39 #if defined(POLARSSL_X509_PARSE_C)
45 #if defined(POLARSSL_MD2_C)
48 #if defined(POLARSSL_MD4_C)
51 #if defined(POLARSSL_MD5_C)
54 #if defined(POLARSSL_SHA1_C)
57 #if defined(POLARSSL_SHA2_C)
60 #if defined(POLARSSL_SHA4_C)
64 #if defined(POLARSSL_PKCS5_C)
67 #if defined(POLARSSL_PKCS12_C)
79 #if defined(POLARSSL_FS_IO)
82 #include <sys/types.h>
89 #define OID_CMP(oid_str, oid_buf) \
90 ( ( OID_SIZE(oid_str) == (oid_buf)->len ) && \
91 memcmp( (oid_str), (oid_buf)->p, (oid_buf)->len) == 0)
96 static int x509_get_version(
unsigned char **p,
97 const unsigned char *end,
130 static int x509_crl_get_version(
unsigned char **p,
131 const unsigned char *end,
153 static int x509_get_serial(
unsigned char **p,
154 const unsigned char *end,
159 if( ( end - *p ) < 1 )
168 serial->
tag = *(*p)++;
184 static int x509_get_alg(
unsigned char **p,
185 const unsigned char *end,
229 static int x509_get_attr_type_value(
unsigned char **p,
230 const unsigned char *end,
251 if( ( end - *p ) < 1 )
287 static int x509_get_name(
unsigned char **p,
288 const unsigned char *end,
293 const unsigned char *end2;
306 if( ( ret = x509_get_attr_type_value( p, end, use ) ) != 0 )
314 if( use->
next == NULL )
333 if( cur->
next == NULL )
338 return( x509_get_name( p, end2, cur->
next ) );
346 static int x509_get_time(
unsigned char **p,
347 const unsigned char *end,
355 if( ( end - *p ) < 1 )
369 memset( date, 0,
sizeof( date ) );
370 memcpy( date, *p, ( len <
sizeof( date ) - 1 ) ?
371 len :
sizeof( date ) - 1 );
373 if( sscanf( date,
"%2d%2d%2d%2d%2d%2d",
378 time->
year += 100 * ( time->
year < 50 );
393 memset( date, 0,
sizeof( date ) );
394 memcpy( date, *p, ( len <
sizeof( date ) - 1 ) ?
395 len :
sizeof( date ) - 1 );
397 if( sscanf( date,
"%4d%2d%2d%2d%2d%2d",
416 static int x509_get_dates(
unsigned char **p,
417 const unsigned char *end,
430 if( ( ret = x509_get_time( p, end, from ) ) != 0 )
433 if( ( ret = x509_get_time( p, end, to ) ) != 0 )
448 static int x509_get_pubkey(
unsigned char **p,
449 const unsigned char *end,
457 if( ( ret = x509_get_alg( p, end, pk_alg_oid ) ) != 0 )
463 if( pk_alg_oid->
len != 9 ||
472 if( ( end - *p ) < 1 )
491 if( *p + len != end2 )
506 static int x509_get_sig(
unsigned char **p,
507 const unsigned char *end,
513 if( ( end - *p ) < 1 )
523 if( --len < 1 || *(*p)++ != 0 )
537 static int x509_get_uid(
unsigned char **p,
538 const unsigned char *end,
567 static int x509_get_ext(
unsigned char **p,
568 const unsigned char *end,
598 if( end != *p + len )
608 static int x509_get_crl_ext(
unsigned char **p,
609 const unsigned char *end,
616 if( ( ret = x509_get_ext( p, end, ext, 0) ) != 0 )
643 static int x509_get_crl_entry_ext(
unsigned char **p,
644 const unsigned char *end,
674 if( end != *p + ext->
len )
694 static int x509_get_basic_constraints(
unsigned char **p,
695 const unsigned char *end,
725 if( *ca_istrue != 0 )
732 if( ( ret =
asn1_get_int( p, end, max_pathlen ) ) != 0 )
744 static int x509_get_ns_cert_type(
unsigned char **p,
745 const unsigned char *end,
746 unsigned char *ns_cert_type)
759 *ns_cert_type = *bs.
p;
763 static int x509_get_key_usage(
unsigned char **p,
764 const unsigned char *end,
765 unsigned char *key_usage)
787 static int x509_get_ext_key_usage(
unsigned char **p,
788 const unsigned char *end,
797 if( ext_key_usage->
buf.
p == NULL )
830 static int x509_get_subject_alt_name(
unsigned char **p,
831 const unsigned char *end,
845 if( *p + len != end )
851 if( ( end - *p ) < 1 )
864 if( tag != ( ASN1_CONTEXT_SPECIFIC | 2 ) )
882 if( cur->
next == NULL )
908 static int x509_get_crt_ext(
unsigned char **p,
909 const unsigned char *end,
914 unsigned char *end_ext_data, *end_ext_octet;
916 if( ( ret = x509_get_ext( p, end, &crt->
v3_ext, 3 ) ) != 0 )
939 end_ext_data = *p + len;
950 if( ( end - *p ) < 1 )
955 if( ( ret =
asn1_get_bool( p, end_ext_data, &is_critical ) ) != 0 &&
964 end_ext_octet = *p + len;
966 if( end_ext_octet != end_ext_data )
977 if( ( ret = x509_get_basic_constraints( p, end_ext_octet,
986 if( ( ret = x509_get_ns_cert_type( p, end_ext_octet,
995 if( ( ret = x509_get_key_usage( p, end_ext_octet,
1004 if( ( ret = x509_get_ext_key_usage( p, end_ext_octet,
1013 if( ( ret = x509_get_subject_alt_name( p, end_ext_octet,
1023 #if !defined(POLARSSL_X509_ALLOW_UNSUPPORTED_CRITICAL_EXTENSION)
1044 static int x509_get_entries(
unsigned char **p,
1045 const unsigned char *end,
1064 end = *p + entry_len;
1069 const unsigned char *end2;
1077 cur_entry->
raw.
tag = **p;
1078 cur_entry->
raw.
p = *p;
1079 cur_entry->
raw.
len = len2;
1082 if( ( ret = x509_get_serial( p, end2, &cur_entry->
serial ) ) != 0 )
1085 if( ( ret = x509_get_time( p, end2, &cur_entry->
revocation_date ) ) != 0 )
1088 if( ( ret = x509_get_crl_entry_ext( p, end2, &cur_entry->
entry_ext ) ) != 0 )
1095 if( cur_entry->
next == NULL )
1098 cur_entry = cur_entry->
next;
1108 if( sig_oid->
len == 9 &&
1111 if( sig_oid->
p[8] >= 2 && sig_oid->
p[8] <= 5 )
1113 *sig_alg = sig_oid->
p[8];
1117 if ( sig_oid->
p[8] >= 11 && sig_oid->
p[8] <= 14 )
1119 *sig_alg = sig_oid->
p[8];
1125 if( sig_oid->
len == 5 &&
1138 int x509parse_crt_der_core(
x509_cert *crt,
const unsigned char *buf,
1143 unsigned char *p, *end, *crt_end;
1148 if( crt == NULL || buf == NULL )
1151 p = (
unsigned char *) malloc( len = buflen );
1156 memcpy( p, buf, buflen );
1177 if( len > (
size_t) ( end - p ) )
1207 if( ( ret = x509_get_version( &p, end, &crt->
version ) ) != 0 ||
1208 ( ret = x509_get_serial( &p, end, &crt->
serial ) ) != 0 ||
1209 ( ret = x509_get_alg( &p, end, &crt->
sig_oid1 ) ) != 0 )
1223 if( ( ret = x509_get_sig_alg( &crt->
sig_oid1, &crt->
sig_alg ) ) != 0 )
1241 if( ( ret = x509_get_name( &p, p + len, &crt->
issuer ) ) != 0 )
1255 if( ( ret = x509_get_dates( &p, end, &crt->
valid_from,
1274 if( len && ( ret = x509_get_name( &p, p + len, &crt->
subject ) ) != 0 )
1294 if( ( ret = x509_get_pubkey( &p, p + len, &crt->
pk_oid,
1295 &crt->
rsa.
N, &crt->
rsa.
E ) ) != 0 )
1319 ret = x509_get_uid( &p, end, &crt->
issuer_id, 1 );
1329 ret = x509_get_uid( &p, end, &crt->
subject_id, 2 );
1339 ret = x509_get_crt_ext( &p, end, crt);
1360 if( ( ret = x509_get_alg( &p, end, &crt->
sig_oid2 ) ) != 0 )
1373 if( ( ret = x509_get_sig( &p, end, &crt->
sig ) ) != 0 )
1401 if( crt == NULL || buf == NULL )
1417 if( crt->
next == NULL )
1425 if( ( ret = x509parse_crt_der_core( crt, buf, buflen ) ) != 0 )
1444 int ret, success = 0, first_error = 0, total_failed = 0;
1450 if( chain == NULL || buf == NULL )
1457 #if defined(POLARSSL_PEM_C)
1458 if( strstr( (
const char *) buf,
"-----BEGIN CERTIFICATE-----" ) != NULL )
1465 #if defined(POLARSSL_PEM_C)
1476 "-----BEGIN CERTIFICATE-----",
1477 "-----END CERTIFICATE-----",
1478 buf, NULL, 0, &use_len );
1502 if( first_error == 0 )
1522 if( first_error == 0 )
1535 return( total_failed );
1536 else if( first_error )
1537 return( first_error );
1549 unsigned char *p, *end;
1551 #if defined(POLARSSL_PEM_C)
1561 if( crl == NULL || buf == NULL )
1574 if( crl->
next == NULL )
1581 memset( crl, 0,
sizeof(
x509_crl ) );
1584 #if defined(POLARSSL_PEM_C)
1587 "-----BEGIN X509 CRL-----",
1588 "-----END X509 CRL-----",
1589 buf, NULL, 0, &use_len );
1617 p = (
unsigned char *) malloc( len = buflen );
1622 memcpy( p, buf, buflen );
1627 p = (
unsigned char *) malloc( len = buflen );
1632 memcpy( p, buf, buflen );
1654 if( len != (
size_t) ( end - p ) )
1682 if( ( ret = x509_crl_get_version( &p, end, &crl->
version ) ) != 0 ||
1683 ( ret = x509_get_alg( &p, end, &crl->
sig_oid1 ) ) != 0 )
1697 if( ( ret = x509_get_sig_alg( &crl->
sig_oid1, &crl->
sig_alg ) ) != 0 )
1715 if( ( ret = x509_get_name( &p, p + len, &crl->
issuer ) ) != 0 )
1727 if( ( ret = x509_get_time( &p, end, &crl->
this_update ) ) != 0 )
1733 if( ( ret = x509_get_time( &p, end, &crl->
next_update ) ) != 0 )
1753 if( ( ret = x509_get_entries( &p, end, &crl->
entry ) ) != 0 )
1765 ret = x509_get_crl_ext( &p, end, &crl->
crl_ext );
1787 if( ( ret = x509_get_alg( &p, end, &crl->
sig_oid2 ) ) != 0 )
1800 if( ( ret = x509_get_sig( &p, end, &crl->
sig ) ) != 0 )
1817 if( crl->
next == NULL )
1824 memset( crl, 0,
sizeof(
x509_crl ) );
1832 #if defined(POLARSSL_FS_IO)
1836 int load_file(
const char *path,
unsigned char **buf,
size_t *n )
1840 if( ( f = fopen( path,
"rb" ) ) == NULL )
1843 fseek( f, 0, SEEK_END );
1844 *n = (size_t) ftell( f );
1845 fseek( f, 0, SEEK_SET );
1847 if( ( *buf = (
unsigned char *) malloc( *n + 1 ) ) == NULL )
1850 if( fread( *buf, 1, *n, f ) != *n )
1873 if ( (ret = load_file( path, &buf, &n ) ) != 0 )
1878 memset( buf, 0, n + 1 );
1889 WCHAR szDir[MAX_PATH];
1890 char filename[MAX_PATH];
1892 int len = strlen( path );
1894 WIN32_FIND_DATAW file_data;
1897 if( len > MAX_PATH - 3 )
1900 memset( szDir, 0,
sizeof(szDir) );
1901 memset( filename, 0, MAX_PATH );
1902 memcpy( filename, path, len );
1903 filename[len++] =
'\\';
1905 filename[len++] =
'*';
1907 w_ret = MultiByteToWideChar( CP_ACP, 0, path, len, szDir, MAX_PATH - 3 );
1909 hFind = FindFirstFileW( szDir, &file_data );
1910 if (hFind == INVALID_HANDLE_VALUE)
1913 len = MAX_PATH - len;
1916 memset( p, 0, len );
1918 if( file_data.dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY )
1921 w_ret = WideCharToMultiByte( CP_ACP, 0, file_data.cFileName,
1922 lstrlenW(file_data.cFileName),
1932 while( FindNextFileW( hFind, &file_data ) != 0 );
1934 if (GetLastError() != ERROR_NO_MORE_FILES)
1942 struct dirent entry, *result = NULL;
1943 char entry_name[255];
1944 DIR *dir = opendir( path );
1949 while( ( t_ret = readdir_r( dir, &entry, &result ) ) == 0 )
1951 if( result == NULL )
1954 snprintf( entry_name,
sizeof(entry_name),
"%s/%s", path, entry.d_name );
1956 i = stat( entry_name, &sb );
1961 if( !S_ISREG( sb.st_mode ) )
1987 if ( (ret = load_file( path, &buf, &n ) ) != 0 )
1992 memset( buf, 0, n + 1 );
2007 if ( (ret = load_file( path, &buf, &n ) ) != 0 )
2014 (
unsigned char *) pwd, strlen( pwd ) );
2016 memset( buf, 0, n + 1 );
2031 if ( (ret = load_file( path, &buf, &n ) ) != 0 )
2036 memset( buf, 0, n + 1 );
2046 static int x509parse_key_pkcs1_der(
rsa_context *rsa,
2047 const unsigned char *key,
2052 unsigned char *p, *end;
2054 p = (
unsigned char *) key;
2125 static int x509parse_key_pkcs8_unencrypted_der(
2127 const unsigned char *key,
2132 unsigned char *p, *end;
2135 p = (
unsigned char *) key;
2172 if( ( ret = x509_get_alg( &p, end, &pk_alg_oid ) ) != 0 )
2180 if( pk_alg_oid.
len != 9 ||
2192 if( ( end - p ) < 1 )
2200 if( ( ret = x509parse_key_pkcs1_der( rsa, p, end - p ) ) != 0 )
2209 static int x509parse_key_pkcs8_encrypted_der(
2211 const unsigned char *key,
2213 const unsigned char *pwd,
2218 unsigned char *p, *end, *end2;
2220 unsigned char buf[2048];
2222 memset(buf, 0, 2048);
2224 p = (
unsigned char *) key;
2264 p += pbe_alg_oid.
len;
2270 pbe_params.
len = end2 - p;
2271 p += pbe_params.
len;
2283 #if defined(POLARSSL_PKCS12_C)
2288 pwd, pwdlen, p, len, buf ) ) != 0 )
2300 pwd, pwdlen, p, len, buf ) ) != 0 )
2313 p, len, buf ) ) != 0 )
2326 #if defined(POLARSSL_PKCS5_C)
2330 p, len, buf ) ) != 0 )
2342 return x509parse_key_pkcs8_unencrypted_der( rsa, buf, len );
2349 const unsigned char *pwd,
size_t pwdlen )
2353 #if defined(POLARSSL_PEM_C)
2359 "-----BEGIN RSA PRIVATE KEY-----",
2360 "-----END RSA PRIVATE KEY-----",
2361 key, pwd, pwdlen, &len );
2364 if( ( ret = x509parse_key_pkcs1_der( rsa, pem.
buf, pem.
buflen ) ) != 0 )
2380 "-----BEGIN PRIVATE KEY-----",
2381 "-----END PRIVATE KEY-----",
2382 key, NULL, 0, &len );
2385 if( ( ret = x509parse_key_pkcs8_unencrypted_der( rsa,
2398 "-----BEGIN ENCRYPTED PRIVATE KEY-----",
2399 "-----END ENCRYPTED PRIVATE KEY-----",
2400 key, NULL, 0, &len );
2403 if( ( ret = x509parse_key_pkcs8_encrypted_der( rsa,
2405 pwd, pwdlen ) ) != 0 )
2426 if( ( ret = x509parse_key_pkcs8_encrypted_der( rsa, key, keylen,
2427 pwd, pwdlen ) ) == 0 )
2439 if( ( ret = x509parse_key_pkcs8_unencrypted_der( rsa, key, keylen ) ) == 0 )
2444 if( ( ret = x509parse_key_pkcs1_der( rsa, key, keylen ) ) == 0 )
2459 unsigned char *p, *end;
2461 #if defined(POLARSSL_PEM_C)
2466 "-----BEGIN PUBLIC KEY-----",
2467 "-----END PUBLIC KEY-----",
2468 key, NULL, 0, &len );
2483 p = ( ret == 0 ) ? pem.
buf : (
unsigned char *) key;
2485 p = (
unsigned char *) key;
2509 #if defined(POLARSSL_PEM_C)
2516 if( ( ret = x509_get_pubkey( &p, end, &alg_oid, &rsa->
N, &rsa->
E ) ) != 0 )
2518 #if defined(POLARSSL_PEM_C)
2527 #if defined(POLARSSL_PEM_C)
2536 #if defined(POLARSSL_PEM_C)
2543 #if defined(POLARSSL_DHM_C)
2551 unsigned char *p, *end;
2552 #if defined(POLARSSL_PEM_C)
2558 "-----BEGIN DH PARAMETERS-----",
2559 "-----END DH PARAMETERS-----",
2560 dhmin, NULL, 0, &dhminlen );
2575 p = ( ret == 0 ) ? pem.
buf : (
unsigned char *) dhmin;
2577 p = (
unsigned char *) dhmin;
2592 #if defined(POLARSSL_PEM_C)
2603 #if defined(POLARSSL_PEM_C)
2612 #if defined(POLARSSL_PEM_C)
2620 #if defined(POLARSSL_PEM_C)
2627 #if defined(POLARSSL_FS_IO)
2637 if ( ( ret = load_file( path, &buf, &n ) ) != 0 )
2642 memset( buf, 0, n + 1 );
2650 #if defined _MSC_VER && !defined snprintf
2653 #if !defined vsnprintf
2654 #define vsnprintf _vsnprintf
2664 int compat_snprintf(
char *str,
size_t size,
const char *format, ...)
2669 va_start( ap, format );
2671 res = vsnprintf( str, size, format, ap );
2677 return( (
int) size + 20 );
2682 #define snprintf compat_snprintf
2685 #define POLARSSL_ERR_DEBUG_BUF_TOO_SMALL -2
2687 #define SAFE_SNPRINTF() \
2692 if ( (unsigned int) ret > n ) { \
2694 return POLARSSL_ERR_DEBUG_BUF_TOO_SMALL;\
2697 n -= (unsigned int) ret; \
2698 p += (unsigned int) ret; \
2713 memset( s, 0,
sizeof( s ) );
2719 while( name != NULL )
2729 ret = snprintf( p, n,
", " );
2733 if( name->
oid.
len == 3 &&
2736 switch( name->
oid.
p[2] )
2739 ret = snprintf( p, n,
"CN=" );
break;
2742 ret = snprintf( p, n,
"C=" );
break;
2745 ret = snprintf( p, n,
"L=" );
break;
2748 ret = snprintf( p, n,
"ST=" );
break;
2751 ret = snprintf( p, n,
"O=" );
break;
2754 ret = snprintf( p, n,
"OU=" );
break;
2757 ret = snprintf( p, n,
"0x%02X=",
2763 else if( name->
oid.
len == 9 &&
2766 switch( name->
oid.
p[8] )
2769 ret = snprintf( p, n,
"emailAddress=" );
break;
2772 ret = snprintf( p, n,
"0x%02X=",
2780 ret = snprintf( p, n,
"\?\?=" );
2784 for( i = 0; i < name->
val.
len; i++ )
2786 if( i >=
sizeof( s ) - 1 )
2790 if( c < 32 || c == 127 || ( c > 128 && c < 160 ) )
2795 ret = snprintf( p, n,
"%s", s );
2800 return( (
int) ( size - n ) );
2816 nr = ( serial->
len <= 32 )
2819 for( i = 0; i < nr; i++ )
2821 if( i == 0 && nr > 1 && serial->
p[i] == 0x0 )
2824 ret = snprintf( p, n,
"%02X%s",
2825 serial->
p[i], ( i < nr - 1 ) ?
":" :
"" );
2829 if( nr != serial->
len )
2831 ret = snprintf( p, n,
"...." );
2835 return( (
int) ( size - n ) );
2851 ret = snprintf( p, n,
"%scert. version : %d\n",
2854 ret = snprintf( p, n,
"%sserial number : ",
2861 ret = snprintf( p, n,
"\n%sissuer name : ", prefix );
2866 ret = snprintf( p, n,
"\n%ssubject name : ", prefix );
2871 ret = snprintf( p, n,
"\n%sissued on : " \
2872 "%04d-%02d-%02d %02d:%02d:%02d", prefix,
2878 ret = snprintf( p, n,
"\n%sexpires on : " \
2879 "%04d-%02d-%02d %02d:%02d:%02d", prefix,
2885 ret = snprintf( p, n,
"\n%ssigned using : RSA+", prefix );
2890 case SIG_RSA_MD2 : ret = snprintf( p, n,
"MD2" );
break;
2891 case SIG_RSA_MD4 : ret = snprintf( p, n,
"MD4" );
break;
2892 case SIG_RSA_MD5 : ret = snprintf( p, n,
"MD5" );
break;
2893 case SIG_RSA_SHA1 : ret = snprintf( p, n,
"SHA1" );
break;
2898 default: ret = snprintf( p, n,
"???" );
break;
2902 ret = snprintf( p, n,
"\n%sRSA key size : %d bits\n", prefix,
2903 (
int) crt->
rsa.
N.
n * (
int)
sizeof(
t_uint ) * 8 );
2906 return( (
int) ( size - n ) );
2952 ret = snprintf( p, n,
"%d.%d", oid->
p[0]/40, oid->
p[0]%40 );
2958 for( i = 1; i < oid->
len; i++ )
2961 value += oid->
p[i] & 0x7F;
2963 if( !( oid->
p[i] & 0x80 ) )
2966 ret = snprintf( p, n,
".%d", value );
2972 return( (
int) ( size - n ) );
2989 ret = snprintf( p, n,
"%sCRL version : %d",
2993 ret = snprintf( p, n,
"\n%sissuer name : ", prefix );
2998 ret = snprintf( p, n,
"\n%sthis update : " \
2999 "%04d-%02d-%02d %02d:%02d:%02d", prefix,
3005 ret = snprintf( p, n,
"\n%snext update : " \
3006 "%04d-%02d-%02d %02d:%02d:%02d", prefix,
3012 entry = &crl->
entry;
3014 ret = snprintf( p, n,
"\n%sRevoked certificates:",
3018 while( entry != NULL && entry->
raw.
len != 0 )
3020 ret = snprintf( p, n,
"\n%sserial number: ",
3027 ret = snprintf( p, n,
" revocation date: " \
3028 "%04d-%02d-%02d %02d:%02d:%02d",
3034 entry = entry->
next;
3037 ret = snprintf( p, n,
"\n%ssigned using : RSA+", prefix );
3042 case SIG_RSA_MD2 : ret = snprintf( p, n,
"MD2" );
break;
3043 case SIG_RSA_MD4 : ret = snprintf( p, n,
"MD4" );
break;
3044 case SIG_RSA_MD5 : ret = snprintf( p, n,
"MD5" );
break;
3045 case SIG_RSA_SHA1 : ret = snprintf( p, n,
"SHA1" );
break;
3050 default: ret = snprintf( p, n,
"???" );
break;
3054 ret = snprintf( p, n,
"\n" );
3057 return( (
int) ( size - n ) );
3084 lt = localtime( &tt );
3086 year = lt->tm_year + 1900;
3087 mon = lt->tm_mon + 1;
3094 if( year > to->
year )
3097 if( year == to->
year &&
3101 if( year == to->
year &&
3106 if( year == to->
year &&
3112 if( year == to->
year &&
3119 if( year == to->
year &&
3137 while( cur != NULL && cur->
serial.
len != 0 )
3155 static void x509_hash(
const unsigned char *in,
size_t len,
int alg,
3156 unsigned char *out )
3160 #if defined(POLARSSL_MD2_C)
3163 #if defined(POLARSSL_MD4_C)
3166 #if defined(POLARSSL_MD5_C)
3169 #if defined(POLARSSL_SHA1_C)
3172 #if defined(POLARSSL_SHA2_C)
3176 #if defined(POLARSSL_SHA4_C)
3181 memset( out,
'\xFF', 64 );
3194 unsigned char hash[64];
3205 while( crl_list != NULL )
3212 crl_list = crl_list->
next;
3221 x509_hash( crl_list->
tbs.
p, crl_list->
tbs.
len, hash_id, hash );
3224 0, hash, crl_list->
sig.
p ) == 0 )
3248 crl_list = crl_list->
next;
3253 int x509_wildcard_verify(
const char *cn,
x509_buf *name )
3258 if( name->
len < 3 || name->
p[0] !=
'*' || name->
p[1] !=
'.' )
3261 for( i = 0; i < strlen( cn ); ++i )
3273 if( strlen( cn ) - cn_idx == name->
len - 1 &&
3274 memcmp( name->
p + 1, cn + cn_idx, name->
len - 1 ) == 0 )
3282 static int x509parse_verify_top(
3284 x509_crl *ca_crl,
int path_cnt,
int *flags,
3285 int (*f_vrfy)(
void *,
x509_cert *,
int,
int *),
3289 int ca_flags = 0, check_path_cnt = path_cnt + 1;
3290 unsigned char hash[64];
3300 while( trust_ca != NULL )
3307 trust_ca = trust_ca->
next;
3325 trust_ca = trust_ca->
next;
3331 x509_hash( child->
tbs.
p, child->
tbs.
len, hash_id, hash );
3334 0, hash, child->
sig.
p ) != 0 )
3336 trust_ca = trust_ca->
next;
3352 if( trust_ca != NULL &&
3358 *flags |= x509parse_verifycrl( child, trust_ca, ca_crl );
3363 if( NULL != f_vrfy )
3365 if( ( ret = f_vrfy( p_vrfy, trust_ca, path_cnt + 1, &ca_flags ) ) != 0 )
3371 if( NULL != f_vrfy )
3373 if( ( ret = f_vrfy(p_vrfy, child, path_cnt, flags ) ) != 0 )
3382 static int x509parse_verify_child(
3384 x509_crl *ca_crl,
int path_cnt,
int *flags,
3385 int (*f_vrfy)(
void *,
x509_cert *,
int,
int *),
3389 int parent_flags = 0;
3390 unsigned char hash[64];
3398 x509_hash( child->
tbs.
p, child->
tbs.
len, hash_id, hash );
3401 child->
sig.
p ) != 0 )
3405 *flags |= x509parse_verifycrl(child, parent, ca_crl);
3407 grandparent = parent->
next;
3409 while( grandparent != NULL )
3411 if( grandparent->
version == 0 ||
3417 grandparent = grandparent->
next;
3423 if( grandparent != NULL )
3428 ret = x509parse_verify_child( parent, grandparent, trust_ca, ca_crl, path_cnt + 1, &parent_flags, f_vrfy, p_vrfy );
3434 ret = x509parse_verify_top( parent, trust_ca, ca_crl, path_cnt + 1, &parent_flags, f_vrfy, p_vrfy );
3440 if( NULL != f_vrfy )
3441 if( ( ret = f_vrfy( p_vrfy, child, path_cnt, flags ) ) != 0 )
3444 *flags |= parent_flags;
3455 const char *cn,
int *flags,
3456 int (*f_vrfy)(
void *,
x509_cert *,
int,
int *),
3471 cn_len = strlen( cn );
3477 while( cur != NULL )
3479 if( cur->
buf.
len == cn_len &&
3480 memcmp( cn, cur->
buf.
p, cn_len ) == 0 )
3484 memcmp( cur->
buf.
p,
"*.", 2 ) == 0 &&
3485 x509_wildcard_verify( cn, &cur->
buf ) )
3496 while( name != NULL )
3498 if( name->
oid.
len == 3 &&
3501 if( name->
val.
len == cn_len &&
3502 memcmp( name->
val.
p, cn, cn_len ) == 0 )
3506 memcmp( name->
val.
p,
"*.", 2 ) == 0 &&
3507 x509_wildcard_verify( cn, &name->
val ) )
3525 while( parent != NULL && parent->
version != 0 )
3532 parent = parent->
next;
3538 if( parent != NULL )
3543 ret = x509parse_verify_child( crt, parent, trust_ca, ca_crl, pathlen, flags, f_vrfy, p_vrfy );
3549 ret = x509parse_verify_top( crt, trust_ca, ca_crl, pathlen, flags, f_vrfy, p_vrfy );
3580 while( name_cur != NULL )
3582 name_prv = name_cur;
3583 name_cur = name_cur->
next;
3584 memset( name_prv, 0,
sizeof(
x509_name ) );
3589 while( name_cur != NULL )
3591 name_prv = name_cur;
3592 name_cur = name_cur->
next;
3593 memset( name_prv, 0,
sizeof(
x509_name ) );
3598 while( seq_cur != NULL )
3601 seq_cur = seq_cur->
next;
3607 while( seq_cur != NULL )
3610 seq_cur = seq_cur->
next;
3615 if( cert_cur->
raw.
p != NULL )
3617 memset( cert_cur->
raw.
p, 0, cert_cur->
raw.
len );
3618 free( cert_cur->
raw.
p );
3621 cert_cur = cert_cur->
next;
3623 while( cert_cur != NULL );
3628 cert_prv = cert_cur;
3629 cert_cur = cert_cur->
next;
3631 memset( cert_prv, 0,
sizeof(
x509_cert ) );
3632 if( cert_prv != crt )
3635 while( cert_cur != NULL );
3656 while( name_cur != NULL )
3658 name_prv = name_cur;
3659 name_cur = name_cur->
next;
3660 memset( name_prv, 0,
sizeof(
x509_name ) );
3665 while( entry_cur != NULL )
3667 entry_prv = entry_cur;
3668 entry_cur = entry_cur->
next;
3673 if( crl_cur->
raw.
p != NULL )
3675 memset( crl_cur->
raw.
p, 0, crl_cur->
raw.
len );
3676 free( crl_cur->
raw.
p );
3679 crl_cur = crl_cur->
next;
3681 while( crl_cur != NULL );
3687 crl_cur = crl_cur->
next;
3689 memset( crl_prv, 0,
sizeof(
x509_crl ) );
3690 if( crl_prv != crl )
3693 while( crl_cur != NULL );
3696 #if defined(POLARSSL_SELF_TEST)
3705 #if defined(POLARSSL_CERTS_C) && defined(POLARSSL_MD5_C)
3712 #if defined(POLARSSL_DHM_C)
3717 printf(
" X.509 certificate load: " );
3719 memset( &clicert, 0,
sizeof(
x509_cert ) );
3721 ret =
x509parse_crt( &clicert, (
const unsigned char *) test_cli_crt,
3722 strlen( test_cli_crt ) );
3726 printf(
"failed\n" );
3731 memset( &cacert, 0,
sizeof(
x509_cert ) );
3733 ret =
x509parse_crt( &cacert, (
const unsigned char *) test_ca_crt,
3734 strlen( test_ca_crt ) );
3738 printf(
"failed\n" );
3744 printf(
"passed\n X.509 private key load: " );
3746 i = strlen( test_ca_key );
3747 j = strlen( test_ca_pwd );
3752 (
const unsigned char *) test_ca_key, i,
3753 (
const unsigned char *) test_ca_pwd, j ) ) != 0 )
3756 printf(
"failed\n" );
3762 printf(
"passed\n X.509 signature verify: ");
3764 ret =
x509parse_verify( &clicert, &cacert, NULL,
"PolarSSL Client 2", &flags, NULL, NULL );
3767 printf(
"%02x", flags);
3769 printf(
"failed\n" );
3774 #if defined(POLARSSL_DHM_C)
3776 printf(
"passed\n X.509 DHM parameter load: " );
3778 i = strlen( test_dhm_params );
3779 j = strlen( test_ca_pwd );
3781 if( ( ret =
x509parse_dhm( &dhm, (
const unsigned char *) test_dhm_params, i ) ) != 0 )
3784 printf(
"failed\n" );
3790 printf(
"passed\n\n" );
3796 #if defined(POLARSSL_DHM_C)