/work/mbedtls-2.28.8/library/x509_crl.c

Source (jump to first uncovered line)
/*
 *  X.509 Certificate Revocation List (CRL) parsing
 *
 *  Copyright The Mbed TLS Contributors
 *  SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
 */
/*
 *  The ITU-T X.509 standard defines a certificate format for PKI.
 *
 *  http://www.ietf.org/rfc/rfc5280.txt (Certificates and CRLs)
 *  http://www.ietf.org/rfc/rfc3279.txt (Alg IDs for CRLs)
 *  http://www.ietf.org/rfc/rfc2986.txt (CSRs, aka PKCS#10)
 *
 *  http://www.itu.int/ITU-T/studygroups/com17/languages/X.680-0207.pdf
 *  http://www.itu.int/ITU-T/studygroups/com17/languages/X.690-0207.pdf
 */

#include "common.h"

#if defined(MBEDTLS_X509_CRL_PARSE_C)

#include "mbedtls/x509_crl.h"
#include "mbedtls/error.h"
#include "mbedtls/oid.h"
#include "mbedtls/platform_util.h"

#include <string.h>

#if defined(MBEDTLS_PEM_PARSE_C)
#include "mbedtls/pem.h"
#endif

#include "mbedtls/platform.h"

#if defined(MBEDTLS_HAVE_TIME)
#if defined(_WIN32) && !defined(EFIX64) && !defined(EFI32)
#include <windows.h>
#else
#include <time.h>
#endif
#endif

#if defined(MBEDTLS_FS_IO) || defined(EFIX64) || defined(EFI32)
#include <stdio.h>
#endif

/*
 *  Version  ::=  INTEGER  {  v1(0), v2(1)  }
 */
static int x509_crl_get_version(unsigned char **p,
                                const unsigned char *end,
                                int *ver)
{
    int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;

    if ((ret = mbedtls_asn1_get_int(p, end, ver)) != 0) {
        if (ret == MBEDTLS_ERR_ASN1_UNEXPECTED_TAG) {
            *ver = 0;
            return 0;
        }

        return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_VERSION, ret);
    }

    return 0;
}

/*
 * X.509 CRL v2 extensions
 *
 * We currently don't parse any extension's content, but we do check that the
 * list of extensions is well-formed and abort on critical extensions (that
 * are unsupported as we don't support any extension so far)
 */
static int x509_get_crl_ext(unsigned char **p,
                            const unsigned char *end,
                            mbedtls_x509_buf *ext)
{
    int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;

    if (*p == end) {
        return 0;
    }

    /*
     * crlExtensions           [0]  EXPLICIT Extensions OPTIONAL
     *                              -- if present, version MUST be v2
     */
    if ((ret = mbedtls_x509_get_ext(p, end, ext, 0)) != 0) {
        return ret;
    }

    end = ext->p + ext->len;

    while (*p < end) {
        /*
         * Extension  ::=  SEQUENCE  {
         *      extnID      OBJECT IDENTIFIER,
         *      critical    BOOLEAN DEFAULT FALSE,
         *      extnValue   OCTET STRING  }
         */
        int is_critical = 0;
        const unsigned char *end_ext_data;
        size_t len;

        /* Get enclosing sequence tag */
        if ((ret = mbedtls_asn1_get_tag(p, end, &len,
                                        MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE)) != 0) {
            return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret);
        }

        end_ext_data = *p + len;

        /* Get OID (currently ignored) */
        if ((ret = mbedtls_asn1_get_tag(p, end_ext_data, &len,
                                        MBEDTLS_ASN1_OID)) != 0) {
            return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret);
        }
        *p += len;

        /* Get optional critical */
        if ((ret = mbedtls_asn1_get_bool(p, end_ext_data,
                                         &is_critical)) != 0 &&
            (ret != MBEDTLS_ERR_ASN1_UNEXPECTED_TAG)) {
            return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret);
        }

        /* Data should be octet string type */
        if ((ret = mbedtls_asn1_get_tag(p, end_ext_data, &len,
                                        MBEDTLS_ASN1_OCTET_STRING)) != 0) {
            return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret);
        }

        /* Ignore data so far and just check its length */
        *p += len;
        if (*p != end_ext_data) {
            return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS,
                                     MBEDTLS_ERR_ASN1_LENGTH_MISMATCH);
        }

        /* Abort on (unsupported) critical extensions */
        if (is_critical) {
            return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS,
                                     MBEDTLS_ERR_ASN1_UNEXPECTED_TAG);
        }
    }

    if (*p != end) {
        return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS,
                                 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH);
    }

    return 0;
}

/*
 * X.509 CRL v2 entry extensions (no extensions parsed yet.)
 */
static int x509_get_crl_entry_ext(unsigned char **p,
                                  const unsigned char *end,
                                  mbedtls_x509_buf *ext)
{
    int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
    size_t len = 0;

    /* OPTIONAL */
    if (end <= *p) {
        return 0;
    }

    ext->tag = **p;
    ext->p = *p;

    /*
     * Get CRL-entry extension sequence header
     * crlEntryExtensions      Extensions OPTIONAL  -- if present, MUST be v2
     */
    if ((ret = mbedtls_asn1_get_tag(p, end, &ext->len,
                                    MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE)) != 0) {
        if (ret == MBEDTLS_ERR_ASN1_UNEXPECTED_TAG) {
            ext->p = NULL;
            return 0;
        }
        return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret);
    }

    end = *p + ext->len;

    if (end != *p + ext->len) {
        return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS,
                                 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH);
    }

    while (*p < end) {
        if ((ret = mbedtls_asn1_get_tag(p, end, &len,
                                        MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE)) != 0) {
            return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret);
        }

        *p += len;
    }

    if (*p != end) {
        return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS,
                                 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH);
    }

    return 0;
}

/*
 * X.509 CRL Entries
 */
static int x509_get_entries(unsigned char **p,
                            const unsigned char *end,
                            mbedtls_x509_crl_entry *entry)
{
    int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
    size_t entry_len;
    mbedtls_x509_crl_entry *cur_entry = entry;

    if (*p == end) {
        return 0;
    }

    if ((ret = mbedtls_asn1_get_tag(p, end, &entry_len,
                                    MBEDTLS_ASN1_SEQUENCE | MBEDTLS_ASN1_CONSTRUCTED)) != 0) {
        if (ret == MBEDTLS_ERR_ASN1_UNEXPECTED_TAG) {
            return 0;
        }

        return ret;
    }

    end = *p + entry_len;

    while (*p < end) {
        size_t len2;
        const unsigned char *end2;

        cur_entry->raw.tag = **p;
        if ((ret = mbedtls_asn1_get_tag(p, end, &len2,
                                        MBEDTLS_ASN1_SEQUENCE | MBEDTLS_ASN1_CONSTRUCTED)) != 0) {
            return ret;
        }

        cur_entry->raw.p = *p;
        cur_entry->raw.len = len2;
        end2 = *p + len2;

        if ((ret = mbedtls_x509_get_serial(p, end2, &cur_entry->serial)) != 0) {
            return ret;
        }

        if ((ret = mbedtls_x509_get_time(p, end2,
                                         &cur_entry->revocation_date)) != 0) {
            return ret;
        }

        if ((ret = x509_get_crl_entry_ext(p, end2,
                                          &cur_entry->entry_ext)) != 0) {
            return ret;
        }

        if (*p < end) {
            cur_entry->next = mbedtls_calloc(1, sizeof(mbedtls_x509_crl_entry));

            if (cur_entry->next == NULL) {
                return MBEDTLS_ERR_X509_ALLOC_FAILED;
            }

            cur_entry = cur_entry->next;
        }
    }

    return 0;
}

/*
 * Parse one  CRLs in DER format and append it to the chained list
 */
int mbedtls_x509_crl_parse_der(mbedtls_x509_crl *chain,
                               const unsigned char *buf, size_t buflen)
{
    int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
    size_t len;
    unsigned char *p = NULL, *end = NULL;
    mbedtls_x509_buf sig_params1, sig_params2, sig_oid2;
    mbedtls_x509_crl *crl = chain;

    /*
     * Check for valid input
     */
    if (crl == NULL || buf == NULL) {
        return MBEDTLS_ERR_X509_BAD_INPUT_DATA;
    }

    memset(&sig_params1, 0, sizeof(mbedtls_x509_buf));
    memset(&sig_params2, 0, sizeof(mbedtls_x509_buf));
    memset(&sig_oid2, 0, sizeof(mbedtls_x509_buf));

    /*
     * Add new CRL on the end of the chain if needed.
     */
    while (crl->version != 0 && crl->next != NULL) {
        crl = crl->next;
    }

    if (crl->version != 0 && crl->next == NULL) {
        crl->next = mbedtls_calloc(1, sizeof(mbedtls_x509_crl));

        if (crl->next == NULL) {
            mbedtls_x509_crl_free(crl);
            return MBEDTLS_ERR_X509_ALLOC_FAILED;
        }

        mbedtls_x509_crl_init(crl->next);
        crl = crl->next;
    }

    /*
     * Copy raw DER-encoded CRL
     */
    if (buflen == 0) {
        return MBEDTLS_ERR_X509_INVALID_FORMAT;
    }

    p = mbedtls_calloc(1, buflen);
    if (p == NULL) {
        return MBEDTLS_ERR_X509_ALLOC_FAILED;
    }

    memcpy(p, buf, buflen);

    crl->raw.p = p;
    crl->raw.len = buflen;

    end = p + buflen;

    /*
     * CertificateList  ::=  SEQUENCE  {
     *      tbsCertList          TBSCertList,
     *      signatureAlgorithm   AlgorithmIdentifier,
     *      signatureValue       BIT STRING  }
     */
    if ((ret = mbedtls_asn1_get_tag(&p, end, &len,
                                    MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE)) != 0) {
        mbedtls_x509_crl_free(crl);
        return MBEDTLS_ERR_X509_INVALID_FORMAT;
    }

    if (len != (size_t) (end - p)) {
        mbedtls_x509_crl_free(crl);
        return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_FORMAT,
                                 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH);
    }

    /*
     * TBSCertList  ::=  SEQUENCE  {
     */
    crl->tbs.p = p;

    if ((ret = mbedtls_asn1_get_tag(&p, end, &len,
                                    MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE)) != 0) {
        mbedtls_x509_crl_free(crl);
        return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_FORMAT, ret);
    }

    end = p + len;
    crl->tbs.len = end - crl->tbs.p;

    /*
     * Version  ::=  INTEGER  OPTIONAL {  v1(0), v2(1)  }
     *               -- if present, MUST be v2
     *
     * signature            AlgorithmIdentifier
     */
    if ((ret = x509_crl_get_version(&p, end, &crl->version)) != 0 ||
        (ret = mbedtls_x509_get_alg(&p, end, &crl->sig_oid, &sig_params1)) != 0) {
        mbedtls_x509_crl_free(crl);
        return ret;
    }

    if (crl->version < 0 || crl->version > 1) {
        mbedtls_x509_crl_free(crl);
        return MBEDTLS_ERR_X509_UNKNOWN_VERSION;
    }

    crl->version++;

    if ((ret = mbedtls_x509_get_sig_alg(&crl->sig_oid, &sig_params1,
                                        &crl->sig_md, &crl->sig_pk,
                                        &crl->sig_opts)) != 0) {
        mbedtls_x509_crl_free(crl);
        return MBEDTLS_ERR_X509_UNKNOWN_SIG_ALG;
    }

    /*
     * issuer               Name
     */
    crl->issuer_raw.p = p;

    if ((ret = mbedtls_asn1_get_tag(&p, end, &len,
                                    MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE)) != 0) {
        mbedtls_x509_crl_free(crl);
        return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_FORMAT, ret);
    }

    if ((ret = mbedtls_x509_get_name(&p, p + len, &crl->issuer)) != 0) {
        mbedtls_x509_crl_free(crl);
        return ret;
    }

    crl->issuer_raw.len = p - crl->issuer_raw.p;

    /*
     * thisUpdate          Time
     * nextUpdate          Time OPTIONAL
     */
    if ((ret = mbedtls_x509_get_time(&p, end, &crl->this_update)) != 0) {
        mbedtls_x509_crl_free(crl);
        return ret;
    }

    if ((ret = mbedtls_x509_get_time(&p, end, &crl->next_update)) != 0) {
        if (ret != (MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_DATE,
                                      MBEDTLS_ERR_ASN1_UNEXPECTED_TAG)) &&
            ret != (MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_DATE,
                                      MBEDTLS_ERR_ASN1_OUT_OF_DATA))) {
            mbedtls_x509_crl_free(crl);
            return ret;
        }
    }

    /*
     * revokedCertificates    SEQUENCE OF SEQUENCE   {
     *      userCertificate        CertificateSerialNumber,
     *      revocationDate         Time,
     *      crlEntryExtensions     Extensions OPTIONAL
     *                                   -- if present, MUST be v2
     *                        } OPTIONAL
     */
    if ((ret = x509_get_entries(&p, end, &crl->entry)) != 0) {
        mbedtls_x509_crl_free(crl);
        return ret;
    }

    /*
     * crlExtensions          EXPLICIT Extensions OPTIONAL
     *                              -- if present, MUST be v2
     */
    if (crl->version == 2) {
        ret = x509_get_crl_ext(&p, end, &crl->crl_ext);

        if (ret != 0) {
            mbedtls_x509_crl_free(crl);
            return ret;
        }
    }

    if (p != end) {
        mbedtls_x509_crl_free(crl);
        return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_FORMAT,
                                 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH);
    }

    end = crl->raw.p + crl->raw.len;

    /*
     *  signatureAlgorithm   AlgorithmIdentifier,
     *  signatureValue       BIT STRING
     */
    if ((ret = mbedtls_x509_get_alg(&p, end, &sig_oid2, &sig_params2)) != 0) {
        mbedtls_x509_crl_free(crl);
        return ret;
    }

    if (crl->sig_oid.len != sig_oid2.len ||
        memcmp(crl->sig_oid.p, sig_oid2.p, crl->sig_oid.len) != 0 ||
        sig_params1.len != sig_params2.len ||
        (sig_params1.len != 0 &&
         memcmp(sig_params1.p, sig_params2.p, sig_params1.len) != 0)) {
        mbedtls_x509_crl_free(crl);
        return MBEDTLS_ERR_X509_SIG_MISMATCH;
    }

    if ((ret = mbedtls_x509_get_sig(&p, end, &crl->sig)) != 0) {
        mbedtls_x509_crl_free(crl);
        return ret;
    }

    if (p != end) {
        mbedtls_x509_crl_free(crl);
        return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_FORMAT,
                                 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH);
    }

    return 0;
}

/*
 * Parse one or more CRLs and add them to the chained list
 */
int mbedtls_x509_crl_parse(mbedtls_x509_crl *chain, const unsigned char *buf, size_t buflen)
{
#if defined(MBEDTLS_PEM_PARSE_C)
    int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
    size_t use_len = 0;
    mbedtls_pem_context pem;
    int is_pem = 0;

    if (chain == NULL || buf == NULL) {
        return MBEDTLS_ERR_X509_BAD_INPUT_DATA;
    }

    do {
        mbedtls_pem_init(&pem);

        // Avoid calling mbedtls_pem_read_buffer() on non-null-terminated
        // string
        if (buflen == 0 || buf[buflen - 1] != '\0') {
            ret = MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT;
        } else {
            ret = mbedtls_pem_read_buffer(&pem,
                                          "-----BEGIN X509 CRL-----",
                                          "-----END X509 CRL-----",
                                          buf, NULL, 0, &use_len);
        }

        if (ret == 0) {
            /*
             * Was PEM encoded
             */
            is_pem = 1;

            buflen -= use_len;
            buf += use_len;

            if ((ret = mbedtls_x509_crl_parse_der(chain,
                                                  pem.buf, pem.buflen)) != 0) {
                mbedtls_pem_free(&pem);
                return ret;
            }
        } else if (is_pem) {
            mbedtls_pem_free(&pem);
            return ret;
        }

        mbedtls_pem_free(&pem);
    }
    /* In the PEM case, buflen is 1 at the end, for the terminated NULL byte.
     * And a valid CRL cannot be less than 1 byte anyway. */
    while (is_pem && buflen > 1);

    if (is_pem) {
        return 0;
    } else
#endif /* MBEDTLS_PEM_PARSE_C */
    return mbedtls_x509_crl_parse_der(chain, buf, buflen);
}

#if defined(MBEDTLS_FS_IO)
/*
 * Load one or more CRLs and add them to the chained list
 */
int mbedtls_x509_crl_parse_file(mbedtls_x509_crl *chain, const char *path)
{
    int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
    size_t n;
    unsigned char *buf;

    if ((ret = mbedtls_pk_load_file(path, &buf, &n)) != 0) {
        return ret;
    }

    ret = mbedtls_x509_crl_parse(chain, buf, n);

    mbedtls_platform_zeroize(buf, n);
    mbedtls_free(buf);

    return ret;
}
#endif /* MBEDTLS_FS_IO */

/*
 * Return an informational string about the certificate.
 */
#define BEFORE_COLON    14
#define BC              "14"
/*
 * Return an informational string about the CRL.
 */
int mbedtls_x509_crl_info(char *buf, size_t size, const char *prefix,
                          const mbedtls_x509_crl *crl)
{
    int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
    size_t n;
    char *p;
    const mbedtls_x509_crl_entry *entry;

    p = buf;
    n = size;

    ret = mbedtls_snprintf(p, n, "%sCRL version   : %d",
                           prefix, crl->version);
    MBEDTLS_X509_SAFE_SNPRINTF;

    ret = mbedtls_snprintf(p, n, "\n%sissuer name   : ", prefix);
    MBEDTLS_X509_SAFE_SNPRINTF;
    ret = mbedtls_x509_dn_gets(p, n, &crl->issuer);
    MBEDTLS_X509_SAFE_SNPRINTF;

    ret = mbedtls_snprintf(p, n, "\n%sthis update   : " \
                                 "%04d-%02d-%02d %02d:%02d:%02d", prefix,
                           crl->this_update.year, crl->this_update.mon,
                           crl->this_update.day,  crl->this_update.hour,
                           crl->this_update.min,  crl->this_update.sec);
    MBEDTLS_X509_SAFE_SNPRINTF;

    ret = mbedtls_snprintf(p, n, "\n%snext update   : " \
                                 "%04d-%02d-%02d %02d:%02d:%02d", prefix,
                           crl->next_update.year, crl->next_update.mon,
                           crl->next_update.day,  crl->next_update.hour,
                           crl->next_update.min,  crl->next_update.sec);
    MBEDTLS_X509_SAFE_SNPRINTF;

    entry = &crl->entry;

    ret = mbedtls_snprintf(p, n, "\n%sRevoked certificates:",
                           prefix);
    MBEDTLS_X509_SAFE_SNPRINTF;

    while (entry != NULL && entry->raw.len != 0) {
        ret = mbedtls_snprintf(p, n, "\n%sserial number: ",
                               prefix);
        MBEDTLS_X509_SAFE_SNPRINTF;

        ret = mbedtls_x509_serial_gets(p, n, &entry->serial);
        MBEDTLS_X509_SAFE_SNPRINTF;

        ret = mbedtls_snprintf(p, n, " revocation date: " \
                                     "%04d-%02d-%02d %02d:%02d:%02d",
                               entry->revocation_date.year, entry->revocation_date.mon,
                               entry->revocation_date.day,  entry->revocation_date.hour,
                               entry->revocation_date.min,  entry->revocation_date.sec);
        MBEDTLS_X509_SAFE_SNPRINTF;

        entry = entry->next;
    }

    ret = mbedtls_snprintf(p, n, "\n%ssigned using  : ", prefix);
    MBEDTLS_X509_SAFE_SNPRINTF;

    ret = mbedtls_x509_sig_alg_gets(p, n, &crl->sig_oid, crl->sig_pk, crl->sig_md,
                                    crl->sig_opts);
    MBEDTLS_X509_SAFE_SNPRINTF;

    ret = mbedtls_snprintf(p, n, "\n");
    MBEDTLS_X509_SAFE_SNPRINTF;

    return (int) (size - n);
}

/*
 * Initialize a CRL chain
 */
void mbedtls_x509_crl_init(mbedtls_x509_crl *crl)
{
    memset(crl, 0, sizeof(mbedtls_x509_crl));
}

/*
 * Unallocate all CRL data
 */
void mbedtls_x509_crl_free(mbedtls_x509_crl *crl)
{
    mbedtls_x509_crl *crl_cur = crl;
    mbedtls_x509_crl *crl_prv;
    mbedtls_x509_name *name_cur;
    mbedtls_x509_name *name_prv;
    mbedtls_x509_crl_entry *entry_cur;
    mbedtls_x509_crl_entry *entry_prv;

    if (crl == NULL) {
        return;
    }

    do {
#if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT)
        mbedtls_free(crl_cur->sig_opts);
#endif

        name_cur = crl_cur->issuer.next;
        while (name_cur != NULL) {
            name_prv = name_cur;
            name_cur = name_cur->next;
            mbedtls_platform_zeroize(name_prv, sizeof(mbedtls_x509_name));
            mbedtls_free(name_prv);
        }

        entry_cur = crl_cur->entry.next;
        while (entry_cur != NULL) {
            entry_prv = entry_cur;
            entry_cur = entry_cur->next;
            mbedtls_platform_zeroize(entry_prv,
                                     sizeof(mbedtls_x509_crl_entry));
            mbedtls_free(entry_prv);
        }

        if (crl_cur->raw.p != NULL) {
            mbedtls_platform_zeroize(crl_cur->raw.p, crl_cur->raw.len);
            mbedtls_free(crl_cur->raw.p);
        }

        crl_cur = crl_cur->next;
    } while (crl_cur != NULL);

    crl_cur = crl;
    do {
        crl_prv = crl_cur;
        crl_cur = crl_cur->next;

        mbedtls_platform_zeroize(crl_prv, sizeof(mbedtls_x509_crl));
        if (crl_prv != crl) {
            mbedtls_free(crl_prv);
        }
    } while (crl_cur != NULL);
}

#endif /* MBEDTLS_X509_CRL_PARSE_C */

Coverage Report

Created: 2025-07-01 06:54

Line	Count	Source (jump to first uncovered line)
1		/*
2		* X.509 Certificate Revocation List (CRL) parsing
3		*
4		* Copyright The Mbed TLS Contributors
5		* SPDX-License-Identifier: Apache-2.0 OR GPL-2.0-or-later
6		*/
7		/*
8		* The ITU-T X.509 standard defines a certificate format for PKI.
9		*
10		* http://www.ietf.org/rfc/rfc5280.txt (Certificates and CRLs)
11		* http://www.ietf.org/rfc/rfc3279.txt (Alg IDs for CRLs)
12		* http://www.ietf.org/rfc/rfc2986.txt (CSRs, aka PKCS#10)
13		*
14		* http://www.itu.int/ITU-T/studygroups/com17/languages/X.680-0207.pdf
15		* http://www.itu.int/ITU-T/studygroups/com17/languages/X.690-0207.pdf
16		*/
17
18		#include "common.h"
19
20		#if defined(MBEDTLS_X509_CRL_PARSE_C)
21
22		#include "mbedtls/x509_crl.h"
23		#include "mbedtls/error.h"
24		#include "mbedtls/oid.h"
25		#include "mbedtls/platform_util.h"
26
27		#include <string.h>
28
29		#if defined(MBEDTLS_PEM_PARSE_C)
30		#include "mbedtls/pem.h"
31		#endif
32
33		#include "mbedtls/platform.h"
34
35		#if defined(MBEDTLS_HAVE_TIME)
36		#if defined(_WIN32) && !defined(EFIX64) && !defined(EFI32)
37		#include <windows.h>
38		#else
39		#include <time.h>
40		#endif
41		#endif
42
43		#if defined(MBEDTLS_FS_IO) \|\| defined(EFIX64) \|\| defined(EFI32)
44		#include <stdio.h>
45		#endif
46
47		/*
48		* Version ::= INTEGER { v1(0), v2(1) }
49		*/
50		static int x509_crl_get_version(unsigned char **p,
51		const unsigned char *end,
52		int *ver)
53	0	{
54	0	int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
55
56	0	if ((ret = mbedtls_asn1_get_int(p, end, ver)) != 0) {
57	0	if (ret == MBEDTLS_ERR_ASN1_UNEXPECTED_TAG) {
58	0	*ver = 0;
59	0	return 0;
60	0	}
61
62	0	return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_VERSION, ret);
63	0	}
64
65	0	return 0;
66	0	}
67
68		/*
69		* X.509 CRL v2 extensions
70		*
71		* We currently don't parse any extension's content, but we do check that the
72		* list of extensions is well-formed and abort on critical extensions (that
73		* are unsupported as we don't support any extension so far)
74		*/
75		static int x509_get_crl_ext(unsigned char **p,
76		const unsigned char *end,
77		mbedtls_x509_buf *ext)
78	0	{
79	0	int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
80
81	0	if (*p == end) {
82	0	return 0;
83	0	}
84
85		/*
86		* crlExtensions [0] EXPLICIT Extensions OPTIONAL
87		* -- if present, version MUST be v2
88		*/
89	0	if ((ret = mbedtls_x509_get_ext(p, end, ext, 0)) != 0) {
90	0	return ret;
91	0	}
92
93	0	end = ext->p + ext->len;
94
95	0	while (*p < end) {
96		/*
97		* Extension ::= SEQUENCE {
98		* extnID OBJECT IDENTIFIER,
99		* critical BOOLEAN DEFAULT FALSE,
100		* extnValue OCTET STRING }
101		*/
102	0	int is_critical = 0;
103	0	const unsigned char *end_ext_data;
104	0	size_t len;
105
106		/* Get enclosing sequence tag */
107	0	if ((ret = mbedtls_asn1_get_tag(p, end, &len,
108	0	MBEDTLS_ASN1_CONSTRUCTED \| MBEDTLS_ASN1_SEQUENCE)) != 0) {
109	0	return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret);
110	0	}
111
112	0	end_ext_data = *p + len;
113
114		/* Get OID (currently ignored) */
115	0	if ((ret = mbedtls_asn1_get_tag(p, end_ext_data, &len,
116	0	MBEDTLS_ASN1_OID)) != 0) {
117	0	return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret);
118	0	}
119	0	*p += len;
120
121		/* Get optional critical */
122	0	if ((ret = mbedtls_asn1_get_bool(p, end_ext_data,
123	0	&is_critical)) != 0 &&
124	0	(ret != MBEDTLS_ERR_ASN1_UNEXPECTED_TAG)) {
125	0	return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret);
126	0	}
127
128		/* Data should be octet string type */
129	0	if ((ret = mbedtls_asn1_get_tag(p, end_ext_data, &len,
130	0	MBEDTLS_ASN1_OCTET_STRING)) != 0) {
131	0	return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret);
132	0	}
133
134		/* Ignore data so far and just check its length */
135	0	*p += len;
136	0	if (*p != end_ext_data) {
137	0	return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS,
138	0	MBEDTLS_ERR_ASN1_LENGTH_MISMATCH);
139	0	}
140
141		/* Abort on (unsupported) critical extensions */
142	0	if (is_critical) {
143	0	return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS,
144	0	MBEDTLS_ERR_ASN1_UNEXPECTED_TAG);
145	0	}
146	0	}
147
148	0	if (*p != end) {
149	0	return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS,
150	0	MBEDTLS_ERR_ASN1_LENGTH_MISMATCH);
151	0	}
152
153	0	return 0;
154	0	}
155
156		/*
157		* X.509 CRL v2 entry extensions (no extensions parsed yet.)
158		*/
159		static int x509_get_crl_entry_ext(unsigned char **p,
160		const unsigned char *end,
161		mbedtls_x509_buf *ext)
162	0	{
163	0	int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
164	0	size_t len = 0;
165
166		/* OPTIONAL */
167	0	if (end <= *p) {
168	0	return 0;
169	0	}
170
171	0	ext->tag = **p;
172	0	ext->p = *p;
173
174		/*
175		* Get CRL-entry extension sequence header
176		* crlEntryExtensions Extensions OPTIONAL -- if present, MUST be v2
177		*/
178	0	if ((ret = mbedtls_asn1_get_tag(p, end, &ext->len,
179	0	MBEDTLS_ASN1_CONSTRUCTED \| MBEDTLS_ASN1_SEQUENCE)) != 0) {
180	0	if (ret == MBEDTLS_ERR_ASN1_UNEXPECTED_TAG) {
181	0	ext->p = NULL;
182	0	return 0;
183	0	}
184	0	return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret);
185	0	}
186
187	0	end = *p + ext->len;
188
189	0	if (end != *p + ext->len) {
190	0	return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS,
191	0	MBEDTLS_ERR_ASN1_LENGTH_MISMATCH);
192	0	}
193
194	0	while (*p < end) {
195	0	if ((ret = mbedtls_asn1_get_tag(p, end, &len,
196	0	MBEDTLS_ASN1_CONSTRUCTED \| MBEDTLS_ASN1_SEQUENCE)) != 0) {
197	0	return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS, ret);
198	0	}
199
200	0	*p += len;
201	0	}
202
203	0	if (*p != end) {
204	0	return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_EXTENSIONS,
205	0	MBEDTLS_ERR_ASN1_LENGTH_MISMATCH);
206	0	}
207
208	0	return 0;
209	0	}
210
211		/*
212		* X.509 CRL Entries
213		*/
214		static int x509_get_entries(unsigned char **p,
215		const unsigned char *end,
216		mbedtls_x509_crl_entry *entry)
217	0	{
218	0	int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
219	0	size_t entry_len;
220	0	mbedtls_x509_crl_entry *cur_entry = entry;
221
222	0	if (*p == end) {
223	0	return 0;
224	0	}
225
226	0	if ((ret = mbedtls_asn1_get_tag(p, end, &entry_len,
227	0	MBEDTLS_ASN1_SEQUENCE \| MBEDTLS_ASN1_CONSTRUCTED)) != 0) {
228	0	if (ret == MBEDTLS_ERR_ASN1_UNEXPECTED_TAG) {
229	0	return 0;
230	0	}
231
232	0	return ret;
233	0	}
234
235	0	end = *p + entry_len;
236
237	0	while (*p < end) {
238	0	size_t len2;
239	0	const unsigned char *end2;
240
241	0	cur_entry->raw.tag = **p;
242	0	if ((ret = mbedtls_asn1_get_tag(p, end, &len2,
243	0	MBEDTLS_ASN1_SEQUENCE \| MBEDTLS_ASN1_CONSTRUCTED)) != 0) {
244	0	return ret;
245	0	}
246
247	0	cur_entry->raw.p = *p;
248	0	cur_entry->raw.len = len2;
249	0	end2 = *p + len2;
250
251	0	if ((ret = mbedtls_x509_get_serial(p, end2, &cur_entry->serial)) != 0) {
252	0	return ret;
253	0	}
254
255	0	if ((ret = mbedtls_x509_get_time(p, end2,
256	0	&cur_entry->revocation_date)) != 0) {
257	0	return ret;
258	0	}
259
260	0	if ((ret = x509_get_crl_entry_ext(p, end2,
261	0	&cur_entry->entry_ext)) != 0) {
262	0	return ret;
263	0	}
264
265	0	if (*p < end) {
266	0	cur_entry->next = mbedtls_calloc(1, sizeof(mbedtls_x509_crl_entry));
267
268	0	if (cur_entry->next == NULL) {
269	0	return MBEDTLS_ERR_X509_ALLOC_FAILED;
270	0	}
271
272	0	cur_entry = cur_entry->next;
273	0	}
274	0	}
275
276	0	return 0;
277	0	}
278
279		/*
280		* Parse one CRLs in DER format and append it to the chained list
281		*/
282		int mbedtls_x509_crl_parse_der(mbedtls_x509_crl *chain,
283		const unsigned char *buf, size_t buflen)
284	0	{
285	0	int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
286	0	size_t len;
287	0	unsigned char p = NULL, end = NULL;
288	0	mbedtls_x509_buf sig_params1, sig_params2, sig_oid2;
289	0	mbedtls_x509_crl *crl = chain;
290
291		/*
292		* Check for valid input
293		*/
294	0	if (crl == NULL \|\| buf == NULL) {
295	0	return MBEDTLS_ERR_X509_BAD_INPUT_DATA;
296	0	}
297
298	0	memset(&sig_params1, 0, sizeof(mbedtls_x509_buf));
299	0	memset(&sig_params2, 0, sizeof(mbedtls_x509_buf));
300	0	memset(&sig_oid2, 0, sizeof(mbedtls_x509_buf));
301
302		/*
303		* Add new CRL on the end of the chain if needed.
304		*/
305	0	while (crl->version != 0 && crl->next != NULL) {
306	0	crl = crl->next;
307	0	}
308
309	0	if (crl->version != 0 && crl->next == NULL) {
310	0	crl->next = mbedtls_calloc(1, sizeof(mbedtls_x509_crl));
311
312	0	if (crl->next == NULL) {
313	0	mbedtls_x509_crl_free(crl);
314	0	return MBEDTLS_ERR_X509_ALLOC_FAILED;
315	0	}
316
317	0	mbedtls_x509_crl_init(crl->next);
318	0	crl = crl->next;
319	0	}
320
321		/*
322		* Copy raw DER-encoded CRL
323		*/
324	0	if (buflen == 0) {
325	0	return MBEDTLS_ERR_X509_INVALID_FORMAT;
326	0	}
327
328	0	p = mbedtls_calloc(1, buflen);
329	0	if (p == NULL) {
330	0	return MBEDTLS_ERR_X509_ALLOC_FAILED;
331	0	}
332
333	0	memcpy(p, buf, buflen);
334
335	0	crl->raw.p = p;
336	0	crl->raw.len = buflen;
337
338	0	end = p + buflen;
339
340		/*
341		* CertificateList ::= SEQUENCE {
342		* tbsCertList TBSCertList,
343		* signatureAlgorithm AlgorithmIdentifier,
344		* signatureValue BIT STRING }
345		*/
346	0	if ((ret = mbedtls_asn1_get_tag(&p, end, &len,
347	0	MBEDTLS_ASN1_CONSTRUCTED \| MBEDTLS_ASN1_SEQUENCE)) != 0) {
348	0	mbedtls_x509_crl_free(crl);
349	0	return MBEDTLS_ERR_X509_INVALID_FORMAT;
350	0	}
351
352	0	if (len != (size_t) (end - p)) {
353	0	mbedtls_x509_crl_free(crl);
354	0	return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_FORMAT,
355	0	MBEDTLS_ERR_ASN1_LENGTH_MISMATCH);
356	0	}
357
358		/*
359		* TBSCertList ::= SEQUENCE {
360		*/
361	0	crl->tbs.p = p;
362
363	0	if ((ret = mbedtls_asn1_get_tag(&p, end, &len,
364	0	MBEDTLS_ASN1_CONSTRUCTED \| MBEDTLS_ASN1_SEQUENCE)) != 0) {
365	0	mbedtls_x509_crl_free(crl);
366	0	return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_FORMAT, ret);
367	0	}
368
369	0	end = p + len;
370	0	crl->tbs.len = end - crl->tbs.p;
371
372		/*
373		* Version ::= INTEGER OPTIONAL { v1(0), v2(1) }
374		* -- if present, MUST be v2
375		*
376		* signature AlgorithmIdentifier
377		*/
378	0	if ((ret = x509_crl_get_version(&p, end, &crl->version)) != 0 \|\|
379	0	(ret = mbedtls_x509_get_alg(&p, end, &crl->sig_oid, &sig_params1)) != 0) {
380	0	mbedtls_x509_crl_free(crl);
381	0	return ret;
382	0	}
383
384	0	if (crl->version < 0 \|\| crl->version > 1) {
385	0	mbedtls_x509_crl_free(crl);
386	0	return MBEDTLS_ERR_X509_UNKNOWN_VERSION;
387	0	}
388
389	0	crl->version++;
390
391	0	if ((ret = mbedtls_x509_get_sig_alg(&crl->sig_oid, &sig_params1,
392	0	&crl->sig_md, &crl->sig_pk,
393	0	&crl->sig_opts)) != 0) {
394	0	mbedtls_x509_crl_free(crl);
395	0	return MBEDTLS_ERR_X509_UNKNOWN_SIG_ALG;
396	0	}
397
398		/*
399		* issuer Name
400		*/
401	0	crl->issuer_raw.p = p;
402
403	0	if ((ret = mbedtls_asn1_get_tag(&p, end, &len,
404	0	MBEDTLS_ASN1_CONSTRUCTED \| MBEDTLS_ASN1_SEQUENCE)) != 0) {
405	0	mbedtls_x509_crl_free(crl);
406	0	return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_FORMAT, ret);
407	0	}
408
409	0	if ((ret = mbedtls_x509_get_name(&p, p + len, &crl->issuer)) != 0) {
410	0	mbedtls_x509_crl_free(crl);
411	0	return ret;
412	0	}
413
414	0	crl->issuer_raw.len = p - crl->issuer_raw.p;
415
416		/*
417		* thisUpdate Time
418		* nextUpdate Time OPTIONAL
419		*/
420	0	if ((ret = mbedtls_x509_get_time(&p, end, &crl->this_update)) != 0) {
421	0	mbedtls_x509_crl_free(crl);
422	0	return ret;
423	0	}
424
425	0	if ((ret = mbedtls_x509_get_time(&p, end, &crl->next_update)) != 0) {
426	0	if (ret != (MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_DATE,
427	0	MBEDTLS_ERR_ASN1_UNEXPECTED_TAG)) &&
428	0	ret != (MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_DATE,
429	0	MBEDTLS_ERR_ASN1_OUT_OF_DATA))) {
430	0	mbedtls_x509_crl_free(crl);
431	0	return ret;
432	0	}
433	0	}
434
435		/*
436		* revokedCertificates SEQUENCE OF SEQUENCE {
437		* userCertificate CertificateSerialNumber,
438		* revocationDate Time,
439		* crlEntryExtensions Extensions OPTIONAL
440		* -- if present, MUST be v2
441		* } OPTIONAL
442		*/
443	0	if ((ret = x509_get_entries(&p, end, &crl->entry)) != 0) {
444	0	mbedtls_x509_crl_free(crl);
445	0	return ret;
446	0	}
447
448		/*
449		* crlExtensions EXPLICIT Extensions OPTIONAL
450		* -- if present, MUST be v2
451		*/
452	0	if (crl->version == 2) {
453	0	ret = x509_get_crl_ext(&p, end, &crl->crl_ext);
454
455	0	if (ret != 0) {
456	0	mbedtls_x509_crl_free(crl);
457	0	return ret;
458	0	}
459	0	}
460
461	0	if (p != end) {
462	0	mbedtls_x509_crl_free(crl);
463	0	return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_FORMAT,
464	0	MBEDTLS_ERR_ASN1_LENGTH_MISMATCH);
465	0	}
466
467	0	end = crl->raw.p + crl->raw.len;
468
469		/*
470		* signatureAlgorithm AlgorithmIdentifier,
471		* signatureValue BIT STRING
472		*/
473	0	if ((ret = mbedtls_x509_get_alg(&p, end, &sig_oid2, &sig_params2)) != 0) {
474	0	mbedtls_x509_crl_free(crl);
475	0	return ret;
476	0	}
477
478	0	if (crl->sig_oid.len != sig_oid2.len \|\|
479	0	memcmp(crl->sig_oid.p, sig_oid2.p, crl->sig_oid.len) != 0 \|\|
480	0	sig_params1.len != sig_params2.len \|\|
481	0	(sig_params1.len != 0 &&
482	0	memcmp(sig_params1.p, sig_params2.p, sig_params1.len) != 0)) {
483	0	mbedtls_x509_crl_free(crl);
484	0	return MBEDTLS_ERR_X509_SIG_MISMATCH;
485	0	}
486
487	0	if ((ret = mbedtls_x509_get_sig(&p, end, &crl->sig)) != 0) {
488	0	mbedtls_x509_crl_free(crl);
489	0	return ret;
490	0	}
491
492	0	if (p != end) {
493	0	mbedtls_x509_crl_free(crl);
494	0	return MBEDTLS_ERROR_ADD(MBEDTLS_ERR_X509_INVALID_FORMAT,
495	0	MBEDTLS_ERR_ASN1_LENGTH_MISMATCH);
496	0	}
497
498	0	return 0;
499	0	}
500
501		/*
502		* Parse one or more CRLs and add them to the chained list
503		*/
504		int mbedtls_x509_crl_parse(mbedtls_x509_crl chain, const unsigned char buf, size_t buflen)
505	0	{
506	0	#if defined(MBEDTLS_PEM_PARSE_C)
507	0	int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
508	0	size_t use_len = 0;
509	0	mbedtls_pem_context pem;
510	0	int is_pem = 0;
511
512	0	if (chain == NULL \|\| buf == NULL) {
513	0	return MBEDTLS_ERR_X509_BAD_INPUT_DATA;
514	0	}
515
516	0	do {
517	0	mbedtls_pem_init(&pem);
518
519		// Avoid calling mbedtls_pem_read_buffer() on non-null-terminated
520		// string
521	0	if (buflen == 0 \|\| buf[buflen - 1] != '\0') {
522	0	ret = MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT;
523	0	} else {
524	0	ret = mbedtls_pem_read_buffer(&pem,
525	0	"-----BEGIN X509 CRL-----",
526	0	"-----END X509 CRL-----",
527	0	buf, NULL, 0, &use_len);
528	0	}
529
530	0	if (ret == 0) {
531		/*
532		* Was PEM encoded
533		*/
534	0	is_pem = 1;
535
536	0	buflen -= use_len;
537	0	buf += use_len;
538
539	0	if ((ret = mbedtls_x509_crl_parse_der(chain,
540	0	pem.buf, pem.buflen)) != 0) {
541	0	mbedtls_pem_free(&pem);
542	0	return ret;
543	0	}
544	0	} else if (is_pem) {
545	0	mbedtls_pem_free(&pem);
546	0	return ret;
547	0	}
548
549	0	mbedtls_pem_free(&pem);
550	0	}
551		/* In the PEM case, buflen is 1 at the end, for the terminated NULL byte.
552		* And a valid CRL cannot be less than 1 byte anyway. */
553	0	while (is_pem && buflen > 1);
554
555	0	if (is_pem) {
556	0	return 0;
557	0	} else
558	0	#endif /* MBEDTLS_PEM_PARSE_C */
559	0	return mbedtls_x509_crl_parse_der(chain, buf, buflen);
560	0	}
561
562		#if defined(MBEDTLS_FS_IO)
563		/*
564		* Load one or more CRLs and add them to the chained list
565		*/
566		int mbedtls_x509_crl_parse_file(mbedtls_x509_crl chain, const char path)
567	0	{
568	0	int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
569	0	size_t n;
570	0	unsigned char *buf;
571
572	0	if ((ret = mbedtls_pk_load_file(path, &buf, &n)) != 0) {
573	0	return ret;
574	0	}
575
576	0	ret = mbedtls_x509_crl_parse(chain, buf, n);
577
578	0	mbedtls_platform_zeroize(buf, n);
579	0	mbedtls_free(buf);
580
581	0	return ret;
582	0	}
583		#endif /* MBEDTLS_FS_IO */
584
585		/*
586		* Return an informational string about the certificate.
587		*/
588		#define BEFORE_COLON 14
589		#define BC "14"
590		/*
591		* Return an informational string about the CRL.
592		*/
593		int mbedtls_x509_crl_info(char buf, size_t size, const char prefix,
594		const mbedtls_x509_crl *crl)
595	0	{
596	0	int ret = MBEDTLS_ERR_ERROR_CORRUPTION_DETECTED;
597	0	size_t n;
598	0	char *p;
599	0	const mbedtls_x509_crl_entry *entry;
600
601	0	p = buf;
602	0	n = size;
603
604	0	ret = mbedtls_snprintf(p, n, "%sCRL version : %d",
605	0	prefix, crl->version);
606	0	MBEDTLS_X509_SAFE_SNPRINTF;
607
608	0	ret = mbedtls_snprintf(p, n, "\n%sissuer name : ", prefix);
609	0	MBEDTLS_X509_SAFE_SNPRINTF;
610	0	ret = mbedtls_x509_dn_gets(p, n, &crl->issuer);
611	0	MBEDTLS_X509_SAFE_SNPRINTF;
612
613	0	ret = mbedtls_snprintf(p, n, "\n%sthis update : " \
614	0	"%04d-%02d-%02d %02d:%02d:%02d", prefix,
615	0	crl->this_update.year, crl->this_update.mon,
616	0	crl->this_update.day, crl->this_update.hour,
617	0	crl->this_update.min, crl->this_update.sec);
618	0	MBEDTLS_X509_SAFE_SNPRINTF;
619
620	0	ret = mbedtls_snprintf(p, n, "\n%snext update : " \
621	0	"%04d-%02d-%02d %02d:%02d:%02d", prefix,
622	0	crl->next_update.year, crl->next_update.mon,
623	0	crl->next_update.day, crl->next_update.hour,
624	0	crl->next_update.min, crl->next_update.sec);
625	0	MBEDTLS_X509_SAFE_SNPRINTF;
626
627	0	entry = &crl->entry;
628
629	0	ret = mbedtls_snprintf(p, n, "\n%sRevoked certificates:",
630	0	prefix);
631	0	MBEDTLS_X509_SAFE_SNPRINTF;
632
633	0	while (entry != NULL && entry->raw.len != 0) {
634	0	ret = mbedtls_snprintf(p, n, "\n%sserial number: ",
635	0	prefix);
636	0	MBEDTLS_X509_SAFE_SNPRINTF;
637
638	0	ret = mbedtls_x509_serial_gets(p, n, &entry->serial);
639	0	MBEDTLS_X509_SAFE_SNPRINTF;
640
641	0	ret = mbedtls_snprintf(p, n, " revocation date: " \
642	0	"%04d-%02d-%02d %02d:%02d:%02d",
643	0	entry->revocation_date.year, entry->revocation_date.mon,
644	0	entry->revocation_date.day, entry->revocation_date.hour,
645	0	entry->revocation_date.min, entry->revocation_date.sec);
646	0	MBEDTLS_X509_SAFE_SNPRINTF;
647
648	0	entry = entry->next;
649	0	}
650
651	0	ret = mbedtls_snprintf(p, n, "\n%ssigned using : ", prefix);
652	0	MBEDTLS_X509_SAFE_SNPRINTF;
653
654	0	ret = mbedtls_x509_sig_alg_gets(p, n, &crl->sig_oid, crl->sig_pk, crl->sig_md,
655	0	crl->sig_opts);
656	0	MBEDTLS_X509_SAFE_SNPRINTF;
657
658	0	ret = mbedtls_snprintf(p, n, "\n");
659	0	MBEDTLS_X509_SAFE_SNPRINTF;
660
661	0	return (int) (size - n);
662	0	}
663
664		/*
665		* Initialize a CRL chain
666		*/
667		void mbedtls_x509_crl_init(mbedtls_x509_crl *crl)
668	0	{
669	0	memset(crl, 0, sizeof(mbedtls_x509_crl));
670	0	}
671
672		/*
673		* Unallocate all CRL data
674		*/
675		void mbedtls_x509_crl_free(mbedtls_x509_crl *crl)
676	0	{
677	0	mbedtls_x509_crl *crl_cur = crl;
678	0	mbedtls_x509_crl *crl_prv;
679	0	mbedtls_x509_name *name_cur;
680	0	mbedtls_x509_name *name_prv;
681	0	mbedtls_x509_crl_entry *entry_cur;
682	0	mbedtls_x509_crl_entry *entry_prv;
683
684	0	if (crl == NULL) {
685	0	return;
686	0	}
687
688	0	do {
689	0	#if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT)
690	0	mbedtls_free(crl_cur->sig_opts);
691	0	#endif
692
693	0	name_cur = crl_cur->issuer.next;
694	0	while (name_cur != NULL) {
695	0	name_prv = name_cur;
696	0	name_cur = name_cur->next;
697	0	mbedtls_platform_zeroize(name_prv, sizeof(mbedtls_x509_name));
698	0	mbedtls_free(name_prv);
699	0	}
700
701	0	entry_cur = crl_cur->entry.next;
702	0	while (entry_cur != NULL) {
703	0	entry_prv = entry_cur;
704	0	entry_cur = entry_cur->next;
705	0	mbedtls_platform_zeroize(entry_prv,
706	0	sizeof(mbedtls_x509_crl_entry));
707	0	mbedtls_free(entry_prv);
708	0	}
709
710	0	if (crl_cur->raw.p != NULL) {
711	0	mbedtls_platform_zeroize(crl_cur->raw.p, crl_cur->raw.len);
712	0	mbedtls_free(crl_cur->raw.p);
713	0	}
714
715	0	crl_cur = crl_cur->next;
716	0	} while (crl_cur != NULL);
717
718	0	crl_cur = crl;
719	0	do {
720	0	crl_prv = crl_cur;
721	0	crl_cur = crl_cur->next;
722
723	0	mbedtls_platform_zeroize(crl_prv, sizeof(mbedtls_x509_crl));
724	0	if (crl_prv != crl) {
725	0	mbedtls_free(crl_prv);
726	0	}
727	0	} while (crl_cur != NULL);
728	0	}
729
730		#endif /* MBEDTLS_X509_CRL_PARSE_C */