4 * \brief X.509 certificate revocation list parsing
6 * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
7 * SPDX-License-Identifier: GPL-2.0
9 * This program is free software; you can redistribute it and/or modify
10 * it under the terms of the GNU General Public License as published by
11 * the Free Software Foundation; either version 2 of the License, or
12 * (at your option) any later version.
14 * This program is distributed in the hope that it will be useful,
15 * but WITHOUT ANY WARRANTY; without even the implied warranty of
16 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 * GNU General Public License for more details.
19 * You should have received a copy of the GNU General Public License along
20 * with this program; if not, write to the Free Software Foundation, Inc.,
21 * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301 USA.
23 * This file is part of mbed TLS (https://tls.mbed.org)
25 #ifndef MBEDTLS_X509_CRL_H
26 #define MBEDTLS_X509_CRL_H
28 #if !defined(MBEDTLS_CONFIG_FILE)
31 #include MBEDTLS_CONFIG_FILE
41 * \addtogroup x509_module
45 * \name Structures and functions for parsing CRLs
50 * Certificate revocation list entry.
51 * Contains the CA-specific serial numbers and revocation dates.
53 typedef struct mbedtls_x509_crl_entry
57 mbedtls_x509_buf serial
;
59 mbedtls_x509_time revocation_date
;
61 mbedtls_x509_buf entry_ext
;
63 struct mbedtls_x509_crl_entry
*next
;
65 mbedtls_x509_crl_entry
;
68 * Certificate revocation list structure.
69 * Every CRL may have multiple entries.
71 typedef struct mbedtls_x509_crl
73 mbedtls_x509_buf raw
; /**< The raw certificate data (DER). */
74 mbedtls_x509_buf tbs
; /**< The raw certificate body (DER). The part that is To Be Signed. */
76 int version
; /**< CRL version (1=v1, 2=v2) */
77 mbedtls_x509_buf sig_oid
; /**< CRL signature type identifier */
79 mbedtls_x509_buf issuer_raw
; /**< The raw issuer data (DER). */
81 mbedtls_x509_name issuer
; /**< The parsed issuer data (named information object). */
83 mbedtls_x509_time this_update
;
84 mbedtls_x509_time next_update
;
86 mbedtls_x509_crl_entry entry
; /**< The CRL entries containing the certificate revocation times for this CA. */
88 mbedtls_x509_buf crl_ext
;
90 mbedtls_x509_buf sig_oid2
;
92 mbedtls_md_type_t sig_md
; /**< Internal representation of the MD algorithm of the signature algorithm, e.g. MBEDTLS_MD_SHA256 */
93 mbedtls_pk_type_t sig_pk
; /**< Internal representation of the Public Key algorithm of the signature algorithm, e.g. MBEDTLS_PK_RSA */
94 void *sig_opts
; /**< Signature options to be passed to mbedtls_pk_verify_ext(), e.g. for RSASSA-PSS */
96 struct mbedtls_x509_crl
*next
;
101 * \brief Parse a DER-encoded CRL and append it to the chained list
103 * \param chain points to the start of the chain
104 * \param buf buffer holding the CRL data in DER format
105 * \param buflen size of the buffer
106 * (including the terminating null byte for PEM data)
108 * \return 0 if successful, or a specific X509 or PEM error code
110 int mbedtls_x509_crl_parse_der( mbedtls_x509_crl
*chain
,
111 const unsigned char *buf
, size_t buflen
);
113 * \brief Parse one or more CRLs and append them to the chained list
115 * \note Mutliple CRLs are accepted only if using PEM format
117 * \param chain points to the start of the chain
118 * \param buf buffer holding the CRL data in PEM or DER format
119 * \param buflen size of the buffer
120 * (including the terminating null byte for PEM data)
122 * \return 0 if successful, or a specific X509 or PEM error code
124 int mbedtls_x509_crl_parse( mbedtls_x509_crl
*chain
, const unsigned char *buf
, size_t buflen
);
126 #if defined(MBEDTLS_FS_IO)
128 * \brief Load one or more CRLs and append them to the chained list
130 * \note Mutliple CRLs are accepted only if using PEM format
132 * \param chain points to the start of the chain
133 * \param path filename to read the CRLs from (in PEM or DER encoding)
135 * \return 0 if successful, or a specific X509 or PEM error code
137 int mbedtls_x509_crl_parse_file( mbedtls_x509_crl
*chain
, const char *path
);
138 #endif /* MBEDTLS_FS_IO */
141 * \brief Returns an informational string about the CRL.
143 * \param buf Buffer to write to
144 * \param size Maximum size of buffer
145 * \param prefix A line prefix
146 * \param crl The X509 CRL to represent
148 * \return The length of the string written (not including the
149 * terminated nul byte), or a negative error code.
151 int mbedtls_x509_crl_info( char *buf
, size_t size
, const char *prefix
,
152 const mbedtls_x509_crl
*crl
);
155 * \brief Initialize a CRL (chain)
157 * \param crl CRL chain to initialize
159 void mbedtls_x509_crl_init( mbedtls_x509_crl
*crl
);
162 * \brief Unallocate all CRL data
164 * \param crl CRL chain to free
166 void mbedtls_x509_crl_free( mbedtls_x509_crl
*crl
);
169 /* \} addtogroup x509_module */
175 #endif /* mbedtls_x509_crl.h */