Arcola / mbedtls

mbed TLS upgraded to 2.6.0

Fork of mbedtls by Mark Radbourne

library/x509_crl.c@0:cdf462088d13, 2017-01-05 (annotated)

Committer:
markrad
Date:
Thu Jan 05 00:18:44 2017 +0000
Revision:
0:cdf462088d13
Child:
1:9ebc941037d5
Initial commit

Who changed what in which revision?

UserRevisionLine numberNew contents of line
markrad 0:cdf462088d13 1 /*
markrad 0:cdf462088d13 2 * X.509 Certidicate Revocation List (CRL) parsing
markrad 0:cdf462088d13 3 *
markrad 0:cdf462088d13 4 * Copyright (C) 2006-2015, ARM Limited, All Rights Reserved
markrad 0:cdf462088d13 5 * SPDX-License-Identifier: Apache-2.0
markrad 0:cdf462088d13 6 *
markrad 0:cdf462088d13 7 * Licensed under the Apache License, Version 2.0 (the "License"); you may
markrad 0:cdf462088d13 8 * not use this file except in compliance with the License.
markrad 0:cdf462088d13 9 * You may obtain a copy of the License at
markrad 0:cdf462088d13 10 *
markrad 0:cdf462088d13 11 * http://www.apache.org/licenses/LICENSE-2.0
markrad 0:cdf462088d13 12 *
markrad 0:cdf462088d13 13 * Unless required by applicable law or agreed to in writing, software
markrad 0:cdf462088d13 14 * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
markrad 0:cdf462088d13 15 * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
markrad 0:cdf462088d13 16 * See the License for the specific language governing permissions and
markrad 0:cdf462088d13 17 * limitations under the License.
markrad 0:cdf462088d13 18 *
markrad 0:cdf462088d13 19 * This file is part of mbed TLS (https://tls.mbed.org)
markrad 0:cdf462088d13 20 */
markrad 0:cdf462088d13 21 /*
markrad 0:cdf462088d13 22 * The ITU-T X.509 standard defines a certificate format for PKI.
markrad 0:cdf462088d13 23 *
markrad 0:cdf462088d13 24 * http://www.ietf.org/rfc/rfc5280.txt (Certificates and CRLs)
markrad 0:cdf462088d13 25 * http://www.ietf.org/rfc/rfc3279.txt (Alg IDs for CRLs)
markrad 0:cdf462088d13 26 * http://www.ietf.org/rfc/rfc2986.txt (CSRs, aka PKCS#10)
markrad 0:cdf462088d13 27 *
markrad 0:cdf462088d13 28 * http://www.itu.int/ITU-T/studygroups/com17/languages/X.680-0207.pdf
markrad 0:cdf462088d13 29 * http://www.itu.int/ITU-T/studygroups/com17/languages/X.690-0207.pdf
markrad 0:cdf462088d13 30 */
markrad 0:cdf462088d13 31
markrad 0:cdf462088d13 32 #if !defined(MBEDTLS_CONFIG_FILE)
markrad 0:cdf462088d13 33 #include "mbedtls/config.h"
markrad 0:cdf462088d13 34 #else
markrad 0:cdf462088d13 35 #include MBEDTLS_CONFIG_FILE
markrad 0:cdf462088d13 36 #endif
markrad 0:cdf462088d13 37
markrad 0:cdf462088d13 38 #if defined(MBEDTLS_X509_CRL_PARSE_C)
markrad 0:cdf462088d13 39
markrad 0:cdf462088d13 40 #include "mbedtls/x509_crl.h"
markrad 0:cdf462088d13 41 #include "mbedtls/oid.h"
markrad 0:cdf462088d13 42
markrad 0:cdf462088d13 43 #include <string.h>
markrad 0:cdf462088d13 44
markrad 0:cdf462088d13 45 #if defined(MBEDTLS_PEM_PARSE_C)
markrad 0:cdf462088d13 46 #include "mbedtls/pem.h"
markrad 0:cdf462088d13 47 #endif
markrad 0:cdf462088d13 48
markrad 0:cdf462088d13 49 #if defined(MBEDTLS_PLATFORM_C)
markrad 0:cdf462088d13 50 #include "mbedtls/platform.h"
markrad 0:cdf462088d13 51 #else
markrad 0:cdf462088d13 52 #include <stdlib.h>
markrad 0:cdf462088d13 53 #include <stdio.h>
markrad 0:cdf462088d13 54 #define mbedtls_free free
markrad 0:cdf462088d13 55 #define mbedtls_calloc calloc
markrad 0:cdf462088d13 56 #define mbedtls_snprintf snprintf
markrad 0:cdf462088d13 57 #endif
markrad 0:cdf462088d13 58
markrad 0:cdf462088d13 59 #if defined(_WIN32) && !defined(EFIX64) && !defined(EFI32)
markrad 0:cdf462088d13 60 #include <windows.h>
markrad 0:cdf462088d13 61 #else
markrad 0:cdf462088d13 62 #include <time.h>
markrad 0:cdf462088d13 63 #endif
markrad 0:cdf462088d13 64
markrad 0:cdf462088d13 65 #if defined(MBEDTLS_FS_IO) || defined(EFIX64) || defined(EFI32)
markrad 0:cdf462088d13 66 #include <stdio.h>
markrad 0:cdf462088d13 67 #endif
markrad 0:cdf462088d13 68
markrad 0:cdf462088d13 69 /* Implementation that should never be optimized out by the compiler */
markrad 0:cdf462088d13 70 static void mbedtls_zeroize( void *v, size_t n ) {
markrad 0:cdf462088d13 71 volatile unsigned char *p = v; while( n-- ) *p++ = 0;
markrad 0:cdf462088d13 72 }
markrad 0:cdf462088d13 73
markrad 0:cdf462088d13 74 /*
markrad 0:cdf462088d13 75 * Version ::= INTEGER { v1(0), v2(1) }
markrad 0:cdf462088d13 76 */
markrad 0:cdf462088d13 77 static int x509_crl_get_version( unsigned char **p,
markrad 0:cdf462088d13 78 const unsigned char *end,
markrad 0:cdf462088d13 79 int *ver )
markrad 0:cdf462088d13 80 {
markrad 0:cdf462088d13 81 int ret;
markrad 0:cdf462088d13 82
markrad 0:cdf462088d13 83 if( ( ret = mbedtls_asn1_get_int( p, end, ver ) ) != 0 )
markrad 0:cdf462088d13 84 {
markrad 0:cdf462088d13 85 if( ret == MBEDTLS_ERR_ASN1_UNEXPECTED_TAG )
markrad 0:cdf462088d13 86 {
markrad 0:cdf462088d13 87 *ver = 0;
markrad 0:cdf462088d13 88 return( 0 );
markrad 0:cdf462088d13 89 }
markrad 0:cdf462088d13 90
markrad 0:cdf462088d13 91 return( MBEDTLS_ERR_X509_INVALID_VERSION + ret );
markrad 0:cdf462088d13 92 }
markrad 0:cdf462088d13 93
markrad 0:cdf462088d13 94 return( 0 );
markrad 0:cdf462088d13 95 }
markrad 0:cdf462088d13 96
markrad 0:cdf462088d13 97 /*
markrad 0:cdf462088d13 98 * X.509 CRL v2 extensions (no extensions parsed yet.)
markrad 0:cdf462088d13 99 */
markrad 0:cdf462088d13 100 static int x509_get_crl_ext( unsigned char **p,
markrad 0:cdf462088d13 101 const unsigned char *end,
markrad 0:cdf462088d13 102 mbedtls_x509_buf *ext )
markrad 0:cdf462088d13 103 {
markrad 0:cdf462088d13 104 int ret;
markrad 0:cdf462088d13 105 size_t len = 0;
markrad 0:cdf462088d13 106
markrad 0:cdf462088d13 107 /* Get explicit tag */
markrad 0:cdf462088d13 108 if( ( ret = mbedtls_x509_get_ext( p, end, ext, 0) ) != 0 )
markrad 0:cdf462088d13 109 {
markrad 0:cdf462088d13 110 if( ret == MBEDTLS_ERR_ASN1_UNEXPECTED_TAG )
markrad 0:cdf462088d13 111 return( 0 );
markrad 0:cdf462088d13 112
markrad 0:cdf462088d13 113 return( ret );
markrad 0:cdf462088d13 114 }
markrad 0:cdf462088d13 115
markrad 0:cdf462088d13 116 while( *p < end )
markrad 0:cdf462088d13 117 {
markrad 0:cdf462088d13 118 if( ( ret = mbedtls_asn1_get_tag( p, end, &len,
markrad 0:cdf462088d13 119 MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
markrad 0:cdf462088d13 120 return( MBEDTLS_ERR_X509_INVALID_EXTENSIONS + ret );
markrad 0:cdf462088d13 121
markrad 0:cdf462088d13 122 *p += len;
markrad 0:cdf462088d13 123 }
markrad 0:cdf462088d13 124
markrad 0:cdf462088d13 125 if( *p != end )
markrad 0:cdf462088d13 126 return( MBEDTLS_ERR_X509_INVALID_EXTENSIONS +
markrad 0:cdf462088d13 127 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH );
markrad 0:cdf462088d13 128
markrad 0:cdf462088d13 129 return( 0 );
markrad 0:cdf462088d13 130 }
markrad 0:cdf462088d13 131
markrad 0:cdf462088d13 132 /*
markrad 0:cdf462088d13 133 * X.509 CRL v2 entry extensions (no extensions parsed yet.)
markrad 0:cdf462088d13 134 */
markrad 0:cdf462088d13 135 static int x509_get_crl_entry_ext( unsigned char **p,
markrad 0:cdf462088d13 136 const unsigned char *end,
markrad 0:cdf462088d13 137 mbedtls_x509_buf *ext )
markrad 0:cdf462088d13 138 {
markrad 0:cdf462088d13 139 int ret;
markrad 0:cdf462088d13 140 size_t len = 0;
markrad 0:cdf462088d13 141
markrad 0:cdf462088d13 142 /* OPTIONAL */
markrad 0:cdf462088d13 143 if( end <= *p )
markrad 0:cdf462088d13 144 return( 0 );
markrad 0:cdf462088d13 145
markrad 0:cdf462088d13 146 ext->tag = **p;
markrad 0:cdf462088d13 147 ext->p = *p;
markrad 0:cdf462088d13 148
markrad 0:cdf462088d13 149 /*
markrad 0:cdf462088d13 150 * Get CRL-entry extension sequence header
markrad 0:cdf462088d13 151 * crlEntryExtensions Extensions OPTIONAL -- if present, MUST be v2
markrad 0:cdf462088d13 152 */
markrad 0:cdf462088d13 153 if( ( ret = mbedtls_asn1_get_tag( p, end, &ext->len,
markrad 0:cdf462088d13 154 MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
markrad 0:cdf462088d13 155 {
markrad 0:cdf462088d13 156 if( ret == MBEDTLS_ERR_ASN1_UNEXPECTED_TAG )
markrad 0:cdf462088d13 157 {
markrad 0:cdf462088d13 158 ext->p = NULL;
markrad 0:cdf462088d13 159 return( 0 );
markrad 0:cdf462088d13 160 }
markrad 0:cdf462088d13 161 return( MBEDTLS_ERR_X509_INVALID_EXTENSIONS + ret );
markrad 0:cdf462088d13 162 }
markrad 0:cdf462088d13 163
markrad 0:cdf462088d13 164 end = *p + ext->len;
markrad 0:cdf462088d13 165
markrad 0:cdf462088d13 166 if( end != *p + ext->len )
markrad 0:cdf462088d13 167 return( MBEDTLS_ERR_X509_INVALID_EXTENSIONS +
markrad 0:cdf462088d13 168 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH );
markrad 0:cdf462088d13 169
markrad 0:cdf462088d13 170 while( *p < end )
markrad 0:cdf462088d13 171 {
markrad 0:cdf462088d13 172 if( ( ret = mbedtls_asn1_get_tag( p, end, &len,
markrad 0:cdf462088d13 173 MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
markrad 0:cdf462088d13 174 return( MBEDTLS_ERR_X509_INVALID_EXTENSIONS + ret );
markrad 0:cdf462088d13 175
markrad 0:cdf462088d13 176 *p += len;
markrad 0:cdf462088d13 177 }
markrad 0:cdf462088d13 178
markrad 0:cdf462088d13 179 if( *p != end )
markrad 0:cdf462088d13 180 return( MBEDTLS_ERR_X509_INVALID_EXTENSIONS +
markrad 0:cdf462088d13 181 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH );
markrad 0:cdf462088d13 182
markrad 0:cdf462088d13 183 return( 0 );
markrad 0:cdf462088d13 184 }
markrad 0:cdf462088d13 185
markrad 0:cdf462088d13 186 /*
markrad 0:cdf462088d13 187 * X.509 CRL Entries
markrad 0:cdf462088d13 188 */
markrad 0:cdf462088d13 189 static int x509_get_entries( unsigned char **p,
markrad 0:cdf462088d13 190 const unsigned char *end,
markrad 0:cdf462088d13 191 mbedtls_x509_crl_entry *entry )
markrad 0:cdf462088d13 192 {
markrad 0:cdf462088d13 193 int ret;
markrad 0:cdf462088d13 194 size_t entry_len;
markrad 0:cdf462088d13 195 mbedtls_x509_crl_entry *cur_entry = entry;
markrad 0:cdf462088d13 196
markrad 0:cdf462088d13 197 if( *p == end )
markrad 0:cdf462088d13 198 return( 0 );
markrad 0:cdf462088d13 199
markrad 0:cdf462088d13 200 if( ( ret = mbedtls_asn1_get_tag( p, end, &entry_len,
markrad 0:cdf462088d13 201 MBEDTLS_ASN1_SEQUENCE | MBEDTLS_ASN1_CONSTRUCTED ) ) != 0 )
markrad 0:cdf462088d13 202 {
markrad 0:cdf462088d13 203 if( ret == MBEDTLS_ERR_ASN1_UNEXPECTED_TAG )
markrad 0:cdf462088d13 204 return( 0 );
markrad 0:cdf462088d13 205
markrad 0:cdf462088d13 206 return( ret );
markrad 0:cdf462088d13 207 }
markrad 0:cdf462088d13 208
markrad 0:cdf462088d13 209 end = *p + entry_len;
markrad 0:cdf462088d13 210
markrad 0:cdf462088d13 211 while( *p < end )
markrad 0:cdf462088d13 212 {
markrad 0:cdf462088d13 213 size_t len2;
markrad 0:cdf462088d13 214 const unsigned char *end2;
markrad 0:cdf462088d13 215
markrad 0:cdf462088d13 216 if( ( ret = mbedtls_asn1_get_tag( p, end, &len2,
markrad 0:cdf462088d13 217 MBEDTLS_ASN1_SEQUENCE | MBEDTLS_ASN1_CONSTRUCTED ) ) != 0 )
markrad 0:cdf462088d13 218 {
markrad 0:cdf462088d13 219 return( ret );
markrad 0:cdf462088d13 220 }
markrad 0:cdf462088d13 221
markrad 0:cdf462088d13 222 cur_entry->raw.tag = **p;
markrad 0:cdf462088d13 223 cur_entry->raw.p = *p;
markrad 0:cdf462088d13 224 cur_entry->raw.len = len2;
markrad 0:cdf462088d13 225 end2 = *p + len2;
markrad 0:cdf462088d13 226
markrad 0:cdf462088d13 227 if( ( ret = mbedtls_x509_get_serial( p, end2, &cur_entry->serial ) ) != 0 )
markrad 0:cdf462088d13 228 return( ret );
markrad 0:cdf462088d13 229
markrad 0:cdf462088d13 230 if( ( ret = mbedtls_x509_get_time( p, end2,
markrad 0:cdf462088d13 231 &cur_entry->revocation_date ) ) != 0 )
markrad 0:cdf462088d13 232 return( ret );
markrad 0:cdf462088d13 233
markrad 0:cdf462088d13 234 if( ( ret = x509_get_crl_entry_ext( p, end2,
markrad 0:cdf462088d13 235 &cur_entry->entry_ext ) ) != 0 )
markrad 0:cdf462088d13 236 return( ret );
markrad 0:cdf462088d13 237
markrad 0:cdf462088d13 238 if( *p < end )
markrad 0:cdf462088d13 239 {
markrad 0:cdf462088d13 240 cur_entry->next = mbedtls_calloc( 1, sizeof( mbedtls_x509_crl_entry ) );
markrad 0:cdf462088d13 241
markrad 0:cdf462088d13 242 if( cur_entry->next == NULL )
markrad 0:cdf462088d13 243 return( MBEDTLS_ERR_X509_ALLOC_FAILED );
markrad 0:cdf462088d13 244
markrad 0:cdf462088d13 245 cur_entry = cur_entry->next;
markrad 0:cdf462088d13 246 }
markrad 0:cdf462088d13 247 }
markrad 0:cdf462088d13 248
markrad 0:cdf462088d13 249 return( 0 );
markrad 0:cdf462088d13 250 }
markrad 0:cdf462088d13 251
markrad 0:cdf462088d13 252 /*
markrad 0:cdf462088d13 253 * Parse one CRLs in DER format and append it to the chained list
markrad 0:cdf462088d13 254 */
markrad 0:cdf462088d13 255 int mbedtls_x509_crl_parse_der( mbedtls_x509_crl *chain,
markrad 0:cdf462088d13 256 const unsigned char *buf, size_t buflen )
markrad 0:cdf462088d13 257 {
markrad 0:cdf462088d13 258 int ret;
markrad 0:cdf462088d13 259 size_t len;
markrad 0:cdf462088d13 260 unsigned char *p, *end;
markrad 0:cdf462088d13 261 mbedtls_x509_buf sig_params1, sig_params2, sig_oid2;
markrad 0:cdf462088d13 262 mbedtls_x509_crl *crl = chain;
markrad 0:cdf462088d13 263
markrad 0:cdf462088d13 264 /*
markrad 0:cdf462088d13 265 * Check for valid input
markrad 0:cdf462088d13 266 */
markrad 0:cdf462088d13 267 if( crl == NULL || buf == NULL )
markrad 0:cdf462088d13 268 return( MBEDTLS_ERR_X509_BAD_INPUT_DATA );
markrad 0:cdf462088d13 269
markrad 0:cdf462088d13 270 memset( &sig_params1, 0, sizeof( mbedtls_x509_buf ) );
markrad 0:cdf462088d13 271 memset( &sig_params2, 0, sizeof( mbedtls_x509_buf ) );
markrad 0:cdf462088d13 272 memset( &sig_oid2, 0, sizeof( mbedtls_x509_buf ) );
markrad 0:cdf462088d13 273
markrad 0:cdf462088d13 274 /*
markrad 0:cdf462088d13 275 * Add new CRL on the end of the chain if needed.
markrad 0:cdf462088d13 276 */
markrad 0:cdf462088d13 277 while( crl->version != 0 && crl->next != NULL )
markrad 0:cdf462088d13 278 crl = crl->next;
markrad 0:cdf462088d13 279
markrad 0:cdf462088d13 280 if( crl->version != 0 && crl->next == NULL )
markrad 0:cdf462088d13 281 {
markrad 0:cdf462088d13 282 crl->next = mbedtls_calloc( 1, sizeof( mbedtls_x509_crl ) );
markrad 0:cdf462088d13 283
markrad 0:cdf462088d13 284 if( crl->next == NULL )
markrad 0:cdf462088d13 285 {
markrad 0:cdf462088d13 286 mbedtls_x509_crl_free( crl );
markrad 0:cdf462088d13 287 return( MBEDTLS_ERR_X509_ALLOC_FAILED );
markrad 0:cdf462088d13 288 }
markrad 0:cdf462088d13 289
markrad 0:cdf462088d13 290 mbedtls_x509_crl_init( crl->next );
markrad 0:cdf462088d13 291 crl = crl->next;
markrad 0:cdf462088d13 292 }
markrad 0:cdf462088d13 293
markrad 0:cdf462088d13 294 /*
markrad 0:cdf462088d13 295 * Copy raw DER-encoded CRL
markrad 0:cdf462088d13 296 */
markrad 0:cdf462088d13 297 if( ( p = mbedtls_calloc( 1, buflen ) ) == NULL )
markrad 0:cdf462088d13 298 return( MBEDTLS_ERR_X509_ALLOC_FAILED );
markrad 0:cdf462088d13 299
markrad 0:cdf462088d13 300 memcpy( p, buf, buflen );
markrad 0:cdf462088d13 301
markrad 0:cdf462088d13 302 crl->raw.p = p;
markrad 0:cdf462088d13 303 crl->raw.len = buflen;
markrad 0:cdf462088d13 304
markrad 0:cdf462088d13 305 end = p + buflen;
markrad 0:cdf462088d13 306
markrad 0:cdf462088d13 307 /*
markrad 0:cdf462088d13 308 * CertificateList ::= SEQUENCE {
markrad 0:cdf462088d13 309 * tbsCertList TBSCertList,
markrad 0:cdf462088d13 310 * signatureAlgorithm AlgorithmIdentifier,
markrad 0:cdf462088d13 311 * signatureValue BIT STRING }
markrad 0:cdf462088d13 312 */
markrad 0:cdf462088d13 313 if( ( ret = mbedtls_asn1_get_tag( &p, end, &len,
markrad 0:cdf462088d13 314 MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
markrad 0:cdf462088d13 315 {
markrad 0:cdf462088d13 316 mbedtls_x509_crl_free( crl );
markrad 0:cdf462088d13 317 return( MBEDTLS_ERR_X509_INVALID_FORMAT );
markrad 0:cdf462088d13 318 }
markrad 0:cdf462088d13 319
markrad 0:cdf462088d13 320 if( len != (size_t) ( end - p ) )
markrad 0:cdf462088d13 321 {
markrad 0:cdf462088d13 322 mbedtls_x509_crl_free( crl );
markrad 0:cdf462088d13 323 return( MBEDTLS_ERR_X509_INVALID_FORMAT +
markrad 0:cdf462088d13 324 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH );
markrad 0:cdf462088d13 325 }
markrad 0:cdf462088d13 326
markrad 0:cdf462088d13 327 /*
markrad 0:cdf462088d13 328 * TBSCertList ::= SEQUENCE {
markrad 0:cdf462088d13 329 */
markrad 0:cdf462088d13 330 crl->tbs.p = p;
markrad 0:cdf462088d13 331
markrad 0:cdf462088d13 332 if( ( ret = mbedtls_asn1_get_tag( &p, end, &len,
markrad 0:cdf462088d13 333 MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
markrad 0:cdf462088d13 334 {
markrad 0:cdf462088d13 335 mbedtls_x509_crl_free( crl );
markrad 0:cdf462088d13 336 return( MBEDTLS_ERR_X509_INVALID_FORMAT + ret );
markrad 0:cdf462088d13 337 }
markrad 0:cdf462088d13 338
markrad 0:cdf462088d13 339 end = p + len;
markrad 0:cdf462088d13 340 crl->tbs.len = end - crl->tbs.p;
markrad 0:cdf462088d13 341
markrad 0:cdf462088d13 342 /*
markrad 0:cdf462088d13 343 * Version ::= INTEGER OPTIONAL { v1(0), v2(1) }
markrad 0:cdf462088d13 344 * -- if present, MUST be v2
markrad 0:cdf462088d13 345 *
markrad 0:cdf462088d13 346 * signature AlgorithmIdentifier
markrad 0:cdf462088d13 347 */
markrad 0:cdf462088d13 348 if( ( ret = x509_crl_get_version( &p, end, &crl->version ) ) != 0 ||
markrad 0:cdf462088d13 349 ( ret = mbedtls_x509_get_alg( &p, end, &crl->sig_oid, &sig_params1 ) ) != 0 )
markrad 0:cdf462088d13 350 {
markrad 0:cdf462088d13 351 mbedtls_x509_crl_free( crl );
markrad 0:cdf462088d13 352 return( ret );
markrad 0:cdf462088d13 353 }
markrad 0:cdf462088d13 354
markrad 0:cdf462088d13 355 crl->version++;
markrad 0:cdf462088d13 356
markrad 0:cdf462088d13 357 if( crl->version > 2 )
markrad 0:cdf462088d13 358 {
markrad 0:cdf462088d13 359 mbedtls_x509_crl_free( crl );
markrad 0:cdf462088d13 360 return( MBEDTLS_ERR_X509_UNKNOWN_VERSION );
markrad 0:cdf462088d13 361 }
markrad 0:cdf462088d13 362
markrad 0:cdf462088d13 363 if( ( ret = mbedtls_x509_get_sig_alg( &crl->sig_oid, &sig_params1,
markrad 0:cdf462088d13 364 &crl->sig_md, &crl->sig_pk,
markrad 0:cdf462088d13 365 &crl->sig_opts ) ) != 0 )
markrad 0:cdf462088d13 366 {
markrad 0:cdf462088d13 367 mbedtls_x509_crl_free( crl );
markrad 0:cdf462088d13 368 return( MBEDTLS_ERR_X509_UNKNOWN_SIG_ALG );
markrad 0:cdf462088d13 369 }
markrad 0:cdf462088d13 370
markrad 0:cdf462088d13 371 /*
markrad 0:cdf462088d13 372 * issuer Name
markrad 0:cdf462088d13 373 */
markrad 0:cdf462088d13 374 crl->issuer_raw.p = p;
markrad 0:cdf462088d13 375
markrad 0:cdf462088d13 376 if( ( ret = mbedtls_asn1_get_tag( &p, end, &len,
markrad 0:cdf462088d13 377 MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) ) != 0 )
markrad 0:cdf462088d13 378 {
markrad 0:cdf462088d13 379 mbedtls_x509_crl_free( crl );
markrad 0:cdf462088d13 380 return( MBEDTLS_ERR_X509_INVALID_FORMAT + ret );
markrad 0:cdf462088d13 381 }
markrad 0:cdf462088d13 382
markrad 0:cdf462088d13 383 if( ( ret = mbedtls_x509_get_name( &p, p + len, &crl->issuer ) ) != 0 )
markrad 0:cdf462088d13 384 {
markrad 0:cdf462088d13 385 mbedtls_x509_crl_free( crl );
markrad 0:cdf462088d13 386 return( ret );
markrad 0:cdf462088d13 387 }
markrad 0:cdf462088d13 388
markrad 0:cdf462088d13 389 crl->issuer_raw.len = p - crl->issuer_raw.p;
markrad 0:cdf462088d13 390
markrad 0:cdf462088d13 391 /*
markrad 0:cdf462088d13 392 * thisUpdate Time
markrad 0:cdf462088d13 393 * nextUpdate Time OPTIONAL
markrad 0:cdf462088d13 394 */
markrad 0:cdf462088d13 395 if( ( ret = mbedtls_x509_get_time( &p, end, &crl->this_update ) ) != 0 )
markrad 0:cdf462088d13 396 {
markrad 0:cdf462088d13 397 mbedtls_x509_crl_free( crl );
markrad 0:cdf462088d13 398 return( ret );
markrad 0:cdf462088d13 399 }
markrad 0:cdf462088d13 400
markrad 0:cdf462088d13 401 if( ( ret = mbedtls_x509_get_time( &p, end, &crl->next_update ) ) != 0 )
markrad 0:cdf462088d13 402 {
markrad 0:cdf462088d13 403 if( ret != ( MBEDTLS_ERR_X509_INVALID_DATE +
markrad 0:cdf462088d13 404 MBEDTLS_ERR_ASN1_UNEXPECTED_TAG ) &&
markrad 0:cdf462088d13 405 ret != ( MBEDTLS_ERR_X509_INVALID_DATE +
markrad 0:cdf462088d13 406 MBEDTLS_ERR_ASN1_OUT_OF_DATA ) )
markrad 0:cdf462088d13 407 {
markrad 0:cdf462088d13 408 mbedtls_x509_crl_free( crl );
markrad 0:cdf462088d13 409 return( ret );
markrad 0:cdf462088d13 410 }
markrad 0:cdf462088d13 411 }
markrad 0:cdf462088d13 412
markrad 0:cdf462088d13 413 /*
markrad 0:cdf462088d13 414 * revokedCertificates SEQUENCE OF SEQUENCE {
markrad 0:cdf462088d13 415 * userCertificate CertificateSerialNumber,
markrad 0:cdf462088d13 416 * revocationDate Time,
markrad 0:cdf462088d13 417 * crlEntryExtensions Extensions OPTIONAL
markrad 0:cdf462088d13 418 * -- if present, MUST be v2
markrad 0:cdf462088d13 419 * } OPTIONAL
markrad 0:cdf462088d13 420 */
markrad 0:cdf462088d13 421 if( ( ret = x509_get_entries( &p, end, &crl->entry ) ) != 0 )
markrad 0:cdf462088d13 422 {
markrad 0:cdf462088d13 423 mbedtls_x509_crl_free( crl );
markrad 0:cdf462088d13 424 return( ret );
markrad 0:cdf462088d13 425 }
markrad 0:cdf462088d13 426
markrad 0:cdf462088d13 427 /*
markrad 0:cdf462088d13 428 * crlExtensions EXPLICIT Extensions OPTIONAL
markrad 0:cdf462088d13 429 * -- if present, MUST be v2
markrad 0:cdf462088d13 430 */
markrad 0:cdf462088d13 431 if( crl->version == 2 )
markrad 0:cdf462088d13 432 {
markrad 0:cdf462088d13 433 ret = x509_get_crl_ext( &p, end, &crl->crl_ext );
markrad 0:cdf462088d13 434
markrad 0:cdf462088d13 435 if( ret != 0 )
markrad 0:cdf462088d13 436 {
markrad 0:cdf462088d13 437 mbedtls_x509_crl_free( crl );
markrad 0:cdf462088d13 438 return( ret );
markrad 0:cdf462088d13 439 }
markrad 0:cdf462088d13 440 }
markrad 0:cdf462088d13 441
markrad 0:cdf462088d13 442 if( p != end )
markrad 0:cdf462088d13 443 {
markrad 0:cdf462088d13 444 mbedtls_x509_crl_free( crl );
markrad 0:cdf462088d13 445 return( MBEDTLS_ERR_X509_INVALID_FORMAT +
markrad 0:cdf462088d13 446 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH );
markrad 0:cdf462088d13 447 }
markrad 0:cdf462088d13 448
markrad 0:cdf462088d13 449 end = crl->raw.p + crl->raw.len;
markrad 0:cdf462088d13 450
markrad 0:cdf462088d13 451 /*
markrad 0:cdf462088d13 452 * signatureAlgorithm AlgorithmIdentifier,
markrad 0:cdf462088d13 453 * signatureValue BIT STRING
markrad 0:cdf462088d13 454 */
markrad 0:cdf462088d13 455 if( ( ret = mbedtls_x509_get_alg( &p, end, &sig_oid2, &sig_params2 ) ) != 0 )
markrad 0:cdf462088d13 456 {
markrad 0:cdf462088d13 457 mbedtls_x509_crl_free( crl );
markrad 0:cdf462088d13 458 return( ret );
markrad 0:cdf462088d13 459 }
markrad 0:cdf462088d13 460
markrad 0:cdf462088d13 461 if( crl->sig_oid.len != sig_oid2.len ||
markrad 0:cdf462088d13 462 memcmp( crl->sig_oid.p, sig_oid2.p, crl->sig_oid.len ) != 0 ||
markrad 0:cdf462088d13 463 sig_params1.len != sig_params2.len ||
markrad 0:cdf462088d13 464 ( sig_params1.len != 0 &&
markrad 0:cdf462088d13 465 memcmp( sig_params1.p, sig_params2.p, sig_params1.len ) != 0 ) )
markrad 0:cdf462088d13 466 {
markrad 0:cdf462088d13 467 mbedtls_x509_crl_free( crl );
markrad 0:cdf462088d13 468 return( MBEDTLS_ERR_X509_SIG_MISMATCH );
markrad 0:cdf462088d13 469 }
markrad 0:cdf462088d13 470
markrad 0:cdf462088d13 471 if( ( ret = mbedtls_x509_get_sig( &p, end, &crl->sig ) ) != 0 )
markrad 0:cdf462088d13 472 {
markrad 0:cdf462088d13 473 mbedtls_x509_crl_free( crl );
markrad 0:cdf462088d13 474 return( ret );
markrad 0:cdf462088d13 475 }
markrad 0:cdf462088d13 476
markrad 0:cdf462088d13 477 if( p != end )
markrad 0:cdf462088d13 478 {
markrad 0:cdf462088d13 479 mbedtls_x509_crl_free( crl );
markrad 0:cdf462088d13 480 return( MBEDTLS_ERR_X509_INVALID_FORMAT +
markrad 0:cdf462088d13 481 MBEDTLS_ERR_ASN1_LENGTH_MISMATCH );
markrad 0:cdf462088d13 482 }
markrad 0:cdf462088d13 483
markrad 0:cdf462088d13 484 return( 0 );
markrad 0:cdf462088d13 485 }
markrad 0:cdf462088d13 486
markrad 0:cdf462088d13 487 /*
markrad 0:cdf462088d13 488 * Parse one or more CRLs and add them to the chained list
markrad 0:cdf462088d13 489 */
markrad 0:cdf462088d13 490 int mbedtls_x509_crl_parse( mbedtls_x509_crl *chain, const unsigned char *buf, size_t buflen )
markrad 0:cdf462088d13 491 {
markrad 0:cdf462088d13 492 #if defined(MBEDTLS_PEM_PARSE_C)
markrad 0:cdf462088d13 493 int ret;
markrad 0:cdf462088d13 494 size_t use_len;
markrad 0:cdf462088d13 495 mbedtls_pem_context pem;
markrad 0:cdf462088d13 496 int is_pem = 0;
markrad 0:cdf462088d13 497
markrad 0:cdf462088d13 498 if( chain == NULL || buf == NULL )
markrad 0:cdf462088d13 499 return( MBEDTLS_ERR_X509_BAD_INPUT_DATA );
markrad 0:cdf462088d13 500
markrad 0:cdf462088d13 501 do
markrad 0:cdf462088d13 502 {
markrad 0:cdf462088d13 503 mbedtls_pem_init( &pem );
markrad 0:cdf462088d13 504
markrad 0:cdf462088d13 505 // Avoid calling mbedtls_pem_read_buffer() on non-null-terminated
markrad 0:cdf462088d13 506 // string
markrad 0:cdf462088d13 507 if( buflen == 0 || buf[buflen - 1] != '\0' )
markrad 0:cdf462088d13 508 ret = MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT;
markrad 0:cdf462088d13 509 else
markrad 0:cdf462088d13 510 ret = mbedtls_pem_read_buffer( &pem,
markrad 0:cdf462088d13 511 "-----BEGIN X509 CRL-----",
markrad 0:cdf462088d13 512 "-----END X509 CRL-----",
markrad 0:cdf462088d13 513 buf, NULL, 0, &use_len );
markrad 0:cdf462088d13 514
markrad 0:cdf462088d13 515 if( ret == 0 )
markrad 0:cdf462088d13 516 {
markrad 0:cdf462088d13 517 /*
markrad 0:cdf462088d13 518 * Was PEM encoded
markrad 0:cdf462088d13 519 */
markrad 0:cdf462088d13 520 is_pem = 1;
markrad 0:cdf462088d13 521
markrad 0:cdf462088d13 522 buflen -= use_len;
markrad 0:cdf462088d13 523 buf += use_len;
markrad 0:cdf462088d13 524
markrad 0:cdf462088d13 525 if( ( ret = mbedtls_x509_crl_parse_der( chain,
markrad 0:cdf462088d13 526 pem.buf, pem.buflen ) ) != 0 )
markrad 0:cdf462088d13 527 {
markrad 0:cdf462088d13 528 return( ret );
markrad 0:cdf462088d13 529 }
markrad 0:cdf462088d13 530
markrad 0:cdf462088d13 531 mbedtls_pem_free( &pem );
markrad 0:cdf462088d13 532 }
markrad 0:cdf462088d13 533 else if( ret != MBEDTLS_ERR_PEM_NO_HEADER_FOOTER_PRESENT )
markrad 0:cdf462088d13 534 {
markrad 0:cdf462088d13 535 mbedtls_pem_free( &pem );
markrad 0:cdf462088d13 536 return( ret );
markrad 0:cdf462088d13 537 }
markrad 0:cdf462088d13 538 }
markrad 0:cdf462088d13 539 /* In the PEM case, buflen is 1 at the end, for the terminated NULL byte.
markrad 0:cdf462088d13 540 * And a valid CRL cannot be less than 1 byte anyway. */
markrad 0:cdf462088d13 541 while( is_pem && buflen > 1 );
markrad 0:cdf462088d13 542
markrad 0:cdf462088d13 543 if( is_pem )
markrad 0:cdf462088d13 544 return( 0 );
markrad 0:cdf462088d13 545 else
markrad 0:cdf462088d13 546 #endif /* MBEDTLS_PEM_PARSE_C */
markrad 0:cdf462088d13 547 return( mbedtls_x509_crl_parse_der( chain, buf, buflen ) );
markrad 0:cdf462088d13 548 }
markrad 0:cdf462088d13 549
markrad 0:cdf462088d13 550 #if defined(MBEDTLS_FS_IO)
markrad 0:cdf462088d13 551 /*
markrad 0:cdf462088d13 552 * Load one or more CRLs and add them to the chained list
markrad 0:cdf462088d13 553 */
markrad 0:cdf462088d13 554 int mbedtls_x509_crl_parse_file( mbedtls_x509_crl *chain, const char *path )
markrad 0:cdf462088d13 555 {
markrad 0:cdf462088d13 556 int ret;
markrad 0:cdf462088d13 557 size_t n;
markrad 0:cdf462088d13 558 unsigned char *buf;
markrad 0:cdf462088d13 559
markrad 0:cdf462088d13 560 if( ( ret = mbedtls_pk_load_file( path, &buf, &n ) ) != 0 )
markrad 0:cdf462088d13 561 return( ret );
markrad 0:cdf462088d13 562
markrad 0:cdf462088d13 563 ret = mbedtls_x509_crl_parse( chain, buf, n );
markrad 0:cdf462088d13 564
markrad 0:cdf462088d13 565 mbedtls_zeroize( buf, n );
markrad 0:cdf462088d13 566 mbedtls_free( buf );
markrad 0:cdf462088d13 567
markrad 0:cdf462088d13 568 return( ret );
markrad 0:cdf462088d13 569 }
markrad 0:cdf462088d13 570 #endif /* MBEDTLS_FS_IO */
markrad 0:cdf462088d13 571
markrad 0:cdf462088d13 572 /*
markrad 0:cdf462088d13 573 * Return an informational string about the certificate.
markrad 0:cdf462088d13 574 */
markrad 0:cdf462088d13 575 #define BEFORE_COLON 14
markrad 0:cdf462088d13 576 #define BC "14"
markrad 0:cdf462088d13 577 /*
markrad 0:cdf462088d13 578 * Return an informational string about the CRL.
markrad 0:cdf462088d13 579 */
markrad 0:cdf462088d13 580 int mbedtls_x509_crl_info( char *buf, size_t size, const char *prefix,
markrad 0:cdf462088d13 581 const mbedtls_x509_crl *crl )
markrad 0:cdf462088d13 582 {
markrad 0:cdf462088d13 583 int ret;
markrad 0:cdf462088d13 584 size_t n;
markrad 0:cdf462088d13 585 char *p;
markrad 0:cdf462088d13 586 const mbedtls_x509_crl_entry *entry;
markrad 0:cdf462088d13 587
markrad 0:cdf462088d13 588 p = buf;
markrad 0:cdf462088d13 589 n = size;
markrad 0:cdf462088d13 590
markrad 0:cdf462088d13 591 ret = mbedtls_snprintf( p, n, "%sCRL version : %d",
markrad 0:cdf462088d13 592 prefix, crl->version );
markrad 0:cdf462088d13 593 MBEDTLS_X509_SAFE_SNPRINTF;
markrad 0:cdf462088d13 594
markrad 0:cdf462088d13 595 ret = mbedtls_snprintf( p, n, "\n%sissuer name : ", prefix );
markrad 0:cdf462088d13 596 MBEDTLS_X509_SAFE_SNPRINTF;
markrad 0:cdf462088d13 597 ret = mbedtls_x509_dn_gets( p, n, &crl->issuer );
markrad 0:cdf462088d13 598 MBEDTLS_X509_SAFE_SNPRINTF;
markrad 0:cdf462088d13 599
markrad 0:cdf462088d13 600 ret = mbedtls_snprintf( p, n, "\n%sthis update : " \
markrad 0:cdf462088d13 601 "%04d-%02d-%02d %02d:%02d:%02d", prefix,
markrad 0:cdf462088d13 602 crl->this_update.year, crl->this_update.mon,
markrad 0:cdf462088d13 603 crl->this_update.day, crl->this_update.hour,
markrad 0:cdf462088d13 604 crl->this_update.min, crl->this_update.sec );
markrad 0:cdf462088d13 605 MBEDTLS_X509_SAFE_SNPRINTF;
markrad 0:cdf462088d13 606
markrad 0:cdf462088d13 607 ret = mbedtls_snprintf( p, n, "\n%snext update : " \
markrad 0:cdf462088d13 608 "%04d-%02d-%02d %02d:%02d:%02d", prefix,
markrad 0:cdf462088d13 609 crl->next_update.year, crl->next_update.mon,
markrad 0:cdf462088d13 610 crl->next_update.day, crl->next_update.hour,
markrad 0:cdf462088d13 611 crl->next_update.min, crl->next_update.sec );
markrad 0:cdf462088d13 612 MBEDTLS_X509_SAFE_SNPRINTF;
markrad 0:cdf462088d13 613
markrad 0:cdf462088d13 614 entry = &crl->entry;
markrad 0:cdf462088d13 615
markrad 0:cdf462088d13 616 ret = mbedtls_snprintf( p, n, "\n%sRevoked certificates:",
markrad 0:cdf462088d13 617 prefix );
markrad 0:cdf462088d13 618 MBEDTLS_X509_SAFE_SNPRINTF;
markrad 0:cdf462088d13 619
markrad 0:cdf462088d13 620 while( entry != NULL && entry->raw.len != 0 )
markrad 0:cdf462088d13 621 {
markrad 0:cdf462088d13 622 ret = mbedtls_snprintf( p, n, "\n%sserial number: ",
markrad 0:cdf462088d13 623 prefix );
markrad 0:cdf462088d13 624 MBEDTLS_X509_SAFE_SNPRINTF;
markrad 0:cdf462088d13 625
markrad 0:cdf462088d13 626 ret = mbedtls_x509_serial_gets( p, n, &entry->serial );
markrad 0:cdf462088d13 627 MBEDTLS_X509_SAFE_SNPRINTF;
markrad 0:cdf462088d13 628
markrad 0:cdf462088d13 629 ret = mbedtls_snprintf( p, n, " revocation date: " \
markrad 0:cdf462088d13 630 "%04d-%02d-%02d %02d:%02d:%02d",
markrad 0:cdf462088d13 631 entry->revocation_date.year, entry->revocation_date.mon,
markrad 0:cdf462088d13 632 entry->revocation_date.day, entry->revocation_date.hour,
markrad 0:cdf462088d13 633 entry->revocation_date.min, entry->revocation_date.sec );
markrad 0:cdf462088d13 634 MBEDTLS_X509_SAFE_SNPRINTF;
markrad 0:cdf462088d13 635
markrad 0:cdf462088d13 636 entry = entry->next;
markrad 0:cdf462088d13 637 }
markrad 0:cdf462088d13 638
markrad 0:cdf462088d13 639 ret = mbedtls_snprintf( p, n, "\n%ssigned using : ", prefix );
markrad 0:cdf462088d13 640 MBEDTLS_X509_SAFE_SNPRINTF;
markrad 0:cdf462088d13 641
markrad 0:cdf462088d13 642 ret = mbedtls_x509_sig_alg_gets( p, n, &crl->sig_oid, crl->sig_pk, crl->sig_md,
markrad 0:cdf462088d13 643 crl->sig_opts );
markrad 0:cdf462088d13 644 MBEDTLS_X509_SAFE_SNPRINTF;
markrad 0:cdf462088d13 645
markrad 0:cdf462088d13 646 ret = mbedtls_snprintf( p, n, "\n" );
markrad 0:cdf462088d13 647 MBEDTLS_X509_SAFE_SNPRINTF;
markrad 0:cdf462088d13 648
markrad 0:cdf462088d13 649 return( (int) ( size - n ) );
markrad 0:cdf462088d13 650 }
markrad 0:cdf462088d13 651
markrad 0:cdf462088d13 652 /*
markrad 0:cdf462088d13 653 * Initialize a CRL chain
markrad 0:cdf462088d13 654 */
markrad 0:cdf462088d13 655 void mbedtls_x509_crl_init( mbedtls_x509_crl *crl )
markrad 0:cdf462088d13 656 {
markrad 0:cdf462088d13 657 memset( crl, 0, sizeof(mbedtls_x509_crl) );
markrad 0:cdf462088d13 658 }
markrad 0:cdf462088d13 659
markrad 0:cdf462088d13 660 /*
markrad 0:cdf462088d13 661 * Unallocate all CRL data
markrad 0:cdf462088d13 662 */
markrad 0:cdf462088d13 663 void mbedtls_x509_crl_free( mbedtls_x509_crl *crl )
markrad 0:cdf462088d13 664 {
markrad 0:cdf462088d13 665 mbedtls_x509_crl *crl_cur = crl;
markrad 0:cdf462088d13 666 mbedtls_x509_crl *crl_prv;
markrad 0:cdf462088d13 667 mbedtls_x509_name *name_cur;
markrad 0:cdf462088d13 668 mbedtls_x509_name *name_prv;
markrad 0:cdf462088d13 669 mbedtls_x509_crl_entry *entry_cur;
markrad 0:cdf462088d13 670 mbedtls_x509_crl_entry *entry_prv;
markrad 0:cdf462088d13 671
markrad 0:cdf462088d13 672 if( crl == NULL )
markrad 0:cdf462088d13 673 return;
markrad 0:cdf462088d13 674
markrad 0:cdf462088d13 675 do
markrad 0:cdf462088d13 676 {
markrad 0:cdf462088d13 677 #if defined(MBEDTLS_X509_RSASSA_PSS_SUPPORT)
markrad 0:cdf462088d13 678 mbedtls_free( crl_cur->sig_opts );
markrad 0:cdf462088d13 679 #endif
markrad 0:cdf462088d13 680
markrad 0:cdf462088d13 681 name_cur = crl_cur->issuer.next;
markrad 0:cdf462088d13 682 while( name_cur != NULL )
markrad 0:cdf462088d13 683 {
markrad 0:cdf462088d13 684 name_prv = name_cur;
markrad 0:cdf462088d13 685 name_cur = name_cur->next;
markrad 0:cdf462088d13 686 mbedtls_zeroize( name_prv, sizeof( mbedtls_x509_name ) );
markrad 0:cdf462088d13 687 mbedtls_free( name_prv );
markrad 0:cdf462088d13 688 }
markrad 0:cdf462088d13 689
markrad 0:cdf462088d13 690 entry_cur = crl_cur->entry.next;
markrad 0:cdf462088d13 691 while( entry_cur != NULL )
markrad 0:cdf462088d13 692 {
markrad 0:cdf462088d13 693 entry_prv = entry_cur;
markrad 0:cdf462088d13 694 entry_cur = entry_cur->next;
markrad 0:cdf462088d13 695 mbedtls_zeroize( entry_prv, sizeof( mbedtls_x509_crl_entry ) );
markrad 0:cdf462088d13 696 mbedtls_free( entry_prv );
markrad 0:cdf462088d13 697 }
markrad 0:cdf462088d13 698
markrad 0:cdf462088d13 699 if( crl_cur->raw.p != NULL )
markrad 0:cdf462088d13 700 {
markrad 0:cdf462088d13 701 mbedtls_zeroize( crl_cur->raw.p, crl_cur->raw.len );
markrad 0:cdf462088d13 702 mbedtls_free( crl_cur->raw.p );
markrad 0:cdf462088d13 703 }
markrad 0:cdf462088d13 704
markrad 0:cdf462088d13 705 crl_cur = crl_cur->next;
markrad 0:cdf462088d13 706 }
markrad 0:cdf462088d13 707 while( crl_cur != NULL );
markrad 0:cdf462088d13 708
markrad 0:cdf462088d13 709 crl_cur = crl;
markrad 0:cdf462088d13 710 do
markrad 0:cdf462088d13 711 {
markrad 0:cdf462088d13 712 crl_prv = crl_cur;
markrad 0:cdf462088d13 713 crl_cur = crl_cur->next;
markrad 0:cdf462088d13 714
markrad 0:cdf462088d13 715 mbedtls_zeroize( crl_prv, sizeof( mbedtls_x509_crl ) );
markrad 0:cdf462088d13 716 if( crl_prv != crl )
markrad 0:cdf462088d13 717 mbedtls_free( crl_prv );
markrad 0:cdf462088d13 718 }
markrad 0:cdf462088d13 719 while( crl_cur != NULL );
markrad 0:cdf462088d13 720 }
markrad 0:cdf462088d13 721
markrad 0:cdf462088d13 722 #endif /* MBEDTLS_X509_CRL_PARSE_C */