39 #if defined(POLARSSL_X509_PARSE_C)
45 #if defined(POLARSSL_MD2_C)
48 #if defined(POLARSSL_MD4_C)
51 #if defined(POLARSSL_MD5_C)
54 #if defined(POLARSSL_SHA1_C)
57 #if defined(POLARSSL_SHA2_C)
60 #if defined(POLARSSL_SHA4_C)
64 #if defined(POLARSSL_PKCS5_C)
67 #if defined(POLARSSL_PKCS12_C)
79 #if defined(POLARSSL_FS_IO)
82 #include <sys/types.h>
89 #define OID_CMP(oid_str, oid_buf) \
90 ( ( OID_SIZE(oid_str) == (oid_buf)->len ) && \
91 memcmp( (oid_str), (oid_buf)->p, (oid_buf)->len) == 0)
96 static int x509_get_version(
unsigned char **p,
97 const unsigned char *end,
130 static int x509_crl_get_version(
unsigned char **p,
131 const unsigned char *end,
153 static int x509_get_serial(
unsigned char **p,
154 const unsigned char *end,
159 if( ( end - *p ) < 1 )
168 serial->
tag = *(*p)++;
184 static int x509_get_alg(
unsigned char **p,
185 const unsigned char *end,
229 static int x509_get_attr_type_value(
unsigned char **p,
230 const unsigned char *end,
251 if( ( end - *p ) < 1 )
287 static int x509_get_name(
unsigned char **p,
288 const unsigned char *end,
293 const unsigned char *end2;
306 if( ( ret = x509_get_attr_type_value( p, end, use ) ) != 0 )
314 if( use->
next == NULL )
333 if( cur->
next == NULL )
338 return( x509_get_name( p, end2, cur->
next ) );
346 static int x509_get_time(
unsigned char **p,
347 const unsigned char *end,
355 if( ( end - *p ) < 1 )
369 memset( date, 0,
sizeof( date ) );
370 memcpy( date, *p, ( len <
sizeof( date ) - 1 ) ?
371 len :
sizeof( date ) - 1 );
373 if( sscanf( date,
"%2d%2d%2d%2d%2d%2d",
378 time->
year += 100 * ( time->
year < 50 );
393 memset( date, 0,
sizeof( date ) );
394 memcpy( date, *p, ( len <
sizeof( date ) - 1 ) ?
395 len :
sizeof( date ) - 1 );
397 if( sscanf( date,
"%4d%2d%2d%2d%2d%2d",
416 static int x509_get_dates(
unsigned char **p,
417 const unsigned char *end,
430 if( ( ret = x509_get_time( p, end, from ) ) != 0 )
433 if( ( ret = x509_get_time( p, end, to ) ) != 0 )
448 static int x509_get_pubkey(
unsigned char **p,
449 const unsigned char *end,
457 if( ( ret = x509_get_alg( p, end, pk_alg_oid ) ) != 0 )
463 if( pk_alg_oid->
len != 9 ||
472 if( ( end - *p ) < 1 )
491 if( *p + len != end2 )
506 static int x509_get_sig(
unsigned char **p,
507 const unsigned char *end,
513 if( ( end - *p ) < 1 )
523 if( --len < 1 || *(*p)++ != 0 )
537 static int x509_get_uid(
unsigned char **p,
538 const unsigned char *end,
567 static int x509_get_ext(
unsigned char **p,
568 const unsigned char *end,
598 if( end != *p + len )
608 static int x509_get_crl_ext(
unsigned char **p,
609 const unsigned char *end,
616 if( ( ret = x509_get_ext( p, end, ext, 0) ) != 0 )
643 static int x509_get_crl_entry_ext(
unsigned char **p,
644 const unsigned char *end,
674 if( end != *p + ext->
len )
694 static int x509_get_basic_constraints(
unsigned char **p,
695 const unsigned char *end,
725 if( *ca_istrue != 0 )
732 if( ( ret =
asn1_get_int( p, end, max_pathlen ) ) != 0 )
744 static int x509_get_ns_cert_type(
unsigned char **p,
745 const unsigned char *end,
746 unsigned char *ns_cert_type)
759 *ns_cert_type = *bs.
p;
763 static int x509_get_key_usage(
unsigned char **p,
764 const unsigned char *end,
765 unsigned char *key_usage)
787 static int x509_get_ext_key_usage(
unsigned char **p,
788 const unsigned char *end,
797 if( ext_key_usage->
buf.
p == NULL )
830 static int x509_get_subject_alt_name(
unsigned char **p,
831 const unsigned char *end,
845 if( *p + len != end )
851 if( ( end - *p ) < 1 )
864 if( tag != ( ASN1_CONTEXT_SPECIFIC | 2 ) )
882 if( cur->
next == NULL )
908 static int x509_get_crt_ext(
unsigned char **p,
909 const unsigned char *end,
914 unsigned char *end_ext_data, *end_ext_octet;
916 if( ( ret = x509_get_ext( p, end, &crt->
v3_ext, 3 ) ) != 0 )
939 end_ext_data = *p + len;
950 if( ( end - *p ) < 1 )
955 if( ( ret =
asn1_get_bool( p, end_ext_data, &is_critical ) ) != 0 &&
964 end_ext_octet = *p + len;
966 if( end_ext_octet != end_ext_data )
977 if( ( ret = x509_get_basic_constraints( p, end_ext_octet,
986 if( ( ret = x509_get_ns_cert_type( p, end_ext_octet,
995 if( ( ret = x509_get_key_usage( p, end_ext_octet,
1004 if( ( ret = x509_get_ext_key_usage( p, end_ext_octet,
1013 if( ( ret = x509_get_subject_alt_name( p, end_ext_octet,
1023 #if !defined(POLARSSL_X509_ALLOW_UNSUPPORTED_CRITICAL_EXTENSION)
1044 static int x509_get_entries(
unsigned char **p,
1045 const unsigned char *end,
1064 end = *p + entry_len;
1069 const unsigned char *end2;
1077 cur_entry->
raw.
tag = **p;
1078 cur_entry->
raw.
p = *p;
1079 cur_entry->
raw.
len = len2;
1082 if( ( ret = x509_get_serial( p, end2, &cur_entry->
serial ) ) != 0 )
1085 if( ( ret = x509_get_time( p, end2, &cur_entry->
revocation_date ) ) != 0 )
1088 if( ( ret = x509_get_crl_entry_ext( p, end2, &cur_entry->
entry_ext ) ) != 0 )
1095 if( cur_entry->
next == NULL )
1098 cur_entry = cur_entry->
next;
1108 if( sig_oid->
len == 9 &&
1111 if( sig_oid->
p[8] >= 2 && sig_oid->
p[8] <= 5 )
1113 *sig_alg = sig_oid->
p[8];
1117 if ( sig_oid->
p[8] >= 11 && sig_oid->
p[8] <= 14 )
1119 *sig_alg = sig_oid->
p[8];
1125 if( sig_oid->
len == 5 &&
1138 int x509parse_crt_der_core(
x509_cert *crt,
const unsigned char *buf,
1143 unsigned char *p, *end, *crt_end;
1148 if( crt == NULL || buf == NULL )
1151 p = (
unsigned char *) malloc( len = buflen );
1156 memcpy( p, buf, buflen );
1177 if( len > (
size_t) ( end - p ) )
1207 if( ( ret = x509_get_version( &p, end, &crt->
version ) ) != 0 ||
1208 ( ret = x509_get_serial( &p, end, &crt->
serial ) ) != 0 ||
1209 ( ret = x509_get_alg( &p, end, &crt->
sig_oid1 ) ) != 0 )
1223 if( ( ret = x509_get_sig_alg( &crt->
sig_oid1, &crt->
sig_alg ) ) != 0 )
1241 if( ( ret = x509_get_name( &p, p + len, &crt->
issuer ) ) != 0 )
1255 if( ( ret = x509_get_dates( &p, end, &crt->
valid_from,
1274 if( len && ( ret = x509_get_name( &p, p + len, &crt->
subject ) ) != 0 )
1294 if( ( ret = x509_get_pubkey( &p, p + len, &crt->
pk_oid,
1295 &crt->
rsa.
N, &crt->
rsa.
E ) ) != 0 )
1319 ret = x509_get_uid( &p, end, &crt->
issuer_id, 1 );
1329 ret = x509_get_uid( &p, end, &crt->
subject_id, 2 );
1339 ret = x509_get_crt_ext( &p, end, crt);
1360 if( ( ret = x509_get_alg( &p, end, &crt->
sig_oid2 ) ) != 0 )
1373 if( ( ret = x509_get_sig( &p, end, &crt->
sig ) ) != 0 )
1401 if( crt == NULL || buf == NULL )
1417 if( crt->
next == NULL )
1425 if( ( ret = x509parse_crt_der_core( crt, buf, buflen ) ) != 0 )
1444 int ret, success = 0, first_error = 0, total_failed = 0;
1450 if( chain == NULL || buf == NULL )
1457 #if defined(POLARSSL_PEM_C)
1458 if( strstr( (
const char *) buf,
"-----BEGIN CERTIFICATE-----" ) != NULL )
1465 #if defined(POLARSSL_PEM_C)
1476 "-----BEGIN CERTIFICATE-----",
1477 "-----END CERTIFICATE-----",
1478 buf, NULL, 0, &use_len );
1502 if( first_error == 0 )
1522 if( first_error == 0 )
1535 return( total_failed );
1536 else if( first_error )
1537 return( first_error );
1549 unsigned char *p, *end;
1551 #if defined(POLARSSL_PEM_C)
1561 if( crl == NULL || buf == NULL )
1574 if( crl->
next == NULL )
1581 memset( crl, 0,
sizeof(
x509_crl ) );
1584 #if defined(POLARSSL_PEM_C)
1587 "-----BEGIN X509 CRL-----",
1588 "-----END X509 CRL-----",
1589 buf, NULL, 0, &use_len );
1617 p = (
unsigned char *) malloc( len = buflen );
1622 memcpy( p, buf, buflen );
1627 p = (
unsigned char *) malloc( len = buflen );
1632 memcpy( p, buf, buflen );
1654 if( len != (
size_t) ( end - p ) )
1682 if( ( ret = x509_crl_get_version( &p, end, &crl->
version ) ) != 0 ||
1683 ( ret = x509_get_alg( &p, end, &crl->
sig_oid1 ) ) != 0 )
1697 if( ( ret = x509_get_sig_alg( &crl->
sig_oid1, &crl->
sig_alg ) ) != 0 )
1715 if( ( ret = x509_get_name( &p, p + len, &crl->
issuer ) ) != 0 )
1727 if( ( ret = x509_get_time( &p, end, &crl->
this_update ) ) != 0 )
1733 if( ( ret = x509_get_time( &p, end, &crl->
next_update ) ) != 0 )
1753 if( ( ret = x509_get_entries( &p, end, &crl->
entry ) ) != 0 )
1765 ret = x509_get_crl_ext( &p, end, &crl->
crl_ext );
1787 if( ( ret = x509_get_alg( &p, end, &crl->
sig_oid2 ) ) != 0 )
1800 if( ( ret = x509_get_sig( &p, end, &crl->
sig ) ) != 0 )
1817 if( crl->
next == NULL )
1824 memset( crl, 0,
sizeof(
x509_crl ) );
1832 #if defined(POLARSSL_FS_IO)
1836 int load_file(
const char *path,
unsigned char **buf,
size_t *n )
1841 if( ( f = fopen( path,
"rb" ) ) == NULL )
1844 fseek( f, 0, SEEK_END );
1845 if( ( size = ftell( f ) ) == -1 )
1850 fseek( f, 0, SEEK_SET );
1855 ( *buf = (
unsigned char *) malloc( *n + 1 ) ) == NULL )
1861 if( fread( *buf, 1, *n, f ) != *n )
1884 if ( (ret = load_file( path, &buf, &n ) ) != 0 )
1889 memset( buf, 0, n + 1 );
1900 WCHAR szDir[MAX_PATH];
1901 char filename[MAX_PATH];
1903 int len = strlen( path );
1905 WIN32_FIND_DATAW file_data;
1908 if( len > MAX_PATH - 3 )
1911 memset( szDir, 0,
sizeof(szDir) );
1912 memset( filename, 0, MAX_PATH );
1913 memcpy( filename, path, len );
1914 filename[len++] =
'\\';
1916 filename[len++] =
'*';
1918 w_ret = MultiByteToWideChar( CP_ACP, 0, path, len, szDir, MAX_PATH - 3 );
1920 hFind = FindFirstFileW( szDir, &file_data );
1921 if (hFind == INVALID_HANDLE_VALUE)
1924 len = MAX_PATH - len;
1927 memset( p, 0, len );
1929 if( file_data.dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY )
1932 w_ret = WideCharToMultiByte( CP_ACP, 0, file_data.cFileName,
1933 lstrlenW(file_data.cFileName),
1943 while( FindNextFileW( hFind, &file_data ) != 0 );
1945 if (GetLastError() != ERROR_NO_MORE_FILES)
1953 struct dirent entry, *result = NULL;
1954 char entry_name[255];
1955 DIR *dir = opendir( path );
1960 while( ( t_ret = readdir_r( dir, &entry, &result ) ) == 0 )
1962 if( result == NULL )
1965 snprintf( entry_name,
sizeof(entry_name),
"%s/%s", path, entry.d_name );
1967 i = stat( entry_name, &sb );
1975 if( !S_ISREG( sb.st_mode ) )
2001 if ( (ret = load_file( path, &buf, &n ) ) != 0 )
2006 memset( buf, 0, n + 1 );
2021 if ( (ret = load_file( path, &buf, &n ) ) != 0 )
2028 (
unsigned char *) pwd, strlen( pwd ) );
2030 memset( buf, 0, n + 1 );
2045 if ( (ret = load_file( path, &buf, &n ) ) != 0 )
2050 memset( buf, 0, n + 1 );
2060 static int x509parse_key_pkcs1_der(
rsa_context *rsa,
2061 const unsigned char *key,
2066 unsigned char *p, *end;
2068 p = (
unsigned char *) key;
2139 static int x509parse_key_pkcs8_unencrypted_der(
2141 const unsigned char *key,
2146 unsigned char *p, *end;
2149 p = (
unsigned char *) key;
2186 if( ( ret = x509_get_alg( &p, end, &pk_alg_oid ) ) != 0 )
2194 if( pk_alg_oid.
len != 9 ||
2206 if( ( end - p ) < 1 )
2214 if( ( ret = x509parse_key_pkcs1_der( rsa, p, end - p ) ) != 0 )
2223 static int x509parse_key_pkcs8_encrypted_der(
2225 const unsigned char *key,
2227 const unsigned char *pwd,
2232 unsigned char *p, *end, *end2;
2234 unsigned char buf[2048];
2236 memset(buf, 0, 2048);
2238 p = (
unsigned char *) key;
2278 p += pbe_alg_oid.
len;
2284 pbe_params.
len = end2 - p;
2285 p += pbe_params.
len;
2297 #if defined(POLARSSL_PKCS12_C)
2302 pwd, pwdlen, p, len, buf ) ) != 0 )
2314 pwd, pwdlen, p, len, buf ) ) != 0 )
2327 p, len, buf ) ) != 0 )
2340 #if defined(POLARSSL_PKCS5_C)
2344 p, len, buf ) ) != 0 )
2356 return x509parse_key_pkcs8_unencrypted_der( rsa, buf, len );
2363 const unsigned char *pwd,
size_t pwdlen )
2367 #if defined(POLARSSL_PEM_C)
2373 "-----BEGIN RSA PRIVATE KEY-----",
2374 "-----END RSA PRIVATE KEY-----",
2375 key, pwd, pwdlen, &len );
2378 if( ( ret = x509parse_key_pkcs1_der( rsa, pem.
buf, pem.
buflen ) ) != 0 )
2394 "-----BEGIN PRIVATE KEY-----",
2395 "-----END PRIVATE KEY-----",
2396 key, NULL, 0, &len );
2399 if( ( ret = x509parse_key_pkcs8_unencrypted_der( rsa,
2412 "-----BEGIN ENCRYPTED PRIVATE KEY-----",
2413 "-----END ENCRYPTED PRIVATE KEY-----",
2414 key, NULL, 0, &len );
2417 if( ( ret = x509parse_key_pkcs8_encrypted_der( rsa,
2419 pwd, pwdlen ) ) != 0 )
2440 if( ( ret = x509parse_key_pkcs8_encrypted_der( rsa, key, keylen,
2441 pwd, pwdlen ) ) == 0 )
2453 if( ( ret = x509parse_key_pkcs8_unencrypted_der( rsa, key, keylen ) ) == 0 )
2458 if( ( ret = x509parse_key_pkcs1_der( rsa, key, keylen ) ) == 0 )
2473 unsigned char *p, *end;
2475 #if defined(POLARSSL_PEM_C)
2480 "-----BEGIN PUBLIC KEY-----",
2481 "-----END PUBLIC KEY-----",
2482 key, NULL, 0, &len );
2497 p = ( ret == 0 ) ? pem.
buf : (
unsigned char *) key;
2499 p = (
unsigned char *) key;
2523 #if defined(POLARSSL_PEM_C)
2530 if( ( ret = x509_get_pubkey( &p, end, &alg_oid, &rsa->
N, &rsa->
E ) ) != 0 )
2532 #if defined(POLARSSL_PEM_C)
2541 #if defined(POLARSSL_PEM_C)
2550 #if defined(POLARSSL_PEM_C)
2557 #if defined(POLARSSL_DHM_C)
2565 unsigned char *p, *end;
2566 #if defined(POLARSSL_PEM_C)
2572 "-----BEGIN DH PARAMETERS-----",
2573 "-----END DH PARAMETERS-----",
2574 dhmin, NULL, 0, &dhminlen );
2589 p = ( ret == 0 ) ? pem.
buf : (
unsigned char *) dhmin;
2591 p = (
unsigned char *) dhmin;
2606 #if defined(POLARSSL_PEM_C)
2617 #if defined(POLARSSL_PEM_C)
2626 #if defined(POLARSSL_PEM_C)
2634 #if defined(POLARSSL_PEM_C)
2641 #if defined(POLARSSL_FS_IO)
2651 if ( ( ret = load_file( path, &buf, &n ) ) != 0 )
2656 memset( buf, 0, n + 1 );
2664 #if defined _MSC_VER && !defined snprintf
2667 #if !defined vsnprintf
2668 #define vsnprintf _vsnprintf
2678 int compat_snprintf(
char *str,
size_t size,
const char *format, ...)
2683 va_start( ap, format );
2685 res = vsnprintf( str, size, format, ap );
2691 return( (
int) size + 20 );
2696 #define snprintf compat_snprintf
2699 #define POLARSSL_ERR_DEBUG_BUF_TOO_SMALL -2
2701 #define SAFE_SNPRINTF() \
2706 if ( (unsigned int) ret > n ) { \
2708 return POLARSSL_ERR_DEBUG_BUF_TOO_SMALL;\
2711 n -= (unsigned int) ret; \
2712 p += (unsigned int) ret; \
2727 memset( s, 0,
sizeof( s ) );
2733 while( name != NULL )
2743 ret = snprintf( p, n,
", " );
2747 if( name->
oid.
len == 3 &&
2750 switch( name->
oid.
p[2] )
2753 ret = snprintf( p, n,
"CN=" );
break;
2756 ret = snprintf( p, n,
"C=" );
break;
2759 ret = snprintf( p, n,
"L=" );
break;
2762 ret = snprintf( p, n,
"ST=" );
break;
2765 ret = snprintf( p, n,
"O=" );
break;
2768 ret = snprintf( p, n,
"OU=" );
break;
2771 ret = snprintf( p, n,
"0x%02X=",
2777 else if( name->
oid.
len == 9 &&
2780 switch( name->
oid.
p[8] )
2783 ret = snprintf( p, n,
"emailAddress=" );
break;
2786 ret = snprintf( p, n,
"0x%02X=",
2794 ret = snprintf( p, n,
"\?\?=" );
2798 for( i = 0; i < name->
val.
len; i++ )
2800 if( i >=
sizeof( s ) - 1 )
2804 if( c < 32 || c == 127 || ( c > 128 && c < 160 ) )
2809 ret = snprintf( p, n,
"%s", s );
2814 return( (
int) ( size - n ) );
2830 nr = ( serial->
len <= 32 )
2833 for( i = 0; i < nr; i++ )
2835 if( i == 0 && nr > 1 && serial->
p[i] == 0x0 )
2838 ret = snprintf( p, n,
"%02X%s",
2839 serial->
p[i], ( i < nr - 1 ) ?
":" :
"" );
2843 if( nr != serial->
len )
2845 ret = snprintf( p, n,
"...." );
2849 return( (
int) ( size - n ) );
2865 ret = snprintf( p, n,
"%scert. version : %d\n",
2868 ret = snprintf( p, n,
"%sserial number : ",
2875 ret = snprintf( p, n,
"\n%sissuer name : ", prefix );
2880 ret = snprintf( p, n,
"\n%ssubject name : ", prefix );
2885 ret = snprintf( p, n,
"\n%sissued on : " \
2886 "%04d-%02d-%02d %02d:%02d:%02d", prefix,
2892 ret = snprintf( p, n,
"\n%sexpires on : " \
2893 "%04d-%02d-%02d %02d:%02d:%02d", prefix,
2899 ret = snprintf( p, n,
"\n%ssigned using : RSA+", prefix );
2904 case SIG_RSA_MD2 : ret = snprintf( p, n,
"MD2" );
break;
2905 case SIG_RSA_MD4 : ret = snprintf( p, n,
"MD4" );
break;
2906 case SIG_RSA_MD5 : ret = snprintf( p, n,
"MD5" );
break;
2907 case SIG_RSA_SHA1 : ret = snprintf( p, n,
"SHA1" );
break;
2912 default: ret = snprintf( p, n,
"???" );
break;
2916 ret = snprintf( p, n,
"\n%sRSA key size : %d bits\n", prefix,
2917 (
int) crt->
rsa.
N.
n * (
int)
sizeof(
t_uint ) * 8 );
2920 return( (
int) ( size - n ) );
2966 ret = snprintf( p, n,
"%d.%d", oid->
p[0]/40, oid->
p[0]%40 );
2972 for( i = 1; i < oid->
len; i++ )
2975 value += oid->
p[i] & 0x7F;
2977 if( !( oid->
p[i] & 0x80 ) )
2980 ret = snprintf( p, n,
".%d", value );
2986 return( (
int) ( size - n ) );
3003 ret = snprintf( p, n,
"%sCRL version : %d",
3007 ret = snprintf( p, n,
"\n%sissuer name : ", prefix );
3012 ret = snprintf( p, n,
"\n%sthis update : " \
3013 "%04d-%02d-%02d %02d:%02d:%02d", prefix,
3019 ret = snprintf( p, n,
"\n%snext update : " \
3020 "%04d-%02d-%02d %02d:%02d:%02d", prefix,
3026 entry = &crl->
entry;
3028 ret = snprintf( p, n,
"\n%sRevoked certificates:",
3032 while( entry != NULL && entry->
raw.
len != 0 )
3034 ret = snprintf( p, n,
"\n%sserial number: ",
3041 ret = snprintf( p, n,
" revocation date: " \
3042 "%04d-%02d-%02d %02d:%02d:%02d",
3048 entry = entry->
next;
3051 ret = snprintf( p, n,
"\n%ssigned using : RSA+", prefix );
3056 case SIG_RSA_MD2 : ret = snprintf( p, n,
"MD2" );
break;
3057 case SIG_RSA_MD4 : ret = snprintf( p, n,
"MD4" );
break;
3058 case SIG_RSA_MD5 : ret = snprintf( p, n,
"MD5" );
break;
3059 case SIG_RSA_SHA1 : ret = snprintf( p, n,
"SHA1" );
break;
3064 default: ret = snprintf( p, n,
"???" );
break;
3068 ret = snprintf( p, n,
"\n" );
3071 return( (
int) ( size - n ) );
3098 lt = localtime( &tt );
3100 year = lt->tm_year + 1900;
3101 mon = lt->tm_mon + 1;
3108 if( year > to->
year )
3111 if( year == to->
year &&
3115 if( year == to->
year &&
3120 if( year == to->
year &&
3126 if( year == to->
year &&
3133 if( year == to->
year &&
3151 while( cur != NULL && cur->
serial.
len != 0 )
3169 static void x509_hash(
const unsigned char *in,
size_t len,
int alg,
3170 unsigned char *out )
3174 #if defined(POLARSSL_MD2_C)
3177 #if defined(POLARSSL_MD4_C)
3180 #if defined(POLARSSL_MD5_C)
3183 #if defined(POLARSSL_SHA1_C)
3186 #if defined(POLARSSL_SHA2_C)
3190 #if defined(POLARSSL_SHA4_C)
3195 memset( out,
'\xFF', 64 );
3208 unsigned char hash[64];
3219 while( crl_list != NULL )
3226 crl_list = crl_list->
next;
3235 x509_hash( crl_list->
tbs.
p, crl_list->
tbs.
len, hash_id, hash );
3238 0, hash, crl_list->
sig.
p ) == 0 )
3262 crl_list = crl_list->
next;
3268 static int x509_name_cmp(
const void *s1,
const void *s2,
size_t len )
3272 const unsigned char *n1 = s1, *n2 = s2;
3274 for( i = 0; i < len; i++ )
3276 diff = n1[i] ^ n2[i];
3278 if( ( n1[i] >=
'a' || n1[i] <=
'z' ) && ( diff == 0 || diff == 32 ) )
3281 if( ( n1[i] >=
'A' || n1[i] <=
'Z' ) && ( diff == 0 || diff == 32 ) )
3290 int x509_wildcard_verify(
const char *cn,
x509_buf *name )
3295 if( name->
len < 3 || name->
p[0] !=
'*' || name->
p[1] !=
'.' )
3298 for( i = 0; i < strlen( cn ); ++i )
3310 if( strlen( cn ) - cn_idx == name->
len - 1 &&
3311 x509_name_cmp( name->
p + 1, cn + cn_idx, name->
len - 1 ) == 0 )
3319 static int x509parse_verify_top(
3321 x509_crl *ca_crl,
int path_cnt,
int *flags,
3322 int (*f_vrfy)(
void *,
x509_cert *,
int,
int *),
3326 int ca_flags = 0, check_path_cnt = path_cnt + 1;
3327 unsigned char hash[64];
3337 while( trust_ca != NULL )
3344 trust_ca = trust_ca->
next;
3362 trust_ca = trust_ca->
next;
3368 x509_hash( child->
tbs.
p, child->
tbs.
len, hash_id, hash );
3371 0, hash, child->
sig.
p ) != 0 )
3373 trust_ca = trust_ca->
next;
3389 if( trust_ca != NULL &&
3395 *flags |= x509parse_verifycrl( child, trust_ca, ca_crl );
3400 if( NULL != f_vrfy )
3402 if( ( ret = f_vrfy( p_vrfy, trust_ca, path_cnt + 1, &ca_flags ) ) != 0 )
3408 if( NULL != f_vrfy )
3410 if( ( ret = f_vrfy(p_vrfy, child, path_cnt, flags ) ) != 0 )
3419 static int x509parse_verify_child(
3421 x509_crl *ca_crl,
int path_cnt,
int *flags,
3422 int (*f_vrfy)(
void *,
x509_cert *,
int,
int *),
3426 int parent_flags = 0;
3427 unsigned char hash[64];
3435 x509_hash( child->
tbs.
p, child->
tbs.
len, hash_id, hash );
3438 hash, child->
sig.
p ) != 0 )
3442 *flags |= x509parse_verifycrl(child, parent, ca_crl);
3444 grandparent = parent->
next;
3446 while( grandparent != NULL )
3448 if( grandparent->
version == 0 ||
3454 grandparent = grandparent->
next;
3460 if( grandparent != NULL )
3465 ret = x509parse_verify_child( parent, grandparent, trust_ca, ca_crl, path_cnt + 1, &parent_flags, f_vrfy, p_vrfy );
3471 ret = x509parse_verify_top( parent, trust_ca, ca_crl, path_cnt + 1, &parent_flags, f_vrfy, p_vrfy );
3477 if( NULL != f_vrfy )
3478 if( ( ret = f_vrfy( p_vrfy, child, path_cnt, flags ) ) != 0 )
3481 *flags |= parent_flags;
3492 const char *cn,
int *flags,
3493 int (*f_vrfy)(
void *,
x509_cert *,
int,
int *),
3508 cn_len = strlen( cn );
3514 while( cur != NULL )
3516 if( cur->
buf.
len == cn_len &&
3517 x509_name_cmp( cn, cur->
buf.
p, cn_len ) == 0 )
3521 memcmp( cur->
buf.
p,
"*.", 2 ) == 0 &&
3522 x509_wildcard_verify( cn, &cur->
buf ) )
3533 while( name != NULL )
3535 if( name->
oid.
len == 3 &&
3538 if( name->
val.
len == cn_len &&
3539 x509_name_cmp( name->
val.
p, cn, cn_len ) == 0 )
3543 memcmp( name->
val.
p,
"*.", 2 ) == 0 &&
3544 x509_wildcard_verify( cn, &name->
val ) )
3562 while( parent != NULL && parent->
version != 0 )
3569 parent = parent->
next;
3575 if( parent != NULL )
3580 ret = x509parse_verify_child( crt, parent, trust_ca, ca_crl, pathlen, flags, f_vrfy, p_vrfy );
3586 ret = x509parse_verify_top( crt, trust_ca, ca_crl, pathlen, flags, f_vrfy, p_vrfy );
3617 while( name_cur != NULL )
3619 name_prv = name_cur;
3620 name_cur = name_cur->
next;
3621 memset( name_prv, 0,
sizeof(
x509_name ) );
3626 while( name_cur != NULL )
3628 name_prv = name_cur;
3629 name_cur = name_cur->
next;
3630 memset( name_prv, 0,
sizeof(
x509_name ) );
3635 while( seq_cur != NULL )
3638 seq_cur = seq_cur->
next;
3644 while( seq_cur != NULL )
3647 seq_cur = seq_cur->
next;
3652 if( cert_cur->
raw.
p != NULL )
3654 memset( cert_cur->
raw.
p, 0, cert_cur->
raw.
len );
3655 free( cert_cur->
raw.
p );
3658 cert_cur = cert_cur->
next;
3660 while( cert_cur != NULL );
3665 cert_prv = cert_cur;
3666 cert_cur = cert_cur->
next;
3668 memset( cert_prv, 0,
sizeof(
x509_cert ) );
3669 if( cert_prv != crt )
3672 while( cert_cur != NULL );
3693 while( name_cur != NULL )
3695 name_prv = name_cur;
3696 name_cur = name_cur->
next;
3697 memset( name_prv, 0,
sizeof(
x509_name ) );
3702 while( entry_cur != NULL )
3704 entry_prv = entry_cur;
3705 entry_cur = entry_cur->
next;
3710 if( crl_cur->
raw.
p != NULL )
3712 memset( crl_cur->
raw.
p, 0, crl_cur->
raw.
len );
3713 free( crl_cur->
raw.
p );
3716 crl_cur = crl_cur->
next;
3718 while( crl_cur != NULL );
3724 crl_cur = crl_cur->
next;
3726 memset( crl_prv, 0,
sizeof(
x509_crl ) );
3727 if( crl_prv != crl )
3730 while( crl_cur != NULL );
3733 #if defined(POLARSSL_SELF_TEST)
3742 #if defined(POLARSSL_CERTS_C) && defined(POLARSSL_MD5_C)
3749 #if defined(POLARSSL_DHM_C)
3754 printf(
" X.509 certificate load: " );
3756 memset( &clicert, 0,
sizeof(
x509_cert ) );
3758 ret =
x509parse_crt( &clicert, (
const unsigned char *) test_cli_crt,
3759 strlen( test_cli_crt ) );
3763 printf(
"failed\n" );
3768 memset( &cacert, 0,
sizeof(
x509_cert ) );
3770 ret =
x509parse_crt( &cacert, (
const unsigned char *) test_ca_crt,
3771 strlen( test_ca_crt ) );
3775 printf(
"failed\n" );
3781 printf(
"passed\n X.509 private key load: " );
3783 i = strlen( test_ca_key );
3784 j = strlen( test_ca_pwd );
3789 (
const unsigned char *) test_ca_key, i,
3790 (
const unsigned char *) test_ca_pwd, j ) ) != 0 )
3793 printf(
"failed\n" );
3799 printf(
"passed\n X.509 signature verify: ");
3801 ret =
x509parse_verify( &clicert, &cacert, NULL,
"PolarSSL Client 2", &flags, NULL, NULL );
3805 printf(
"failed\n" );
3810 #if defined(POLARSSL_DHM_C)
3812 printf(
"passed\n X.509 DHM parameter load: " );
3814 i = strlen( test_dhm_params );
3815 j = strlen( test_ca_pwd );
3817 if( ( ret =
x509parse_dhm( &dhm, (
const unsigned char *) test_dhm_params, i ) ) != 0 )
3820 printf(
"failed\n" );
3826 printf(
"passed\n\n" );
3832 #if defined(POLARSSL_DHM_C)