diff options
Diffstat (limited to 'lib/x509/crl.c')
| -rw-r--r-- | lib/x509/crl.c | 1425 |
1 files changed, 1425 insertions, 0 deletions
diff --git a/lib/x509/crl.c b/lib/x509/crl.c new file mode 100644 index 0000000..56103e1 --- /dev/null +++ b/lib/x509/crl.c @@ -0,0 +1,1425 @@ +/* + * Copyright (C) 2003-2016 Free Software Foundation, Inc. + * Copyright (C) 2015-2016 Red Hat, Inc. + * + * Author: Nikos Mavrogiannopoulos + * + * This file is part of GnuTLS. + * + * The GnuTLS is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public License + * as published by the Free Software Foundation; either version 2.1 of + * the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, but + * WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public License + * along with this program. If not, see <https://www.gnu.org/licenses/> + * + */ + +#include "gnutls_int.h" +#include <libtasn1.h> + +#include <datum.h> +#include <global.h> +#include "errors.h" +#include <common.h> +#include <x509_b64.h> +#include <x509_int.h> +#include <x509.h> + +static int crl_reinit(gnutls_x509_crl_t crl) +{ +int result; + + if (crl->crl) + asn1_delete_structure(&crl->crl); + + result = asn1_create_element(_gnutls_get_pkix(), + "PKIX1.CertificateList", + &crl->crl); + if (result != ASN1_SUCCESS) { + gnutls_assert(); + return _gnutls_asn2err(result); + } + crl->rcache = NULL; + crl->rcache_idx = 0; + crl->raw_issuer_dn.size = 0; + + return 0; +} + +/** + * gnutls_x509_crl_init: + * @crl: A pointer to the type to be initialized + * + * This function will initialize a CRL structure. CRL stands for + * Certificate Revocation List. A revocation list usually contains + * lists of certificate serial numbers that have been revoked by an + * Authority. The revocation lists are always signed with the + * authority's private key. + * + * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned, otherwise a + * negative error value. + **/ +int gnutls_x509_crl_init(gnutls_x509_crl_t * crl) +{ + FAIL_IF_LIB_ERROR; + + *crl = gnutls_calloc(1, sizeof(gnutls_x509_crl_int)); + + if (*crl) { + int result = crl_reinit(*crl); + if (result < 0) { + gnutls_assert(); + gnutls_free(*crl); + return result; + } + return 0; /* success */ + } + return GNUTLS_E_MEMORY_ERROR; +} + +/** + * gnutls_x509_crl_deinit: + * @crl: The data to be deinitialized + * + * This function will deinitialize a CRL structure. + **/ +void gnutls_x509_crl_deinit(gnutls_x509_crl_t crl) +{ + if (!crl) + return; + + if (crl->crl) + asn1_delete_structure(&crl->crl); + gnutls_free(crl->der.data); + + gnutls_free(crl); +} + +/** + * gnutls_x509_crl_import: + * @crl: The data to store the parsed CRL. + * @data: The DER or PEM encoded CRL. + * @format: One of DER or PEM + * + * This function will convert the given DER or PEM encoded CRL + * to the native #gnutls_x509_crl_t format. The output will be stored in 'crl'. + * + * If the CRL is PEM encoded it should have a header of "X509 CRL". + * + * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned, otherwise a + * negative error value. + **/ +int +gnutls_x509_crl_import(gnutls_x509_crl_t crl, + const gnutls_datum_t * data, + gnutls_x509_crt_fmt_t format) +{ + int result = 0; + + if (crl == NULL) { + gnutls_assert(); + return GNUTLS_E_INVALID_REQUEST; + } + + _gnutls_free_datum(&crl->der); + + /* If the CRL is in PEM format then decode it + */ + if (format == GNUTLS_X509_FMT_PEM) { + result = + _gnutls_fbase64_decode(PEM_CRL, data->data, data->size, + &crl->der); + + if (result < 0) { + gnutls_assert(); + return result; + } + } else { + result = _gnutls_set_datum(&crl->der, data->data, data->size); + if (result < 0) { + gnutls_assert(); + return result; + } + } + + if (crl->expanded) { + result = crl_reinit(crl); + if (result < 0) { + gnutls_assert(); + goto cleanup; + } + } + crl->expanded = 1; + + result = + _asn1_strict_der_decode(&crl->crl, crl->der.data, crl->der.size, NULL); + if (result != ASN1_SUCCESS) { + result = _gnutls_asn2err(result); + gnutls_assert(); + goto cleanup; + } + + result = _gnutls_x509_get_raw_field2(crl->crl, &crl->der, + "tbsCertList.issuer.rdnSequence", + &crl->raw_issuer_dn); + if (result < 0) { + gnutls_assert(); + goto cleanup; + } + + return 0; + + cleanup: + _gnutls_free_datum(&crl->der); + return result; +} + + +/** + * gnutls_x509_crl_get_issuer_dn: + * @crl: should contain a gnutls_x509_crl_t type + * @buf: a pointer to a structure to hold the peer's name (may be null) + * @sizeof_buf: initially holds the size of @buf + * + * This function will copy the name of the CRL issuer in the provided + * buffer. The name will be in the form "C=xxxx,O=yyyy,CN=zzzz" as + * described in RFC4514. The output string will be ASCII or UTF-8 + * encoded, depending on the certificate data. + * + * If buf is %NULL then only the size will be filled. + * + * This function does not output a fully RFC4514 compliant string, if + * that is required see gnutls_x509_crl_get_issuer_dn3(). + * + * Returns: %GNUTLS_E_SHORT_MEMORY_BUFFER if the provided buffer is + * not long enough, and in that case the sizeof_buf will be updated + * with the required size, and 0 on success. + * + **/ +int +gnutls_x509_crl_get_issuer_dn(gnutls_x509_crl_t crl, char *buf, + size_t * sizeof_buf) +{ + if (crl == NULL) { + gnutls_assert(); + return GNUTLS_E_INVALID_REQUEST; + } + + return _gnutls_x509_parse_dn(crl->crl, + "tbsCertList.issuer.rdnSequence", + buf, sizeof_buf, GNUTLS_X509_DN_FLAG_COMPAT); +} + +/** + * gnutls_x509_crl_get_issuer_dn_by_oid: + * @crl: should contain a gnutls_x509_crl_t type + * @oid: holds an Object Identified in null terminated string + * @indx: In case multiple same OIDs exist in the RDN, this specifies which to send. Use (0) to get the first one. + * @raw_flag: If non-zero returns the raw DER data of the DN part. + * @buf: a pointer to a structure to hold the peer's name (may be null) + * @sizeof_buf: initially holds the size of @buf + * + * This function will extract the part of the name of the CRL issuer + * specified by the given OID. The output will be encoded as described + * in RFC4514. The output string will be ASCII or UTF-8 encoded, + * depending on the certificate data. + * + * Some helper macros with popular OIDs can be found in gnutls/x509.h + * If raw flag is (0), this function will only return known OIDs as + * text. Other OIDs will be DER encoded, as described in RFC4514 -- in + * hex format with a '#' prefix. You can check about known OIDs + * using gnutls_x509_dn_oid_known(). + * + * If buf is null then only the size will be filled. + * + * Returns: %GNUTLS_E_SHORT_MEMORY_BUFFER if the provided buffer is + * not long enough, and in that case the sizeof_buf will be updated + * with the required size, and 0 on success. + **/ +int +gnutls_x509_crl_get_issuer_dn_by_oid(gnutls_x509_crl_t crl, + const char *oid, unsigned indx, + unsigned int raw_flag, void *buf, + size_t * sizeof_buf) +{ + gnutls_datum_t td; + int ret; + + if (crl == NULL) { + gnutls_assert(); + return GNUTLS_E_INVALID_REQUEST; + } + + ret = _gnutls_x509_parse_dn_oid(crl->crl, + "tbsCertList.issuer.rdnSequence", + oid, indx, raw_flag, &td); + if (ret < 0) + return gnutls_assert_val(ret); + + return _gnutls_strdatum_to_buf(&td, buf, sizeof_buf); +} + + +/** + * gnutls_x509_crl_get_dn_oid: + * @crl: should contain a gnutls_x509_crl_t type + * @indx: Specifies which DN OID to send. Use (0) to get the first one. + * @oid: a pointer to store the OID (may be null) + * @sizeof_oid: initially holds the size of 'oid' + * + * This function will extract the requested OID of the name of the CRL + * issuer, specified by the given index. + * + * If oid is null then only the size will be filled. + * + * Returns: %GNUTLS_E_SHORT_MEMORY_BUFFER if the provided buffer is + * not long enough, and in that case the sizeof_oid will be updated + * with the required size. On success 0 is returned. + **/ +int +gnutls_x509_crl_get_dn_oid(gnutls_x509_crl_t crl, + unsigned indx, void *oid, size_t * sizeof_oid) +{ + if (crl == NULL) { + gnutls_assert(); + return GNUTLS_E_INVALID_REQUEST; + } + + return _gnutls_x509_get_dn_oid(crl->crl, + "tbsCertList.issuer.rdnSequence", + indx, oid, sizeof_oid); +} + +/** + * gnutls_x509_crl_get_issuer_dn2: + * @crl: should contain a #gnutls_x509_crl_t type + * @dn: a pointer to a structure to hold the name; must be freed using gnutls_free() + * + * This function will allocate buffer and copy the name of the CRL issuer. + * The name will be in the form "C=xxxx,O=yyyy,CN=zzzz" as + * described in RFC4514. The output string will be ASCII or UTF-8 + * encoded, depending on the certificate data. + * + * This function does not output a fully RFC4514 compliant string, if + * that is required see gnutls_x509_crl_get_issuer_dn3(). + * + * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned, otherwise a + * negative error value. + * + * Since: 3.1.10 + **/ +int +gnutls_x509_crl_get_issuer_dn2(gnutls_x509_crl_t crl, gnutls_datum_t * dn) +{ + if (crl == NULL) { + gnutls_assert(); + return GNUTLS_E_INVALID_REQUEST; + } + + return _gnutls_x509_get_dn(crl->crl, + "tbsCertList.issuer.rdnSequence", + dn, GNUTLS_X509_DN_FLAG_COMPAT); +} + +/** + * gnutls_x509_crl_get_issuer_dn3: + * @crl: should contain a #gnutls_x509_crl_t type + * @dn: a pointer to a structure to hold the name; must be freed using gnutls_free() + * @flags: zero or %GNUTLS_X509_DN_FLAG_COMPAT + * + * This function will allocate buffer and copy the name of the CRL issuer. + * The name will be in the form "C=xxxx,O=yyyy,CN=zzzz" as + * described in RFC4514. The output string will be ASCII or UTF-8 + * encoded, depending on the certificate data. + * + * When the flag %GNUTLS_X509_DN_FLAG_COMPAT is specified, the output + * format will match the format output by previous to 3.5.6 versions of GnuTLS + * which was not not fully RFC4514-compliant. + * + * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned, otherwise a + * negative error value. + * + * Since: 3.5.7 + **/ +int +gnutls_x509_crl_get_issuer_dn3(gnutls_x509_crl_t crl, gnutls_datum_t * dn, unsigned flags) +{ + if (crl == NULL) { + gnutls_assert(); + return GNUTLS_E_INVALID_REQUEST; + } + + return _gnutls_x509_get_dn(crl->crl, + "tbsCertList.issuer.rdnSequence", + dn, flags); +} + +/** + * gnutls_x509_crl_get_signature_algorithm: + * @crl: should contain a #gnutls_x509_crl_t type + * + * This function will return a value of the #gnutls_sign_algorithm_t + * enumeration that is the signature algorithm. + * + * Since 3.6.0 this function never returns a negative error code. + * Error cases and unknown/unsupported signature algorithms are + * mapped to %GNUTLS_SIGN_UNKNOWN. + * + * Returns: a #gnutls_sign_algorithm_t value + **/ +int gnutls_x509_crl_get_signature_algorithm(gnutls_x509_crl_t crl) +{ + return map_errs_to_zero(_gnutls_x509_get_signature_algorithm(crl->crl, + "signatureAlgorithm")); +} + +/** + * gnutls_x509_crl_get_signature_oid: + * @crl: should contain a #gnutls_x509_crl_t type + * @oid: a pointer to a buffer to hold the OID (may be null) + * @oid_size: initially holds the size of @oid + * + * This function will return the OID of the signature algorithm + * that has been used to sign this CRL. This is function + * is useful in the case gnutls_x509_crl_get_signature_algorithm() + * returned %GNUTLS_SIGN_UNKNOWN. + * + * Returns: zero or a negative error code on error. + * + * Since: 3.5.0 + **/ +int gnutls_x509_crl_get_signature_oid(gnutls_x509_crl_t crl, char *oid, size_t *oid_size) +{ + char str[MAX_OID_SIZE]; + int len, result, ret; + gnutls_datum_t out; + + len = sizeof(str); + result = asn1_read_value(crl->crl, "signatureAlgorithm.algorithm", str, &len); + if (result != ASN1_SUCCESS) { + gnutls_assert(); + return _gnutls_asn2err(result); + } + + out.data = (void*)str; + out.size = len; + + ret = _gnutls_copy_string(&out, (void*)oid, oid_size); + if (ret < 0) { + gnutls_assert(); + return ret; + } + + return 0; +} + +/** + * gnutls_x509_crl_get_signature: + * @crl: should contain a gnutls_x509_crl_t type + * @sig: a pointer where the signature part will be copied (may be null). + * @sizeof_sig: initially holds the size of @sig + * + * This function will extract the signature field of a CRL. + * + * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned, otherwise a + * negative error value. + **/ +int +gnutls_x509_crl_get_signature(gnutls_x509_crl_t crl, + char *sig, size_t * sizeof_sig) +{ + int result; + unsigned int bits; + int len; + + if (crl == NULL) { + gnutls_assert(); + return GNUTLS_E_INVALID_REQUEST; + } + + len = 0; + result = asn1_read_value(crl->crl, "signature", NULL, &len); + + if (result != ASN1_MEM_ERROR) { + gnutls_assert(); + return _gnutls_asn2err(result); + } + + bits = len; + if (bits % 8 != 0) { + gnutls_assert(); + return GNUTLS_E_CERTIFICATE_ERROR; + } + + len = bits / 8; + + if (*sizeof_sig < (unsigned) len) { + *sizeof_sig = bits / 8; + return GNUTLS_E_SHORT_MEMORY_BUFFER; + } + + result = asn1_read_value(crl->crl, "signature", sig, &len); + if (result != ASN1_SUCCESS) { + gnutls_assert(); + return _gnutls_asn2err(result); + } + + return 0; +} + +/** + * gnutls_x509_crl_get_version: + * @crl: should contain a #gnutls_x509_crl_t type + * + * This function will return the version of the specified CRL. + * + * Returns: The version number, or a negative error code on error. + **/ +int gnutls_x509_crl_get_version(gnutls_x509_crl_t crl) +{ + if (crl == NULL) { + gnutls_assert(); + return GNUTLS_E_INVALID_REQUEST; + } + + return _gnutls_x509_get_version(crl->crl, "tbsCertList.version"); +} + +/** + * gnutls_x509_crl_get_this_update: + * @crl: should contain a #gnutls_x509_crl_t type + * + * This function will return the time this CRL was issued. + * + * Returns: when the CRL was issued, or (time_t)-1 on error. + **/ +time_t gnutls_x509_crl_get_this_update(gnutls_x509_crl_t crl) +{ + if (crl == NULL) { + gnutls_assert(); + return (time_t) - 1; + } + + return _gnutls_x509_get_time(crl->crl, "tbsCertList.thisUpdate", + 0); +} + +/** + * gnutls_x509_crl_get_next_update: + * @crl: should contain a #gnutls_x509_crl_t type + * + * This function will return the time the next CRL will be issued. + * This field is optional in a CRL so it might be normal to get an + * error instead. + * + * Returns: when the next CRL will be issued, or (time_t)-1 on error. + **/ +time_t gnutls_x509_crl_get_next_update(gnutls_x509_crl_t crl) +{ + if (crl == NULL) { + gnutls_assert(); + return (time_t) - 1; + } + + return _gnutls_x509_get_time(crl->crl, "tbsCertList.nextUpdate", + 0); +} + +/** + * gnutls_x509_crl_get_crt_count: + * @crl: should contain a #gnutls_x509_crl_t type + * + * This function will return the number of revoked certificates in the + * given CRL. + * + * Returns: number of certificates, a negative error code on failure. + **/ +int gnutls_x509_crl_get_crt_count(gnutls_x509_crl_t crl) +{ + + int count, result; + + if (crl == NULL) { + gnutls_assert(); + return GNUTLS_E_INVALID_REQUEST; + } + + result = + asn1_number_of_elements(crl->crl, + "tbsCertList.revokedCertificates", + &count); + + if (result != ASN1_SUCCESS) { + gnutls_assert(); + return 0; /* no certificates */ + } + + return count; +} + +/** + * gnutls_x509_crl_get_crt_serial: + * @crl: should contain a #gnutls_x509_crl_t type + * @indx: the index of the certificate to extract (starting from 0) + * @serial: where the serial number will be copied + * @serial_size: initially holds the size of serial + * @t: if non null, will hold the time this certificate was revoked + * + * This function will retrieve the serial number of the specified, by + * the index, revoked certificate. + * + * Note that this function will have performance issues in large sequences + * of revoked certificates. In that case use gnutls_x509_crl_iter_crt_serial(). + * + * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned, otherwise a + * negative error value. + **/ +int +gnutls_x509_crl_get_crt_serial(gnutls_x509_crl_t crl, unsigned indx, + unsigned char *serial, + size_t * serial_size, time_t * t) +{ + + int result, _serial_size; + char serial_name[MAX_NAME_SIZE]; + char date_name[MAX_NAME_SIZE]; + + if (crl == NULL) { + gnutls_assert(); + return GNUTLS_E_INVALID_REQUEST; + } + + snprintf(serial_name, sizeof(serial_name), + "tbsCertList.revokedCertificates.?%u.userCertificate", + indx + 1); + snprintf(date_name, sizeof(date_name), + "tbsCertList.revokedCertificates.?%u.revocationDate", + indx + 1); + + _serial_size = *serial_size; + result = + asn1_read_value(crl->crl, serial_name, serial, &_serial_size); + + *serial_size = _serial_size; + if (result != ASN1_SUCCESS) { + gnutls_assert(); + if (result == ASN1_ELEMENT_NOT_FOUND) + return GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE; + return _gnutls_asn2err(result); + } + + if (t) { + *t = _gnutls_x509_get_time(crl->crl, date_name, 0); + } + + return 0; +} + +/** + * gnutls_x509_crl_iter_deinit: + * @iter: The iterator to be deinitialized + * + * This function will deinitialize an iterator type. + **/ +void gnutls_x509_crl_iter_deinit(gnutls_x509_crl_iter_t iter) +{ + if (!iter) + return; + + gnutls_free(iter); +} + +/** + * gnutls_x509_crl_iter_crt_serial: + * @crl: should contain a #gnutls_x509_crl_t type + * @iter: A pointer to an iterator (initially the iterator should be %NULL) + * @serial: where the serial number will be copied + * @serial_size: initially holds the size of serial + * @t: if non null, will hold the time this certificate was revoked + * + * This function performs the same as gnutls_x509_crl_get_crt_serial(), + * but reads sequentially and keeps state in the iterator + * between calls. That allows it to provide better performance in sequences + * with many elements (50000+). + * + * When past the last element is accessed %GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE + * is returned and the iterator is reset. + * + * After use, the iterator must be deinitialized using gnutls_x509_crl_iter_deinit(). + * + * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned, otherwise a + * negative error value. + **/ +int +gnutls_x509_crl_iter_crt_serial(gnutls_x509_crl_t crl, + gnutls_x509_crl_iter_t *iter, + unsigned char *serial, + size_t * serial_size, time_t * t) +{ + + int result, _serial_size; + char serial_name[MAX_NAME_SIZE]; + char date_name[MAX_NAME_SIZE]; + + if (crl == NULL || iter == NULL) { + gnutls_assert(); + return GNUTLS_E_INVALID_REQUEST; + } + + if (*iter == NULL) { + *iter = gnutls_calloc(1, sizeof(struct gnutls_x509_crl_iter)); + if (*iter == NULL) + return gnutls_assert_val(GNUTLS_E_MEMORY_ERROR); + } + + if ((*iter)->rcache == NULL) { + (*iter)->rcache = asn1_find_node (crl->crl, "tbsCertList.revokedCertificates.?1"); + (*iter)->rcache_idx = 1; + } else { + snprintf(serial_name, sizeof(serial_name), + "?%u", (*iter)->rcache_idx); + (*iter)->rcache = asn1_find_node ((*iter)->rcache, serial_name); + } + if ((*iter)->rcache == NULL) { + /* reset */ + (*iter)->rcache = NULL; + return gnutls_assert_val(GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE); + } + + snprintf(serial_name, sizeof(serial_name), + "?%u.userCertificate", (*iter)->rcache_idx); + + _serial_size = *serial_size; + result = + asn1_read_value((*iter)->rcache, serial_name, serial, &_serial_size); + + *serial_size = _serial_size; + if (result != ASN1_SUCCESS) { + gnutls_assert(); + if (result == ASN1_ELEMENT_NOT_FOUND) { + /* reset */ + (*iter)->rcache = NULL; + return GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE; + } + return _gnutls_asn2err(result); + } + + if (t) { + snprintf(date_name, sizeof(date_name), + "?%u.revocationDate", (*iter)->rcache_idx); + *t = _gnutls_x509_get_time((*iter)->rcache, date_name, 0); + } + + (*iter)->rcache_idx++; + + return 0; +} + +/** + * gnutls_x509_crl_get_raw_issuer_dn: + * @crl: should contain a gnutls_x509_crl_t type + * @dn: will hold the starting point of the DN + * + * This function will return a pointer to the DER encoded DN structure + * and the length. + * + * Returns: a negative error code on error, and (0) on success. + * + * Since: 2.12.0 + **/ +int +gnutls_x509_crl_get_raw_issuer_dn(gnutls_x509_crl_t crl, + gnutls_datum_t * dn) +{ + if (crl->raw_issuer_dn.size != 0) { + return _gnutls_set_datum(dn, crl->raw_issuer_dn.data, + crl->raw_issuer_dn.size); + } else { + return _gnutls_x509_get_raw_field(crl->crl, "tbsCertList.issuer.rdnSequence", dn); + } +} + +/** + * gnutls_x509_crl_export: + * @crl: Holds the revocation list + * @format: the format of output params. One of PEM or DER. + * @output_data: will contain a private key PEM or DER encoded + * @output_data_size: holds the size of output_data (and will + * be replaced by the actual size of parameters) + * + * This function will export the revocation list to DER or PEM format. + * + * If the buffer provided is not long enough to hold the output, then + * %GNUTLS_E_SHORT_MEMORY_BUFFER will be returned. + * + * If the structure is PEM encoded, it will have a header + * of "BEGIN X509 CRL". + * + * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned, otherwise a + * negative error value. + **/ +int +gnutls_x509_crl_export(gnutls_x509_crl_t crl, + gnutls_x509_crt_fmt_t format, void *output_data, + size_t * output_data_size) +{ + if (crl == NULL) { + gnutls_assert(); + return GNUTLS_E_INVALID_REQUEST; + } + + return _gnutls_x509_export_int(crl->crl, format, PEM_CRL, + output_data, output_data_size); +} + +/** + * gnutls_x509_crl_export2: + * @crl: Holds the revocation list + * @format: the format of output params. One of PEM or DER. + * @out: will contain a private key PEM or DER encoded + * + * This function will export the revocation list to DER or PEM format. + * + * The output buffer is allocated using gnutls_malloc(). + * + * If the structure is PEM encoded, it will have a header + * of "BEGIN X509 CRL". + * + * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned, otherwise a + * negative error value. + * + * Since 3.1.3 + **/ +int +gnutls_x509_crl_export2(gnutls_x509_crl_t crl, + gnutls_x509_crt_fmt_t format, gnutls_datum_t * out) +{ + if (crl == NULL) { + gnutls_assert(); + return GNUTLS_E_INVALID_REQUEST; + } + + return _gnutls_x509_export_int2(crl->crl, format, PEM_CRL, out); +} + +/*- + * _gnutls_x509_crl_cpy - This function copies a gnutls_x509_crl_t type + * @dest: The data where to copy + * @src: The data to be copied + * + * This function will copy an X.509 certificate structure. + * + * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned, otherwise a + * negative error value. + -*/ +int _gnutls_x509_crl_cpy(gnutls_x509_crl_t dest, gnutls_x509_crl_t src) +{ + int ret; + gnutls_datum_t tmp; + + ret = gnutls_x509_crl_export2(src, GNUTLS_X509_FMT_DER, &tmp); + if (ret < 0) + return gnutls_assert_val(ret); + + ret = gnutls_x509_crl_import(dest, &tmp, GNUTLS_X509_FMT_DER); + + gnutls_free(tmp.data); + + if (ret < 0) { + gnutls_assert(); + return ret; + } + + return 0; + +} + +static int +_get_authority_key_id(gnutls_x509_crl_t cert, asn1_node * c2, + unsigned int *critical) +{ + int ret; + gnutls_datum_t id; + + *c2 = NULL; + + if (cert == NULL) { + gnutls_assert(); + return GNUTLS_E_INVALID_REQUEST; + } + + if ((ret = + _gnutls_x509_crl_get_extension(cert, "2.5.29.35", 0, &id, + critical)) < 0) { + return gnutls_assert_val(ret); + } + + if (id.size == 0 || id.data == NULL) { + gnutls_assert(); + return GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE; + } + + ret = asn1_create_element + (_gnutls_get_pkix(), "PKIX1.AuthorityKeyIdentifier", c2); + if (ret != ASN1_SUCCESS) { + gnutls_assert(); + _gnutls_free_datum(&id); + return _gnutls_asn2err(ret); + } + + ret = _asn1_strict_der_decode(c2, id.data, id.size, NULL); + _gnutls_free_datum(&id); + + if (ret != ASN1_SUCCESS) { + gnutls_assert(); + asn1_delete_structure(c2); + return _gnutls_asn2err(ret); + } + + return 0; +} + +/** + * gnutls_x509_crl_get_authority_key_gn_serial: + * @crl: should contain a #gnutls_x509_crl_t type + * @seq: specifies the sequence number of the alt name (0 for the first one, 1 for the second etc.) + * @alt: is the place where the alternative name will be copied to + * @alt_size: holds the size of alt. + * @alt_type: holds the type of the alternative name (one of gnutls_x509_subject_alt_name_t). + * @serial: buffer to store the serial number (may be null) + * @serial_size: Holds the size of the serial field (may be null) + * @critical: will be non-zero if the extension is marked as critical (may be null) + * + * This function will return the X.509 authority key + * identifier when stored as a general name (authorityCertIssuer) + * and serial number. + * + * Because more than one general names might be stored + * @seq can be used as a counter to request them all until + * %GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE is returned. + * + * Returns: Returns 0 on success, or an error code. + * + * Since: 3.0 + **/ +int +gnutls_x509_crl_get_authority_key_gn_serial(gnutls_x509_crl_t crl, + unsigned int seq, + void *alt, + size_t * alt_size, + unsigned int *alt_type, + void *serial, + size_t * serial_size, + unsigned int *critical) +{ + int ret, result, len; + asn1_node c2; + + ret = _get_authority_key_id(crl, &c2, critical); + if (ret < 0) + return gnutls_assert_val(ret); + + ret = + _gnutls_parse_general_name(c2, "authorityCertIssuer", seq, alt, + alt_size, alt_type, 0); + if (ret < 0) { + ret = gnutls_assert_val(ret); + goto fail; + } + + if (serial) { + len = *serial_size; + result = + asn1_read_value(c2, "authorityCertSerialNumber", + serial, &len); + + *serial_size = len; + + if (result < 0) { + ret = _gnutls_asn2err(result); + goto fail; + } + + } + + ret = 0; + + fail: + asn1_delete_structure(&c2); + + return ret; +} + + +/** + * gnutls_x509_crl_get_authority_key_id: + * @crl: should contain a #gnutls_x509_crl_t type + * @id: The place where the identifier will be copied + * @id_size: Holds the size of the result field. + * @critical: will be non-zero if the extension is marked as critical + * (may be null) + * + * This function will return the CRL authority's key identifier. This + * is obtained by the X.509 Authority Key identifier extension field + * (2.5.29.35). Note that this function + * only returns the keyIdentifier field of the extension and + * %GNUTLS_E_X509_UNSUPPORTED_EXTENSION, if the extension contains + * the name and serial number of the certificate. In that case + * gnutls_x509_crl_get_authority_key_gn_serial() may be used. + * + * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned, otherwise a + * negative error code in case of an error. + * + * Since: 2.8.0 + **/ +int +gnutls_x509_crl_get_authority_key_id(gnutls_x509_crl_t crl, void *id, + size_t * id_size, + unsigned int *critical) +{ + int result, len, ret; + asn1_node c2; + + ret = _get_authority_key_id(crl, &c2, critical); + if (ret < 0) + return gnutls_assert_val(ret); + + len = *id_size; + result = asn1_read_value(c2, "keyIdentifier", id, &len); + + *id_size = len; + asn1_delete_structure(&c2); + + if (result == ASN1_VALUE_NOT_FOUND + || result == ASN1_ELEMENT_NOT_FOUND) + return + gnutls_assert_val(GNUTLS_E_X509_UNSUPPORTED_EXTENSION); + + if (result != ASN1_SUCCESS) { + gnutls_assert(); + return _gnutls_asn2err(result); + } + + return 0; +} + +/** + * gnutls_x509_crl_get_number: + * @crl: should contain a #gnutls_x509_crl_t type + * @ret: The place where the number will be copied + * @ret_size: Holds the size of the result field. + * @critical: will be non-zero if the extension is marked as critical + * (may be null) + * + * This function will return the CRL number extension. This is + * obtained by the CRL Number extension field (2.5.29.20). + * + * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned, otherwise a + * negative error code in case of an error. + * + * Since: 2.8.0 + **/ +int +gnutls_x509_crl_get_number(gnutls_x509_crl_t crl, void *ret, + size_t * ret_size, unsigned int *critical) +{ + int result; + gnutls_datum_t id; + + if (crl == NULL) { + gnutls_assert(); + return GNUTLS_E_INVALID_REQUEST; + } + + if (ret) + memset(ret, 0, *ret_size); + else + *ret_size = 0; + + if ((result = + _gnutls_x509_crl_get_extension(crl, "2.5.29.20", 0, &id, + critical)) < 0) { + return result; + } + + if (id.size == 0 || id.data == NULL) { + gnutls_assert(); + return GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE; + } + + result = + _gnutls_x509_ext_extract_number(ret, ret_size, id.data, + id.size); + + _gnutls_free_datum(&id); + + if (result < 0) { + gnutls_assert(); + return result; + } + + return 0; +} + +/** + * gnutls_x509_crl_get_extension_oid: + * @crl: should contain a #gnutls_x509_crl_t type + * @indx: Specifies which extension OID to send, use (0) to get the first one. + * @oid: a pointer to store the OID (may be null) + * @sizeof_oid: initially holds the size of @oid + * + * This function will return the requested extension OID in the CRL. + * The extension OID will be stored as a string in the provided + * buffer. + * + * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned, otherwise a + * negative error code in case of an error. If your have reached the + * last extension available %GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE + * will be returned. + * + * Since: 2.8.0 + **/ +int +gnutls_x509_crl_get_extension_oid(gnutls_x509_crl_t crl, unsigned indx, + void *oid, size_t * sizeof_oid) +{ + int result; + + if (crl == NULL) { + gnutls_assert(); + return GNUTLS_E_INVALID_REQUEST; + } + + result = + _gnutls_x509_crl_get_extension_oid(crl, indx, oid, sizeof_oid); + if (result < 0) { + return result; + } + + return 0; + +} + +/** + * gnutls_x509_crl_get_extension_info: + * @crl: should contain a #gnutls_x509_crl_t type + * @indx: Specifies which extension OID to send, use (0) to get the first one. + * @oid: a pointer to store the OID + * @sizeof_oid: initially holds the maximum size of @oid, on return + * holds actual size of @oid. + * @critical: output variable with critical flag, may be NULL. + * + * This function will return the requested extension OID in the CRL, + * and the critical flag for it. The extension OID will be stored as + * a string in the provided buffer. Use + * gnutls_x509_crl_get_extension_data() to extract the data. + * + * If the buffer provided is not long enough to hold the output, then + * *@sizeof_oid is updated and %GNUTLS_E_SHORT_MEMORY_BUFFER will be + * returned. + * + * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned, otherwise a + * negative error code in case of an error. If your have reached the + * last extension available %GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE + * will be returned. + * + * Since: 2.8.0 + **/ +int +gnutls_x509_crl_get_extension_info(gnutls_x509_crl_t crl, unsigned indx, + void *oid, size_t * sizeof_oid, + unsigned int *critical) +{ + int result; + char str_critical[10]; + char name[MAX_NAME_SIZE]; + int len; + + if (!crl) { + gnutls_assert(); + return GNUTLS_E_INVALID_REQUEST; + } + + snprintf(name, sizeof(name), + "tbsCertList.crlExtensions.?%u.extnID", indx + 1); + + len = *sizeof_oid; + result = asn1_read_value(crl->crl, name, oid, &len); + *sizeof_oid = len; + + if (result == ASN1_ELEMENT_NOT_FOUND) + return GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE; + else if (result != ASN1_SUCCESS) { + gnutls_assert(); + return _gnutls_asn2err(result); + } + + snprintf(name, sizeof(name), + "tbsCertList.crlExtensions.?%u.critical", indx + 1); + len = sizeof(str_critical); + result = asn1_read_value(crl->crl, name, str_critical, &len); + if (result != ASN1_SUCCESS) { + gnutls_assert(); + return _gnutls_asn2err(result); + } + + if (critical) { + if (str_critical[0] == 'T') + *critical = 1; + else + *critical = 0; + } + + return 0; + +} + +/** + * gnutls_x509_crl_get_extension_data: + * @crl: should contain a #gnutls_x509_crl_t type + * @indx: Specifies which extension OID to send. Use (0) to get the first one. + * @data: a pointer to a structure to hold the data (may be null) + * @sizeof_data: initially holds the size of @oid + * + * This function will return the requested extension data in the CRL. + * The extension data will be stored as a string in the provided + * buffer. + * + * Use gnutls_x509_crl_get_extension_info() to extract the OID and + * critical flag. Use gnutls_x509_crl_get_extension_info() instead, + * if you want to get data indexed by the extension OID rather than + * sequence. + * + * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned, otherwise a + * negative error code in case of an error. If your have reached the + * last extension available %GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE + * will be returned. + * + * Since: 2.8.0 + **/ +int +gnutls_x509_crl_get_extension_data(gnutls_x509_crl_t crl, unsigned indx, + void *data, size_t * sizeof_data) +{ + int result, len; + char name[MAX_NAME_SIZE]; + + if (!crl) { + gnutls_assert(); + return GNUTLS_E_INVALID_REQUEST; + } + + snprintf(name, sizeof(name), + "tbsCertList.crlExtensions.?%u.extnValue", indx + 1); + + len = *sizeof_data; + result = asn1_read_value(crl->crl, name, data, &len); + *sizeof_data = len; + + if (result == ASN1_ELEMENT_NOT_FOUND) + return GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE; + else if (result < 0) { + gnutls_assert(); + return _gnutls_asn2err(result); + } + + return 0; +} + +/** + * gnutls_x509_crl_list_import2: + * @crls: Will contain the parsed crl list. + * @size: It will contain the size of the list. + * @data: The PEM encoded CRL. + * @format: One of DER or PEM. + * @flags: must be (0) or an OR'd sequence of gnutls_certificate_import_flags. + * + * This function will convert the given PEM encoded CRL list + * to the native gnutls_x509_crl_t format. The output will be stored + * in @crls. They will be automatically initialized. + * + * If the Certificate is PEM encoded it should have a header of "X509 + * CRL". + * + * Returns: the number of certificates read or a negative error value. + * + * Since: 3.0 + **/ +int +gnutls_x509_crl_list_import2(gnutls_x509_crl_t ** crls, + unsigned int *size, + const gnutls_datum_t * data, + gnutls_x509_crt_fmt_t format, + unsigned int flags) +{ + unsigned int init = 1024; + int ret; + + *crls = _gnutls_reallocarray(NULL, init, sizeof(gnutls_x509_crl_t)); + if (*crls == NULL) { + gnutls_assert(); + return GNUTLS_E_MEMORY_ERROR; + } + + ret = + gnutls_x509_crl_list_import(*crls, &init, data, format, + flags | GNUTLS_X509_CRT_LIST_IMPORT_FAIL_IF_EXCEED); + if (ret == GNUTLS_E_SHORT_MEMORY_BUFFER) { + *crls = _gnutls_reallocarray_fast(*crls, init, + sizeof(gnutls_x509_crl_t)); + if (*crls == NULL) { + gnutls_assert(); + return GNUTLS_E_MEMORY_ERROR; + } + + ret = + gnutls_x509_crl_list_import(*crls, &init, data, format, + flags); + } + + if (ret < 0) { + gnutls_free(*crls); + *crls = NULL; + return ret; + } + + *size = init; + return 0; +} + +/** + * gnutls_x509_crl_list_import: + * @crls: Indicates where the parsed CRLs will be copied to. Must not be initialized. + * @crl_max: Initially must hold the maximum number of crls. It will be updated with the number of crls available. + * @data: The PEM encoded CRLs + * @format: One of DER or PEM. + * @flags: must be (0) or an OR'd sequence of gnutls_certificate_import_flags. + * + * This function will convert the given PEM encoded CRL list + * to the native gnutls_x509_crl_t format. The output will be stored + * in @crls. They will be automatically initialized. + * + * If the Certificate is PEM encoded it should have a header of "X509 CRL". + * + * Returns: the number of certificates read or a negative error value. + * + * Since: 3.0 + **/ +int +gnutls_x509_crl_list_import(gnutls_x509_crl_t * crls, + unsigned int *crl_max, + const gnutls_datum_t * data, + gnutls_x509_crt_fmt_t format, + unsigned int flags) +{ + int size; + const char *ptr; + gnutls_datum_t tmp; + int ret, nocopy = 0; + unsigned int count = 0, j; + + if (format == GNUTLS_X509_FMT_DER) { + if (*crl_max < 1) { + *crl_max = 1; + return GNUTLS_E_SHORT_MEMORY_BUFFER; + } + + count = 1; /* import only the first one */ + + ret = gnutls_x509_crl_init(&crls[0]); + if (ret < 0) { + gnutls_assert(); + goto error; + } + + ret = gnutls_x509_crl_import(crls[0], data, format); + if (ret < 0) { + gnutls_assert(); + goto error; + } + + *crl_max = 1; + return 1; + } + + /* move to the certificate + */ + ptr = memmem(data->data, data->size, + PEM_CRL_SEP, sizeof(PEM_CRL_SEP) - 1); + if (ptr == NULL) { + gnutls_assert(); + return GNUTLS_E_BASE64_DECODING_ERROR; + } + + count = 0; + + do { + if (count >= *crl_max) { + if (! + (flags & + GNUTLS_X509_CRT_LIST_IMPORT_FAIL_IF_EXCEED)) { + break; + } else if (nocopy == 0) { + for (j = 0; j < count; j++) + gnutls_x509_crl_deinit(crls[j]); + nocopy = 1; + } + } + + if (!nocopy) { + ret = gnutls_x509_crl_init(&crls[count]); + if (ret < 0) { + gnutls_assert(); + goto error; + } + + tmp.data = (void *) ptr; + tmp.size = + data->size - (ptr - (char *) data->data); + ret = + gnutls_x509_crl_import(crls[count], &tmp, + GNUTLS_X509_FMT_PEM); + if (ret < 0) { + gnutls_assert(); + count++; + goto error; + } + } + + /* now we move ptr after the pem header + */ + ptr++; + /* find the next certificate (if any) + */ + size = data->size - (ptr - (char *) data->data); + + if (size > 0) { + ptr = + memmem(ptr, size, PEM_CRL_SEP, + sizeof(PEM_CRL_SEP) - 1); + } else + ptr = NULL; + + count++; + } + while (ptr != NULL); + + *crl_max = count; + + if (nocopy == 0) + return count; + else + return GNUTLS_E_SHORT_MEMORY_BUFFER; + + error: + for (j = 0; j < count; j++) + gnutls_x509_crl_deinit(crls[j]); + return ret; +} |