Arcola / mbedtls

mbed TLS upgraded to 2.6.0

Fork of mbedtls by Mark Radbourne

library/x509.c@0:cdf462088d13, 2017-01-05 (annotated)

Committer:
markrad
Date:
Thu Jan 05 00:18:44 2017 +0000
Revision:
0:cdf462088d13
Child:
1:9ebc941037d5
Initial commit

Who changed what in which revision?

UserRevisionLine numberNew contents of line
markrad 0:cdf462088d13 1 /*
markrad 0:cdf462088d13 2 * X.509 common functions for parsing and verification
markrad 0:cdf462088d13 3 *
markrad 0:cdf462088d13 4 * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
markrad 0:cdf462088d13 5 * SPDX-License-Identifier: Apache-2.0
markrad 0:cdf462088d13 6 *
markrad 0:cdf462088d13 7 * Licensed under the Apache License, Version 2.0 (the "License"); you may
markrad 0:cdf462088d13 8 * not use this file except in compliance with the License.
markrad 0:cdf462088d13 9 * You may obtain a copy of the License at
markrad 0:cdf462088d13 10 *
markrad 0:cdf462088d13 11 * http://www.apache.org/licenses/LICENSE-2.0
markrad 0:cdf462088d13 12 *
markrad 0:cdf462088d13 13 * Unless required by applicable law or agreed to in writing, software
markrad 0:cdf462088d13 14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
markrad 0:cdf462088d13 15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
markrad 0:cdf462088d13 16 * See the License for the specific language governing permissions and
markrad 0:cdf462088d13 17 * limitations under the License.
markrad 0:cdf462088d13 18 *
markrad 0:cdf462088d13 19 * This file is part of mbed TLS (https://tls.mbed.org)
markrad 0:cdf462088d13 20 */
markrad 0:cdf462088d13 21 /*
markrad 0:cdf462088d13 22 * The ITU-T X.509 standard defines a certificate format for PKI.
markrad 0:cdf462088d13 23 *
markrad 0:cdf462088d13 24 * http://www.ietf.org/rfc/rfc5280.txt (Certificates and CRLs)
markrad 0:cdf462088d13 25 * http://www.ietf.org/rfc/rfc3279.txt (Alg IDs for CRLs)
markrad 0:cdf462088d13 26 * http://www.ietf.org/rfc/rfc2986.txt (CSRs, aka PKCS#10)
markrad 0:cdf462088d13 27 *
markrad 0:cdf462088d13 28 * http://www.itu.int/ITU-T/studygroups/com17/languages/X.680-0207.pdf
markrad 0:cdf462088d13 29 * http://www.itu.int/ITU-T/studygroups/com17/languages/X.690-0207.pdf
markrad 0:cdf462088d13 30 */
markrad 0:cdf462088d13 31
markrad 0:cdf462088d13 32 #if !defined(MBEDTLS_CONFIG_FILE)
markrad 0:cdf462088d13 33 #include "mbedtls/config.h"
markrad 0:cdf462088d13 34 #else
markrad 0:cdf462088d13 35 #include MBEDTLS_CONFIG_FILE
markrad 0:cdf462088d13 36 #endif
markrad 0:cdf462088d13 37
markrad 0:cdf462088d13 38 #if defined(MBEDTLS_X509_USE_C)
markrad 0:cdf462088d13 39
markrad 0:cdf462088d13 40 #include "mbedtls/x509.h"
markrad 0:cdf462088d13 41 #include "mbedtls/asn1.h"
markrad 0:cdf462088d13 42 #include "mbedtls/oid.h"
markrad 0:cdf462088d13 43
markrad 0:cdf462088d13 44 #include <stdio.h>
markrad 0:cdf462088d13 45 #include <string.h>
markrad 0:cdf462088d13 46
markrad 0:cdf462088d13 47 #if defined(MBEDTLS_PEM_PARSE_C)
markrad 0:cdf462088d13 48 #include "mbedtls/pem.h"
markrad 0:cdf462088d13 49 #endif
markrad 0:cdf462088d13 50
markrad 0:cdf462088d13 51 #if defined(MBEDTLS_PLATFORM_C)
markrad 0:cdf462088d13 52 #include "mbedtls/platform.h"
markrad 0:cdf462088d13 53 #else
markrad 0:cdf462088d13 54 #include <stdio.h>
markrad 0:cdf462088d13 55 #include <stdlib.h>
markrad 0:cdf462088d13 56 #define mbedtls_free free
markrad 0:cdf462088d13 57 #define mbedtls_calloc calloc
markrad 0:cdf462088d13 58 #define mbedtls_printf printf
markrad 0:cdf462088d13 59 #define mbedtls_snprintf snprintf
markrad 0:cdf462088d13 60 #endif
markrad 0:cdf462088d13 61
markrad 0:cdf462088d13 62
markrad 0:cdf462088d13 63 #if defined(MBEDTLS_HAVE_TIME)
markrad 0:cdf462088d13 64 #include "mbedtls/platform_time.h"
markrad 0:cdf462088d13 65 #endif
markrad 0:cdf462088d13 66
markrad 0:cdf462088d13 67 #if defined(_WIN32) && !defined(EFIX64) && !defined(EFI32)
markrad 0:cdf462088d13 68 #include <windows.h>
markrad 0:cdf462088d13 69 #else
markrad 0:cdf462088d13 70 #include <time.h>
markrad 0:cdf462088d13 71 #endif
markrad 0:cdf462088d13 72
markrad 0:cdf462088d13 73 #if defined(MBEDTLS_FS_IO)
markrad 0:cdf462088d13 74 #include <stdio.h>
markrad 0:cdf462088d13 75 #if !defined(_WIN32)
markrad 0:cdf462088d13 76 #include <sys/types.h>
markrad 0:cdf462088d13 77 #include <sys/stat.h>
markrad 0:cdf462088d13 78 #include <dirent.h>
markrad 0:cdf462088d13 79 #endif
markrad 0:cdf462088d13 80 #endif
markrad 0:cdf462088d13 81
markrad 0:cdf462088d13 82 #define CHECK(code) if( ( ret = code ) != 0 ){ return( ret ); }
markrad 0:cdf462088d13 83 #define CHECK_RANGE(min, max, val) if( val < min || val > max ){ return( ret ); }
markrad 0:cdf462088d13 84
markrad 0:cdf462088d13 85 /*
markrad 0:cdf462088d13 86 * CertificateSerialNumber ::= INTEGER
markrad 0:cdf462088d13 87 */
markrad 0:cdf462088d13 88 int mbedtls_x509_get_serial( unsigned char **p, const unsigned char *end,
markrad 0:cdf462088d13 89 mbedtls_x509_buf *serial )
markrad 0:cdf462088d13 90 {
markrad 0:cdf462088d13 91 int ret;
markrad 0:cdf462088d13 92
markrad 0:cdf462088d13 93 if( ( end - *p ) < 1 )
markrad 0:cdf462088d13 94 return( MBEDTLS_ERR_X509_INVALID_SERIAL +
markrad 0:cdf462088d13 95 MBEDTLS_ERR_ASN1_OUT_OF_DATA );
markrad 0:cdf462088d13 96
markrad 0:cdf462088d13 97 if( **p != ( MBEDTLS_ASN1_CONTEXT_SPECIFIC | MBEDTLS_ASN1_PRIMITIVE | 2 ) &&
markrad 0:cdf462088d13 98 **p != MBEDTLS_ASN1_INTEGER )
markrad 0:cdf462088d13 99 return( MBEDTLS_ERR_X509_INVALID_SERIAL +
markrad 0:cdf462088d13 100 MBEDTLS_ERR_ASN1_UNEXPECTED_TAG );
markrad 0:cdf462088d13 101
markrad 0:cdf462088d13 102 serial->tag = *(*p)++;
markrad 0:cdf462088d13 103
markrad 0:cdf462088d13 104 if( ( ret = mbedtls_asn1_get_len( p, end, &serial->len ) ) != 0 )
markrad 0:cdf462088d13 105 return( MBEDTLS_ERR_X509_INVALID_SERIAL + ret );
markrad 0:cdf462088d13 106
markrad 0:cdf462088d13 107 serial->p = *p;
markrad 0:cdf462088d13 108 *p += serial->len;
markrad 0:cdf462088d13 109
markrad 0:cdf462088d13 110 return( 0 );
markrad 0:cdf462088d13 111 }
markrad 0:cdf462088d13 112
markrad 0:cdf462088d13 113 /* Get an algorithm identifier without parameters (eg for signatures)
markrad 0:cdf462088d13 114 *
markrad 0:cdf462088d13 115 * AlgorithmIdentifier ::= SEQUENCE {
markrad 0:cdf462088d13 116 * algorithm OBJECT IDENTIFIER,
markrad 0:cdf462088d13 117 * parameters ANY DEFINED BY algorithm OPTIONAL }
markrad 0:cdf462088d13 118 */
markrad 0:cdf462088d13 119 int mbedtls_x509_get_alg_null( unsigned char **p, const unsigned char *end,
markrad 0:cdf462088d13 120 mbedtls_x509_buf *alg )
markrad 0:cdf462088d13 121 {
markrad 0:cdf462088d13 122 int ret;
markrad 0:cdf462088d13 123
markrad 0:cdf462088d13 124 if( ( ret = mbedtls_asn1_get_alg_null( p, end, alg ) ) != 0 )
markrad 0:cdf462088d13 125 return( MBEDTLS_ERR_X509_INVALID_ALG + ret );
markrad 0:cdf462088d13 126
markrad 0:cdf462088d13 127 return( 0 );
markrad 0:cdf462088d13 128 }
markrad 0:cdf462088d13 129
markrad 0:cdf462088d13 130 /*
markrad 0:cdf462088d13 131 * Parse an algorithm identifier with (optional) paramaters
markrad 0:cdf462088d13 132 */
markrad 0:cdf462088d13 133 int mbedtls_x509_get_alg( unsigned char **p, const unsigned char *end,
markrad 0:cdf462088d13 134 mbedtls_x509_buf *alg, mbedtls_x509_buf *params )
markrad 0:cdf462088d13 135 {
markrad 0:cdf462088d13 136 int ret;
markrad 0:cdf462088d13 137
markrad 0:cdf462088d13 138 if( ( ret = mbedtls_asn1_get_alg( p, end, alg, params ) ) != 0 )
markrad 0:cdf462088d13 139 return( MBEDTLS_ERR_X509_INVALID_ALG + ret );
markrad 0:cdf462088d13 140
markrad 0:cdf462088d13 141 return( 0 );
markrad 0:cdf462088d13 142 }
markrad 0:cdf462088d13 143
markrad 0:cdf462088d13 144 #if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT)
markrad 0:cdf462088d13 145 /*
markrad 0:cdf462088d13 146 * HashAlgorithm ::= AlgorithmIdentifier
markrad 0:cdf462088d13 147 *
markrad 0:cdf462088d13 148 * AlgorithmIdentifier ::= SEQUENCE {
markrad 0:cdf462088d13 149 * algorithm OBJECT IDENTIFIER,
markrad 0:cdf462088d13 150 * parameters ANY DEFINED BY algorithm OPTIONAL }
markrad 0:cdf462088d13 151 *
markrad 0:cdf462088d13 152 * For HashAlgorithm, parameters MUST be NULL or absent.
markrad 0:cdf462088d13 153 */
markrad 0:cdf462088d13 154 static int x509_get_hash_alg( const mbedtls_x509_buf *alg, mbedtls_md_type_t *md_alg )
markrad 0:cdf462088d13 155 {
markrad 0:cdf462088d13 156 int ret;
markrad 0:cdf462088d13 157 unsigned char *p;
markrad 0:cdf462088d13 158 const unsigned char *end;
markrad 0:cdf462088d13 159 mbedtls_x509_buf md_oid;
markrad 0:cdf462088d13 160 size_t len;
markrad 0:cdf462088d13 161
markrad 0:cdf462088d13 162 /* Make sure we got a SEQUENCE and setup bounds */
markrad 0:cdf462088d13 163 if( alg->tag != ( MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) )
markrad 0:cdf462088d13 164 return( MBEDTLS_ERR_X509_INVALID_ALG +
markrad 0:cdf462088d13 165 MBEDTLS_ERR_ASN1_UNEXPECTED_TAG );
markrad 0:cdf462088d13 166
markrad 0:cdf462088d13 167 p = (unsigned char *) alg->p;
markrad 0:cdf462088d13 168 end = p + alg->len;
markrad 0:cdf462088d13 169
markrad 0:cdf462088d13 170 if( p >= end )
markrad 0:cdf462088d13 171 return( MBEDTLS_ERR_X509_INVALID_ALG +
markrad 0:cdf462088d13 172 MBEDTLS_ERR_ASN1_OUT_OF_DATA );
markrad 0:cdf462088d13 173
markrad 0:cdf462088d13 174 /* Parse md_oid */
markrad 0:cdf462088d13 175 md_oid.tag = *p;
markrad 0:cdf462088d13 176
markrad 0:cdf462088d13 177 if( ( ret = mbedtls_asn1_get_tag( &p, end, &md_oid.len, MBEDTLS_ASN1_OID ) ) != 0 )
markrad 0:cdf462088d13 178 return( MBEDTLS_ERR_X509_INVALID_ALG + ret );
markrad 0:cdf462088d13 179
markrad 0:cdf462088d13 180 md_oid.p = p;
markrad 0:cdf462088d13 181 p += md_oid.len;
markrad 0:cdf462088d13 182
markrad 0:cdf462088d13 183 /* Get md_alg from md_oid */
markrad 0:cdf462088d13 184 if( ( ret = mbedtls_oid_get_md_alg( &md_oid, md_alg ) ) != 0 )
markrad 0:cdf462088d13 185 return( MBEDTLS_ERR_X509_INVALID_ALG + ret );
markrad 0:cdf462088d13 186
markrad 0:cdf462088d13 187 /* Make sure params is absent of NULL */
markrad 0:cdf462088d13 188 if( p == end )
markrad 0:cdf462088d13 189 return( 0 );
markrad 0:cdf462088d13 190
markrad 0:cdf462088d13 191 if( ( ret = mbedtls_asn1_get_tag( &p, end, &len, MBEDTLS_ASN1_NULL ) ) != 0 || len != 0 )
markrad 0:cdf462088d13 192 return( MBEDTLS_ERR_X509_INVALID_ALG + ret );
markrad 0:cdf462088d13 193
markrad 0:cdf462088d13 194 if( p != end )
markrad 0:cdf462088d13 195 return( MBEDTLS_ERR_X509_INVALID_ALG +
markrad 0:cdf462088d13 196 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH );
markrad 0:cdf462088d13 197
markrad 0:cdf462088d13 198 return( 0 );
markrad 0:cdf462088d13 199 }
markrad 0:cdf462088d13 200
markrad 0:cdf462088d13 201 /*
markrad 0:cdf462088d13 202 * RSASSA-PSS-params ::= SEQUENCE {
markrad 0:cdf462088d13 203 * hashAlgorithm [0] HashAlgorithm DEFAULT sha1Identifier,
markrad 0:cdf462088d13 204 * maskGenAlgorithm [1] MaskGenAlgorithm DEFAULT mgf1SHA1Identifier,
markrad 0:cdf462088d13 205 * saltLength [2] INTEGER DEFAULT 20,
markrad 0:cdf462088d13 206 * trailerField [3] INTEGER DEFAULT 1 }
markrad 0:cdf462088d13 207 * -- Note that the tags in this Sequence are explicit.
markrad 0:cdf462088d13 208 *
markrad 0:cdf462088d13 209 * RFC 4055 (which defines use of RSASSA-PSS in PKIX) states that the value
markrad 0:cdf462088d13 210 * of trailerField MUST be 1, and PKCS#1 v2.2 doesn't even define any other
markrad 0:cdf462088d13 211 * option. Enfore this at parsing time.
markrad 0:cdf462088d13 212 */
markrad 0:cdf462088d13 213 int mbedtls_x509_get_rsassa_pss_params( const mbedtls_x509_buf *params,
markrad 0:cdf462088d13 214 mbedtls_md_type_t *md_alg, mbedtls_md_type_t *mgf_md,
markrad 0:cdf462088d13 215 int *salt_len )
markrad 0:cdf462088d13 216 {
markrad 0:cdf462088d13 217 int ret;
markrad 0:cdf462088d13 218 unsigned char *p;
markrad 0:cdf462088d13 219 const unsigned char *end, *end2;
markrad 0:cdf462088d13 220 size_t len;
markrad 0:cdf462088d13 221 mbedtls_x509_buf alg_id, alg_params;
markrad 0:cdf462088d13 222
markrad 0:cdf462088d13 223 /* First set everything to defaults */
markrad 0:cdf462088d13 224 *md_alg = MBEDTLS_MD_SHA1;
markrad 0:cdf462088d13 225 *mgf_md = MBEDTLS_MD_SHA1;
markrad 0:cdf462088d13 226 *salt_len = 20;
markrad 0:cdf462088d13 227
markrad 0:cdf462088d13 228 /* Make sure params is a SEQUENCE and setup bounds */
markrad 0:cdf462088d13 229 if( params->tag != ( MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) )
markrad 0:cdf462088d13 230 return( MBEDTLS_ERR_X509_INVALID_ALG +
markrad 0:cdf462088d13 231 MBEDTLS_ERR_ASN1_UNEXPECTED_TAG );
markrad 0:cdf462088d13 232
markrad 0:cdf462088d13 233 p = (unsigned char *) params->p;
markrad 0:cdf462088d13 234 end = p + params->len;
markrad 0:cdf462088d13 235
markrad 0:cdf462088d13 236 if( p == end )
markrad 0:cdf462088d13 237 return( 0 );
markrad 0:cdf462088d13 238
markrad 0:cdf462088d13 239 /*
markrad 0:cdf462088d13 240 * HashAlgorithm
markrad 0:cdf462088d13 241 */
markrad 0:cdf462088d13 242 if( ( ret = mbedtls_asn1_get_tag( &p, end, &len,
markrad 0:cdf462088d13 243 MBEDTLS_ASN1_CONTEXT_SPECIFIC | MBEDTLS_ASN1_CONSTRUCTED | 0 ) ) == 0 )
markrad 0:cdf462088d13 244 {
markrad 0:cdf462088d13 245 end2 = p + len;
markrad 0:cdf462088d13 246
markrad 0:cdf462088d13 247 /* HashAlgorithm ::= AlgorithmIdentifier (without parameters) */
markrad 0:cdf462088d13 248 if( ( ret = mbedtls_x509_get_alg_null( &p, end2, &alg_id ) ) != 0 )
markrad 0:cdf462088d13 249 return( ret );
markrad 0:cdf462088d13 250
markrad 0:cdf462088d13 251 if( ( ret = mbedtls_oid_get_md_alg( &alg_id, md_alg ) ) != 0 )
markrad 0:cdf462088d13 252 return( MBEDTLS_ERR_X509_INVALID_ALG + ret );
markrad 0:cdf462088d13 253
markrad 0:cdf462088d13 254 if( p != end2 )
markrad 0:cdf462088d13 255 return( MBEDTLS_ERR_X509_INVALID_ALG +
markrad 0:cdf462088d13 256 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH );
markrad 0:cdf462088d13 257 }
markrad 0:cdf462088d13 258 else if( ret != MBEDTLS_ERR_ASN1_UNEXPECTED_TAG )
markrad 0:cdf462088d13 259 return( MBEDTLS_ERR_X509_INVALID_ALG + ret );
markrad 0:cdf462088d13 260
markrad 0:cdf462088d13 261 if( p == end )
markrad 0:cdf462088d13 262 return( 0 );
markrad 0:cdf462088d13 263
markrad 0:cdf462088d13 264 /*
markrad 0:cdf462088d13 265 * MaskGenAlgorithm
markrad 0:cdf462088d13 266 */
markrad 0:cdf462088d13 267 if( ( ret = mbedtls_asn1_get_tag( &p, end, &len,
markrad 0:cdf462088d13 268 MBEDTLS_ASN1_CONTEXT_SPECIFIC | MBEDTLS_ASN1_CONSTRUCTED | 1 ) ) == 0 )
markrad 0:cdf462088d13 269 {
markrad 0:cdf462088d13 270 end2 = p + len;
markrad 0:cdf462088d13 271
markrad 0:cdf462088d13 272 /* MaskGenAlgorithm ::= AlgorithmIdentifier (params = HashAlgorithm) */
markrad 0:cdf462088d13 273 if( ( ret = mbedtls_x509_get_alg( &p, end2, &alg_id, &alg_params ) ) != 0 )
markrad 0:cdf462088d13 274 return( ret );
markrad 0:cdf462088d13 275
markrad 0:cdf462088d13 276 /* Only MFG1 is recognised for now */
markrad 0:cdf462088d13 277 if( MBEDTLS_OID_CMP( MBEDTLS_OID_MGF1, &alg_id ) != 0 )
markrad 0:cdf462088d13 278 return( MBEDTLS_ERR_X509_FEATURE_UNAVAILABLE +
markrad 0:cdf462088d13 279 MBEDTLS_ERR_OID_NOT_FOUND );
markrad 0:cdf462088d13 280
markrad 0:cdf462088d13 281 /* Parse HashAlgorithm */
markrad 0:cdf462088d13 282 if( ( ret = x509_get_hash_alg( &alg_params, mgf_md ) ) != 0 )
markrad 0:cdf462088d13 283 return( ret );
markrad 0:cdf462088d13 284
markrad 0:cdf462088d13 285 if( p != end2 )
markrad 0:cdf462088d13 286 return( MBEDTLS_ERR_X509_INVALID_ALG +
markrad 0:cdf462088d13 287 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH );
markrad 0:cdf462088d13 288 }
markrad 0:cdf462088d13 289 else if( ret != MBEDTLS_ERR_ASN1_UNEXPECTED_TAG )
markrad 0:cdf462088d13 290 return( MBEDTLS_ERR_X509_INVALID_ALG + ret );
markrad 0:cdf462088d13 291
markrad 0:cdf462088d13 292 if( p == end )
markrad 0:cdf462088d13 293 return( 0 );
markrad 0:cdf462088d13 294
markrad 0:cdf462088d13 295 /*
markrad 0:cdf462088d13 296 * salt_len
markrad 0:cdf462088d13 297 */
markrad 0:cdf462088d13 298 if( ( ret = mbedtls_asn1_get_tag( &p, end, &len,
markrad 0:cdf462088d13 299 MBEDTLS_ASN1_CONTEXT_SPECIFIC | MBEDTLS_ASN1_CONSTRUCTED | 2 ) ) == 0 )
markrad 0:cdf462088d13 300 {
markrad 0:cdf462088d13 301 end2 = p + len;
markrad 0:cdf462088d13 302
markrad 0:cdf462088d13 303 if( ( ret = mbedtls_asn1_get_int( &p, end2, salt_len ) ) != 0 )
markrad 0:cdf462088d13 304 return( MBEDTLS_ERR_X509_INVALID_ALG + ret );
markrad 0:cdf462088d13 305
markrad 0:cdf462088d13 306 if( p != end2 )
markrad 0:cdf462088d13 307 return( MBEDTLS_ERR_X509_INVALID_ALG +
markrad 0:cdf462088d13 308 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH );
markrad 0:cdf462088d13 309 }
markrad 0:cdf462088d13 310 else if( ret != MBEDTLS_ERR_ASN1_UNEXPECTED_TAG )
markrad 0:cdf462088d13 311 return( MBEDTLS_ERR_X509_INVALID_ALG + ret );
markrad 0:cdf462088d13 312
markrad 0:cdf462088d13 313 if( p == end )
markrad 0:cdf462088d13 314 return( 0 );
markrad 0:cdf462088d13 315
markrad 0:cdf462088d13 316 /*
markrad 0:cdf462088d13 317 * trailer_field (if present, must be 1)
markrad 0:cdf462088d13 318 */
markrad 0:cdf462088d13 319 if( ( ret = mbedtls_asn1_get_tag( &p, end, &len,
markrad 0:cdf462088d13 320 MBEDTLS_ASN1_CONTEXT_SPECIFIC | MBEDTLS_ASN1_CONSTRUCTED | 3 ) ) == 0 )
markrad 0:cdf462088d13 321 {
markrad 0:cdf462088d13 322 int trailer_field;
markrad 0:cdf462088d13 323
markrad 0:cdf462088d13 324 end2 = p + len;
markrad 0:cdf462088d13 325
markrad 0:cdf462088d13 326 if( ( ret = mbedtls_asn1_get_int( &p, end2, &trailer_field ) ) != 0 )
markrad 0:cdf462088d13 327 return( MBEDTLS_ERR_X509_INVALID_ALG + ret );
markrad 0:cdf462088d13 328
markrad 0:cdf462088d13 329 if( p != end2 )
markrad 0:cdf462088d13 330 return( MBEDTLS_ERR_X509_INVALID_ALG +
markrad 0:cdf462088d13 331 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH );
markrad 0:cdf462088d13 332
markrad 0:cdf462088d13 333 if( trailer_field != 1 )
markrad 0:cdf462088d13 334 return( MBEDTLS_ERR_X509_INVALID_ALG );
markrad 0:cdf462088d13 335 }
markrad 0:cdf462088d13 336 else if( ret != MBEDTLS_ERR_ASN1_UNEXPECTED_TAG )
markrad 0:cdf462088d13 337 return( MBEDTLS_ERR_X509_INVALID_ALG + ret );
markrad 0:cdf462088d13 338
markrad 0:cdf462088d13 339 if( p != end )
markrad 0:cdf462088d13 340 return( MBEDTLS_ERR_X509_INVALID_ALG +
markrad 0:cdf462088d13 341 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH );
markrad 0:cdf462088d13 342
markrad 0:cdf462088d13 343 return( 0 );
markrad 0:cdf462088d13 344 }
markrad 0:cdf462088d13 345 #endif /* MBEDTLS_X509_RSASSA_PSS_SUPPORT */
markrad 0:cdf462088d13 346
markrad 0:cdf462088d13 347 /*
markrad 0:cdf462088d13 348 * AttributeTypeAndValue ::= SEQUENCE {
markrad 0:cdf462088d13 349 * type AttributeType,
markrad 0:cdf462088d13 350 * value AttributeValue }
markrad 0:cdf462088d13 351 *
markrad 0:cdf462088d13 352 * AttributeType ::= OBJECT IDENTIFIER
markrad 0:cdf462088d13 353 *
markrad 0:cdf462088d13 354 * AttributeValue ::= ANY DEFINED BY AttributeType
markrad 0:cdf462088d13 355 */
markrad 0:cdf462088d13 356 static int x509_get_attr_type_value( unsigned char **p,
markrad 0:cdf462088d13 357 const unsigned char *end,
markrad 0:cdf462088d13 358 mbedtls_x509_name *cur )
markrad 0:cdf462088d13 359 {
markrad 0:cdf462088d13 360 int ret;
markrad 0:cdf462088d13 361 size_t len;
markrad 0:cdf462088d13 362 mbedtls_x509_buf *oid;
markrad 0:cdf462088d13 363 mbedtls_x509_buf *val;
markrad 0:cdf462088d13 364
markrad 0:cdf462088d13 365 if( ( ret = mbedtls_asn1_get_tag( p, end, &len,
markrad 0:cdf462088d13 366 MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
markrad 0:cdf462088d13 367 return( MBEDTLS_ERR_X509_INVALID_NAME + ret );
markrad 0:cdf462088d13 368
markrad 0:cdf462088d13 369 if( ( end - *p ) < 1 )
markrad 0:cdf462088d13 370 return( MBEDTLS_ERR_X509_INVALID_NAME +
markrad 0:cdf462088d13 371 MBEDTLS_ERR_ASN1_OUT_OF_DATA );
markrad 0:cdf462088d13 372
markrad 0:cdf462088d13 373 oid = &cur->oid;
markrad 0:cdf462088d13 374 oid->tag = **p;
markrad 0:cdf462088d13 375
markrad 0:cdf462088d13 376 if( ( ret = mbedtls_asn1_get_tag( p, end, &oid->len, MBEDTLS_ASN1_OID ) ) != 0 )
markrad 0:cdf462088d13 377 return( MBEDTLS_ERR_X509_INVALID_NAME + ret );
markrad 0:cdf462088d13 378
markrad 0:cdf462088d13 379 oid->p = *p;
markrad 0:cdf462088d13 380 *p += oid->len;
markrad 0:cdf462088d13 381
markrad 0:cdf462088d13 382 if( ( end - *p ) < 1 )
markrad 0:cdf462088d13 383 return( MBEDTLS_ERR_X509_INVALID_NAME +
markrad 0:cdf462088d13 384 MBEDTLS_ERR_ASN1_OUT_OF_DATA );
markrad 0:cdf462088d13 385
markrad 0:cdf462088d13 386 if( **p != MBEDTLS_ASN1_BMP_STRING && **p != MBEDTLS_ASN1_UTF8_STRING &&
markrad 0:cdf462088d13 387 **p != MBEDTLS_ASN1_T61_STRING && **p != MBEDTLS_ASN1_PRINTABLE_STRING &&
markrad 0:cdf462088d13 388 **p != MBEDTLS_ASN1_IA5_STRING && **p != MBEDTLS_ASN1_UNIVERSAL_STRING &&
markrad 0:cdf462088d13 389 **p != MBEDTLS_ASN1_BIT_STRING )
markrad 0:cdf462088d13 390 return( MBEDTLS_ERR_X509_INVALID_NAME +
markrad 0:cdf462088d13 391 MBEDTLS_ERR_ASN1_UNEXPECTED_TAG );
markrad 0:cdf462088d13 392
markrad 0:cdf462088d13 393 val = &cur->val;
markrad 0:cdf462088d13 394 val->tag = *(*p)++;
markrad 0:cdf462088d13 395
markrad 0:cdf462088d13 396 if( ( ret = mbedtls_asn1_get_len( p, end, &val->len ) ) != 0 )
markrad 0:cdf462088d13 397 return( MBEDTLS_ERR_X509_INVALID_NAME + ret );
markrad 0:cdf462088d13 398
markrad 0:cdf462088d13 399 val->p = *p;
markrad 0:cdf462088d13 400 *p += val->len;
markrad 0:cdf462088d13 401
markrad 0:cdf462088d13 402 cur->next = NULL;
markrad 0:cdf462088d13 403
markrad 0:cdf462088d13 404 return( 0 );
markrad 0:cdf462088d13 405 }
markrad 0:cdf462088d13 406
markrad 0:cdf462088d13 407 /*
markrad 0:cdf462088d13 408 * Name ::= CHOICE { -- only one possibility for now --
markrad 0:cdf462088d13 409 * rdnSequence RDNSequence }
markrad 0:cdf462088d13 410 *
markrad 0:cdf462088d13 411 * RDNSequence ::= SEQUENCE OF RelativeDistinguishedName
markrad 0:cdf462088d13 412 *
markrad 0:cdf462088d13 413 * RelativeDistinguishedName ::=
markrad 0:cdf462088d13 414 * SET OF AttributeTypeAndValue
markrad 0:cdf462088d13 415 *
markrad 0:cdf462088d13 416 * AttributeTypeAndValue ::= SEQUENCE {
markrad 0:cdf462088d13 417 * type AttributeType,
markrad 0:cdf462088d13 418 * value AttributeValue }
markrad 0:cdf462088d13 419 *
markrad 0:cdf462088d13 420 * AttributeType ::= OBJECT IDENTIFIER
markrad 0:cdf462088d13 421 *
markrad 0:cdf462088d13 422 * AttributeValue ::= ANY DEFINED BY AttributeType
markrad 0:cdf462088d13 423 *
markrad 0:cdf462088d13 424 * The data structure is optimized for the common case where each RDN has only
markrad 0:cdf462088d13 425 * one element, which is represented as a list of AttributeTypeAndValue.
markrad 0:cdf462088d13 426 * For the general case we still use a flat list, but we mark elements of the
markrad 0:cdf462088d13 427 * same set so that they are "merged" together in the functions that consume
markrad 0:cdf462088d13 428 * this list, eg mbedtls_x509_dn_gets().
markrad 0:cdf462088d13 429 */
markrad 0:cdf462088d13 430 int mbedtls_x509_get_name( unsigned char **p, const unsigned char *end,
markrad 0:cdf462088d13 431 mbedtls_x509_name *cur )
markrad 0:cdf462088d13 432 {
markrad 0:cdf462088d13 433 int ret;
markrad 0:cdf462088d13 434 size_t set_len;
markrad 0:cdf462088d13 435 const unsigned char *end_set;
markrad 0:cdf462088d13 436
markrad 0:cdf462088d13 437 /* don't use recursion, we'd risk stack overflow if not optimized */
markrad 0:cdf462088d13 438 while( 1 )
markrad 0:cdf462088d13 439 {
markrad 0:cdf462088d13 440 /*
markrad 0:cdf462088d13 441 * parse SET
markrad 0:cdf462088d13 442 */
markrad 0:cdf462088d13 443 if( ( ret = mbedtls_asn1_get_tag( p, end, &set_len,
markrad 0:cdf462088d13 444 MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SET ) ) != 0 )
markrad 0:cdf462088d13 445 return( MBEDTLS_ERR_X509_INVALID_NAME + ret );
markrad 0:cdf462088d13 446
markrad 0:cdf462088d13 447 end_set = *p + set_len;
markrad 0:cdf462088d13 448
markrad 0:cdf462088d13 449 while( 1 )
markrad 0:cdf462088d13 450 {
markrad 0:cdf462088d13 451 if( ( ret = x509_get_attr_type_value( p, end_set, cur ) ) != 0 )
markrad 0:cdf462088d13 452 return( ret );
markrad 0:cdf462088d13 453
markrad 0:cdf462088d13 454 if( *p == end_set )
markrad 0:cdf462088d13 455 break;
markrad 0:cdf462088d13 456
markrad 0:cdf462088d13 457 /* Mark this item as being no the only one in a set */
markrad 0:cdf462088d13 458 cur->next_merged = 1;
markrad 0:cdf462088d13 459
markrad 0:cdf462088d13 460 cur->next = mbedtls_calloc( 1, sizeof( mbedtls_x509_name ) );
markrad 0:cdf462088d13 461
markrad 0:cdf462088d13 462 if( cur->next == NULL )
markrad 0:cdf462088d13 463 return( MBEDTLS_ERR_X509_ALLOC_FAILED );
markrad 0:cdf462088d13 464
markrad 0:cdf462088d13 465 cur = cur->next;
markrad 0:cdf462088d13 466 }
markrad 0:cdf462088d13 467
markrad 0:cdf462088d13 468 /*
markrad 0:cdf462088d13 469 * continue until end of SEQUENCE is reached
markrad 0:cdf462088d13 470 */
markrad 0:cdf462088d13 471 if( *p == end )
markrad 0:cdf462088d13 472 return( 0 );
markrad 0:cdf462088d13 473
markrad 0:cdf462088d13 474 cur->next = mbedtls_calloc( 1, sizeof( mbedtls_x509_name ) );
markrad 0:cdf462088d13 475
markrad 0:cdf462088d13 476 if( cur->next == NULL )
markrad 0:cdf462088d13 477 return( MBEDTLS_ERR_X509_ALLOC_FAILED );
markrad 0:cdf462088d13 478
markrad 0:cdf462088d13 479 cur = cur->next;
markrad 0:cdf462088d13 480 }
markrad 0:cdf462088d13 481 }
markrad 0:cdf462088d13 482
markrad 0:cdf462088d13 483 static int x509_parse_int(unsigned char **p, unsigned n, int *res){
markrad 0:cdf462088d13 484 *res = 0;
markrad 0:cdf462088d13 485 for( ; n > 0; --n ){
markrad 0:cdf462088d13 486 if( ( **p < '0') || ( **p > '9' ) ) return MBEDTLS_ERR_X509_INVALID_DATE;
markrad 0:cdf462088d13 487 *res *= 10;
markrad 0:cdf462088d13 488 *res += (*(*p)++ - '0');
markrad 0:cdf462088d13 489 }
markrad 0:cdf462088d13 490 return 0;
markrad 0:cdf462088d13 491 }
markrad 0:cdf462088d13 492
markrad 0:cdf462088d13 493 static int x509_date_is_valid(const mbedtls_x509_time *time)
markrad 0:cdf462088d13 494 {
markrad 0:cdf462088d13 495 int ret = MBEDTLS_ERR_X509_INVALID_DATE;
markrad 0:cdf462088d13 496
markrad 0:cdf462088d13 497 CHECK_RANGE( 0, 9999, time->year );
markrad 0:cdf462088d13 498 CHECK_RANGE( 0, 23, time->hour );
markrad 0:cdf462088d13 499 CHECK_RANGE( 0, 59, time->min );
markrad 0:cdf462088d13 500 CHECK_RANGE( 0, 59, time->sec );
markrad 0:cdf462088d13 501
markrad 0:cdf462088d13 502 switch( time->mon )
markrad 0:cdf462088d13 503 {
markrad 0:cdf462088d13 504 case 1: case 3: case 5: case 7: case 8: case 10: case 12:
markrad 0:cdf462088d13 505 CHECK_RANGE( 1, 31, time->day );
markrad 0:cdf462088d13 506 break;
markrad 0:cdf462088d13 507 case 4: case 6: case 9: case 11:
markrad 0:cdf462088d13 508 CHECK_RANGE( 1, 30, time->day );
markrad 0:cdf462088d13 509 break;
markrad 0:cdf462088d13 510 case 2:
markrad 0:cdf462088d13 511 CHECK_RANGE( 1, 28 + (time->year % 4 == 0), time->day );
markrad 0:cdf462088d13 512 break;
markrad 0:cdf462088d13 513 default:
markrad 0:cdf462088d13 514 return( ret );
markrad 0:cdf462088d13 515 }
markrad 0:cdf462088d13 516
markrad 0:cdf462088d13 517 return( 0 );
markrad 0:cdf462088d13 518 }
markrad 0:cdf462088d13 519
markrad 0:cdf462088d13 520 /*
markrad 0:cdf462088d13 521 * Time ::= CHOICE {
markrad 0:cdf462088d13 522 * utcTime UTCTime,
markrad 0:cdf462088d13 523 * generalTime GeneralizedTime }
markrad 0:cdf462088d13 524 */
markrad 0:cdf462088d13 525 int mbedtls_x509_get_time( unsigned char **p, const unsigned char *end,
markrad 0:cdf462088d13 526 mbedtls_x509_time *time )
markrad 0:cdf462088d13 527 {
markrad 0:cdf462088d13 528 int ret;
markrad 0:cdf462088d13 529 size_t len;
markrad 0:cdf462088d13 530 unsigned char tag;
markrad 0:cdf462088d13 531
markrad 0:cdf462088d13 532 if( ( end - *p ) < 1 )
markrad 0:cdf462088d13 533 return( MBEDTLS_ERR_X509_INVALID_DATE +
markrad 0:cdf462088d13 534 MBEDTLS_ERR_ASN1_OUT_OF_DATA );
markrad 0:cdf462088d13 535
markrad 0:cdf462088d13 536 tag = **p;
markrad 0:cdf462088d13 537
markrad 0:cdf462088d13 538 if( tag == MBEDTLS_ASN1_UTC_TIME )
markrad 0:cdf462088d13 539 {
markrad 0:cdf462088d13 540 (*p)++;
markrad 0:cdf462088d13 541 ret = mbedtls_asn1_get_len( p, end, &len );
markrad 0:cdf462088d13 542
markrad 0:cdf462088d13 543 if( ret != 0 )
markrad 0:cdf462088d13 544 return( MBEDTLS_ERR_X509_INVALID_DATE + ret );
markrad 0:cdf462088d13 545
markrad 0:cdf462088d13 546 CHECK( x509_parse_int( p, 2, &time->year ) );
markrad 0:cdf462088d13 547 CHECK( x509_parse_int( p, 2, &time->mon ) );
markrad 0:cdf462088d13 548 CHECK( x509_parse_int( p, 2, &time->day ) );
markrad 0:cdf462088d13 549 CHECK( x509_parse_int( p, 2, &time->hour ) );
markrad 0:cdf462088d13 550 CHECK( x509_parse_int( p, 2, &time->min ) );
markrad 0:cdf462088d13 551 if( len > 10 )
markrad 0:cdf462088d13 552 CHECK( x509_parse_int( p, 2, &time->sec ) );
markrad 0:cdf462088d13 553 if( len > 12 && *(*p)++ != 'Z' )
markrad 0:cdf462088d13 554 return( MBEDTLS_ERR_X509_INVALID_DATE );
markrad 0:cdf462088d13 555
markrad 0:cdf462088d13 556 time->year += 100 * ( time->year < 50 );
markrad 0:cdf462088d13 557 time->year += 1900;
markrad 0:cdf462088d13 558
markrad 0:cdf462088d13 559 CHECK( x509_date_is_valid( time ) );
markrad 0:cdf462088d13 560
markrad 0:cdf462088d13 561 return( 0 );
markrad 0:cdf462088d13 562 }
markrad 0:cdf462088d13 563 else if( tag == MBEDTLS_ASN1_GENERALIZED_TIME )
markrad 0:cdf462088d13 564 {
markrad 0:cdf462088d13 565 (*p)++;
markrad 0:cdf462088d13 566 ret = mbedtls_asn1_get_len( p, end, &len );
markrad 0:cdf462088d13 567
markrad 0:cdf462088d13 568 if( ret != 0 )
markrad 0:cdf462088d13 569 return( MBEDTLS_ERR_X509_INVALID_DATE + ret );
markrad 0:cdf462088d13 570
markrad 0:cdf462088d13 571 CHECK( x509_parse_int( p, 4, &time->year ) );
markrad 0:cdf462088d13 572 CHECK( x509_parse_int( p, 2, &time->mon ) );
markrad 0:cdf462088d13 573 CHECK( x509_parse_int( p, 2, &time->day ) );
markrad 0:cdf462088d13 574 CHECK( x509_parse_int( p, 2, &time->hour ) );
markrad 0:cdf462088d13 575 CHECK( x509_parse_int( p, 2, &time->min ) );
markrad 0:cdf462088d13 576 if( len > 12 )
markrad 0:cdf462088d13 577 CHECK( x509_parse_int( p, 2, &time->sec ) );
markrad 0:cdf462088d13 578 if( len > 14 && *(*p)++ != 'Z' )
markrad 0:cdf462088d13 579 return( MBEDTLS_ERR_X509_INVALID_DATE );
markrad 0:cdf462088d13 580
markrad 0:cdf462088d13 581 CHECK( x509_date_is_valid( time ) );
markrad 0:cdf462088d13 582
markrad 0:cdf462088d13 583 return( 0 );
markrad 0:cdf462088d13 584 }
markrad 0:cdf462088d13 585 else
markrad 0:cdf462088d13 586 return( MBEDTLS_ERR_X509_INVALID_DATE +
markrad 0:cdf462088d13 587 MBEDTLS_ERR_ASN1_UNEXPECTED_TAG );
markrad 0:cdf462088d13 588 }
markrad 0:cdf462088d13 589
markrad 0:cdf462088d13 590 int mbedtls_x509_get_sig( unsigned char **p, const unsigned char *end, mbedtls_x509_buf *sig )
markrad 0:cdf462088d13 591 {
markrad 0:cdf462088d13 592 int ret;
markrad 0:cdf462088d13 593 size_t len;
markrad 0:cdf462088d13 594 int tag_type;
markrad 0:cdf462088d13 595
markrad 0:cdf462088d13 596 if( ( end - *p ) < 1 )
markrad 0:cdf462088d13 597 return( MBEDTLS_ERR_X509_INVALID_SIGNATURE +
markrad 0:cdf462088d13 598 MBEDTLS_ERR_ASN1_OUT_OF_DATA );
markrad 0:cdf462088d13 599
markrad 0:cdf462088d13 600 tag_type = **p;
markrad 0:cdf462088d13 601
markrad 0:cdf462088d13 602 if( ( ret = mbedtls_asn1_get_bitstring_null( p, end, &len ) ) != 0 )
markrad 0:cdf462088d13 603 return( MBEDTLS_ERR_X509_INVALID_SIGNATURE + ret );
markrad 0:cdf462088d13 604
markrad 0:cdf462088d13 605 sig->tag = tag_type;
markrad 0:cdf462088d13 606 sig->len = len;
markrad 0:cdf462088d13 607 sig->p = *p;
markrad 0:cdf462088d13 608
markrad 0:cdf462088d13 609 *p += len;
markrad 0:cdf462088d13 610
markrad 0:cdf462088d13 611 return( 0 );
markrad 0:cdf462088d13 612 }
markrad 0:cdf462088d13 613
markrad 0:cdf462088d13 614 /*
markrad 0:cdf462088d13 615 * Get signature algorithm from alg OID and optional parameters
markrad 0:cdf462088d13 616 */
markrad 0:cdf462088d13 617 int mbedtls_x509_get_sig_alg( const mbedtls_x509_buf *sig_oid, const mbedtls_x509_buf *sig_params,
markrad 0:cdf462088d13 618 mbedtls_md_type_t *md_alg, mbedtls_pk_type_t *pk_alg,
markrad 0:cdf462088d13 619 void **sig_opts )
markrad 0:cdf462088d13 620 {
markrad 0:cdf462088d13 621 int ret;
markrad 0:cdf462088d13 622
markrad 0:cdf462088d13 623 if( *sig_opts != NULL )
markrad 0:cdf462088d13 624 return( MBEDTLS_ERR_X509_BAD_INPUT_DATA );
markrad 0:cdf462088d13 625
markrad 0:cdf462088d13 626 if( ( ret = mbedtls_oid_get_sig_alg( sig_oid, md_alg, pk_alg ) ) != 0 )
markrad 0:cdf462088d13 627 return( MBEDTLS_ERR_X509_UNKNOWN_SIG_ALG + ret );
markrad 0:cdf462088d13 628
markrad 0:cdf462088d13 629 #if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT)
markrad 0:cdf462088d13 630 if( *pk_alg == MBEDTLS_PK_RSASSA_PSS )
markrad 0:cdf462088d13 631 {
markrad 0:cdf462088d13 632 mbedtls_pk_rsassa_pss_options *pss_opts;
markrad 0:cdf462088d13 633
markrad 0:cdf462088d13 634 pss_opts = mbedtls_calloc( 1, sizeof( mbedtls_pk_rsassa_pss_options ) );
markrad 0:cdf462088d13 635 if( pss_opts == NULL )
markrad 0:cdf462088d13 636 return( MBEDTLS_ERR_X509_ALLOC_FAILED );
markrad 0:cdf462088d13 637
markrad 0:cdf462088d13 638 ret = mbedtls_x509_get_rsassa_pss_params( sig_params,
markrad 0:cdf462088d13 639 md_alg,
markrad 0:cdf462088d13 640 &pss_opts->mgf1_hash_id,
markrad 0:cdf462088d13 641 &pss_opts->expected_salt_len );
markrad 0:cdf462088d13 642 if( ret != 0 )
markrad 0:cdf462088d13 643 {
markrad 0:cdf462088d13 644 mbedtls_free( pss_opts );
markrad 0:cdf462088d13 645 return( ret );
markrad 0:cdf462088d13 646 }
markrad 0:cdf462088d13 647
markrad 0:cdf462088d13 648 *sig_opts = (void *) pss_opts;
markrad 0:cdf462088d13 649 }
markrad 0:cdf462088d13 650 else
markrad 0:cdf462088d13 651 #endif /* MBEDTLS_X509_RSASSA_PSS_SUPPORT */
markrad 0:cdf462088d13 652 {
markrad 0:cdf462088d13 653 /* Make sure parameters are absent or NULL */
markrad 0:cdf462088d13 654 if( ( sig_params->tag != MBEDTLS_ASN1_NULL && sig_params->tag != 0 ) ||
markrad 0:cdf462088d13 655 sig_params->len != 0 )
markrad 0:cdf462088d13 656 return( MBEDTLS_ERR_X509_INVALID_ALG );
markrad 0:cdf462088d13 657 }
markrad 0:cdf462088d13 658
markrad 0:cdf462088d13 659 return( 0 );
markrad 0:cdf462088d13 660 }
markrad 0:cdf462088d13 661
markrad 0:cdf462088d13 662 /*
markrad 0:cdf462088d13 663 * X.509 Extensions (No parsing of extensions, pointer should
markrad 0:cdf462088d13 664 * be either manually updated or extensions should be parsed!)
markrad 0:cdf462088d13 665 */
markrad 0:cdf462088d13 666 int mbedtls_x509_get_ext( unsigned char **p, const unsigned char *end,
markrad 0:cdf462088d13 667 mbedtls_x509_buf *ext, int tag )
markrad 0:cdf462088d13 668 {
markrad 0:cdf462088d13 669 int ret;
markrad 0:cdf462088d13 670 size_t len;
markrad 0:cdf462088d13 671
markrad 0:cdf462088d13 672 if( *p == end )
markrad 0:cdf462088d13 673 return( 0 );
markrad 0:cdf462088d13 674
markrad 0:cdf462088d13 675 ext->tag = **p;
markrad 0:cdf462088d13 676
markrad 0:cdf462088d13 677 if( ( ret = mbedtls_asn1_get_tag( p, end, &ext->len,
markrad 0:cdf462088d13 678 MBEDTLS_ASN1_CONTEXT_SPECIFIC | MBEDTLS_ASN1_CONSTRUCTED | tag ) ) != 0 )
markrad 0:cdf462088d13 679 return( ret );
markrad 0:cdf462088d13 680
markrad 0:cdf462088d13 681 ext->p = *p;
markrad 0:cdf462088d13 682 end = *p + ext->len;
markrad 0:cdf462088d13 683
markrad 0:cdf462088d13 684 /*
markrad 0:cdf462088d13 685 * Extensions ::= SEQUENCE SIZE (1..MAX) OF Extension
markrad 0:cdf462088d13 686 *
markrad 0:cdf462088d13 687 * Extension ::= SEQUENCE {
markrad 0:cdf462088d13 688 * extnID OBJECT IDENTIFIER,
markrad 0:cdf462088d13 689 * critical BOOLEAN DEFAULT FALSE,
markrad 0:cdf462088d13 690 * extnValue OCTET STRING }
markrad 0:cdf462088d13 691 */
markrad 0:cdf462088d13 692 if( ( ret = mbedtls_asn1_get_tag( p, end, &len,
markrad 0:cdf462088d13 693 MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
markrad 0:cdf462088d13 694 return( MBEDTLS_ERR_X509_INVALID_EXTENSIONS + ret );
markrad 0:cdf462088d13 695
markrad 0:cdf462088d13 696 if( end != *p + len )
markrad 0:cdf462088d13 697 return( MBEDTLS_ERR_X509_INVALID_EXTENSIONS +
markrad 0:cdf462088d13 698 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH );
markrad 0:cdf462088d13 699
markrad 0:cdf462088d13 700 return( 0 );
markrad 0:cdf462088d13 701 }
markrad 0:cdf462088d13 702
markrad 0:cdf462088d13 703 /*
markrad 0:cdf462088d13 704 * Store the name in printable form into buf; no more
markrad 0:cdf462088d13 705 * than size characters will be written
markrad 0:cdf462088d13 706 */
markrad 0:cdf462088d13 707 int mbedtls_x509_dn_gets( char *buf, size_t size, const mbedtls_x509_name *dn )
markrad 0:cdf462088d13 708 {
markrad 0:cdf462088d13 709 int ret;
markrad 0:cdf462088d13 710 size_t i, n;
markrad 0:cdf462088d13 711 unsigned char c, merge = 0;
markrad 0:cdf462088d13 712 const mbedtls_x509_name *name;
markrad 0:cdf462088d13 713 const char *short_name = NULL;
markrad 0:cdf462088d13 714 char s[MBEDTLS_X509_MAX_DN_NAME_SIZE], *p;
markrad 0:cdf462088d13 715
markrad 0:cdf462088d13 716 memset( s, 0, sizeof( s ) );
markrad 0:cdf462088d13 717
markrad 0:cdf462088d13 718 name = dn;
markrad 0:cdf462088d13 719 p = buf;
markrad 0:cdf462088d13 720 n = size;
markrad 0:cdf462088d13 721
markrad 0:cdf462088d13 722 while( name != NULL )
markrad 0:cdf462088d13 723 {
markrad 0:cdf462088d13 724 if( !name->oid.p )
markrad 0:cdf462088d13 725 {
markrad 0:cdf462088d13 726 name = name->next;
markrad 0:cdf462088d13 727 continue;
markrad 0:cdf462088d13 728 }
markrad 0:cdf462088d13 729
markrad 0:cdf462088d13 730 if( name != dn )
markrad 0:cdf462088d13 731 {
markrad 0:cdf462088d13 732 ret = mbedtls_snprintf( p, n, merge ? " + " : ", " );
markrad 0:cdf462088d13 733 MBEDTLS_X509_SAFE_SNPRINTF;
markrad 0:cdf462088d13 734 }
markrad 0:cdf462088d13 735
markrad 0:cdf462088d13 736 ret = mbedtls_oid_get_attr_short_name( &name->oid, &short_name );
markrad 0:cdf462088d13 737
markrad 0:cdf462088d13 738 if( ret == 0 )
markrad 0:cdf462088d13 739 ret = mbedtls_snprintf( p, n, "%s=", short_name );
markrad 0:cdf462088d13 740 else
markrad 0:cdf462088d13 741 ret = mbedtls_snprintf( p, n, "\?\?=" );
markrad 0:cdf462088d13 742 MBEDTLS_X509_SAFE_SNPRINTF;
markrad 0:cdf462088d13 743
markrad 0:cdf462088d13 744 for( i = 0; i < name->val.len; i++ )
markrad 0:cdf462088d13 745 {
markrad 0:cdf462088d13 746 if( i >= sizeof( s ) - 1 )
markrad 0:cdf462088d13 747 break;
markrad 0:cdf462088d13 748
markrad 0:cdf462088d13 749 c = name->val.p[i];
markrad 0:cdf462088d13 750 if( c < 32 || c == 127 || ( c > 128 && c < 160 ) )
markrad 0:cdf462088d13 751 s[i] = '?';
markrad 0:cdf462088d13 752 else s[i] = c;
markrad 0:cdf462088d13 753 }
markrad 0:cdf462088d13 754 s[i] = '\0';
markrad 0:cdf462088d13 755 ret = mbedtls_snprintf( p, n, "%s", s );
markrad 0:cdf462088d13 756 MBEDTLS_X509_SAFE_SNPRINTF;
markrad 0:cdf462088d13 757
markrad 0:cdf462088d13 758 merge = name->next_merged;
markrad 0:cdf462088d13 759 name = name->next;
markrad 0:cdf462088d13 760 }
markrad 0:cdf462088d13 761
markrad 0:cdf462088d13 762 return( (int) ( size - n ) );
markrad 0:cdf462088d13 763 }
markrad 0:cdf462088d13 764
markrad 0:cdf462088d13 765 /*
markrad 0:cdf462088d13 766 * Store the serial in printable form into buf; no more
markrad 0:cdf462088d13 767 * than size characters will be written
markrad 0:cdf462088d13 768 */
markrad 0:cdf462088d13 769 int mbedtls_x509_serial_gets( char *buf, size_t size, const mbedtls_x509_buf *serial )
markrad 0:cdf462088d13 770 {
markrad 0:cdf462088d13 771 int ret;
markrad 0:cdf462088d13 772 size_t i, n, nr;
markrad 0:cdf462088d13 773 char *p;
markrad 0:cdf462088d13 774
markrad 0:cdf462088d13 775 p = buf;
markrad 0:cdf462088d13 776 n = size;
markrad 0:cdf462088d13 777
markrad 0:cdf462088d13 778 nr = ( serial->len <= 32 )
markrad 0:cdf462088d13 779 ? serial->len : 28;
markrad 0:cdf462088d13 780
markrad 0:cdf462088d13 781 for( i = 0; i < nr; i++ )
markrad 0:cdf462088d13 782 {
markrad 0:cdf462088d13 783 if( i == 0 && nr > 1 && serial->p[i] == 0x0 )
markrad 0:cdf462088d13 784 continue;
markrad 0:cdf462088d13 785
markrad 0:cdf462088d13 786 ret = mbedtls_snprintf( p, n, "%02X%s",
markrad 0:cdf462088d13 787 serial->p[i], ( i < nr - 1 ) ? ":" : "" );
markrad 0:cdf462088d13 788 MBEDTLS_X509_SAFE_SNPRINTF;
markrad 0:cdf462088d13 789 }
markrad 0:cdf462088d13 790
markrad 0:cdf462088d13 791 if( nr != serial->len )
markrad 0:cdf462088d13 792 {
markrad 0:cdf462088d13 793 ret = mbedtls_snprintf( p, n, "...." );
markrad 0:cdf462088d13 794 MBEDTLS_X509_SAFE_SNPRINTF;
markrad 0:cdf462088d13 795 }
markrad 0:cdf462088d13 796
markrad 0:cdf462088d13 797 return( (int) ( size - n ) );
markrad 0:cdf462088d13 798 }
markrad 0:cdf462088d13 799
markrad 0:cdf462088d13 800 /*
markrad 0:cdf462088d13 801 * Helper for writing signature algorithms
markrad 0:cdf462088d13 802 */
markrad 0:cdf462088d13 803 int mbedtls_x509_sig_alg_gets( char *buf, size_t size, const mbedtls_x509_buf *sig_oid,
markrad 0:cdf462088d13 804 mbedtls_pk_type_t pk_alg, mbedtls_md_type_t md_alg,
markrad 0:cdf462088d13 805 const void *sig_opts )
markrad 0:cdf462088d13 806 {
markrad 0:cdf462088d13 807 int ret;
markrad 0:cdf462088d13 808 char *p = buf;
markrad 0:cdf462088d13 809 size_t n = size;
markrad 0:cdf462088d13 810 const char *desc = NULL;
markrad 0:cdf462088d13 811
markrad 0:cdf462088d13 812 ret = mbedtls_oid_get_sig_alg_desc( sig_oid, &desc );
markrad 0:cdf462088d13 813 if( ret != 0 )
markrad 0:cdf462088d13 814 ret = mbedtls_snprintf( p, n, "???" );
markrad 0:cdf462088d13 815 else
markrad 0:cdf462088d13 816 ret = mbedtls_snprintf( p, n, "%s", desc );
markrad 0:cdf462088d13 817 MBEDTLS_X509_SAFE_SNPRINTF;
markrad 0:cdf462088d13 818
markrad 0:cdf462088d13 819 #if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT)
markrad 0:cdf462088d13 820 if( pk_alg == MBEDTLS_PK_RSASSA_PSS )
markrad 0:cdf462088d13 821 {
markrad 0:cdf462088d13 822 const mbedtls_pk_rsassa_pss_options *pss_opts;
markrad 0:cdf462088d13 823 const mbedtls_md_info_t *md_info, *mgf_md_info;
markrad 0:cdf462088d13 824
markrad 0:cdf462088d13 825 pss_opts = (const mbedtls_pk_rsassa_pss_options *) sig_opts;
markrad 0:cdf462088d13 826
markrad 0:cdf462088d13 827 md_info = mbedtls_md_info_from_type( md_alg );
markrad 0:cdf462088d13 828 mgf_md_info = mbedtls_md_info_from_type( pss_opts->mgf1_hash_id );
markrad 0:cdf462088d13 829
markrad 0:cdf462088d13 830 ret = mbedtls_snprintf( p, n, " (%s, MGF1-%s, 0x%02X)",
markrad 0:cdf462088d13 831 md_info ? mbedtls_md_get_name( md_info ) : "???",
markrad 0:cdf462088d13 832 mgf_md_info ? mbedtls_md_get_name( mgf_md_info ) : "???",
markrad 0:cdf462088d13 833 pss_opts->expected_salt_len );
markrad 0:cdf462088d13 834 MBEDTLS_X509_SAFE_SNPRINTF;
markrad 0:cdf462088d13 835 }
markrad 0:cdf462088d13 836 #else
markrad 0:cdf462088d13 837 ((void) pk_alg);
markrad 0:cdf462088d13 838 ((void) md_alg);
markrad 0:cdf462088d13 839 ((void) sig_opts);
markrad 0:cdf462088d13 840 #endif /* MBEDTLS_X509_RSASSA_PSS_SUPPORT */
markrad 0:cdf462088d13 841
markrad 0:cdf462088d13 842 return( (int)( size - n ) );
markrad 0:cdf462088d13 843 }
markrad 0:cdf462088d13 844
markrad 0:cdf462088d13 845 /*
markrad 0:cdf462088d13 846 * Helper for writing "RSA key size", "EC key size", etc
markrad 0:cdf462088d13 847 */
markrad 0:cdf462088d13 848 int mbedtls_x509_key_size_helper( char *buf, size_t buf_size, const char *name )
markrad 0:cdf462088d13 849 {
markrad 0:cdf462088d13 850 char *p = buf;
markrad 0:cdf462088d13 851 size_t n = buf_size;
markrad 0:cdf462088d13 852 int ret;
markrad 0:cdf462088d13 853
markrad 0:cdf462088d13 854 ret = mbedtls_snprintf( p, n, "%s key size", name );
markrad 0:cdf462088d13 855 MBEDTLS_X509_SAFE_SNPRINTF;
markrad 0:cdf462088d13 856
markrad 0:cdf462088d13 857 return( 0 );
markrad 0:cdf462088d13 858 }
markrad 0:cdf462088d13 859
markrad 0:cdf462088d13 860 #if defined(MBEDTLS_HAVE_TIME_DATE)
markrad 0:cdf462088d13 861 /*
markrad 0:cdf462088d13 862 * Set the time structure to the current time.
markrad 0:cdf462088d13 863 * Return 0 on success, non-zero on failure.
markrad 0:cdf462088d13 864 */
markrad 0:cdf462088d13 865 #if defined(_WIN32) && !defined(EFIX64) && !defined(EFI32)
markrad 0:cdf462088d13 866 static int x509_get_current_time( mbedtls_x509_time *now )
markrad 0:cdf462088d13 867 {
markrad 0:cdf462088d13 868 SYSTEMTIME st;
markrad 0:cdf462088d13 869
markrad 0:cdf462088d13 870 GetSystemTime( &st );
markrad 0:cdf462088d13 871
markrad 0:cdf462088d13 872 now->year = st.wYear;
markrad 0:cdf462088d13 873 now->mon = st.wMonth;
markrad 0:cdf462088d13 874 now->day = st.wDay;
markrad 0:cdf462088d13 875 now->hour = st.wHour;
markrad 0:cdf462088d13 876 now->min = st.wMinute;
markrad 0:cdf462088d13 877 now->sec = st.wSecond;
markrad 0:cdf462088d13 878
markrad 0:cdf462088d13 879 return( 0 );
markrad 0:cdf462088d13 880 }
markrad 0:cdf462088d13 881 #else
markrad 0:cdf462088d13 882 static int x509_get_current_time( mbedtls_x509_time *now )
markrad 0:cdf462088d13 883 {
markrad 0:cdf462088d13 884 struct tm *lt;
markrad 0:cdf462088d13 885 mbedtls_time_t tt;
markrad 0:cdf462088d13 886 int ret = 0;
markrad 0:cdf462088d13 887
markrad 0:cdf462088d13 888 #if defined(MBEDTLS_THREADING_C)
markrad 0:cdf462088d13 889 if( mbedtls_mutex_lock( &mbedtls_threading_gmtime_mutex ) != 0 )
markrad 0:cdf462088d13 890 return( MBEDTLS_ERR_THREADING_MUTEX_ERROR );
markrad 0:cdf462088d13 891 #endif
markrad 0:cdf462088d13 892
markrad 0:cdf462088d13 893 tt = mbedtls_time( NULL );
markrad 0:cdf462088d13 894 lt = gmtime( &tt );
markrad 0:cdf462088d13 895
markrad 0:cdf462088d13 896 if( lt == NULL )
markrad 0:cdf462088d13 897 ret = -1;
markrad 0:cdf462088d13 898 else
markrad 0:cdf462088d13 899 {
markrad 0:cdf462088d13 900 now->year = lt->tm_year + 1900;
markrad 0:cdf462088d13 901 now->mon = lt->tm_mon + 1;
markrad 0:cdf462088d13 902 now->day = lt->tm_mday;
markrad 0:cdf462088d13 903 now->hour = lt->tm_hour;
markrad 0:cdf462088d13 904 now->min = lt->tm_min;
markrad 0:cdf462088d13 905 now->sec = lt->tm_sec;
markrad 0:cdf462088d13 906 }
markrad 0:cdf462088d13 907
markrad 0:cdf462088d13 908 #if defined(MBEDTLS_THREADING_C)
markrad 0:cdf462088d13 909 if( mbedtls_mutex_unlock( &mbedtls_threading_gmtime_mutex ) != 0 )
markrad 0:cdf462088d13 910 return( MBEDTLS_ERR_THREADING_MUTEX_ERROR );
markrad 0:cdf462088d13 911 #endif
markrad 0:cdf462088d13 912
markrad 0:cdf462088d13 913 return( ret );
markrad 0:cdf462088d13 914 }
markrad 0:cdf462088d13 915 #endif /* _WIN32 && !EFIX64 && !EFI32 */
markrad 0:cdf462088d13 916
markrad 0:cdf462088d13 917 /*
markrad 0:cdf462088d13 918 * Return 0 if before <= after, 1 otherwise
markrad 0:cdf462088d13 919 */
markrad 0:cdf462088d13 920 static int x509_check_time( const mbedtls_x509_time *before, const mbedtls_x509_time *after )
markrad 0:cdf462088d13 921 {
markrad 0:cdf462088d13 922 if( before->year > after->year )
markrad 0:cdf462088d13 923 return( 1 );
markrad 0:cdf462088d13 924
markrad 0:cdf462088d13 925 if( before->year == after->year &&
markrad 0:cdf462088d13 926 before->mon > after->mon )
markrad 0:cdf462088d13 927 return( 1 );
markrad 0:cdf462088d13 928
markrad 0:cdf462088d13 929 if( before->year == after->year &&
markrad 0:cdf462088d13 930 before->mon == after->mon &&
markrad 0:cdf462088d13 931 before->day > after->day )
markrad 0:cdf462088d13 932 return( 1 );
markrad 0:cdf462088d13 933
markrad 0:cdf462088d13 934 if( before->year == after->year &&
markrad 0:cdf462088d13 935 before->mon == after->mon &&
markrad 0:cdf462088d13 936 before->day == after->day &&
markrad 0:cdf462088d13 937 before->hour > after->hour )
markrad 0:cdf462088d13 938 return( 1 );
markrad 0:cdf462088d13 939
markrad 0:cdf462088d13 940 if( before->year == after->year &&
markrad 0:cdf462088d13 941 before->mon == after->mon &&
markrad 0:cdf462088d13 942 before->day == after->day &&
markrad 0:cdf462088d13 943 before->hour == after->hour &&
markrad 0:cdf462088d13 944 before->min > after->min )
markrad 0:cdf462088d13 945 return( 1 );
markrad 0:cdf462088d13 946
markrad 0:cdf462088d13 947 if( before->year == after->year &&
markrad 0:cdf462088d13 948 before->mon == after->mon &&
markrad 0:cdf462088d13 949 before->day == after->day &&
markrad 0:cdf462088d13 950 before->hour == after->hour &&
markrad 0:cdf462088d13 951 before->min == after->min &&
markrad 0:cdf462088d13 952 before->sec > after->sec )
markrad 0:cdf462088d13 953 return( 1 );
markrad 0:cdf462088d13 954
markrad 0:cdf462088d13 955 return( 0 );
markrad 0:cdf462088d13 956 }
markrad 0:cdf462088d13 957
markrad 0:cdf462088d13 958 int mbedtls_x509_time_is_past( const mbedtls_x509_time *to )
markrad 0:cdf462088d13 959 {
markrad 0:cdf462088d13 960 mbedtls_x509_time now;
markrad 0:cdf462088d13 961
markrad 0:cdf462088d13 962 if( x509_get_current_time( &now ) != 0 )
markrad 0:cdf462088d13 963 return( 1 );
markrad 0:cdf462088d13 964
markrad 0:cdf462088d13 965 return( x509_check_time( &now, to ) );
markrad 0:cdf462088d13 966 }
markrad 0:cdf462088d13 967
markrad 0:cdf462088d13 968 int mbedtls_x509_time_is_future( const mbedtls_x509_time *from )
markrad 0:cdf462088d13 969 {
markrad 0:cdf462088d13 970 mbedtls_x509_time now;
markrad 0:cdf462088d13 971
markrad 0:cdf462088d13 972 if( x509_get_current_time( &now ) != 0 )
markrad 0:cdf462088d13 973 return( 1 );
markrad 0:cdf462088d13 974
markrad 0:cdf462088d13 975 return( x509_check_time( from, &now ) );
markrad 0:cdf462088d13 976 }
markrad 0:cdf462088d13 977
markrad 0:cdf462088d13 978 #else /* MBEDTLS_HAVE_TIME_DATE */
markrad 0:cdf462088d13 979
markrad 0:cdf462088d13 980 int mbedtls_x509_time_is_past( const mbedtls_x509_time *to )
markrad 0:cdf462088d13 981 {
markrad 0:cdf462088d13 982 ((void) to);
markrad 0:cdf462088d13 983 return( 0 );
markrad 0:cdf462088d13 984 }
markrad 0:cdf462088d13 985
markrad 0:cdf462088d13 986 int mbedtls_x509_time_is_future( const mbedtls_x509_time *from )
markrad 0:cdf462088d13 987 {
markrad 0:cdf462088d13 988 ((void) from);
markrad 0:cdf462088d13 989 return( 0 );
markrad 0:cdf462088d13 990 }
markrad 0:cdf462088d13 991 #endif /* MBEDTLS_HAVE_TIME_DATE */
markrad 0:cdf462088d13 992
markrad 0:cdf462088d13 993 #if defined(MBEDTLS_SELF_TEST)
markrad 0:cdf462088d13 994
markrad 0:cdf462088d13 995 #include "mbedtls/x509_crt.h"
markrad 0:cdf462088d13 996 #include "mbedtls/certs.h"
markrad 0:cdf462088d13 997
markrad 0:cdf462088d13 998 /*
markrad 0:cdf462088d13 999 * Checkup routine
markrad 0:cdf462088d13 1000 */
markrad 0:cdf462088d13 1001 int mbedtls_x509_self_test( int verbose )
markrad 0:cdf462088d13 1002 {
markrad 0:cdf462088d13 1003 #if defined(MBEDTLS_CERTS_C) && defined(MBEDTLS_SHA1_C)
markrad 0:cdf462088d13 1004 int ret;
markrad 0:cdf462088d13 1005 uint32_t flags;
markrad 0:cdf462088d13 1006 mbedtls_x509_crt cacert;
markrad 0:cdf462088d13 1007 mbedtls_x509_crt clicert;
markrad 0:cdf462088d13 1008
markrad 0:cdf462088d13 1009 if( verbose != 0 )
markrad 0:cdf462088d13 1010 mbedtls_printf( " X.509 certificate load: " );
markrad 0:cdf462088d13 1011
markrad 0:cdf462088d13 1012 mbedtls_x509_crt_init( &clicert );
markrad 0:cdf462088d13 1013
markrad 0:cdf462088d13 1014 ret = mbedtls_x509_crt_parse( &clicert, (const unsigned char *) mbedtls_test_cli_crt,
markrad 0:cdf462088d13 1015 mbedtls_test_cli_crt_len );
markrad 0:cdf462088d13 1016 if( ret != 0 )
markrad 0:cdf462088d13 1017 {
markrad 0:cdf462088d13 1018 if( verbose != 0 )
markrad 0:cdf462088d13 1019 mbedtls_printf( "failed\n" );
markrad 0:cdf462088d13 1020
markrad 0:cdf462088d13 1021 return( ret );
markrad 0:cdf462088d13 1022 }
markrad 0:cdf462088d13 1023
markrad 0:cdf462088d13 1024 mbedtls_x509_crt_init( &cacert );
markrad 0:cdf462088d13 1025
markrad 0:cdf462088d13 1026 ret = mbedtls_x509_crt_parse( &cacert, (const unsigned char *) mbedtls_test_ca_crt,
markrad 0:cdf462088d13 1027 mbedtls_test_ca_crt_len );
markrad 0:cdf462088d13 1028 if( ret != 0 )
markrad 0:cdf462088d13 1029 {
markrad 0:cdf462088d13 1030 if( verbose != 0 )
markrad 0:cdf462088d13 1031 mbedtls_printf( "failed\n" );
markrad 0:cdf462088d13 1032
markrad 0:cdf462088d13 1033 return( ret );
markrad 0:cdf462088d13 1034 }
markrad 0:cdf462088d13 1035
markrad 0:cdf462088d13 1036 if( verbose != 0 )
markrad 0:cdf462088d13 1037 mbedtls_printf( "passed\n X.509 signature verify: ");
markrad 0:cdf462088d13 1038
markrad 0:cdf462088d13 1039 ret = mbedtls_x509_crt_verify( &clicert, &cacert, NULL, NULL, &flags, NULL, NULL );
markrad 0:cdf462088d13 1040 if( ret != 0 )
markrad 0:cdf462088d13 1041 {
markrad 0:cdf462088d13 1042 if( verbose != 0 )
markrad 0:cdf462088d13 1043 mbedtls_printf( "failed\n" );
markrad 0:cdf462088d13 1044
markrad 0:cdf462088d13 1045 return( ret );
markrad 0:cdf462088d13 1046 }
markrad 0:cdf462088d13 1047
markrad 0:cdf462088d13 1048 if( verbose != 0 )
markrad 0:cdf462088d13 1049 mbedtls_printf( "passed\n\n");
markrad 0:cdf462088d13 1050
markrad 0:cdf462088d13 1051 mbedtls_x509_crt_free( &cacert );
markrad 0:cdf462088d13 1052 mbedtls_x509_crt_free( &clicert );
markrad 0:cdf462088d13 1053
markrad 0:cdf462088d13 1054 return( 0 );
markrad 0:cdf462088d13 1055 #else
markrad 0:cdf462088d13 1056 ((void) verbose);
markrad 0:cdf462088d13 1057 return( 0 );
markrad 0:cdf462088d13 1058 #endif /* MBEDTLS_CERTS_C && MBEDTLS_SHA1_C */
markrad 0:cdf462088d13 1059 }
markrad 0:cdf462088d13 1060
markrad 0:cdf462088d13 1061 #endif /* MBEDTLS_SELF_TEST */
markrad 0:cdf462088d13 1062
markrad 0:cdf462088d13 1063 #endif /* MBEDTLS_X509_USE_C */