2009-01-03 21:22:43 +00:00
|
|
|
/*
|
|
|
|
* X.509 certificate and private key decoding
|
|
|
|
*
|
2010-07-18 10:13:04 +00:00
|
|
|
* Copyright (C) 2006-2010, Brainspark B.V.
|
2010-07-18 20:36:00 +00:00
|
|
|
*
|
|
|
|
* This file is part of PolarSSL (http://www.polarssl.org)
|
2010-07-18 10:13:04 +00:00
|
|
|
* Lead Maintainer: Paul Bakker <polarssl_maintainer at polarssl.org>
|
2010-07-18 20:36:00 +00:00
|
|
|
*
|
2009-07-28 17:23:11 +00:00
|
|
|
* All rights reserved.
|
2009-01-04 16:27:10 +00:00
|
|
|
*
|
2009-01-03 21:22:43 +00:00
|
|
|
* This program is free software; you can redistribute it and/or modify
|
|
|
|
* it under the terms of the GNU General Public License as published by
|
|
|
|
* the Free Software Foundation; either version 2 of the License, or
|
|
|
|
* (at your option) any later version.
|
|
|
|
*
|
|
|
|
* This program is distributed in the hope that it will be useful,
|
|
|
|
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
|
|
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
|
|
|
* GNU General Public License for more details.
|
|
|
|
*
|
|
|
|
* You should have received a copy of the GNU General Public License along
|
|
|
|
* with this program; if not, write to the Free Software Foundation, Inc.,
|
|
|
|
* 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
|
|
|
|
*/
|
|
|
|
/*
|
|
|
|
* The ITU-T X.509 standard defines a certificat format for PKI.
|
|
|
|
*
|
|
|
|
* http://www.ietf.org/rfc/rfc2459.txt
|
|
|
|
* http://www.ietf.org/rfc/rfc3279.txt
|
|
|
|
*
|
|
|
|
* ftp://ftp.rsasecurity.com/pub/pkcs/ascii/pkcs-1v2.asc
|
|
|
|
*
|
|
|
|
* http://www.itu.int/ITU-T/studygroups/com17/languages/X.680-0207.pdf
|
|
|
|
* http://www.itu.int/ITU-T/studygroups/com17/languages/X.690-0207.pdf
|
|
|
|
*/
|
|
|
|
|
2009-01-03 21:51:57 +00:00
|
|
|
#include "polarssl/config.h"
|
2009-01-03 21:22:43 +00:00
|
|
|
|
2009-01-03 21:51:57 +00:00
|
|
|
#if defined(POLARSSL_X509_PARSE_C)
|
2009-01-03 21:22:43 +00:00
|
|
|
|
2009-01-03 21:51:57 +00:00
|
|
|
#include "polarssl/x509.h"
|
2011-02-12 14:30:57 +00:00
|
|
|
#include "polarssl/pem.h"
|
2009-01-03 21:51:57 +00:00
|
|
|
#include "polarssl/des.h"
|
|
|
|
#include "polarssl/md2.h"
|
|
|
|
#include "polarssl/md4.h"
|
|
|
|
#include "polarssl/md5.h"
|
|
|
|
#include "polarssl/sha1.h"
|
2009-03-28 17:53:03 +00:00
|
|
|
#include "polarssl/sha2.h"
|
|
|
|
#include "polarssl/sha4.h"
|
2011-01-06 15:48:19 +00:00
|
|
|
#include "polarssl/dhm.h"
|
2009-01-03 21:22:43 +00:00
|
|
|
|
|
|
|
#include <string.h>
|
|
|
|
#include <stdlib.h>
|
|
|
|
#include <stdio.h>
|
|
|
|
#include <time.h>
|
|
|
|
|
|
|
|
/*
|
|
|
|
* ASN.1 DER decoding routines
|
|
|
|
*/
|
|
|
|
static int asn1_get_len( unsigned char **p,
|
2010-03-16 21:09:09 +00:00
|
|
|
const unsigned char *end,
|
2011-04-24 08:57:21 +00:00
|
|
|
size_t *len )
|
2009-01-03 21:22:43 +00:00
|
|
|
{
|
|
|
|
if( ( end - *p ) < 1 )
|
2009-01-03 21:51:57 +00:00
|
|
|
return( POLARSSL_ERR_ASN1_OUT_OF_DATA );
|
2009-01-03 21:22:43 +00:00
|
|
|
|
|
|
|
if( ( **p & 0x80 ) == 0 )
|
|
|
|
*len = *(*p)++;
|
|
|
|
else
|
|
|
|
{
|
|
|
|
switch( **p & 0x7F )
|
|
|
|
{
|
|
|
|
case 1:
|
|
|
|
if( ( end - *p ) < 2 )
|
2009-01-03 21:51:57 +00:00
|
|
|
return( POLARSSL_ERR_ASN1_OUT_OF_DATA );
|
2009-01-03 21:22:43 +00:00
|
|
|
|
|
|
|
*len = (*p)[1];
|
|
|
|
(*p) += 2;
|
|
|
|
break;
|
|
|
|
|
|
|
|
case 2:
|
|
|
|
if( ( end - *p ) < 3 )
|
2009-01-03 21:51:57 +00:00
|
|
|
return( POLARSSL_ERR_ASN1_OUT_OF_DATA );
|
2009-01-03 21:22:43 +00:00
|
|
|
|
|
|
|
*len = ( (*p)[1] << 8 ) | (*p)[2];
|
|
|
|
(*p) += 3;
|
|
|
|
break;
|
|
|
|
|
|
|
|
default:
|
2009-01-03 21:51:57 +00:00
|
|
|
return( POLARSSL_ERR_ASN1_INVALID_LENGTH );
|
2009-01-03 21:22:43 +00:00
|
|
|
break;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2011-04-24 08:57:21 +00:00
|
|
|
if( *len > (size_t) ( end - *p ) )
|
2009-01-03 21:51:57 +00:00
|
|
|
return( POLARSSL_ERR_ASN1_OUT_OF_DATA );
|
2009-01-03 21:22:43 +00:00
|
|
|
|
|
|
|
return( 0 );
|
|
|
|
}
|
|
|
|
|
|
|
|
static int asn1_get_tag( unsigned char **p,
|
2010-03-16 21:09:09 +00:00
|
|
|
const unsigned char *end,
|
2011-04-24 08:57:21 +00:00
|
|
|
size_t *len, int tag )
|
2009-01-03 21:22:43 +00:00
|
|
|
{
|
|
|
|
if( ( end - *p ) < 1 )
|
2009-01-03 21:51:57 +00:00
|
|
|
return( POLARSSL_ERR_ASN1_OUT_OF_DATA );
|
2009-01-03 21:22:43 +00:00
|
|
|
|
|
|
|
if( **p != tag )
|
2009-01-03 21:51:57 +00:00
|
|
|
return( POLARSSL_ERR_ASN1_UNEXPECTED_TAG );
|
2009-01-03 21:22:43 +00:00
|
|
|
|
|
|
|
(*p)++;
|
|
|
|
|
|
|
|
return( asn1_get_len( p, end, len ) );
|
|
|
|
}
|
|
|
|
|
|
|
|
static int asn1_get_bool( unsigned char **p,
|
2010-03-16 21:09:09 +00:00
|
|
|
const unsigned char *end,
|
2009-01-03 21:22:43 +00:00
|
|
|
int *val )
|
|
|
|
{
|
2011-04-24 08:57:21 +00:00
|
|
|
int ret;
|
|
|
|
size_t len;
|
2009-01-03 21:22:43 +00:00
|
|
|
|
|
|
|
if( ( ret = asn1_get_tag( p, end, &len, ASN1_BOOLEAN ) ) != 0 )
|
|
|
|
return( ret );
|
|
|
|
|
|
|
|
if( len != 1 )
|
2009-01-03 21:51:57 +00:00
|
|
|
return( POLARSSL_ERR_ASN1_INVALID_LENGTH );
|
2009-01-03 21:22:43 +00:00
|
|
|
|
|
|
|
*val = ( **p != 0 ) ? 1 : 0;
|
|
|
|
(*p)++;
|
|
|
|
|
|
|
|
return( 0 );
|
|
|
|
}
|
|
|
|
|
|
|
|
static int asn1_get_int( unsigned char **p,
|
2010-03-16 21:09:09 +00:00
|
|
|
const unsigned char *end,
|
2009-01-03 21:22:43 +00:00
|
|
|
int *val )
|
|
|
|
{
|
2011-04-24 08:57:21 +00:00
|
|
|
int ret;
|
|
|
|
size_t len;
|
2009-01-03 21:22:43 +00:00
|
|
|
|
|
|
|
if( ( ret = asn1_get_tag( p, end, &len, ASN1_INTEGER ) ) != 0 )
|
|
|
|
return( ret );
|
|
|
|
|
|
|
|
if( len > (int) sizeof( int ) || ( **p & 0x80 ) != 0 )
|
2009-01-03 21:51:57 +00:00
|
|
|
return( POLARSSL_ERR_ASN1_INVALID_LENGTH );
|
2009-01-03 21:22:43 +00:00
|
|
|
|
|
|
|
*val = 0;
|
|
|
|
|
|
|
|
while( len-- > 0 )
|
|
|
|
{
|
|
|
|
*val = ( *val << 8 ) | **p;
|
|
|
|
(*p)++;
|
|
|
|
}
|
|
|
|
|
|
|
|
return( 0 );
|
|
|
|
}
|
|
|
|
|
|
|
|
static int asn1_get_mpi( unsigned char **p,
|
2010-03-16 21:09:09 +00:00
|
|
|
const unsigned char *end,
|
2009-01-03 21:22:43 +00:00
|
|
|
mpi *X )
|
|
|
|
{
|
2011-04-24 08:57:21 +00:00
|
|
|
int ret;
|
|
|
|
size_t len;
|
2009-01-03 21:22:43 +00:00
|
|
|
|
|
|
|
if( ( ret = asn1_get_tag( p, end, &len, ASN1_INTEGER ) ) != 0 )
|
|
|
|
return( ret );
|
|
|
|
|
|
|
|
ret = mpi_read_binary( X, *p, len );
|
|
|
|
|
|
|
|
*p += len;
|
|
|
|
|
|
|
|
return( ret );
|
|
|
|
}
|
|
|
|
|
2011-01-15 16:57:55 +00:00
|
|
|
static int asn1_get_bitstring( unsigned char **p, const unsigned char *end,
|
|
|
|
x509_bitstring *bs)
|
|
|
|
{
|
|
|
|
int ret;
|
|
|
|
|
|
|
|
/* Certificate type is a single byte bitstring */
|
|
|
|
if( ( ret = asn1_get_tag( p, end, &bs->len, ASN1_BIT_STRING ) ) != 0 )
|
|
|
|
return( ret );
|
|
|
|
|
|
|
|
/* Check length, subtract one for actual bit string length */
|
|
|
|
if ( bs->len < 1 )
|
|
|
|
return( POLARSSL_ERR_ASN1_OUT_OF_DATA );
|
|
|
|
bs->len -= 1;
|
|
|
|
|
|
|
|
/* Get number of unused bits, ensure unused bits <= 7 */
|
|
|
|
bs->unused_bits = **p;
|
|
|
|
if( bs->unused_bits > 7 )
|
|
|
|
return( POLARSSL_ERR_ASN1_INVALID_LENGTH );
|
|
|
|
(*p)++;
|
|
|
|
|
|
|
|
/* Get actual bitstring */
|
|
|
|
bs->p = *p;
|
|
|
|
*p += bs->len;
|
|
|
|
|
|
|
|
if( *p != end )
|
|
|
|
return( POLARSSL_ERR_ASN1_LENGTH_MISMATCH );
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Parses and splits an ASN.1 "SEQUENCE OF <tag>"
|
|
|
|
*/
|
|
|
|
static int asn1_get_sequence_of( unsigned char **p,
|
|
|
|
const unsigned char *end,
|
|
|
|
x509_sequence *cur,
|
|
|
|
int tag)
|
|
|
|
{
|
2011-04-24 08:57:21 +00:00
|
|
|
int ret;
|
|
|
|
size_t len;
|
2011-01-15 16:57:55 +00:00
|
|
|
x509_buf *buf;
|
|
|
|
|
|
|
|
/* Get main sequence tag */
|
|
|
|
if( ( ret = asn1_get_tag( p, end, &len,
|
|
|
|
ASN1_CONSTRUCTED | ASN1_SEQUENCE ) ) != 0 )
|
|
|
|
return( ret );
|
|
|
|
|
|
|
|
if( *p + len != end )
|
|
|
|
return( POLARSSL_ERR_ASN1_LENGTH_MISMATCH );
|
|
|
|
|
|
|
|
while( *p < end )
|
|
|
|
{
|
|
|
|
buf = &(cur->buf);
|
|
|
|
buf->tag = **p;
|
|
|
|
|
|
|
|
if( ( ret = asn1_get_tag( p, end, &buf->len, tag ) ) != 0 )
|
|
|
|
return( ret );
|
|
|
|
|
|
|
|
buf->p = *p;
|
|
|
|
*p += buf->len;
|
|
|
|
|
|
|
|
/* Allocate and assign next pointer */
|
|
|
|
if (*p < end)
|
|
|
|
{
|
|
|
|
cur->next = (x509_sequence *) malloc(
|
|
|
|
sizeof( x509_sequence ) );
|
|
|
|
|
|
|
|
if( cur->next == NULL )
|
|
|
|
return( 1 );
|
|
|
|
|
|
|
|
cur = cur->next;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Set final sequence entry's next pointer to NULL */
|
|
|
|
cur->next = NULL;
|
|
|
|
|
|
|
|
if( *p != end )
|
|
|
|
return( POLARSSL_ERR_ASN1_LENGTH_MISMATCH );
|
|
|
|
|
|
|
|
return( 0 );
|
|
|
|
}
|
|
|
|
|
2009-01-03 21:22:43 +00:00
|
|
|
/*
|
|
|
|
* Version ::= INTEGER { v1(0), v2(1), v3(2) }
|
|
|
|
*/
|
|
|
|
static int x509_get_version( unsigned char **p,
|
2010-03-16 21:09:09 +00:00
|
|
|
const unsigned char *end,
|
2009-01-03 21:22:43 +00:00
|
|
|
int *ver )
|
|
|
|
{
|
2011-04-24 08:57:21 +00:00
|
|
|
int ret;
|
|
|
|
size_t len;
|
2009-01-03 21:22:43 +00:00
|
|
|
|
|
|
|
if( ( ret = asn1_get_tag( p, end, &len,
|
|
|
|
ASN1_CONTEXT_SPECIFIC | ASN1_CONSTRUCTED | 0 ) ) != 0 )
|
|
|
|
{
|
2009-01-03 21:51:57 +00:00
|
|
|
if( ret == POLARSSL_ERR_ASN1_UNEXPECTED_TAG )
|
2009-01-03 21:22:43 +00:00
|
|
|
return( *ver = 0 );
|
|
|
|
|
|
|
|
return( ret );
|
|
|
|
}
|
|
|
|
|
|
|
|
end = *p + len;
|
|
|
|
|
|
|
|
if( ( ret = asn1_get_int( p, end, ver ) ) != 0 )
|
2009-01-03 21:51:57 +00:00
|
|
|
return( POLARSSL_ERR_X509_CERT_INVALID_VERSION | ret );
|
2009-01-03 21:22:43 +00:00
|
|
|
|
|
|
|
if( *p != end )
|
2009-01-03 21:51:57 +00:00
|
|
|
return( POLARSSL_ERR_X509_CERT_INVALID_VERSION |
|
|
|
|
POLARSSL_ERR_ASN1_LENGTH_MISMATCH );
|
2009-01-03 21:22:43 +00:00
|
|
|
|
|
|
|
return( 0 );
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* CertificateSerialNumber ::= INTEGER
|
|
|
|
*/
|
|
|
|
static int x509_get_serial( unsigned char **p,
|
2010-03-16 21:09:09 +00:00
|
|
|
const unsigned char *end,
|
2009-01-03 21:22:43 +00:00
|
|
|
x509_buf *serial )
|
|
|
|
{
|
|
|
|
int ret;
|
|
|
|
|
|
|
|
if( ( end - *p ) < 1 )
|
2009-01-03 21:51:57 +00:00
|
|
|
return( POLARSSL_ERR_X509_CERT_INVALID_SERIAL |
|
|
|
|
POLARSSL_ERR_ASN1_OUT_OF_DATA );
|
2009-01-03 21:22:43 +00:00
|
|
|
|
|
|
|
if( **p != ( ASN1_CONTEXT_SPECIFIC | ASN1_PRIMITIVE | 2 ) &&
|
|
|
|
**p != ASN1_INTEGER )
|
2009-01-03 21:51:57 +00:00
|
|
|
return( POLARSSL_ERR_X509_CERT_INVALID_SERIAL |
|
|
|
|
POLARSSL_ERR_ASN1_UNEXPECTED_TAG );
|
2009-01-03 21:22:43 +00:00
|
|
|
|
|
|
|
serial->tag = *(*p)++;
|
|
|
|
|
|
|
|
if( ( ret = asn1_get_len( p, end, &serial->len ) ) != 0 )
|
2009-01-03 21:51:57 +00:00
|
|
|
return( POLARSSL_ERR_X509_CERT_INVALID_SERIAL | ret );
|
2009-01-03 21:22:43 +00:00
|
|
|
|
|
|
|
serial->p = *p;
|
|
|
|
*p += serial->len;
|
|
|
|
|
|
|
|
return( 0 );
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* AlgorithmIdentifier ::= SEQUENCE {
|
|
|
|
* algorithm OBJECT IDENTIFIER,
|
|
|
|
* parameters ANY DEFINED BY algorithm OPTIONAL }
|
|
|
|
*/
|
|
|
|
static int x509_get_alg( unsigned char **p,
|
2010-03-16 21:09:09 +00:00
|
|
|
const unsigned char *end,
|
2009-01-03 21:22:43 +00:00
|
|
|
x509_buf *alg )
|
|
|
|
{
|
2011-04-24 08:57:21 +00:00
|
|
|
int ret;
|
|
|
|
size_t len;
|
2009-01-03 21:22:43 +00:00
|
|
|
|
|
|
|
if( ( ret = asn1_get_tag( p, end, &len,
|
|
|
|
ASN1_CONSTRUCTED | ASN1_SEQUENCE ) ) != 0 )
|
2009-01-03 21:51:57 +00:00
|
|
|
return( POLARSSL_ERR_X509_CERT_INVALID_ALG | ret );
|
2009-01-03 21:22:43 +00:00
|
|
|
|
|
|
|
end = *p + len;
|
|
|
|
alg->tag = **p;
|
|
|
|
|
|
|
|
if( ( ret = asn1_get_tag( p, end, &alg->len, ASN1_OID ) ) != 0 )
|
2009-01-03 21:51:57 +00:00
|
|
|
return( POLARSSL_ERR_X509_CERT_INVALID_ALG | ret );
|
2009-01-03 21:22:43 +00:00
|
|
|
|
|
|
|
alg->p = *p;
|
|
|
|
*p += alg->len;
|
|
|
|
|
|
|
|
if( *p == end )
|
|
|
|
return( 0 );
|
|
|
|
|
|
|
|
/*
|
|
|
|
* assume the algorithm parameters must be NULL
|
|
|
|
*/
|
|
|
|
if( ( ret = asn1_get_tag( p, end, &len, ASN1_NULL ) ) != 0 )
|
2009-01-03 21:51:57 +00:00
|
|
|
return( POLARSSL_ERR_X509_CERT_INVALID_ALG | ret );
|
2009-01-03 21:22:43 +00:00
|
|
|
|
|
|
|
if( *p != end )
|
2009-01-03 21:51:57 +00:00
|
|
|
return( POLARSSL_ERR_X509_CERT_INVALID_ALG |
|
|
|
|
POLARSSL_ERR_ASN1_LENGTH_MISMATCH );
|
2009-01-03 21:22:43 +00:00
|
|
|
|
|
|
|
return( 0 );
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* AttributeTypeAndValue ::= SEQUENCE {
|
|
|
|
* type AttributeType,
|
|
|
|
* value AttributeValue }
|
|
|
|
*
|
|
|
|
* AttributeType ::= OBJECT IDENTIFIER
|
|
|
|
*
|
|
|
|
* AttributeValue ::= ANY DEFINED BY AttributeType
|
|
|
|
*/
|
2011-02-20 10:40:16 +00:00
|
|
|
static int x509_get_attr_type_value( unsigned char **p,
|
|
|
|
const unsigned char *end,
|
|
|
|
x509_name *cur )
|
2009-01-03 21:22:43 +00:00
|
|
|
{
|
2011-04-24 08:57:21 +00:00
|
|
|
int ret;
|
|
|
|
size_t len;
|
2009-01-03 21:22:43 +00:00
|
|
|
x509_buf *oid;
|
|
|
|
x509_buf *val;
|
|
|
|
|
|
|
|
if( ( ret = asn1_get_tag( p, end, &len,
|
|
|
|
ASN1_CONSTRUCTED | ASN1_SEQUENCE ) ) != 0 )
|
2009-01-03 21:51:57 +00:00
|
|
|
return( POLARSSL_ERR_X509_CERT_INVALID_NAME | ret );
|
2009-01-03 21:22:43 +00:00
|
|
|
|
|
|
|
oid = &cur->oid;
|
|
|
|
oid->tag = **p;
|
|
|
|
|
|
|
|
if( ( ret = asn1_get_tag( p, end, &oid->len, ASN1_OID ) ) != 0 )
|
2009-01-03 21:51:57 +00:00
|
|
|
return( POLARSSL_ERR_X509_CERT_INVALID_NAME | ret );
|
2009-01-03 21:22:43 +00:00
|
|
|
|
|
|
|
oid->p = *p;
|
|
|
|
*p += oid->len;
|
|
|
|
|
|
|
|
if( ( end - *p ) < 1 )
|
2009-01-03 21:51:57 +00:00
|
|
|
return( POLARSSL_ERR_X509_CERT_INVALID_NAME |
|
|
|
|
POLARSSL_ERR_ASN1_OUT_OF_DATA );
|
2009-01-03 21:22:43 +00:00
|
|
|
|
|
|
|
if( **p != ASN1_BMP_STRING && **p != ASN1_UTF8_STRING &&
|
|
|
|
**p != ASN1_T61_STRING && **p != ASN1_PRINTABLE_STRING &&
|
|
|
|
**p != ASN1_IA5_STRING && **p != ASN1_UNIVERSAL_STRING )
|
2009-01-03 21:51:57 +00:00
|
|
|
return( POLARSSL_ERR_X509_CERT_INVALID_NAME |
|
|
|
|
POLARSSL_ERR_ASN1_UNEXPECTED_TAG );
|
2009-01-03 21:22:43 +00:00
|
|
|
|
|
|
|
val = &cur->val;
|
|
|
|
val->tag = *(*p)++;
|
|
|
|
|
|
|
|
if( ( ret = asn1_get_len( p, end, &val->len ) ) != 0 )
|
2009-01-03 21:51:57 +00:00
|
|
|
return( POLARSSL_ERR_X509_CERT_INVALID_NAME | ret );
|
2009-01-03 21:22:43 +00:00
|
|
|
|
|
|
|
val->p = *p;
|
|
|
|
*p += val->len;
|
|
|
|
|
|
|
|
cur->next = NULL;
|
|
|
|
|
2011-02-20 10:40:16 +00:00
|
|
|
return( 0 );
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* RelativeDistinguishedName ::=
|
|
|
|
* SET OF AttributeTypeAndValue
|
|
|
|
*
|
|
|
|
* AttributeTypeAndValue ::= SEQUENCE {
|
|
|
|
* type AttributeType,
|
|
|
|
* value AttributeValue }
|
|
|
|
*
|
|
|
|
* AttributeType ::= OBJECT IDENTIFIER
|
|
|
|
*
|
|
|
|
* AttributeValue ::= ANY DEFINED BY AttributeType
|
|
|
|
*/
|
|
|
|
static int x509_get_name( unsigned char **p,
|
|
|
|
const unsigned char *end,
|
|
|
|
x509_name *cur )
|
|
|
|
{
|
2011-04-24 08:57:21 +00:00
|
|
|
int ret;
|
|
|
|
size_t len;
|
2011-02-20 10:40:16 +00:00
|
|
|
const unsigned char *end2;
|
|
|
|
x509_name *use;
|
|
|
|
|
|
|
|
if( ( ret = asn1_get_tag( p, end, &len,
|
|
|
|
ASN1_CONSTRUCTED | ASN1_SET ) ) != 0 )
|
|
|
|
return( POLARSSL_ERR_X509_CERT_INVALID_NAME | ret );
|
|
|
|
|
|
|
|
end2 = end;
|
|
|
|
end = *p + len;
|
|
|
|
use = cur;
|
|
|
|
|
|
|
|
do
|
|
|
|
{
|
|
|
|
if( ( ret = x509_get_attr_type_value( p, end, use ) ) != 0 )
|
|
|
|
return( ret );
|
|
|
|
|
|
|
|
if( *p != end )
|
|
|
|
{
|
|
|
|
use->next = (x509_name *) malloc(
|
|
|
|
sizeof( x509_name ) );
|
|
|
|
|
|
|
|
if( use->next == NULL )
|
|
|
|
return( 1 );
|
|
|
|
|
|
|
|
memset( use->next, 0, sizeof( x509_name ) );
|
|
|
|
|
|
|
|
use = use->next;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
while( *p != end );
|
2009-01-03 21:22:43 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
* recurse until end of SEQUENCE is reached
|
|
|
|
*/
|
|
|
|
if( *p == end2 )
|
|
|
|
return( 0 );
|
|
|
|
|
|
|
|
cur->next = (x509_name *) malloc(
|
|
|
|
sizeof( x509_name ) );
|
|
|
|
|
|
|
|
if( cur->next == NULL )
|
|
|
|
return( 1 );
|
|
|
|
|
|
|
|
return( x509_get_name( p, end2, cur->next ) );
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Time ::= CHOICE {
|
|
|
|
* utcTime UTCTime,
|
|
|
|
* generalTime GeneralizedTime }
|
|
|
|
*/
|
2010-02-18 21:26:15 +00:00
|
|
|
static int x509_get_time( unsigned char **p,
|
2010-03-16 21:09:09 +00:00
|
|
|
const unsigned char *end,
|
2009-05-02 15:13:40 +00:00
|
|
|
x509_time *time )
|
2009-01-03 21:22:43 +00:00
|
|
|
{
|
2011-04-24 08:57:21 +00:00
|
|
|
int ret;
|
|
|
|
size_t len;
|
2009-01-03 21:22:43 +00:00
|
|
|
char date[64];
|
2010-02-18 21:26:15 +00:00
|
|
|
unsigned char tag;
|
2009-01-03 21:22:43 +00:00
|
|
|
|
2010-02-18 21:26:15 +00:00
|
|
|
if( ( end - *p ) < 1 )
|
|
|
|
return( POLARSSL_ERR_X509_CERT_INVALID_DATE | POLARSSL_ERR_ASN1_OUT_OF_DATA );
|
2009-01-03 21:22:43 +00:00
|
|
|
|
2010-02-18 21:26:15 +00:00
|
|
|
tag = **p;
|
2009-01-03 21:22:43 +00:00
|
|
|
|
2010-02-18 21:26:15 +00:00
|
|
|
if ( tag == ASN1_UTC_TIME )
|
|
|
|
{
|
|
|
|
(*p)++;
|
|
|
|
ret = asn1_get_len( p, end, &len );
|
|
|
|
|
|
|
|
if( ret != 0 )
|
|
|
|
return( POLARSSL_ERR_X509_CERT_INVALID_DATE | ret );
|
2009-01-03 21:22:43 +00:00
|
|
|
|
2010-02-18 21:26:15 +00:00
|
|
|
memset( date, 0, sizeof( date ) );
|
|
|
|
memcpy( date, *p, ( len < (int) sizeof( date ) - 1 ) ?
|
|
|
|
len : (int) sizeof( date ) - 1 );
|
2009-01-03 21:22:43 +00:00
|
|
|
|
2010-02-18 21:26:15 +00:00
|
|
|
if( sscanf( date, "%2d%2d%2d%2d%2d%2d",
|
|
|
|
&time->year, &time->mon, &time->day,
|
|
|
|
&time->hour, &time->min, &time->sec ) < 5 )
|
|
|
|
return( POLARSSL_ERR_X509_CERT_INVALID_DATE );
|
2009-01-03 21:22:43 +00:00
|
|
|
|
2011-02-20 10:40:16 +00:00
|
|
|
time->year += 100 * ( time->year < 50 );
|
2010-02-18 21:26:15 +00:00
|
|
|
time->year += 1900;
|
|
|
|
|
|
|
|
*p += len;
|
|
|
|
|
|
|
|
return( 0 );
|
|
|
|
}
|
|
|
|
else if ( tag == ASN1_GENERALIZED_TIME )
|
|
|
|
{
|
|
|
|
(*p)++;
|
|
|
|
ret = asn1_get_len( p, end, &len );
|
|
|
|
|
|
|
|
if( ret != 0 )
|
|
|
|
return( POLARSSL_ERR_X509_CERT_INVALID_DATE | ret );
|
|
|
|
|
|
|
|
memset( date, 0, sizeof( date ) );
|
|
|
|
memcpy( date, *p, ( len < (int) sizeof( date ) - 1 ) ?
|
|
|
|
len : (int) sizeof( date ) - 1 );
|
|
|
|
|
|
|
|
if( sscanf( date, "%4d%2d%2d%2d%2d%2d",
|
|
|
|
&time->year, &time->mon, &time->day,
|
|
|
|
&time->hour, &time->min, &time->sec ) < 5 )
|
|
|
|
return( POLARSSL_ERR_X509_CERT_INVALID_DATE );
|
|
|
|
|
|
|
|
*p += len;
|
|
|
|
|
|
|
|
return( 0 );
|
|
|
|
}
|
|
|
|
else
|
|
|
|
return( POLARSSL_ERR_X509_CERT_INVALID_DATE | POLARSSL_ERR_ASN1_UNEXPECTED_TAG );
|
2009-05-02 15:13:40 +00:00
|
|
|
}
|
2009-01-03 21:22:43 +00:00
|
|
|
|
|
|
|
|
2009-05-02 15:13:40 +00:00
|
|
|
/*
|
|
|
|
* Validity ::= SEQUENCE {
|
|
|
|
* notBefore Time,
|
|
|
|
* notAfter Time }
|
|
|
|
*/
|
|
|
|
static int x509_get_dates( unsigned char **p,
|
2010-03-16 21:09:09 +00:00
|
|
|
const unsigned char *end,
|
2009-05-02 15:13:40 +00:00
|
|
|
x509_time *from,
|
|
|
|
x509_time *to )
|
|
|
|
{
|
2011-04-24 08:57:21 +00:00
|
|
|
int ret;
|
|
|
|
size_t len;
|
2009-01-03 21:22:43 +00:00
|
|
|
|
2009-05-02 15:13:40 +00:00
|
|
|
if( ( ret = asn1_get_tag( p, end, &len,
|
|
|
|
ASN1_CONSTRUCTED | ASN1_SEQUENCE ) ) != 0 )
|
|
|
|
return( POLARSSL_ERR_X509_CERT_INVALID_DATE | ret );
|
2009-01-03 21:22:43 +00:00
|
|
|
|
2009-05-02 15:13:40 +00:00
|
|
|
end = *p + len;
|
|
|
|
|
2010-02-18 21:26:15 +00:00
|
|
|
if( ( ret = x509_get_time( p, end, from ) ) != 0 )
|
2009-05-02 15:13:40 +00:00
|
|
|
return( ret );
|
|
|
|
|
2010-02-18 21:26:15 +00:00
|
|
|
if( ( ret = x509_get_time( p, end, to ) ) != 0 )
|
2009-05-02 15:13:40 +00:00
|
|
|
return( ret );
|
2009-01-03 21:22:43 +00:00
|
|
|
|
|
|
|
if( *p != end )
|
2009-01-03 21:51:57 +00:00
|
|
|
return( POLARSSL_ERR_X509_CERT_INVALID_DATE |
|
|
|
|
POLARSSL_ERR_ASN1_LENGTH_MISMATCH );
|
2009-01-03 21:22:43 +00:00
|
|
|
|
|
|
|
return( 0 );
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* SubjectPublicKeyInfo ::= SEQUENCE {
|
|
|
|
* algorithm AlgorithmIdentifier,
|
|
|
|
* subjectPublicKey BIT STRING }
|
|
|
|
*/
|
|
|
|
static int x509_get_pubkey( unsigned char **p,
|
2010-03-16 21:09:09 +00:00
|
|
|
const unsigned char *end,
|
2009-01-03 21:22:43 +00:00
|
|
|
x509_buf *pk_alg_oid,
|
|
|
|
mpi *N, mpi *E )
|
|
|
|
{
|
2011-04-24 08:57:21 +00:00
|
|
|
int ret, can_handle;
|
|
|
|
size_t len;
|
2009-01-03 21:22:43 +00:00
|
|
|
unsigned char *end2;
|
|
|
|
|
|
|
|
if( ( ret = x509_get_alg( p, end, pk_alg_oid ) ) != 0 )
|
|
|
|
return( ret );
|
|
|
|
|
|
|
|
/*
|
|
|
|
* only RSA public keys handled at this time
|
|
|
|
*/
|
2011-02-20 10:40:16 +00:00
|
|
|
can_handle = 0;
|
|
|
|
|
|
|
|
if( pk_alg_oid->len == 9 &&
|
|
|
|
memcmp( pk_alg_oid->p, OID_PKCS1_RSA, 9 ) == 0 )
|
|
|
|
can_handle = 1;
|
|
|
|
|
|
|
|
if( pk_alg_oid->len == 9 &&
|
|
|
|
memcmp( pk_alg_oid->p, OID_PKCS1, 8 ) == 0 )
|
|
|
|
{
|
|
|
|
if( pk_alg_oid->p[8] >= 2 && pk_alg_oid->p[8] <= 5 )
|
|
|
|
can_handle = 1;
|
|
|
|
|
|
|
|
if ( pk_alg_oid->p[8] >= 11 && pk_alg_oid->p[8] <= 14 )
|
|
|
|
can_handle = 1;
|
|
|
|
}
|
|
|
|
|
|
|
|
if( pk_alg_oid->len == 5 &&
|
|
|
|
memcmp( pk_alg_oid->p, OID_RSA_SHA_OBS, 5 ) == 0 )
|
|
|
|
can_handle = 1;
|
|
|
|
|
|
|
|
if( can_handle == 0 )
|
2009-01-03 21:51:57 +00:00
|
|
|
return( POLARSSL_ERR_X509_CERT_UNKNOWN_PK_ALG );
|
2009-01-03 21:22:43 +00:00
|
|
|
|
|
|
|
if( ( ret = asn1_get_tag( p, end, &len, ASN1_BIT_STRING ) ) != 0 )
|
2009-01-03 21:51:57 +00:00
|
|
|
return( POLARSSL_ERR_X509_CERT_INVALID_PUBKEY | ret );
|
2009-01-03 21:22:43 +00:00
|
|
|
|
|
|
|
if( ( end - *p ) < 1 )
|
2009-01-03 21:51:57 +00:00
|
|
|
return( POLARSSL_ERR_X509_CERT_INVALID_PUBKEY |
|
|
|
|
POLARSSL_ERR_ASN1_OUT_OF_DATA );
|
2009-01-03 21:22:43 +00:00
|
|
|
|
|
|
|
end2 = *p + len;
|
|
|
|
|
|
|
|
if( *(*p)++ != 0 )
|
2009-01-03 21:51:57 +00:00
|
|
|
return( POLARSSL_ERR_X509_CERT_INVALID_PUBKEY );
|
2009-01-03 21:22:43 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
* RSAPublicKey ::= SEQUENCE {
|
|
|
|
* modulus INTEGER, -- n
|
|
|
|
* publicExponent INTEGER -- e
|
|
|
|
* }
|
|
|
|
*/
|
|
|
|
if( ( ret = asn1_get_tag( p, end2, &len,
|
|
|
|
ASN1_CONSTRUCTED | ASN1_SEQUENCE ) ) != 0 )
|
2009-01-03 21:51:57 +00:00
|
|
|
return( POLARSSL_ERR_X509_CERT_INVALID_PUBKEY | ret );
|
2009-01-03 21:22:43 +00:00
|
|
|
|
|
|
|
if( *p + len != end2 )
|
2009-01-03 21:51:57 +00:00
|
|
|
return( POLARSSL_ERR_X509_CERT_INVALID_PUBKEY |
|
|
|
|
POLARSSL_ERR_ASN1_LENGTH_MISMATCH );
|
2009-01-03 21:22:43 +00:00
|
|
|
|
|
|
|
if( ( ret = asn1_get_mpi( p, end2, N ) ) != 0 ||
|
|
|
|
( ret = asn1_get_mpi( p, end2, E ) ) != 0 )
|
2009-01-03 21:51:57 +00:00
|
|
|
return( POLARSSL_ERR_X509_CERT_INVALID_PUBKEY | ret );
|
2009-01-03 21:22:43 +00:00
|
|
|
|
|
|
|
if( *p != end )
|
2009-01-03 21:51:57 +00:00
|
|
|
return( POLARSSL_ERR_X509_CERT_INVALID_PUBKEY |
|
|
|
|
POLARSSL_ERR_ASN1_LENGTH_MISMATCH );
|
2009-01-03 21:22:43 +00:00
|
|
|
|
|
|
|
return( 0 );
|
|
|
|
}
|
|
|
|
|
|
|
|
static int x509_get_sig( unsigned char **p,
|
2010-03-16 21:09:09 +00:00
|
|
|
const unsigned char *end,
|
2009-01-03 21:22:43 +00:00
|
|
|
x509_buf *sig )
|
|
|
|
{
|
2011-04-24 08:57:21 +00:00
|
|
|
int ret;
|
|
|
|
size_t len;
|
2009-01-03 21:22:43 +00:00
|
|
|
|
|
|
|
sig->tag = **p;
|
|
|
|
|
|
|
|
if( ( ret = asn1_get_tag( p, end, &len, ASN1_BIT_STRING ) ) != 0 )
|
2009-01-03 21:51:57 +00:00
|
|
|
return( POLARSSL_ERR_X509_CERT_INVALID_SIGNATURE | ret );
|
2009-01-03 21:22:43 +00:00
|
|
|
|
2011-01-15 16:57:55 +00:00
|
|
|
|
2009-01-03 21:22:43 +00:00
|
|
|
if( --len < 1 || *(*p)++ != 0 )
|
2009-01-03 21:51:57 +00:00
|
|
|
return( POLARSSL_ERR_X509_CERT_INVALID_SIGNATURE );
|
2009-01-03 21:22:43 +00:00
|
|
|
|
|
|
|
sig->len = len;
|
|
|
|
sig->p = *p;
|
|
|
|
|
|
|
|
*p += len;
|
|
|
|
|
|
|
|
return( 0 );
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* X.509 v2/v3 unique identifier (not parsed)
|
|
|
|
*/
|
|
|
|
static int x509_get_uid( unsigned char **p,
|
2010-03-16 21:09:09 +00:00
|
|
|
const unsigned char *end,
|
2009-01-03 21:22:43 +00:00
|
|
|
x509_buf *uid, int n )
|
|
|
|
{
|
|
|
|
int ret;
|
|
|
|
|
|
|
|
if( *p == end )
|
|
|
|
return( 0 );
|
|
|
|
|
|
|
|
uid->tag = **p;
|
|
|
|
|
|
|
|
if( ( ret = asn1_get_tag( p, end, &uid->len,
|
|
|
|
ASN1_CONTEXT_SPECIFIC | ASN1_CONSTRUCTED | n ) ) != 0 )
|
|
|
|
{
|
2009-01-03 21:51:57 +00:00
|
|
|
if( ret == POLARSSL_ERR_ASN1_UNEXPECTED_TAG )
|
2009-01-03 21:22:43 +00:00
|
|
|
return( 0 );
|
|
|
|
|
|
|
|
return( ret );
|
|
|
|
}
|
|
|
|
|
|
|
|
uid->p = *p;
|
|
|
|
*p += uid->len;
|
|
|
|
|
|
|
|
return( 0 );
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
2009-05-02 15:13:40 +00:00
|
|
|
* X.509 Extensions (No parsing of extensions, pointer should
|
|
|
|
* be either manually updated or extensions should be parsed!
|
2009-01-03 21:22:43 +00:00
|
|
|
*/
|
|
|
|
static int x509_get_ext( unsigned char **p,
|
2010-03-16 21:09:09 +00:00
|
|
|
const unsigned char *end,
|
2009-05-02 15:13:40 +00:00
|
|
|
x509_buf *ext )
|
2009-01-03 21:22:43 +00:00
|
|
|
{
|
2011-04-24 08:57:21 +00:00
|
|
|
int ret;
|
|
|
|
size_t len;
|
2009-01-03 21:22:43 +00:00
|
|
|
|
|
|
|
if( *p == end )
|
|
|
|
return( 0 );
|
|
|
|
|
|
|
|
ext->tag = **p;
|
2010-03-16 21:09:09 +00:00
|
|
|
|
2009-01-03 21:22:43 +00:00
|
|
|
if( ( ret = asn1_get_tag( p, end, &ext->len,
|
|
|
|
ASN1_CONTEXT_SPECIFIC | ASN1_CONSTRUCTED | 3 ) ) != 0 )
|
|
|
|
return( ret );
|
|
|
|
|
|
|
|
ext->p = *p;
|
|
|
|
end = *p + ext->len;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Extensions ::= SEQUENCE SIZE (1..MAX) OF Extension
|
|
|
|
*
|
|
|
|
* Extension ::= SEQUENCE {
|
|
|
|
* extnID OBJECT IDENTIFIER,
|
|
|
|
* critical BOOLEAN DEFAULT FALSE,
|
|
|
|
* extnValue OCTET STRING }
|
|
|
|
*/
|
|
|
|
if( ( ret = asn1_get_tag( p, end, &len,
|
|
|
|
ASN1_CONSTRUCTED | ASN1_SEQUENCE ) ) != 0 )
|
2009-01-03 21:51:57 +00:00
|
|
|
return( POLARSSL_ERR_X509_CERT_INVALID_EXTENSIONS | ret );
|
2009-01-03 21:22:43 +00:00
|
|
|
|
|
|
|
if( end != *p + len )
|
2009-01-03 21:51:57 +00:00
|
|
|
return( POLARSSL_ERR_X509_CERT_INVALID_EXTENSIONS |
|
|
|
|
POLARSSL_ERR_ASN1_LENGTH_MISMATCH );
|
2009-01-03 21:22:43 +00:00
|
|
|
|
2009-05-02 15:13:40 +00:00
|
|
|
return( 0 );
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* X.509 CRL v2 extensions (no extensions parsed yet.)
|
|
|
|
*/
|
|
|
|
static int x509_get_crl_ext( unsigned char **p,
|
2010-03-16 21:09:09 +00:00
|
|
|
const unsigned char *end,
|
|
|
|
x509_buf *ext )
|
2009-05-02 15:13:40 +00:00
|
|
|
{
|
2011-04-24 08:57:21 +00:00
|
|
|
int ret;
|
|
|
|
size_t len;
|
2009-05-02 15:13:40 +00:00
|
|
|
|
|
|
|
if( ( ret = x509_get_ext( p, end, ext ) ) != 0 )
|
|
|
|
{
|
|
|
|
if( ret == POLARSSL_ERR_ASN1_UNEXPECTED_TAG )
|
|
|
|
return( 0 );
|
|
|
|
|
|
|
|
return( ret );
|
|
|
|
}
|
|
|
|
|
|
|
|
while( *p < end )
|
|
|
|
{
|
|
|
|
if( ( ret = asn1_get_tag( p, end, &len,
|
|
|
|
ASN1_CONSTRUCTED | ASN1_SEQUENCE ) ) != 0 )
|
|
|
|
return( POLARSSL_ERR_X509_CERT_INVALID_EXTENSIONS | ret );
|
|
|
|
|
|
|
|
*p += len;
|
|
|
|
}
|
|
|
|
|
|
|
|
if( *p != end )
|
|
|
|
return( POLARSSL_ERR_X509_CERT_INVALID_EXTENSIONS |
|
|
|
|
POLARSSL_ERR_ASN1_LENGTH_MISMATCH );
|
|
|
|
|
|
|
|
return( 0 );
|
|
|
|
}
|
|
|
|
|
2011-01-15 16:57:55 +00:00
|
|
|
static int x509_get_basic_constraints( unsigned char **p,
|
|
|
|
const unsigned char *end,
|
|
|
|
int *ca_istrue,
|
|
|
|
int *max_pathlen )
|
|
|
|
{
|
2011-04-24 08:57:21 +00:00
|
|
|
int ret;
|
|
|
|
size_t len;
|
2011-01-15 16:57:55 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
* BasicConstraints ::= SEQUENCE {
|
|
|
|
* cA BOOLEAN DEFAULT FALSE,
|
|
|
|
* pathLenConstraint INTEGER (0..MAX) OPTIONAL }
|
|
|
|
*/
|
2011-01-16 21:46:31 +00:00
|
|
|
*ca_istrue = 0; /* DEFAULT FALSE */
|
2011-01-15 16:57:55 +00:00
|
|
|
*max_pathlen = 0; /* endless */
|
|
|
|
|
|
|
|
if( ( ret = asn1_get_tag( p, end, &len,
|
|
|
|
ASN1_CONSTRUCTED | ASN1_SEQUENCE ) ) != 0 )
|
|
|
|
return( POLARSSL_ERR_X509_CERT_INVALID_EXTENSIONS | ret );
|
|
|
|
|
|
|
|
if( *p == end )
|
|
|
|
return 0;
|
|
|
|
|
2011-01-16 21:46:31 +00:00
|
|
|
if( ( ret = asn1_get_bool( p, end, ca_istrue ) ) != 0 )
|
2011-01-15 16:57:55 +00:00
|
|
|
{
|
|
|
|
if( ret == POLARSSL_ERR_ASN1_UNEXPECTED_TAG )
|
2011-01-16 21:46:31 +00:00
|
|
|
ret = asn1_get_int( p, end, ca_istrue );
|
2011-01-15 16:57:55 +00:00
|
|
|
|
|
|
|
if( ret != 0 )
|
|
|
|
return( POLARSSL_ERR_X509_CERT_INVALID_EXTENSIONS | ret );
|
|
|
|
|
2011-01-16 21:46:31 +00:00
|
|
|
if( *ca_istrue != 0 )
|
|
|
|
*ca_istrue = 1;
|
2011-01-15 16:57:55 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
if( *p == end )
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
if( ( ret = asn1_get_int( p, end, max_pathlen ) ) != 0 )
|
|
|
|
return( POLARSSL_ERR_X509_CERT_INVALID_EXTENSIONS | ret );
|
|
|
|
|
|
|
|
if( *p != end )
|
|
|
|
return( POLARSSL_ERR_X509_CERT_INVALID_EXTENSIONS |
|
|
|
|
POLARSSL_ERR_ASN1_LENGTH_MISMATCH );
|
|
|
|
|
|
|
|
(*max_pathlen)++;
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
static int x509_get_ns_cert_type( unsigned char **p,
|
|
|
|
const unsigned char *end,
|
|
|
|
unsigned char *ns_cert_type)
|
|
|
|
{
|
|
|
|
int ret;
|
2011-01-18 16:17:47 +00:00
|
|
|
x509_bitstring bs = { 0, 0, NULL };
|
2011-01-15 16:57:55 +00:00
|
|
|
|
|
|
|
if( ( ret = asn1_get_bitstring( p, end, &bs ) ) != 0 )
|
|
|
|
return( POLARSSL_ERR_X509_CERT_INVALID_EXTENSIONS | ret );
|
|
|
|
|
|
|
|
if( bs.len != 1 )
|
|
|
|
return( POLARSSL_ERR_X509_CERT_INVALID_EXTENSIONS |
|
|
|
|
POLARSSL_ERR_ASN1_INVALID_LENGTH );
|
|
|
|
|
|
|
|
/* Get actual bitstring */
|
|
|
|
*ns_cert_type = *bs.p;
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
static int x509_get_key_usage( unsigned char **p,
|
|
|
|
const unsigned char *end,
|
|
|
|
unsigned char *key_usage)
|
|
|
|
{
|
|
|
|
int ret;
|
2011-01-18 16:17:47 +00:00
|
|
|
x509_bitstring bs = { 0, 0, NULL };
|
2011-01-15 16:57:55 +00:00
|
|
|
|
|
|
|
if( ( ret = asn1_get_bitstring( p, end, &bs ) ) != 0 )
|
|
|
|
return( POLARSSL_ERR_X509_CERT_INVALID_EXTENSIONS | ret );
|
|
|
|
|
|
|
|
if( bs.len != 1 )
|
|
|
|
return( POLARSSL_ERR_X509_CERT_INVALID_EXTENSIONS |
|
|
|
|
POLARSSL_ERR_ASN1_INVALID_LENGTH );
|
|
|
|
|
|
|
|
/* Get actual bitstring */
|
|
|
|
*key_usage = *bs.p;
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2009-05-02 15:13:40 +00:00
|
|
|
/*
|
2011-01-15 16:57:55 +00:00
|
|
|
* ExtKeyUsageSyntax ::= SEQUENCE SIZE (1..MAX) OF KeyPurposeId
|
|
|
|
*
|
|
|
|
* KeyPurposeId ::= OBJECT IDENTIFIER
|
|
|
|
*/
|
|
|
|
static int x509_get_ext_key_usage( unsigned char **p,
|
|
|
|
const unsigned char *end,
|
|
|
|
x509_sequence *ext_key_usage)
|
|
|
|
{
|
|
|
|
int ret;
|
|
|
|
|
|
|
|
if( ( ret = asn1_get_sequence_of( p, end, ext_key_usage, ASN1_OID ) ) != 0 )
|
|
|
|
return( POLARSSL_ERR_X509_CERT_INVALID_EXTENSIONS | ret );
|
|
|
|
|
|
|
|
/* Sequence length must be >= 1 */
|
|
|
|
if( ext_key_usage->buf.p == NULL )
|
|
|
|
return( POLARSSL_ERR_X509_CERT_INVALID_EXTENSIONS |
|
|
|
|
POLARSSL_ERR_ASN1_INVALID_LENGTH );
|
|
|
|
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* X.509 v3 extensions
|
|
|
|
*
|
|
|
|
* TODO: Perform all of the basic constraints tests required by the RFC
|
|
|
|
* TODO: Set values for undetected extensions to a sane default?
|
|
|
|
*
|
2009-05-02 15:13:40 +00:00
|
|
|
*/
|
|
|
|
static int x509_get_crt_ext( unsigned char **p,
|
2010-03-16 21:09:09 +00:00
|
|
|
const unsigned char *end,
|
2011-01-15 16:57:55 +00:00
|
|
|
x509_cert *crt )
|
2009-05-02 15:13:40 +00:00
|
|
|
{
|
2011-04-24 08:57:21 +00:00
|
|
|
int ret;
|
|
|
|
size_t len;
|
2009-07-27 21:34:45 +00:00
|
|
|
unsigned char *end_ext_data, *end_ext_octet;
|
2009-05-02 15:13:40 +00:00
|
|
|
|
2011-01-15 16:57:55 +00:00
|
|
|
if( ( ret = x509_get_ext( p, end, &crt->v3_ext ) ) != 0 )
|
2009-05-02 15:13:40 +00:00
|
|
|
{
|
|
|
|
if( ret == POLARSSL_ERR_ASN1_UNEXPECTED_TAG )
|
|
|
|
return( 0 );
|
|
|
|
|
|
|
|
return( ret );
|
|
|
|
}
|
|
|
|
|
2009-01-03 21:22:43 +00:00
|
|
|
while( *p < end )
|
|
|
|
{
|
2011-01-15 16:57:55 +00:00
|
|
|
/*
|
|
|
|
* Extension ::= SEQUENCE {
|
|
|
|
* extnID OBJECT IDENTIFIER,
|
|
|
|
* critical BOOLEAN DEFAULT FALSE,
|
|
|
|
* extnValue OCTET STRING }
|
|
|
|
*/
|
|
|
|
x509_buf extn_oid = {0, 0, NULL};
|
|
|
|
int is_critical = 0; /* DEFAULT FALSE */
|
|
|
|
|
2009-01-03 21:22:43 +00:00
|
|
|
if( ( ret = asn1_get_tag( p, end, &len,
|
|
|
|
ASN1_CONSTRUCTED | ASN1_SEQUENCE ) ) != 0 )
|
2009-01-03 21:51:57 +00:00
|
|
|
return( POLARSSL_ERR_X509_CERT_INVALID_EXTENSIONS | ret );
|
2009-01-03 21:22:43 +00:00
|
|
|
|
2009-07-27 21:34:45 +00:00
|
|
|
end_ext_data = *p + len;
|
|
|
|
|
2011-01-15 16:57:55 +00:00
|
|
|
/* Get extension ID */
|
|
|
|
extn_oid.tag = **p;
|
|
|
|
|
|
|
|
if( ( ret = asn1_get_tag( p, end, &extn_oid.len, ASN1_OID ) ) != 0 )
|
|
|
|
return( POLARSSL_ERR_X509_CERT_INVALID_EXTENSIONS | ret );
|
2009-01-03 21:22:43 +00:00
|
|
|
|
2011-01-15 16:57:55 +00:00
|
|
|
extn_oid.p = *p;
|
|
|
|
*p += extn_oid.len;
|
2009-01-03 21:22:43 +00:00
|
|
|
|
2011-01-15 16:57:55 +00:00
|
|
|
if( ( end - *p ) < 1 )
|
|
|
|
return( POLARSSL_ERR_X509_CERT_INVALID_EXTENSIONS |
|
|
|
|
POLARSSL_ERR_ASN1_OUT_OF_DATA );
|
|
|
|
|
|
|
|
/* Get optional critical */
|
2009-07-27 21:34:45 +00:00
|
|
|
if( ( ret = asn1_get_bool( p, end_ext_data, &is_critical ) ) != 0 &&
|
2009-01-03 21:51:57 +00:00
|
|
|
( ret != POLARSSL_ERR_ASN1_UNEXPECTED_TAG ) )
|
|
|
|
return( POLARSSL_ERR_X509_CERT_INVALID_EXTENSIONS | ret );
|
2009-01-03 21:22:43 +00:00
|
|
|
|
2011-01-15 16:57:55 +00:00
|
|
|
/* Data should be octet string type */
|
2009-07-27 21:34:45 +00:00
|
|
|
if( ( ret = asn1_get_tag( p, end_ext_data, &len,
|
2009-01-03 21:22:43 +00:00
|
|
|
ASN1_OCTET_STRING ) ) != 0 )
|
2009-01-03 21:51:57 +00:00
|
|
|
return( POLARSSL_ERR_X509_CERT_INVALID_EXTENSIONS | ret );
|
2009-01-03 21:22:43 +00:00
|
|
|
|
2009-07-27 21:34:45 +00:00
|
|
|
end_ext_octet = *p + len;
|
2010-03-16 21:09:09 +00:00
|
|
|
|
2009-07-27 21:34:45 +00:00
|
|
|
if( end_ext_octet != end_ext_data )
|
|
|
|
return( POLARSSL_ERR_X509_CERT_INVALID_EXTENSIONS |
|
|
|
|
POLARSSL_ERR_ASN1_LENGTH_MISMATCH );
|
2009-01-03 21:22:43 +00:00
|
|
|
|
2011-01-15 16:57:55 +00:00
|
|
|
/*
|
|
|
|
* Detect supported extensions
|
|
|
|
*/
|
|
|
|
if( ( OID_SIZE( OID_BASIC_CONSTRAINTS ) == extn_oid.len ) &&
|
|
|
|
memcmp( extn_oid.p, OID_BASIC_CONSTRAINTS, extn_oid.len ) == 0 )
|
2009-01-03 21:22:43 +00:00
|
|
|
{
|
2011-01-15 16:57:55 +00:00
|
|
|
/* Parse basic constraints */
|
|
|
|
if( ( ret = x509_get_basic_constraints( p, end_ext_octet,
|
2011-01-16 21:46:31 +00:00
|
|
|
&crt->ca_istrue, &crt->max_pathlen ) ) != 0 )
|
2011-01-15 16:57:55 +00:00
|
|
|
return ( ret );
|
|
|
|
crt->ext_types |= EXT_BASIC_CONSTRAINTS;
|
2009-01-03 21:22:43 +00:00
|
|
|
}
|
2011-01-15 16:57:55 +00:00
|
|
|
else if( ( OID_SIZE( OID_NS_CERT_TYPE ) == extn_oid.len ) &&
|
|
|
|
memcmp( extn_oid.p, OID_NS_CERT_TYPE, extn_oid.len ) == 0 )
|
|
|
|
{
|
|
|
|
/* Parse netscape certificate type */
|
|
|
|
if( ( ret = x509_get_ns_cert_type( p, end_ext_octet,
|
|
|
|
&crt->ns_cert_type ) ) != 0 )
|
|
|
|
return ( ret );
|
|
|
|
crt->ext_types |= EXT_NS_CERT_TYPE;
|
|
|
|
}
|
|
|
|
else if( ( OID_SIZE( OID_KEY_USAGE ) == extn_oid.len ) &&
|
|
|
|
memcmp( extn_oid.p, OID_KEY_USAGE, extn_oid.len ) == 0 )
|
|
|
|
{
|
|
|
|
/* Parse key usage */
|
|
|
|
if( ( ret = x509_get_key_usage( p, end_ext_octet,
|
|
|
|
&crt->key_usage ) ) != 0 )
|
|
|
|
return ( ret );
|
|
|
|
crt->ext_types |= EXT_KEY_USAGE;
|
|
|
|
}
|
|
|
|
else if( ( OID_SIZE( OID_EXTENDED_KEY_USAGE ) == extn_oid.len ) &&
|
|
|
|
memcmp( extn_oid.p, OID_EXTENDED_KEY_USAGE, extn_oid.len ) == 0 )
|
|
|
|
{
|
|
|
|
/* Parse extended key usage */
|
|
|
|
if( ( ret = x509_get_ext_key_usage( p, end_ext_octet,
|
|
|
|
&crt->ext_key_usage ) ) != 0 )
|
|
|
|
return ( ret );
|
|
|
|
crt->ext_types |= EXT_EXTENDED_KEY_USAGE;
|
|
|
|
}
|
|
|
|
else
|
|
|
|
{
|
|
|
|
/* No parser found, skip extension */
|
|
|
|
*p = end_ext_octet;
|
2009-01-03 21:22:43 +00:00
|
|
|
|
2011-01-15 16:57:55 +00:00
|
|
|
if( is_critical )
|
|
|
|
{
|
|
|
|
/* Data is marked as critical: fail */
|
|
|
|
return ( POLARSSL_ERR_X509_CERT_INVALID_EXTENSIONS |
|
|
|
|
POLARSSL_ERR_ASN1_UNEXPECTED_TAG );
|
|
|
|
}
|
|
|
|
}
|
2009-01-03 21:22:43 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
if( *p != end )
|
2009-01-03 21:51:57 +00:00
|
|
|
return( POLARSSL_ERR_X509_CERT_INVALID_EXTENSIONS |
|
|
|
|
POLARSSL_ERR_ASN1_LENGTH_MISMATCH );
|
2009-01-03 21:22:43 +00:00
|
|
|
|
|
|
|
return( 0 );
|
|
|
|
}
|
|
|
|
|
2009-05-02 15:13:40 +00:00
|
|
|
/*
|
|
|
|
* X.509 CRL Entries
|
|
|
|
*/
|
|
|
|
static int x509_get_entries( unsigned char **p,
|
2010-03-16 21:09:09 +00:00
|
|
|
const unsigned char *end,
|
2009-05-02 15:13:40 +00:00
|
|
|
x509_crl_entry *entry )
|
|
|
|
{
|
2011-04-24 08:57:21 +00:00
|
|
|
int ret;
|
|
|
|
size_t entry_len;
|
2009-05-02 15:13:40 +00:00
|
|
|
x509_crl_entry *cur_entry = entry;
|
|
|
|
|
|
|
|
if( *p == end )
|
|
|
|
return( 0 );
|
|
|
|
|
2009-07-27 20:21:53 +00:00
|
|
|
if( ( ret = asn1_get_tag( p, end, &entry_len,
|
2009-05-02 15:13:40 +00:00
|
|
|
ASN1_SEQUENCE | ASN1_CONSTRUCTED ) ) != 0 )
|
|
|
|
{
|
|
|
|
if( ret == POLARSSL_ERR_ASN1_UNEXPECTED_TAG )
|
|
|
|
return( 0 );
|
|
|
|
|
|
|
|
return( ret );
|
|
|
|
}
|
|
|
|
|
2009-07-27 20:21:53 +00:00
|
|
|
end = *p + entry_len;
|
2009-05-02 15:13:40 +00:00
|
|
|
|
|
|
|
while( *p < end )
|
|
|
|
{
|
2011-04-24 08:57:21 +00:00
|
|
|
size_t len2;
|
2009-05-02 15:13:40 +00:00
|
|
|
|
|
|
|
if( ( ret = asn1_get_tag( p, end, &len2,
|
|
|
|
ASN1_SEQUENCE | ASN1_CONSTRUCTED ) ) != 0 )
|
|
|
|
{
|
|
|
|
return( ret );
|
|
|
|
}
|
|
|
|
|
2009-07-27 20:21:53 +00:00
|
|
|
cur_entry->raw.tag = **p;
|
|
|
|
cur_entry->raw.p = *p;
|
|
|
|
cur_entry->raw.len = len2;
|
|
|
|
|
2009-05-02 15:13:40 +00:00
|
|
|
if( ( ret = x509_get_serial( p, end, &cur_entry->serial ) ) != 0 )
|
|
|
|
return( ret );
|
|
|
|
|
2010-02-18 21:26:15 +00:00
|
|
|
if( ( ret = x509_get_time( p, end, &cur_entry->revocation_date ) ) != 0 )
|
2009-05-02 15:13:40 +00:00
|
|
|
return( ret );
|
|
|
|
|
|
|
|
if( ( ret = x509_get_crl_ext( p, end, &cur_entry->entry_ext ) ) != 0 )
|
|
|
|
return( ret );
|
|
|
|
|
2011-01-15 16:57:55 +00:00
|
|
|
if ( *p < end )
|
|
|
|
{
|
2009-05-02 15:13:40 +00:00
|
|
|
cur_entry->next = malloc( sizeof( x509_crl_entry ) );
|
|
|
|
cur_entry = cur_entry->next;
|
|
|
|
memset( cur_entry, 0, sizeof( x509_crl_entry ) );
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
return( 0 );
|
|
|
|
}
|
|
|
|
|
2010-03-17 06:56:01 +00:00
|
|
|
static int x509_get_sig_alg( const x509_buf *sig_oid, int *sig_alg )
|
|
|
|
{
|
|
|
|
if( sig_oid->len == 9 &&
|
|
|
|
memcmp( sig_oid->p, OID_PKCS1, 8 ) == 0 )
|
|
|
|
{
|
|
|
|
if( sig_oid->p[8] >= 2 && sig_oid->p[8] <= 5 )
|
|
|
|
{
|
|
|
|
*sig_alg = sig_oid->p[8];
|
|
|
|
return( 0 );
|
|
|
|
}
|
|
|
|
|
|
|
|
if ( sig_oid->p[8] >= 11 && sig_oid->p[8] <= 14 )
|
|
|
|
{
|
|
|
|
*sig_alg = sig_oid->p[8];
|
|
|
|
return( 0 );
|
|
|
|
}
|
|
|
|
|
|
|
|
return( POLARSSL_ERR_X509_CERT_UNKNOWN_SIG_ALG );
|
|
|
|
}
|
2011-02-20 10:40:16 +00:00
|
|
|
if( sig_oid->len == 5 &&
|
|
|
|
memcmp( sig_oid->p, OID_RSA_SHA_OBS, 5 ) == 0 )
|
|
|
|
{
|
|
|
|
*sig_alg = SIG_RSA_SHA1;
|
|
|
|
return( 0 );
|
|
|
|
}
|
2010-03-17 06:56:01 +00:00
|
|
|
|
|
|
|
return( POLARSSL_ERR_X509_CERT_UNKNOWN_SIG_ALG );
|
|
|
|
}
|
|
|
|
|
2009-01-03 21:22:43 +00:00
|
|
|
/*
|
|
|
|
* Parse one or more certificates and add them to the chained list
|
|
|
|
*/
|
2011-04-24 08:57:21 +00:00
|
|
|
int x509parse_crt( x509_cert *chain, const unsigned char *buf, size_t buflen )
|
2009-01-03 21:22:43 +00:00
|
|
|
{
|
2011-04-24 08:57:21 +00:00
|
|
|
int ret;
|
|
|
|
size_t len, use_len;
|
2009-01-03 21:22:43 +00:00
|
|
|
unsigned char *p, *end;
|
|
|
|
x509_cert *crt;
|
2011-02-12 14:30:57 +00:00
|
|
|
#if defined(POLARSSL_PEM_C)
|
|
|
|
pem_context pem;
|
|
|
|
#endif
|
2009-01-03 21:22:43 +00:00
|
|
|
|
|
|
|
crt = chain;
|
|
|
|
|
2009-03-28 18:52:39 +00:00
|
|
|
/*
|
|
|
|
* Check for valid input
|
|
|
|
*/
|
|
|
|
if( crt == NULL || buf == NULL )
|
|
|
|
return( 1 );
|
|
|
|
|
2009-03-28 20:29:25 +00:00
|
|
|
while( crt->version != 0 && crt->next != NULL )
|
2009-01-03 21:22:43 +00:00
|
|
|
crt = crt->next;
|
|
|
|
|
2009-03-28 18:52:39 +00:00
|
|
|
/*
|
|
|
|
* Add new certificate on the end of the chain if needed.
|
|
|
|
*/
|
2009-03-28 20:29:25 +00:00
|
|
|
if ( crt->version != 0 && crt->next == NULL)
|
2009-03-28 18:52:39 +00:00
|
|
|
{
|
|
|
|
crt->next = (x509_cert *) malloc( sizeof( x509_cert ) );
|
|
|
|
|
2009-05-02 15:53:56 +00:00
|
|
|
if( crt->next == NULL )
|
|
|
|
{
|
2009-03-28 18:52:39 +00:00
|
|
|
x509_free( crt );
|
2009-05-02 15:53:56 +00:00
|
|
|
return( 1 );
|
|
|
|
}
|
2009-03-28 18:52:39 +00:00
|
|
|
|
2009-05-02 15:53:56 +00:00
|
|
|
crt = crt->next;
|
|
|
|
memset( crt, 0, sizeof( x509_cert ) );
|
2009-03-28 18:52:39 +00:00
|
|
|
}
|
|
|
|
|
2011-02-12 14:30:57 +00:00
|
|
|
#if defined(POLARSSL_PEM_C)
|
|
|
|
pem_init( &pem );
|
|
|
|
ret = pem_read_buffer( &pem,
|
|
|
|
"-----BEGIN CERTIFICATE-----",
|
|
|
|
"-----END CERTIFICATE-----",
|
|
|
|
buf, NULL, 0, &use_len );
|
2009-01-03 21:22:43 +00:00
|
|
|
|
2011-02-12 14:30:57 +00:00
|
|
|
if( ret == 0 )
|
2009-01-03 21:22:43 +00:00
|
|
|
{
|
|
|
|
/*
|
2011-02-12 14:30:57 +00:00
|
|
|
* Was PEM encoded
|
2009-01-03 21:22:43 +00:00
|
|
|
*/
|
2011-02-12 14:30:57 +00:00
|
|
|
buflen -= use_len;
|
|
|
|
buf += use_len;
|
2009-01-03 21:22:43 +00:00
|
|
|
|
|
|
|
/*
|
2011-02-12 14:30:57 +00:00
|
|
|
* Steal PEM buffer
|
2009-01-03 21:22:43 +00:00
|
|
|
*/
|
2011-02-12 14:30:57 +00:00
|
|
|
p = pem.buf;
|
|
|
|
pem.buf = NULL;
|
|
|
|
len = pem.buflen;
|
|
|
|
pem_free( &pem );
|
|
|
|
}
|
|
|
|
else if( ret != POLARSSL_ERR_PEM_NO_HEADER_PRESENT )
|
|
|
|
{
|
|
|
|
pem_free( &pem );
|
|
|
|
return( ret );
|
2009-01-03 21:22:43 +00:00
|
|
|
}
|
|
|
|
else
|
|
|
|
{
|
|
|
|
/*
|
|
|
|
* nope, copy the raw DER data
|
|
|
|
*/
|
|
|
|
p = (unsigned char *) malloc( len = buflen );
|
|
|
|
|
|
|
|
if( p == NULL )
|
|
|
|
return( 1 );
|
|
|
|
|
|
|
|
memcpy( p, buf, buflen );
|
|
|
|
|
|
|
|
buflen = 0;
|
|
|
|
}
|
2011-02-12 14:30:57 +00:00
|
|
|
#else
|
|
|
|
p = (unsigned char *) malloc( len = buflen );
|
|
|
|
|
|
|
|
if( p == NULL )
|
|
|
|
return( 1 );
|
|
|
|
|
|
|
|
memcpy( p, buf, buflen );
|
|
|
|
|
|
|
|
buflen = 0;
|
|
|
|
#endif
|
2009-01-03 21:22:43 +00:00
|
|
|
|
|
|
|
crt->raw.p = p;
|
|
|
|
crt->raw.len = len;
|
|
|
|
end = p + len;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Certificate ::= SEQUENCE {
|
|
|
|
* tbsCertificate TBSCertificate,
|
|
|
|
* signatureAlgorithm AlgorithmIdentifier,
|
|
|
|
* signatureValue BIT STRING }
|
|
|
|
*/
|
|
|
|
if( ( ret = asn1_get_tag( &p, end, &len,
|
|
|
|
ASN1_CONSTRUCTED | ASN1_SEQUENCE ) ) != 0 )
|
|
|
|
{
|
2009-05-02 15:53:56 +00:00
|
|
|
x509_free( crt );
|
2009-01-03 21:51:57 +00:00
|
|
|
return( POLARSSL_ERR_X509_CERT_INVALID_FORMAT );
|
2009-01-03 21:22:43 +00:00
|
|
|
}
|
|
|
|
|
2011-04-24 08:57:21 +00:00
|
|
|
if( len != (size_t) ( end - p ) )
|
2009-01-03 21:22:43 +00:00
|
|
|
{
|
2009-05-02 15:53:56 +00:00
|
|
|
x509_free( crt );
|
2009-01-03 21:51:57 +00:00
|
|
|
return( POLARSSL_ERR_X509_CERT_INVALID_FORMAT |
|
|
|
|
POLARSSL_ERR_ASN1_LENGTH_MISMATCH );
|
2009-01-03 21:22:43 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* TBSCertificate ::= SEQUENCE {
|
|
|
|
*/
|
|
|
|
crt->tbs.p = p;
|
|
|
|
|
|
|
|
if( ( ret = asn1_get_tag( &p, end, &len,
|
|
|
|
ASN1_CONSTRUCTED | ASN1_SEQUENCE ) ) != 0 )
|
|
|
|
{
|
2009-05-02 15:53:56 +00:00
|
|
|
x509_free( crt );
|
2009-01-03 21:51:57 +00:00
|
|
|
return( POLARSSL_ERR_X509_CERT_INVALID_FORMAT | ret );
|
2009-01-03 21:22:43 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
end = p + len;
|
|
|
|
crt->tbs.len = end - crt->tbs.p;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Version ::= INTEGER { v1(0), v2(1), v3(2) }
|
|
|
|
*
|
|
|
|
* CertificateSerialNumber ::= INTEGER
|
|
|
|
*
|
|
|
|
* signature AlgorithmIdentifier
|
|
|
|
*/
|
|
|
|
if( ( ret = x509_get_version( &p, end, &crt->version ) ) != 0 ||
|
|
|
|
( ret = x509_get_serial( &p, end, &crt->serial ) ) != 0 ||
|
|
|
|
( ret = x509_get_alg( &p, end, &crt->sig_oid1 ) ) != 0 )
|
|
|
|
{
|
2009-05-02 15:53:56 +00:00
|
|
|
x509_free( crt );
|
2009-01-03 21:22:43 +00:00
|
|
|
return( ret );
|
|
|
|
}
|
|
|
|
|
|
|
|
crt->version++;
|
|
|
|
|
|
|
|
if( crt->version > 3 )
|
|
|
|
{
|
2009-05-02 15:53:56 +00:00
|
|
|
x509_free( crt );
|
2009-01-03 21:51:57 +00:00
|
|
|
return( POLARSSL_ERR_X509_CERT_UNKNOWN_VERSION );
|
2009-01-03 21:22:43 +00:00
|
|
|
}
|
|
|
|
|
2010-03-17 06:56:01 +00:00
|
|
|
if( ( ret = x509_get_sig_alg( &crt->sig_oid1, &crt->sig_alg ) ) != 0 )
|
2009-01-03 21:22:43 +00:00
|
|
|
{
|
2009-05-02 15:53:56 +00:00
|
|
|
x509_free( crt );
|
2010-03-17 06:56:01 +00:00
|
|
|
return( ret );
|
2009-01-03 21:22:43 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* issuer Name
|
|
|
|
*/
|
|
|
|
crt->issuer_raw.p = p;
|
|
|
|
|
|
|
|
if( ( ret = asn1_get_tag( &p, end, &len,
|
|
|
|
ASN1_CONSTRUCTED | ASN1_SEQUENCE ) ) != 0 )
|
|
|
|
{
|
2009-05-02 15:53:56 +00:00
|
|
|
x509_free( crt );
|
2009-01-03 21:51:57 +00:00
|
|
|
return( POLARSSL_ERR_X509_CERT_INVALID_FORMAT | ret );
|
2009-01-03 21:22:43 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
if( ( ret = x509_get_name( &p, p + len, &crt->issuer ) ) != 0 )
|
|
|
|
{
|
2009-05-02 15:53:56 +00:00
|
|
|
x509_free( crt );
|
2009-01-03 21:22:43 +00:00
|
|
|
return( ret );
|
|
|
|
}
|
|
|
|
|
|
|
|
crt->issuer_raw.len = p - crt->issuer_raw.p;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Validity ::= SEQUENCE {
|
|
|
|
* notBefore Time,
|
|
|
|
* notAfter Time }
|
|
|
|
*
|
|
|
|
*/
|
|
|
|
if( ( ret = x509_get_dates( &p, end, &crt->valid_from,
|
|
|
|
&crt->valid_to ) ) != 0 )
|
|
|
|
{
|
2009-05-02 15:53:56 +00:00
|
|
|
x509_free( crt );
|
2009-01-03 21:22:43 +00:00
|
|
|
return( ret );
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* subject Name
|
|
|
|
*/
|
|
|
|
crt->subject_raw.p = p;
|
|
|
|
|
|
|
|
if( ( ret = asn1_get_tag( &p, end, &len,
|
|
|
|
ASN1_CONSTRUCTED | ASN1_SEQUENCE ) ) != 0 )
|
|
|
|
{
|
2009-05-02 15:53:56 +00:00
|
|
|
x509_free( crt );
|
2009-01-03 21:51:57 +00:00
|
|
|
return( POLARSSL_ERR_X509_CERT_INVALID_FORMAT | ret );
|
2009-01-03 21:22:43 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
if( ( ret = x509_get_name( &p, p + len, &crt->subject ) ) != 0 )
|
|
|
|
{
|
2009-05-02 15:53:56 +00:00
|
|
|
x509_free( crt );
|
2009-01-03 21:22:43 +00:00
|
|
|
return( ret );
|
|
|
|
}
|
|
|
|
|
|
|
|
crt->subject_raw.len = p - crt->subject_raw.p;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* SubjectPublicKeyInfo ::= SEQUENCE
|
|
|
|
* algorithm AlgorithmIdentifier,
|
|
|
|
* subjectPublicKey BIT STRING }
|
|
|
|
*/
|
|
|
|
if( ( ret = asn1_get_tag( &p, end, &len,
|
|
|
|
ASN1_CONSTRUCTED | ASN1_SEQUENCE ) ) != 0 )
|
|
|
|
{
|
2009-05-02 15:53:56 +00:00
|
|
|
x509_free( crt );
|
2009-01-03 21:51:57 +00:00
|
|
|
return( POLARSSL_ERR_X509_CERT_INVALID_FORMAT | ret );
|
2009-01-03 21:22:43 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
if( ( ret = x509_get_pubkey( &p, p + len, &crt->pk_oid,
|
|
|
|
&crt->rsa.N, &crt->rsa.E ) ) != 0 )
|
|
|
|
{
|
2009-05-02 15:53:56 +00:00
|
|
|
x509_free( crt );
|
2009-01-03 21:22:43 +00:00
|
|
|
return( ret );
|
|
|
|
}
|
|
|
|
|
|
|
|
if( ( ret = rsa_check_pubkey( &crt->rsa ) ) != 0 )
|
|
|
|
{
|
2009-05-02 15:53:56 +00:00
|
|
|
x509_free( crt );
|
2009-01-03 21:22:43 +00:00
|
|
|
return( ret );
|
|
|
|
}
|
|
|
|
|
|
|
|
crt->rsa.len = mpi_size( &crt->rsa.N );
|
|
|
|
|
|
|
|
/*
|
|
|
|
* issuerUniqueID [1] IMPLICIT UniqueIdentifier OPTIONAL,
|
|
|
|
* -- If present, version shall be v2 or v3
|
|
|
|
* subjectUniqueID [2] IMPLICIT UniqueIdentifier OPTIONAL,
|
|
|
|
* -- If present, version shall be v2 or v3
|
|
|
|
* extensions [3] EXPLICIT Extensions OPTIONAL
|
|
|
|
* -- If present, version shall be v3
|
|
|
|
*/
|
|
|
|
if( crt->version == 2 || crt->version == 3 )
|
|
|
|
{
|
|
|
|
ret = x509_get_uid( &p, end, &crt->issuer_id, 1 );
|
|
|
|
if( ret != 0 )
|
|
|
|
{
|
2009-05-02 15:53:56 +00:00
|
|
|
x509_free( crt );
|
2009-01-03 21:22:43 +00:00
|
|
|
return( ret );
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
if( crt->version == 2 || crt->version == 3 )
|
|
|
|
{
|
|
|
|
ret = x509_get_uid( &p, end, &crt->subject_id, 2 );
|
|
|
|
if( ret != 0 )
|
|
|
|
{
|
2009-05-02 15:53:56 +00:00
|
|
|
x509_free( crt );
|
2009-01-03 21:22:43 +00:00
|
|
|
return( ret );
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
if( crt->version == 3 )
|
|
|
|
{
|
2011-01-15 16:57:55 +00:00
|
|
|
ret = x509_get_crt_ext( &p, end, crt);
|
2009-01-03 21:22:43 +00:00
|
|
|
if( ret != 0 )
|
|
|
|
{
|
2009-05-02 15:53:56 +00:00
|
|
|
x509_free( crt );
|
2009-01-03 21:22:43 +00:00
|
|
|
return( ret );
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
if( p != end )
|
|
|
|
{
|
2009-05-02 15:53:56 +00:00
|
|
|
x509_free( crt );
|
2009-01-03 21:51:57 +00:00
|
|
|
return( POLARSSL_ERR_X509_CERT_INVALID_FORMAT |
|
|
|
|
POLARSSL_ERR_ASN1_LENGTH_MISMATCH );
|
2009-01-03 21:22:43 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
end = crt->raw.p + crt->raw.len;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* signatureAlgorithm AlgorithmIdentifier,
|
|
|
|
* signatureValue BIT STRING
|
|
|
|
*/
|
|
|
|
if( ( ret = x509_get_alg( &p, end, &crt->sig_oid2 ) ) != 0 )
|
|
|
|
{
|
2009-05-02 15:53:56 +00:00
|
|
|
x509_free( crt );
|
2009-01-03 21:22:43 +00:00
|
|
|
return( ret );
|
|
|
|
}
|
|
|
|
|
2009-03-28 18:52:39 +00:00
|
|
|
if( memcmp( crt->sig_oid1.p, crt->sig_oid2.p, crt->sig_oid1.len ) != 0 )
|
2009-01-03 21:22:43 +00:00
|
|
|
{
|
2009-05-02 15:53:56 +00:00
|
|
|
x509_free( crt );
|
2009-01-03 21:51:57 +00:00
|
|
|
return( POLARSSL_ERR_X509_CERT_SIG_MISMATCH );
|
2009-01-03 21:22:43 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
if( ( ret = x509_get_sig( &p, end, &crt->sig ) ) != 0 )
|
|
|
|
{
|
2009-05-02 15:53:56 +00:00
|
|
|
x509_free( crt );
|
2009-01-03 21:22:43 +00:00
|
|
|
return( ret );
|
|
|
|
}
|
|
|
|
|
|
|
|
if( p != end )
|
|
|
|
{
|
2009-05-02 15:53:56 +00:00
|
|
|
x509_free( crt );
|
2009-01-03 21:51:57 +00:00
|
|
|
return( POLARSSL_ERR_X509_CERT_INVALID_FORMAT |
|
|
|
|
POLARSSL_ERR_ASN1_LENGTH_MISMATCH );
|
2009-01-03 21:22:43 +00:00
|
|
|
}
|
|
|
|
|
2009-03-28 18:52:39 +00:00
|
|
|
if( buflen > 0 )
|
2009-01-03 21:22:43 +00:00
|
|
|
{
|
2009-03-28 18:52:39 +00:00
|
|
|
crt->next = (x509_cert *) malloc( sizeof( x509_cert ) );
|
2009-01-03 21:22:43 +00:00
|
|
|
|
2009-05-02 15:53:56 +00:00
|
|
|
if( crt->next == NULL )
|
|
|
|
{
|
2009-03-28 18:52:39 +00:00
|
|
|
x509_free( crt );
|
2009-05-02 15:53:56 +00:00
|
|
|
return( 1 );
|
|
|
|
}
|
2009-03-28 18:52:39 +00:00
|
|
|
|
2009-05-02 15:53:56 +00:00
|
|
|
crt = crt->next;
|
|
|
|
memset( crt, 0, sizeof( x509_cert ) );
|
2009-01-03 21:22:43 +00:00
|
|
|
|
|
|
|
return( x509parse_crt( crt, buf, buflen ) );
|
2009-03-28 18:52:39 +00:00
|
|
|
}
|
2009-01-03 21:22:43 +00:00
|
|
|
|
|
|
|
return( 0 );
|
|
|
|
}
|
|
|
|
|
2009-05-02 15:13:40 +00:00
|
|
|
/*
|
|
|
|
* Parse one or more CRLs and add them to the chained list
|
|
|
|
*/
|
2011-04-24 08:57:21 +00:00
|
|
|
int x509parse_crl( x509_crl *chain, const unsigned char *buf, size_t buflen )
|
2009-05-02 15:13:40 +00:00
|
|
|
{
|
2011-04-24 08:57:21 +00:00
|
|
|
int ret;
|
|
|
|
size_t len, use_len;
|
2009-05-02 15:13:40 +00:00
|
|
|
unsigned char *p, *end;
|
|
|
|
x509_crl *crl;
|
2011-02-12 14:30:57 +00:00
|
|
|
#if defined(POLARSSL_PEM_C)
|
|
|
|
pem_context pem;
|
|
|
|
#endif
|
2009-05-02 15:13:40 +00:00
|
|
|
|
|
|
|
crl = chain;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Check for valid input
|
|
|
|
*/
|
|
|
|
if( crl == NULL || buf == NULL )
|
|
|
|
return( 1 );
|
|
|
|
|
|
|
|
while( crl->version != 0 && crl->next != NULL )
|
|
|
|
crl = crl->next;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Add new CRL on the end of the chain if needed.
|
|
|
|
*/
|
|
|
|
if ( crl->version != 0 && crl->next == NULL)
|
|
|
|
{
|
|
|
|
crl->next = (x509_crl *) malloc( sizeof( x509_crl ) );
|
|
|
|
|
2009-05-02 15:53:56 +00:00
|
|
|
if( crl->next == NULL )
|
|
|
|
{
|
2009-05-02 15:13:40 +00:00
|
|
|
x509_crl_free( crl );
|
2009-05-02 15:53:56 +00:00
|
|
|
return( 1 );
|
|
|
|
}
|
2009-05-02 15:13:40 +00:00
|
|
|
|
2009-05-02 15:53:56 +00:00
|
|
|
crl = crl->next;
|
|
|
|
memset( crl, 0, sizeof( x509_crl ) );
|
2009-05-02 15:13:40 +00:00
|
|
|
}
|
|
|
|
|
2011-02-12 14:30:57 +00:00
|
|
|
#if defined(POLARSSL_PEM_C)
|
|
|
|
pem_init( &pem );
|
|
|
|
ret = pem_read_buffer( &pem,
|
|
|
|
"-----BEGIN X509 CRL-----",
|
|
|
|
"-----END X509 CRL-----",
|
|
|
|
buf, NULL, 0, &use_len );
|
2009-05-02 15:13:40 +00:00
|
|
|
|
2011-02-12 14:30:57 +00:00
|
|
|
if( ret == 0 )
|
2009-05-02 15:13:40 +00:00
|
|
|
{
|
|
|
|
/*
|
2011-02-12 14:30:57 +00:00
|
|
|
* Was PEM encoded
|
2009-05-02 15:13:40 +00:00
|
|
|
*/
|
2011-02-12 14:30:57 +00:00
|
|
|
buflen -= use_len;
|
|
|
|
buf += use_len;
|
2009-05-02 15:13:40 +00:00
|
|
|
|
|
|
|
/*
|
2011-02-12 14:30:57 +00:00
|
|
|
* Steal PEM buffer
|
2009-05-02 15:13:40 +00:00
|
|
|
*/
|
2011-02-12 14:30:57 +00:00
|
|
|
p = pem.buf;
|
|
|
|
pem.buf = NULL;
|
|
|
|
len = pem.buflen;
|
|
|
|
pem_free( &pem );
|
|
|
|
}
|
|
|
|
else if( ret != POLARSSL_ERR_PEM_NO_HEADER_PRESENT )
|
|
|
|
{
|
|
|
|
pem_free( &pem );
|
|
|
|
return( ret );
|
2009-05-02 15:13:40 +00:00
|
|
|
}
|
|
|
|
else
|
|
|
|
{
|
|
|
|
/*
|
|
|
|
* nope, copy the raw DER data
|
|
|
|
*/
|
|
|
|
p = (unsigned char *) malloc( len = buflen );
|
|
|
|
|
|
|
|
if( p == NULL )
|
|
|
|
return( 1 );
|
|
|
|
|
|
|
|
memcpy( p, buf, buflen );
|
|
|
|
|
|
|
|
buflen = 0;
|
|
|
|
}
|
2011-02-12 14:30:57 +00:00
|
|
|
#else
|
|
|
|
p = (unsigned char *) malloc( len = buflen );
|
|
|
|
|
|
|
|
if( p == NULL )
|
|
|
|
return( 1 );
|
|
|
|
|
|
|
|
memcpy( p, buf, buflen );
|
|
|
|
|
|
|
|
buflen = 0;
|
|
|
|
#endif
|
2009-05-02 15:13:40 +00:00
|
|
|
|
|
|
|
crl->raw.p = p;
|
|
|
|
crl->raw.len = len;
|
|
|
|
end = p + len;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* CertificateList ::= SEQUENCE {
|
|
|
|
* tbsCertList TBSCertList,
|
|
|
|
* signatureAlgorithm AlgorithmIdentifier,
|
|
|
|
* signatureValue BIT STRING }
|
|
|
|
*/
|
|
|
|
if( ( ret = asn1_get_tag( &p, end, &len,
|
|
|
|
ASN1_CONSTRUCTED | ASN1_SEQUENCE ) ) != 0 )
|
|
|
|
{
|
|
|
|
x509_crl_free( crl );
|
|
|
|
return( POLARSSL_ERR_X509_CERT_INVALID_FORMAT );
|
|
|
|
}
|
|
|
|
|
2011-04-24 08:57:21 +00:00
|
|
|
if( len != (size_t) ( end - p ) )
|
2009-05-02 15:13:40 +00:00
|
|
|
{
|
|
|
|
x509_crl_free( crl );
|
|
|
|
return( POLARSSL_ERR_X509_CERT_INVALID_FORMAT |
|
|
|
|
POLARSSL_ERR_ASN1_LENGTH_MISMATCH );
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* TBSCertList ::= SEQUENCE {
|
|
|
|
*/
|
|
|
|
crl->tbs.p = p;
|
|
|
|
|
|
|
|
if( ( ret = asn1_get_tag( &p, end, &len,
|
|
|
|
ASN1_CONSTRUCTED | ASN1_SEQUENCE ) ) != 0 )
|
|
|
|
{
|
|
|
|
x509_crl_free( crl );
|
|
|
|
return( POLARSSL_ERR_X509_CERT_INVALID_FORMAT | ret );
|
|
|
|
}
|
|
|
|
|
|
|
|
end = p + len;
|
|
|
|
crl->tbs.len = end - crl->tbs.p;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Version ::= INTEGER OPTIONAL { v1(0), v2(1) }
|
|
|
|
* -- if present, MUST be v2
|
|
|
|
*
|
|
|
|
* signature AlgorithmIdentifier
|
|
|
|
*/
|
|
|
|
if( ( ret = x509_get_version( &p, end, &crl->version ) ) != 0 ||
|
|
|
|
( ret = x509_get_alg( &p, end, &crl->sig_oid1 ) ) != 0 )
|
|
|
|
{
|
|
|
|
x509_crl_free( crl );
|
|
|
|
return( ret );
|
|
|
|
}
|
|
|
|
|
|
|
|
crl->version++;
|
|
|
|
|
|
|
|
if( crl->version > 2 )
|
|
|
|
{
|
|
|
|
x509_crl_free( crl );
|
|
|
|
return( POLARSSL_ERR_X509_CERT_UNKNOWN_VERSION );
|
|
|
|
}
|
|
|
|
|
2010-03-17 06:56:01 +00:00
|
|
|
if( ( ret = x509_get_sig_alg( &crl->sig_oid1, &crl->sig_alg ) ) != 0 )
|
2009-05-02 15:13:40 +00:00
|
|
|
{
|
|
|
|
x509_crl_free( crl );
|
|
|
|
return( POLARSSL_ERR_X509_CERT_UNKNOWN_SIG_ALG );
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* issuer Name
|
|
|
|
*/
|
|
|
|
crl->issuer_raw.p = p;
|
|
|
|
|
|
|
|
if( ( ret = asn1_get_tag( &p, end, &len,
|
|
|
|
ASN1_CONSTRUCTED | ASN1_SEQUENCE ) ) != 0 )
|
|
|
|
{
|
|
|
|
x509_crl_free( crl );
|
|
|
|
return( POLARSSL_ERR_X509_CERT_INVALID_FORMAT | ret );
|
|
|
|
}
|
|
|
|
|
|
|
|
if( ( ret = x509_get_name( &p, p + len, &crl->issuer ) ) != 0 )
|
|
|
|
{
|
|
|
|
x509_crl_free( crl );
|
|
|
|
return( ret );
|
|
|
|
}
|
|
|
|
|
|
|
|
crl->issuer_raw.len = p - crl->issuer_raw.p;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* thisUpdate Time
|
|
|
|
* nextUpdate Time OPTIONAL
|
|
|
|
*/
|
2010-02-18 21:26:15 +00:00
|
|
|
if( ( ret = x509_get_time( &p, end, &crl->this_update ) ) != 0 )
|
2009-05-02 15:13:40 +00:00
|
|
|
{
|
|
|
|
x509_crl_free( crl );
|
|
|
|
return( ret );
|
|
|
|
}
|
|
|
|
|
2010-02-18 21:26:15 +00:00
|
|
|
if( ( ret = x509_get_time( &p, end, &crl->next_update ) ) != 0 )
|
2009-05-02 15:13:40 +00:00
|
|
|
{
|
2009-07-20 20:34:41 +00:00
|
|
|
if ( ret != ( POLARSSL_ERR_X509_CERT_INVALID_DATE |
|
2009-07-27 20:21:53 +00:00
|
|
|
POLARSSL_ERR_ASN1_UNEXPECTED_TAG ) &&
|
|
|
|
ret != ( POLARSSL_ERR_X509_CERT_INVALID_DATE |
|
|
|
|
POLARSSL_ERR_ASN1_OUT_OF_DATA ) )
|
2009-07-20 20:34:41 +00:00
|
|
|
{
|
2009-05-02 15:13:40 +00:00
|
|
|
x509_crl_free( crl );
|
|
|
|
return( ret );
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* revokedCertificates SEQUENCE OF SEQUENCE {
|
|
|
|
* userCertificate CertificateSerialNumber,
|
|
|
|
* revocationDate Time,
|
|
|
|
* crlEntryExtensions Extensions OPTIONAL
|
|
|
|
* -- if present, MUST be v2
|
|
|
|
* } OPTIONAL
|
|
|
|
*/
|
|
|
|
if( ( ret = x509_get_entries( &p, end, &crl->entry ) ) != 0 )
|
|
|
|
{
|
|
|
|
x509_crl_free( crl );
|
|
|
|
return( ret );
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* crlExtensions EXPLICIT Extensions OPTIONAL
|
|
|
|
* -- if present, MUST be v2
|
|
|
|
*/
|
|
|
|
if( crl->version == 2 )
|
|
|
|
{
|
|
|
|
ret = x509_get_crl_ext( &p, end, &crl->crl_ext );
|
|
|
|
|
|
|
|
if( ret != 0 )
|
|
|
|
{
|
|
|
|
x509_crl_free( crl );
|
|
|
|
return( ret );
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
if( p != end )
|
|
|
|
{
|
|
|
|
x509_crl_free( crl );
|
|
|
|
return( POLARSSL_ERR_X509_CERT_INVALID_FORMAT |
|
|
|
|
POLARSSL_ERR_ASN1_LENGTH_MISMATCH );
|
|
|
|
}
|
|
|
|
|
|
|
|
end = crl->raw.p + crl->raw.len;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* signatureAlgorithm AlgorithmIdentifier,
|
|
|
|
* signatureValue BIT STRING
|
|
|
|
*/
|
|
|
|
if( ( ret = x509_get_alg( &p, end, &crl->sig_oid2 ) ) != 0 )
|
|
|
|
{
|
|
|
|
x509_crl_free( crl );
|
|
|
|
return( ret );
|
|
|
|
}
|
|
|
|
|
|
|
|
if( memcmp( crl->sig_oid1.p, crl->sig_oid2.p, crl->sig_oid1.len ) != 0 )
|
|
|
|
{
|
|
|
|
x509_crl_free( crl );
|
|
|
|
return( POLARSSL_ERR_X509_CERT_SIG_MISMATCH );
|
|
|
|
}
|
|
|
|
|
|
|
|
if( ( ret = x509_get_sig( &p, end, &crl->sig ) ) != 0 )
|
|
|
|
{
|
|
|
|
x509_crl_free( crl );
|
|
|
|
return( ret );
|
|
|
|
}
|
|
|
|
|
|
|
|
if( p != end )
|
|
|
|
{
|
|
|
|
x509_crl_free( crl );
|
|
|
|
return( POLARSSL_ERR_X509_CERT_INVALID_FORMAT |
|
|
|
|
POLARSSL_ERR_ASN1_LENGTH_MISMATCH );
|
|
|
|
}
|
|
|
|
|
|
|
|
if( buflen > 0 )
|
|
|
|
{
|
|
|
|
crl->next = (x509_crl *) malloc( sizeof( x509_crl ) );
|
|
|
|
|
2009-05-02 15:53:56 +00:00
|
|
|
if( crl->next == NULL )
|
|
|
|
{
|
2009-05-02 15:13:40 +00:00
|
|
|
x509_crl_free( crl );
|
2009-05-02 15:53:56 +00:00
|
|
|
return( 1 );
|
|
|
|
}
|
2009-05-02 15:13:40 +00:00
|
|
|
|
2009-05-02 15:53:56 +00:00
|
|
|
crl = crl->next;
|
|
|
|
memset( crl, 0, sizeof( x509_crl ) );
|
2009-05-02 15:13:40 +00:00
|
|
|
|
|
|
|
return( x509parse_crl( crl, buf, buflen ) );
|
|
|
|
}
|
|
|
|
|
|
|
|
return( 0 );
|
|
|
|
}
|
|
|
|
|
2009-04-19 18:44:26 +00:00
|
|
|
/*
|
|
|
|
* Load all data from a file into a given buffer.
|
|
|
|
*/
|
2010-03-16 21:09:09 +00:00
|
|
|
int load_file( const char *path, unsigned char **buf, size_t *n )
|
2009-04-19 18:44:26 +00:00
|
|
|
{
|
2009-05-02 15:13:40 +00:00
|
|
|
FILE *f;
|
2009-04-19 18:44:26 +00:00
|
|
|
|
2009-05-02 15:13:40 +00:00
|
|
|
if( ( f = fopen( path, "rb" ) ) == NULL )
|
|
|
|
return( 1 );
|
2009-04-19 18:44:26 +00:00
|
|
|
|
2009-05-02 15:13:40 +00:00
|
|
|
fseek( f, 0, SEEK_END );
|
|
|
|
*n = (size_t) ftell( f );
|
|
|
|
fseek( f, 0, SEEK_SET );
|
2009-04-19 18:44:26 +00:00
|
|
|
|
2009-05-02 15:13:40 +00:00
|
|
|
if( ( *buf = (unsigned char *) malloc( *n + 1 ) ) == NULL )
|
|
|
|
return( 1 );
|
2009-04-19 18:44:26 +00:00
|
|
|
|
2009-05-02 15:13:40 +00:00
|
|
|
if( fread( *buf, 1, *n, f ) != *n )
|
|
|
|
{
|
|
|
|
fclose( f );
|
|
|
|
free( *buf );
|
|
|
|
return( 1 );
|
|
|
|
}
|
2009-04-19 18:44:26 +00:00
|
|
|
|
2009-05-02 15:13:40 +00:00
|
|
|
fclose( f );
|
2009-04-19 18:44:26 +00:00
|
|
|
|
2009-05-02 15:13:40 +00:00
|
|
|
(*buf)[*n] = '\0';
|
2009-04-19 18:44:26 +00:00
|
|
|
|
2009-05-02 15:13:40 +00:00
|
|
|
return( 0 );
|
2009-04-19 18:44:26 +00:00
|
|
|
}
|
|
|
|
|
2009-01-03 21:22:43 +00:00
|
|
|
/*
|
|
|
|
* Load one or more certificates and add them to the chained list
|
|
|
|
*/
|
2010-03-16 21:09:09 +00:00
|
|
|
int x509parse_crtfile( x509_cert *chain, const char *path )
|
2009-01-03 21:22:43 +00:00
|
|
|
{
|
|
|
|
int ret;
|
|
|
|
size_t n;
|
|
|
|
unsigned char *buf;
|
|
|
|
|
2009-04-19 18:44:26 +00:00
|
|
|
if ( load_file( path, &buf, &n ) )
|
2009-01-03 21:22:43 +00:00
|
|
|
return( 1 );
|
|
|
|
|
|
|
|
ret = x509parse_crt( chain, buf, (int) n );
|
|
|
|
|
|
|
|
memset( buf, 0, n + 1 );
|
|
|
|
free( buf );
|
|
|
|
|
|
|
|
return( ret );
|
|
|
|
}
|
|
|
|
|
2009-05-02 15:13:40 +00:00
|
|
|
/*
|
|
|
|
* Load one or more CRLs and add them to the chained list
|
|
|
|
*/
|
2010-03-16 21:09:09 +00:00
|
|
|
int x509parse_crlfile( x509_crl *chain, const char *path )
|
2009-05-02 15:13:40 +00:00
|
|
|
{
|
|
|
|
int ret;
|
|
|
|
size_t n;
|
|
|
|
unsigned char *buf;
|
|
|
|
|
|
|
|
if ( load_file( path, &buf, &n ) )
|
|
|
|
return( 1 );
|
|
|
|
|
|
|
|
ret = x509parse_crl( chain, buf, (int) n );
|
|
|
|
|
|
|
|
memset( buf, 0, n + 1 );
|
|
|
|
free( buf );
|
|
|
|
|
|
|
|
return( ret );
|
|
|
|
}
|
|
|
|
|
2009-01-03 21:22:43 +00:00
|
|
|
/*
|
|
|
|
* Parse a private RSA key
|
|
|
|
*/
|
2011-04-24 08:57:21 +00:00
|
|
|
int x509parse_key( rsa_context *rsa, const unsigned char *key, size_t keylen,
|
|
|
|
const unsigned char *pwd, size_t pwdlen )
|
2009-01-03 21:22:43 +00:00
|
|
|
{
|
2011-04-24 08:57:21 +00:00
|
|
|
int ret;
|
|
|
|
size_t len;
|
2009-01-03 21:22:43 +00:00
|
|
|
unsigned char *p, *end;
|
2011-02-12 14:30:57 +00:00
|
|
|
#if defined(POLARSSL_PEM_C)
|
|
|
|
pem_context pem;
|
2009-01-03 21:22:43 +00:00
|
|
|
|
2011-02-12 14:30:57 +00:00
|
|
|
pem_init( &pem );
|
|
|
|
ret = pem_read_buffer( &pem,
|
|
|
|
"-----BEGIN RSA PRIVATE KEY-----",
|
|
|
|
"-----END RSA PRIVATE KEY-----",
|
|
|
|
key, pwd, pwdlen, &len );
|
2009-01-03 21:22:43 +00:00
|
|
|
|
2011-02-12 14:30:57 +00:00
|
|
|
if( ret == 0 )
|
2009-01-03 21:22:43 +00:00
|
|
|
{
|
2011-02-12 14:30:57 +00:00
|
|
|
/*
|
|
|
|
* Was PEM encoded
|
|
|
|
*/
|
|
|
|
keylen = pem.buflen;
|
2009-01-03 21:22:43 +00:00
|
|
|
}
|
2011-02-12 14:30:57 +00:00
|
|
|
else if( ret != POLARSSL_ERR_PEM_NO_HEADER_PRESENT )
|
2010-03-16 21:09:09 +00:00
|
|
|
{
|
2011-02-12 14:30:57 +00:00
|
|
|
pem_free( &pem );
|
|
|
|
return( ret );
|
2010-03-16 21:09:09 +00:00
|
|
|
}
|
2009-01-03 21:22:43 +00:00
|
|
|
|
2011-02-12 14:30:57 +00:00
|
|
|
p = ( ret == 0 ) ? pem.buf : (unsigned char *) key;
|
|
|
|
#else
|
|
|
|
p = (unsigned char *) key;
|
|
|
|
#endif
|
2010-03-16 21:09:09 +00:00
|
|
|
end = p + keylen;
|
2009-01-03 21:22:43 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
* RSAPrivateKey ::= SEQUENCE {
|
|
|
|
* version Version,
|
|
|
|
* modulus INTEGER, -- n
|
|
|
|
* publicExponent INTEGER, -- e
|
|
|
|
* privateExponent INTEGER, -- d
|
|
|
|
* prime1 INTEGER, -- p
|
|
|
|
* prime2 INTEGER, -- q
|
|
|
|
* exponent1 INTEGER, -- d mod (p-1)
|
|
|
|
* exponent2 INTEGER, -- d mod (q-1)
|
|
|
|
* coefficient INTEGER, -- (inverse of q) mod p
|
|
|
|
* otherPrimeInfos OtherPrimeInfos OPTIONAL
|
|
|
|
* }
|
|
|
|
*/
|
|
|
|
if( ( ret = asn1_get_tag( &p, end, &len,
|
|
|
|
ASN1_CONSTRUCTED | ASN1_SEQUENCE ) ) != 0 )
|
|
|
|
{
|
2011-02-12 14:30:57 +00:00
|
|
|
#if defined(POLARSSL_PEM_C)
|
|
|
|
pem_free( &pem );
|
|
|
|
#endif
|
2009-01-03 21:22:43 +00:00
|
|
|
rsa_free( rsa );
|
2009-01-03 21:51:57 +00:00
|
|
|
return( POLARSSL_ERR_X509_KEY_INVALID_FORMAT | ret );
|
2009-01-03 21:22:43 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
end = p + len;
|
|
|
|
|
|
|
|
if( ( ret = asn1_get_int( &p, end, &rsa->ver ) ) != 0 )
|
|
|
|
{
|
2011-02-12 14:30:57 +00:00
|
|
|
#if defined(POLARSSL_PEM_C)
|
|
|
|
pem_free( &pem );
|
|
|
|
#endif
|
2009-01-03 21:22:43 +00:00
|
|
|
rsa_free( rsa );
|
2009-01-03 21:51:57 +00:00
|
|
|
return( POLARSSL_ERR_X509_KEY_INVALID_FORMAT | ret );
|
2009-01-03 21:22:43 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
if( rsa->ver != 0 )
|
|
|
|
{
|
2011-02-12 14:30:57 +00:00
|
|
|
#if defined(POLARSSL_PEM_C)
|
|
|
|
pem_free( &pem );
|
|
|
|
#endif
|
2009-01-03 21:22:43 +00:00
|
|
|
rsa_free( rsa );
|
2009-01-03 21:51:57 +00:00
|
|
|
return( ret | POLARSSL_ERR_X509_KEY_INVALID_VERSION );
|
2009-01-03 21:22:43 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
if( ( ret = asn1_get_mpi( &p, end, &rsa->N ) ) != 0 ||
|
|
|
|
( ret = asn1_get_mpi( &p, end, &rsa->E ) ) != 0 ||
|
|
|
|
( ret = asn1_get_mpi( &p, end, &rsa->D ) ) != 0 ||
|
|
|
|
( ret = asn1_get_mpi( &p, end, &rsa->P ) ) != 0 ||
|
|
|
|
( ret = asn1_get_mpi( &p, end, &rsa->Q ) ) != 0 ||
|
|
|
|
( ret = asn1_get_mpi( &p, end, &rsa->DP ) ) != 0 ||
|
|
|
|
( ret = asn1_get_mpi( &p, end, &rsa->DQ ) ) != 0 ||
|
|
|
|
( ret = asn1_get_mpi( &p, end, &rsa->QP ) ) != 0 )
|
|
|
|
{
|
2011-02-12 14:30:57 +00:00
|
|
|
#if defined(POLARSSL_PEM_C)
|
|
|
|
pem_free( &pem );
|
|
|
|
#endif
|
2009-01-03 21:22:43 +00:00
|
|
|
rsa_free( rsa );
|
2009-01-03 21:51:57 +00:00
|
|
|
return( ret | POLARSSL_ERR_X509_KEY_INVALID_FORMAT );
|
2009-01-03 21:22:43 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
rsa->len = mpi_size( &rsa->N );
|
|
|
|
|
|
|
|
if( p != end )
|
|
|
|
{
|
2011-02-12 14:30:57 +00:00
|
|
|
#if defined(POLARSSL_PEM_C)
|
|
|
|
pem_free( &pem );
|
|
|
|
#endif
|
2009-01-03 21:22:43 +00:00
|
|
|
rsa_free( rsa );
|
2009-01-03 21:51:57 +00:00
|
|
|
return( POLARSSL_ERR_X509_KEY_INVALID_FORMAT |
|
|
|
|
POLARSSL_ERR_ASN1_LENGTH_MISMATCH );
|
2009-01-03 21:22:43 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
if( ( ret = rsa_check_privkey( rsa ) ) != 0 )
|
|
|
|
{
|
2011-02-12 14:30:57 +00:00
|
|
|
#if defined(POLARSSL_PEM_C)
|
|
|
|
pem_free( &pem );
|
|
|
|
#endif
|
2009-01-03 21:22:43 +00:00
|
|
|
rsa_free( rsa );
|
|
|
|
return( ret );
|
|
|
|
}
|
|
|
|
|
2011-02-12 14:30:57 +00:00
|
|
|
#if defined(POLARSSL_PEM_C)
|
|
|
|
pem_free( &pem );
|
|
|
|
#endif
|
2009-01-03 21:22:43 +00:00
|
|
|
|
|
|
|
return( 0 );
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Load and parse a private RSA key
|
|
|
|
*/
|
2010-03-16 21:09:09 +00:00
|
|
|
int x509parse_keyfile( rsa_context *rsa, const char *path, const char *pwd )
|
2009-01-03 21:22:43 +00:00
|
|
|
{
|
|
|
|
int ret;
|
|
|
|
size_t n;
|
|
|
|
unsigned char *buf;
|
|
|
|
|
2009-04-19 18:44:26 +00:00
|
|
|
if ( load_file( path, &buf, &n ) )
|
2009-01-03 21:22:43 +00:00
|
|
|
return( 1 );
|
|
|
|
|
|
|
|
if( pwd == NULL )
|
|
|
|
ret = x509parse_key( rsa, buf, (int) n, NULL, 0 );
|
|
|
|
else
|
|
|
|
ret = x509parse_key( rsa, buf, (int) n,
|
|
|
|
(unsigned char *) pwd, strlen( pwd ) );
|
|
|
|
|
|
|
|
memset( buf, 0, n + 1 );
|
|
|
|
free( buf );
|
|
|
|
|
|
|
|
return( ret );
|
|
|
|
}
|
|
|
|
|
2011-03-25 13:58:48 +00:00
|
|
|
/*
|
|
|
|
* Parse a public RSA key
|
|
|
|
*/
|
2011-04-24 08:57:21 +00:00
|
|
|
int x509parse_public_key( rsa_context *rsa, const unsigned char *key, size_t keylen )
|
2011-03-25 13:58:48 +00:00
|
|
|
{
|
2011-04-24 08:57:21 +00:00
|
|
|
int ret;
|
|
|
|
size_t len;
|
2011-03-25 13:58:48 +00:00
|
|
|
unsigned char *p, *end;
|
|
|
|
x509_buf alg_oid;
|
|
|
|
#if defined(POLARSSL_PEM_C)
|
|
|
|
pem_context pem;
|
|
|
|
|
|
|
|
pem_init( &pem );
|
|
|
|
ret = pem_read_buffer( &pem,
|
|
|
|
"-----BEGIN PUBLIC KEY-----",
|
|
|
|
"-----END PUBLIC KEY-----",
|
|
|
|
key, NULL, 0, &len );
|
|
|
|
|
|
|
|
if( ret == 0 )
|
|
|
|
{
|
|
|
|
/*
|
|
|
|
* Was PEM encoded
|
|
|
|
*/
|
|
|
|
keylen = pem.buflen;
|
|
|
|
}
|
|
|
|
else if( ret != POLARSSL_ERR_PEM_NO_HEADER_PRESENT )
|
|
|
|
{
|
|
|
|
pem_free( &pem );
|
|
|
|
return( ret );
|
|
|
|
}
|
|
|
|
|
|
|
|
p = ( ret == 0 ) ? pem.buf : (unsigned char *) key;
|
|
|
|
#else
|
|
|
|
p = (unsigned char *) key;
|
|
|
|
#endif
|
|
|
|
end = p + keylen;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* PublicKeyInfo ::= SEQUENCE {
|
|
|
|
* algorithm AlgorithmIdentifier,
|
|
|
|
* PublicKey BIT STRING
|
|
|
|
* }
|
|
|
|
*
|
|
|
|
* AlgorithmIdentifier ::= SEQUENCE {
|
|
|
|
* algorithm OBJECT IDENTIFIER,
|
|
|
|
* parameters ANY DEFINED BY algorithm OPTIONAL
|
|
|
|
* }
|
|
|
|
*
|
|
|
|
* RSAPublicKey ::= SEQUENCE {
|
|
|
|
* modulus INTEGER, -- n
|
|
|
|
* publicExponent INTEGER -- e
|
|
|
|
* }
|
|
|
|
*/
|
|
|
|
|
|
|
|
if( ( ret = asn1_get_tag( &p, end, &len,
|
|
|
|
ASN1_CONSTRUCTED | ASN1_SEQUENCE ) ) != 0 )
|
|
|
|
{
|
|
|
|
#if defined(POLARSSL_PEM_C)
|
|
|
|
pem_free( &pem );
|
|
|
|
#endif
|
|
|
|
rsa_free( rsa );
|
|
|
|
return( POLARSSL_ERR_X509_CERT_INVALID_FORMAT | ret );
|
|
|
|
}
|
|
|
|
|
|
|
|
if( ( ret = x509_get_pubkey( &p, end, &alg_oid, &rsa->N, &rsa->E ) ) != 0 )
|
|
|
|
{
|
|
|
|
#if defined(POLARSSL_PEM_C)
|
|
|
|
pem_free( &pem );
|
|
|
|
#endif
|
|
|
|
rsa_free( rsa );
|
|
|
|
return( POLARSSL_ERR_X509_KEY_INVALID_FORMAT | ret );
|
|
|
|
}
|
|
|
|
|
|
|
|
if( ( ret = rsa_check_pubkey( rsa ) ) != 0 )
|
|
|
|
{
|
|
|
|
#if defined(POLARSSL_PEM_C)
|
|
|
|
pem_free( &pem );
|
|
|
|
#endif
|
|
|
|
rsa_free( rsa );
|
|
|
|
return( ret );
|
|
|
|
}
|
|
|
|
|
|
|
|
rsa->len = mpi_size( &rsa->N );
|
|
|
|
|
|
|
|
#if defined(POLARSSL_PEM_C)
|
|
|
|
pem_free( &pem );
|
|
|
|
#endif
|
|
|
|
|
|
|
|
return( 0 );
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Load and parse a public RSA key
|
|
|
|
*/
|
|
|
|
int x509parse_public_keyfile( rsa_context *rsa, const char *path )
|
|
|
|
{
|
|
|
|
int ret;
|
|
|
|
size_t n;
|
|
|
|
unsigned char *buf;
|
|
|
|
|
|
|
|
if ( load_file( path, &buf, &n ) )
|
|
|
|
return( 1 );
|
|
|
|
|
|
|
|
ret = x509parse_public_key( rsa, buf, (int) n );
|
|
|
|
|
|
|
|
memset( buf, 0, n + 1 );
|
|
|
|
free( buf );
|
|
|
|
|
|
|
|
return( ret );
|
|
|
|
}
|
|
|
|
|
2011-04-04 21:36:15 +00:00
|
|
|
#if defined(POLARSSL_DHM_C)
|
2011-01-06 15:48:19 +00:00
|
|
|
/*
|
|
|
|
* Parse DHM parameters
|
|
|
|
*/
|
2011-04-24 08:57:21 +00:00
|
|
|
int x509parse_dhm( dhm_context *dhm, const unsigned char *dhmin, size_t dhminlen )
|
2011-01-06 15:48:19 +00:00
|
|
|
{
|
2011-04-24 08:57:21 +00:00
|
|
|
int ret;
|
|
|
|
size_t len;
|
2011-01-06 15:48:19 +00:00
|
|
|
unsigned char *p, *end;
|
2011-02-12 14:30:57 +00:00
|
|
|
#if defined(POLARSSL_PEM_C)
|
|
|
|
pem_context pem;
|
2011-01-06 15:48:19 +00:00
|
|
|
|
2011-02-12 14:30:57 +00:00
|
|
|
pem_init( &pem );
|
2011-01-06 15:48:19 +00:00
|
|
|
|
2011-02-12 14:30:57 +00:00
|
|
|
ret = pem_read_buffer( &pem,
|
|
|
|
"-----BEGIN DH PARAMETERS-----",
|
|
|
|
"-----END DH PARAMETERS-----",
|
|
|
|
dhmin, NULL, 0, &dhminlen );
|
2011-01-06 15:48:19 +00:00
|
|
|
|
2011-02-12 14:30:57 +00:00
|
|
|
if( ret == 0 )
|
|
|
|
{
|
|
|
|
/*
|
|
|
|
* Was PEM encoded
|
|
|
|
*/
|
|
|
|
dhminlen = pem.buflen;
|
2011-01-06 15:48:19 +00:00
|
|
|
}
|
2011-02-12 14:30:57 +00:00
|
|
|
else if( ret != POLARSSL_ERR_PEM_NO_HEADER_PRESENT )
|
2011-01-06 15:48:19 +00:00
|
|
|
{
|
2011-02-12 14:30:57 +00:00
|
|
|
pem_free( &pem );
|
|
|
|
return( ret );
|
2011-01-06 15:48:19 +00:00
|
|
|
}
|
|
|
|
|
2011-02-12 14:30:57 +00:00
|
|
|
p = ( ret == 0 ) ? pem.buf : (unsigned char *) dhmin;
|
|
|
|
#else
|
|
|
|
p = (unsigned char *) dhmin;
|
|
|
|
#endif
|
2011-01-06 15:48:19 +00:00
|
|
|
end = p + dhminlen;
|
|
|
|
|
2011-02-12 14:30:57 +00:00
|
|
|
memset( dhm, 0, sizeof( dhm_context ) );
|
|
|
|
|
2011-01-06 15:48:19 +00:00
|
|
|
/*
|
|
|
|
* DHParams ::= SEQUENCE {
|
|
|
|
* prime INTEGER, -- P
|
|
|
|
* generator INTEGER, -- g
|
|
|
|
* }
|
|
|
|
*/
|
|
|
|
if( ( ret = asn1_get_tag( &p, end, &len,
|
|
|
|
ASN1_CONSTRUCTED | ASN1_SEQUENCE ) ) != 0 )
|
|
|
|
{
|
2011-02-12 14:30:57 +00:00
|
|
|
#if defined(POLARSSL_PEM_C)
|
|
|
|
pem_free( &pem );
|
|
|
|
#endif
|
2011-01-06 15:48:19 +00:00
|
|
|
return( POLARSSL_ERR_X509_KEY_INVALID_FORMAT | ret );
|
|
|
|
}
|
|
|
|
|
|
|
|
end = p + len;
|
|
|
|
|
|
|
|
if( ( ret = asn1_get_mpi( &p, end, &dhm->P ) ) != 0 ||
|
|
|
|
( ret = asn1_get_mpi( &p, end, &dhm->G ) ) != 0 )
|
|
|
|
{
|
2011-02-12 14:30:57 +00:00
|
|
|
#if defined(POLARSSL_PEM_C)
|
|
|
|
pem_free( &pem );
|
|
|
|
#endif
|
2011-01-06 15:48:19 +00:00
|
|
|
dhm_free( dhm );
|
|
|
|
return( ret | POLARSSL_ERR_X509_KEY_INVALID_FORMAT );
|
|
|
|
}
|
|
|
|
|
|
|
|
if( p != end )
|
|
|
|
{
|
2011-02-12 14:30:57 +00:00
|
|
|
#if defined(POLARSSL_PEM_C)
|
|
|
|
pem_free( &pem );
|
|
|
|
#endif
|
2011-01-06 15:48:19 +00:00
|
|
|
dhm_free( dhm );
|
|
|
|
return( POLARSSL_ERR_X509_KEY_INVALID_FORMAT |
|
|
|
|
POLARSSL_ERR_ASN1_LENGTH_MISMATCH );
|
|
|
|
}
|
|
|
|
|
2011-02-12 14:30:57 +00:00
|
|
|
#if defined(POLARSSL_PEM_C)
|
|
|
|
pem_free( &pem );
|
|
|
|
#endif
|
2011-01-06 15:48:19 +00:00
|
|
|
|
|
|
|
return( 0 );
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Load and parse a private RSA key
|
|
|
|
*/
|
|
|
|
int x509parse_dhmfile( dhm_context *dhm, const char *path )
|
|
|
|
{
|
|
|
|
int ret;
|
|
|
|
size_t n;
|
|
|
|
unsigned char *buf;
|
|
|
|
|
|
|
|
if ( load_file( path, &buf, &n ) )
|
|
|
|
return( 1 );
|
|
|
|
|
|
|
|
ret = x509parse_dhm( dhm, buf, (int) n);
|
|
|
|
|
|
|
|
memset( buf, 0, n + 1 );
|
|
|
|
free( buf );
|
|
|
|
|
|
|
|
return( ret );
|
|
|
|
}
|
2011-04-04 21:36:15 +00:00
|
|
|
#endif /* POLARSSL_DHM_C */
|
2011-01-06 15:48:19 +00:00
|
|
|
|
2009-01-03 21:22:43 +00:00
|
|
|
#if defined _MSC_VER && !defined snprintf
|
2009-05-02 15:13:40 +00:00
|
|
|
#include <stdarg.h>
|
|
|
|
|
|
|
|
#if !defined vsnprintf
|
|
|
|
#define vsnprintf _vsnprintf
|
|
|
|
#endif // vsnprintf
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Windows _snprintf and _vsnprintf are not compatible to linux versions.
|
|
|
|
* Result value is not size of buffer needed, but -1 if no fit is possible.
|
|
|
|
*
|
|
|
|
* This fuction tries to 'fix' this by at least suggesting enlarging the
|
|
|
|
* size by 20.
|
|
|
|
*/
|
|
|
|
int compat_snprintf(char *str, size_t size, const char *format, ...)
|
|
|
|
{
|
|
|
|
va_list ap;
|
|
|
|
int res = -1;
|
|
|
|
|
|
|
|
va_start( ap, format );
|
|
|
|
|
|
|
|
res = vsnprintf( str, size, format, ap );
|
|
|
|
|
|
|
|
va_end( ap );
|
|
|
|
|
|
|
|
// No quick fix possible
|
|
|
|
if ( res < 0 )
|
2011-04-24 08:57:21 +00:00
|
|
|
return( (int) size + 20 );
|
2009-05-02 15:13:40 +00:00
|
|
|
|
|
|
|
return res;
|
|
|
|
}
|
|
|
|
|
|
|
|
#define snprintf compat_snprintf
|
2009-01-03 21:22:43 +00:00
|
|
|
#endif
|
|
|
|
|
2009-05-02 15:13:40 +00:00
|
|
|
#define POLARSSL_ERR_DEBUG_BUF_TOO_SMALL -2
|
|
|
|
|
|
|
|
#define SAFE_SNPRINTF() \
|
|
|
|
{ \
|
|
|
|
if( ret == -1 ) \
|
|
|
|
return( -1 ); \
|
|
|
|
\
|
2011-04-24 08:57:21 +00:00
|
|
|
if ( (unsigned int) ret > n ) { \
|
2009-05-02 15:13:40 +00:00
|
|
|
p[n - 1] = '\0'; \
|
|
|
|
return POLARSSL_ERR_DEBUG_BUF_TOO_SMALL;\
|
|
|
|
} \
|
|
|
|
\
|
2011-04-24 08:57:21 +00:00
|
|
|
n -= (unsigned int) ret; \
|
|
|
|
p += (unsigned int) ret; \
|
2009-05-02 15:13:40 +00:00
|
|
|
}
|
|
|
|
|
2009-01-03 21:22:43 +00:00
|
|
|
/*
|
|
|
|
* Store the name in printable form into buf; no more
|
2009-05-02 15:13:40 +00:00
|
|
|
* than size characters will be written
|
2009-01-03 21:22:43 +00:00
|
|
|
*/
|
2010-03-16 21:09:09 +00:00
|
|
|
int x509parse_dn_gets( char *buf, size_t size, const x509_name *dn )
|
2009-01-03 21:22:43 +00:00
|
|
|
{
|
2011-04-24 08:57:21 +00:00
|
|
|
int ret;
|
|
|
|
size_t i, n;
|
2009-01-03 21:22:43 +00:00
|
|
|
unsigned char c;
|
2010-03-16 21:09:09 +00:00
|
|
|
const x509_name *name;
|
2009-01-03 21:22:43 +00:00
|
|
|
char s[128], *p;
|
|
|
|
|
|
|
|
memset( s, 0, sizeof( s ) );
|
|
|
|
|
|
|
|
name = dn;
|
|
|
|
p = buf;
|
2009-05-02 15:13:40 +00:00
|
|
|
n = size;
|
2009-01-03 21:22:43 +00:00
|
|
|
|
|
|
|
while( name != NULL )
|
|
|
|
{
|
2011-01-15 16:57:55 +00:00
|
|
|
if( name != dn )
|
|
|
|
{
|
2009-05-02 15:13:40 +00:00
|
|
|
ret = snprintf( p, n, ", " );
|
|
|
|
SAFE_SNPRINTF();
|
|
|
|
}
|
2009-01-03 21:22:43 +00:00
|
|
|
|
|
|
|
if( memcmp( name->oid.p, OID_X520, 2 ) == 0 )
|
|
|
|
{
|
|
|
|
switch( name->oid.p[2] )
|
|
|
|
{
|
|
|
|
case X520_COMMON_NAME:
|
2009-05-02 15:13:40 +00:00
|
|
|
ret = snprintf( p, n, "CN=" ); break;
|
2009-01-03 21:22:43 +00:00
|
|
|
|
|
|
|
case X520_COUNTRY:
|
2009-05-02 15:13:40 +00:00
|
|
|
ret = snprintf( p, n, "C=" ); break;
|
2009-01-03 21:22:43 +00:00
|
|
|
|
|
|
|
case X520_LOCALITY:
|
2009-05-02 15:13:40 +00:00
|
|
|
ret = snprintf( p, n, "L=" ); break;
|
2009-01-03 21:22:43 +00:00
|
|
|
|
|
|
|
case X520_STATE:
|
2009-05-02 15:13:40 +00:00
|
|
|
ret = snprintf( p, n, "ST=" ); break;
|
2009-01-03 21:22:43 +00:00
|
|
|
|
|
|
|
case X520_ORGANIZATION:
|
2009-05-02 15:13:40 +00:00
|
|
|
ret = snprintf( p, n, "O=" ); break;
|
2009-01-03 21:22:43 +00:00
|
|
|
|
|
|
|
case X520_ORG_UNIT:
|
2009-05-02 15:13:40 +00:00
|
|
|
ret = snprintf( p, n, "OU=" ); break;
|
2009-01-03 21:22:43 +00:00
|
|
|
|
|
|
|
default:
|
2009-05-02 15:13:40 +00:00
|
|
|
ret = snprintf( p, n, "0x%02X=",
|
2009-01-03 21:22:43 +00:00
|
|
|
name->oid.p[2] );
|
|
|
|
break;
|
|
|
|
}
|
2009-05-02 15:13:40 +00:00
|
|
|
SAFE_SNPRINTF();
|
2009-01-03 21:22:43 +00:00
|
|
|
}
|
|
|
|
else if( memcmp( name->oid.p, OID_PKCS9, 8 ) == 0 )
|
|
|
|
{
|
|
|
|
switch( name->oid.p[8] )
|
|
|
|
{
|
|
|
|
case PKCS9_EMAIL:
|
2009-05-02 15:13:40 +00:00
|
|
|
ret = snprintf( p, n, "emailAddress=" ); break;
|
2009-01-03 21:22:43 +00:00
|
|
|
|
|
|
|
default:
|
2009-05-02 15:13:40 +00:00
|
|
|
ret = snprintf( p, n, "0x%02X=",
|
2009-01-03 21:22:43 +00:00
|
|
|
name->oid.p[8] );
|
|
|
|
break;
|
|
|
|
}
|
2009-05-02 15:13:40 +00:00
|
|
|
SAFE_SNPRINTF();
|
2009-01-03 21:22:43 +00:00
|
|
|
}
|
|
|
|
else
|
2011-01-15 16:57:55 +00:00
|
|
|
{
|
2009-05-02 15:13:40 +00:00
|
|
|
ret = snprintf( p, n, "\?\?=" );
|
2011-01-15 16:57:55 +00:00
|
|
|
SAFE_SNPRINTF();
|
2009-05-02 15:13:40 +00:00
|
|
|
}
|
2009-01-03 21:22:43 +00:00
|
|
|
|
|
|
|
for( i = 0; i < name->val.len; i++ )
|
|
|
|
{
|
|
|
|
if( i >= (int) sizeof( s ) - 1 )
|
|
|
|
break;
|
|
|
|
|
|
|
|
c = name->val.p[i];
|
|
|
|
if( c < 32 || c == 127 || ( c > 128 && c < 160 ) )
|
|
|
|
s[i] = '?';
|
|
|
|
else s[i] = c;
|
|
|
|
}
|
|
|
|
s[i] = '\0';
|
2009-05-02 15:13:40 +00:00
|
|
|
ret = snprintf( p, n, "%s", s );
|
|
|
|
SAFE_SNPRINTF();
|
2009-01-03 21:22:43 +00:00
|
|
|
name = name->next;
|
|
|
|
}
|
|
|
|
|
2011-04-24 08:57:21 +00:00
|
|
|
return( (int) ( size - n ) );
|
2009-01-03 21:22:43 +00:00
|
|
|
}
|
|
|
|
|
2011-01-16 21:34:59 +00:00
|
|
|
/*
|
|
|
|
* Store the serial in printable form into buf; no more
|
|
|
|
* than size characters will be written
|
|
|
|
*/
|
|
|
|
int x509parse_serial_gets( char *buf, size_t size, const x509_buf *serial )
|
|
|
|
{
|
2011-04-24 08:57:21 +00:00
|
|
|
int ret;
|
|
|
|
size_t i, n, nr;
|
2011-01-16 21:34:59 +00:00
|
|
|
char *p;
|
|
|
|
|
|
|
|
p = buf;
|
|
|
|
n = size;
|
|
|
|
|
|
|
|
nr = ( serial->len <= 32 )
|
|
|
|
? serial->len : 32;
|
|
|
|
|
|
|
|
for( i = 0; i < nr; i++ )
|
|
|
|
{
|
|
|
|
ret = snprintf( p, n, "%02X%s",
|
|
|
|
serial->p[i], ( i < nr - 1 ) ? ":" : "" );
|
|
|
|
SAFE_SNPRINTF();
|
|
|
|
}
|
|
|
|
|
2011-04-24 08:57:21 +00:00
|
|
|
return( (int) ( size - n ) );
|
2011-01-16 21:34:59 +00:00
|
|
|
}
|
|
|
|
|
2009-01-03 21:22:43 +00:00
|
|
|
/*
|
2009-05-02 15:13:40 +00:00
|
|
|
* Return an informational string about the certificate.
|
2009-01-03 21:22:43 +00:00
|
|
|
*/
|
2010-03-16 21:09:09 +00:00
|
|
|
int x509parse_cert_info( char *buf, size_t size, const char *prefix,
|
|
|
|
const x509_cert *crt )
|
2009-01-03 21:22:43 +00:00
|
|
|
{
|
2011-04-24 08:57:21 +00:00
|
|
|
int ret;
|
|
|
|
size_t n;
|
2009-05-02 15:13:40 +00:00
|
|
|
char *p;
|
2009-01-03 21:22:43 +00:00
|
|
|
|
|
|
|
p = buf;
|
2009-05-02 15:13:40 +00:00
|
|
|
n = size;
|
2009-01-03 21:22:43 +00:00
|
|
|
|
2009-05-02 15:13:40 +00:00
|
|
|
ret = snprintf( p, n, "%scert. version : %d\n",
|
2009-01-03 21:22:43 +00:00
|
|
|
prefix, crt->version );
|
2009-05-02 15:13:40 +00:00
|
|
|
SAFE_SNPRINTF();
|
|
|
|
ret = snprintf( p, n, "%sserial number : ",
|
2009-01-03 21:22:43 +00:00
|
|
|
prefix );
|
2009-05-02 15:13:40 +00:00
|
|
|
SAFE_SNPRINTF();
|
2009-01-03 21:22:43 +00:00
|
|
|
|
2011-01-16 21:34:59 +00:00
|
|
|
ret = x509parse_serial_gets( p, n, &crt->serial);
|
|
|
|
SAFE_SNPRINTF();
|
2009-01-03 21:22:43 +00:00
|
|
|
|
2009-05-02 15:13:40 +00:00
|
|
|
ret = snprintf( p, n, "\n%sissuer name : ", prefix );
|
|
|
|
SAFE_SNPRINTF();
|
|
|
|
ret = x509parse_dn_gets( p, n, &crt->issuer );
|
|
|
|
SAFE_SNPRINTF();
|
2009-01-03 21:22:43 +00:00
|
|
|
|
2009-05-02 15:13:40 +00:00
|
|
|
ret = snprintf( p, n, "\n%ssubject name : ", prefix );
|
|
|
|
SAFE_SNPRINTF();
|
|
|
|
ret = x509parse_dn_gets( p, n, &crt->subject );
|
|
|
|
SAFE_SNPRINTF();
|
2009-01-03 21:22:43 +00:00
|
|
|
|
2009-05-02 15:13:40 +00:00
|
|
|
ret = snprintf( p, n, "\n%sissued on : " \
|
2009-01-03 21:22:43 +00:00
|
|
|
"%04d-%02d-%02d %02d:%02d:%02d", prefix,
|
|
|
|
crt->valid_from.year, crt->valid_from.mon,
|
|
|
|
crt->valid_from.day, crt->valid_from.hour,
|
|
|
|
crt->valid_from.min, crt->valid_from.sec );
|
2009-05-02 15:13:40 +00:00
|
|
|
SAFE_SNPRINTF();
|
2009-01-03 21:22:43 +00:00
|
|
|
|
2009-05-02 15:13:40 +00:00
|
|
|
ret = snprintf( p, n, "\n%sexpires on : " \
|
2009-01-03 21:22:43 +00:00
|
|
|
"%04d-%02d-%02d %02d:%02d:%02d", prefix,
|
|
|
|
crt->valid_to.year, crt->valid_to.mon,
|
|
|
|
crt->valid_to.day, crt->valid_to.hour,
|
|
|
|
crt->valid_to.min, crt->valid_to.sec );
|
2009-05-02 15:13:40 +00:00
|
|
|
SAFE_SNPRINTF();
|
2009-01-03 21:22:43 +00:00
|
|
|
|
2009-05-02 15:13:40 +00:00
|
|
|
ret = snprintf( p, n, "\n%ssigned using : RSA+", prefix );
|
|
|
|
SAFE_SNPRINTF();
|
2009-01-03 21:22:43 +00:00
|
|
|
|
2010-03-17 06:56:01 +00:00
|
|
|
switch( crt->sig_alg )
|
2009-01-03 21:22:43 +00:00
|
|
|
{
|
2009-05-02 15:13:40 +00:00
|
|
|
case SIG_RSA_MD2 : ret = snprintf( p, n, "MD2" ); break;
|
|
|
|
case SIG_RSA_MD4 : ret = snprintf( p, n, "MD4" ); break;
|
|
|
|
case SIG_RSA_MD5 : ret = snprintf( p, n, "MD5" ); break;
|
|
|
|
case SIG_RSA_SHA1 : ret = snprintf( p, n, "SHA1" ); break;
|
|
|
|
case SIG_RSA_SHA224 : ret = snprintf( p, n, "SHA224" ); break;
|
|
|
|
case SIG_RSA_SHA256 : ret = snprintf( p, n, "SHA256" ); break;
|
|
|
|
case SIG_RSA_SHA384 : ret = snprintf( p, n, "SHA384" ); break;
|
|
|
|
case SIG_RSA_SHA512 : ret = snprintf( p, n, "SHA512" ); break;
|
|
|
|
default: ret = snprintf( p, n, "???" ); break;
|
2009-01-03 21:22:43 +00:00
|
|
|
}
|
2009-05-02 15:13:40 +00:00
|
|
|
SAFE_SNPRINTF();
|
2009-01-03 21:22:43 +00:00
|
|
|
|
2009-05-02 15:13:40 +00:00
|
|
|
ret = snprintf( p, n, "\n%sRSA key size : %d bits\n", prefix,
|
2009-01-03 21:22:43 +00:00
|
|
|
crt->rsa.N.n * (int) sizeof( unsigned long ) * 8 );
|
2009-05-02 15:13:40 +00:00
|
|
|
SAFE_SNPRINTF();
|
2009-01-03 21:22:43 +00:00
|
|
|
|
2011-04-24 08:57:21 +00:00
|
|
|
return( (int) ( size - n ) );
|
2009-05-02 15:13:40 +00:00
|
|
|
}
|
|
|
|
|
2011-01-15 16:57:55 +00:00
|
|
|
/* Compare a given OID string with an OID x509_buf * */
|
|
|
|
#define OID_CMP(oid_str, oid_buf) \
|
|
|
|
( ( OID_SIZE(oid_str) == (oid_buf)->len ) && \
|
|
|
|
memcmp( (oid_str), (oid_buf)->p, (oid_buf)->len) == 0)
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Return an informational string describing the given OID
|
|
|
|
*/
|
|
|
|
const char *x509_oid_get_description( x509_buf *oid )
|
|
|
|
{
|
|
|
|
if ( oid == NULL )
|
|
|
|
return ( NULL );
|
|
|
|
|
|
|
|
else if( OID_CMP( OID_SERVER_AUTH, oid ) )
|
|
|
|
return( STRING_SERVER_AUTH );
|
|
|
|
|
|
|
|
else if( OID_CMP( OID_CLIENT_AUTH, oid ) )
|
|
|
|
return( STRING_CLIENT_AUTH );
|
|
|
|
|
|
|
|
else if( OID_CMP( OID_CODE_SIGNING, oid ) )
|
|
|
|
return( STRING_CODE_SIGNING );
|
|
|
|
|
|
|
|
else if( OID_CMP( OID_EMAIL_PROTECTION, oid ) )
|
|
|
|
return( STRING_EMAIL_PROTECTION );
|
|
|
|
|
|
|
|
else if( OID_CMP( OID_TIME_STAMPING, oid ) )
|
|
|
|
return( STRING_TIME_STAMPING );
|
|
|
|
|
|
|
|
else if( OID_CMP( OID_OCSP_SIGNING, oid ) )
|
|
|
|
return( STRING_OCSP_SIGNING );
|
|
|
|
|
|
|
|
return( NULL );
|
|
|
|
}
|
|
|
|
|
|
|
|
/* Return the x.y.z.... style numeric string for the given OID */
|
|
|
|
int x509_oid_get_numeric_string( char *buf, size_t size, x509_buf *oid )
|
|
|
|
{
|
2011-04-24 08:57:21 +00:00
|
|
|
int ret;
|
|
|
|
size_t i, n;
|
2011-01-15 16:57:55 +00:00
|
|
|
unsigned int value;
|
|
|
|
char *p;
|
|
|
|
|
|
|
|
p = buf;
|
|
|
|
n = size;
|
|
|
|
|
|
|
|
/* First byte contains first two dots */
|
|
|
|
if( oid->len > 0 )
|
|
|
|
{
|
|
|
|
ret = snprintf( p, n, "%d.%d", oid->p[0]/40, oid->p[0]%40 );
|
|
|
|
SAFE_SNPRINTF();
|
|
|
|
}
|
|
|
|
|
|
|
|
/* TODO: value can overflow in value. */
|
|
|
|
value = 0;
|
2011-04-24 08:57:21 +00:00
|
|
|
for( i = 1; i < oid->len; i++ )
|
2011-01-15 16:57:55 +00:00
|
|
|
{
|
|
|
|
value <<= 7;
|
|
|
|
value += oid->p[i] & 0x7F;
|
|
|
|
|
|
|
|
if( !( oid->p[i] & 0x80 ) )
|
|
|
|
{
|
|
|
|
/* Last byte */
|
|
|
|
ret = snprintf( p, n, ".%d", value );
|
|
|
|
SAFE_SNPRINTF();
|
|
|
|
value = 0;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2011-04-24 08:57:21 +00:00
|
|
|
return( (int) ( size - n ) );
|
2011-01-15 16:57:55 +00:00
|
|
|
}
|
|
|
|
|
2009-05-02 15:13:40 +00:00
|
|
|
/*
|
|
|
|
* Return an informational string about the CRL.
|
|
|
|
*/
|
2010-03-16 21:09:09 +00:00
|
|
|
int x509parse_crl_info( char *buf, size_t size, const char *prefix,
|
|
|
|
const x509_crl *crl )
|
2009-05-02 15:13:40 +00:00
|
|
|
{
|
2011-04-24 08:57:21 +00:00
|
|
|
int ret;
|
|
|
|
size_t i, n, nr;
|
2009-05-02 15:13:40 +00:00
|
|
|
char *p;
|
2010-03-16 21:09:09 +00:00
|
|
|
const x509_crl_entry *entry;
|
2009-05-02 15:13:40 +00:00
|
|
|
|
|
|
|
p = buf;
|
|
|
|
n = size;
|
|
|
|
|
|
|
|
ret = snprintf( p, n, "%sCRL version : %d",
|
|
|
|
prefix, crl->version );
|
|
|
|
SAFE_SNPRINTF();
|
|
|
|
|
|
|
|
ret = snprintf( p, n, "\n%sissuer name : ", prefix );
|
|
|
|
SAFE_SNPRINTF();
|
|
|
|
ret = x509parse_dn_gets( p, n, &crl->issuer );
|
|
|
|
SAFE_SNPRINTF();
|
|
|
|
|
|
|
|
ret = snprintf( p, n, "\n%sthis update : " \
|
|
|
|
"%04d-%02d-%02d %02d:%02d:%02d", prefix,
|
|
|
|
crl->this_update.year, crl->this_update.mon,
|
|
|
|
crl->this_update.day, crl->this_update.hour,
|
|
|
|
crl->this_update.min, crl->this_update.sec );
|
|
|
|
SAFE_SNPRINTF();
|
|
|
|
|
|
|
|
ret = snprintf( p, n, "\n%snext update : " \
|
|
|
|
"%04d-%02d-%02d %02d:%02d:%02d", prefix,
|
|
|
|
crl->next_update.year, crl->next_update.mon,
|
|
|
|
crl->next_update.day, crl->next_update.hour,
|
|
|
|
crl->next_update.min, crl->next_update.sec );
|
|
|
|
SAFE_SNPRINTF();
|
|
|
|
|
|
|
|
entry = &crl->entry;
|
|
|
|
|
|
|
|
ret = snprintf( p, n, "\n%sRevoked certificates:",
|
|
|
|
prefix );
|
|
|
|
SAFE_SNPRINTF();
|
|
|
|
|
2009-07-27 20:21:53 +00:00
|
|
|
while( entry != NULL && entry->raw.len != 0 )
|
2009-05-02 15:13:40 +00:00
|
|
|
{
|
|
|
|
ret = snprintf( p, n, "\n%sserial number: ",
|
|
|
|
prefix );
|
|
|
|
SAFE_SNPRINTF();
|
|
|
|
|
|
|
|
nr = ( entry->serial.len <= 32 )
|
|
|
|
? entry->serial.len : 32;
|
|
|
|
|
2011-01-15 16:57:55 +00:00
|
|
|
for( i = 0; i < nr; i++ )
|
|
|
|
{
|
2009-05-02 15:13:40 +00:00
|
|
|
ret = snprintf( p, n, "%02X%s",
|
|
|
|
entry->serial.p[i], ( i < nr - 1 ) ? ":" : "" );
|
|
|
|
SAFE_SNPRINTF();
|
|
|
|
}
|
|
|
|
|
|
|
|
ret = snprintf( p, n, " revocation date: " \
|
|
|
|
"%04d-%02d-%02d %02d:%02d:%02d",
|
|
|
|
entry->revocation_date.year, entry->revocation_date.mon,
|
|
|
|
entry->revocation_date.day, entry->revocation_date.hour,
|
|
|
|
entry->revocation_date.min, entry->revocation_date.sec );
|
|
|
|
SAFE_SNPRINTF();
|
|
|
|
|
|
|
|
entry = entry->next;
|
|
|
|
}
|
|
|
|
|
|
|
|
ret = snprintf( p, n, "\n%ssigned using : RSA+", prefix );
|
|
|
|
SAFE_SNPRINTF();
|
|
|
|
|
2010-03-17 06:56:01 +00:00
|
|
|
switch( crl->sig_alg )
|
2009-05-02 15:13:40 +00:00
|
|
|
{
|
|
|
|
case SIG_RSA_MD2 : ret = snprintf( p, n, "MD2" ); break;
|
|
|
|
case SIG_RSA_MD4 : ret = snprintf( p, n, "MD4" ); break;
|
|
|
|
case SIG_RSA_MD5 : ret = snprintf( p, n, "MD5" ); break;
|
|
|
|
case SIG_RSA_SHA1 : ret = snprintf( p, n, "SHA1" ); break;
|
|
|
|
case SIG_RSA_SHA224 : ret = snprintf( p, n, "SHA224" ); break;
|
|
|
|
case SIG_RSA_SHA256 : ret = snprintf( p, n, "SHA256" ); break;
|
|
|
|
case SIG_RSA_SHA384 : ret = snprintf( p, n, "SHA384" ); break;
|
|
|
|
case SIG_RSA_SHA512 : ret = snprintf( p, n, "SHA512" ); break;
|
|
|
|
default: ret = snprintf( p, n, "???" ); break;
|
|
|
|
}
|
|
|
|
SAFE_SNPRINTF();
|
|
|
|
|
2009-07-19 20:25:25 +00:00
|
|
|
ret = snprintf( p, n, "\n" );
|
|
|
|
SAFE_SNPRINTF();
|
|
|
|
|
2011-04-24 08:57:21 +00:00
|
|
|
return( (int) ( size - n ) );
|
2009-01-03 21:22:43 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
2009-05-03 10:18:48 +00:00
|
|
|
* Return 0 if the x509_time is still valid, or 1 otherwise.
|
2009-01-03 21:22:43 +00:00
|
|
|
*/
|
2010-03-16 21:09:09 +00:00
|
|
|
int x509parse_time_expired( const x509_time *to )
|
2009-01-03 21:22:43 +00:00
|
|
|
{
|
|
|
|
struct tm *lt;
|
|
|
|
time_t tt;
|
|
|
|
|
|
|
|
tt = time( NULL );
|
|
|
|
lt = localtime( &tt );
|
|
|
|
|
2009-05-03 10:18:48 +00:00
|
|
|
if( lt->tm_year > to->year - 1900 )
|
|
|
|
return( 1 );
|
|
|
|
|
|
|
|
if( lt->tm_year == to->year - 1900 &&
|
|
|
|
lt->tm_mon > to->mon - 1 )
|
|
|
|
return( 1 );
|
|
|
|
|
|
|
|
if( lt->tm_year == to->year - 1900 &&
|
|
|
|
lt->tm_mon == to->mon - 1 &&
|
|
|
|
lt->tm_mday > to->day )
|
|
|
|
return( 1 );
|
|
|
|
|
2011-01-16 21:40:22 +00:00
|
|
|
if( lt->tm_year == to->year - 1900 &&
|
|
|
|
lt->tm_mon == to->mon - 1 &&
|
|
|
|
lt->tm_mday == to->day &&
|
|
|
|
lt->tm_hour > to->hour - 1)
|
|
|
|
return( 1 );
|
|
|
|
|
|
|
|
if( lt->tm_year == to->year - 1900 &&
|
|
|
|
lt->tm_mon == to->mon - 1 &&
|
|
|
|
lt->tm_mday == to->day &&
|
|
|
|
lt->tm_hour == to->hour - 1 &&
|
|
|
|
lt->tm_min > to->min - 1 )
|
|
|
|
return( 1 );
|
|
|
|
|
|
|
|
if( lt->tm_year == to->year - 1900 &&
|
|
|
|
lt->tm_mon == to->mon - 1 &&
|
|
|
|
lt->tm_mday == to->day &&
|
|
|
|
lt->tm_hour == to->hour - 1 &&
|
|
|
|
lt->tm_min == to->min - 1 &&
|
|
|
|
lt->tm_sec > to->sec - 1 )
|
|
|
|
return( 1 );
|
|
|
|
|
2009-05-03 10:18:48 +00:00
|
|
|
return( 0 );
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Return 1 if the certificate is revoked, or 0 otherwise.
|
|
|
|
*/
|
2010-03-16 21:09:09 +00:00
|
|
|
int x509parse_revoked( const x509_cert *crt, const x509_crl *crl )
|
2009-05-03 10:18:48 +00:00
|
|
|
{
|
2010-03-16 21:09:09 +00:00
|
|
|
const x509_crl_entry *cur = &crl->entry;
|
2009-01-03 21:22:43 +00:00
|
|
|
|
2009-05-03 10:18:48 +00:00
|
|
|
while( cur != NULL && cur->serial.len != 0 )
|
|
|
|
{
|
2011-01-16 21:38:35 +00:00
|
|
|
if( crt->serial.len == cur->serial.len &&
|
|
|
|
memcmp( crt->serial.p, cur->serial.p, crt->serial.len ) == 0 )
|
2009-05-03 10:18:48 +00:00
|
|
|
{
|
|
|
|
if( x509parse_time_expired( &cur->revocation_date ) )
|
|
|
|
return( 1 );
|
|
|
|
}
|
2009-01-03 21:22:43 +00:00
|
|
|
|
2009-05-03 10:18:48 +00:00
|
|
|
cur = cur->next;
|
|
|
|
}
|
2009-01-03 21:22:43 +00:00
|
|
|
|
|
|
|
return( 0 );
|
|
|
|
}
|
|
|
|
|
2009-10-03 19:58:52 +00:00
|
|
|
/*
|
|
|
|
* Wrapper for x509 hashes.
|
|
|
|
*
|
2011-01-18 14:58:55 +00:00
|
|
|
* \param out Buffer to receive the hash (Should be at least 64 bytes)
|
2009-10-03 19:58:52 +00:00
|
|
|
*/
|
2011-04-24 08:57:21 +00:00
|
|
|
static void x509_hash( const unsigned char *in, size_t len, int alg,
|
2009-01-03 21:22:43 +00:00
|
|
|
unsigned char *out )
|
|
|
|
{
|
|
|
|
switch( alg )
|
|
|
|
{
|
2009-01-03 21:51:57 +00:00
|
|
|
#if defined(POLARSSL_MD2_C)
|
2009-02-09 22:32:35 +00:00
|
|
|
case SIG_RSA_MD2 : md2( in, len, out ); break;
|
2009-01-03 21:22:43 +00:00
|
|
|
#endif
|
2009-01-03 21:51:57 +00:00
|
|
|
#if defined(POLARSSL_MD4_C)
|
2009-02-09 22:32:35 +00:00
|
|
|
case SIG_RSA_MD4 : md4( in, len, out ); break;
|
|
|
|
#endif
|
2009-10-03 19:58:52 +00:00
|
|
|
#if defined(POLARSSL_MD5_C)
|
2009-02-09 22:32:35 +00:00
|
|
|
case SIG_RSA_MD5 : md5( in, len, out ); break;
|
2009-10-03 19:58:52 +00:00
|
|
|
#endif
|
|
|
|
#if defined(POLARSSL_SHA1_C)
|
2009-02-09 22:32:35 +00:00
|
|
|
case SIG_RSA_SHA1 : sha1( in, len, out ); break;
|
2009-10-03 19:58:52 +00:00
|
|
|
#endif
|
2009-02-09 22:32:35 +00:00
|
|
|
#if defined(POLARSSL_SHA2_C)
|
|
|
|
case SIG_RSA_SHA224 : sha2( in, len, out, 1 ); break;
|
|
|
|
case SIG_RSA_SHA256 : sha2( in, len, out, 0 ); break;
|
|
|
|
#endif
|
2009-10-03 20:09:14 +00:00
|
|
|
#if defined(POLARSSL_SHA4_C)
|
2009-02-09 22:32:35 +00:00
|
|
|
case SIG_RSA_SHA384 : sha4( in, len, out, 1 ); break;
|
|
|
|
case SIG_RSA_SHA512 : sha4( in, len, out, 0 ); break;
|
2009-01-03 21:22:43 +00:00
|
|
|
#endif
|
|
|
|
default:
|
2009-10-03 19:58:52 +00:00
|
|
|
memset( out, '\xFF', 64 );
|
2009-01-03 21:22:43 +00:00
|
|
|
break;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2011-01-16 21:12:10 +00:00
|
|
|
/*
|
|
|
|
* Check that the given certificate is valid accoring to the CRL.
|
|
|
|
*/
|
|
|
|
static int x509parse_verifycrl(x509_cert *crt, x509_cert *ca,
|
|
|
|
x509_crl *crl_list)
|
|
|
|
{
|
|
|
|
int flags = 0;
|
|
|
|
int hash_id;
|
|
|
|
unsigned char hash[64];
|
|
|
|
|
|
|
|
/*
|
|
|
|
* TODO: What happens if no CRL is present?
|
|
|
|
* Suggestion: Revocation state should be unknown if no CRL is present.
|
|
|
|
* For backwards compatibility this is not yet implemented.
|
|
|
|
*/
|
|
|
|
|
|
|
|
while( ca != NULL && crl_list != NULL && crl_list->version != 0 )
|
|
|
|
{
|
|
|
|
if( crl_list->issuer_raw.len != ca->subject_raw.len ||
|
|
|
|
memcmp( crl_list->issuer_raw.p, ca->subject_raw.p,
|
|
|
|
crl_list->issuer_raw.len ) != 0 )
|
|
|
|
{
|
|
|
|
crl_list = crl_list->next;
|
|
|
|
continue;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Check if CRL is correctly signed by the trusted CA
|
|
|
|
*/
|
|
|
|
hash_id = crl_list->sig_alg;
|
|
|
|
|
|
|
|
x509_hash( crl_list->tbs.p, crl_list->tbs.len, hash_id, hash );
|
|
|
|
|
|
|
|
if( !rsa_pkcs1_verify( &ca->rsa, RSA_PUBLIC, hash_id,
|
|
|
|
0, hash, crl_list->sig.p ) == 0 )
|
|
|
|
{
|
|
|
|
/*
|
|
|
|
* CRL is not trusted
|
|
|
|
*/
|
|
|
|
flags |= BADCRL_NOT_TRUSTED;
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Check for validity of CRL (Do not drop out)
|
|
|
|
*/
|
|
|
|
if( x509parse_time_expired( &crl_list->next_update ) )
|
|
|
|
flags |= BADCRL_EXPIRED;
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Check if certificate is revoked
|
|
|
|
*/
|
|
|
|
if( x509parse_revoked(crt, crl_list) )
|
|
|
|
{
|
|
|
|
flags |= BADCERT_REVOKED;
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
|
|
|
crl_list = crl_list->next;
|
|
|
|
}
|
|
|
|
return flags;
|
|
|
|
}
|
|
|
|
|
2009-01-03 21:22:43 +00:00
|
|
|
/*
|
|
|
|
* Verify the certificate validity
|
|
|
|
*/
|
|
|
|
int x509parse_verify( x509_cert *crt,
|
|
|
|
x509_cert *trust_ca,
|
2009-05-03 10:18:48 +00:00
|
|
|
x509_crl *ca_crl,
|
2011-01-13 17:54:59 +00:00
|
|
|
const char *cn, int *flags,
|
|
|
|
int (*f_vrfy)(void *, x509_cert *, int, int),
|
|
|
|
void *p_vrfy )
|
2009-01-03 21:22:43 +00:00
|
|
|
{
|
2011-04-24 08:57:21 +00:00
|
|
|
size_t cn_len;
|
2009-01-03 21:22:43 +00:00
|
|
|
int hash_id;
|
|
|
|
int pathlen;
|
2011-01-16 21:12:10 +00:00
|
|
|
x509_cert *parent;
|
2009-01-03 21:22:43 +00:00
|
|
|
x509_name *name;
|
2009-02-09 22:32:35 +00:00
|
|
|
unsigned char hash[64];
|
2009-01-03 21:22:43 +00:00
|
|
|
|
2009-05-03 10:18:48 +00:00
|
|
|
*flags = 0;
|
|
|
|
|
|
|
|
if( x509parse_time_expired( &crt->valid_to ) )
|
|
|
|
*flags = BADCERT_EXPIRED;
|
2009-01-03 21:22:43 +00:00
|
|
|
|
|
|
|
if( cn != NULL )
|
|
|
|
{
|
|
|
|
name = &crt->subject;
|
|
|
|
cn_len = strlen( cn );
|
|
|
|
|
|
|
|
while( name != NULL )
|
|
|
|
{
|
|
|
|
if( memcmp( name->oid.p, OID_CN, 3 ) == 0 &&
|
|
|
|
memcmp( name->val.p, cn, cn_len ) == 0 &&
|
|
|
|
name->val.len == cn_len )
|
|
|
|
break;
|
|
|
|
|
|
|
|
name = name->next;
|
|
|
|
}
|
|
|
|
|
|
|
|
if( name == NULL )
|
|
|
|
*flags |= BADCERT_CN_MISMATCH;
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Iterate upwards in the given cert chain,
|
|
|
|
* ignoring any upper cert with CA != TRUE.
|
|
|
|
*/
|
2011-01-16 21:12:10 +00:00
|
|
|
parent = crt->next;
|
2009-01-03 21:22:43 +00:00
|
|
|
|
|
|
|
pathlen = 1;
|
|
|
|
|
2011-01-16 21:12:10 +00:00
|
|
|
while( parent != NULL && parent->version != 0 )
|
2009-01-03 21:22:43 +00:00
|
|
|
{
|
2011-01-16 21:12:10 +00:00
|
|
|
if( parent->ca_istrue == 0 ||
|
|
|
|
crt->issuer_raw.len != parent->subject_raw.len ||
|
|
|
|
memcmp( crt->issuer_raw.p, parent->subject_raw.p,
|
2009-01-03 21:22:43 +00:00
|
|
|
crt->issuer_raw.len ) != 0 )
|
|
|
|
{
|
2011-01-16 21:12:10 +00:00
|
|
|
parent = parent->next;
|
2009-01-03 21:22:43 +00:00
|
|
|
continue;
|
|
|
|
}
|
|
|
|
|
2010-03-17 06:56:01 +00:00
|
|
|
hash_id = crt->sig_alg;
|
2009-01-03 21:22:43 +00:00
|
|
|
|
|
|
|
x509_hash( crt->tbs.p, crt->tbs.len, hash_id, hash );
|
|
|
|
|
2011-01-16 21:12:10 +00:00
|
|
|
if( rsa_pkcs1_verify( &parent->rsa, RSA_PUBLIC, hash_id, 0, hash,
|
|
|
|
crt->sig.p ) != 0 )
|
|
|
|
*flags |= BADCERT_NOT_TRUSTED;
|
|
|
|
|
|
|
|
/* Check trusted CA's CRL for the given crt */
|
|
|
|
*flags |= x509parse_verifycrl(crt, parent, ca_crl);
|
2011-01-13 17:54:59 +00:00
|
|
|
|
|
|
|
/* crt is verified to be a child of the parent cur, call verify callback */
|
2011-01-15 16:57:55 +00:00
|
|
|
if( NULL != f_vrfy )
|
|
|
|
{
|
2011-01-16 21:12:10 +00:00
|
|
|
if( f_vrfy( p_vrfy, crt, pathlen - 1, ( *flags == 0 ) ) != 0 )
|
2011-01-13 17:54:59 +00:00
|
|
|
return( POLARSSL_ERR_X509_CERT_VERIFY_FAILED );
|
2011-01-16 21:12:10 +00:00
|
|
|
else
|
|
|
|
*flags = 0;
|
2011-01-13 17:54:59 +00:00
|
|
|
}
|
2011-01-16 21:12:10 +00:00
|
|
|
else if( *flags != 0 )
|
|
|
|
return( POLARSSL_ERR_X509_CERT_VERIFY_FAILED );
|
2009-01-03 21:22:43 +00:00
|
|
|
|
|
|
|
pathlen++;
|
|
|
|
|
2011-01-16 21:12:10 +00:00
|
|
|
crt = parent;
|
|
|
|
parent = crt->next;
|
2009-01-03 21:22:43 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
2011-01-16 21:12:10 +00:00
|
|
|
* Attempt to validate topmost cert with our CA chain.
|
2009-01-03 21:22:43 +00:00
|
|
|
*/
|
2011-01-16 21:12:10 +00:00
|
|
|
*flags |= BADCERT_NOT_TRUSTED;
|
|
|
|
|
2009-03-28 20:35:47 +00:00
|
|
|
while( trust_ca != NULL && trust_ca->version != 0 )
|
2009-01-03 21:22:43 +00:00
|
|
|
{
|
|
|
|
if( crt->issuer_raw.len != trust_ca->subject_raw.len ||
|
|
|
|
memcmp( crt->issuer_raw.p, trust_ca->subject_raw.p,
|
|
|
|
crt->issuer_raw.len ) != 0 )
|
|
|
|
{
|
|
|
|
trust_ca = trust_ca->next;
|
|
|
|
continue;
|
|
|
|
}
|
|
|
|
|
|
|
|
if( trust_ca->max_pathlen > 0 &&
|
|
|
|
trust_ca->max_pathlen < pathlen )
|
|
|
|
break;
|
|
|
|
|
2010-03-17 06:56:01 +00:00
|
|
|
hash_id = crt->sig_alg;
|
2009-01-03 21:22:43 +00:00
|
|
|
|
|
|
|
x509_hash( crt->tbs.p, crt->tbs.len, hash_id, hash );
|
|
|
|
|
|
|
|
if( rsa_pkcs1_verify( &trust_ca->rsa, RSA_PUBLIC, hash_id,
|
|
|
|
0, hash, crt->sig.p ) == 0 )
|
|
|
|
{
|
|
|
|
/*
|
|
|
|
* cert. is signed by a trusted CA
|
|
|
|
*/
|
|
|
|
*flags &= ~BADCERT_NOT_TRUSTED;
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
|
|
|
trust_ca = trust_ca->next;
|
|
|
|
}
|
|
|
|
|
2011-01-16 21:12:10 +00:00
|
|
|
/* Check trusted CA's CRL for the given crt */
|
|
|
|
*flags |= x509parse_verifycrl( crt, trust_ca, ca_crl );
|
2011-01-13 17:54:59 +00:00
|
|
|
|
|
|
|
/* Verification succeeded, call callback on top cert */
|
2011-01-15 16:57:55 +00:00
|
|
|
if( NULL != f_vrfy )
|
|
|
|
{
|
2011-01-16 21:12:10 +00:00
|
|
|
if( f_vrfy(p_vrfy, crt, pathlen-1, ( *flags == 0 ) ) != 0 )
|
2011-01-13 17:54:59 +00:00
|
|
|
return( POLARSSL_ERR_X509_CERT_VERIFY_FAILED );
|
2011-01-16 21:12:10 +00:00
|
|
|
else
|
|
|
|
*flags = 0;
|
2011-01-13 17:54:59 +00:00
|
|
|
}
|
2011-01-16 21:12:10 +00:00
|
|
|
else if( *flags != 0 )
|
|
|
|
return( POLARSSL_ERR_X509_CERT_VERIFY_FAILED );
|
2011-01-13 17:54:59 +00:00
|
|
|
|
2009-01-03 21:22:43 +00:00
|
|
|
return( 0 );
|
|
|
|
}
|
|
|
|
|
|
|
|
/*
|
|
|
|
* Unallocate all certificate data
|
|
|
|
*/
|
|
|
|
void x509_free( x509_cert *crt )
|
|
|
|
{
|
|
|
|
x509_cert *cert_cur = crt;
|
|
|
|
x509_cert *cert_prv;
|
|
|
|
x509_name *name_cur;
|
|
|
|
x509_name *name_prv;
|
2011-01-15 16:57:55 +00:00
|
|
|
x509_sequence *seq_cur;
|
|
|
|
x509_sequence *seq_prv;
|
2009-01-03 21:22:43 +00:00
|
|
|
|
|
|
|
if( crt == NULL )
|
|
|
|
return;
|
|
|
|
|
|
|
|
do
|
|
|
|
{
|
|
|
|
rsa_free( &cert_cur->rsa );
|
|
|
|
|
|
|
|
name_cur = cert_cur->issuer.next;
|
|
|
|
while( name_cur != NULL )
|
|
|
|
{
|
|
|
|
name_prv = name_cur;
|
|
|
|
name_cur = name_cur->next;
|
|
|
|
memset( name_prv, 0, sizeof( x509_name ) );
|
|
|
|
free( name_prv );
|
|
|
|
}
|
|
|
|
|
|
|
|
name_cur = cert_cur->subject.next;
|
|
|
|
while( name_cur != NULL )
|
|
|
|
{
|
|
|
|
name_prv = name_cur;
|
|
|
|
name_cur = name_cur->next;
|
|
|
|
memset( name_prv, 0, sizeof( x509_name ) );
|
|
|
|
free( name_prv );
|
|
|
|
}
|
|
|
|
|
2011-01-15 16:57:55 +00:00
|
|
|
seq_cur = cert_cur->ext_key_usage.next;
|
|
|
|
while( seq_cur != NULL )
|
|
|
|
{
|
|
|
|
seq_prv = seq_cur;
|
|
|
|
seq_cur = seq_cur->next;
|
|
|
|
memset( seq_prv, 0, sizeof( x509_sequence ) );
|
|
|
|
free( seq_prv );
|
|
|
|
}
|
|
|
|
|
2009-01-03 21:22:43 +00:00
|
|
|
if( cert_cur->raw.p != NULL )
|
|
|
|
{
|
|
|
|
memset( cert_cur->raw.p, 0, cert_cur->raw.len );
|
|
|
|
free( cert_cur->raw.p );
|
|
|
|
}
|
|
|
|
|
|
|
|
cert_cur = cert_cur->next;
|
|
|
|
}
|
|
|
|
while( cert_cur != NULL );
|
|
|
|
|
|
|
|
cert_cur = crt;
|
|
|
|
do
|
|
|
|
{
|
|
|
|
cert_prv = cert_cur;
|
|
|
|
cert_cur = cert_cur->next;
|
|
|
|
|
|
|
|
memset( cert_prv, 0, sizeof( x509_cert ) );
|
|
|
|
if( cert_prv != crt )
|
|
|
|
free( cert_prv );
|
|
|
|
}
|
|
|
|
while( cert_cur != NULL );
|
|
|
|
}
|
|
|
|
|
2009-05-02 15:13:40 +00:00
|
|
|
/*
|
|
|
|
* Unallocate all CRL data
|
|
|
|
*/
|
|
|
|
void x509_crl_free( x509_crl *crl )
|
|
|
|
{
|
|
|
|
x509_crl *crl_cur = crl;
|
|
|
|
x509_crl *crl_prv;
|
|
|
|
x509_name *name_cur;
|
|
|
|
x509_name *name_prv;
|
|
|
|
x509_crl_entry *entry_cur;
|
|
|
|
x509_crl_entry *entry_prv;
|
|
|
|
|
|
|
|
if( crl == NULL )
|
|
|
|
return;
|
|
|
|
|
|
|
|
do
|
|
|
|
{
|
|
|
|
name_cur = crl_cur->issuer.next;
|
|
|
|
while( name_cur != NULL )
|
|
|
|
{
|
|
|
|
name_prv = name_cur;
|
|
|
|
name_cur = name_cur->next;
|
|
|
|
memset( name_prv, 0, sizeof( x509_name ) );
|
|
|
|
free( name_prv );
|
|
|
|
}
|
|
|
|
|
|
|
|
entry_cur = crl_cur->entry.next;
|
|
|
|
while( entry_cur != NULL )
|
|
|
|
{
|
|
|
|
entry_prv = entry_cur;
|
|
|
|
entry_cur = entry_cur->next;
|
|
|
|
memset( entry_prv, 0, sizeof( x509_crl_entry ) );
|
|
|
|
free( entry_prv );
|
|
|
|
}
|
|
|
|
|
|
|
|
if( crl_cur->raw.p != NULL )
|
|
|
|
{
|
|
|
|
memset( crl_cur->raw.p, 0, crl_cur->raw.len );
|
|
|
|
free( crl_cur->raw.p );
|
|
|
|
}
|
|
|
|
|
|
|
|
crl_cur = crl_cur->next;
|
|
|
|
}
|
|
|
|
while( crl_cur != NULL );
|
|
|
|
|
|
|
|
crl_cur = crl;
|
|
|
|
do
|
|
|
|
{
|
|
|
|
crl_prv = crl_cur;
|
|
|
|
crl_cur = crl_cur->next;
|
|
|
|
|
|
|
|
memset( crl_prv, 0, sizeof( x509_crl ) );
|
|
|
|
if( crl_prv != crl )
|
|
|
|
free( crl_prv );
|
|
|
|
}
|
|
|
|
while( crl_cur != NULL );
|
|
|
|
}
|
|
|
|
|
2009-01-03 21:51:57 +00:00
|
|
|
#if defined(POLARSSL_SELF_TEST)
|
2009-01-03 21:22:43 +00:00
|
|
|
|
2009-01-03 21:51:57 +00:00
|
|
|
#include "polarssl/certs.h"
|
2009-01-03 21:22:43 +00:00
|
|
|
|
|
|
|
/*
|
|
|
|
* Checkup routine
|
|
|
|
*/
|
|
|
|
int x509_self_test( int verbose )
|
|
|
|
{
|
2009-10-03 19:58:52 +00:00
|
|
|
#if defined(POLARSSL_MD5_C)
|
2011-04-24 08:57:21 +00:00
|
|
|
int ret;
|
|
|
|
int flags;
|
|
|
|
size_t i, j;
|
2009-01-03 21:22:43 +00:00
|
|
|
x509_cert cacert;
|
|
|
|
x509_cert clicert;
|
|
|
|
rsa_context rsa;
|
2011-01-06 15:48:19 +00:00
|
|
|
dhm_context dhm;
|
2009-01-03 21:22:43 +00:00
|
|
|
|
|
|
|
if( verbose != 0 )
|
|
|
|
printf( " X.509 certificate load: " );
|
|
|
|
|
|
|
|
memset( &clicert, 0, sizeof( x509_cert ) );
|
|
|
|
|
|
|
|
ret = x509parse_crt( &clicert, (unsigned char *) test_cli_crt,
|
|
|
|
strlen( test_cli_crt ) );
|
|
|
|
if( ret != 0 )
|
|
|
|
{
|
|
|
|
if( verbose != 0 )
|
|
|
|
printf( "failed\n" );
|
|
|
|
|
|
|
|
return( ret );
|
|
|
|
}
|
|
|
|
|
|
|
|
memset( &cacert, 0, sizeof( x509_cert ) );
|
|
|
|
|
|
|
|
ret = x509parse_crt( &cacert, (unsigned char *) test_ca_crt,
|
|
|
|
strlen( test_ca_crt ) );
|
|
|
|
if( ret != 0 )
|
|
|
|
{
|
|
|
|
if( verbose != 0 )
|
|
|
|
printf( "failed\n" );
|
|
|
|
|
|
|
|
return( ret );
|
|
|
|
}
|
|
|
|
|
|
|
|
if( verbose != 0 )
|
|
|
|
printf( "passed\n X.509 private key load: " );
|
|
|
|
|
|
|
|
i = strlen( test_ca_key );
|
|
|
|
j = strlen( test_ca_pwd );
|
|
|
|
|
2011-03-25 14:22:50 +00:00
|
|
|
rsa_init( &rsa, RSA_PKCS_V15, 0 );
|
|
|
|
|
2009-01-03 21:22:43 +00:00
|
|
|
if( ( ret = x509parse_key( &rsa,
|
|
|
|
(unsigned char *) test_ca_key, i,
|
|
|
|
(unsigned char *) test_ca_pwd, j ) ) != 0 )
|
|
|
|
{
|
|
|
|
if( verbose != 0 )
|
|
|
|
printf( "failed\n" );
|
|
|
|
|
|
|
|
return( ret );
|
|
|
|
}
|
|
|
|
|
|
|
|
if( verbose != 0 )
|
|
|
|
printf( "passed\n X.509 signature verify: ");
|
|
|
|
|
2011-04-24 08:57:21 +00:00
|
|
|
ret = x509parse_verify( &clicert, &cacert, NULL, "PolarSSL Client 2", &flags, NULL, NULL );
|
2009-01-03 21:22:43 +00:00
|
|
|
if( ret != 0 )
|
|
|
|
{
|
2011-04-24 08:57:21 +00:00
|
|
|
printf("%02x", flags);
|
2009-01-03 21:22:43 +00:00
|
|
|
if( verbose != 0 )
|
|
|
|
printf( "failed\n" );
|
|
|
|
|
|
|
|
return( ret );
|
|
|
|
}
|
|
|
|
|
2011-01-06 15:48:19 +00:00
|
|
|
if( verbose != 0 )
|
|
|
|
printf( "passed\n X.509 DHM parameter load: " );
|
|
|
|
|
|
|
|
i = strlen( test_dhm_params );
|
|
|
|
j = strlen( test_ca_pwd );
|
|
|
|
|
|
|
|
if( ( ret = x509parse_dhm( &dhm, (unsigned char *) test_dhm_params, i ) ) != 0 )
|
|
|
|
{
|
|
|
|
if( verbose != 0 )
|
|
|
|
printf( "failed\n" );
|
|
|
|
|
|
|
|
return( ret );
|
|
|
|
}
|
|
|
|
|
2009-01-03 21:22:43 +00:00
|
|
|
if( verbose != 0 )
|
|
|
|
printf( "passed\n\n" );
|
|
|
|
|
|
|
|
x509_free( &cacert );
|
|
|
|
x509_free( &clicert );
|
|
|
|
rsa_free( &rsa );
|
2011-01-06 15:48:19 +00:00
|
|
|
dhm_free( &dhm );
|
2009-01-03 21:22:43 +00:00
|
|
|
|
|
|
|
return( 0 );
|
2009-10-03 19:58:52 +00:00
|
|
|
#else
|
|
|
|
((void) verbose);
|
|
|
|
return( POLARSSL_ERR_X509_FEATURE_UNAVAILABLE );
|
|
|
|
#endif
|
2009-01-03 21:22:43 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
#endif
|
|
|
|
|
|
|
|
#endif
|