1 /**
2  * \file x509_crl.h
3  *
4  * \brief X.509 certificate revocation list parsing
5  */
6 /*
7  *  Copyright The Mbed TLS Contributors
8  *  SPDX-License-Identifier: Apache-2.0
9  *
10  *  Licensed under the Apache License, Version 2.0 (the "License"); you may
11  *  not use this file except in compliance with the License.
12  *  You may obtain a copy of the License at
13  *
14  *  http://www.apache.org/licenses/LICENSE-2.0
15  *
16  *  Unless required by applicable law or agreed to in writing, software
17  *  distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
18  *  WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
19  *  See the License for the specific language governing permissions and
20  *  limitations under the License.
21  */
22 #ifndef MBEDTLS_X509_CRL_H
23 #define MBEDTLS_X509_CRL_H
24 
25 #if !defined(MBEDTLS_CONFIG_FILE)
26 #include "mbedtls/config.h"
27 #else
28 #include MBEDTLS_CONFIG_FILE
29 #endif
30 
31 #include "mbedtls/x509.h"
32 
33 #ifdef __cplusplus
34 extern "C" {
35 #endif
36 
37 /**
38  * \addtogroup x509_module
39  * \{ */
40 
41 /**
42  * \name Structures and functions for parsing CRLs
43  * \{
44  */
45 
46 /**
47  * Certificate revocation list entry.
48  * Contains the CA-specific serial numbers and revocation dates.
49  */
50 typedef struct mbedtls_x509_crl_entry
51 {
52     mbedtls_x509_buf raw;
53 
54     mbedtls_x509_buf serial;
55 
56     mbedtls_x509_time revocation_date;
57 
58     mbedtls_x509_buf entry_ext;
59 
60     struct mbedtls_x509_crl_entry *next;
61 }
62 mbedtls_x509_crl_entry;
63 
64 /**
65  * Certificate revocation list structure.
66  * Every CRL may have multiple entries.
67  */
68 typedef struct mbedtls_x509_crl
69 {
70     mbedtls_x509_buf raw;           /**< The raw certificate data (DER). */
71     mbedtls_x509_buf tbs;           /**< The raw certificate body (DER). The part that is To Be Signed. */
72 
73     int version;            /**< CRL version (1=v1, 2=v2) */
74     mbedtls_x509_buf sig_oid;       /**< CRL signature type identifier */
75 
76     mbedtls_x509_buf issuer_raw;    /**< The raw issuer data (DER). */
77 
78     mbedtls_x509_name issuer;       /**< The parsed issuer data (named information object). */
79 
80     mbedtls_x509_time this_update;
81     mbedtls_x509_time next_update;
82 
83     mbedtls_x509_crl_entry entry;   /**< The CRL entries containing the certificate revocation times for this CA. */
84 
85     mbedtls_x509_buf crl_ext;
86 
87     mbedtls_x509_buf sig_oid2;
88     mbedtls_x509_buf sig;
89     mbedtls_md_type_t sig_md;           /**< Internal representation of the MD algorithm of the signature algorithm, e.g. MBEDTLS_MD_SHA256 */
90     mbedtls_pk_type_t sig_pk;           /**< Internal representation of the Public Key algorithm of the signature algorithm, e.g. MBEDTLS_PK_RSA */
91     void *sig_opts;             /**< Signature options to be passed to mbedtls_pk_verify_ext(), e.g. for RSASSA-PSS */
92 
93     struct mbedtls_x509_crl *next;
94 }
95 mbedtls_x509_crl;
96 
97 /**
98  * \brief          Parse a DER-encoded CRL and append it to the chained list
99  *
100  * \param chain    points to the start of the chain
101  * \param buf      buffer holding the CRL data in DER format
102  * \param buflen   size of the buffer
103  *                 (including the terminating null byte for PEM data)
104  *
105  * \return         0 if successful, or a specific X509 or PEM error code
106  */
107 int mbedtls_x509_crl_parse_der( mbedtls_x509_crl *chain,
108                         const unsigned char *buf, size_t buflen );
109 /**
110  * \brief          Parse one or more CRLs and append them to the chained list
111  *
112  * \note           Multiple CRLs are accepted only if using PEM format
113  *
114  * \param chain    points to the start of the chain
115  * \param buf      buffer holding the CRL data in PEM or DER format
116  * \param buflen   size of the buffer
117  *                 (including the terminating null byte for PEM data)
118  *
119  * \return         0 if successful, or a specific X509 or PEM error code
120  */
121 int mbedtls_x509_crl_parse( mbedtls_x509_crl *chain, const unsigned char *buf, size_t buflen );
122 
123 #if defined(MBEDTLS_FS_IO)
124 /**
125  * \brief          Load one or more CRLs and append them to the chained list
126  *
127  * \note           Multiple CRLs are accepted only if using PEM format
128  *
129  * \param chain    points to the start of the chain
130  * \param path     filename to read the CRLs from (in PEM or DER encoding)
131  *
132  * \return         0 if successful, or a specific X509 or PEM error code
133  */
134 int mbedtls_x509_crl_parse_file( mbedtls_x509_crl *chain, const char *path );
135 #endif /* MBEDTLS_FS_IO */
136 
137 /**
138  * \brief          Returns an informational string about the CRL.
139  *
140  * \param buf      Buffer to write to
141  * \param size     Maximum size of buffer
142  * \param prefix   A line prefix
143  * \param crl      The X509 CRL to represent
144  *
145  * \return         The length of the string written (not including the
146  *                 terminated nul byte), or a negative error code.
147  */
148 int mbedtls_x509_crl_info( char *buf, size_t size, const char *prefix,
149                    const mbedtls_x509_crl *crl );
150 
151 /**
152  * \brief          Initialize a CRL (chain)
153  *
154  * \param crl      CRL chain to initialize
155  */
156 void mbedtls_x509_crl_init( mbedtls_x509_crl *crl );
157 
158 /**
159  * \brief          Unallocate all CRL data
160  *
161  * \param crl      CRL chain to free
162  */
163 void mbedtls_x509_crl_free( mbedtls_x509_crl *crl );
164 
165 /* \} name */
166 /* \} addtogroup x509_module */
167 
168 #ifdef __cplusplus
169 }
170 #endif
171 
172 #endif /* mbedtls_x509_crl.h */
173