/*
* X.509 CRL Entries
*/
static int x509_get_entries(unsigned char **p,
const unsigned char *end,
mbedtls_x509_crl_entry *entry) {
int ret;
size_t entry_len;
mbedtls_x509_crl_entry *cur_entry = entry;
if (*p == end)
return (0);
if ((ret = mbedtls_asn1_get_tag(p, end, &entry_len,
MBEDTLS_ASN1_SEQUENCE | MBEDTLS_ASN1_CONSTRUCTED)) != 0) {
if (ret == MBEDTLS_ERR_ASN1_UNEXPECTED_TAG)
return (0);
return (ret);
}
end = *p + entry_len;
while (*p < end) {
size_t len2;
const unsigned char *end2;
if ((ret = mbedtls_asn1_get_tag(p, end, &len2,
MBEDTLS_ASN1_SEQUENCE | MBEDTLS_ASN1_CONSTRUCTED)) != 0) {
return (ret);
}
cur_entry->raw.tag = **p;
cur_entry->raw.p = *p;
cur_entry->raw.len = len2;
end2 = *p + len2;
if ((ret = mbedtls_x509_get_serial(p, end2, &cur_entry->serial)) != 0)
return (ret);
if ((ret = mbedtls_x509_get_time(p, end2,
&cur_entry->revocation_date)) != 0)
return (ret);
if ((ret = x509_get_crl_entry_ext(p, end2,
&cur_entry->entry_ext)) != 0)
return (ret);
if (*p < end) {
cur_entry->next = mbedtls_calloc(1, sizeof(mbedtls_x509_crl_entry));
if (cur_entry->next == NULL)
return (MBEDTLS_ERR_X509_ALLOC_FAILED);
cur_entry = cur_entry->next;
}
}
return (0);
}
/*
* Parse one CRLs in DER format and append it to the chained list
*/
int mbedtls_x509_crl_parse_der( mbedtls_x509_crl *chain,
const unsigned char *buf, size_t buflen )
{
int ret;
size_t len;
unsigned char *p, *end;
mbedtls_x509_buf sig_params1, sig_params2, sig_oid2;
mbedtls_x509_crl *crl = chain;
/*
* Check for valid input
*/
if( crl == NULL || buf == NULL )
return( MBEDTLS_ERR_X509_BAD_INPUT_DATA );
memset( &sig_params1, 0, sizeof( mbedtls_x509_buf ) );
memset( &sig_params2, 0, sizeof( mbedtls_x509_buf ) );
memset( &sig_oid2, 0, sizeof( mbedtls_x509_buf ) );
/*
* Add new CRL on the end of the chain if needed.
*/
while( crl->version != 0 && crl->next != NULL )
crl = crl->next;
if( crl->version != 0 && crl->next == NULL )
{
crl->next = mbedtls_calloc( 1, sizeof( mbedtls_x509_crl ) );
if( crl->next == NULL )
{
mbedtls_x509_crl_free( crl );
return( MBEDTLS_ERR_X509_ALLOC_FAILED );
}
mbedtls_x509_crl_init( crl->next );
crl = crl->next;
}
/*
* Copy raw DER-encoded CRL
*/
if( ( p = mbedtls_calloc( 1, buflen ) ) == NULL )
return( MBEDTLS_ERR_X509_ALLOC_FAILED );
memmove( p, buf, buflen );
crl->raw.p = p;
crl->raw.len = buflen;
end = p + buflen;
/*
* CertificateList ::= SEQUENCE {
* tbsCertList TBSCertList,
* signatureAlgorithm AlgorithmIdentifier,
* signatureValue BIT STRING }
*/
if( ( ret = mbedtls_asn1_get_tag( &p, end, &len,
MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
{
mbedtls_x509_crl_free( crl );
return( MBEDTLS_ERR_X509_INVALID_FORMAT );
}
if( len != (size_t) ( end - p ) )
{
mbedtls_x509_crl_free( crl );
return( MBEDTLS_ERR_X509_INVALID_FORMAT +
MBEDTLS_ERR_ASN1_LENGTH_MISMATCH );
}
/*
* TBSCertList ::= SEQUENCE {
*/
crl->tbs.p = p;
if( ( ret = mbedtls_asn1_get_tag( &p, end, &len,
MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
{
mbedtls_x509_crl_free( crl );
return( MBEDTLS_ERR_X509_INVALID_FORMAT + ret );
}
end = p + len;
crl->tbs.len = end - crl->tbs.p;
/*
* Version ::= INTEGER OPTIONAL { v1(0), v2(1) }
* -- if present, MUST be v2
*
* signature AlgorithmIdentifier
*/
if( ( ret = x509_crl_get_version( &p, end, &crl->version ) ) != 0 ||
( ret = mbedtls_x509_get_alg( &p, end, &crl->sig_oid, &sig_params1 ) ) != 0 )
{
mbedtls_x509_crl_free( crl );
return( ret );
}
crl->version++;
if( crl->version > 2 )
{
mbedtls_x509_crl_free( crl );
return( MBEDTLS_ERR_X509_UNKNOWN_VERSION );
}
if( ( ret = mbedtls_x509_get_sig_alg( &crl->sig_oid, &sig_params1,
&crl->sig_md, &crl->sig_pk,
&crl->sig_opts ) ) != 0 )
{
mbedtls_x509_crl_free( crl );
return( MBEDTLS_ERR_X509_UNKNOWN_SIG_ALG );
}
/*
* issuer Name
*/
crl->issuer_raw.p = p;
if( ( ret = mbedtls_asn1_get_tag( &p, end, &len,
MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
{
mbedtls_x509_crl_free( crl );
return( MBEDTLS_ERR_X509_INVALID_FORMAT + ret );
}
if( ( ret = mbedtls_x509_get_name( &p, p + len, &crl->issuer ) ) != 0 )
{
mbedtls_x509_crl_free( crl );
return( ret );
}
crl->issuer_raw.len = p - crl->issuer_raw.p;
/*
* thisUpdate Time
* nextUpdate Time OPTIONAL
*/
if( ( ret = mbedtls_x509_get_time( &p, end, &crl->this_update ) ) != 0 )
{
mbedtls_x509_crl_free( crl );
return( ret );
}
if( ( ret = mbedtls_x509_get_time( &p, end, &crl->next_update ) ) != 0 )
{
if( ret != ( MBEDTLS_ERR_X509_INVALID_DATE +
MBEDTLS_ERR_ASN1_UNEXPECTED_TAG ) &&
ret != ( MBEDTLS_ERR_X509_INVALID_DATE +
MBEDTLS_ERR_ASN1_OUT_OF_DATA ) )
{
mbedtls_x509_crl_free( crl );
return( ret );
}
}
/*
* revokedCertificates SEQUENCE OF SEQUENCE {
* userCertificate CertificateSerialNumber,
* revocationDate Time,
* crlEntryExtensions Extensions OPTIONAL
* -- if present, MUST be v2
* } OPTIONAL
*/
if( ( ret = x509_get_entries( &p, end, &crl->entry ) ) != 0 )
{
mbedtls_x509_crl_free( crl );
return( ret );
}
/*
* crlExtensions EXPLICIT Extensions OPTIONAL
* -- if present, MUST be v2
*/
if( crl->version == 2 )
{
ret = x509_get_crl_ext( &p, end, &crl->crl_ext );
if( ret != 0 )
{
mbedtls_x509_crl_free( crl );
return( ret );
}
}
if( p != end )
{
mbedtls_x509_crl_free( crl );
return( MBEDTLS_ERR_X509_INVALID_FORMAT +
MBEDTLS_ERR_ASN1_LENGTH_MISMATCH );
}
end = crl->raw.p + crl->raw.len;
/*
* signatureAlgorithm AlgorithmIdentifier,
* signatureValue BIT STRING
*/
if( ( ret = mbedtls_x509_get_alg( &p, end, &sig_oid2, &sig_params2 ) ) != 0 )
{
mbedtls_x509_crl_free( crl );
return( ret );
}
if( crl->sig_oid.len != sig_oid2.len ||
memcmp( crl->sig_oid.p, sig_oid2.p, crl->sig_oid.len ) != 0 ||
sig_params1.len != sig_params2.len ||
( sig_params1.len != 0 &&
memcmp( sig_params1.p, sig_params2.p, sig_params1.len ) != 0 ) )
{
mbedtls_x509_crl_free( crl );
return( MBEDTLS_ERR_X509_SIG_MISMATCH );
}
if( ( ret = mbedtls_x509_get_sig( &p, end, &crl->sig ) ) != 0 )
{
mbedtls_x509_crl_free( crl );
return( ret );
}
if( p != end )
{
mbedtls_x509_crl_free( crl );
return( MBEDTLS_ERR_X509_INVALID_FORMAT +
MBEDTLS_ERR_ASN1_LENGTH_MISMATCH );
}
return( 0 );
}
