_x509_crl_free( crl );
512         return( MBEDTLS_ERR_X509_SIG_MISMATCH );
513     }
514 
515     if( ( ret = mbedtls_x509_get_sig( &p, end, &crl->sig ) ) != 0 )
516     {
517         mbedtls_x509_crl_free( crl );
518         return( ret );
519     }
520 
521     if( p != end )
522     {
523         mbedtls_x509_crl_free( crl );
524         return( MBEDTLS_ERROR_ADD( MBEDTLS_ERR_X509_INVALID_FORMAT,
525                 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH ) );
526     }
527 
528     return( 0 );
529 }
530 
531 /*
532  * Parse one or more CRLs and add them to the chained list
533  */
mbedtls_x509_crl_parse(mbedtls_x509_crl * chain,const unsigned char * buf,size_t buflen)534 int mbedtls_x509_crl_parse( mbedtls_x509_crl *chain, const unsigned char *buf, size_t buflen )
535 {
536 #if defined(MBEDTLS_PEM_PARSE_C)
537     int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
538     size_t use_len = 0;
539     mbedtls_pem_context pem;
540     int is_pem = 0;
541 
542     if( chain == NULL || buf == NULL )
543         return( MBEDTLS_ERR_X509_BAD_INPUT_DATA );
544 
545     do
546     {
547         mbedtls_pem_init( &pem );
548 
549         // Avoid calling mbedtls_pem_read_buffer() on non-null-terminated
550         // string
551         if( buflen == 0 || buf[buflen - 1] != '\0' )
552             ret = MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT;
553         else
554             ret = mbedtls_pem_read_buffer( &pem,
555                                            "-----BEGIN X509 CRL-----",
556                                            "-----END X509 CRL-----",
557                                             buf, NULL, 0, &use_len );
558 
559         if( ret == 0 )
560         {
561             /*
562              * Was PEM encoded
563              */
564             is_pem = 1;
565 
566             buflen -= use_len;
567             buf += use_len;
568 
569             if( ( ret = mbedtls_x509_crl_parse_der( chain,
570                                             pem.buf, pem.buflen ) ) != 0 )
571             {
572                 mbedtls_pem_free( &pem );
573                 return( ret );
574             }
575         }
576         else if( is_pem )
577         {
578             mbedtls_pem_free( &pem );
579             return( ret );
580         }
581 
582         mbedtls_pem_free( &pem );
583     }
584     /* In the PEM case, buflen is 1 at the end, for the terminated NULL byte.
585      * And a valid CRL cannot be less than 1 byte anyway. */
586     while( is_pem && buflen > 1 );
587 
588     if( is_pem )
589         return( 0 );
590     else
591 #endif /* MBEDTLS_PEM_PARSE_C */
592         return( mbedtls_x509_crl_parse_der( chain, buf, buflen ) );
593 }
594 
595 #if defined(MBEDTLS_FS_IO)
596 /*
597  * Load one or more CRLs and add them to the chained list
598  */
mbedtls_x509_crl_parse_file(mbedtls_x509_crl * chain,const char * path)599 int mbedtls_x509_crl_parse_file( mbedtls_x509_crl *chain, const char *path )
600 {
601     int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
602     size_t n;
603     unsigned char *buf;
604 
605     if( ( ret = mbedtls_pk_load_file( path, &buf, &n ) ) != 0 )
606         return( ret );
607 
608     ret = mbedtls_x509_crl_parse( chain, buf, n );
609 
610     mbedtls_platform_zeroize( buf, n );
611     mbedtls_free( buf );
612 
613     return( ret );
614 }
615 #endif /* MBEDTLS_FS_IO */
616 
617 /*
618  * Return an informational string about the certificate.
619  */
620 #define BEFORE_COLON    14
621 #define BC              "14"
622 /*
623  * Return an informational string about the CRL.
624  */
mbedtls_x509_crl_info(char * buf,size_t size,const char * prefix,const mbedtls_x509_crl * crl)625 int mbedtls_x509_crl_info( char *buf, size_t size, const char *prefix,
626                    const mbedtls_x509_crl *crl )
627 {
628     int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
629     size_t n;
630     char *p;
631     const mbedtls_x509_crl_entry *entry;
632 
633     p = buf;
634     n = size;
635 
636     ret = mbedtls_snprintf( p, n, "%sCRL version   : %d",
637                                prefix, crl->version );
638     MBEDTLS_X509_SAFE_SNPRINTF;
639 
640     ret = mbedtls_snprintf( p, n, "\n%sissuer name   : ", prefix );
641     MBEDTLS_X509_SAFE_SNPRINTF;
642     ret = mbedtls_x509_dn_gets( p, n, &crl->issuer );
643     MBEDTLS_X509_SAFE_SNPRINTF;
644 
645     ret = mbedtls_snprintf( p, n, "\n%sthis update   : " \
646                    "%04d-%02d-%02d %02d:%02d:%02d", prefix,
647                    crl->this_update.year, crl->this_update.mon,
648                    crl->this_update.day,  crl->this_update.hour,
649                    crl->this_update.min,  crl->this_update.sec );
650     MBEDTLS_X509_SAFE_SNPRINTF;
651 
652     ret = mbedtls_snprintf( p, n, "\n%snext update   : " \
653                    "%04d-%02d-%02d %02d:%02d:%02d", prefix,
654                    crl->next_update.year, crl->next_update.mon,
655                    crl->next_update.day,  crl->next_update.hour,
656                    crl->next_update.min,  crl->next_update.sec );
657     MBEDTLS_X509_SAFE_SNPRINTF;
658 
659     entry = &crl->entry;
660 
661     ret = mbedtls_snprintf( p, n, "\n%sRevoked certificates:",
662                                prefix );
663     MBEDTLS_X509_SAFE_SNPRINTF;
664 
665     while( entry != NULL && entry->raw.len != 0 )
666     {
667         ret = mbedtls_snprintf( p, n, "\n%sserial number: ",
668                                prefix );
669         MBEDTLS_X509_SAFE_SNPRINTF;
670 
671         ret = mbedtls_x509_serial_gets( p, n, &entry->serial );
672         MBEDTLS_X509_SAFE_SNPRINTF;
673 
674         ret = mbedtls_snprintf( p, n, " revocation date: " \
675                    "%04d-%02d-%02d %02d:%02d:%02d",
676                    entry->revocation_date.year, entry->revocation_date.mon,
677                    entry->revocation_date.day,  entry->revocation_date.hour,
678                    entry->revocation_date.min,  entry->revocation_date.sec );
679         MBEDTLS_X509_SAFE_SNPRINTF;
680 
681         entry = entry->next;
682     }
683 
684     ret = mbedtls_snprintf( p, n, "\n%ssigned using  : ", prefix );
685     MBEDTLS_X509_SAFE_SNPRINTF;
686 
687     ret = mbedtls_x509_sig_alg_gets( p, n, &crl->sig_oid, crl->sig_pk, crl->sig_md,
688                              crl->sig_opts );
689     MBEDTLS_X509_SAFE_SNPRINTF;
690 
691     ret = mbedtls_snprintf( p, n, "\n" );
692     MBEDTLS_X509_SAFE_SNPRINTF;
693 
694     return( (int) ( size - n ) );
695 }
696 
697 /*
698  * Initialize a CRL chain
699  */
mbedtls_x509_crl_init(mbedtls_x509_crl * crl)700 void mbedtls_x509_crl_init( mbedtls_x509_crl *crl )
701 {
702     memset( crl, 0, sizeof(mbedtls_x509_crl) );
703 }
704 
705 /*
706  * Unallocate all CRL data
707  */
mbedtls_x509_crl_free(mbedtls_x509_crl * crl)708 void mbedtls_x509_crl_free( mbedtls_x509_crl *crl )
709 {
710     mbedtls_x509_crl *crl_cur = crl;
711     mbedtls_x509_crl *crl_prv;
712     mbedtls_x509_name *name_cur;
713     mbedtls_x509_name *name_prv;
714     mbedtls_x509_crl_entry *entry_cur;
715     mbedtls_x509_crl_entry *entry_prv;
716 
717     if( crl == NULL )
718         return;
719 
720     do
721     {
722 #if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT)
723         mbedtls_free( crl_cur->sig_opts );
724 #endif
725 
726         name_cur = crl_cur->issuer.next;
727         while( name_cur != NULL )
728         {
729             name_prv = name_cur;
730             name_cur = name_cur->next;
731             mbedtls_platform_zeroize( name_prv, sizeof( mbedtls_x509_name ) );
732             mbedtls_free( name_prv );
733         }
734 
735         entry_cur = crl_cur->entry.next;
736         while( entry_cur != NULL )
737         {
738             entry_prv = entry_cur;
739             entry_cur = entry_cur->next;
740             mbedtls_platform_zeroize( entry_prv,
741                                       sizeof( mbedtls_x509_crl_entry ) );
742             mbedtls_free( entry_prv );
743         }
744 
745         if( crl_cur->raw.p != NULL )
746         {
747             mbedtls_platform_zeroize( crl_cur->raw.p, crl_cur->raw.len );
748             mbedtls_free( crl_cur->raw.p );
749         }
750 
751         crl_cur = crl_cur->next;
752     }
753     while( crl_cur != NULL );
754 
755     crl_cur = crl;
756     do
757     {
758         crl_prv = crl_cur;
759         crl_cur = crl_cur->next;
760 
761         mbedtls_platform_zeroize( crl_prv, sizeof( mbedtls_x509_crl ) );
762         if( crl_prv != crl )
763             mbedtls_free( crl_prv );
764     }
765     while( crl_cur != NULL );
766 }
767 
768 #endif /* MBEDTLS_X509_CRL_PARSE_C */
769