39 #if defined(POLARSSL_X509_PARSE_C)
45 #if defined(POLARSSL_MD2_C)
48 #if defined(POLARSSL_MD4_C)
51 #if defined(POLARSSL_MD5_C)
54 #if defined(POLARSSL_SHA1_C)
57 #if defined(POLARSSL_SHA2_C)
60 #if defined(POLARSSL_SHA4_C)
73 #if defined(POLARSSL_FS_IO)
76 #include <sys/types.h>
84 static int x509_get_version(
unsigned char **p,
85 const unsigned char *end,
118 static int x509_crl_get_version(
unsigned char **p,
119 const unsigned char *end,
141 static int x509_get_serial(
unsigned char **p,
142 const unsigned char *end,
147 if( ( end - *p ) < 1 )
156 serial->
tag = *(*p)++;
172 static int x509_get_alg(
unsigned char **p,
173 const unsigned char *end,
217 static int x509_get_attr_type_value(
unsigned char **p,
218 const unsigned char *end,
239 if( ( end - *p ) < 1 )
275 static int x509_get_name(
unsigned char **p,
276 const unsigned char *end,
281 const unsigned char *end2;
294 if( ( ret = x509_get_attr_type_value( p, end, use ) ) != 0 )
302 if( use->
next == NULL )
321 if( cur->
next == NULL )
326 return( x509_get_name( p, end2, cur->
next ) );
334 static int x509_get_time(
unsigned char **p,
335 const unsigned char *end,
343 if( ( end - *p ) < 1 )
357 memset( date, 0,
sizeof( date ) );
358 memcpy( date, *p, ( len <
sizeof( date ) - 1 ) ?
359 len :
sizeof( date ) - 1 );
361 if( sscanf( date,
"%2d%2d%2d%2d%2d%2d",
366 time->
year += 100 * ( time->
year < 50 );
381 memset( date, 0,
sizeof( date ) );
382 memcpy( date, *p, ( len <
sizeof( date ) - 1 ) ?
383 len :
sizeof( date ) - 1 );
385 if( sscanf( date,
"%4d%2d%2d%2d%2d%2d",
404 static int x509_get_dates(
unsigned char **p,
405 const unsigned char *end,
418 if( ( ret = x509_get_time( p, end, from ) ) != 0 )
421 if( ( ret = x509_get_time( p, end, to ) ) != 0 )
436 static int x509_get_pubkey(
unsigned char **p,
437 const unsigned char *end,
445 if( ( ret = x509_get_alg( p, end, pk_alg_oid ) ) != 0 )
453 if( pk_alg_oid->
len == 9 &&
457 if( pk_alg_oid->
len == 9 &&
460 if( pk_alg_oid->
p[8] >= 2 && pk_alg_oid->
p[8] <= 5 )
463 if ( pk_alg_oid->
p[8] >= 11 && pk_alg_oid->
p[8] <= 14 )
467 if( pk_alg_oid->
len == 5 &&
471 if( can_handle == 0 )
477 if( ( end - *p ) < 1 )
496 if( *p + len != end2 )
511 static int x509_get_sig(
unsigned char **p,
512 const unsigned char *end,
518 if( ( end - *p ) < 1 )
528 if( --len < 1 || *(*p)++ != 0 )
542 static int x509_get_uid(
unsigned char **p,
543 const unsigned char *end,
572 static int x509_get_ext(
unsigned char **p,
573 const unsigned char *end,
603 if( end != *p + len )
613 static int x509_get_crl_ext(
unsigned char **p,
614 const unsigned char *end,
621 if( ( ret = x509_get_ext( p, end, ext, 0) ) != 0 )
648 static int x509_get_crl_entry_ext(
unsigned char **p,
649 const unsigned char *end,
679 if( end != *p + ext->
len )
699 static int x509_get_basic_constraints(
unsigned char **p,
700 const unsigned char *end,
730 if( *ca_istrue != 0 )
737 if( ( ret =
asn1_get_int( p, end, max_pathlen ) ) != 0 )
749 static int x509_get_ns_cert_type(
unsigned char **p,
750 const unsigned char *end,
751 unsigned char *ns_cert_type)
764 *ns_cert_type = *bs.
p;
768 static int x509_get_key_usage(
unsigned char **p,
769 const unsigned char *end,
770 unsigned char *key_usage)
792 static int x509_get_ext_key_usage(
unsigned char **p,
793 const unsigned char *end,
802 if( ext_key_usage->
buf.
p == NULL )
835 static int x509_get_subject_alt_name(
unsigned char **p,
836 const unsigned char *end,
850 if( *p + len != end )
856 if( ( end - *p ) < 1 )
869 if( tag != ( ASN1_CONTEXT_SPECIFIC | 2 ) )
887 if( cur->
next == NULL )
913 static int x509_get_crt_ext(
unsigned char **p,
914 const unsigned char *end,
919 unsigned char *end_ext_data, *end_ext_octet;
921 if( ( ret = x509_get_ext( p, end, &crt->
v3_ext, 3 ) ) != 0 )
944 end_ext_data = *p + len;
955 if( ( end - *p ) < 1 )
960 if( ( ret =
asn1_get_bool( p, end_ext_data, &is_critical ) ) != 0 &&
969 end_ext_octet = *p + len;
971 if( end_ext_octet != end_ext_data )
982 if( ( ret = x509_get_basic_constraints( p, end_ext_octet,
991 if( ( ret = x509_get_ns_cert_type( p, end_ext_octet,
1000 if( ( ret = x509_get_key_usage( p, end_ext_octet,
1009 if( ( ret = x509_get_ext_key_usage( p, end_ext_octet,
1018 if( ( ret = x509_get_subject_alt_name( p, end_ext_octet,
1028 #if !defined(POLARSSL_X509_ALLOW_UNSUPPORTED_CRITICAL_EXTENSION)
1049 static int x509_get_entries(
unsigned char **p,
1050 const unsigned char *end,
1069 end = *p + entry_len;
1074 const unsigned char *end2;
1082 cur_entry->
raw.
tag = **p;
1083 cur_entry->
raw.
p = *p;
1084 cur_entry->
raw.
len = len2;
1087 if( ( ret = x509_get_serial( p, end2, &cur_entry->
serial ) ) != 0 )
1090 if( ( ret = x509_get_time( p, end2, &cur_entry->
revocation_date ) ) != 0 )
1093 if( ( ret = x509_get_crl_entry_ext( p, end2, &cur_entry->
entry_ext ) ) != 0 )
1100 if( cur_entry->
next == NULL )
1103 cur_entry = cur_entry->
next;
1113 if( sig_oid->
len == 9 &&
1116 if( sig_oid->
p[8] >= 2 && sig_oid->
p[8] <= 5 )
1118 *sig_alg = sig_oid->
p[8];
1122 if ( sig_oid->
p[8] >= 11 && sig_oid->
p[8] <= 14 )
1124 *sig_alg = sig_oid->
p[8];
1130 if( sig_oid->
len == 5 &&
1143 int x509parse_crt_der(
x509_cert *crt,
const unsigned char *buf,
size_t buflen )
1147 unsigned char *p, *end, *crt_end;
1152 if( crt == NULL || buf == NULL )
1155 p = (
unsigned char *) malloc( len = buflen );
1160 memcpy( p, buf, buflen );
1181 if( len > (
size_t) ( end - p ) )
1211 if( ( ret = x509_get_version( &p, end, &crt->
version ) ) != 0 ||
1212 ( ret = x509_get_serial( &p, end, &crt->
serial ) ) != 0 ||
1213 ( ret = x509_get_alg( &p, end, &crt->
sig_oid1 ) ) != 0 )
1227 if( ( ret = x509_get_sig_alg( &crt->
sig_oid1, &crt->
sig_alg ) ) != 0 )
1245 if( ( ret = x509_get_name( &p, p + len, &crt->
issuer ) ) != 0 )
1259 if( ( ret = x509_get_dates( &p, end, &crt->
valid_from,
1278 if( len && ( ret = x509_get_name( &p, p + len, &crt->
subject ) ) != 0 )
1298 if( ( ret = x509_get_pubkey( &p, p + len, &crt->
pk_oid,
1299 &crt->
rsa.
N, &crt->
rsa.
E ) ) != 0 )
1323 ret = x509_get_uid( &p, end, &crt->
issuer_id, 1 );
1333 ret = x509_get_uid( &p, end, &crt->
subject_id, 2 );
1343 ret = x509_get_crt_ext( &p, end, crt);
1364 if( ( ret = x509_get_alg( &p, end, &crt->
sig_oid2 ) ) != 0 )
1377 if( ( ret = x509_get_sig( &p, end, &crt->
sig ) ) != 0 )
1398 int ret, success = 0, first_error = 0, total_failed = 0;
1407 if( crt == NULL || buf == NULL )
1423 if( crt->
next == NULL )
1435 #if defined(POLARSSL_PEM_C)
1436 if( strstr( (
char *) buf,
"-----BEGIN CERTIFICATE-----" ) != NULL )
1441 return x509parse_crt_der( crt, buf, buflen );
1443 #if defined(POLARSSL_PEM_C)
1454 "-----BEGIN CERTIFICATE-----",
1455 "-----END CERTIFICATE-----",
1456 buf, NULL, 0, &use_len );
1470 if( first_error == 0 )
1478 ret = x509parse_crt_der( crt, pem.
buf, pem.
buflen );
1498 if( first_error == 0 )
1514 if( crt->
next == NULL )
1534 return( total_failed );
1535 else if( first_error )
1536 return( first_error );
1548 unsigned char *p, *end;
1550 #if defined(POLARSSL_PEM_C)
1560 if( crl == NULL || buf == NULL )
1573 if( crl->
next == NULL )
1580 memset( crl, 0,
sizeof(
x509_crl ) );
1583 #if defined(POLARSSL_PEM_C)
1586 "-----BEGIN X509 CRL-----",
1587 "-----END X509 CRL-----",
1588 buf, NULL, 0, &use_len );
1616 p = (
unsigned char *) malloc( len = buflen );
1621 memcpy( p, buf, buflen );
1626 p = (
unsigned char *) malloc( len = buflen );
1631 memcpy( p, buf, buflen );
1653 if( len != (
size_t) ( end - p ) )
1681 if( ( ret = x509_crl_get_version( &p, end, &crl->
version ) ) != 0 ||
1682 ( ret = x509_get_alg( &p, end, &crl->
sig_oid1 ) ) != 0 )
1696 if( ( ret = x509_get_sig_alg( &crl->
sig_oid1, &crl->
sig_alg ) ) != 0 )
1714 if( ( ret = x509_get_name( &p, p + len, &crl->
issuer ) ) != 0 )
1726 if( ( ret = x509_get_time( &p, end, &crl->
this_update ) ) != 0 )
1732 if( ( ret = x509_get_time( &p, end, &crl->
next_update ) ) != 0 )
1752 if( ( ret = x509_get_entries( &p, end, &crl->
entry ) ) != 0 )
1764 ret = x509_get_crl_ext( &p, end, &crl->
crl_ext );
1786 if( ( ret = x509_get_alg( &p, end, &crl->
sig_oid2 ) ) != 0 )
1799 if( ( ret = x509_get_sig( &p, end, &crl->
sig ) ) != 0 )
1816 if( crl->
next == NULL )
1823 memset( crl, 0,
sizeof(
x509_crl ) );
1831 #if defined(POLARSSL_FS_IO)
1835 int load_file(
const char *path,
unsigned char **buf,
size_t *n )
1839 if( ( f = fopen( path,
"rb" ) ) == NULL )
1842 fseek( f, 0, SEEK_END );
1843 *n = (size_t) ftell( f );
1844 fseek( f, 0, SEEK_SET );
1846 if( ( *buf = (
unsigned char *) malloc( *n + 1 ) ) == NULL )
1849 if( fread( *buf, 1, *n, f ) != *n )
1872 if ( (ret = load_file( path, &buf, &n ) ) != 0 )
1877 memset( buf, 0, n + 1 );
1888 WCHAR szDir[MAX_PATH];
1889 char filename[MAX_PATH];
1891 int len = strlen( path );
1893 WIN32_FIND_DATAW file_data;
1896 if( len > MAX_PATH - 3 )
1899 memset( szDir, 0,
sizeof(szDir) );
1900 memset( filename, 0, MAX_PATH );
1901 memcpy( filename, path, len );
1902 filename[len++] =
'\\';
1904 filename[len++] =
'*';
1906 w_ret = MultiByteToWideChar( CP_ACP, 0, path, len, szDir, MAX_PATH - 3 );
1908 hFind = FindFirstFileW( szDir, &file_data );
1909 if (hFind == INVALID_HANDLE_VALUE)
1912 len = MAX_PATH - len;
1915 memset( p, 0, len );
1917 if( file_data.dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY )
1920 w_ret = WideCharToMultiByte( CP_ACP, 0, file_data.cFileName,
1921 lstrlenW(file_data.cFileName),
1934 while( FindNextFileW( hFind, &file_data ) != 0 );
1936 if (GetLastError() != ERROR_NO_MORE_FILES)
1943 struct dirent *entry;
1944 char entry_name[255];
1945 DIR *dir = opendir( path );
1950 while( ( entry = readdir( dir ) ) != NULL )
1952 if( entry->d_type != DT_REG )
1955 snprintf( entry_name,
sizeof(entry_name),
"%s/%s", path, entry->d_name );
1980 if ( (ret = load_file( path, &buf, &n ) ) != 0 )
1985 memset( buf, 0, n + 1 );
2000 if ( (ret = load_file( path, &buf, &n ) ) != 0 )
2007 (
unsigned char *) pwd, strlen( pwd ) );
2009 memset( buf, 0, n + 1 );
2024 if ( (ret = load_file( path, &buf, &n ) ) != 0 )
2029 memset( buf, 0, n + 1 );
2040 const unsigned char *pwd,
size_t pwdlen )
2044 unsigned char *p, *end;
2045 unsigned char *p_alt;
2048 #if defined(POLARSSL_PEM_C)
2053 "-----BEGIN RSA PRIVATE KEY-----",
2054 "-----END RSA PRIVATE KEY-----",
2055 key, pwd, pwdlen, &len );
2060 "-----BEGIN PRIVATE KEY-----",
2061 "-----END PRIVATE KEY-----",
2062 key, pwd, pwdlen, &len );
2078 p = ( ret == 0 ) ? pem.
buf : (
unsigned char *) key;
2082 p = (
unsigned char *) key;
2117 #if defined(POLARSSL_PEM_C)
2128 #if defined(POLARSSL_PEM_C)
2137 #if defined(POLARSSL_PEM_C)
2146 if( ( ret = x509_get_alg( &p_alt, end, &pk_alg_oid ) ) != 0 )
2154 #if defined(POLARSSL_PEM_C)
2170 if( pk_alg_oid.
len == 9 &&
2174 if( pk_alg_oid.
len == 9 &&
2177 if( pk_alg_oid.
p[8] >= 2 && pk_alg_oid.
p[8] <= 5 )
2180 if ( pk_alg_oid.
p[8] >= 11 && pk_alg_oid.
p[8] <= 14 )
2184 if( pk_alg_oid.
len == 5 &&
2188 if( can_handle == 0 )
2198 #if defined(POLARSSL_PEM_C)
2205 if( ( end - p ) < 1 )
2207 #if defined(POLARSSL_PEM_C)
2220 #if defined(POLARSSL_PEM_C)
2231 #if defined(POLARSSL_PEM_C)
2240 #if defined(POLARSSL_PEM_C)
2257 #if defined(POLARSSL_PEM_C)
2268 #if defined(POLARSSL_PEM_C)
2278 #if defined(POLARSSL_PEM_C)
2285 #if defined(POLARSSL_PEM_C)
2299 unsigned char *p, *end;
2301 #if defined(POLARSSL_PEM_C)
2306 "-----BEGIN PUBLIC KEY-----",
2307 "-----END PUBLIC KEY-----",
2308 key, NULL, 0, &len );
2323 p = ( ret == 0 ) ? pem.
buf : (
unsigned char *) key;
2325 p = (
unsigned char *) key;
2349 #if defined(POLARSSL_PEM_C)
2356 if( ( ret = x509_get_pubkey( &p, end, &alg_oid, &rsa->
N, &rsa->
E ) ) != 0 )
2358 #if defined(POLARSSL_PEM_C)
2367 #if defined(POLARSSL_PEM_C)
2376 #if defined(POLARSSL_PEM_C)
2383 #if defined(POLARSSL_DHM_C)
2391 unsigned char *p, *end;
2392 #if defined(POLARSSL_PEM_C)
2398 "-----BEGIN DH PARAMETERS-----",
2399 "-----END DH PARAMETERS-----",
2400 dhmin, NULL, 0, &dhminlen );
2415 p = ( ret == 0 ) ? pem.
buf : (
unsigned char *) dhmin;
2417 p = (
unsigned char *) dhmin;
2432 #if defined(POLARSSL_PEM_C)
2443 #if defined(POLARSSL_PEM_C)
2452 #if defined(POLARSSL_PEM_C)
2460 #if defined(POLARSSL_PEM_C)
2467 #if defined(POLARSSL_FS_IO)
2477 if ( ( ret = load_file( path, &buf, &n ) ) != 0 )
2482 memset( buf, 0, n + 1 );
2490 #if defined _MSC_VER && !defined snprintf
2493 #if !defined vsnprintf
2494 #define vsnprintf _vsnprintf
2504 int compat_snprintf(
char *str,
size_t size,
const char *format, ...)
2509 va_start( ap, format );
2511 res = vsnprintf( str, size, format, ap );
2517 return( (
int) size + 20 );
2522 #define snprintf compat_snprintf
2525 #define POLARSSL_ERR_DEBUG_BUF_TOO_SMALL -2
2527 #define SAFE_SNPRINTF() \
2532 if ( (unsigned int) ret > n ) { \
2534 return POLARSSL_ERR_DEBUG_BUF_TOO_SMALL;\
2537 n -= (unsigned int) ret; \
2538 p += (unsigned int) ret; \
2553 memset( s, 0,
sizeof( s ) );
2559 while( name != NULL )
2569 ret = snprintf( p, n,
", " );
2573 if( name->
oid.
len == 3 &&
2576 switch( name->
oid.
p[2] )
2579 ret = snprintf( p, n,
"CN=" );
break;
2582 ret = snprintf( p, n,
"C=" );
break;
2585 ret = snprintf( p, n,
"L=" );
break;
2588 ret = snprintf( p, n,
"ST=" );
break;
2591 ret = snprintf( p, n,
"O=" );
break;
2594 ret = snprintf( p, n,
"OU=" );
break;
2597 ret = snprintf( p, n,
"0x%02X=",
2603 else if( name->
oid.
len == 9 &&
2606 switch( name->
oid.
p[8] )
2609 ret = snprintf( p, n,
"emailAddress=" );
break;
2612 ret = snprintf( p, n,
"0x%02X=",
2620 ret = snprintf( p, n,
"\?\?=" );
2624 for( i = 0; i < name->
val.
len; i++ )
2626 if( i >=
sizeof( s ) - 1 )
2630 if( c < 32 || c == 127 || ( c > 128 && c < 160 ) )
2635 ret = snprintf( p, n,
"%s", s );
2640 return( (
int) ( size - n ) );
2656 nr = ( serial->
len <= 32 )
2659 for( i = 0; i < nr; i++ )
2661 if( i == 0 && nr > 1 && serial->
p[i] == 0x0 )
2664 ret = snprintf( p, n,
"%02X%s",
2665 serial->
p[i], ( i < nr - 1 ) ?
":" :
"" );
2669 if( nr != serial->
len )
2671 ret = snprintf( p, n,
"...." );
2675 return( (
int) ( size - n ) );
2691 ret = snprintf( p, n,
"%scert. version : %d\n",
2694 ret = snprintf( p, n,
"%sserial number : ",
2701 ret = snprintf( p, n,
"\n%sissuer name : ", prefix );
2706 ret = snprintf( p, n,
"\n%ssubject name : ", prefix );
2711 ret = snprintf( p, n,
"\n%sissued on : " \
2712 "%04d-%02d-%02d %02d:%02d:%02d", prefix,
2718 ret = snprintf( p, n,
"\n%sexpires on : " \
2719 "%04d-%02d-%02d %02d:%02d:%02d", prefix,
2725 ret = snprintf( p, n,
"\n%ssigned using : RSA+", prefix );
2730 case SIG_RSA_MD2 : ret = snprintf( p, n,
"MD2" );
break;
2731 case SIG_RSA_MD4 : ret = snprintf( p, n,
"MD4" );
break;
2732 case SIG_RSA_MD5 : ret = snprintf( p, n,
"MD5" );
break;
2733 case SIG_RSA_SHA1 : ret = snprintf( p, n,
"SHA1" );
break;
2738 default: ret = snprintf( p, n,
"???" );
break;
2742 ret = snprintf( p, n,
"\n%sRSA key size : %d bits\n", prefix,
2743 (
int) crt->
rsa.
N.
n * (
int)
sizeof(
t_uint ) * 8 );
2746 return( (
int) ( size - n ) );
2750 #define OID_CMP(oid_str, oid_buf) \
2751 ( ( OID_SIZE(oid_str) == (oid_buf)->len ) && \
2752 memcmp( (oid_str), (oid_buf)->p, (oid_buf)->len) == 0)
2797 ret = snprintf( p, n,
"%d.%d", oid->
p[0]/40, oid->
p[0]%40 );
2803 for( i = 1; i < oid->
len; i++ )
2806 value += oid->
p[i] & 0x7F;
2808 if( !( oid->
p[i] & 0x80 ) )
2811 ret = snprintf( p, n,
".%d", value );
2817 return( (
int) ( size - n ) );
2834 ret = snprintf( p, n,
"%sCRL version : %d",
2838 ret = snprintf( p, n,
"\n%sissuer name : ", prefix );
2843 ret = snprintf( p, n,
"\n%sthis update : " \
2844 "%04d-%02d-%02d %02d:%02d:%02d", prefix,
2850 ret = snprintf( p, n,
"\n%snext update : " \
2851 "%04d-%02d-%02d %02d:%02d:%02d", prefix,
2857 entry = &crl->
entry;
2859 ret = snprintf( p, n,
"\n%sRevoked certificates:",
2863 while( entry != NULL && entry->
raw.
len != 0 )
2865 ret = snprintf( p, n,
"\n%sserial number: ",
2872 ret = snprintf( p, n,
" revocation date: " \
2873 "%04d-%02d-%02d %02d:%02d:%02d",
2879 entry = entry->
next;
2882 ret = snprintf( p, n,
"\n%ssigned using : RSA+", prefix );
2887 case SIG_RSA_MD2 : ret = snprintf( p, n,
"MD2" );
break;
2888 case SIG_RSA_MD4 : ret = snprintf( p, n,
"MD4" );
break;
2889 case SIG_RSA_MD5 : ret = snprintf( p, n,
"MD5" );
break;
2890 case SIG_RSA_SHA1 : ret = snprintf( p, n,
"SHA1" );
break;
2895 default: ret = snprintf( p, n,
"???" );
break;
2899 ret = snprintf( p, n,
"\n" );
2902 return( (
int) ( size - n ) );
2929 lt = localtime( &tt );
2931 year = lt->tm_year + 1900;
2932 mon = lt->tm_mon + 1;
2939 if( year > to->
year )
2942 if( year == to->
year &&
2946 if( year == to->
year &&
2951 if( year == to->
year &&
2957 if( year == to->
year &&
2964 if( year == to->
year &&
2982 while( cur != NULL && cur->
serial.
len != 0 )
3000 static void x509_hash(
const unsigned char *in,
size_t len,
int alg,
3001 unsigned char *out )
3005 #if defined(POLARSSL_MD2_C)
3008 #if defined(POLARSSL_MD4_C)
3011 #if defined(POLARSSL_MD5_C)
3014 #if defined(POLARSSL_SHA1_C)
3017 #if defined(POLARSSL_SHA2_C)
3021 #if defined(POLARSSL_SHA4_C)
3026 memset( out,
'\xFF', 64 );
3039 unsigned char hash[64];
3050 while( crl_list != NULL )
3057 crl_list = crl_list->
next;
3066 x509_hash( crl_list->
tbs.
p, crl_list->
tbs.
len, hash_id, hash );
3069 0, hash, crl_list->
sig.
p ) == 0 )
3093 crl_list = crl_list->
next;
3098 int x509_wildcard_verify(
const char *cn,
x509_buf *name )
3103 if( name->
len < 3 || name->
p[0] !=
'*' || name->
p[1] !=
'.' )
3106 for( i = 0; i < strlen( cn ); ++i )
3118 if( strlen( cn ) - cn_idx == name->
len - 1 &&
3119 memcmp( name->
p + 1, cn + cn_idx, name->
len - 1 ) == 0 )
3127 static int x509parse_verify_top(
3129 x509_crl *ca_crl,
int path_cnt,
int *flags,
3130 int (*f_vrfy)(
void *,
x509_cert *,
int,
int *),
3134 int ca_flags = 0, check_path_cnt = path_cnt + 1;
3135 unsigned char hash[64];
3145 while( trust_ca != NULL )
3152 trust_ca = trust_ca->
next;
3170 trust_ca = trust_ca->
next;
3176 x509_hash( child->
tbs.
p, child->
tbs.
len, hash_id, hash );
3179 0, hash, child->
sig.
p ) != 0 )
3181 trust_ca = trust_ca->
next;
3197 if( trust_ca != NULL &&
3203 *flags |= x509parse_verifycrl( child, trust_ca, ca_crl );
3208 if( NULL != f_vrfy )
3210 if( ( ret = f_vrfy( p_vrfy, trust_ca, path_cnt + 1, &ca_flags ) ) != 0 )
3216 if( NULL != f_vrfy )
3218 if( ( ret = f_vrfy(p_vrfy, child, path_cnt, flags ) ) != 0 )
3227 static int x509parse_verify_child(
3229 x509_crl *ca_crl,
int path_cnt,
int *flags,
3230 int (*f_vrfy)(
void *,
x509_cert *,
int,
int *),
3234 int parent_flags = 0;
3235 unsigned char hash[64];
3243 x509_hash( child->
tbs.
p, child->
tbs.
len, hash_id, hash );
3246 child->
sig.
p ) != 0 )
3250 *flags |= x509parse_verifycrl(child, parent, ca_crl);
3252 grandparent = parent->
next;
3254 while( grandparent != NULL )
3256 if( grandparent->
version == 0 ||
3262 grandparent = grandparent->
next;
3268 if( grandparent != NULL )
3273 ret = x509parse_verify_child( parent, grandparent, trust_ca, ca_crl, path_cnt + 1, &parent_flags, f_vrfy, p_vrfy );
3279 ret = x509parse_verify_top( parent, trust_ca, ca_crl, path_cnt + 1, &parent_flags, f_vrfy, p_vrfy );
3285 if( NULL != f_vrfy )
3286 if( ( ret = f_vrfy( p_vrfy, child, path_cnt, flags ) ) != 0 )
3289 *flags |= parent_flags;
3300 const char *cn,
int *flags,
3301 int (*f_vrfy)(
void *,
x509_cert *,
int,
int *),
3316 cn_len = strlen( cn );
3322 while( cur != NULL )
3324 if( cur->
buf.
len == cn_len &&
3325 memcmp( cn, cur->
buf.
p, cn_len ) == 0 )
3329 memcmp( cur->
buf.
p,
"*.", 2 ) == 0 &&
3330 x509_wildcard_verify( cn, &cur->
buf ) )
3341 while( name != NULL )
3343 if( name->
oid.
len == 3 &&
3346 if( name->
val.
len == cn_len &&
3347 memcmp( name->
val.
p, cn, cn_len ) == 0 )
3351 memcmp( name->
val.
p,
"*.", 2 ) == 0 &&
3352 x509_wildcard_verify( cn, &name->
val ) )
3370 while( parent != NULL && parent->
version != 0 )
3377 parent = parent->
next;
3383 if( parent != NULL )
3388 ret = x509parse_verify_child( crt, parent, trust_ca, ca_crl, pathlen, flags, f_vrfy, p_vrfy );
3394 ret = x509parse_verify_top( crt, trust_ca, ca_crl, pathlen, flags, f_vrfy, p_vrfy );
3425 while( name_cur != NULL )
3427 name_prv = name_cur;
3428 name_cur = name_cur->
next;
3429 memset( name_prv, 0,
sizeof(
x509_name ) );
3434 while( name_cur != NULL )
3436 name_prv = name_cur;
3437 name_cur = name_cur->
next;
3438 memset( name_prv, 0,
sizeof(
x509_name ) );
3443 while( seq_cur != NULL )
3446 seq_cur = seq_cur->
next;
3452 while( seq_cur != NULL )
3455 seq_cur = seq_cur->
next;
3460 if( cert_cur->
raw.
p != NULL )
3462 memset( cert_cur->
raw.
p, 0, cert_cur->
raw.
len );
3463 free( cert_cur->
raw.
p );
3466 cert_cur = cert_cur->
next;
3468 while( cert_cur != NULL );
3473 cert_prv = cert_cur;
3474 cert_cur = cert_cur->
next;
3476 memset( cert_prv, 0,
sizeof(
x509_cert ) );
3477 if( cert_prv != crt )
3480 while( cert_cur != NULL );
3501 while( name_cur != NULL )
3503 name_prv = name_cur;
3504 name_cur = name_cur->
next;
3505 memset( name_prv, 0,
sizeof(
x509_name ) );
3510 while( entry_cur != NULL )
3512 entry_prv = entry_cur;
3513 entry_cur = entry_cur->
next;
3518 if( crl_cur->
raw.
p != NULL )
3520 memset( crl_cur->
raw.
p, 0, crl_cur->
raw.
len );
3521 free( crl_cur->
raw.
p );
3524 crl_cur = crl_cur->
next;
3526 while( crl_cur != NULL );
3532 crl_cur = crl_cur->
next;
3534 memset( crl_prv, 0,
sizeof(
x509_crl ) );
3535 if( crl_prv != crl )
3538 while( crl_cur != NULL );
3541 #if defined(POLARSSL_SELF_TEST)
3550 #if defined(POLARSSL_CERTS_C) && defined(POLARSSL_MD5_C)
3557 #if defined(POLARSSL_DHM_C)
3562 printf(
" X.509 certificate load: " );
3564 memset( &clicert, 0,
sizeof(
x509_cert ) );
3566 ret =
x509parse_crt( &clicert, (
unsigned char *) test_cli_crt,
3567 strlen( test_cli_crt ) );
3571 printf(
"failed\n" );
3576 memset( &cacert, 0,
sizeof(
x509_cert ) );
3578 ret =
x509parse_crt( &cacert, (
unsigned char *) test_ca_crt,
3579 strlen( test_ca_crt ) );
3583 printf(
"failed\n" );
3589 printf(
"passed\n X.509 private key load: " );
3591 i = strlen( test_ca_key );
3592 j = strlen( test_ca_pwd );
3597 (
unsigned char *) test_ca_key, i,
3598 (
unsigned char *) test_ca_pwd, j ) ) != 0 )
3601 printf(
"failed\n" );
3607 printf(
"passed\n X.509 signature verify: ");
3609 ret =
x509parse_verify( &clicert, &cacert, NULL,
"PolarSSL Client 2", &flags, NULL, NULL );
3612 printf(
"%02x", flags);
3614 printf(
"failed\n" );
3619 #if defined(POLARSSL_DHM_C)
3621 printf(
"passed\n X.509 DHM parameter load: " );
3623 i = strlen( test_dhm_params );
3624 j = strlen( test_ca_pwd );
3626 if( ( ret =
x509parse_dhm( &dhm, (
unsigned char *) test_dhm_params, i ) ) != 0 )
3629 printf(
"failed\n" );
3635 printf(
"passed\n\n" );
3641 #if defined(POLARSSL_DHM_C)