39 #if defined(POLARSSL_X509_PARSE_C)
45 #if defined(POLARSSL_MD2_C)
48 #if defined(POLARSSL_MD4_C)
51 #if defined(POLARSSL_MD5_C)
54 #if defined(POLARSSL_SHA1_C)
57 #if defined(POLARSSL_SHA2_C)
60 #if defined(POLARSSL_SHA4_C)
64 #if defined(POLARSSL_PKCS5_C)
67 #if defined(POLARSSL_PKCS12_C)
79 #if defined(POLARSSL_FS_IO)
82 #include <sys/types.h>
89 #define OID_CMP(oid_str, oid_buf) \
90 ( ( OID_SIZE(oid_str) == (oid_buf)->len ) && \
91 memcmp( (oid_str), (oid_buf)->p, (oid_buf)->len) == 0)
96 static int x509_get_version(
unsigned char **p,
97 const unsigned char *end,
130 static int x509_crl_get_version(
unsigned char **p,
131 const unsigned char *end,
153 static int x509_get_serial(
unsigned char **p,
154 const unsigned char *end,
159 if( ( end - *p ) < 1 )
168 serial->
tag = *(*p)++;
184 static int x509_get_alg(
unsigned char **p,
185 const unsigned char *end,
229 static int x509_get_attr_type_value(
unsigned char **p,
230 const unsigned char *end,
251 if( ( end - *p ) < 1 )
287 static int x509_get_name(
unsigned char **p,
288 const unsigned char *end,
293 const unsigned char *end2;
306 if( ( ret = x509_get_attr_type_value( p, end, use ) ) != 0 )
314 if( use->
next == NULL )
333 if( cur->
next == NULL )
338 return( x509_get_name( p, end2, cur->
next ) );
346 static int x509_get_time(
unsigned char **p,
347 const unsigned char *end,
355 if( ( end - *p ) < 1 )
369 memset( date, 0,
sizeof( date ) );
370 memcpy( date, *p, ( len <
sizeof( date ) - 1 ) ?
371 len :
sizeof( date ) - 1 );
373 if( sscanf( date,
"%2d%2d%2d%2d%2d%2d",
378 time->
year += 100 * ( time->
year < 50 );
393 memset( date, 0,
sizeof( date ) );
394 memcpy( date, *p, ( len <
sizeof( date ) - 1 ) ?
395 len :
sizeof( date ) - 1 );
397 if( sscanf( date,
"%4d%2d%2d%2d%2d%2d",
416 static int x509_get_dates(
unsigned char **p,
417 const unsigned char *end,
430 if( ( ret = x509_get_time( p, end, from ) ) != 0 )
433 if( ( ret = x509_get_time( p, end, to ) ) != 0 )
448 static int x509_get_pubkey(
unsigned char **p,
449 const unsigned char *end,
457 if( ( ret = x509_get_alg( p, end, pk_alg_oid ) ) != 0 )
463 if( pk_alg_oid->
len != 9 ||
472 if( ( end - *p ) < 1 )
491 if( *p + len != end2 )
506 static int x509_get_sig(
unsigned char **p,
507 const unsigned char *end,
513 if( ( end - *p ) < 1 )
523 if( --len < 1 || *(*p)++ != 0 )
537 static int x509_get_uid(
unsigned char **p,
538 const unsigned char *end,
567 static int x509_get_ext(
unsigned char **p,
568 const unsigned char *end,
598 if( end != *p + len )
608 static int x509_get_crl_ext(
unsigned char **p,
609 const unsigned char *end,
616 if( ( ret = x509_get_ext( p, end, ext, 0) ) != 0 )
643 static int x509_get_crl_entry_ext(
unsigned char **p,
644 const unsigned char *end,
674 if( end != *p + ext->
len )
694 static int x509_get_basic_constraints(
unsigned char **p,
695 const unsigned char *end,
725 if( *ca_istrue != 0 )
732 if( ( ret =
asn1_get_int( p, end, max_pathlen ) ) != 0 )
744 static int x509_get_ns_cert_type(
unsigned char **p,
745 const unsigned char *end,
746 unsigned char *ns_cert_type)
759 *ns_cert_type = *bs.
p;
763 static int x509_get_key_usage(
unsigned char **p,
764 const unsigned char *end,
765 unsigned char *key_usage)
787 static int x509_get_ext_key_usage(
unsigned char **p,
788 const unsigned char *end,
797 if( ext_key_usage->
buf.
p == NULL )
830 static int x509_get_subject_alt_name(
unsigned char **p,
831 const unsigned char *end,
845 if( *p + len != end )
851 if( ( end - *p ) < 1 )
864 if( tag != ( ASN1_CONTEXT_SPECIFIC | 2 ) )
882 if( cur->
next == NULL )
908 static int x509_get_crt_ext(
unsigned char **p,
909 const unsigned char *end,
914 unsigned char *end_ext_data, *end_ext_octet;
916 if( ( ret = x509_get_ext( p, end, &crt->
v3_ext, 3 ) ) != 0 )
939 end_ext_data = *p + len;
950 if( ( end - *p ) < 1 )
955 if( ( ret =
asn1_get_bool( p, end_ext_data, &is_critical ) ) != 0 &&
964 end_ext_octet = *p + len;
966 if( end_ext_octet != end_ext_data )
977 if( ( ret = x509_get_basic_constraints( p, end_ext_octet,
986 if( ( ret = x509_get_ns_cert_type( p, end_ext_octet,
995 if( ( ret = x509_get_key_usage( p, end_ext_octet,
1004 if( ( ret = x509_get_ext_key_usage( p, end_ext_octet,
1013 if( ( ret = x509_get_subject_alt_name( p, end_ext_octet,
1023 #if !defined(POLARSSL_X509_ALLOW_UNSUPPORTED_CRITICAL_EXTENSION)
1044 static int x509_get_entries(
unsigned char **p,
1045 const unsigned char *end,
1064 end = *p + entry_len;
1069 const unsigned char *end2;
1077 cur_entry->
raw.
tag = **p;
1078 cur_entry->
raw.
p = *p;
1079 cur_entry->
raw.
len = len2;
1082 if( ( ret = x509_get_serial( p, end2, &cur_entry->
serial ) ) != 0 )
1085 if( ( ret = x509_get_time( p, end2, &cur_entry->
revocation_date ) ) != 0 )
1088 if( ( ret = x509_get_crl_entry_ext( p, end2, &cur_entry->
entry_ext ) ) != 0 )
1095 if( cur_entry->
next == NULL )
1098 cur_entry = cur_entry->
next;
1108 if( sig_oid->
len == 9 &&
1111 if( sig_oid->
p[8] >= 2 && sig_oid->
p[8] <= 5 )
1113 *sig_alg = sig_oid->
p[8];
1117 if ( sig_oid->
p[8] >= 11 && sig_oid->
p[8] <= 14 )
1119 *sig_alg = sig_oid->
p[8];
1125 if( sig_oid->
len == 5 &&
1138 int x509parse_crt_der_core(
x509_cert *crt,
const unsigned char *buf,
1143 unsigned char *p, *end, *crt_end;
1148 if( crt == NULL || buf == NULL )
1151 p = (
unsigned char *) malloc( len = buflen );
1156 memcpy( p, buf, buflen );
1177 if( len > (
size_t) ( end - p ) )
1207 if( ( ret = x509_get_version( &p, end, &crt->
version ) ) != 0 ||
1208 ( ret = x509_get_serial( &p, end, &crt->
serial ) ) != 0 ||
1209 ( ret = x509_get_alg( &p, end, &crt->
sig_oid1 ) ) != 0 )
1223 if( ( ret = x509_get_sig_alg( &crt->
sig_oid1, &crt->
sig_alg ) ) != 0 )
1241 if( ( ret = x509_get_name( &p, p + len, &crt->
issuer ) ) != 0 )
1255 if( ( ret = x509_get_dates( &p, end, &crt->
valid_from,
1274 if( len && ( ret = x509_get_name( &p, p + len, &crt->
subject ) ) != 0 )
1294 if( ( ret = x509_get_pubkey( &p, p + len, &crt->
pk_oid,
1295 &crt->
rsa.
N, &crt->
rsa.
E ) ) != 0 )
1319 ret = x509_get_uid( &p, end, &crt->
issuer_id, 1 );
1329 ret = x509_get_uid( &p, end, &crt->
subject_id, 2 );
1339 ret = x509_get_crt_ext( &p, end, crt);
1360 if( ( ret = x509_get_alg( &p, end, &crt->
sig_oid2 ) ) != 0 )
1373 if( ( ret = x509_get_sig( &p, end, &crt->
sig ) ) != 0 )
1401 if( crt == NULL || buf == NULL )
1417 if( crt->
next == NULL )
1425 if( ( ret = x509parse_crt_der_core( crt, buf, buflen ) ) != 0 )
1444 int ret, success = 0, first_error = 0, total_failed = 0;
1450 if( chain == NULL || buf == NULL )
1457 #if defined(POLARSSL_PEM_C)
1458 if( strstr( (
const char *) buf,
"-----BEGIN CERTIFICATE-----" ) != NULL )
1465 #if defined(POLARSSL_PEM_C)
1476 "-----BEGIN CERTIFICATE-----",
1477 "-----END CERTIFICATE-----",
1478 buf, NULL, 0, &use_len );
1502 if( first_error == 0 )
1522 if( first_error == 0 )
1535 return( total_failed );
1536 else if( first_error )
1537 return( first_error );
1549 unsigned char *p, *end;
1551 #if defined(POLARSSL_PEM_C)
1561 if( crl == NULL || buf == NULL )
1574 if( crl->
next == NULL )
1581 memset( crl, 0,
sizeof(
x509_crl ) );
1584 #if defined(POLARSSL_PEM_C)
1587 "-----BEGIN X509 CRL-----",
1588 "-----END X509 CRL-----",
1589 buf, NULL, 0, &use_len );
1617 p = (
unsigned char *) malloc( len = buflen );
1622 memcpy( p, buf, buflen );
1627 p = (
unsigned char *) malloc( len = buflen );
1632 memcpy( p, buf, buflen );
1654 if( len != (
size_t) ( end - p ) )
1682 if( ( ret = x509_crl_get_version( &p, end, &crl->
version ) ) != 0 ||
1683 ( ret = x509_get_alg( &p, end, &crl->
sig_oid1 ) ) != 0 )
1697 if( ( ret = x509_get_sig_alg( &crl->
sig_oid1, &crl->
sig_alg ) ) != 0 )
1715 if( ( ret = x509_get_name( &p, p + len, &crl->
issuer ) ) != 0 )
1727 if( ( ret = x509_get_time( &p, end, &crl->
this_update ) ) != 0 )
1733 if( ( ret = x509_get_time( &p, end, &crl->
next_update ) ) != 0 )
1753 if( ( ret = x509_get_entries( &p, end, &crl->
entry ) ) != 0 )
1765 ret = x509_get_crl_ext( &p, end, &crl->
crl_ext );
1787 if( ( ret = x509_get_alg( &p, end, &crl->
sig_oid2 ) ) != 0 )
1800 if( ( ret = x509_get_sig( &p, end, &crl->
sig ) ) != 0 )
1817 if( crl->
next == NULL )
1824 memset( crl, 0,
sizeof(
x509_crl ) );
1832 #if defined(POLARSSL_FS_IO)
1836 int load_file(
const char *path,
unsigned char **buf,
size_t *n )
1841 if( ( f = fopen( path,
"rb" ) ) == NULL )
1844 fseek( f, 0, SEEK_END );
1845 if( ( size = ftell( f ) ) == -1 )
1850 fseek( f, 0, SEEK_SET );
1855 ( *buf = (
unsigned char *) malloc( *n + 1 ) ) == NULL )
1861 if( fread( *buf, 1, *n, f ) != *n )
1884 if ( (ret = load_file( path, &buf, &n ) ) != 0 )
1889 memset( buf, 0, n + 1 );
1900 WCHAR szDir[MAX_PATH];
1901 char filename[MAX_PATH];
1903 int len = strlen( path );
1905 WIN32_FIND_DATAW file_data;
1908 if( len > MAX_PATH - 3 )
1911 memset( szDir, 0,
sizeof(szDir) );
1912 memset( filename, 0, MAX_PATH );
1913 memcpy( filename, path, len );
1914 filename[len++] =
'\\';
1916 filename[len++] =
'*';
1918 w_ret = MultiByteToWideChar( CP_ACP, 0, path, len, szDir, MAX_PATH - 3 );
1920 hFind = FindFirstFileW( szDir, &file_data );
1921 if (hFind == INVALID_HANDLE_VALUE)
1924 len = MAX_PATH - len;
1927 memset( p, 0, len );
1929 if( file_data.dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY )
1932 w_ret = WideCharToMultiByte( CP_ACP, 0, file_data.cFileName,
1933 lstrlenW(file_data.cFileName),
1943 while( FindNextFileW( hFind, &file_data ) != 0 );
1945 if (GetLastError() != ERROR_NO_MORE_FILES)
1953 struct dirent entry, *result = NULL;
1954 char entry_name[255];
1955 DIR *dir = opendir( path );
1960 while( ( t_ret = readdir_r( dir, &entry, &result ) ) == 0 )
1962 if( result == NULL )
1965 snprintf( entry_name,
sizeof(entry_name),
"%s/%s", path, entry.d_name );
1967 i = stat( entry_name, &sb );
1975 if( !S_ISREG( sb.st_mode ) )
2001 if ( (ret = load_file( path, &buf, &n ) ) != 0 )
2006 memset( buf, 0, n + 1 );
2021 if ( (ret = load_file( path, &buf, &n ) ) != 0 )
2028 (
unsigned char *) pwd, strlen( pwd ) );
2030 memset( buf, 0, n + 1 );
2045 if ( (ret = load_file( path, &buf, &n ) ) != 0 )
2050 memset( buf, 0, n + 1 );
2060 static int x509parse_key_pkcs1_der(
rsa_context *rsa,
2061 const unsigned char *key,
2066 unsigned char *p, *end;
2068 p = (
unsigned char *) key;
2139 static int x509parse_key_pkcs8_unencrypted_der(
2141 const unsigned char *key,
2146 unsigned char *p, *end;
2149 p = (
unsigned char *) key;
2186 if( ( ret = x509_get_alg( &p, end, &pk_alg_oid ) ) != 0 )
2194 if( pk_alg_oid.
len != 9 ||
2206 if( ( end - p ) < 1 )
2214 if( ( ret = x509parse_key_pkcs1_der( rsa, p, end - p ) ) != 0 )
2223 static int x509parse_key_pkcs8_encrypted_der(
2225 const unsigned char *key,
2227 const unsigned char *pwd,
2232 unsigned char *p, *end, *end2;
2234 unsigned char buf[2048];
2236 memset(buf, 0, 2048);
2238 p = (
unsigned char *) key;
2278 p += pbe_alg_oid.
len;
2284 pbe_params.
len = end2 - p;
2285 p += pbe_params.
len;
2297 #if defined(POLARSSL_PKCS12_C)
2302 pwd, pwdlen, p, len, buf ) ) != 0 )
2314 pwd, pwdlen, p, len, buf ) ) != 0 )
2327 p, len, buf ) ) != 0 )
2340 #if defined(POLARSSL_PKCS5_C)
2344 p, len, buf ) ) != 0 )
2356 return x509parse_key_pkcs8_unencrypted_der( rsa, buf, len );
2363 const unsigned char *pwd,
size_t pwdlen )
2367 #if defined(POLARSSL_PEM_C)
2373 "-----BEGIN RSA PRIVATE KEY-----",
2374 "-----END RSA PRIVATE KEY-----",
2375 key, pwd, pwdlen, &len );
2378 if( ( ret = x509parse_key_pkcs1_der( rsa, pem.
buf, pem.
buflen ) ) != 0 )
2394 "-----BEGIN PRIVATE KEY-----",
2395 "-----END PRIVATE KEY-----",
2396 key, NULL, 0, &len );
2399 if( ( ret = x509parse_key_pkcs8_unencrypted_der( rsa,
2412 "-----BEGIN ENCRYPTED PRIVATE KEY-----",
2413 "-----END ENCRYPTED PRIVATE KEY-----",
2414 key, NULL, 0, &len );
2417 if( ( ret = x509parse_key_pkcs8_encrypted_der( rsa,
2419 pwd, pwdlen ) ) != 0 )
2440 if( ( ret = x509parse_key_pkcs8_encrypted_der( rsa, key, keylen,
2441 pwd, pwdlen ) ) == 0 )
2453 if( ( ret = x509parse_key_pkcs8_unencrypted_der( rsa, key, keylen ) ) == 0 )
2458 if( ( ret = x509parse_key_pkcs1_der( rsa, key, keylen ) ) == 0 )
2473 unsigned char *p, *end;
2475 #if defined(POLARSSL_PEM_C)
2480 "-----BEGIN PUBLIC KEY-----",
2481 "-----END PUBLIC KEY-----",
2482 key, NULL, 0, &len );
2497 p = ( ret == 0 ) ? pem.
buf : (
unsigned char *) key;
2499 p = (
unsigned char *) key;
2523 #if defined(POLARSSL_PEM_C)
2530 if( ( ret = x509_get_pubkey( &p, end, &alg_oid, &rsa->
N, &rsa->
E ) ) != 0 )
2532 #if defined(POLARSSL_PEM_C)
2541 #if defined(POLARSSL_PEM_C)
2550 #if defined(POLARSSL_PEM_C)
2557 #if defined(POLARSSL_DHM_C)
2565 unsigned char *p, *end;
2566 #if defined(POLARSSL_PEM_C)
2572 "-----BEGIN DH PARAMETERS-----",
2573 "-----END DH PARAMETERS-----",
2574 dhmin, NULL, 0, &dhminlen );
2589 p = ( ret == 0 ) ? pem.
buf : (
unsigned char *) dhmin;
2591 p = (
unsigned char *) dhmin;
2606 #if defined(POLARSSL_PEM_C)
2617 #if defined(POLARSSL_PEM_C)
2626 #if defined(POLARSSL_PEM_C)
2634 #if defined(POLARSSL_PEM_C)
2641 #if defined(POLARSSL_FS_IO)
2651 if ( ( ret = load_file( path, &buf, &n ) ) != 0 )
2656 memset( buf, 0, n + 1 );
2664 #if defined _MSC_VER && !defined snprintf
2667 #if !defined vsnprintf
2668 #define vsnprintf _vsnprintf
2678 int compat_snprintf(
char *str,
size_t size,
const char *format, ...)
2683 va_start( ap, format );
2685 res = vsnprintf( str, size, format, ap );
2691 return( (
int) size + 20 );
2696 #define snprintf compat_snprintf
2699 #define POLARSSL_ERR_DEBUG_BUF_TOO_SMALL -2
2701 #define SAFE_SNPRINTF() \
2706 if ( (unsigned int) ret > n ) { \
2708 return POLARSSL_ERR_DEBUG_BUF_TOO_SMALL;\
2711 n -= (unsigned int) ret; \
2712 p += (unsigned int) ret; \
2727 memset( s, 0,
sizeof( s ) );
2733 while( name != NULL )
2743 ret = snprintf( p, n,
", " );
2747 if( name->
oid.
len == 3 &&
2750 switch( name->
oid.
p[2] )
2753 ret = snprintf( p, n,
"CN=" );
break;
2756 ret = snprintf( p, n,
"C=" );
break;
2759 ret = snprintf( p, n,
"L=" );
break;
2762 ret = snprintf( p, n,
"ST=" );
break;
2765 ret = snprintf( p, n,
"O=" );
break;
2768 ret = snprintf( p, n,
"OU=" );
break;
2771 ret = snprintf( p, n,
"0x%02X=",
2777 else if( name->
oid.
len == 9 &&
2780 switch( name->
oid.
p[8] )
2783 ret = snprintf( p, n,
"emailAddress=" );
break;
2786 ret = snprintf( p, n,
"0x%02X=",
2794 ret = snprintf( p, n,
"\?\?=" );
2798 for( i = 0; i < name->
val.
len; i++ )
2800 if( i >=
sizeof( s ) - 1 )
2804 if( c < 32 || c == 127 || ( c > 128 && c < 160 ) )
2809 ret = snprintf( p, n,
"%s", s );
2814 return( (
int) ( size - n ) );
2830 nr = ( serial->
len <= 32 )
2833 for( i = 0; i < nr; i++ )
2835 if( i == 0 && nr > 1 && serial->
p[i] == 0x0 )
2838 ret = snprintf( p, n,
"%02X%s",
2839 serial->
p[i], ( i < nr - 1 ) ?
":" :
"" );
2843 if( nr != serial->
len )
2845 ret = snprintf( p, n,
"...." );
2849 return( (
int) ( size - n ) );
2865 ret = snprintf( p, n,
"%scert. version : %d\n",
2868 ret = snprintf( p, n,
"%sserial number : ",
2875 ret = snprintf( p, n,
"\n%sissuer name : ", prefix );
2880 ret = snprintf( p, n,
"\n%ssubject name : ", prefix );
2885 ret = snprintf( p, n,
"\n%sissued on : " \
2886 "%04d-%02d-%02d %02d:%02d:%02d", prefix,
2892 ret = snprintf( p, n,
"\n%sexpires on : " \
2893 "%04d-%02d-%02d %02d:%02d:%02d", prefix,
2899 ret = snprintf( p, n,
"\n%ssigned using : RSA+", prefix );
2904 case SIG_RSA_MD2 : ret = snprintf( p, n,
"MD2" );
break;
2905 case SIG_RSA_MD4 : ret = snprintf( p, n,
"MD4" );
break;
2906 case SIG_RSA_MD5 : ret = snprintf( p, n,
"MD5" );
break;
2907 case SIG_RSA_SHA1 : ret = snprintf( p, n,
"SHA1" );
break;
2912 default: ret = snprintf( p, n,
"???" );
break;
2916 ret = snprintf( p, n,
"\n%sRSA key size : %d bits\n", prefix,
2917 (
int) crt->
rsa.
N.
n * (
int)
sizeof(
t_uint ) * 8 );
2920 return( (
int) ( size - n ) );
2966 ret = snprintf( p, n,
"%d.%d", oid->
p[0]/40, oid->
p[0]%40 );
2972 for( i = 1; i < oid->
len; i++ )
2975 value += oid->
p[i] & 0x7F;
2977 if( !( oid->
p[i] & 0x80 ) )
2980 ret = snprintf( p, n,
".%d", value );
2986 return( (
int) ( size - n ) );
3003 ret = snprintf( p, n,
"%sCRL version : %d",
3007 ret = snprintf( p, n,
"\n%sissuer name : ", prefix );
3012 ret = snprintf( p, n,
"\n%sthis update : " \
3013 "%04d-%02d-%02d %02d:%02d:%02d", prefix,
3019 ret = snprintf( p, n,
"\n%snext update : " \
3020 "%04d-%02d-%02d %02d:%02d:%02d", prefix,
3026 entry = &crl->
entry;
3028 ret = snprintf( p, n,
"\n%sRevoked certificates:",
3032 while( entry != NULL && entry->
raw.
len != 0 )
3034 ret = snprintf( p, n,
"\n%sserial number: ",
3041 ret = snprintf( p, n,
" revocation date: " \
3042 "%04d-%02d-%02d %02d:%02d:%02d",
3048 entry = entry->
next;
3051 ret = snprintf( p, n,
"\n%ssigned using : RSA+", prefix );
3056 case SIG_RSA_MD2 : ret = snprintf( p, n,
"MD2" );
break;
3057 case SIG_RSA_MD4 : ret = snprintf( p, n,
"MD4" );
break;
3058 case SIG_RSA_MD5 : ret = snprintf( p, n,
"MD5" );
break;
3059 case SIG_RSA_SHA1 : ret = snprintf( p, n,
"SHA1" );
break;
3064 default: ret = snprintf( p, n,
"???" );
break;
3068 ret = snprintf( p, n,
"\n" );
3071 return( (
int) ( size - n ) );
3098 lt = localtime( &tt );
3100 year = lt->tm_year + 1900;
3101 mon = lt->tm_mon + 1;
3108 if( year > to->
year )
3111 if( year == to->
year &&
3115 if( year == to->
year &&
3120 if( year == to->
year &&
3126 if( year == to->
year &&
3133 if( year == to->
year &&
3151 while( cur != NULL && cur->
serial.
len != 0 )
3169 static void x509_hash(
const unsigned char *in,
size_t len,
int alg,
3170 unsigned char *out )
3174 #if defined(POLARSSL_MD2_C)
3177 #if defined(POLARSSL_MD4_C)
3180 #if defined(POLARSSL_MD5_C)
3183 #if defined(POLARSSL_SHA1_C)
3186 #if defined(POLARSSL_SHA2_C)
3190 #if defined(POLARSSL_SHA4_C)
3195 memset( out,
'\xFF', 64 );
3208 unsigned char hash[64];
3219 while( crl_list != NULL )
3226 crl_list = crl_list->
next;
3235 x509_hash( crl_list->
tbs.
p, crl_list->
tbs.
len, hash_id, hash );
3238 0, hash, crl_list->
sig.
p ) == 0 )
3262 crl_list = crl_list->
next;
3268 static int x509_name_cmp(
const void *s1,
const void *s2,
size_t len )
3272 const unsigned char *n1 = s1, *n2 = s2;
3274 for( i = 0; i < len; i++ )
3276 diff = n1[i] ^ n2[i];
3278 if( ( n1[i] >=
'a' || n1[i] <=
'z' ) && ( diff == 0 || diff == 32 ) )
3281 if( ( n1[i] >=
'A' || n1[i] <=
'Z' ) && ( diff == 0 || diff == 32 ) )
3290 int x509_wildcard_verify(
const char *cn,
x509_buf *name )
3295 if( name->
len < 3 || name->
p[0] !=
'*' || name->
p[1] !=
'.' )
3298 for( i = 0; i < strlen( cn ); ++i )
3310 if( strlen( cn ) - cn_idx == name->
len - 1 &&
3311 x509_name_cmp( name->
p + 1, cn + cn_idx, name->
len - 1 ) == 0 )
3319 static int x509parse_verify_top(
3321 x509_crl *ca_crl,
int path_cnt,
int *flags,
3322 int (*f_vrfy)(
void *,
x509_cert *,
int,
int *),
3326 int ca_flags = 0, check_path_cnt = path_cnt + 1;
3327 unsigned char hash[64];
3337 while( trust_ca != NULL )
3344 trust_ca = trust_ca->
next;
3362 trust_ca = trust_ca->
next;
3368 x509_hash( child->
tbs.
p, child->
tbs.
len, hash_id, hash );
3371 0, hash, child->
sig.
p ) != 0 )
3373 trust_ca = trust_ca->
next;
3389 if( trust_ca != NULL &&
3395 *flags |= x509parse_verifycrl( child, trust_ca, ca_crl );
3400 if( NULL != f_vrfy )
3402 if( ( ret = f_vrfy( p_vrfy, trust_ca, path_cnt + 1, &ca_flags ) ) != 0 )
3408 if( NULL != f_vrfy )
3410 if( ( ret = f_vrfy(p_vrfy, child, path_cnt, flags ) ) != 0 )
3419 static int x509parse_verify_child(
3421 x509_crl *ca_crl,
int path_cnt,
int *flags,
3422 int (*f_vrfy)(
void *,
x509_cert *,
int,
int *),
3426 int parent_flags = 0;
3427 unsigned char hash[64];
3435 x509_hash( child->
tbs.
p, child->
tbs.
len, hash_id, hash );
3438 hash, child->
sig.
p ) != 0 )
3442 *flags |= x509parse_verifycrl(child, parent, ca_crl);
3444 grandparent = parent->
next;
3446 while( grandparent != NULL )
3448 if( grandparent->
version == 0 ||
3454 grandparent = grandparent->
next;
3460 if( grandparent != NULL )
3465 ret = x509parse_verify_child( parent, grandparent, trust_ca, ca_crl, path_cnt + 1, &parent_flags, f_vrfy, p_vrfy );
3471 ret = x509parse_verify_top( parent, trust_ca, ca_crl, path_cnt + 1, &parent_flags, f_vrfy, p_vrfy );
3477 if( NULL != f_vrfy )
3478 if( ( ret = f_vrfy( p_vrfy, child, path_cnt, flags ) ) != 0 )
3481 *flags |= parent_flags;
3492 const char *cn,
int *flags,
3493 int (*f_vrfy)(
void *,
x509_cert *,
int,
int *),
3508 cn_len = strlen( cn );
3514 while( cur != NULL )
3516 if( cur->
buf.
len == cn_len &&
3517 x509_name_cmp( cn, cur->
buf.
p, cn_len ) == 0 )
3521 memcmp( cur->
buf.
p,
"*.", 2 ) == 0 &&
3522 x509_wildcard_verify( cn, &cur->
buf ) )
3533 while( name != NULL )
3535 if( name->
oid.
len == 3 &&
3538 if( name->
val.
len == cn_len &&
3539 x509_name_cmp( name->
val.
p, cn, cn_len ) == 0 )
3543 memcmp( name->
val.
p,
"*.", 2 ) == 0 &&
3544 x509_wildcard_verify( cn, &name->
val ) )
3562 while( parent != NULL && parent->
version != 0 )
3569 parent = parent->
next;
3575 if( parent != NULL )
3580 ret = x509parse_verify_child( crt, parent, trust_ca, ca_crl, pathlen, flags, f_vrfy, p_vrfy );
3586 ret = x509parse_verify_top( crt, trust_ca, ca_crl, pathlen, flags, f_vrfy, p_vrfy );
3617 while( name_cur != NULL )
3619 name_prv = name_cur;
3620 name_cur = name_cur->
next;
3621 memset( name_prv, 0,
sizeof(
x509_name ) );
3626 while( name_cur != NULL )
3628 name_prv = name_cur;
3629 name_cur = name_cur->
next;
3630 memset( name_prv, 0,
sizeof(
x509_name ) );
3635 while( seq_cur != NULL )
3638 seq_cur = seq_cur->
next;
3644 while( seq_cur != NULL )
3647 seq_cur = seq_cur->
next;
3652 if( cert_cur->
raw.
p != NULL )
3654 memset( cert_cur->
raw.
p, 0, cert_cur->
raw.
len );
3655 free( cert_cur->
raw.
p );
3658 cert_cur = cert_cur->
next;
3660 while( cert_cur != NULL );
3665 cert_prv = cert_cur;
3666 cert_cur = cert_cur->
next;
3668 memset( cert_prv, 0,
sizeof(
x509_cert ) );
3669 if( cert_prv != crt )
3672 while( cert_cur != NULL );
3693 while( name_cur != NULL )
3695 name_prv = name_cur;
3696 name_cur = name_cur->
next;
3697 memset( name_prv, 0,
sizeof(
x509_name ) );
3702 while( entry_cur != NULL )
3704 entry_prv = entry_cur;
3705 entry_cur = entry_cur->
next;
3710 if( crl_cur->
raw.
p != NULL )
3712 memset( crl_cur->
raw.
p, 0, crl_cur->
raw.
len );
3713 free( crl_cur->
raw.
p );
3716 crl_cur = crl_cur->
next;
3718 while( crl_cur != NULL );
3724 crl_cur = crl_cur->
next;
3726 memset( crl_prv, 0,
sizeof(
x509_crl ) );
3727 if( crl_prv != crl )
3730 while( crl_cur != NULL );
3733 #if defined(POLARSSL_SELF_TEST)
3742 #if defined(POLARSSL_CERTS_C) && defined(POLARSSL_MD5_C)
3749 #if defined(POLARSSL_DHM_C)
3754 printf(
" X.509 certificate load: " );
3756 memset( &clicert, 0,
sizeof(
x509_cert ) );
3763 printf(
"failed\n" );
3768 memset( &cacert, 0,
sizeof(
x509_cert ) );
3775 printf(
"failed\n" );
3781 printf(
"passed\n X.509 private key load: " );
3793 printf(
"failed\n" );
3799 printf(
"passed\n X.509 signature verify: ");
3801 ret =
x509parse_verify( &clicert, &cacert, NULL,
"PolarSSL Client 2", &flags, NULL, NULL );
3805 printf(
"failed\n" );
3810 #if defined(POLARSSL_DHM_C)
3812 printf(
"passed\n X.509 DHM parameter load: " );
3820 printf(
"failed\n" );
3826 printf(
"passed\n\n" );
3832 #if defined(POLARSSL_DHM_C)
x509_time valid_to
End time of certificate validity.
#define OID_CLIENT_AUTH
id-kp-clientAuth OBJECT IDENTIFIER ::= { id-kp 2 }
#define POLARSSL_ERR_X509_KEY_INVALID_FORMAT
Invalid RSA key tag or value.
x509_buf issuer_raw
The raw issuer data (DER).
#define ASN1_PRINTABLE_STRING
int x509parse_crt_der(x509_cert *chain, const unsigned char *buf, size_t buflen)
Parse a single DER formatted certificate and add it to the chained list.
#define STRING_SERVER_AUTH
x509_name issuer
The parsed issuer data (named information object).
x509_buf tbs
The raw certificate body (DER).
x509_buf val
The named value.
int asn1_get_sequence_of(unsigned char **p, const unsigned char *end, asn1_sequence *cur, int tag)
Parses and splits an ASN.1 "SEQUENCE OF <tag>" Updated the pointer to immediately behind the full seq...
int max_pathlen
Optional Basic Constraint extension value: The maximum path length to the root certificate.
#define ASN1_GENERALIZED_TIME
unsigned char ns_cert_type
Optional Netscape certificate type extension value: See the values below.
int rsa_check_privkey(const rsa_context *ctx)
Check a private RSA key.
asn1_buf buf
Buffer containing the given ASN.1 item.
#define POLARSSL_ERR_X509_PASSWORD_REQUIRED
Private key password can't be empty.
#define POLARSSL_ERR_ASN1_LENGTH_MISMATCH
Actual length differs from expected length.
int pkcs12_pbe(asn1_buf *pbe_params, int mode, cipher_type_t cipher_type, md_type_t md_type, const unsigned char *pwd, size_t pwdlen, const unsigned char *input, size_t len, unsigned char *output)
PKCS12 Password Based function (encryption / decryption) for cipher-based and md-based PBE's...
int x509parse_crtfile(x509_cert *chain, const char *path)
Load one or more certificates and add them to the chained list.
void sha1(const unsigned char *input, size_t ilen, unsigned char output[20])
Output = SHA-1( input buffer )
Certificate revocation list entry.
#define POLARSSL_ERR_X509_CERT_INVALID_EXTENSIONS
The extension tag or value is invalid.
x509_buf sig
Signature: hash of the tbs part signed with the private key.
#define POLARSSL_ERR_X509_INVALID_INPUT
Input invalid.
#define POLARSSL_ERR_X509_CERT_UNKNOWN_FORMAT
Format not recognized as DER or PEM.
#define EXT_BASIC_CONSTRAINTS
x509_name subject
The parsed subject data (named information object).
#define OID_SERVER_AUTH
id-kp-serverAuth OBJECT IDENTIFIER ::= { id-kp 1 }
int asn1_get_int(unsigned char **p, const unsigned char *end, int *val)
Retrieve an integer ASN.1 tag and its value.
size_t len
ASN1 length, e.g.
x509_buf raw
The raw certificate data (DER).
#define POLARSSL_ERR_X509_CERT_UNKNOWN_SIG_ALG
Signature algorithm (oid) is unsupported.
const char * x509_oid_get_description(x509_buf *oid)
Give an known OID, return its descriptive string.
Container for date and time (precision in seconds).
#define STRING_EMAIL_PROTECTION
#define POLARSSL_ERR_PKCS12_PASSWORD_MISMATCH
Given private key password does not allow for correct decryption.
#define POLARSSL_ERR_X509_CERT_INVALID_VERSION
The certificate version element is invalid.
void x509_free(x509_cert *crt)
Unallocate all certificate data.
x509_sequence ext_key_usage
Optional list of extended key usage OIDs.
Configuration options (set of defines)
int rsa_check_pubkey(const rsa_context *ctx)
Check a public RSA key.
void md2(const unsigned char *input, size_t ilen, unsigned char output[16])
Output = MD2( input buffer )
int pem_read_buffer(pem_context *ctx, char *header, char *footer, const unsigned char *data, const unsigned char *pwd, size_t pwdlen, size_t *use_len)
Read a buffer for PEM information and store the resulting data into the specified context buffers...
#define POLARSSL_ERR_X509_UNKNOWN_PK_ALG
Key algorithm is unsupported (only RSA is supported).
Container for ASN1 named information objects.
int x509parse_cert_info(char *buf, size_t size, const char *prefix, const x509_cert *crt)
Returns an informational string about the certificate.
#define STRING_TIME_STAMPING
Container for an X.509 certificate.
int x509parse_dhmfile(dhm_context *dhm, const char *path)
Load and parse DHM parameters.
#define BADCRL_NOT_TRUSTED
CRL is not correctly signed by the trusted CA.
void md4(const unsigned char *input, size_t ilen, unsigned char output[16])
Output = MD4( input buffer )
#define POLARSSL_ERR_ASN1_INVALID_LENGTH
Error when trying to determine the length or invalid length.
Container for ASN1 bit strings.
#define POLARSSL_ERR_X509_CERT_INVALID_SERIAL
The serial tag or value is invalid.
x509_name issuer
The parsed issuer data (named information object).
#define POLARSSL_ERR_X509_KEY_INVALID_VERSION
Unsupported RSA key version.
#define OID_SIZE(x)
Returns the size of the binary string, without the trailing \0.
#define OID_KEY_USAGE
id-ce-keyUsage OBJECT IDENTIFIER ::= { id-ce 15 }
x509_crl_entry entry
The CRL entries containing the certificate revocation times for this CA.
#define OID_PKCS12_PBE_SHA1_DES3_EDE_CBC
x509_buf sig_oid2
Signature algorithm.
#define POLARSSL_ERR_X509_CERT_SIG_MISMATCH
Certificate signature algorithms do not match.
#define POLARSSL_ERR_PKCS5_PASSWORD_MISMATCH
Given private key password does not allow for correct decryption.
Container for a sequence of ASN.1 items.
#define OID_SUBJECT_ALT_NAME
id-ce-subjectAltName OBJECT IDENTIFIER ::= { id-ce 17 }
#define POLARSSL_ERR_PEM_PASSWORD_REQUIRED
Private key password can't be empty.
#define BADCERT_EXPIRED
The certificate validity has expired.
void rsa_free(rsa_context *ctx)
Free the components of an RSA key.
int sig_alg
Internal representation of the signature algorithm, e.g.
unsigned char * p
Raw ASN1 data for the bit string.
void pem_init(pem_context *ctx)
PEM context setup.
int x509parse_crt(x509_cert *chain, const unsigned char *buf, size_t buflen)
Parse one or more certificates and add them to the chained list.
SHA-384 and SHA-512 cryptographic hash function.
#define POLARSSL_ERR_X509_CERT_VERIFY_FAILED
Certificate verification failed, e.g.
int x509parse_time_expired(const x509_time *time)
Check a given x509_time against the system time and check if it is valid.
Privacy Enhanced Mail (PEM) decoding.
#define POLARSSL_ERR_X509_CERT_INVALID_SIGNATURE
The signature tag or value invalid.
int pkcs5_pbes2(asn1_buf *pbe_params, int mode, const unsigned char *pwd, size_t pwdlen, const unsigned char *data, size_t datalen, unsigned char *output)
PKCS#5 PBES2 function.
#define OID_EXTENDED_KEY_USAGE
id-ce-extKeyUsage OBJECT IDENTIFIER ::= { id-ce 37 }
#define OID_BASIC_CONSTRAINTS
id-ce-basicConstraints OBJECT IDENTIFIER ::= { id-ce 19 }
SHA-224 and SHA-256 cryptographic hash function.
void x509_crl_free(x509_crl *crl)
Unallocate all CRL data.
int x509parse_dhm(dhm_context *dhm, const unsigned char *dhmin, size_t dhminlen)
Parse DHM parameters.
unsigned char * p
ASN1 data, e.g.
#define POLARSSL_ERR_X509_CERT_INVALID_FORMAT
The certificate format is invalid, e.g.
int x509parse_crtpath(x509_cert *chain, const char *path)
Load one or more certificate files from a path and add them to the chained list.
int x509parse_crl(x509_crl *chain, const unsigned char *buf, size_t buflen)
Parse one or more CRLs and add them to the chained list.
int x509parse_dn_gets(char *buf, size_t size, const x509_name *dn)
Store the certificate DN in printable form into buf; no more than size characters will be written...
int x509parse_key(rsa_context *rsa, const unsigned char *key, size_t keylen, const unsigned char *pwd, size_t pwdlen)
Parse a private RSA key.
#define POLARSSL_ERR_PEM_PASSWORD_MISMATCH
Given private key password does not allow for correct decryption.
int x509_oid_get_numeric_string(char *buf, size_t size, x509_buf *oid)
Give an OID, return a string version of its OID number.
void pem_free(pem_context *ctx)
PEM context memory freeing.
x509_buf tbs
The raw certificate body (DER).
int asn1_get_bool(unsigned char **p, const unsigned char *end, int *val)
Retrieve a boolean ASN.1 tag and its value.
#define STRING_OCSP_SIGNING
int x509parse_public_keyfile(rsa_context *rsa, const char *path)
Load and parse a public RSA key.
x509_buf serial
Unique id for certificate issued by a specific CA.
struct _x509_crl_entry * next
x509_buf subject_id
Optional X.509 v2/v3 subject unique identifier.
Diffie-Hellman-Merkle key exchange.
x509_time valid_from
Start time of certificate validity.
#define POLARSSL_ERR_ASN1_OUT_OF_DATA
Out of data when parsing an ASN1 data structure.
#define EXT_EXTENDED_KEY_USAGE
x509_buf issuer_id
Optional X.509 v2/v3 issuer unique identifier.
unsigned char key_usage
Optional key usage extension value: See the values below.
X.509 certificate and private key decoding.
int x509parse_crl_info(char *buf, size_t size, const char *prefix, const x509_crl *crl)
Returns an informational string about the CRL.
int x509parse_public_key(rsa_context *rsa, const unsigned char *key, size_t keylen)
Parse a public RSA key.
#define POLARSSL_ERR_ASN1_MALLOC_FAILED
Memory allocation failed.
#define ASN1_CONTEXT_SPECIFIC
#define BADCERT_NOT_TRUSTED
The certificate is not correctly signed by the trusted CA.
struct _x509_cert * next
Next certificate in the CA-chain.
#define POLARSSL_ERR_X509_FILE_IO_ERROR
Read/write of file failed.
#define STRING_CODE_SIGNING
#define OID_PKCS12_PBE_SHA1_DES2_EDE_CBC
#define POLARSSL_ERR_X509_CERT_INVALID_DATE
The date tag or value is invalid.
Type-length-value structure that allows for ASN1 using DER.
#define ASN1_UNIVERSAL_STRING
#define POLARSSL_ERR_X509_CERT_UNKNOWN_VERSION
Certificate or CRL has an unsupported version number.
int pkcs12_pbe_sha1_rc4_128(asn1_buf *pbe_params, int mode, const unsigned char *pwd, size_t pwdlen, const unsigned char *input, size_t len, unsigned char *output)
PKCS12 Password Based function (encryption / decryption) for pbeWithSHAAnd128BitRC4.
size_t len
ASN1 length, e.g.
void sha4(const unsigned char *input, size_t ilen, unsigned char output[64], int is384)
Output = SHA-512( input buffer )
Sample certificates and DHM parameters for testing.
#define POLARSSL_ERR_X509_CERT_INVALID_PUBKEY
The pubkey tag or value is invalid (only RSA is supported).
#define OID_PKCS12_PBE_SHA1_RC4_128
SHA-1 cryptographic hash function.
#define BADCERT_REVOKED
The certificate has been revoked (is on a CRL).
size_t mpi_size(const mpi *X)
Return the total size in bytes.
int x509parse_revoked(const x509_cert *crt, const x509_crl *crl)
Verify the certificate signature.
#define BADCRL_EXPIRED
CRL is expired.
x509_buf subject_raw
The raw subject data (DER).
int asn1_get_len(unsigned char **p, const unsigned char *end, size_t *len)
Get the length of an ASN.1 element.
void rsa_init(rsa_context *ctx, int padding, int hash_id)
Initialize an RSA context.
#define POLARSSL_ERR_X509_FEATURE_UNAVAILABLE
Unavailable feature, e.g.
int asn1_get_tag(unsigned char **p, const unsigned char *end, size_t *len, int tag)
Get the tag and length of the tag.
#define X520_ORGANIZATION
Certificate revocation list structure.
int asn1_get_bitstring(unsigned char **p, const unsigned char *end, asn1_bitstring *bs)
Retrieve a bitstring ASN.1 tag and its value.
#define POLARSSL_ERR_X509_CERT_INVALID_ALG
The algorithm tag or value is invalid.
#define OID_TIME_STAMPING
id-kp-timeStamping OBJECT IDENTIFIER ::= { id-kp 8 }
#define POLARSSL_ERR_X509_PASSWORD_MISMATCH
Given private key password does not allow for correct decryption.
#define OID_OCSP_SIGNING
id-kp-OCSPSigning OBJECT IDENTIFIER ::= { id-kp 9 }
x509_sequence subject_alt_names
Optional list of Subject Alternative Names (Only dNSName supported).
x509_buf v3_ext
Optional X.509 v3 extensions.
void dhm_free(dhm_context *ctx)
Free the components of a DHM key.
#define OID_EMAIL_PROTECTION
id-kp-emailProtection OBJECT IDENTIFIER ::= { id-kp 4 }
x509_buf pk_oid
Subject public key info.
#define ASN1_OCTET_STRING
void sha2(const unsigned char *input, size_t ilen, unsigned char output[32], int is224)
Output = SHA-256( input buffer )
#define STRING_CLIENT_AUTH
#define OID_CODE_SIGNING
id-kp-codeSigning OBJECT IDENTIFIER ::= { id-kp 3 }
x509_buf raw
The raw certificate data (DER).
#define BADCERT_CN_MISMATCH
The certificate Common Name (CN) does not match with the expected CN.
int x509_self_test(int verbose)
Checkup routine.
#define POLARSSL_ERR_PEM_NO_HEADER_FOOTER_PRESENT
No PEM header or footer found.
const char test_dhm_params[]
MD4 message digest algorithm (hash function)
x509_time revocation_date
int x509parse_verify(x509_cert *crt, x509_cert *trust_ca, x509_crl *ca_crl, const char *cn, int *flags, int(*f_vrfy)(void *, x509_cert *, int, int *), void *p_vrfy)
Verify the certificate signature.
x509_buf issuer_raw
The raw issuer data (DER).
const char test_cli_crt[]
int asn1_get_mpi(unsigned char **p, const unsigned char *end, mpi *X)
Retrieve a MPI value from an integer ASN.1 tag.
int version
The X.509 version.
rsa_context rsa
Container for the RSA context.
MD5 message digest algorithm (hash function)
#define PKCS12_PBE_DECRYPT
#define POLARSSL_ERR_X509_MALLOC_FAILED
Allocation of memory failed.
#define POLARSSL_ERR_PEM_BAD_INPUT_DATA
Bad input parameters to function.
void md5(const unsigned char *input, size_t ilen, unsigned char output[16])
Output = MD5( input buffer )
MD2 message digest algorithm (hash function)
#define POLARSSL_ERR_ASN1_UNEXPECTED_TAG
ASN1 tag was of an unexpected value.
PKCS#12 Personal Information Exchange Syntax.
int x509parse_keyfile(rsa_context *rsa, const char *path, const char *password)
Load and parse a private RSA key.
int rsa_pkcs1_verify(rsa_context *ctx, int(*f_rng)(void *, unsigned char *, size_t), void *p_rng, int mode, int hash_id, unsigned int hashlen, const unsigned char *hash, unsigned char *sig)
Generic wrapper to perform a PKCS#1 verification using the mode from the context. ...
int x509parse_serial_gets(char *buf, size_t size, const x509_buf *serial)
Store the certificate serial in printable form into buf; no more than size characters will be written...
struct _asn1_sequence * next
The next entry in the sequence.
int x509parse_crlfile(x509_crl *chain, const char *path)
Load one or more CRLs and add them to the chained list.
x509_buf sig_oid1
Signature algorithm, e.g.
int ca_istrue
Optional Basic Constraint extension value: 1 if this certificate belongs to a CA, 0 otherwise...
struct _x509_name * next
The next named information object.
#define POLARSSL_ERR_X509_CERT_INVALID_NAME
The name tag or value is invalid.
#define EXT_SUBJECT_ALT_NAME
x509_buf oid
The object identifier.
int ext_types
Bit string containing detected and parsed extensions.