add crl function-openHiTLS-AtomGit

Mbsl/obj/src/bsl_obj.c+7-0

	@@ -82,7 +82,14 @@ BslOidInfo g_oidTable[] = {
82	{{3, "\125\35\17", BSL_OID_GLOBAL}, "KeyUsage", BSL_CID_CE_KEYUSAGE},	82	{{3, "\125\35\17", BSL_OID_GLOBAL}, "KeyUsage", BSL_CID_CE_KEYUSAGE},
83	{{3, "\125\35\21", BSL_OID_GLOBAL}, "SubjectAltName", BSL_CID_CE_SUBJECTALTNAME},	83	{{3, "\125\35\21", BSL_OID_GLOBAL}, "SubjectAltName", BSL_CID_CE_SUBJECTALTNAME},
84	{{3, "\125\35\23", BSL_OID_GLOBAL}, "BasicConstraints", BSL_CID_CE_BASICCONSTRAINTS},	84	{{3, "\125\35\23", BSL_OID_GLOBAL}, "BasicConstraints", BSL_CID_CE_BASICCONSTRAINTS},
		85	{{3, "\125\35\24", BSL_OID_GLOBAL}, "CrlNumber", BSL_CID_CE_CRLNUMBER},
		86	{{3, "\125\35\25", BSL_OID_GLOBAL}, "CrlReason", BSL_CID_CE_CRLREASON},
		87	{{3, "\125\35\30", BSL_OID_GLOBAL}, "InvalidityDate", BSL_CID_CE_INVALIDITYDATE},
		88	{{3, "\125\35\33", BSL_OID_GLOBAL}, "DeltaCrlIndicator", BSL_CID_CE_DELTACRLINDICATOR},
		89	{{3, "\125\35\34", BSL_OID_GLOBAL}, "IssuingDistributionPoint", BSL_CID_CE_ISSUINGDISTRIBUTIONPOINT},
		90	{{3, "\125\35\35", BSL_OID_GLOBAL}, "CertificateIssuer", BSL_CID_CE_CERTIFICATEISSUER},
85	{{3, "\125\35\45", BSL_OID_GLOBAL}, "ExtendedKeyUsage", BSL_CID_CE_EXTENDEDKEYUSAGE},	91	{{3, "\125\35\45", BSL_OID_GLOBAL}, "ExtendedKeyUsage", BSL_CID_CE_EXTENDEDKEYUSAGE},
		92	{{3, "\125\35\56", BSL_OID_GLOBAL}, "FreshestCRL", BSL_CID_CE_FRESHESTCRL},
86	{{8, "\53\6\1\5\5\7\3\1", BSL_OID_GLOBAL}, "ServerAuth", BSL_CID_CE_SERVERAUTH},	93	{{8, "\53\6\1\5\5\7\3\1", BSL_OID_GLOBAL}, "ServerAuth", BSL_CID_CE_SERVERAUTH},
87	{{8, "\53\6\1\5\5\7\3\2", BSL_OID_GLOBAL}, "ClientAuth", BSL_CID_CE_CLIENTAUTH},	94	{{8, "\53\6\1\5\5\7\3\2", BSL_OID_GLOBAL}, "ClientAuth", BSL_CID_CE_CLIENTAUTH},
88	{{8, "\53\6\1\5\5\7\3\3", BSL_OID_GLOBAL}, "CodeSigning", BSL_CID_CE_CODESIGNING},	95	{{8, "\53\6\1\5\5\7\3\3", BSL_OID_GLOBAL}, "CodeSigning", BSL_CID_CE_CODESIGNING},

Mcrypto/encode/src/crypt_eal_encode.c+10-10

	@@ -303,18 +303,21 @@ static int32_t EncodeAlgoIdAsn1Buff(BSL_ASN1_Buffer *algoId, uint32_t algoIdNum,
303		303
304	static int32_t ProcRsaPssParam(BSL_ASN1_Buffer rsaPssParam, CRYPT_EAL_PkeyCtx ealPriKey)	304	static int32_t ProcRsaPssParam(BSL_ASN1_Buffer rsaPssParam, CRYPT_EAL_PkeyCtx ealPriKey)
305	{	305	{
306	CRYPT_RSA_PssPara para = {0};
307	int32_t ret = CRYPT_EAL_ParseRsaPssAlgParam(rsaPssParam, &para);
308	if (ret != CRYPT_SUCCESS) {
309	return ret;
310	}
311
312	CRYPT_RsaPadType padType = CRYPT_PKEY_EMSA_PSS;	306	CRYPT_RsaPadType padType = CRYPT_PKEY_EMSA_PSS;
313	ret = CRYPT_EAL_PkeyCtrl(ealPriKey, CRYPT_CTRL_SET_RSA_PADDING, &padType, sizeof(CRYPT_RsaPadType));	307	int32_t ret = CRYPT_EAL_PkeyCtrl(ealPriKey, CRYPT_CTRL_SET_RSA_PADDING, &padType, sizeof(CRYPT_RsaPadType));
314	if (ret != CRYPT_SUCCESS) {	308	if (ret != CRYPT_SUCCESS) {
315	BSL_ERR_PUSH_ERROR(ret);	309	BSL_ERR_PUSH_ERROR(ret);
316	return ret;	310	return ret;
317	}	311	}
		312	if (rsaPssParam == NULL \|\| rsaPssParam->buff == NULL) {
		313	return CRYPT_SUCCESS;
		314	}
		315
		316	CRYPT_RSA_PssPara para = {0};
		317	ret = CRYPT_EAL_ParseRsaPssAlgParam(rsaPssParam, &para);
		318	if (ret != CRYPT_SUCCESS) {
		319	return ret;
		320	}
318		321
319	return CRYPT_EAL_PkeyCtrl(ealPriKey, CRYPT_CTRL_SET_RSA_EMSA_PSS, &para, sizeof(CRYPT_RSA_PssPara));	322	return CRYPT_EAL_PkeyCtrl(ealPriKey, CRYPT_CTRL_SET_RSA_EMSA_PSS, &para, sizeof(CRYPT_RSA_PssPara));
320	}	323	}
	@@ -602,9 +605,6 @@ int32_t CRYPT_EAL_ParseRsaPssAlgParam(BSL_ASN1_Buffer *param, CRYPT_RSA_PssPara
602	para->mdId = (CRYPT_MD_AlgId)BSL_CID_SHA1; // hashAlgorithm [0] HashAlgorithm DEFAULT sha1Identifier,	605	para->mdId = (CRYPT_MD_AlgId)BSL_CID_SHA1; // hashAlgorithm [0] HashAlgorithm DEFAULT sha1Identifier,
603	para->mgfId = (CRYPT_MD_AlgId)BSL_CID_SHA1; // maskGenAlgorithm [1] MaskGenAlgorithm DEFAULT mgf1SHA1Identifier,	606	para->mgfId = (CRYPT_MD_AlgId)BSL_CID_SHA1; // maskGenAlgorithm [1] MaskGenAlgorithm DEFAULT mgf1SHA1Identifier,
604	para->saltLen = 20; // saltLength [2] INTEGER DEFAULT 20	607	para->saltLen = 20; // saltLength [2] INTEGER DEFAULT 20
605	if (param == NULL \|\| param->buff == NULL) {
606	return CRYPT_SUCCESS;
607	}
608		608
609	uint8_t *temp = param->buff;	609	uint8_t *temp = param->buff;
610	uint32_t tempLen = param->len;	610	uint32_t tempLen = param->len;

Minclude/bsl/bsl_obj.h+7-0

	@@ -207,7 +207,14 @@ typedef enum {
207	BSL_CID_CE_KEYUSAGE,	207	BSL_CID_CE_KEYUSAGE,
208	BSL_CID_CE_SUBJECTALTNAME,	208	BSL_CID_CE_SUBJECTALTNAME,
209	BSL_CID_CE_BASICCONSTRAINTS,	209	BSL_CID_CE_BASICCONSTRAINTS,
		210	BSL_CID_CE_CRLNUMBER,
		211	BSL_CID_CE_CRLREASON,
		212	BSL_CID_CE_INVALIDITYDATE,
		213	BSL_CID_CE_DELTACRLINDICATOR,
		214	BSL_CID_CE_ISSUINGDISTRIBUTIONPOINT,
		215	BSL_CID_CE_CERTIFICATEISSUER,
210	BSL_CID_CE_EXTENDEDKEYUSAGE,	216	BSL_CID_CE_EXTENDEDKEYUSAGE,
		217	BSL_CID_CE_FRESHESTCRL,
211	BSL_CID_CE_SERVERAUTH,	218	BSL_CID_CE_SERVERAUTH,
212	BSL_CID_CE_CLIENTAUTH,	219	BSL_CID_CE_CLIENTAUTH,
213	BSL_CID_CE_CODESIGNING,	220	BSL_CID_CE_CODESIGNING,

Mtestcode/framework/tls/rpc/src/hlt_func.c+1-0

	@@ -200,6 +200,7 @@ int HLT_GetTlsAcceptResult(HLT_Tls_Res* tlsRes)
200	} else {	200	} else {
201	// Indicates that the local process accepts the request.	201	// Indicates that the local process accepts the request.
202	pthread_join(tlsRes->acceptId, NULL);	202	pthread_join(tlsRes->acceptId, NULL);
		203	tlsRes->acceptId = 0;
203	return SUCCESS;	204	return SUCCESS;
204	}	205	}
205	tlsRes->acceptId = 0;	206	tlsRes->acceptId = 0;

Mtestcode/sdv/testcase/bsl/sal/test_suite_sdv_sal.c+1-1

	@@ -755,7 +755,7 @@ void SDV_BSL_SAL_THREAD_DEFAULT_FUNC_TC001(void)
755	BSL_SAL_ThreadClose(pid[j]);	755	BSL_SAL_ThreadClose(pid[j]);
756	}	756	}
757	for (size_t n = 0; n < m; n++) {	757	for (size_t n = 0; n < m; n++) {
758	BSL_SAL_ThreadClose(pid[n]);	758	BSL_SAL_ThreadClose(pid2[n]);
759	}	759	}
760	ASSERT_EQ(g_threadDefaultWrite001, TEST_READ_PID_CNT * TEST_THREAD_DEFAULT_TC001_WRITE_CNT);	760	ASSERT_EQ(g_threadDefaultWrite001, TEST_READ_PID_CNT * TEST_THREAD_DEFAULT_TC001_WRITE_CNT);
761	// Concurrent reads. The read result is uncertain and does not determine whether to perform the read operation.	761	// Concurrent reads. The read result is uncertain and does not determine whether to perform the read operation.

Mtestcode/sdv/testcase/crypto/sm2/test_suite_sdv_eal_sm2_exchange.c+1-1

	@@ -562,7 +562,7 @@ exit:
562	/* BEGIN_CASE */	562	/* BEGIN_CASE */
563	void SDV_CRYPTO_SM2_CTRL_API_TC002(Hex *R, int isProvider)	563	void SDV_CRYPTO_SM2_CTRL_API_TC002(Hex *R, int isProvider)
564	{	564	{
565	uint8_t zero[65];	565	uint8_t zero[65] = {0};
566		566
567	TestMemInit();	567	TestMemInit();
568	CRYPT_EAL_PkeyCtx *ctx = NULL;	568	CRYPT_EAL_PkeyCtx *ctx = NULL;

Mtestcode/sdv/testcase/x509/cert/test_suite_sdv_x509_cert.c+23-24

	@@ -553,7 +553,7 @@ void SDV_X509_CERT_CTRL_FUNC_TC002(char path, char expectedSerialNum, char *ex
553	ASSERT_EQ(issuerName.dataLen, strlen(expectedIssueName));	553	ASSERT_EQ(issuerName.dataLen, strlen(expectedIssueName));
554	ASSERT_EQ(strcmp((char *)issuerName.data, expectedIssueName), 0);	554	ASSERT_EQ(strcmp((char *)issuerName.data, expectedIssueName), 0);
555		555
556	ret = HITLS_X509_CertCtrl(cert, HITLS_X509_GET_SERIALNUM, &serialNum, sizeof(BSL_Buffer));	556	ret = HITLS_X509_CertCtrl(cert, HITLS_X509_GET_SERIALNUM_STR, &serialNum, sizeof(BSL_Buffer));
557	ASSERT_EQ(ret, HITLS_X509_SUCCESS);	557	ASSERT_EQ(ret, HITLS_X509_SUCCESS);
558	ASSERT_NE(serialNum.data, NULL);	558	ASSERT_NE(serialNum.data, NULL);
559	ASSERT_EQ(serialNum.dataLen, strlen(expectedSerialNum));	559	ASSERT_EQ(serialNum.dataLen, strlen(expectedSerialNum));
	@@ -660,17 +660,18 @@ void SDV_X509_CERT_PARSE_EXTENSIONS_FUNC_TC001(char *path, int extNum, int isCA,
660	HITLS_X509_Cert *cert = NULL;	660	HITLS_X509_Cert *cert = NULL;
661	HITLS_X509_ExtEntry **node = NULL;	661	HITLS_X509_ExtEntry **node = NULL;
662	ASSERT_EQ(HITLS_ParseCertTest(path, BSL_FORMAT_ASN1, &cert), HITLS_X509_SUCCESS);	662	ASSERT_EQ(HITLS_ParseCertTest(path, BSL_FORMAT_ASN1, &cert), HITLS_X509_SUCCESS);
663	ASSERT_EQ(cert->tbs.ext.isCa, isCA);	663	HITLS_X509_CertExt certExt = (HITLS_X509_CertExt )cert->tbs.ext.extData;
664	ASSERT_EQ(cert->tbs.ext.maxPathLen, maxPathLen);	664	ASSERT_EQ(certExt->isCa, isCA);
665	ASSERT_EQ(cert->tbs.ext.keyUsage, keyUsage);	665	ASSERT_EQ(certExt->maxPathLen, maxPathLen);
666	ASSERT_EQ(BSL_LIST_COUNT(cert->tbs.ext.list), extNum);	666	ASSERT_EQ(certExt->keyUsage, keyUsage);
		667	ASSERT_EQ(BSL_LIST_COUNT(cert->tbs.ext.extList), extNum);
667		668
668	HITLS_X509_ExtEntry arr[] = {	669	HITLS_X509_ExtEntry arr[] = {
669	{cid1, {BSL_ASN1_TAG_OBJECT_ID, oid1->len, oid1->x}, cr1, {BSL_ASN1_TAG_OCTETSTRING, val1->len, val1->x}},	670	{cid1, {BSL_ASN1_TAG_OBJECT_ID, oid1->len, oid1->x}, cr1, {BSL_ASN1_TAG_OCTETSTRING, val1->len, val1->x}},
670	{cid2, {BSL_ASN1_TAG_OBJECT_ID, oid2->len, oid2->x}, cr2, {BSL_ASN1_TAG_OCTETSTRING, val2->len, val2->x}},	671	{cid2, {BSL_ASN1_TAG_OBJECT_ID, oid2->len, oid2->x}, cr2, {BSL_ASN1_TAG_OCTETSTRING, val2->len, val2->x}},
671	{cid3, {BSL_ASN1_TAG_OBJECT_ID, oid3->len, oid3->x}, cr3, {BSL_ASN1_TAG_OCTETSTRING, val3->len, val3->x}},	672	{cid3, {BSL_ASN1_TAG_OBJECT_ID, oid3->len, oid3->x}, cr3, {BSL_ASN1_TAG_OCTETSTRING, val3->len, val3->x}},
672	};	673	};
673	node = BSL_LIST_First(cert->tbs.ext.list);	674	node = BSL_LIST_First(cert->tbs.ext.extList);
674	for (int i = 0; i < 3; i++) { // Check the first 3 extensions	675	for (int i = 0; i < 3; i++) { // Check the first 3 extensions
675	ASSERT_NE((*node), NULL);	676	ASSERT_NE((*node), NULL);
676	ASSERT_EQ((*node)->critical, arr[i].critical);	677	ASSERT_EQ((*node)->critical, arr[i].critical);
	@@ -679,7 +680,7 @@ void SDV_X509_CERT_PARSE_EXTENSIONS_FUNC_TC001(char *path, int extNum, int isCA,
679	ASSERT_EQ((*node)->extnValue.tag, arr[i].extnValue.tag);	680	ASSERT_EQ((*node)->extnValue.tag, arr[i].extnValue.tag);
680	ASSERT_COMPARE(	681	ASSERT_COMPARE(
681	"value", (node)->extnValue.buff, (node)->extnValue.len, arr[i].extnValue.buff, arr[i].extnValue.len);	682	"value", (node)->extnValue.buff, (node)->extnValue.len, arr[i].extnValue.buff, arr[i].extnValue.len);
682	node = BSL_LIST_Next(cert->tbs.ext.list);	683	node = BSL_LIST_Next(cert->tbs.ext.extList);
683	}	684	}
684	exit:	685	exit:
685	HITLS_X509_CertFree(cert);	686	HITLS_X509_CertFree(cert);
	@@ -986,7 +987,7 @@ void SDV_X509_ENCODE_CERT_EXT_TC001(char path, Hex expectExt)
986		987
987	ASSERT_EQ(HITLS_ParseCertTest(path, BSL_FORMAT_ASN1, &cert), HITLS_X509_SUCCESS);	988	ASSERT_EQ(HITLS_ParseCertTest(path, BSL_FORMAT_ASN1, &cert), HITLS_X509_SUCCESS);
988	uint8_t tag = 0xA3;	989	uint8_t tag = 0xA3;
989	ASSERT_EQ(HITLS_X509_EncodeExt(tag, cert->tbs.ext.list, &ext), HITLS_X509_SUCCESS);	990	ASSERT_EQ(HITLS_X509_EncodeExt(tag, cert->tbs.ext.extList, &ext), HITLS_X509_SUCCESS);
990		991
991	ASSERT_EQ(ext.len, expectExt->len);	992	ASSERT_EQ(ext.len, expectExt->len);
992	if (expectExt->len != 0) {	993	if (expectExt->len != 0) {
	@@ -1016,7 +1017,7 @@ void SDV_X509_CERT_GEN_BUFF_API_TC001(void)
1016	ASSERT_EQ(HITLS_X509_CertGenBuff(BSL_FORMAT_ASN1, cert, NULL), HITLS_X509_ERR_INVALID_PARAM);	1017	ASSERT_EQ(HITLS_X509_CertGenBuff(BSL_FORMAT_ASN1, cert, NULL), HITLS_X509_ERR_INVALID_PARAM);
1017		1018
1018	cert->tbs.version = HITLS_CERT_VERSION_1;	1019	cert->tbs.version = HITLS_CERT_VERSION_1;
1019	cert->tbs.ext.list->count = 1;	1020	cert->tbs.ext.extList->count = 1;
1020	ASSERT_EQ(HITLS_X509_CertGenBuff(BSL_FORMAT_ASN1, cert, &buff), HITLS_X509_ERR_CERT_INACCURACY_VERSION);	1021	ASSERT_EQ(HITLS_X509_CertGenBuff(BSL_FORMAT_ASN1, cert, &buff), HITLS_X509_ERR_CERT_INACCURACY_VERSION);
1021		1022
1022	exit:	1023	exit:
	@@ -1109,8 +1110,8 @@ void SDV_X509_CERT_SETANDGEN_TC001(char derCertPath, char privPath, int keyTyp
1109	new = HITLS_X509_CertNew();	1110	new = HITLS_X509_CertNew();
1110	ASSERT_TRUE(new != NULL);	1111	ASSERT_TRUE(new != NULL);
1111	ASSERT_EQ(SetCert(raw, new, privKey, mdId), 0);	1112	ASSERT_EQ(SetCert(raw, new, privKey, mdId), 0);
1112	tmp = new->tbs.ext.list;	1113	tmp = new->tbs.ext.extList;
1113	new->tbs.ext.list = raw->tbs.ext.list;	1114	new->tbs.ext.extList = raw->tbs.ext.extList;
1114	if (pkeyId == CRYPT_PKEY_RSA) {	1115	if (pkeyId == CRYPT_PKEY_RSA) {
1115	ASSERT_EQ(HITLS_X509_CertCtrl(new, HITLS_X509_SET_SIGN_RSA_PADDING, &pad, sizeof(int32_t)), 0);	1116	ASSERT_EQ(HITLS_X509_CertCtrl(new, HITLS_X509_SET_SIGN_RSA_PADDING, &pad, sizeof(int32_t)), 0);
1116	if (pad == CRYPT_PKEY_EMSA_PSS) {	1117	if (pad == CRYPT_PKEY_EMSA_PSS) {
	@@ -1130,7 +1131,7 @@ exit:
1130	HITLS_X509_CertFree(raw);	1131	HITLS_X509_CertFree(raw);
1131	BSL_SAL_Free(encodeRaw.data);	1132	BSL_SAL_Free(encodeRaw.data);
1132	if (tmp != NULL) {	1133	if (tmp != NULL) {
1133	new->tbs.ext.list = tmp;	1134	new->tbs.ext.extList = tmp;
1134	}	1135	}
1135	HITLS_X509_CertFree(new);	1136	HITLS_X509_CertFree(new);
1136	HITLS_X509_CertFree(parse);	1137	HITLS_X509_CertFree(parse);
	@@ -1154,8 +1155,8 @@ void SDV_X509_GEN_CERT_ERROR_TC001(char derCertPath, char privPath, int keyTyp
1154	new = HITLS_X509_CertNew();	1155	new = HITLS_X509_CertNew();
1155	ASSERT_TRUE(new != NULL);	1156	ASSERT_TRUE(new != NULL);
1156	ASSERT_EQ(SetCert(raw, new, privKey, mdId), 0);	1157	ASSERT_EQ(SetCert(raw, new, privKey, mdId), 0);
1157	tmp = new->tbs.ext.list;	1158	tmp = new->tbs.ext.extList;
1158	new->tbs.ext.list = raw->tbs.ext.list;	1159	new->tbs.ext.extList = raw->tbs.ext.extList;
1159		1160
1160	ASSERT_EQ(HITLS_X509_CertGenBuff(BSL_FORMAT_ASN1, new, &encodeCert), ret);	1161	ASSERT_EQ(HITLS_X509_CertGenBuff(BSL_FORMAT_ASN1, new, &encodeCert), ret);
1161		1162
	@@ -1163,7 +1164,7 @@ exit:
1163	raw->flag = HITLS_X509_CERT_PARSE_FLAG;	1164	raw->flag = HITLS_X509_CERT_PARSE_FLAG;
1164	HITLS_X509_CertFree(raw);	1165	HITLS_X509_CertFree(raw);
1165	if (tmp != NULL) {	1166	if (tmp != NULL) {
1166	new->tbs.ext.list = tmp;	1167	new->tbs.ext.extList = tmp;
1167	}	1168	}
1168	HITLS_X509_CertFree(new);	1169	HITLS_X509_CertFree(new);
1169	CRYPT_EAL_PkeyFreeCtx(privKey);	1170	CRYPT_EAL_PkeyFreeCtx(privKey);
	@@ -1188,8 +1189,8 @@ void SDV_X509_GEN_CERT_ERROR_TC002(char derCertPath, char privPath, int keyTyp
1188	new = HITLS_X509_CertNew();	1189	new = HITLS_X509_CertNew();
1189	ASSERT_TRUE(new != NULL);	1190	ASSERT_TRUE(new != NULL);
1190	ASSERT_EQ(SetCert(raw, new, privKey, mdId), 0);	1191	ASSERT_EQ(SetCert(raw, new, privKey, mdId), 0);
1191	tmp = new->tbs.ext.list;	1192	tmp = new->tbs.ext.extList;
1192	new->tbs.ext.list = raw->tbs.ext.list;	1193	new->tbs.ext.extList = raw->tbs.ext.extList;
1193		1194
1194	tmpBuff = new->tbs.serialNum.buff;	1195	tmpBuff = new->tbs.serialNum.buff;
1195	new->tbs.serialNum.buff = NULL;	1196	new->tbs.serialNum.buff = NULL;
	@@ -1212,7 +1213,7 @@ exit:
1212	HITLS_X509_CertFree(raw);	1213	HITLS_X509_CertFree(raw);
1213	BSL_SAL_Free(encodeRaw.data);	1214	BSL_SAL_Free(encodeRaw.data);
1214	if (tmp != NULL) {	1215	if (tmp != NULL) {
1215	new->tbs.ext.list = tmp;	1216	new->tbs.ext.extList = tmp;
1216	}	1217	}
1217	HITLS_X509_CertFree(new);	1218	HITLS_X509_CertFree(new);
1218	CRYPT_EAL_PkeyFreeCtx(privKey);	1219	CRYPT_EAL_PkeyFreeCtx(privKey);
	@@ -1225,7 +1226,6 @@ void SDV_X509_GEN_CERT_ERROR_TC003(char *derCertPath)
1225	HITLS_X509_Cert *parse = NULL;	1226	HITLS_X509_Cert *parse = NULL;
1226	HITLS_X509_Cert *new = NULL;	1227	HITLS_X509_Cert *new = NULL;
1227	int32_t ver = 0;	1228	int32_t ver = 0;
1228	HITLS_X509_Ext *ext = NULL;
1229		1229
1230	// Test: Set after parse	1230	// Test: Set after parse
1231	ASSERT_EQ(HITLS_ParseCertTest(derCertPath, BSL_FORMAT_ASN1, &parse), HITLS_X509_SUCCESS);	1231	ASSERT_EQ(HITLS_ParseCertTest(derCertPath, BSL_FORMAT_ASN1, &parse), HITLS_X509_SUCCESS);
	@@ -1233,9 +1233,8 @@ void SDV_X509_GEN_CERT_ERROR_TC003(char *derCertPath)
1233	ASSERT_EQ(HITLS_X509_CertCtrl(parse, HITLS_X509_SET_VERSION, &ver, sizeof(int32_t)),	1233	ASSERT_EQ(HITLS_X509_CertCtrl(parse, HITLS_X509_SET_VERSION, &ver, sizeof(int32_t)),
1234	HITLS_X509_ERR_SET_AFTER_PARSE);	1234	HITLS_X509_ERR_SET_AFTER_PARSE);
1235		1235
1236	ASSERT_EQ(HITLS_X509_CertCtrl(parse, HITLS_X509_GET_EXT, &ext, sizeof(HITLS_X509_Ext *)), 0);
1237	HITLS_X509_ExtBCons bCons = {true, true, 1};	1236	HITLS_X509_ExtBCons bCons = {true, true, 1};
1238	ASSERT_EQ(HITLS_X509_ExtCtrl(ext, HITLS_X509_EXT_SET_BCONS, &bCons, sizeof(HITLS_X509_ExtBCons)),	1237	ASSERT_EQ(HITLS_X509_CertCtrl(parse, HITLS_X509_EXT_SET_BCONS, &bCons, sizeof(HITLS_X509_ExtBCons)),
1239	HITLS_X509_ERR_EXT_SET_AFTER_PARSE);	1238	HITLS_X509_ERR_EXT_SET_AFTER_PARSE);
1240		1239
1241	// Test: Parse after set	1240	// Test: Parse after set
	@@ -1286,10 +1285,10 @@ void SDV_X509_CERT_SET_CSR_EXT_FUNC_TC001(int inForm, char *inCsr, int ret, Hex
1286		1285
1287	ASSERT_EQ(HITLS_X509_CsrParseFile(inForm, inCsr, &csr), 0);	1286	ASSERT_EQ(HITLS_X509_CsrParseFile(inForm, inCsr, &csr), 0);
1288	ASSERT_EQ(HITLS_X509_CertCtrl(cert, HITLS_X509_SET_CSR_EXT, csr, 0), ret);	1287	ASSERT_EQ(HITLS_X509_CertCtrl(cert, HITLS_X509_SET_CSR_EXT, csr, 0), ret);
1289	ASSERT_EQ(HITLS_X509_EncodeExt(0, cert->tbs.ext.list, &encodeExt), 0);	1288	ASSERT_EQ(HITLS_X509_EncodeExt(0, cert->tbs.ext.extList, &encodeExt), 0);
1290	if (expect->len != 0) {	1289	if (expect->len != 0) {
1291	ASSERT_TRUE((cert->tbs.ext.extFlags & HITLS_X509_EXT_FLAG_PARSE) == 0);	1290	ASSERT_TRUE((cert->tbs.ext.flag & HITLS_X509_EXT_FLAG_PARSE) == 0);
1292	ASSERT_TRUE((cert->tbs.ext.extFlags & HITLS_X509_EXT_FLAG_SET) != 0);	1291	ASSERT_TRUE((cert->tbs.ext.flag & HITLS_X509_EXT_FLAG_GEN) != 0);
1293	ASSERT_COMPARE("Csr ext", encodeExt.buff, encodeExt.len, expect->x, expect->len);	1292	ASSERT_COMPARE("Csr ext", encodeExt.buff, encodeExt.len, expect->x, expect->len);
1294	}	1293	}
1295	exit:	1294	exit:

Mtestcode/sdv/testcase/x509/common/test_suite_sdv_common.c+81-54

	@@ -212,7 +212,7 @@ void SDV_HITLS_X509_CtrlCert_TC001(void)
212		212
213	ASSERT_EQ(HITLS_X509_CertCtrl(NULL, 0xff, NULL, 0), HITLS_X509_ERR_INVALID_PARAM);	213	ASSERT_EQ(HITLS_X509_CertCtrl(NULL, 0xff, NULL, 0), HITLS_X509_ERR_INVALID_PARAM);
214	HITLS_X509_Cert cert = {0};	214	HITLS_X509_Cert cert = {0};
215	ASSERT_EQ(HITLS_X509_CertCtrl(&cert, 0xff, NULL, 0), HITLS_X509_ERR_INVALID_PARAM);	215	ASSERT_EQ(HITLS_X509_CertCtrl(&cert, 0x7fffffff, NULL, 0), HITLS_X509_ERR_INVALID_PARAM);
216	ASSERT_EQ(HITLS_X509_CertCtrl(&cert, HITLS_X509_GET_ENCODELEN, NULL, 0), HITLS_X509_ERR_INVALID_PARAM);	216	ASSERT_EQ(HITLS_X509_CertCtrl(&cert, HITLS_X509_GET_ENCODELEN, NULL, 0), HITLS_X509_ERR_INVALID_PARAM);
217	ASSERT_EQ(HITLS_X509_CertCtrl(&cert, HITLS_X509_GET_ENCODELEN, &cert, 0), HITLS_X509_ERR_INVALID_PARAM);	217	ASSERT_EQ(HITLS_X509_CertCtrl(&cert, HITLS_X509_GET_ENCODELEN, &cert, 0), HITLS_X509_ERR_INVALID_PARAM);
218	ASSERT_EQ(HITLS_X509_CertCtrl(&cert, HITLS_X509_GET_ENCODE, NULL, 0), HITLS_X509_ERR_INVALID_PARAM);	218	ASSERT_EQ(HITLS_X509_CertCtrl(&cert, HITLS_X509_GET_ENCODE, NULL, 0), HITLS_X509_ERR_INVALID_PARAM);
	@@ -287,8 +287,8 @@ void SDV_HITLS_X509_CtrlCrl_TC001(void)
287	ASSERT_EQ(HITLS_X509_CrlCtrl(NULL, 0xff, NULL, 0), HITLS_X509_ERR_INVALID_PARAM);	287	ASSERT_EQ(HITLS_X509_CrlCtrl(NULL, 0xff, NULL, 0), HITLS_X509_ERR_INVALID_PARAM);
288	HITLS_X509_Crl crl = {0};	288	HITLS_X509_Crl crl = {0};
289	ASSERT_EQ(HITLS_X509_CrlCtrl(&crl, 0xff, NULL, 0), HITLS_X509_ERR_INVALID_PARAM);	289	ASSERT_EQ(HITLS_X509_CrlCtrl(&crl, 0xff, NULL, 0), HITLS_X509_ERR_INVALID_PARAM);
290	ASSERT_EQ(HITLS_X509_CrlCtrl(&crl, HITLS_X509_CRL_REF_UP, NULL, 0), HITLS_X509_ERR_INVALID_PARAM);	290	ASSERT_EQ(HITLS_X509_CrlCtrl(&crl, HITLS_X509_REF_UP, NULL, 0), HITLS_X509_ERR_INVALID_PARAM);
291	ASSERT_EQ(HITLS_X509_CrlCtrl(&crl, HITLS_X509_CRL_REF_UP, &crl, 0), HITLS_X509_ERR_INVALID_PARAM);	291	ASSERT_EQ(HITLS_X509_CrlCtrl(&crl, HITLS_X509_REF_UP, &crl, 0), HITLS_X509_ERR_INVALID_PARAM);
292	exit:	292	exit:
293	BSL_GLOBAL_DeInit();	293	BSL_GLOBAL_DeInit();
294	}	294	}
	@@ -511,19 +511,21 @@ void SDV_X509_EXT_SetBCons_TC001(void)
511	ASSERT_NE(cert, NULL);	511	ASSERT_NE(cert, NULL);
512		512
513	HITLS_X509_Ext *ext = &cert->tbs.ext;	513	HITLS_X509_Ext *ext = &cert->tbs.ext;
514	ASSERT_EQ(ext->extFlags, 0);	514	HITLS_X509_CertExt certExt = (HITLS_X509_CertExt )ext->extData;
515	ASSERT_EQ(ext->isCa, false);	515	ASSERT_EQ(certExt->extFlags, 0);
516	ASSERT_EQ(ext->maxPathLen, -1);	516	ASSERT_EQ(certExt->isCa, false);
		517	ASSERT_EQ(certExt->maxPathLen, -1);
517		518
518	HITLS_X509_ExtBCons bCons = {true, true, 1};	519	HITLS_X509_ExtBCons bCons = {true, true, 1};
519		520
520	ASSERT_EQ(HITLS_X509_ExtCtrl(ext, HITLS_X509_EXT_SET_BCONS, &bCons, 0), HITLS_X509_ERR_INVALID_PARAM);	521	ASSERT_EQ(HITLS_X509_ExtCtrl(ext, HITLS_X509_EXT_SET_BCONS, &bCons, 0), HITLS_X509_ERR_EXT_NOT_SUPPORT);
		522	ASSERT_EQ(HITLS_X509_CertCtrl(cert, HITLS_X509_EXT_SET_BCONS, &bCons, 0), HITLS_X509_ERR_INVALID_PARAM);
521		523
522	ASSERT_EQ(HITLS_X509_ExtCtrl(ext, HITLS_X509_EXT_SET_BCONS, &bCons, sizeof(HITLS_X509_ExtBCons)), 0);	524	ASSERT_EQ(HITLS_X509_CertCtrl(cert, HITLS_X509_EXT_SET_BCONS, &bCons, sizeof(HITLS_X509_ExtBCons)), 0);
523	ASSERT_EQ(BSL_LIST_COUNT(ext->list), 1);	525	ASSERT_EQ(BSL_LIST_COUNT(ext->extList), 1);
524	ASSERT_NE(ext->extFlags & HITLS_X509_EXT_FLAG_BCONS, 0);	526	ASSERT_NE(certExt->extFlags & HITLS_X509_EXT_FLAG_BCONS, 0);
525	ASSERT_EQ(ext->isCa, true);	527	ASSERT_EQ(certExt->isCa, true);
526	ASSERT_EQ(ext->maxPathLen, 1);	528	ASSERT_EQ(certExt->maxPathLen, 1);
527		529
528	exit:	530	exit:
529	HITLS_X509_CertFree(cert);	531	HITLS_X509_CertFree(cert);
	@@ -543,22 +545,24 @@ void SDV_X509_EXT_SetAkiSki_TC001(Hex *kid)
543	HITLS_X509_ExtAki aki = {true, {kid->x, kid->len}, NULL, {0}};	545	HITLS_X509_ExtAki aki = {true, {kid->x, kid->len}, NULL, {0}};
544	HITLS_X509_ExtSki ski = {true, {kid->x, kid->len}};	546	HITLS_X509_ExtSki ski = {true, {kid->x, kid->len}};
545		547
546	ASSERT_EQ(HITLS_X509_ExtCtrl(ext, HITLS_X509_EXT_SET_SKI, &ski, 0), HITLS_X509_ERR_INVALID_PARAM);	548	ASSERT_EQ(HITLS_X509_CertCtrl(cert, HITLS_X509_EXT_SET_SKI, &ski, 0), HITLS_X509_ERR_INVALID_PARAM);
547	ASSERT_EQ(HITLS_X509_ExtCtrl(ext, HITLS_X509_EXT_SET_AKI, &aki, 0), HITLS_X509_ERR_INVALID_PARAM);	549	ASSERT_EQ(HITLS_X509_CertCtrl(cert, HITLS_X509_EXT_SET_AKI, &aki, 0), HITLS_X509_ERR_INVALID_PARAM);
548		550
549	aki.kid.dataLen = 0;	551	aki.kid.dataLen = 0;
550	ASSERT_EQ(HITLS_X509_ExtCtrl(ext, HITLS_X509_EXT_SET_AKI, &aki, sizeof(HITLS_X509_ExtAki)), HITLS_X509_ERR_EXT_KID);	552	ASSERT_EQ(HITLS_X509_CertCtrl(cert, HITLS_X509_EXT_SET_AKI, &aki, sizeof(HITLS_X509_ExtAki)),
		553	HITLS_X509_ERR_EXT_KID);
551	aki.kid.dataLen = kid->len;	554	aki.kid.dataLen = kid->len;
552		555
553	ski.kid.dataLen = 0;	556	ski.kid.dataLen = 0;
554	ASSERT_EQ(HITLS_X509_ExtCtrl(ext, HITLS_X509_EXT_SET_SKI, &ski, sizeof(HITLS_X509_ExtSki)), HITLS_X509_ERR_EXT_KID);	557	ASSERT_EQ(HITLS_X509_CertCtrl(cert, HITLS_X509_EXT_SET_SKI, &ski, sizeof(HITLS_X509_ExtSki)),
		558	HITLS_X509_ERR_EXT_KID);
555	ski.kid.dataLen = kid->len;	559	ski.kid.dataLen = kid->len;
556		560
557	ASSERT_EQ(HITLS_X509_ExtCtrl(ext, HITLS_X509_EXT_SET_AKI, &aki, sizeof(HITLS_X509_ExtAki)), 0);	561	ASSERT_EQ(HITLS_X509_CertCtrl(cert, HITLS_X509_EXT_SET_AKI, &aki, sizeof(HITLS_X509_ExtAki)), 0);
558	ASSERT_EQ(BSL_LIST_COUNT(ext->list), 1);	562	ASSERT_EQ(BSL_LIST_COUNT(ext->extList), 1);
559	ASSERT_EQ(HITLS_X509_ExtCtrl(ext, HITLS_X509_EXT_SET_SKI, &ski, sizeof(HITLS_X509_ExtSki)), 0);	563	ASSERT_EQ(HITLS_X509_CertCtrl(cert, HITLS_X509_EXT_SET_SKI, &ski, sizeof(HITLS_X509_ExtSki)), 0);
560	ASSERT_NE(ext->extFlags & HITLS_X509_EXT_FLAG_SET, 0);	564	ASSERT_NE(ext->flag & HITLS_X509_EXT_FLAG_GEN, 0);
561	ASSERT_EQ(BSL_LIST_COUNT(ext->list), 1 + 1);	565	ASSERT_EQ(BSL_LIST_COUNT(ext->extList), 1 + 1);
562	exit:	566	exit:
563	HITLS_X509_CertFree(cert);	567	HITLS_X509_CertFree(cert);
564	BSL_GLOBAL_DeInit();	568	BSL_GLOBAL_DeInit();
	@@ -574,13 +578,14 @@ void SDV_X509_EXT_SetKeyUsage_TC001(void)
574	ASSERT_NE(cert, NULL);	578	ASSERT_NE(cert, NULL);
575		579
576	HITLS_X509_Ext *ext = &cert->tbs.ext;	580	HITLS_X509_Ext *ext = &cert->tbs.ext;
577	ASSERT_EQ(ext->keyUsage, 0);	581	HITLS_X509_CertExt certExt = (HITLS_X509_CertExt )ext->extData;
		582	ASSERT_EQ(certExt->keyUsage, 0);
578		583
579	HITLS_X509_ExtKeyUsage ku = {true, 0};	584	HITLS_X509_ExtKeyUsage ku = {true, 0};
580		585
581	ASSERT_EQ(HITLS_X509_ExtCtrl(ext, HITLS_X509_EXT_SET_KUSAGE, &ku, 0), HITLS_X509_ERR_INVALID_PARAM);	586	ASSERT_EQ(HITLS_X509_CertCtrl(cert, HITLS_X509_EXT_SET_KUSAGE, &ku, 0), HITLS_X509_ERR_INVALID_PARAM);
582		587
583	ASSERT_EQ(HITLS_X509_ExtCtrl(ext, HITLS_X509_EXT_SET_KUSAGE, &ku, sizeof(HITLS_X509_ExtKeyUsage)),	588	ASSERT_EQ(HITLS_X509_CertCtrl(cert, HITLS_X509_EXT_SET_KUSAGE, &ku, sizeof(HITLS_X509_ExtKeyUsage)),
584	HITLS_X509_ERR_EXT_KU);	589	HITLS_X509_ERR_EXT_KU);
585		590
586	ku.keyUsage = HITLS_X509_EXT_KU_DIGITAL_SIGN \| HITLS_X509_EXT_KU_NON_REPUDIATION \|	591	ku.keyUsage = HITLS_X509_EXT_KU_DIGITAL_SIGN \| HITLS_X509_EXT_KU_NON_REPUDIATION \|
	@@ -588,14 +593,14 @@ void SDV_X509_EXT_SetKeyUsage_TC001(void)
588	HITLS_X509_EXT_KU_KEY_CERT_SIGN \| HITLS_X509_EXT_KU_CRL_SIGN \| HITLS_X509_EXT_KU_ENCIPHER_ONLY \|	593	HITLS_X509_EXT_KU_KEY_CERT_SIGN \| HITLS_X509_EXT_KU_CRL_SIGN \| HITLS_X509_EXT_KU_ENCIPHER_ONLY \|
589	HITLS_X509_EXT_KU_DECIPHER_ONLY;	594	HITLS_X509_EXT_KU_DECIPHER_ONLY;
590	ku.keyUsage = ~ku.keyUsage;	595	ku.keyUsage = ~ku.keyUsage;
591	ASSERT_EQ(HITLS_X509_ExtCtrl(ext, HITLS_X509_EXT_SET_KUSAGE, &ku, sizeof(HITLS_X509_ExtKeyUsage)),	596	ASSERT_EQ(HITLS_X509_CertCtrl(cert, HITLS_X509_EXT_SET_KUSAGE, &ku, sizeof(HITLS_X509_ExtKeyUsage)),
592	HITLS_X509_ERR_EXT_KU);	597	HITLS_X509_ERR_EXT_KU);
593		598
594	ku.keyUsage = ~ku.keyUsage;	599	ku.keyUsage = ~ku.keyUsage;
595	ASSERT_EQ(HITLS_X509_ExtCtrl(ext, HITLS_X509_EXT_SET_KUSAGE, &ku, sizeof(HITLS_X509_ExtKeyUsage)), 0);	600	ASSERT_EQ(HITLS_X509_CertCtrl(cert, HITLS_X509_EXT_SET_KUSAGE, &ku, sizeof(HITLS_X509_ExtKeyUsage)), 0);
596	ASSERT_EQ(BSL_LIST_COUNT(ext->list), 1);	601	ASSERT_EQ(BSL_LIST_COUNT(ext->extList), 1);
597	ASSERT_NE(ext->extFlags & HITLS_X509_EXT_FLAG_KUSAGE, 0);	602	ASSERT_NE(certExt->extFlags & HITLS_X509_EXT_FLAG_KUSAGE, 0);
598	ASSERT_NE(ext->extFlags & HITLS_X509_EXT_FLAG_SET, 0);	603	ASSERT_NE(ext->flag & HITLS_X509_EXT_FLAG_GEN, 0);
599		604
600	exit:	605	exit:
601	HITLS_X509_CertFree(cert);	606	HITLS_X509_CertFree(cert);
	@@ -616,19 +621,19 @@ void SDV_X509_EXT_SetExtendKeyUsage_TC001(void)
616	HITLS_X509_Ext *ext = &cert->tbs.ext;	621	HITLS_X509_Ext *ext = &cert->tbs.ext;
617	HITLS_X509_ExtExKeyUsage exku = {true, NULL};	622	HITLS_X509_ExtExKeyUsage exku = {true, NULL};
618		623
619	ASSERT_EQ(HITLS_X509_ExtCtrl(ext, HITLS_X509_EXT_SET_EXKUSAGE, &exku, 0), HITLS_X509_ERR_INVALID_PARAM);	624	ASSERT_EQ(HITLS_X509_CertCtrl(cert, HITLS_X509_EXT_SET_EXKUSAGE, &exku, 0), HITLS_X509_ERR_INVALID_PARAM);
620		625
621	// error: list is null	626	// error: list is null
622	ASSERT_EQ(HITLS_X509_ExtCtrl(ext, HITLS_X509_EXT_SET_EXKUSAGE, &exku, sizeof(HITLS_X509_ExtExKeyUsage)),	627	ASSERT_EQ(HITLS_X509_CertCtrl(cert, HITLS_X509_EXT_SET_EXKUSAGE, &exku, sizeof(HITLS_X509_ExtExKeyUsage)),
623	HITLS_X509_ERR_EXT_EXTENDED_KU);	628	HITLS_X509_ERR_EXT_EXTENDED_KU);
624	// werror: list is empty	629	// werror: list is empty
625	exku.oidList = oidList;	630	exku.oidList = oidList;
626	ASSERT_EQ(HITLS_X509_ExtCtrl(ext, HITLS_X509_EXT_SET_EXKUSAGE, &exku, sizeof(HITLS_X509_ExtExKeyUsage)),	631	ASSERT_EQ(HITLS_X509_CertCtrl(cert, HITLS_X509_EXT_SET_EXKUSAGE, &exku, sizeof(HITLS_X509_ExtExKeyUsage)),
627	HITLS_X509_ERR_EXT_EXTENDED_KU);	632	HITLS_X509_ERR_EXT_EXTENDED_KU);
628	// error: oid is null	633	// error: oid is null
629	BSL_Buffer emptyOid = {0};	634	BSL_Buffer emptyOid = {0};
630	ASSERT_EQ(BSL_LIST_AddElement(oidList, &emptyOid, BSL_LIST_POS_END), 0);	635	ASSERT_EQ(BSL_LIST_AddElement(oidList, &emptyOid, BSL_LIST_POS_END), 0);
631	ASSERT_EQ(HITLS_X509_ExtCtrl(ext, HITLS_X509_EXT_SET_EXKUSAGE, &exku, sizeof(HITLS_X509_ExtExKeyUsage)),	636	ASSERT_EQ(HITLS_X509_CertCtrl(cert, HITLS_X509_EXT_SET_EXKUSAGE, &exku, sizeof(HITLS_X509_ExtExKeyUsage)),
632	HITLS_X509_ERR_EXT_EXTENDED_KU_ELE);	637	HITLS_X509_ERR_EXT_EXTENDED_KU_ELE);
633	BSL_LIST_DeleteAll(oidList, FreeListData);	638	BSL_LIST_DeleteAll(oidList, FreeListData);
634		639
	@@ -637,8 +642,8 @@ void SDV_X509_EXT_SetExtendKeyUsage_TC001(void)
637	ASSERT_NE(oid, NULL);	642	ASSERT_NE(oid, NULL);
638	BSL_Buffer oidBuff = {(uint8_t *)oid->octs, oid->octetLen};	643	BSL_Buffer oidBuff = {(uint8_t *)oid->octs, oid->octetLen};
639	ASSERT_EQ(BSL_LIST_AddElement(oidList, &oidBuff, BSL_LIST_POS_END), 0);	644	ASSERT_EQ(BSL_LIST_AddElement(oidList, &oidBuff, BSL_LIST_POS_END), 0);
640	ASSERT_EQ(HITLS_X509_ExtCtrl(ext, HITLS_X509_EXT_SET_EXKUSAGE, &exku, sizeof(HITLS_X509_ExtExKeyUsage)), 0);	645	ASSERT_EQ(HITLS_X509_CertCtrl(cert, HITLS_X509_EXT_SET_EXKUSAGE, &exku, sizeof(HITLS_X509_ExtExKeyUsage)), 0);
641	ASSERT_NE(ext->extFlags & HITLS_X509_EXT_FLAG_SET, 0);	646	ASSERT_NE(ext->flag & HITLS_X509_EXT_FLAG_GEN, 0);
642		647
643	exit:	648	exit:
644	HITLS_X509_CertFree(cert);	649	HITLS_X509_CertFree(cert);
	@@ -660,17 +665,19 @@ void SDV_X509_EXT_SetSan_TC001(void)
660	HITLS_X509_Ext *ext = &cert->tbs.ext;	665	HITLS_X509_Ext *ext = &cert->tbs.ext;
661	HITLS_X509_ExtSan san = {true, NULL};	666	HITLS_X509_ExtSan san = {true, NULL};
662		667
663	ASSERT_EQ(HITLS_X509_ExtCtrl(ext, HITLS_X509_EXT_SET_SAN, &san, 0), HITLS_X509_ERR_INVALID_PARAM);	668	ASSERT_EQ(HITLS_X509_CertCtrl(cert, HITLS_X509_EXT_SET_SAN, &san, 0), HITLS_X509_ERR_INVALID_PARAM);
664		669
665	// error: list is null	670	// error: list is null
666	ASSERT_EQ(HITLS_X509_ExtCtrl(ext, HITLS_X509_EXT_SET_SAN, &san, sizeof(HITLS_X509_ExtSan)), HITLS_X509_ERR_EXT_SAN);	671	ASSERT_EQ(HITLS_X509_CertCtrl(cert, HITLS_X509_EXT_SET_SAN, &san, sizeof(HITLS_X509_ExtSan)),
		672	HITLS_X509_ERR_EXT_SAN);
667	// error: list is empty	673	// error: list is empty
668	san.names = list;	674	san.names = list;
669	ASSERT_EQ(HITLS_X509_ExtCtrl(ext, HITLS_X509_EXT_SET_SAN, &san, sizeof(HITLS_X509_ExtSan)), HITLS_X509_ERR_EXT_SAN);	675	ASSERT_EQ(HITLS_X509_CertCtrl(cert, HITLS_X509_EXT_SET_SAN, &san, sizeof(HITLS_X509_ExtSan)),
		676	HITLS_X509_ERR_EXT_SAN);
670	// error: list data content is null	677	// error: list data content is null
671	HITLS_X509_GeneralName empty = {0};	678	HITLS_X509_GeneralName empty = {0};
672	ASSERT_EQ(BSL_LIST_AddElement(list, &empty, BSL_LIST_POS_END), 0);	679	ASSERT_EQ(BSL_LIST_AddElement(list, &empty, BSL_LIST_POS_END), 0);
673	ASSERT_EQ(HITLS_X509_ExtCtrl(ext, HITLS_X509_EXT_SET_SAN, &san, sizeof(HITLS_X509_ExtSan)),	680	ASSERT_EQ(HITLS_X509_CertCtrl(cert, HITLS_X509_EXT_SET_SAN, &san, sizeof(HITLS_X509_ExtSan)),
674	HITLS_X509_ERR_EXT_SAN_ELE);	681	HITLS_X509_ERR_EXT_SAN_ELE);
675	BSL_LIST_DeleteAll(list, FreeListData);	682	BSL_LIST_DeleteAll(list, FreeListData);
676		683
	@@ -678,14 +685,14 @@ void SDV_X509_EXT_SetSan_TC001(void)
678	char *email = "test@a.com";	685	char *email = "test@a.com";
679	HITLS_X509_GeneralName errType = {HITLS_X509_GN_IP + 1, {(uint8_t *)email, (uint32_t)strlen(email)}};	686	HITLS_X509_GeneralName errType = {HITLS_X509_GN_IP + 1, {(uint8_t *)email, (uint32_t)strlen(email)}};
680	ASSERT_EQ(BSL_LIST_AddElement(list, &errType, BSL_LIST_POS_END), 0);	687	ASSERT_EQ(BSL_LIST_AddElement(list, &errType, BSL_LIST_POS_END), 0);
681	ASSERT_EQ(HITLS_X509_ExtCtrl(ext, HITLS_X509_EXT_SET_SAN, &san, sizeof(HITLS_X509_ExtSan)),	688	ASSERT_EQ(HITLS_X509_CertCtrl(cert, HITLS_X509_EXT_SET_SAN, &san, sizeof(HITLS_X509_ExtSan)),
682	HITLS_X509_ERR_EXT_GN_UNSUPPORT);	689	HITLS_X509_ERR_EXT_GN_UNSUPPORT);
683	BSL_LIST_DeleteAll(list, FreeListData);	690	BSL_LIST_DeleteAll(list, FreeListData);
684	// success	691	// success
685	HITLS_X509_GeneralName nomal = {HITLS_X509_GN_EMAIL, {(uint8_t *)email, (uint32_t)strlen(email)}};	692	HITLS_X509_GeneralName nomal = {HITLS_X509_GN_EMAIL, {(uint8_t *)email, (uint32_t)strlen(email)}};
686	ASSERT_EQ(BSL_LIST_AddElement(list, &nomal, BSL_LIST_POS_END), 0);	693	ASSERT_EQ(BSL_LIST_AddElement(list, &nomal, BSL_LIST_POS_END), 0);
687	ASSERT_EQ(HITLS_X509_ExtCtrl(ext, HITLS_X509_EXT_SET_SAN, &san, sizeof(HITLS_X509_ExtSan)), 0);	694	ASSERT_EQ(HITLS_X509_CertCtrl(cert, HITLS_X509_EXT_SET_SAN, &san, sizeof(HITLS_X509_ExtSan)), 0);
688	ASSERT_NE(ext->extFlags & HITLS_X509_EXT_FLAG_SET, 0);	695	ASSERT_NE(ext->flag & HITLS_X509_EXT_FLAG_GEN, 0);
689		696
690	exit:	697	exit:
691	HITLS_X509_CertFree(cert);	698	HITLS_X509_CertFree(cert);
	@@ -706,8 +713,8 @@ void SDV_X509_EXT_EncodeBCons_TC001(int critical, int isCa, int maxPathLen, Hex
706	HITLS_X509_Cert *cert = HITLS_X509_CertNew();	713	HITLS_X509_Cert *cert = HITLS_X509_CertNew();
707	ASSERT_NE(cert, NULL);	714	ASSERT_NE(cert, NULL);
708		715
709	ASSERT_EQ(HITLS_X509_ExtCtrl(&cert->tbs.ext, HITLS_X509_EXT_SET_BCONS, &bCons, sizeof(HITLS_X509_ExtBCons)), 0);	716	ASSERT_EQ(HITLS_X509_CertCtrl(cert, HITLS_X509_EXT_SET_BCONS, &bCons, sizeof(HITLS_X509_ExtBCons)), 0);
710	ASSERT_EQ(HITLS_X509_EncodeExt(tag, cert->tbs.ext.list, &encode), HITLS_X509_SUCCESS);	717	ASSERT_EQ(HITLS_X509_EncodeExt(tag, cert->tbs.ext.extList, &encode), HITLS_X509_SUCCESS);
711	ASSERT_EQ(encode.len, expect->len);	718	ASSERT_EQ(encode.len, expect->len);
712	ASSERT_COMPARE("Ext: bCons", encode.buff, encode.len, expect->x, expect->len);	719	ASSERT_COMPARE("Ext: bCons", encode.buff, encode.len, expect->x, expect->len);
713	exit:	720	exit:
	@@ -733,9 +740,9 @@ void SDV_X509_EXT_EncodeExtendKeyUsage_TC001(int critical, Hex oid1, Hex oid2,
733	ASSERT_EQ(BSL_LIST_AddElement(exku.oidList, oid1, BSL_LIST_POS_END), 0);	740	ASSERT_EQ(BSL_LIST_AddElement(exku.oidList, oid1, BSL_LIST_POS_END), 0);
734	ASSERT_EQ(BSL_LIST_AddElement(exku.oidList, oid2, BSL_LIST_POS_END), 0);	741	ASSERT_EQ(BSL_LIST_AddElement(exku.oidList, oid2, BSL_LIST_POS_END), 0);
735		742
736	ASSERT_EQ(HITLS_X509_ExtCtrl(&cert->tbs.ext, HITLS_X509_EXT_SET_EXKUSAGE, &exku, sizeof(HITLS_X509_ExtExKeyUsage)),	743	ASSERT_EQ(HITLS_X509_CertCtrl(cert, HITLS_X509_EXT_SET_EXKUSAGE, &exku, sizeof(HITLS_X509_ExtExKeyUsage)),
737	0);	744	0);
738	ASSERT_EQ(HITLS_X509_EncodeExt(tag, cert->tbs.ext.list, &encode), HITLS_X509_SUCCESS);	745	ASSERT_EQ(HITLS_X509_EncodeExt(tag, cert->tbs.ext.extList, &encode), HITLS_X509_SUCCESS);
739	ASSERT_EQ(encode.len, expect->len);	746	ASSERT_EQ(encode.len, expect->len);
740	ASSERT_COMPARE("Ext: extendKeyUsage", encode.buff, encode.len, expect->x, expect->len);	747	ASSERT_COMPARE("Ext: extendKeyUsage", encode.buff, encode.len, expect->x, expect->len);
741		748
	@@ -782,8 +789,8 @@ void SDV_X509_EXT_EncodeSan_TC001(int critical, int type1, int type2, int type3,
782	}	789	}
783		790
784	// set san and encode ext	791	// set san and encode ext
785	ASSERT_EQ(HITLS_X509_ExtCtrl(&cert->tbs.ext, HITLS_X509_EXT_SET_SAN, &san, sizeof(HITLS_X509_ExtSan)), 0);	792	ASSERT_EQ(HITLS_X509_CertCtrl(cert, HITLS_X509_EXT_SET_SAN, &san, sizeof(HITLS_X509_ExtSan)), 0);
786	ASSERT_EQ(HITLS_X509_EncodeExt(tag, cert->tbs.ext.list, &encode), HITLS_X509_SUCCESS);	793	ASSERT_EQ(HITLS_X509_EncodeExt(tag, cert->tbs.ext.extList, &encode), HITLS_X509_SUCCESS);
787	ASSERT_EQ(encode.len, expect->len);	794	ASSERT_EQ(encode.len, expect->len);
788	ASSERT_COMPARE("Ext: san", encode.buff, encode.len, expect->x, expect->len);	795	ASSERT_COMPARE("Ext: san", encode.buff, encode.len, expect->x, expect->len);
789		796
	@@ -808,8 +815,8 @@ void SDV_X509_EXT_EncodeKeyUsage_TC001(int critical, int usage, Hex *expect)
808	HITLS_X509_Cert *cert = HITLS_X509_CertNew();	815	HITLS_X509_Cert *cert = HITLS_X509_CertNew();
809	ASSERT_NE(cert, NULL);	816	ASSERT_NE(cert, NULL);
810		817
811	ASSERT_EQ(HITLS_X509_ExtCtrl(&cert->tbs.ext, HITLS_X509_EXT_SET_KUSAGE, &ku, sizeof(HITLS_X509_ExtKeyUsage)), 0);	818	ASSERT_EQ(HITLS_X509_CertCtrl(cert, HITLS_X509_EXT_SET_KUSAGE, &ku, sizeof(HITLS_X509_ExtKeyUsage)), 0);
812	ASSERT_EQ(HITLS_X509_EncodeExt(tag, cert->tbs.ext.list, &encode), HITLS_X509_SUCCESS);	819	ASSERT_EQ(HITLS_X509_EncodeExt(tag, cert->tbs.ext.extList, &encode), HITLS_X509_SUCCESS);
813	ASSERT_EQ(encode.len, expect->len);	820	ASSERT_EQ(encode.len, expect->len);
814	ASSERT_COMPARE("Ext: keyUsage", encode.buff, encode.len, expect->x, expect->len);	821	ASSERT_COMPARE("Ext: keyUsage", encode.buff, encode.len, expect->x, expect->len);
815	exit:	822	exit:
	@@ -832,9 +839,9 @@ void SDV_X509_EXT_EncodeAKiSki_TC001(int critical1, int critical2, Hex *kid1, He
832	HITLS_X509_Cert *cert = HITLS_X509_CertNew();	839	HITLS_X509_Cert *cert = HITLS_X509_CertNew();
833	ASSERT_NE(cert, NULL);	840	ASSERT_NE(cert, NULL);
834		841
835	ASSERT_EQ(HITLS_X509_ExtCtrl(&cert->tbs.ext, HITLS_X509_EXT_SET_SKI, &ski, sizeof(HITLS_X509_ExtSki)), 0);	842	ASSERT_EQ(HITLS_X509_CertCtrl(cert, HITLS_X509_EXT_SET_SKI, &ski, sizeof(HITLS_X509_ExtSki)), 0);
836	ASSERT_EQ(HITLS_X509_ExtCtrl(&cert->tbs.ext, HITLS_X509_EXT_SET_AKI, &aki, sizeof(HITLS_X509_ExtAki)), 0);	843	ASSERT_EQ(HITLS_X509_CertCtrl(cert, HITLS_X509_EXT_SET_AKI, &aki, sizeof(HITLS_X509_ExtAki)), 0);
837	ASSERT_EQ(HITLS_X509_EncodeExt(tag, cert->tbs.ext.list, &encode), HITLS_X509_SUCCESS);	844	ASSERT_EQ(HITLS_X509_EncodeExt(tag, cert->tbs.ext.extList, &encode), HITLS_X509_SUCCESS);
838	ASSERT_EQ(encode.len, expect->len);	845	ASSERT_EQ(encode.len, expect->len);
839	ASSERT_COMPARE("Ext:aki ski", encode.buff, encode.len, expect->x, expect->len);	846	ASSERT_COMPARE("Ext:aki ski", encode.buff, encode.len, expect->x, expect->len);
840	exit:	847	exit:
	@@ -1007,7 +1014,7 @@ void SDV_X509_EXT_GetSki_TC001(Hex encode, int ret, int critical, Hex kid)
1007	bool getIsExist;	1014	bool getIsExist;
1008	HITLS_X509_ExtSki ski = {0};	1015	HITLS_X509_ExtSki ski = {0};
1009		1016
1010	HITLS_X509_Ext *ext = HITLS_X509_ExtNew();	1017	HITLS_X509_Ext *ext = HITLS_X509_ExtNew(HITLS_X509_EXT_TYPE_CSR);
1011	ASSERT_NE(ext, NULL);	1018	ASSERT_NE(ext, NULL);
1012	ASSERT_EQ(HITLS_X509_ParseExt(&asnExt, ext), 0);	1019	ASSERT_EQ(HITLS_X509_ParseExt(&asnExt, ext), 0);
1013		1020
	@@ -1022,3 +1029,23 @@ exit:
1022	HITLS_X509_ExtFree(ext);	1029	HITLS_X509_ExtFree(ext);
1023	}	1030	}
1024	/* END_CASE */	1031	/* END_CASE */
		1032
		1033	/* BEGIN_CASE */
		1034	void SDV_HITLS_X509_ExtParamCheck_TC001(void)
		1035	{
		1036	TestMemInit();
		1037	BSL_LOG_BinLogFuncs func = {0};
		1038	BSL_GLOBAL_Init();
		1039	func.fixLenFunc = BinLogFixLenFunc;
		1040	func.varLenFunc = BinLogVarLenFunc;
		1041	ASSERT_TRUE(BSL_LOG_RegBinLogFunc(&func) == BSL_SUCCESS);
		1042
		1043	ASSERT_EQ(HITLS_X509_ExtNew(HITLS_X509_EXT_TYPE_CERT), NULL);
		1044	ASSERT_EQ(HITLS_X509_ExtNew(HITLS_X509_EXT_TYPE_CRL), NULL);
		1045	HITLS_X509_Ext *ext = HITLS_X509_ExtNew(HITLS_X509_EXT_TYPE_CSR);
		1046	ASSERT_NE(ext, NULL);
		1047	HITLS_X509_ExtFree(ext);
		1048	exit:
		1049	BSL_GLOBAL_DeInit();
		1050	}
		1051	/* END_CASE */

Mtestcode/sdv/testcase/x509/common/test_suite_sdv_common.data+3-0

	@@ -225,3 +225,6 @@ SDV_X509_EXT_GetSki_TC001:"304830360603551D11042F302D81106D79406F746865722E61646
225		225
226	SDV_X509_EXT_GetSki_TC001: ski is exist	226	SDV_X509_EXT_GetSki_TC001: ski is exist
227	SDV_X509_EXT_GetSki_TC001:"306730360603551D11042F302D81106D79406F746865722E6164647265737386196C6461703A2F2F736F6D686F73742E636F6D2F434E3D666F6F301D0603551D0E04160414962D9DF010CE347D86409930A9D99696B34961BB300E0603551D0F0101FF040403020388":HITLS_X509_SUCCESS:0:"962D9DF010CE347D86409930A9D99696B34961BB"	227	SDV_X509_EXT_GetSki_TC001:"306730360603551D11042F302D81106D79406F746865722E6164647265737386196C6461703A2F2F736F6D686F73742E636F6D2F434E3D666F6F301D0603551D0E04160414962D9DF010CE347D86409930A9D99696B34961BB300E0603551D0F0101FF040403020388":HITLS_X509_SUCCESS:0:"962D9DF010CE347D86409930A9D99696B34961BB"
		228
		229	SDV_HITLS_X509_ExtParamCheck_TC001
		230	SDV_HITLS_X509_ExtParamCheck_TC001:

Mtestcode/sdv/testcase/x509/crl/test_suite_sdv_x509_crl.c+653-13

	@@ -21,9 +21,13 @@
21	#include "hitls_x509_errno.h"	21	#include "hitls_x509_errno.h"
22	#include "bsl_type.h"	22	#include "bsl_type.h"
23	#include "bsl_log.h"	23	#include "bsl_log.h"
		24	#include "bsl_obj.h"
		25	#include "crypt_encode.h"
24	#include "sal_file.h"	26	#include "sal_file.h"
25	#include "bsl_init.h"	27	#include "bsl_init.h"
		28	#include "crypt_errno.h"
26	#include "hitls_crl_local.h"	29	#include "hitls_crl_local.h"
		30	#include "hitls_cert_local.h"
27		31
28		32
29	/* END_HEADER */	33	/* END_HEADER */
	@@ -94,7 +98,7 @@ void SDV_X509_CRL_CTRL_FUNC_TC001(char *path)
94	ASSERT_EQ(ret, HITLS_X509_SUCCESS);	98	ASSERT_EQ(ret, HITLS_X509_SUCCESS);
95		99
96	int32_t ref = 0;	100	int32_t ref = 0;
97	ret = HITLS_X509_CrlCtrl(crl, HITLS_X509_CRL_REF_UP, &ref, sizeof(ref));	101	ret = HITLS_X509_CrlCtrl(crl, HITLS_X509_REF_UP, &ref, sizeof(ref));
98	ASSERT_EQ(ret, HITLS_X509_SUCCESS);	102	ASSERT_EQ(ret, HITLS_X509_SUCCESS);
99	ASSERT_EQ(ref, 2);	103	ASSERT_EQ(ref, 2);
100	HITLS_X509_CrlFree(crl);	104	HITLS_X509_CrlFree(crl);
	@@ -207,21 +211,21 @@ void SDV_X509_CRL_PARSE_REVOKED_FUNC_TC003(char *path, int count, int num,
207	int32_t ret = HITLS_ParseCrlTest(BSL_FORMAT_ASN1, path, &crl);	211	int32_t ret = HITLS_ParseCrlTest(BSL_FORMAT_ASN1, path, &crl);
208	ASSERT_EQ(ret, HITLS_X509_SUCCESS);	212	ASSERT_EQ(ret, HITLS_X509_SUCCESS);
209	ASSERT_EQ(BSL_LIST_COUNT(crl->tbs.revokedCerts), count);	213	ASSERT_EQ(BSL_LIST_COUNT(crl->tbs.revokedCerts), count);
210	HITLS_X509_CrlEntry **nameNode = NULL;	214	HITLS_X509_CrlEntry *nameNode = NULL;
211	nameNode = BSL_LIST_First(crl->tbs.revokedCerts);	215	nameNode = BSL_LIST_GET_FIRST(crl->tbs.revokedCerts);
212	for (int i = 1; i < num; i++) {	216	for (int i = 1; i < num; i++) {
213	nameNode = BSL_LIST_Next(crl->tbs.revokedCerts);	217	nameNode = BSL_LIST_GET_NEXT(crl->tbs.revokedCerts);
214	}	218	}
215		219
216	ASSERT_EQ((*nameNode)->serialNumber.tag, tag1);	220	ASSERT_EQ(nameNode->serialNumber.tag, tag1);
217	ASSERT_COMPARE("", (nameNode)->serialNumber.buff, (nameNode)->serialNumber.len,	221	ASSERT_COMPARE("", nameNode->serialNumber.buff, nameNode->serialNumber.len,
218	value1->x, value1->len);	222	value1->x, value1->len);
219	ASSERT_EQ((*nameNode)->time.year, year1);	223	ASSERT_EQ(nameNode->time.year, year1);
220	ASSERT_EQ((*nameNode)->time.month, month1);	224	ASSERT_EQ(nameNode->time.month, month1);
221	ASSERT_EQ((*nameNode)->time.day, day1);	225	ASSERT_EQ(nameNode->time.day, day1);
222	ASSERT_EQ((*nameNode)->time.hour, hour1);	226	ASSERT_EQ(nameNode->time.hour, hour1);
223	ASSERT_EQ((*nameNode)->time.minute, minute1);	227	ASSERT_EQ(nameNode->time.minute, minute1);
224	ASSERT_EQ((*nameNode)->time.second, second1);	228	ASSERT_EQ(nameNode->time.second, second1);
225	exit:	229	exit:
226	HITLS_X509_CrlFree(crl);	230	HITLS_X509_CrlFree(crl);
227	BSL_GLOBAL_DeInit();	231	BSL_GLOBAL_DeInit();
	@@ -434,4 +438,640 @@ exit:
434	HITLS_X509_CrlFree(crl);	438	HITLS_X509_CrlFree(crl);
435	BSL_SAL_Free(res);	439	BSL_SAL_Free(res);
436	}	440	}
437	/* END_CASE */	441	/* END_CASE */
		442
		443	/* BEGIN_CASE */
		444	void SDV_X509_CRL_Check_TC001(char capath, char crlpath, int res)
		445	{
		446	BSL_GLOBAL_Init();
		447	HITLS_X509_Crl *crl = NULL;
		448	HITLS_X509_Cert *cert = NULL;
		449	void *pubKey = NULL;
		450	ASSERT_EQ(HITLS_X509_CrlParseFile(BSL_FORMAT_UNKNOWN, crlpath, &crl), HITLS_X509_SUCCESS);
		451	ASSERT_EQ(HITLS_X509_CertParseFile(BSL_FORMAT_UNKNOWN, capath, &cert), HITLS_X509_SUCCESS);
		452	ASSERT_EQ(HITLS_X509_CertCtrl(cert, HITLS_X509_GET_PUBKEY, &pubKey, sizeof(void *)), HITLS_X509_SUCCESS);
		453	ASSERT_EQ(HITLS_X509_CrlVerify(pubKey, crl), res);
		454	exit:
		455	CRYPT_EAL_PkeyFreeCtx(pubKey);
		456	HITLS_X509_CrlFree(crl);
		457	HITLS_X509_CertFree(cert);
		458	}
		459	/* END_CASE */
		460
		461	/* BEGIN_CASE */
		462	void SDV_X509_CRL_CTRL_ParamCheck_TC001(void)
		463	{
		464	HITLS_X509_Crl *crl = NULL;
		465	BSL_TIME time = {0};
		466	BSL_ASN1_List *issuer = NULL;
		467	uint32_t version = 1;
		468
		469	// Test null pointer parameter
		470	ASSERT_EQ(HITLS_X509_CrlCtrl(NULL, HITLS_X509_SET_VERSION, &version, sizeof(version)),
		471	HITLS_X509_ERR_INVALID_PARAM);
		472
		473	// Create a CRL object for subsequent tests
		474	crl = HITLS_X509_CrlNew();
		475	ASSERT_NE(crl, NULL);
		476
		477	// Test invalid command
		478	ASSERT_EQ(HITLS_X509_CrlCtrl(crl, 0x7FFFFFFF, &version, sizeof(version)), HITLS_X509_ERR_INVALID_PARAM);
		479
		480	// Test null value pointer
		481	ASSERT_EQ(HITLS_X509_CrlCtrl(crl, HITLS_X509_SET_VERSION, NULL, sizeof(uint8_t)), HITLS_X509_ERR_INVALID_PARAM);
		482
		483	// Test incorrect length for version parameter
		484	ASSERT_EQ(HITLS_X509_CrlCtrl(crl, HITLS_X509_SET_VERSION, &version, 0), HITLS_X509_ERR_INVALID_PARAM);
		485
		486	// Test invalid version number
		487	version = 3; // Out of valid range
		488	ASSERT_EQ(HITLS_X509_CrlCtrl(crl, HITLS_X509_SET_VERSION, &version, sizeof(version)), HITLS_X509_ERR_INVALID_PARAM);
		489
		490	// Test incorrect length for time parameter
		491	ASSERT_EQ(HITLS_X509_CrlCtrl(crl, HITLS_X509_SET_BEFORE_TIME, &time, sizeof(time) - 1),
		492	HITLS_X509_ERR_INVALID_PARAM);
		493
		494	// Test incorrect length for issuer parameter
		495	ASSERT_EQ(HITLS_X509_CrlCtrl(crl, HITLS_X509_SET_ISSUER_DNNAME, issuer, sizeof(BSL_ASN1_List) - 1),
		496	HITLS_X509_ERR_INVALID_PARAM);
		497
		498	// Test empty buffer for get command
		499	ASSERT_EQ(HITLS_X509_CrlCtrl(crl, HITLS_X509_GET_VERSION, NULL, sizeof(version)), HITLS_X509_ERR_INVALID_PARAM);
		500
		501	// Test incorrect buffer length for get command
		502	ASSERT_EQ(HITLS_X509_CrlCtrl(crl, HITLS_X509_GET_VERSION, &version, 0), HITLS_X509_ERR_INVALID_PARAM);
		503
		504	// Test normal parameters - set version number
		505	version = 1;
		506	ASSERT_EQ(HITLS_X509_CrlCtrl(crl, HITLS_X509_SET_VERSION, &version, sizeof(version)), HITLS_X509_SUCCESS);
		507
		508	// Test normal parameters - get version number
		509	uint32_t getVersion = 0;
		510	ASSERT_EQ(HITLS_X509_CrlCtrl(crl, HITLS_X509_GET_VERSION, &getVersion, sizeof(getVersion)), HITLS_X509_SUCCESS);
		511	ASSERT_EQ(getVersion, version);
		512
		513	// Test normal parameters - set last update time
		514	ASSERT_EQ(BSL_SAL_SysTimeGet(&time), BSL_SUCCESS);
		515	ASSERT_EQ(HITLS_X509_CrlCtrl(crl, HITLS_X509_SET_BEFORE_TIME, &time, sizeof(time)), HITLS_X509_SUCCESS);
		516
		517	// Test normal parameters - get last update time
		518	BSL_TIME getTime = {0};
		519	ASSERT_EQ(HITLS_X509_CrlCtrl(crl, HITLS_X509_GET_BEFORE_TIME, &getTime, sizeof(getTime)), HITLS_X509_SUCCESS);
		520	ASSERT_EQ(memcmp(&getTime, &time, sizeof(BSL_TIME)), 0);
		521	exit:
		522	// Clean up resources
		523	HITLS_X509_CrlFree(crl);
		524	}
		525	/* END_CASE */
		526
		527	/* BEGIN_CASE */
		528	void SDV_X509_CRL_CTRL_RevokedParamCheck_TC001(void)
		529	{
		530	HITLS_X509_CrlEntry *entry = NULL;
		531	BSL_TIME time = {0};
		532
		533	// Test HITLS_X509_CrlRevokedNew
		534	entry = HITLS_X509_CrlRevokedNew();
		535	ASSERT_NE(entry, NULL);
		536
		537	// Test HITLS_X509_CrlRevokedCtrl with invalid command
		538	ASSERT_EQ(HITLS_X509_CrlRevokedCtrl(entry, 0xFFFF, &time, sizeof(time)), HITLS_X509_ERR_INVALID_PARAM);
		539
		540	// Test HITLS_X509_CrlRevokedCtrl with NULL entry
		541	ASSERT_EQ(HITLS_X509_CrlRevokedCtrl(NULL, HITLS_X509_CRL_GET_REVOKED_REVOKE_TIME, &time, sizeof(time)),
		542	HITLS_X509_ERR_INVALID_PARAM);
		543
		544	// Test HITLS_X509_CrlRevokedCtrl with NULL value pointer
		545	ASSERT_EQ(HITLS_X509_CrlRevokedCtrl(entry, HITLS_X509_CRL_GET_REVOKED_REVOKE_TIME, NULL, sizeof(time)),
		546	HITLS_X509_ERR_INVALID_PARAM);
		547
		548	// Test HITLS_X509_CrlRevokedCtrl with invalid value length
		549	ASSERT_EQ(HITLS_X509_CrlRevokedCtrl(entry, HITLS_X509_CRL_GET_REVOKED_REVOKE_TIME, &time, 0),
		550	HITLS_X509_ERR_INVALID_PARAM);
		551
		552	// Test setting/getting revoke time
		553	ASSERT_EQ(BSL_SAL_SysTimeGet(&time), BSL_SUCCESS);
		554	ASSERT_EQ(HITLS_X509_CrlRevokedCtrl(entry, HITLS_X509_CRL_SET_REVOKED_REVOKE_TIME, &time, sizeof(time)),
		555	HITLS_X509_SUCCESS);
		556
		557	BSL_TIME getTime = {0};
		558	ASSERT_EQ(HITLS_X509_CrlRevokedCtrl(entry, HITLS_X509_CRL_GET_REVOKED_REVOKE_TIME, &getTime, sizeof(getTime)),
		559	HITLS_X509_SUCCESS);
		560	ASSERT_EQ(memcmp(&time, &getTime, sizeof(BSL_TIME)), 0);
		561
		562	// Test setting/getting reason
		563	HITLS_X509_RevokeExtReason reasonExt = {false, 1};
		564	ASSERT_EQ(HITLS_X509_CrlRevokedCtrl(entry, HITLS_X509_CRL_SET_REVOKED_REASON, &reasonExt,
		565	sizeof(HITLS_X509_RevokeExtReason)), HITLS_X509_SUCCESS);
		566
		567	int32_t getReason = 0;
		568	ASSERT_EQ(HITLS_X509_CrlRevokedCtrl(entry, HITLS_X509_CRL_GET_REVOKED_REASON, &getReason, sizeof(getReason)),
		569	HITLS_X509_SUCCESS);
		570	ASSERT_EQ(reasonExt.reason, getReason);
		571
		572	// Test setting/getting serial number
		573	uint8_t serial[] = {0x01, 0x02, 0x03, 0x04};
		574	ASSERT_EQ(HITLS_X509_CrlRevokedCtrl(entry, HITLS_X509_CRL_SET_REVOKED_SERIALNUM, serial, 4),
		575	HITLS_X509_SUCCESS);
		576
		577	BSL_Buffer getSerial = {0};
		578	ASSERT_EQ(HITLS_X509_CrlRevokedCtrl(entry, HITLS_X509_CRL_GET_REVOKED_SERIALNUM, &getSerial, sizeof(getSerial)),
		579	HITLS_X509_SUCCESS);
		580	ASSERT_EQ(4, getSerial.dataLen);
		581	ASSERT_EQ(memcmp(serial, getSerial.data, getSerial.dataLen), 0);
		582
		583	// Test HITLS_X509_CrlRevokedFree with NULL
		584	HITLS_X509_CrlRevokedFree(NULL); // Should not crash
		585
		586	// Test HITLS_X509_CrlRevokedFree with valid entry
		587	HITLS_X509_CrlRevokedFree(entry);
		588	exit:
		589	return;
		590	}
		591	/* END_CASE */
		592
		593	/* BEGIN_CASE */
		594	void SDV_X509_CRL_PARSE_REVOKEDLIST_FUNC_TC001(char *parh, int revokedNum)
		595	{
		596	HITLS_X509_Crl *crl = NULL;
		597	HITLS_X509_CrlEntry *entry = NULL;
		598	BslList *revokeList = NULL;
		599	BSL_TIME time = {0};
		600	int32_t reason = 0;
		601	BSL_Buffer serialNum = {0};
		602
		603	ASSERT_EQ(HITLS_X509_CrlParseFile(BSL_FORMAT_PEM, parh, &crl), HITLS_X509_SUCCESS);
		604	ASSERT_NE(crl, NULL);
		605
		606	ASSERT_EQ(HITLS_X509_CrlCtrl(crl, HITLS_X509_GET_REVOKELIST, &revokeList, sizeof(BslList *)), HITLS_X509_SUCCESS);
		607	ASSERT_NE(revokeList, NULL);
		608	ASSERT_EQ(BSL_LIST_COUNT(revokeList), revokedNum);
		609	for (entry = (HITLS_X509_CrlEntry *)BSL_LIST_GET_FIRST(revokeList); entry != NULL; entry =
		610	(HITLS_X509_CrlEntry *)BSL_LIST_GET_NEXT(revokeList)) {
		611	ASSERT_TRUE(entry->serialNumber.buff != NULL);
		612	ASSERT_EQ(HITLS_X509_CrlRevokedCtrl(entry, HITLS_X509_CRL_GET_REVOKED_SERIALNUM, &serialNum,
		613	sizeof(BSL_Buffer)), HITLS_X509_SUCCESS);
		614	ASSERT_TRUE(serialNum.dataLen > 0 && serialNum.dataLen <= 20);
		615	ASSERT_NE(serialNum.data, NULL);
		616	ASSERT_EQ(HITLS_X509_CrlRevokedCtrl(entry, HITLS_X509_CRL_GET_REVOKED_REVOKE_TIME, &time, sizeof(BSL_TIME)),
		617	HITLS_X509_SUCCESS);
		618	ASSERT_NE(time.year, 0);
		619	ASSERT_EQ(HITLS_X509_CrlRevokedCtrl(entry, HITLS_X509_CRL_GET_REVOKED_REASON,
		620	&reason, sizeof(int32_t)), HITLS_X509_SUCCESS);
		621	ASSERT_TRUE(reason >= 0 && reason <= 11);
		622	reason = 0;
		623	memset(&time, 0, sizeof(BSL_TIME));
		624	memset(&serialNum, 0, sizeof(serialNum));
		625	}
		626	exit:
		627	HITLS_X509_CrlFree(crl);
		628	}
		629	/* END_CASE */
		630
		631	/* BEGIN_CASE */
		632	void SDV_X509_CRL_CTRL_GetFunc_TC001(void)
		633	{
		634	HITLS_X509_Crl *crl = NULL;
		635	uint32_t version = 0;
		636	BSL_TIME beforeTime = {0};
		637	BSL_TIME afterTime = {0};
		638	BslList *issuerDN = NULL;
		639	BslList *revokeList = NULL;
		640
		641	// Parse the test CRL file
		642	ASSERT_EQ(HITLS_X509_CrlParseFile(BSL_FORMAT_PEM, "../testdata/cert/pem/crl/crl_v2.mul3.crl", &crl),
		643	HITLS_X509_SUCCESS);
		644	ASSERT_NE(crl, NULL);
		645
		646	// Test getting the version number
		647	ASSERT_EQ(HITLS_X509_CrlCtrl(crl, HITLS_X509_GET_VERSION, &version, sizeof(uint32_t)), HITLS_X509_SUCCESS);
		648	// The CRL version should be 0 (v1) or 1 (v2)
		649	ASSERT_TRUE(version == 1);
		650
		651	// Test getting the last update time
		652	ASSERT_EQ(HITLS_X509_CrlCtrl(crl, HITLS_X509_GET_BEFORE_TIME, &beforeTime, sizeof(BSL_TIME)), HITLS_X509_SUCCESS);
		653	ASSERT_NE(beforeTime.year, 0);
		654
		655	// Test getting the next update time
		656	ASSERT_EQ(HITLS_X509_CrlCtrl(crl, HITLS_X509_GET_AFTER_TIME, &afterTime, sizeof(BSL_TIME)), HITLS_X509_SUCCESS);
		657	// The next update time should be later than the last update time
		658	ASSERT_TRUE(afterTime.month > beforeTime.month);
		659
		660	// Test getting the issuer DN name
		661	ASSERT_EQ(HITLS_X509_CrlCtrl(crl, HITLS_X509_GET_ISSUER_DNNAME, &issuerDN, sizeof(BslList *)), HITLS_X509_SUCCESS);
		662	ASSERT_NE(issuerDN, NULL);
		663	ASSERT_NE(BSL_LIST_COUNT(issuerDN), 0);
		664
		665	// Test getting extensions (using CRL Number as an example)
		666	ASSERT_NE(crl->tbs.crlExt.extList, NULL);
		667	ASSERT_EQ(crl->tbs.crlExt.type, HITLS_X509_EXT_TYPE_CRL);
		668	ASSERT_EQ(BSL_LIST_COUNT(crl->tbs.crlExt.extList), 1);
		669
		670	// Test getting the revoke list
		671	ASSERT_EQ(HITLS_X509_CrlCtrl(crl, HITLS_X509_GET_REVOKELIST, &revokeList, sizeof(BslList *)), HITLS_X509_SUCCESS);
		672	ASSERT_NE(revokeList, NULL);
		673	ASSERT_EQ(BSL_LIST_COUNT(revokeList), 3);
		674
		675	exit:
		676	HITLS_X509_CrlFree(crl);
		677	}
		678
		679	/* END_CASE */
		680
		681	/* BEGIN_CASE */
		682	void SDV_X509_CRL_ExtCtrl_FuncTest_TC001(void)
		683	{
		684	uint8_t keyId[8] = {0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07, 0x08};
		685	uint8_t serialNum[4] = {0x11, 0x22, 0x33, 0x44};
		686
		687	HITLS_X509_Crl *crl = HITLS_X509_CrlNew();
		688	ASSERT_NE(crl, NULL);
		689
		690	// set CRL Number
		691	HITLS_X509_ExtCrlNumber crlNumberExt = {false, {serialNum, 4}};
		692	ASSERT_EQ(HITLS_X509_CrlCtrl(crl, HITLS_X509_EXT_SET_CRLNUMBER, &crlNumberExt, sizeof(HITLS_X509_ExtCrlNumber)),
		693	HITLS_X509_SUCCESS);
		694	HITLS_X509_ExtCrlNumber crlNumExt = {0};
		695	ASSERT_EQ(HITLS_X509_CrlCtrl(crl, HITLS_X509_EXT_GET_CRLNUMBER, &crlNumExt, sizeof(HITLS_X509_ExtCrlNumber)),
		696	HITLS_X509_SUCCESS);
		697	ASSERT_EQ(crlNumExt.critical, crlNumberExt.critical);
		698	ASSERT_EQ(crlNumExt.crlNumber.dataLen, crlNumberExt.crlNumber.dataLen);
		699	ASSERT_EQ(memcmp(crlNumExt.crlNumber.data, crlNumberExt.crlNumber.data, crlNumberExt.crlNumber.dataLen), 0);
		700
		701	HITLS_X509_ExtAki aki = {false, {keyId, sizeof(keyId)}, NULL, {NULL, 0}};
		702	ASSERT_EQ(HITLS_X509_CrlCtrl(crl, HITLS_X509_EXT_SET_AKI, &aki, sizeof(HITLS_X509_ExtAki)), HITLS_X509_SUCCESS);
		703	HITLS_X509_ExtAki getaki = {0};
		704	ASSERT_EQ(HITLS_X509_CrlCtrl(crl, HITLS_X509_EXT_GET_AKI, &getaki, sizeof(HITLS_X509_ExtAki)), HITLS_X509_SUCCESS);
		705	ASSERT_EQ(getaki.critical, aki.critical);
		706	ASSERT_EQ(getaki.kid.dataLen, aki.kid.dataLen);
		707	ASSERT_EQ(memcmp(getaki.kid.data, aki.kid.data, aki.kid.dataLen), 0);
		708
		709	exit:
		710	HITLS_X509_CrlFree(crl);
		711	}
		712
		713	/* END_CASE */
		714
		715	/* BEGIN_CASE */
		716	void SDV_X509_CRL_CTRL_SetFunc_TC001(char *capath)
		717	{
		718	uint8_t serialNum[4] = {0x11, 0x22, 0x33, 0x44};
		719	BSL_TIME beforeTime = {0};
		720	BSL_TIME afterTime = {0};
		721	HITLS_X509_Cert *cert = NULL;
		722	HITLS_X509_Crl *crl = HITLS_X509_CrlNew();
		723	ASSERT_EQ(HITLS_X509_CertParseFile(BSL_FORMAT_UNKNOWN, capath, &cert), HITLS_X509_SUCCESS);
		724	ASSERT_NE(crl, NULL);
		725	uint32_t version = 1;
		726	ASSERT_EQ(HITLS_X509_CrlCtrl(crl, HITLS_X509_SET_VERSION, &version, sizeof(uint32_t)), HITLS_X509_SUCCESS);
		727	BslList *issuerDN = NULL;
		728	ASSERT_EQ(HITLS_X509_CertCtrl(cert, HITLS_X509_GET_ISSUER_DNNAME, &issuerDN, sizeof(BslList *)),
		729	HITLS_X509_SUCCESS);
		730	ASSERT_NE(issuerDN, NULL);
		731	ASSERT_EQ(HITLS_X509_CrlCtrl(crl, HITLS_X509_SET_ISSUER_DNNAME, issuerDN, sizeof(BslList)), HITLS_X509_SUCCESS);
		732	ASSERT_EQ(BSL_SAL_SysTimeGet(&beforeTime), BSL_SUCCESS);
		733	ASSERT_EQ(HITLS_X509_CrlCtrl(crl, HITLS_X509_SET_BEFORE_TIME, &beforeTime, sizeof(BSL_TIME)), HITLS_X509_SUCCESS);
		734
		735	afterTime = beforeTime;
		736	afterTime.year += 1;
		737	ASSERT_EQ(HITLS_X509_CrlCtrl(crl, HITLS_X509_SET_AFTER_TIME, &afterTime, sizeof(BSL_TIME)), HITLS_X509_SUCCESS);
		738
		739	HITLS_X509_ExtSki ski = {0};
		740	ASSERT_EQ(HITLS_X509_CertCtrl(cert, HITLS_X509_EXT_GET_SKI, &ski, sizeof(HITLS_X509_ExtSki)), HITLS_X509_SUCCESS);
		741	ASSERT_TRUE(ski.kid.data != NULL);
		742	HITLS_X509_ExtAki aki = {false, {ski.kid.data, ski.kid.dataLen}, cert->tbs.issuerName,
		743	{cert->tbs.serialNum.buff, cert->tbs.serialNum.len}};
		744	ASSERT_EQ(HITLS_X509_CrlCtrl(crl, HITLS_X509_EXT_SET_AKI, &aki, sizeof(HITLS_X509_ExtAki)), HITLS_X509_SUCCESS);
		745	HITLS_X509_ExtCrlNumber crlNumberExt = {false, {serialNum, 4}};
		746	ASSERT_EQ(HITLS_X509_CrlCtrl(crl, HITLS_X509_EXT_SET_CRLNUMBER, &crlNumberExt, sizeof(HITLS_X509_ExtCrlNumber)),
		747	HITLS_X509_SUCCESS);
		748	exit:
		749	HITLS_X509_CertFree(cert);
		750	HITLS_X509_CrlFree(crl);
		751	}
		752	/* END_CASE */
		753
		754	/* BEGIN_CASE */
		755	void SDV_X509_CRL_Sign_ParamCheck_TC001(void)
		756	{
		757	HITLS_X509_Crl *crl = NULL;
		758	CRYPT_EAL_PkeyCtx *pivKey = NULL;
		759	HITLS_X509_SignAlgParam algParam = {0};
		760
		761	// Create a basic CRL object
		762	crl = HITLS_X509_CrlNew();
		763	ASSERT_NE(crl, NULL);
		764
		765	// Test null parameters
		766	ASSERT_EQ(HITLS_X509_CrlSign(BSL_CID_SHA256, NULL, &algParam, crl), HITLS_X509_ERR_INVALID_PARAM);
		767	ASSERT_EQ(HITLS_X509_CrlSign(BSL_CID_SHA256, pivKey, &algParam, NULL), HITLS_X509_ERR_INVALID_PARAM);
		768	ASSERT_EQ(HITLS_X509_CrlSign(BSL_CID_SHA256, pivKey, NULL, crl), HITLS_X509_ERR_INVALID_PARAM);
		769
		770	// Test invalid digest algorithm
		771	ASSERT_EQ(HITLS_X509_CrlSign(BSL_CID_UNKNOWN, pivKey, &algParam, crl), HITLS_X509_ERR_INVALID_PARAM);
		772	ASSERT_EQ(HITLS_X509_CrlSign(BSL_CID_MAX, pivKey, &algParam, crl), HITLS_X509_ERR_INVALID_PARAM);
		773
		774	exit:
		775	HITLS_X509_CrlFree(crl);
		776	CRYPT_EAL_PkeyFreeCtx(pivKey);
		777	}
		778	/* END_CASE */
		779
		780	/* BEGIN_CASE */
		781	void SDV_X509_CRL_Sign_AlgParamCheck_TC001(void)
		782	{
		783	HITLS_X509_Crl *crl = NULL;
		784	HITLS_X509_SignAlgParam algParam = {0};
		785	CRYPT_EAL_PkeyCtx *pivKey = NULL;
		786
		787	// Create a basic CRL object
		788	crl = HITLS_X509_CrlNew();
		789	ASSERT_NE(crl, NULL);
		790
		791	// Read private key file for signing
		792	ASSERT_EQ(CRYPT_EAL_PriKeyParseFile(BSL_FORMAT_ASN1, CRYPT_PRIKEY_RSA,
		793	"../testdata/cert/asn1/rsa_cert/rsa_p1.key.der", NULL, 0, &pivKey), 0);
		794
		795	// Test missing RSA-PSS parameters
		796	algParam.algId = BSL_CID_RSASSAPSS;
		797	ASSERT_EQ(HITLS_X509_CrlSign(BSL_CID_SHA256, pivKey, &algParam, crl), HITLS_X509_ERR_INVALID_PARAM);
		798
		799	// Test invalid hash algorithm
		800	algParam.rsaPss.mdId = (CRYPT_MD_AlgId)BSL_CID_UNKNOWN;
		801	algParam.rsaPss.mgfId = (CRYPT_MD_AlgId)BSL_CID_SHA256;
		802	algParam.rsaPss.saltLen = 32;
		803
		804	ASSERT_EQ(HITLS_X509_CrlSign(BSL_CID_SHA256, pivKey, &algParam, crl), HITLS_X509_ERR_INVALID_PARAM);
		805
		806	// Test invalid MGF1 hash algorithm
		807	algParam.rsaPss.mdId = (CRYPT_MD_AlgId)BSL_CID_SHA256;
		808	algParam.rsaPss.mgfId = (CRYPT_MD_AlgId)BSL_CID_UNKNOWN;
		809	ASSERT_EQ(HITLS_X509_CrlSign(BSL_CID_SHA256, pivKey, &algParam, crl), HITLS_X509_ERR_INVALID_PARAM);
		810
		811	exit:
		812	HITLS_X509_CrlFree(crl);
		813	CRYPT_EAL_PkeyFreeCtx(pivKey);
		814	}
		815	/* END_CASE */
		816
		817	/* BEGIN_CASE */
		818	void SDV_X509_CRL_Sign_CrlFieldCheck_TC001(void)
		819	{
		820	HITLS_X509_Crl *crl = NULL;
		821	CRYPT_EAL_PkeyCtx *pivKey = NULL;
		822	HITLS_X509_Cert *cert = NULL;
		823	HITLS_X509_SignAlgParam algParam = {0};
		824	BSL_TIME beforeTime = {0};
		825	BSL_TIME afterTime = {0};
		826
		827	ASSERT_EQ(CRYPT_EAL_PriKeyParseFile(BSL_FORMAT_ASN1, CRYPT_PRIKEY_RSA,
		828	"../testdata/cert/asn1/rsa_cert/rsa_p1.key.der", NULL, 0, &pivKey), 0);
		829	ASSERT_EQ(HITLS_X509_CertParseFile(BSL_FORMAT_ASN1, "../testdata/cert/asn1/rsa_cert/rsa_p8.crt.der", &cert),
		830	HITLS_X509_SUCCESS);
		831
		832	// Create a basic CRL object
		833	crl = HITLS_X509_CrlNew();
		834	ASSERT_NE(crl, NULL);
		835	BslList *issueList = crl->tbs.issuerName;
		836	// Test CRL without necessary fields set
		837	ASSERT_EQ(HITLS_X509_CrlSign(BSL_CID_SHA256, pivKey, &algParam, crl),
		838	HITLS_X509_ERR_CRL_ISSUER_EMPTY);
		839
		840	// Set invalid version number
		841	crl->tbs.version = 2;
		842	ASSERT_EQ(HITLS_X509_CrlSign(BSL_CID_SHA256, pivKey, &algParam, crl),
		843	HITLS_X509_ERR_CRL_INACCURACY_VERSION);
		844	crl->tbs.version = 1;
		845	crl->tbs.issuerName = cert->tbs.subjectName;
		846	ASSERT_EQ(HITLS_X509_CrlSign(BSL_CID_SHA256, pivKey, &algParam, crl),
		847	HITLS_X509_ERR_CRL_THISUPDATE_UNEXIST);
		848	// Set invalid time
		849	ASSERT_EQ(BSL_SAL_SysTimeGet(&beforeTime), BSL_SUCCESS);
		850	ASSERT_EQ(HITLS_X509_CrlCtrl(crl, HITLS_X509_SET_BEFORE_TIME, &beforeTime, sizeof(BSL_TIME)), HITLS_X509_SUCCESS);
		851
		852	afterTime = beforeTime;
		853	afterTime.year -= 1; // Set to past time
		854	ASSERT_EQ(HITLS_X509_CrlCtrl(crl, HITLS_X509_SET_AFTER_TIME, &afterTime, sizeof(BSL_TIME)), HITLS_X509_SUCCESS);
		855	ASSERT_EQ(HITLS_X509_CrlSign(BSL_CID_SHA256, pivKey, &algParam, crl),
		856	HITLS_X509_ERR_CRL_TIME_INVALID);
		857
		858	// Set valid time but missing issuer
		859	afterTime = beforeTime;
		860	afterTime.year += 1;
		861	ASSERT_EQ(HITLS_X509_CrlCtrl(crl, HITLS_X509_SET_AFTER_TIME, &afterTime, sizeof(BSL_TIME)), HITLS_X509_SUCCESS);
		862	crl->tbs.issuerName = NULL;
		863	ASSERT_EQ(HITLS_X509_CrlSign(BSL_CID_SHA256, pivKey, &algParam, crl), HITLS_X509_ERR_CRL_ISSUER_EMPTY);
		864	crl->tbs.issuerName = cert->tbs.subjectName;
		865	crl->tbs.version = 0;
		866	BslList *extList = crl->tbs.crlExt.extList;
		867	crl->tbs.crlExt.extList = cert->tbs.ext.extList;
		868	ASSERT_EQ(HITLS_X509_CrlSign(BSL_CID_SHA256, pivKey, &algParam, crl), HITLS_X509_ERR_CRL_INACCURACY_VERSION);
		869	crl->tbs.crlExt.extList = extList;
		870	exit:
		871	crl->tbs.issuerName = issueList;
		872	HITLS_X509_CrlFree(crl);
		873	HITLS_X509_CertFree(cert);
		874	CRYPT_EAL_PkeyFreeCtx(pivKey);
		875	}
		876	/* END_CASE */
		877
		878	static int32_t SetCrlRevoked(HITLS_X509_Crl crl, BslList issuerDN, int8_t ser)
		879	{
		880	uint8_t serialNum[4] = {0x11, 0x22, 0x33, 0x44};
		881	serialNum[3] = ser;
		882	HITLS_X509_CrlEntry *entry = HITLS_X509_CrlRevokedNew();
		883	ASSERT_NE(entry, NULL);
		884	ASSERT_EQ(HITLS_X509_CrlRevokedCtrl(entry, HITLS_X509_CRL_SET_REVOKED_SERIALNUM,
		885	serialNum, sizeof(serialNum)), HITLS_X509_SUCCESS);
		886
		887	BSL_TIME revokeTime = {0};
		888	ASSERT_EQ(BSL_SAL_SysTimeGet(&revokeTime), BSL_SUCCESS);
		889	ASSERT_EQ(HITLS_X509_CrlRevokedCtrl(entry, HITLS_X509_CRL_SET_REVOKED_REVOKE_TIME, &revokeTime, sizeof(BSL_TIME)),
		890	HITLS_X509_SUCCESS);
		891	HITLS_X509_RevokeExtReason reason = {0, 1}; // keyCompromise
		892	ASSERT_EQ(HITLS_X509_CrlRevokedCtrl(entry, HITLS_X509_CRL_SET_REVOKED_REASON, &reason,
		893	sizeof(HITLS_X509_RevokeExtReason)), HITLS_X509_SUCCESS);
		894
		895	// Set invalid time (optional)
		896	BSL_TIME invalidTime = revokeTime;
		897	invalidTime.day -= 1; // Set invalid time to 1 day before revocation
		898	HITLS_X509_RevokeExtTime invalidTimeExt = {false, invalidTime};
		899	ASSERT_EQ(HITLS_X509_CrlRevokedCtrl(entry, HITLS_X509_CRL_SET_REVOKED_INVAILD_TIME,
		900	&invalidTimeExt, sizeof(HITLS_X509_RevokeExtTime)), HITLS_X509_SUCCESS);
		901
		902	// Set certificate issuer (optional, only needed for indirect CRLs)
		903	HITLS_X509_RevokeExtCertIssuer certIssuer = {
		904	false, // non-critical
		905	issuerDN // Use the same DN as CRL issuer for this test
		906	};
		907	ASSERT_EQ(HITLS_X509_CrlRevokedCtrl(entry, HITLS_X509_CRL_SET_REVOKED_CERTISSUER,
		908	&certIssuer, sizeof(HITLS_X509_RevokeExtCertIssuer)), HITLS_X509_SUCCESS);
		909
		910	ASSERT_EQ(HITLS_X509_CrlCtrl(crl, HITLS_X509_CRL_ADD_REVOKED_CERT, entry, sizeof(HITLS_X509_CrlEntry)),
		911	HITLS_X509_SUCCESS);
		912	HITLS_X509_CrlRevokedFree(entry);
		913	return HITLS_X509_SUCCESS;
		914	exit:
		915	return -1;
		916	}
		917
		918	/* BEGIN_CASE */
		919	void SDV_X509_CRL_Sign_RevokedCheck_TC001(void)
		920	{
		921	HITLS_X509_Crl *crl = NULL;
		922	HITLS_X509_Cert *cert = NULL;
		923	CRYPT_EAL_PkeyCtx *pivKey = NULL;
		924	HITLS_X509_SignAlgParam algParam = {0};
		925	HITLS_X509_CrlEntry *entry = NULL;
		926	BSL_TIME beforeTime = {0};
		927	BSL_TIME afterTime = {0};
		928
		929	ASSERT_EQ(CRYPT_EAL_PriKeyParseFile(BSL_FORMAT_ASN1, CRYPT_PRIKEY_RSA,
		930	"../testdata/cert/asn1/rsa_cert/rsa_p1.key.der", NULL, 0, &pivKey), 0);
		931	ASSERT_EQ(HITLS_X509_CertParseFile(BSL_FORMAT_ASN1, "../testdata/cert/asn1/rsa_cert/rsa_p1_v1.crt.der", &cert),
		932	HITLS_X509_SUCCESS);
		933
		934	// Create a basic CRL object and set necessary fields
		935	crl = HITLS_X509_CrlNew();
		936	ASSERT_NE(crl, NULL);
		937	BslList *issueList = crl->tbs.issuerName;
		938	// Set basic fields (version, time, issuer, etc.)
		939	crl->tbs.version = 1;
		940	crl->tbs.issuerName = cert->tbs.subjectName;
		941	ASSERT_EQ(BSL_SAL_SysTimeGet(&beforeTime), BSL_SUCCESS);
		942	ASSERT_EQ(HITLS_X509_CrlCtrl(crl, HITLS_X509_SET_BEFORE_TIME, &beforeTime, sizeof(BSL_TIME)), HITLS_X509_SUCCESS);
		943
		944	afterTime = beforeTime;
		945	afterTime.year += 1;
		946	ASSERT_EQ(HITLS_X509_CrlCtrl(crl, HITLS_X509_SET_AFTER_TIME, &afterTime, sizeof(BSL_TIME)), HITLS_X509_SUCCESS);
		947
		948	ASSERT_EQ(SetCrlRevoked(crl, cert->tbs.subjectName, 1), HITLS_X509_SUCCESS);
		949	entry = BSL_LIST_GET_FIRST(crl->tbs.revokedCerts);
		950	ASSERT_TRUE(entry != NULL);
		951
		952	crl->tbs.version = 0;
		953	ASSERT_EQ(HITLS_X509_CrlSign(BSL_CID_SHA256, pivKey, &algParam, crl), HITLS_X509_ERR_CRL_INACCURACY_VERSION);
		954
		955	crl->tbs.version = 1;
		956	uint8_t *serialNum = entry->serialNumber.buff;
		957	entry->serialNumber.buff = NULL;
		958	ASSERT_EQ(HITLS_X509_CrlSign(BSL_CID_SHA256, pivKey, &algParam, crl), HITLS_X509_ERR_CRL_ENTRY);
		959
		960	entry->serialNumber.buff = serialNum;
		961	uint32_t year = entry->time.year;
		962	entry->time.year = 0;
		963	ASSERT_EQ(HITLS_X509_CrlSign(BSL_CID_SHA256, pivKey, &algParam, crl), HITLS_X509_ERR_CRL_TIME_INVALID);
		964
		965	entry->time.year = year;
		966	exit:
		967	crl->tbs.issuerName = issueList;
		968	HITLS_X509_CrlFree(crl);
		969	HITLS_X509_CertFree(cert);
		970	CRYPT_EAL_PkeyFreeCtx(pivKey);
		971	}
		972	/* END_CASE */
		973
		974	static int32_t SetCrl(HITLS_X509_Crl crl, HITLS_X509_Cert cert, bool isV2)
		975	{
		976	BSL_TIME beforeTime = {0};
		977	BSL_TIME afterTime = {0};
		978	BslList *issuerDN = NULL;
		979	uint8_t crlNumber[1] = {0x01};
		980	// Set CRL version (v2)
		981	uint32_t version = 1;
		982	ASSERT_EQ(HITLS_X509_CrlCtrl(crl, HITLS_X509_SET_VERSION, &version, sizeof(version)), HITLS_X509_SUCCESS);
		983
		984	// Set issuer DN from certificate
		985	ASSERT_EQ(HITLS_X509_CertCtrl(cert, HITLS_X509_GET_SUBJECT_DNNAME, &issuerDN, sizeof(BslList *)),
		986	HITLS_X509_SUCCESS);
		987	ASSERT_EQ(HITLS_X509_CrlCtrl(crl, HITLS_X509_SET_ISSUER_DNNAME, issuerDN, sizeof(BslList)),
		988	HITLS_X509_SUCCESS);
		989
		990	// Set validity period
		991	ASSERT_EQ(BSL_SAL_SysTimeGet(&beforeTime), BSL_SUCCESS);
		992	ASSERT_EQ(HITLS_X509_CrlCtrl(crl, HITLS_X509_SET_BEFORE_TIME, &beforeTime, sizeof(BSL_TIME)),
		993	HITLS_X509_SUCCESS);
		994
		995	afterTime = beforeTime;
		996	afterTime.year += 1;
		997	ASSERT_EQ(HITLS_X509_CrlCtrl(crl, HITLS_X509_SET_AFTER_TIME, &afterTime, sizeof(BSL_TIME)),
		998	HITLS_X509_SUCCESS);
		999	for (int i = 0; i < 3; i++) {
		1000	ASSERT_EQ(SetCrlRevoked(crl, issuerDN, i), HITLS_X509_SUCCESS);
		1001	}
		1002	if (isV2) {
		1003	HITLS_X509_ExtSki ski = {0};
		1004	int32_t ret = HITLS_X509_CertCtrl(cert, HITLS_X509_EXT_GET_SKI, &ski, sizeof(HITLS_X509_ExtSki));
		1005	if (ret == HITLS_X509_SUCCESS) {
		1006	HITLS_X509_ExtAki aki = {false, {ski.kid.data, ski.kid.dataLen}, NULL, {NULL, 0}};
		1007	// Set SKI extension
		1008	ASSERT_EQ(HITLS_X509_CrlCtrl(crl, HITLS_X509_EXT_SET_AKI, &aki, sizeof(HITLS_X509_ExtAki)),
		1009	HITLS_X509_SUCCESS);
		1010	}
		1011
		1012	// Set CRL Number extension
		1013	HITLS_X509_ExtCrlNumber crlNumberExt = {
		1014	false, // non-critical
		1015	{crlNumber, sizeof(crlNumber)}
		1016	};
		1017	ASSERT_EQ(HITLS_X509_CrlCtrl(crl, HITLS_X509_EXT_SET_CRLNUMBER, &crlNumberExt,
		1018	sizeof(HITLS_X509_ExtCrlNumber)), HITLS_X509_SUCCESS);
		1019	}
		1020	return HITLS_X509_SUCCESS;
		1021	exit:
		1022	return -1;
		1023	}
		1024
		1025
		1026	/* BEGIN_CASE */
		1027	void SDV_X509_CRL_Sign_Func_TC001(char cert, char key, int keytype, int pkeyId, int pad, int mdId, int isV2,
		1028	char *tmp)
		1029	{
		1030	HITLS_X509_Crl *crl = NULL;
		1031	HITLS_X509_Crl *parseCrl = NULL;
		1032	HITLS_X509_Cert *issuerCert = NULL;
		1033	CRYPT_EAL_PkeyCtx *pivKey = NULL;
		1034	HITLS_X509_SignAlgParam algParam = {0};
		1035	(void)pkeyId;
		1036	TestRandInit();
		1037	// Parse issuer certificate and private key
		1038	ASSERT_EQ(HITLS_X509_CertParseFile(BSL_FORMAT_UNKNOWN, cert, &issuerCert), HITLS_X509_SUCCESS);
		1039	ASSERT_EQ(CRYPT_EAL_PriKeyParseFile(BSL_FORMAT_UNKNOWN, keytype, key, NULL, 0, &pivKey), 0);
		1040
		1041	// Create and initialize CRL
		1042	crl = HITLS_X509_CrlNew();
		1043	ASSERT_NE(crl, NULL);
		1044	ASSERT_EQ(SetCrl(crl, issuerCert, (bool)isV2), 0);
		1045	// Set signature algorithm parameters
		1046	if (pad == CRYPT_PKEY_EMSA_PSS) {
		1047	algParam.algId = BSL_CID_RSASSAPSS;
		1048	CRYPT_RSA_PssPara pssParam = {0};
		1049	pssParam.mdId = mdId;
		1050	pssParam.mgfId = mdId;
		1051	pssParam.saltLen = 32;
		1052	algParam.rsaPss = pssParam;
		1053	} else if (pad == CRYPT_PKEY_EMSA_PKCSV15) {
		1054	algParam.algId = BSL_CID_RSA;
		1055	algParam.pkcsV15.mdId = mdId;
		1056	}
		1057
		1058	if (pad == CRYPT_PKEY_EMSA_PSS \|\| pad == CRYPT_PKEY_EMSA_PKCSV15) {
		1059	ASSERT_EQ(HITLS_X509_CrlSign(mdId, pivKey, &algParam, crl), HITLS_X509_SUCCESS);
		1060	} else {
		1061	ASSERT_EQ(HITLS_X509_CrlSign(mdId, pivKey, NULL, crl), HITLS_X509_SUCCESS);
		1062	}
		1063
		1064	// Verify the signature is present
		1065	ASSERT_NE(crl->signature.buff, NULL);
		1066	ASSERT_NE(crl->signature.len, 0);
		1067	ASSERT_EQ(HITLS_X509_CrlGenFile(BSL_FORMAT_ASN1, crl, tmp), HITLS_X509_SUCCESS);
		1068	ASSERT_EQ(HITLS_X509_CrlParseFile(BSL_FORMAT_UNKNOWN, tmp, &parseCrl), HITLS_X509_SUCCESS);
		1069	ASSERT_NE(parseCrl, NULL);
		1070	ASSERT_EQ(HITLS_X509_CrlVerify(issuerCert->tbs.ealPubKey, parseCrl), HITLS_X509_SUCCESS);
		1071	HITLS_X509_CrlFree(parseCrl);
		1072	exit:
		1073	HITLS_X509_CrlFree(crl);
		1074	HITLS_X509_CertFree(issuerCert);
		1075	CRYPT_EAL_PkeyFreeCtx(pivKey);
		1076	}
		1077	/* END_CASE */

Mtestcode/sdv/testcase/x509/crl/test_suite_sdv_x509_crl.data+67-1

	@@ -16,6 +16,9 @@ SDV_X509_CRL_PARSE_FUNC_TC001:BSL_FORMAT_ASN1:"../testdata/cert/asn1/ca-1-rsa-sh
16	SDV_X509_CRL_PARSE_FUNC_TC001	16	SDV_X509_CRL_PARSE_FUNC_TC001
17	SDV_X509_CRL_PARSE_FUNC_TC001:BSL_FORMAT_ASN1:"../testdata/cert/asn1/ca-1-rsa-sha256-v1.der"	17	SDV_X509_CRL_PARSE_FUNC_TC001:BSL_FORMAT_ASN1:"../testdata/cert/asn1/ca-1-rsa-sha256-v1.der"
18		18
		19	SDV_X509_CRL_PARSE_FUNC_TC001 revokelist ext
		20	SDV_X509_CRL_PARSE_FUNC_TC001:BSL_FORMAT_UNKNOWN:"../testdata/cert/pem/crl/crl_v2.mul3.crl"
		21
19	SDV_X509_CRL_CTRL_FUNC_TC001	22	SDV_X509_CRL_CTRL_FUNC_TC001
20	SDV_X509_CRL_CTRL_FUNC_TC001:"../testdata/cert/asn1/ca-1-rsa-sha256-v2.der"	23	SDV_X509_CRL_CTRL_FUNC_TC001:"../testdata/cert/asn1/ca-1-rsa-sha256-v2.der"
21		24
	@@ -221,4 +224,67 @@ SDV_X509_CRL_EncodeFile_TC001 sm2 crl(der)
221	SDV_X509_CRL_EncodeFile_TC001:BSL_FORMAT_ASN1:"../testdata/cert/asn1/sm2_crl/crl_v2.v1.der"	224	SDV_X509_CRL_EncodeFile_TC001:BSL_FORMAT_ASN1:"../testdata/cert/asn1/sm2_crl/crl_v2.v1.der"
222		225
223	SDV_X509_CRL_EncodeFile_TC001 sm2 crl(pem)	226	SDV_X509_CRL_EncodeFile_TC001 sm2 crl(pem)
224	SDV_X509_CRL_EncodeFile_TC001:BSL_FORMAT_PEM:"../testdata/cert/pem/crl/crl_v2.pem"	227	SDV_X509_CRL_EncodeFile_TC001:BSL_FORMAT_PEM:"../testdata/cert/pem/crl/crl_v2.pem"
		228
		229	SDV_X509_CRL_Check_TC001 success rsa
		230	SDV_X509_CRL_Check_TC001:"../testdata/cert/chain/rsa-v3/inter.der":"../testdata/cert/chain/rsa-v3/crl_v1.der":HITLS_X509_SUCCESS
		231
		232	SDV_X509_CRL_Check_TC001 success ecdsa
		233	SDV_X509_CRL_Check_TC001:"../testdata/cert/chain/ecdsa-v3/inter.der":"../testdata/cert/chain/ecdsa-v3/crl_v2.old.der":HITLS_X509_SUCCESS
		234
		235	SDV_X509_CRL_Check_TC001 success rsa-pss
		236	SDV_X509_CRL_Check_TC001:"../testdata/cert/chain/rsa-pss-v3/rootca.crt":"../testdata/cert/chain/rsa-pss-v3/crl.der":HITLS_X509_SUCCESS
		237
		238	SDV_X509_CRL_Check_TC001 success sm2
		239	SDV_X509_CRL_Check_TC001:"../testdata/cert/sm2/inter.mul.der":"../testdata/cert/sm2/crl_v2.mul.der":HITLS_X509_SUCCESS
		240
		241	SDV_X509_CRL_CTRL_ParamCheck_TC001
		242	SDV_X509_CRL_CTRL_ParamCheck_TC001:
		243
		244	SDV_X509_CRL_PARSE_REVOKEDLIST_FUNC_TC001
		245	SDV_X509_CRL_PARSE_REVOKEDLIST_FUNC_TC001:"../testdata/cert/pem/crl/crl_v2.mul3.crl":3
		246
		247	SDV_X509_CRL_CTRL_RevokedParamCheck_TC001
		248	SDV_X509_CRL_CTRL_RevokedParamCheck_TC001:
		249
		250	SDV_X509_CRL_CTRL_GetFunc_TC001
		251	SDV_X509_CRL_CTRL_GetFunc_TC001:
		252
		253	SDV_X509_CRL_ExtCtrl_FuncTest_TC001
		254	SDV_X509_CRL_ExtCtrl_FuncTest_TC001:
		255
		256	SDV_X509_CRL_CTRL_SetFunc_TC001
		257	SDV_X509_CRL_CTRL_SetFunc_TC001:"../testdata/cert/pem/crl/inter.mul.crt"
		258
		259	SDV_X509_CRL_Sign_ParamCheck_TC001
		260	SDV_X509_CRL_Sign_ParamCheck_TC001:
		261
		262	SDV_X509_CRL_Sign_AlgParamCheck_TC001
		263	SDV_X509_CRL_Sign_AlgParamCheck_TC001:
		264
		265	SDV_X509_CRL_Sign_CrlFieldCheck_TC001
		266	SDV_X509_CRL_Sign_CrlFieldCheck_TC001:
		267
		268	SDV_X509_CRL_Sign_RevokedCheck_TC001
		269	SDV_X509_CRL_Sign_RevokedCheck_TC001:
		270
		271	SDV_X509_CRL_Sign_Func_TC001 v1 cert rsa_p1_v1.crt.der
		272	SDV_X509_CRL_Sign_Func_TC001:"../testdata/cert/asn1/rsa_cert/rsa_p1_v1.crt.der":"../testdata/cert/asn1/rsa_cert/rsa_p1.key.der":CRYPT_PRIKEY_RSA:CRYPT_PRIKEY_RSA:CRYPT_PKEY_EMSA_PKCSV15:CRYPT_MD_SHA256:0:"tmp-rsav1.crl"
		273
		274	SDV_X509_CRL_Sign_Func_TC001 v3 cert rsa_p8.crt.der
		275	SDV_X509_CRL_Sign_Func_TC001:"../testdata/cert/asn1/rsa_cert/rsa_p8.crt.der":"../testdata/cert/asn1/rsa_cert/rsa_p8.key.der":CRYPT_PRIKEY_PKCS8_UNENCRYPT:CRYPT_PKEY_RSA:CRYPT_PKEY_EMSA_PKCSV15:CRYPT_MD_SHA256:1:"tmp-rsav2.crl"
		276
		277	SDV_X509_CRL_Sign_Func_TC001 v3 cert sm2.crt.der
		278	SDV_X509_CRL_Sign_Func_TC001:"../testdata/cert/asn1/sm2_cert/sm2.crt.der":"../testdata/cert/asn1/sm2_cert/sm2.key.der":CRYPT_PRIKEY_ECC:CRYPT_PKEY_SM2:0:CRYPT_MD_SM3:1:"tmp-sm2.crl"
		279
		280	SDV_X509_CRL_Sign_Func_TC001 v3 cert ecdsa_sha384.crt.der
		281	SDV_X509_CRL_Sign_Func_TC001:"../testdata/cert/asn1/ecdsa_cert/ecdsa_sha384.crt.der":"../testdata/cert/asn1/ecdsa_cert/ecdsa_sha384.key.der":CRYPT_PRIKEY_PKCS8_UNENCRYPT:CRYPT_PKEY_ECDSA:0:CRYPT_MD_SHA384:1:"tmp-ec.crl"
		282
		283	SDV_X509_CRL_Sign_Func_TC001 v3 cert rsa_pss.crt.der
		284	SDV_X509_CRL_Sign_Func_TC001:"../testdata/cert/asn1/rsa_pss_cert/rsa_pss.crt.der":"../testdata/cert/asn1/rsa_pss_cert/rsa_pss.key.der":CRYPT_PRIKEY_PKCS8_UNENCRYPT:CRYPT_PKEY_RSA:CRYPT_PKEY_EMSA_PSS:CRYPT_MD_SHA256:0:"tmp-pss.crl"
		285
		286	SDV_X509_CRL_Sign_Func_TC001 v3 cert rsa -- rsa_pss.crt.der
		287	SDV_X509_CRL_Sign_Func_TC001:"../testdata/cert/asn1/rsa_cert/rsa_p8.crt.der":"../testdata/cert/asn1/rsa_cert/rsa_p8.key.der":CRYPT_PRIKEY_PKCS8_UNENCRYPT:CRYPT_PKEY_RSA:CRYPT_PKEY_EMSA_PSS:CRYPT_MD_SHA256:1:"tmp-rsa-pss.crl"
		288
		289	SDV_X509_CRL_Sign_Func_TC001 v2 cert rsa -- rsa_pss-aki.crt.der
		290	SDV_X509_CRL_Sign_Func_TC001:"../testdata/cert/asn1/rsa_cert/inter2.mul.crt":"../testdata/cert/asn1/rsa_cert/inter2.mul.key":CRYPT_PRIKEY_PKCS8_UNENCRYPT:CRYPT_PKEY_RSA:CRYPT_PKEY_EMSA_PSS:CRYPT_MD_SHA256:1:"tmp-rsa-pss-aki.crl"

Mtestcode/sdv/testcase/x509/csr/test_suite_sdv_x509_csr.c+22-18

	@@ -661,14 +661,15 @@ void SDV_X509_CSR_AttrCtrl_API_TC001(void)
661	TestMemInit();	661	TestMemInit();
662	HITLS_X509_Attr attr = {0};	662	HITLS_X509_Attr attr = {0};
663	HITLS_X509_Attr getAttr = {0};	663	HITLS_X509_Attr getAttr = {0};
664	HITLS_X509_Ext ext = {0};	664	HITLS_X509_Ext *ext = HITLS_X509_ExtNew(HITLS_X509_EXT_TYPE_CSR);
665	HITLS_X509_ExtKeyUsage ku = {0, HITLS_X509_EXT_KU_NON_REPUDIATION};	665	HITLS_X509_ExtKeyUsage ku = {0, HITLS_X509_EXT_KU_NON_REPUDIATION};
666	int32_t cmd = HITLS_X509_ATTR_SET_REQUESTED_EXTENSIONS;	666	int32_t cmd = HITLS_X509_ATTR_SET_REQUESTED_EXTENSIONS;
667	BslList *attrList = NULL;	667	BslList *attrList = NULL;
668		668
669	HITLS_X509_Csr *csr = HITLS_X509_CsrNew();	669	HITLS_X509_Csr *csr = HITLS_X509_CsrNew();
		670	ASSERT_NE(ext, NULL);
670	ASSERT_NE(csr, NULL);	671	ASSERT_NE(csr, NULL);
671	ASSERT_EQ(HITLS_X509_ExtCtrl(&ext, HITLS_X509_EXT_SET_KUSAGE, &ku, sizeof(HITLS_X509_ExtKeyUsage)), 0);	672	ASSERT_EQ(HITLS_X509_ExtCtrl(ext, HITLS_X509_EXT_SET_KUSAGE, &ku, sizeof(HITLS_X509_ExtKeyUsage)), 0);
672	ASSERT_EQ(HITLS_X509_CsrCtrl(csr, HITLS_X509_CSR_GET_ATTRIBUTES, &attrList, sizeof(BslList *)), 0);	673	ASSERT_EQ(HITLS_X509_CsrCtrl(csr, HITLS_X509_CSR_GET_ATTRIBUTES, &attrList, sizeof(BslList *)), 0);
673		674
674	// invalid param	675	// invalid param
	@@ -684,12 +685,12 @@ void SDV_X509_CSR_AttrCtrl_API_TC001(void)
684	attr.cid = BSL_CID_REQ_EXTENSION;	685	attr.cid = BSL_CID_REQ_EXTENSION;
685	ASSERT_EQ(HITLS_X509_AttrCtrl(attrList, cmd, &attr, sizeof(HITLS_X509_Attr)), HITLS_X509_ERR_INVALID_PARAM);	686	ASSERT_EQ(HITLS_X509_AttrCtrl(attrList, cmd, &attr, sizeof(HITLS_X509_Attr)), HITLS_X509_ERR_INVALID_PARAM);
686		687
687	attr.value = &ext;	688	attr.value = ext;
688		689
689	// encode ext failed	690	// encode ext failed
690	ext.list->count = 2;	691	ext->extList->count = 2;
691	ASSERT_EQ(HITLS_X509_AttrCtrl(attrList, cmd, &attr, sizeof(HITLS_X509_Attr)), BSL_INVALID_ARG);	692	ASSERT_EQ(HITLS_X509_AttrCtrl(attrList, cmd, &attr, sizeof(HITLS_X509_Attr)), BSL_INVALID_ARG);
692	ext.list->count = 1;	693	ext->extList->count = 1;
693		694
694	// success	695	// success
695	ASSERT_EQ(HITLS_X509_AttrCtrl(attrList, cmd, &attr, sizeof(HITLS_X509_Attr)), 0);	696	ASSERT_EQ(HITLS_X509_AttrCtrl(attrList, cmd, &attr, sizeof(HITLS_X509_Attr)), 0);
	@@ -703,10 +704,11 @@ void SDV_X509_CSR_AttrCtrl_API_TC001(void)
703	ASSERT_NE(getAttr.value, NULL);	704	ASSERT_NE(getAttr.value, NULL);
704	ASSERT_EQ(getAttr.cid, BSL_CID_REQ_EXTENSION);	705	ASSERT_EQ(getAttr.cid, BSL_CID_REQ_EXTENSION);
705	HITLS_X509_Ext *getExt = getAttr.value;	706	HITLS_X509_Ext *getExt = getAttr.value;
706	ASSERT_EQ(getExt->keyUsage, HITLS_X509_EXT_KU_NON_REPUDIATION);	707	HITLS_X509_CertExt certExt = (HITLS_X509_CertExt )getExt->extData;
		708	ASSERT_EQ(certExt->keyUsage, HITLS_X509_EXT_KU_NON_REPUDIATION);
707		709
708	// not found	710	// not found
709	HITLS_X509_ExtFree(getExt);	711	X509_ExtFree(getExt, true);
710	getExt = NULL;	712	getExt = NULL;
711	getAttr.value = NULL;	713	getAttr.value = NULL;
712	BSL_LIST_DeleteAll(attrList, (BSL_LIST_PFUNC_FREE)HITLS_X509_AttrEntryFree);	714	BSL_LIST_DeleteAll(attrList, (BSL_LIST_PFUNC_FREE)HITLS_X509_AttrEntryFree);
	@@ -715,8 +717,8 @@ void SDV_X509_CSR_AttrCtrl_API_TC001(void)
715		717
716	exit:	718	exit:
717	HITLS_X509_CsrFree(csr);	719	HITLS_X509_CsrFree(csr);
718	BSL_LIST_FREE(ext.list, (BSL_LIST_PFUNC_FREE)HITLS_X509_ExtEntryFree);	720	HITLS_X509_ExtFree(ext);
719	HITLS_X509_ExtFree(getExt);	721	X509_ExtFree(getExt, true);
720	}	722	}
721	/* END_CASE */	723	/* END_CASE */
722		724
	@@ -725,23 +727,24 @@ void SDV_X509_CSR_EncodeAttrList_FUNC_TC001(int critical1, int maxPath, int crit
725	{	727	{
726	TestMemInit();	728	TestMemInit();
727		729
728	HITLS_X509_Ext ext = {0};	730	HITLS_X509_Ext *ext = HITLS_X509_ExtNew(HITLS_X509_EXT_TYPE_CSR);
729	BslList *attrList = NULL;	731	BslList *attrList = NULL;
730	HITLS_X509_ExtBCons bCons = {critical1, false, maxPath};	732	HITLS_X509_ExtBCons bCons = {critical1, false, maxPath};
731	HITLS_X509_ExtKeyUsage ku = {critical2, keyUsage};	733	HITLS_X509_ExtKeyUsage ku = {critical2, keyUsage};
732	BSL_ASN1_Buffer encode = {0};	734	BSL_ASN1_Buffer encode = {0};
733		735
734	HITLS_X509_Csr *csr = HITLS_X509_CsrNew();	736	HITLS_X509_Csr *csr = HITLS_X509_CsrNew();
		737	ASSERT_NE(ext, NULL);
735	ASSERT_NE(csr, NULL);	738	ASSERT_NE(csr, NULL);
736	ASSERT_EQ(HITLS_X509_CsrCtrl(csr, HITLS_X509_CSR_GET_ATTRIBUTES, &attrList, sizeof(BslList *)), 0);	739	ASSERT_EQ(HITLS_X509_CsrCtrl(csr, HITLS_X509_CSR_GET_ATTRIBUTES, &attrList, sizeof(BslList *)), 0);
737	ASSERT_NE(attrList, NULL);	740	ASSERT_NE(attrList, NULL);
738		741
739	// Generate ext	742	// Generate ext
740	ASSERT_EQ(HITLS_X509_ExtCtrl(&ext, HITLS_X509_EXT_SET_KUSAGE, &ku, sizeof(HITLS_X509_ExtKeyUsage)), 0);	743	ASSERT_EQ(HITLS_X509_ExtCtrl(ext, HITLS_X509_EXT_SET_KUSAGE, &ku, sizeof(HITLS_X509_ExtKeyUsage)), 0);
741	ASSERT_EQ(HITLS_X509_ExtCtrl(&ext, HITLS_X509_EXT_SET_BCONS, &bCons, sizeof(HITLS_X509_ExtBCons)), 0);	744	ASSERT_EQ(HITLS_X509_ExtCtrl(ext, HITLS_X509_EXT_SET_BCONS, &bCons, sizeof(HITLS_X509_ExtBCons)), 0);
742		745
743	// Set ext into attr	746	// Set ext into attr
744	HITLS_X509_Attr attr = {BSL_CID_REQ_EXTENSION, &ext};	747	HITLS_X509_Attr attr = {BSL_CID_REQ_EXTENSION, ext};
745	ASSERT_EQ(HITLS_X509_AttrCtrl(attrList, HITLS_X509_ATTR_SET_REQUESTED_EXTENSIONS, &attr, sizeof(HITLS_X509_Attr)),	748	ASSERT_EQ(HITLS_X509_AttrCtrl(attrList, HITLS_X509_ATTR_SET_REQUESTED_EXTENSIONS, &attr, sizeof(HITLS_X509_Attr)),
746	0);	749	0);
747		750
	@@ -752,7 +755,7 @@ void SDV_X509_CSR_EncodeAttrList_FUNC_TC001(int critical1, int maxPath, int crit
752	exit:	755	exit:
753	HITLS_X509_CsrFree(csr);	756	HITLS_X509_CsrFree(csr);
754	BSL_SAL_Free(encode.buff);	757	BSL_SAL_Free(encode.buff);
755	BSL_LIST_FREE(ext.list, (BSL_LIST_PFUNC_FREE)HITLS_X509_ExtEntryFree);	758	HITLS_X509_ExtFree(ext);
756	}	759	}
757	/* END_CASE */	760	/* END_CASE */
758		761
	@@ -761,16 +764,17 @@ void SDV_X509_CSR_EncodeAttrList_FUNC_TC002(void)
761	{	764	{
762	TestMemInit();	765	TestMemInit();
763		766
764	HITLS_X509_Ext ext = {0};	767	HITLS_X509_Ext *ext = HITLS_X509_ExtNew(HITLS_X509_EXT_TYPE_CSR);
765	BslList *attrList = NULL;	768	BslList *attrList = NULL;
766	HITLS_X509_ExtKeyUsage ku = {0, HITLS_X509_EXT_KU_NON_REPUDIATION};	769	HITLS_X509_ExtKeyUsage ku = {0, HITLS_X509_EXT_KU_NON_REPUDIATION};
767	BSL_ASN1_Buffer encode = {0};	770	BSL_ASN1_Buffer encode = {0};
768		771
769	HITLS_X509_Csr *csr = HITLS_X509_CsrNew();	772	HITLS_X509_Csr *csr = HITLS_X509_CsrNew();
		773	ASSERT_NE(ext, NULL);
770	ASSERT_NE(csr, NULL);	774	ASSERT_NE(csr, NULL);
771	ASSERT_EQ(HITLS_X509_CsrCtrl(csr, HITLS_X509_CSR_GET_ATTRIBUTES, &attrList, sizeof(BslList *)), 0);	775	ASSERT_EQ(HITLS_X509_CsrCtrl(csr, HITLS_X509_CSR_GET_ATTRIBUTES, &attrList, sizeof(BslList *)), 0);
772	ASSERT_NE(attrList, NULL);	776	ASSERT_NE(attrList, NULL);
773	ASSERT_EQ(HITLS_X509_ExtCtrl(&ext, HITLS_X509_EXT_SET_KUSAGE, &ku, sizeof(HITLS_X509_ExtKeyUsage)), 0);	777	ASSERT_EQ(HITLS_X509_ExtCtrl(ext, HITLS_X509_EXT_SET_KUSAGE, &ku, sizeof(HITLS_X509_ExtKeyUsage)), 0);
774		778
775	// Test 1: no attr	779	// Test 1: no attr
776	ASSERT_EQ(HITLS_X509_EncodeAttrList(1, attrList, &encode), 0);	780	ASSERT_EQ(HITLS_X509_EncodeAttrList(1, attrList, &encode), 0);
	@@ -782,7 +786,7 @@ void SDV_X509_CSR_EncodeAttrList_FUNC_TC002(void)
782	ASSERT_EQ(HITLS_X509_EncodeAttrList(1, attrList, &encode), BSL_INVALID_ARG);	786	ASSERT_EQ(HITLS_X509_EncodeAttrList(1, attrList, &encode), BSL_INVALID_ARG);
783		787
784	// Set ext into attr	788	// Set ext into attr
785	HITLS_X509_Attr attr = {BSL_CID_REQ_EXTENSION, &ext};	789	HITLS_X509_Attr attr = {BSL_CID_REQ_EXTENSION, ext};
786	ASSERT_EQ(HITLS_X509_AttrCtrl(attrList, HITLS_X509_ATTR_SET_REQUESTED_EXTENSIONS, &attr, sizeof(HITLS_X509_Attr)),	790	ASSERT_EQ(HITLS_X509_AttrCtrl(attrList, HITLS_X509_ATTR_SET_REQUESTED_EXTENSIONS, &attr, sizeof(HITLS_X509_Attr)),
787	0);	791	0);
788		792
	@@ -791,7 +795,7 @@ void SDV_X509_CSR_EncodeAttrList_FUNC_TC002(void)
791		795
792	exit:	796	exit:
793	HITLS_X509_CsrFree(csr);	797	HITLS_X509_CsrFree(csr);
794	BSL_LIST_FREE(ext.list, (BSL_LIST_PFUNC_FREE)HITLS_X509_ExtEntryFree);	798	HITLS_X509_ExtFree(ext);
795	}	799	}
796	/* END_CASE */	800	/* END_CASE */
797		801

Mtestcode/sdv/testcase/x509/verify/test_suite_sdv_x509_vfy.c+1-1

	@@ -160,7 +160,7 @@ void SDV_X509_STORE_VFY_CRL_FUNC_TC001(int type, int expResult, char *path1, cha
160	ret = HITLS_BuildChain(storeCtx->crl, 1, crl1, crl2, NULL, NULL, NULL);	160	ret = HITLS_BuildChain(storeCtx->crl, 1, crl1, crl2, NULL, NULL, NULL);
161	ASSERT_EQ(ret, HITLS_X509_SUCCESS);	161	ASSERT_EQ(ret, HITLS_X509_SUCCESS);
162		162
163	ret = HITLS_X509_CrlVerify(storeCtx, chain);	163	ret = HITLS_X509_VerifyCrl(storeCtx, chain);
164	ASSERT_EQ(ret, expResult);	164	ASSERT_EQ(ret, expResult);
165	exit:	165	exit:
166	HITLS_X509_FreeStoreCtxMock(storeCtx);	166	HITLS_X509_FreeStoreCtxMock(storeCtx);

Atestcode/testdata/cert/asn1/rsa_cert/inter2.mul.crt+79-0

@@ -0,0 +1,79 @@
	1	Certificate:
	2	Data:
	3	Version: 3 (0x2)
	4	Serial Number: 5 (0x5)
	5	Signature Algorithm: sha256WithRSAEncryption
	6	Issuer: C=XX, ST=XX, L=XX, O=certificate, OU=testca, CN=certificate.testca.mul.com
	7	Validity
	8	Not Before: Oct 31 02:13:07 2024 GMT
	9	Not After : Oct 29 02:13:07 2034 GMT
	10	Subject: C=XX, ST=XX, O=certificate, OU=testend, CN=certificate.testinter2.mul.com
	11	Subject Public Key Info:
	12	Public Key Algorithm: rsaEncryption
	13	Public-Key: (2048 bit)
	14	Modulus:
	15	00:bd:ef:a7:e2:03:1a:b8:c5:fe:1c:35:8d:74:49:
	16	c8:a3:33:f9:a7:a2:3d:90:75:46:9d:d8:a1:ed:d2:
	17	e7:2e:28:14:53:9b:e0:71:a2:7d:e5:b0:c9:71:c0:
	18	74:4f:ff:0a:92:4a:4c:a3:18:ce:d2:ce:e8:21:1b:
	19	e7:a9:a2:3f:95:5e:bd:e0:6a:99:68:43:24:48:ca:
	20	f9:64:75:42:b1:4d:83:fe:c3:73:2d:64:6f:03:ba:
	21	cf:95:28:d7:13:5a:41:4e:ab:3c:ef:25:d9:bf:3b:
	22	56:0c:f9:86:8b:3f:d3:67:0e:74:15:0a:42:be:bd:
	23	b2:1a:0a:23:19:b4:9a:59:0b:e1:fc:7f:39:d6:18:
	24	86:a7:16:4b:53:3f:70:a5:04:97:25:ef:74:47:aa:
	25	02:b0:31:da:a0:fa:d2:a4:62:50:26:02:04:59:7b:
	26	50:b0:d0:6d:f7:e7:f3:05:f9:b6:01:71:a0:84:5d:
	27	95:ab:15:bb:31:8a:53:98:df:de:13:d4:54:4b:61:
	28	59:99:c3:b4:cb:69:b6:0f:19:85:a7:41:fb:c2:7f:
	29	6d:f6:e5:69:8d:66:35:e9:ad:0f:7d:ab:35:5c:78:
	30	a9:d0:7d:bb:84:55:f3:78:e6:1d:2f:40:83:54:cd:
	31	fd:16:8c:8a:f9:a8:7f:0a:81:1a:aa:cc:54:c1:a7:
	32	4d:09
	33	Exponent: 65537 (0x10001)
	34	X509v3 extensions:
	35	X509v3 Basic Constraints:
	36	CA:TRUE
	37	X509v3 Subject Key Identifier:
	38	E6:70:CB:CF:84:84:D8:16:83:7F:03:E6:B4:16:96:EF:4B:56:EC:8B
	39	X509v3 Authority Key Identifier:
	40	48:01:C2:A8:D8:66:A0:B5:FC:95:95:B3:C3:3E:00:B4:EB:5A:68:56
	41	Signature Algorithm: sha256WithRSAEncryption
	42	Signature Value:
	43	96:34:76:e4:d3:09:69:e6:d9:56:aa:ec:a7:96:cd:6e:78:72:
	44	32:1b:c7:b5:c1:b1:05:8a:84:99:87:88:25:9f:46:75:65:90:
	45	87:f1:20:8e:e9:6d:e3:c6:e5:ba:ed:4f:5c:ec:4d:fb:d1:cf:
	46	b5:e2:1c:bd:63:b7:2e:ce:2d:b1:99:a7:54:f7:78:71:e8:4f:
	47	f3:20:81:a4:27:0b:66:06:9e:78:65:3b:44:23:63:88:6c:f5:
	48	8b:df:9e:44:a3:51:ca:12:3b:c6:a6:5d:7d:5d:1d:f2:45:9b:
	49	e8:a0:7e:93:08:28:5a:c8:44:22:f2:f4:a2:50:6f:cf:06:2f:
	50	27:e6:fc:d4:f6:a9:7f:84:27:4e:e4:db:4a:20:4b:70:51:d3:
	51	a0:bb:df:77:ed:ea:1b:1c:6d:1c:b0:63:20:f5:77:be:0c:ac:
	52	3d:37:b7:0d:d7:02:9f:9f:44:60:1f:c9:a0:89:19:89:00:3b:
	53	8f:a8:1b:31:5c:42:e4:7e:47:e3:a0:64:1d:62:a3:16:73:cf:
	54	00:ec:6a:9c:5d:d8:01:b6:cf:c3:3c:46:f9:b8:88:76:95:82:
	55	5a:77:11:73:36:bc:21:5f:08:c0:80:63:84:90:a6:79:57:03:
	56	f9:0b:9c:88:0c:94:95:a6:80:04:5a:af:bd:e6:f0:7b:89:09:
	57	33:60:ed:d3
	58	-----BEGIN CERTIFICATE-----
	59	MIIDqTCCApGgAwIBAgIBBTANBgkqhkiG9w0BAQsFADBzMQswCQYDVQQGEwJYWDEL
	60	MAkGA1UECAwCWFgxCzAJBgNVBAcMAlhYMRQwEgYDVQQKDAtjZXJ0aWZpY2F0ZTEP
	61	MA0GA1UECwwGdGVzdGNhMSMwIQYDVQQDDBpjZXJ0aWZpY2F0ZS50ZXN0Y2EubXVs
	62	LmNvbTAeFw0yNDEwMzEwMjEzMDdaFw0zNDEwMjkwMjEzMDdaMGsxCzAJBgNVBAYT
	63	AlhYMQswCQYDVQQIDAJYWDEUMBIGA1UECgwLY2VydGlmaWNhdGUxEDAOBgNVBAsM
	64	B3Rlc3RlbmQxJzAlBgNVBAMMHmNlcnRpZmljYXRlLnRlc3RpbnRlcjIubXVsLmNv
	65	bTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAL3vp+IDGrjF/hw1jXRJ
	66	yKMz+aeiPZB1Rp3Yoe3S5y4oFFOb4HGifeWwyXHAdE//CpJKTKMYztLO6CEb56mi
	67	P5VeveBqmWhDJEjK+WR1QrFNg/7Dcy1kbwO6z5Uo1xNaQU6rPO8l2b87Vgz5hos/
	68	02cOdBUKQr69shoKIxm0mlkL4fx/OdYYhqcWS1M/cKUElyXvdEeqArAx2qD60qRi
	69	UCYCBFl7ULDQbffn8wX5tgFxoIRdlasVuzGKU5jf3hPUVEthWZnDtMtptg8ZhadB
	70	+8J/bfblaY1mNemtD32rNVx4qdB9u4RV83jmHS9Ag1TN/RaMivmofwqBGqrMVMGn
	71	TQkCAwEAAaNQME4wDAYDVR0TBAUwAwEB/zAdBgNVHQ4EFgQU5nDLz4SE2BaDfwPm
	72	tBaW70tW7IswHwYDVR0jBBgwFoAUSAHCqNhmoLX8lZWzwz4AtOtaaFYwDQYJKoZI
	73	hvcNAQELBQADggEBAJY0duTTCWnm2Vaq7KeWzW54cjIbx7XBsQWKhJmHiCWfRnVl
	74	kIfxII7pbePG5brtT1zsTfvRz7XiHL1jty7OLbGZp1T3eHHoT/MggaQnC2YGnnhl
	75	O0QjY4hs9YvfnkSjUcoSO8amXX1dHfJFm+igfpMIKFrIRCLy9KJQb88GLyfm/NT2
	76	qX+EJ07k20ogS3BR06C733ft6hscbRywYyD1d74MrD03tw3XAp+fRGAfyaCJGYkA
	77	O4+oGzFcQuR+R+OgZB1ioxZzzwDsapxd2AG2z8M8Rvm4iHaVglp3EXM2vCFfCMCA
	78	Y4SQpnlXA/kLnIgMlJWmgARar73m8HuJCTNg7dM=
	79	-----END CERTIFICATE-----

Atestcode/testdata/cert/asn1/rsa_cert/inter2.mul.key+28-0

@@ -0,0 +1,28 @@
	1	-----BEGIN PRIVATE KEY-----
	2	MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQC976fiAxq4xf4c
	3	NY10ScijM/mnoj2QdUad2KHt0ucuKBRTm+Bxon3lsMlxwHRP/wqSSkyjGM7Szugh
	4	G+epoj+VXr3gaploQyRIyvlkdUKxTYP+w3MtZG8Dus+VKNcTWkFOqzzvJdm/O1YM
	5	+YaLP9NnDnQVCkK+vbIaCiMZtJpZC+H8fznWGIanFktTP3ClBJcl73RHqgKwMdqg
	6	+tKkYlAmAgRZe1Cw0G335/MF+bYBcaCEXZWrFbsxilOY394T1FRLYVmZw7TLabYP
	7	GYWnQfvCf2325WmNZjXprQ99qzVceKnQfbuEVfN45h0vQINUzf0WjIr5qH8KgRqq
	8	zFTBp00JAgMBAAECggEAAvHMMHzL1UF8hwNthff+3EjZ/fdN7QdkaN4K5Jz4aIbG
	9	ieVIvXo/aWgsN088fmD90PbF6WFhE3ORtbGxDbguNCqb1vbQGgWwclBzPVN0DTue
	10	aDyvdGyyK+ShgzZ23x3vFUEiWLLFhWluFBVqOI5swJRAyHK4Riy6rhyqHqPmIKs/
	11	obSIYk+t2jRy3/7hPo+54Q8PR8YIEcjXfGMTJks+I5sW+Ay0nF9KeGFbmfanXBRK
	12	il/o+pQBMDGjFpsS4xZzuqvUaJnRsteiVLVTk/iCJOlulMoSt7+pqkQFzo0kpSnv
	13	9y2Nxt0bfgl+RAyNS6kLUeZJ4MUthNcol/h8FEL0AQKBgQDu81b0bHmP5JJpwhze
	14	E7g98lj7ua1PiPAQsoLrUssL5tv4rwTp3qLQI+GGH/ZZAX9/Ow2a1IMvMluaRkvU
	15	zfweGUk7JkHfCxER9yEibpC5oFjrMvX6/moG4Nh2+TwFGuWCn6BU//Z8xU5uEOBR
	16	s8kvbU/OCUZwDKMfSQROw+V4UQKBgQDLfQV6HQGxv+triKFAkQ2/zpBWlLYwLRMb
	17	QnwNRebHj3gK3/Y8N/+LxPNHxzVsb+hmKHFnD8YB3jf5w+xaXbI16aNv+wJDcWVy
	18	nxyZUd4Ua9UAMJ7tF3TFusyDthWwrshJLXVZTzyaMVQUhnwTVtq6xxF0m/WjpgLp
	19	darIUqmTOQKBgQDZdfXtzga3kII642CYLwQexD59IJb8ahhoab1B4oBNXZVVdhqX
	20	qHktyWnGQbJVgEqDBMA15y9YNZEuDsmWarwGvGZsAT4zeYPYgLrT9iGZ/bbOnftE
	21	qGLfzaLSa7JWxwqWXSVyFdxB4uKkwpETafYvRmE5ljFXafjOUQotkJR2cQKBgFn4
	22	yGAqzSH7mqrsOWgj+rFRMu6lSDza4TTPW6w+uQCJhelBB02u8NWq2mplQVDV1iq9
	23	PQ71oXYX/CX6I9n8zZwa1sHfeSu6ysE4atu7n/blisNPvCVWlrIKmvytmL+LOFFq
	24	wRUg/Mmsf+GnaNrgL0wgUq59esnF0EnLVhzGt+W5AoGBALHOKZxnwkX6DxW7bbgP
	25	RvW7UFro9x98uzAZ0FDZwsAx6PT9ifhafpvykhAtX1yAbPDXjrSMrbJyRpSxRmH+
	26	zEqAd1g3Df37o5oDzPre07tx/A0agcBcC4YB3Yunf19W1Q77FPYbPRiyf8y8xmb1
	27	7c5Ix5yCLkX1wjurun6pmpf6
	28	-----END PRIVATE KEY-----

Atestcode/testdata/cert/chain/rsa-pss-v3/crl.der+12-0

@@ -0,0 +1,12 @@
	1	-----BEGIN X509 CRL-----
	2	MIIBrzCBmAIBATANBgkqhkiG9w0BAQowADBVMQswCQYDVQQGEwJhYTEOMAwGA1UE
	3	CAwFYWFhYWExCzAJBgNVBAcMAmNjMQ4wDAYDVQQKDAVsbGxsbDELMAkGA1UECwwC
	4	c3MxDDAKBgNVBAMMA3NzcxcNMjQwOTExMTAxODIxWhcNMjYwOTExMTAxODIxWqAP
	5	MA0wCwYDVR0UBAQCAhABMA0GCSqGSIb3DQEBCjAAA4IBAQBprgGGJA6MMeh4KOQo
	6	4i8a74JkDUdPoOxC7kHvowIh2yNn0u/4xNitf/ccy+36bKJFTCzo2ynnmdKg/Odz
	7	AQg/s0ku1tUDQ54L7SdLjO36Ld/PFcjeEyC79Ipi94b6SSYI8fe6Y4KhzktH860u
	8	XL5M3UlpVDFrcgZRLa26cPYEDAq15uTD1QEBLJv5xF9xzG3CJbTdP7+cGXKr0YLh
	9	gYhtRY6VHLK20BdTOnxS/6kLP+xIPQebqwgsEbUjHOCL5yyt2oXH+K6XbZLHncmp
	10	y81kDqPRr9lJyWbcp3Oa2KjW6HJc7lr9abAhlNDbu+ReUGo+XfPu4EvF9tqxMnqv
	11	DsNf
	12	-----END X509 CRL-----

Atestcode/testdata/cert/chain/rsa-pss-v3/rootca.crt+24-0

@@ -0,0 +1,24 @@
	1	-----BEGIN CERTIFICATE-----
	2	MIID8TCCAqWgAwIBAgIUCZuszA0TVouSTMm/4MOixiWl2V8wQQYJKoZIhvcNAQEK
	3	MDSgDzANBglghkgBZQMEAgEFAKEcMBoGCSqGSIb3DQEBCDANBglghkgBZQMEAgEF
	4	AKIDAgEgMFUxCzAJBgNVBAYTAmFhMQ4wDAYDVQQIDAVhYWFhYTELMAkGA1UEBwwC
	5	Y2MxDjAMBgNVBAoMBWxsbGxsMQswCQYDVQQLDAJzczEMMAoGA1UEAwwDc3NzMB4X
	6	DTI0MDkxMTEwMDE1MVoXDTI5MDkxMTEwMDE1MVowVTELMAkGA1UEBhMCYWExDjAM
	7	BgNVBAgMBWFhYWFhMQswCQYDVQQHDAJjYzEOMAwGA1UECgwFbGxsbGwxCzAJBgNV
	8	BAsMAnNzMQwwCgYDVQQDDANzc3MwggEgMAsGCSqGSIb3DQEBCgOCAQ8AMIIBCgKC
	9	AQEAsV2iY9395F+V+XJ/yCxPMZipRM1QUyee1VOx/bqj3AuPERX+TVO2mQDcstfZ
	10	6UWhpvjqLAFrUBgtG9CIynf0DlFaI6mgpGKX2d5a1JoJfVtK+6TOLXb6zCtpKzZL
	11	lE8rzjbzYnel18c+4dRjqUTU/UAJ/czitRxzaubUWYQScvA6TM5b79jmWy1xQBbQ
	12	0G7zDRB61XXysdaXWeqeU8kmFPAtv+f2SGIVTK8z2ys3KqCrTapeovQkci25WZxj
	13	0REAI4eQ1ohMkqCqMDKug/EtQUJBgoRW5TZrExysVnZ+CyjcI7BFjgXYUb2Q1g/2
	14	JXqW7XCI0D5zg4k0FKfEFAP5GQIDAQABo1MwUTAdBgNVHQ4EFgQUhDwCDSwejnAk
	15	xwARyEJeOfgLAqMwHwYDVR0jBBgwFoAUhDwCDSwejnAkxwARyEJeOfgLAqMwDwYD
	16	VR0TAQH/BAUwAwEB/zBBBgkqhkiG9w0BAQowNKAPMA0GCWCGSAFlAwQCAQUAoRww
	17	GgYJKoZIhvcNAQEIMA0GCWCGSAFlAwQCAQUAogMCASADggEBAKIs5+yO21S9quY3
	18	FkDibpmM8NHu3YyxVLXU58Wv+52/HcfqFa4bcIC/oLfC2SpnLco1sBHeYo9uqXYB
	19	RbnndLEGZ2PDqr8C5Pd2g2xmZfs3bJ0vZV9KIUOEQL4plmj1QiM+wn5U/C7NPCIe
	20	ijxkIDKl1AQCZY41Aqw6Xfi0F+9fILwhVsnFgkUwDffQbldWIRmsjahYfxL4w1ZY
	21	PGKdsRD0J2MtivEBE1R9SXBgAqo9kPlroVEg9mcMGq2zMnHXetEF00qmzXs93Gus
	22	KYeW963wx5XYXappDDym1yv2FosnOTgQwlhC8cui83TlsjzrWFIN12KEAMwAmnak
	23	t/ChwwI=
	24	-----END CERTIFICATE-----

Atestcode/testdata/cert/pem/crl/crl_v2.mul3.crl+15-0

@@ -0,0 +1,15 @@
	1	-----BEGIN X509 CRL-----
	2	MIICXTCCAUUCAQEwDQYJKoZIhvcNAQELBQAwZjELMAkGA1UEBhMCWFgxCzAJBgNV
	3	BAgMAlhYMRQwEgYDVQQKDAtjZXJ0aWZpY2F0ZTEPMA0GA1UECwwGdGVzdGluMSMw
	4	IQYDVQQDDBpjZXJ0aWZpY2F0ZS50ZXN0aW4ubXVsLmNvbRcNMjQxMDMxMDE0OTM5
	5	WhcNMjQxMTMwMDE0OTM5WjCBmjAgAgECFw0yNDEwMzAxMzM1NTNaMAwwCgYDVR0V
	6	BAMKAQEwOgIBAxcNMjQxMDMxMDE0NTAxWjAmMAoGA1UdFQQDCgEBMBgGA1UdGAQR
	7	GA8yMDI0MTAzMTAwMjAzMFowOgIBBBcNMjQxMDMxMDE0OTI5WjAmMAoGA1UdFQQD
	8	CgECMBgGA1UdGAQRGA8yMDI0MTAzMDEyMzAxN1qgDjAMMAoGA1UdFAQDAgEDMA0G
	9	CSqGSIb3DQEBCwUAA4IBAQAbntIe+Sl+ndXT/9ukzVhL4OUYbkA/zYDiUyYqpY6o
	10	+cKvAk9ocHOfMYzkjMKokkYy6hNWZrv8phovV9Z40Xo/FSGo+NAV/i2Os/dijfse
	11	XVmcSadrseQ3bjMO55us77BjRJWu8MR6tI2Yoj0U+Rgab3LK1+jE76awHx3UcEZi
	12	MZ8/TfTgGGi2V0M8asg9JYAEIQNRh3nKv8VHKBUQxvJi0uQTeAE0X0dztxqmbcIG
	13	Jiu4cQZhlL5p2heR/MJgKZlvae2FU6+Blc7uVL9SzBFeDWWVMzRcyM/og42eS/3H
	14	/8jGq2JTGUTSavS69kzGMPHZKoSJBdF1O3BOPx4tno7r
	15	-----END X509 CRL-----

Atestcode/testdata/cert/pem/crl/inter.mul.crt+22-0

@@ -0,0 +1,22 @@
	1	-----BEGIN CERTIFICATE-----
	2	MIIDpDCCAoygAwIBAgIBATANBgkqhkiG9w0BAQsFADBzMQswCQYDVQQGEwJYWDEL
	3	MAkGA1UECAwCWFgxCzAJBgNVBAcMAlhYMRQwEgYDVQQKDAtjZXJ0aWZpY2F0ZTEP
	4	MA0GA1UECwwGdGVzdGNhMSMwIQYDVQQDDBpjZXJ0aWZpY2F0ZS50ZXN0Y2EubXVs
	5	LmNvbTAeFw0yNDEwMzAxMzMwMzFaFw0zNDEwMjgxMzMwMzFaMGYxCzAJBgNVBAYT
	6	AlhYMQswCQYDVQQIDAJYWDEUMBIGA1UECgwLY2VydGlmaWNhdGUxDzANBgNVBAsM
	7	BnRlc3RpbjEjMCEGA1UEAwwaY2VydGlmaWNhdGUudGVzdGluLm11bC5jb20wggEi
	8	MA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDO111prwgcu/oDTLbXmbbsithB
	9	f/mQj/enW0YJ6kz9yZypX4L2PLadOQrUW8wEDsWsNceYlOYf6scIG6EPXPQ9k/Hp
	10	4bPkuU5BbUGQQD4ttpuE1Oqnr7gmJGTzltAi1OvTMW5QFP9P51Au3Na+kuj0o3XN
	11	nOf//0me4b2nUfJLmAE/cpJws+7/V1tz0FCV86UGDPXUr7j23uc5/sl1wPJR45mq
	12	k2sL3VQkrcw/FnXKz02LCsBxw9vagLvMhEEEN4F2CJxLuNzKMcyYTWzuHVZMUzG3
	13	xlxTVmDbMMNeWxUxMLHOeXVdZuR8hISRJYv6k/Iem4851SGog9h1n1p4wI+HAgMB
	14	AAGjUDBOMAwGA1UdEwQFMAMBAf8wHQYDVR0OBBYEFJ3xhXzTvjJgVkIc9oIgMpaG
	15	Unl3MB8GA1UdIwQYMBaAFEgBwqjYZqC1/JWVs8M+ALTrWmhWMA0GCSqGSIb3DQEB
	16	CwUAA4IBAQAQwaioB7QiHjdbSY3sXEkj3Qy+mm5rb/f5dG/rgEfoBEhf6pJHBKkz
	17	V6f0ShsfR6ThYYztpcpn2P1fBEl1Kw9blJ+QijnY47LIP4D10qW++mXJL0Grf8jx
	18	3Xrrw+ejMQVVurK2ubkb/o4kD8bEDzOf37WQ5ULc7z2pxPEzpE1VZJWc2NzBMVGj
	19	Q6QJfv8+Ijf7N7I+AspUZgPK4BGJkmzk/7JDOdCa3OBmZ96JHGsvJNDYYPiogORq
	20	0F647Fzq7EwzWzD/MrkJj838SL14Bfd0JeEn3O2UkvUuKT+4FJ9rlFOvGrF+a6TK
	21	ylbqrKEc94vW1jJ96MImrmHDDHmCC0Xw
	22	-----END CERTIFICATE-----

Atestcode/testdata/cert/pem/crl/inter.mul.key+28-0

@@ -0,0 +1,28 @@
	1	-----BEGIN PRIVATE KEY-----
	2	MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQDO111prwgcu/oD
	3	TLbXmbbsithBf/mQj/enW0YJ6kz9yZypX4L2PLadOQrUW8wEDsWsNceYlOYf6scI
	4	G6EPXPQ9k/Hp4bPkuU5BbUGQQD4ttpuE1Oqnr7gmJGTzltAi1OvTMW5QFP9P51Au
	5	3Na+kuj0o3XNnOf//0me4b2nUfJLmAE/cpJws+7/V1tz0FCV86UGDPXUr7j23uc5
	6	/sl1wPJR45mqk2sL3VQkrcw/FnXKz02LCsBxw9vagLvMhEEEN4F2CJxLuNzKMcyY
	7	TWzuHVZMUzG3xlxTVmDbMMNeWxUxMLHOeXVdZuR8hISRJYv6k/Iem4851SGog9h1
	8	n1p4wI+HAgMBAAECggEAIl8aeEXsQK4iCStV1PUHtz4JWrUT+ShbXJWnyV0Eh0Xa
	9	ATFMd3O2WuEQQiKw/9mekpPrQ5k2toYSpe/Fb2KgeZ0cnaNye+cpMGkh9IEgdAM8
	10	y7F//vaN0NTKa8obczZTq+gybx9WH+aN5gOvscKC8Kg7GrxgtyMqjjrwA55z94iR
	11	59A3YPtRYXWknqWJera/dLwyTTFWsinbNDe4MHTcfeGDurA7YRxJprm+djKXCDsM
	12	F3W15KfeBBjhnf8Aj3DfN35x9NMxfWp/TcvFOGSSsJMgIh5jsMVsopFx/HoiQdoQ
	13	G+5KRqZPaefQDWuMh/X90QepI540qIz3HkTMX+Ex5QKBgQDsCm7hAqBStq2FUu9k
	14	dtOk612pE3ywWKzE5IMWTYBUdQ0WIZ+N9sNvxt231FdqXmWP0moj3aVz4Fz0L40o
	15	IPcIhXaJsGtAAL2h+0bYDVPNtRG4BYVVQeEfrFqDzRp7phVuVmw8RjBaiIKsQQLY
	16	geCc+P7+evP1Dn6IeVa6wla65QKBgQDgVNn20TMo5QGPyhyRVSxia+iev64MBsCl
	17	kfrEg0fwsdUNxfQV19a0JGBoGjAANAfB6r+Vz9HaO32qF3G3/ot0hgvKq3Li/7sp
	18	0arSmleqP76byX1ovCA7pbVidwcby2POZNNVNMVONKs8RRjFRxDG7kP58YRH6RIq
	19	qb3lQ8f9+wKBgQDQBgneKFBfVTvsCkGMyuSPrhbnUZNMX3o0NCgLWdZFmLslzBAw
	20	L0/ijOMOhgdcaUEc1ZZRcZ/FVfDWC6pduV+9lNH5Ww/KYly+CxROiMBYxMGO6t6t
	21	Wtgq79z9158FZkPw8B2HqVwoDbMMWGdHpH7uGMuyP24NhO6jHD0BbxC8uQKBgGrz
	22	aTtH/7kWfUkdVcNgNRnzUmMlBYiMS5pkX4cDA/BYCDhZ0QX88krOMPxQx+PA6pXk
	23	IlT9UJJX3JCUPs422CvEoKiOVuasf4HviR6BIRx06Z4CUPz2+/MUDMcV8lio/jtv
	24	TGYKE6s2ZxED7ExZlkERZW0rXSKflt6qMHO2fgmzAoGBAIeegj3Ku8AEIESR/bDy
	25	tCaPJv/IxIObu1M6nFSW1erYQwZXlTF91HU4YJdPNS/m8OiKuzc4AcW7XaSSgd03
	26	Uv+GDU94zicOWNrHbxQs3vkqVyHU1CkWEvn91ZW/CmUVBmEmXG2qNLfuGJw/Ks17
	27	/+U7+IgNXzwPxl5EMkFNsqN5
	28	-----END PRIVATE KEY-----

Mx509/include/hitls_x509.h+185-20

	@@ -37,6 +37,8 @@ typedef struct _HITLS_X509_Ext HITLS_X509_Ext;
37		37
38	typedef struct _HITLS_X509_Crl HITLS_X509_Crl;	38	typedef struct _HITLS_X509_Crl HITLS_X509_Crl;
39		39
		40	typedef struct _HITLS_X509_CrlEntry HITLS_X509_CrlEntry;
		41
40	typedef struct _HITLS_X509_StoreCtx HITLS_X509_StoreCtx;	42	typedef struct _HITLS_X509_StoreCtx HITLS_X509_StoreCtx;
41		43
42	typedef struct _HITLS_X509_Csr HITLS_X509_Csr;	44	typedef struct _HITLS_X509_Csr HITLS_X509_Csr;
	@@ -71,12 +73,14 @@ typedef enum {
71	HITLS_X509_GET_SIGNALG, /** Get the signature algorithm for the cert. */	73	HITLS_X509_GET_SIGNALG, /** Get the signature algorithm for the cert. */
72	HITLS_X509_GET_SUBJECT_DNNAME_STR, /** Get the string of subject name. */	74	HITLS_X509_GET_SUBJECT_DNNAME_STR, /** Get the string of subject name. */
73	HITLS_X509_GET_ISSUER_DNNAME_STR, /** Get the string of issuer name. */	75	HITLS_X509_GET_ISSUER_DNNAME_STR, /** Get the string of issuer name. */
74	HITLS_X509_GET_SERIALNUM, /** Get the string of serial number. */	76	HITLS_X509_GET_SERIALNUM_STR, /** Get the string of serial number. */
75	HITLS_X509_GET_BEFORE_TIME, /** Get the string of before time. */	77	HITLS_X509_GET_BEFORE_TIME, /** Get the string of before time. */
76	HITLS_X509_GET_AFTER_TIME, /** Get the string of after time. */	78	HITLS_X509_GET_AFTER_TIME, /** Get the string of after time. */
77	HITLS_X509_GET_SUBJECT_DNNAME, /** Get the subject name list. */	79	HITLS_X509_GET_SUBJECT_DNNAME, /** Get the subject name list. */
78	HITLS_X509_GET_ISSUER_DNNAME, /** Get the issuer name list. */	80	HITLS_X509_GET_ISSUER_DNNAME, /** Get the issuer name list. */
79	HITLS_X509_GET_EXT, /** Get the extension from cert. */	81	HITLS_X509_GET_VERSION, /** Get the version from cert or crl. */
		82	HITLS_X509_GET_REVOKELIST, /** Get the certficate revoke list from the crl. */
		83	HITLS_X509_GET_SERIALNUM, /** Get the serial number of the cert. */
80		84
81	HITLS_X509_SET_VERSION = 0x0200, /** Set the version for the cert. */	85	HITLS_X509_SET_VERSION = 0x0200, /** Set the version for the cert. */
82	HITLS_X509_SET_SERIALNUM, /** Set the serial number for the cert, the length range is 1 to 20. */	86	HITLS_X509_SET_SERIALNUM, /** Set the serial number for the cert, the length range is 1 to 20. */
	@@ -100,21 +104,25 @@ typedef enum {
100	HITLS_X509_SET_ISSUER_DNNAME, /** Set the issuer name list. */	104	HITLS_X509_SET_ISSUER_DNNAME, /** Set the issuer name list. */
101	HITLS_X509_SET_CSR_EXT, /** Replace the cert's ext with csr's */	105	HITLS_X509_SET_CSR_EXT, /** Replace the cert's ext with csr's */
102	HITLS_X509_ADD_SUBJECT_NAME, /** Add the subject name for the cert/csr. */	106	HITLS_X509_ADD_SUBJECT_NAME, /** Add the subject name for the cert/csr. */
		107	HITLS_X509_CRL_ADD_REVOKED_CERT, /** Add the revoke cert to crl. */
103		108
104	HITLS_X509_EXT_KU_KEYENC = 0x0300,	109	HITLS_X509_EXT_KU_KEYENC = 0x0300,
105	HITLS_X509_EXT_KU_DIGITALSIGN,	110	HITLS_X509_EXT_KU_DIGITALSIGN,
106	HITLS_X509_EXT_KU_CERTSIGN,	111	HITLS_X509_EXT_KU_CERTSIGN,
107	HITLS_X509_EXT_KU_KEYAGREEMENT,	112	HITLS_X509_EXT_KU_KEYAGREEMENT,
108		113
109	HITLS_X509_EXT_SET_SKI = 0x0400,	114	HITLS_X509_EXT_SET_SKI = 0x0400, /** Set the subject key identifier extension. */
110	HITLS_X509_EXT_SET_AKI,	115	HITLS_X509_EXT_SET_AKI, /** Set the authority key identifier extension. */
111	HITLS_X509_EXT_SET_KUSAGE,	116	HITLS_X509_EXT_SET_KUSAGE, /** Set the key usage extension. */
112	HITLS_X509_EXT_SET_SAN,	117	HITLS_X509_EXT_SET_SAN, /** Set the subject alternative name extension. */
113	HITLS_X509_EXT_SET_BCONS,	118	HITLS_X509_EXT_SET_BCONS, /** Set the basic constraints extension. */
114	HITLS_X509_EXT_SET_EXKUSAGE,	119	HITLS_X509_EXT_SET_EXKUSAGE, /** Set the extended key usage extension. */
		120	HITLS_X509_EXT_SET_CRLNUMBER, /** Set the crlnumber extension. */
115		121
116	HITLS_X509_EXT_GET_SKI = 0x0500, /** Get aki from extensions.	122	HITLS_X509_EXT_GET_SKI = 0x0500, /** Get Subject Key Identifier from extensions.
117	Note: Kid is a shallow copy. */	123	Note: Kid is a shallow copy. */
		124	HITLS_X509_EXT_GET_CRLNUMBER, /** get the crlnumber form the crl. */
		125	HITLS_X509_EXT_GET_AKI, /** get the Authority Key Identifier form the crl/cert/csr. */
118		126
119	HITLS_X509_EXT_CHECK_SKI = 0x0600, /** Check if ski is exists. */	127	HITLS_X509_EXT_CHECK_SKI = 0x0600, /** Check if ski is exists. */
120		128
	@@ -207,6 +215,60 @@ typedef struct {
207	int32_t maxPathLen; // Greater than or equal to 0. -1: no check, 0: no intermediate certificate	215	int32_t maxPathLen; // Greater than or equal to 0. -1: no check, 0: no intermediate certificate
208	} HITLS_X509_ExtBCons;	216	} HITLS_X509_ExtBCons;
209		217
		218	/**
		219	* Crl number
		220	*/
		221	typedef struct {
		222	bool critical; // Default to false.
		223	BSL_Buffer crlNumber; // crlNumber
		224	} HITLS_X509_ExtCrlNumber;
		225
		226	typedef struct {
		227	bool critical;
		228	BSL_TIME time;
		229	} HITLS_X509_RevokeExtTime;
		230
		231	typedef enum {
		232	HITLS_X509_CRL_SET_REVOKED_SERIALNUM = 0, /** Set the revoked serial number. */
		233	HITLS_X509_CRL_SET_REVOKED_REVOKE_TIME, /** Set the revoke time. */
		234	HITLS_X509_CRL_SET_REVOKED_INVAILD_TIME, /** Set the invalid time extension. */
		235	HITLS_X509_CRL_SET_REVOKED_REASON, /** Set the revoke reason extension. */
		236	HITLS_X509_CRL_SET_REVOKED_CERTISSUER, /** Set the revoke cert issuer extension. */
		237
		238	HITLS_X509_CRL_GET_REVOKED_SERIALNUM, /** Get the revoked serial number. */
		239	HITLS_X509_CRL_GET_REVOKED_REVOKE_TIME, /** Get the revoke time. */
		240	HITLS_X509_CRL_GET_REVOKED_INVAILD_TIME, /** Get the invalid time extension. */
		241	HITLS_X509_CRL_GET_REVOKED_REASON, /** Get the revoke reason extension. */
		242	HITLS_X509_CRL_GET_REVOKED_CERTISSUER, /** Get the revoke cert issuer extension. */
		243	} HITLS_X509_RevokeCmd;
		244
		245	typedef enum {
		246	HITLS_X509_REVOKED_REASON_UNSPECIFIED = 0, /** CRLReason: Unspecified. */
		247	HITLS_X509_REVOKED_REASON_KEY_COMPROMISE, /** CRLReason: Key compromise. */
		248	HITLS_X509_REVOKED_REASON_CA_COMPROMISE, /** CRLReason: CA compromise. */
		249	HITLS_X509_REVOKED_REASON_AFFILIATION_CHANGED, /** CRLReason: Affiliation changed. */
		250	HITLS_X509_REVOKED_REASON_SUPERSEDED, /** CRLReason: Superseded. */
		251	HITLS_X509_REVOKED_REASON_CESSATION_OF_OPERATION, /** CRLReason: Cessation of operation. */
		252	HITLS_X509_REVOKED_REASON_CERTIFICATE_HOLD, /** CRLReason: Certificate hold. */
		253	HITLS_X509_REVOKED_REASON_REMOVE_FROM_CRL, /** CRLReason: Remove from CRL. */
		254	HITLS_X509_REVOKED_REASON_PRIVILEGE_WITHDRAWN, /** CRLReason: Privilege withdrawn. */
		255	HITLS_X509_REVOKED_REASON_AA_COMPROMISE, /** CRLReason: aA compromise. */
		256	} HITLS_X509_RevokeReason;
		257
		258	typedef struct {
		259	bool critical;
		260	int32_t reason;
		261	} HITLS_X509_RevokeExtReason;
		262
		263	typedef struct {
		264	bool critical;
		265	BslList *issuerName;
		266	} HITLS_X509_RevokeExtCertIssuer;
		267
		268	typedef enum {
		269	HITLS_X509_EXT_TYPE_CSR,
		270	} HITLS_X509_ExtType;
		271
210	/**	272	/**
211	* @ingroup x509	273	* @ingroup x509
212	* @brief Allocate a certificate.	274	* @brief Allocate a certificate.
	@@ -281,12 +343,39 @@ int32_t HITLS_X509_CertCtrl(HITLS_X509_Cert cert, int32_t cmd, void val, int32
281	*/	343	*/
282	int32_t HITLS_X509_ExtCtrl(HITLS_X509_Ext ext, int32_t cmd, void val, int32_t valLen);	344	int32_t HITLS_X509_ExtCtrl(HITLS_X509_Ext ext, int32_t cmd, void val, int32_t valLen);
283		345
		346	/**
		347	* @ingroup x509
		348	* @brief Allocate a extension.
		349	*
		350	* @retval HITLS_X509_Ext *
		351	*/
		352	HITLS_X509_Ext *HITLS_X509_ExtNew(int32_t type);
		353
		354	/**
		355	* @ingroup x509
		356	* @brief Unallocate a extension.
		357	*
		358	* @param ext [IN] The extension.
		359	*/
		360	void HITLS_X509_ExtFree(HITLS_X509_Ext *ext);
		361
		362	/**
		363	* @ingroup x509
		364	* @brief clear the HITLS_X509_ExtAki structure.
		365	* @par Description: This interface needs to be called to clean up memory when obtaining AKI extensions from
		366	* certificates, CRLs, or CSRs using the macro HITLS_X509_EXT_GET_AKI.
		367	*
		368	* @param aki [IN] The HITLS_X509_ExtAki aki
		369	*/
		370	void HITLS_X509_ClearAuthorityKeyId(HITLS_X509_ExtAki *aki);
		371
284	/**	372	/**
285	* @ingroup x509	373	* @ingroup x509
286	* @brief Parse the CERT in the buffer.	374	* @brief Parse the CERT in the buffer.
287	* @par Description: Parse the CERT in the buffer.	375	* @par Description: Parse the CERT in the buffer.
288	* If the encoding is successful, the memory for the crl is requested from within the function,	376	* If the encoding is successful, the memory for the crl is requested from within the function,
289	* and the user needs to free it after using it.	377	* and the user needs to free it after using it. When the parameter is BSL_FORMAT_PEM and
		378	* BSL_FORMAT_UNKNOWN, the buff of encode needs to end with '\0'
290	* @attention None	379	* @attention None
291	* @param format [IN] Encoding format: BSL_FORMAT_PEM/BSL_FORMAT_ASN1/BSL_FORMAT_UNKNOWN.	380	* @param format [IN] Encoding format: BSL_FORMAT_PEM/BSL_FORMAT_ASN1/BSL_FORMAT_UNKNOWN.
292	* @param encode [IN] CERT data.	381	* @param encode [IN] CERT data.
	@@ -366,10 +455,13 @@ int32_t HITLS_X509_CertGenFile(int32_t format, HITLS_X509_Cert *cert, const char
366	*/	455	*/
367	int32_t HITLS_X509_AddDnName(BslList list, HITLS_X509_DN dnNames, int32_t size);	456	int32_t HITLS_X509_AddDnName(BslList list, HITLS_X509_DN dnNames, int32_t size);
368		457
369	typedef enum {	458	/**
370	HITLS_X509_CRL_REF_UP,	459	* @ingroup x509
371	} HITLS_X509_CrlCmd;	460	* @brief Allocate a crl.
372		461	*
		462	* @retval HITLS_X509_Crl *
		463	*/
		464	HITLS_X509_Crl *HITLS_X509_CrlNew(void);
373	/**	465	/**
374	* @ingroup x509	466	* @ingroup x509
375	* @brief Release the CRL.	467	* @brief Release the CRL.
	@@ -386,8 +478,8 @@ void HITLS_X509_CrlFree(HITLS_X509_Crl *crl);
386	* @brief Crl setting interface.	478	* @brief Crl setting interface.
387	* @par Description: Set CRL information.	479	* @par Description: Set CRL information.
388	* parameter data type Length(len):number of data bytes	480	* parameter data type Length(len):number of data bytes
389	* HITLS_X509_CRL_REF_UP int The length is sizeof(int), which is used to increase the	481	* HITLS_X509_REF_UP int The length is sizeof(int), which is used to increase the
390	* number of CRL references.	482	* number of CRL references.
391	* @attention None	483	* @attention None
392	* @param crl [IN] CRL data	484	* @param crl [IN] CRL data
393	* @param cmd [IN] Set type.	485	* @param cmd [IN] Set type.
	@@ -402,7 +494,8 @@ int32_t HITLS_X509_CrlCtrl(HITLS_X509_Crl crl, int32_t cmd, void val, int32_t
402	* @brief Parse the CRL in the buffer.	494	* @brief Parse the CRL in the buffer.
403	* @par Description: Parse the CRL in the buffer.	495	* @par Description: Parse the CRL in the buffer.
404	* If the encoding is successful, the memory for the crl is requested from within the function,	496	* If the encoding is successful, the memory for the crl is requested from within the function,
405	* and the user needs to free it after using it.	497	* and the user needs to free it after using it. When the parameter is BSL_FORMAT_PEM and
		498	* BSL_FORMAT_UNKNOWN, the buff of encode needs to end with '\0'
406	* @attention None	499	* @attention None
407	* @param format [IN] Encoding format: BSL_FORMAT_PEM/BSL_FORMAT_ASN1/	500	* @param format [IN] Encoding format: BSL_FORMAT_PEM/BSL_FORMAT_ASN1/
408	* BSL_FORMAT_UNKNOWN.	501	* BSL_FORMAT_UNKNOWN.
	@@ -471,6 +564,76 @@ int32_t HITLS_X509_CrlGenBuff(int32_t format, HITLS_X509_Crl crl, uint8_t *enc
471	*/	564	*/
472	int32_t HITLS_X509_CrlGenFile(int32_t format, HITLS_X509_Crl crl, const char path);	565	int32_t HITLS_X509_CrlGenFile(int32_t format, HITLS_X509_Crl crl, const char path);
473		566
		567	/**
		568	* @ingroup x509
		569	* @brief Verify the integrity of the CRL.
		570	* @par Description: This function verifies the integrity of the CRL
		571	*
		572	* @attention None
		573	* @param pubkey [IN] pubkey.
		574	* @param crl [IN] CRL info.
		575	* @return Error code
		576	*/
		577	int32_t HITLS_X509_CrlVerify(void pubkey, HITLS_X509_Crl crl);
		578
		579	typedef struct {
		580	uint32_t algId;
		581	union {
		582	CRYPT_RSA_PssPara rsaPss;
		583	CRYPT_RSA_PkcsV15Para pkcsV15;
		584	};
		585	} HITLS_X509_SignAlgParam;
		586
		587	/**
		588	* @ingroup x509
		589	* @brief Signing a CRL.
		590	* @par Description: This function is used to sign the CRL.
		591	* For the newly generated CRL, you need to invoke the HITLS_X509_CrlGenBuff/HITLS_X509_CrlGenFile interface
		592	* before invoking the interface.
		593	*
		594	* @attention The interface can be called multiple times, and the signature is regenerated on each call.
		595	* @param mdId [IN] hash algorithm.
		596	* @param pivKey [IN] private key.
		597	* @param algParam [IN] signature parameter, for example, rsa-pss parameter.
		598	* @param crl [IN/OUT] CRL info.
		599	* @return Error code
		600	*/
		601	int32_t HITLS_X509_CrlSign(uint32_t mdId, CRYPT_EAL_PkeyCtx pivKey, const HITLS_X509_SignAlgParam algParam,
		602	HITLS_X509_Crl *crl);
		603
		604	/**
		605	* @ingroup x509 crl
		606	* @brief Allocate a revoked certificate.
		607	*
		608	* @attention None
		609	* @return HITLS_X509_CrlEntry *
		610	*/
		611	HITLS_X509_CrlEntry *HITLS_X509_CrlRevokedNew(void);
		612
		613	/**
		614	* @ingroup x509
		615	* @brief Release the CRL certificateRevoke struct .
		616	* @par Description: Release the memory of the CRL certificateRevoke struct.
		617	*
		618	* @attention None
		619	* @param entry [IN] entry info.
		620	* @return Error code
		621	*/
		622	void HITLS_X509_CrlRevokedFree(HITLS_X509_CrlEntry *entry);
		623
		624	/**
		625	* @ingroup x509
		626	* @brief Generate a CRL and encode it to specific file.
		627	* @par Description: This function encodes the CRL into the specified format.
		628	* If the encoding is successful, the memory for the encode data is requested from within the function,
		629	* and the user needs to free it after using it.
		630	* @attention None
		631	* @param pubkey [IN] pubkey.
		632	* @param crl [IN] CRL info.
		633	* @return Error code
		634	*/
		635	int32_t HITLS_X509_CrlRevokedCtrl(HITLS_X509_CrlEntry revoked, int32_t cmd, void val, int32_t valLen);
		636
474	typedef enum {	637	typedef enum {
475	HITLS_X509_VFY_FLAG_CRL_ALL = 1,	638	HITLS_X509_VFY_FLAG_CRL_ALL = 1,
476	HITLS_X509_VFY_FLAG_CRL_DEV = 2	639	HITLS_X509_VFY_FLAG_CRL_DEV = 2
	@@ -615,7 +778,8 @@ int32_t HITLS_X509_CsrCtrl(HITLS_X509_Csr csr, int32_t cmd, void val, int32_t
615		778
616	/**	779	/**
617	* @ingroup x509	780	* @ingroup x509
618	* @brief Parse the csr in the buffer	781	* @brief Parse the csr in the buffer.When the parameter is BSL_FORMAT_PEM and
		782	* BSL_FORMAT_UNKNOWN, the buff of encode needs to end with '\0'
619	*	783	*
620	* @param format [IN] Encoding format: BSL_FORMAT_PEM/BSL_FORMAT_ASN1	784	* @param format [IN] Encoding format: BSL_FORMAT_PEM/BSL_FORMAT_ASN1
621	* @param encode [IN] The csr data	785	* @param encode [IN] The csr data
	@@ -753,8 +917,9 @@ int32_t HITLS_PKCS12_Ctrl(HITLS_PKCS12 p12, int32_t cmd, void val, int32_t val
753	/**	917	/**
754	* @ingroup pkcs12	918	* @ingroup pkcs12
755	* @brief pkcs12 parse	919	* @brief pkcs12 parse
756	* @par Description: parse p12 buffer, and set the p12 struct.	920	* @par Description: parse p12 buffer, and set the p12 struct. When the parameter is
757		921	* BSL_FORMAT_PEM and BSL_FORMAT_UNKNOWN, the buff of encode needs to end with '\0'
		922	*
758	* @attention Only support to parse p12 buffer in key-integrity and key-privacy protection mode.	923	* @attention Only support to parse p12 buffer in key-integrity and key-privacy protection mode.
759	* @param format [IN] Decoding format: BSL_FORMAT_ASN1/BSL_FORMAT_UNKNOWN.	924	* @param format [IN] Decoding format: BSL_FORMAT_ASN1/BSL_FORMAT_UNKNOWN.
760	* @param encode [IN] encode data	925	* @param encode [IN] encode data

Mx509/include/hitls_x509_errno.h+15-0

	@@ -38,6 +38,11 @@ typedef enum {
38	HITLS_X509_ERR_ISSUE_CERT_NOT_FOUND,	38	HITLS_X509_ERR_ISSUE_CERT_NOT_FOUND,
39	HITLS_X509_ERR_ROOT_CERT_NOT_FOUND,	39	HITLS_X509_ERR_ROOT_CERT_NOT_FOUND,
40	HITLS_X509_ERR_CHAIN_DEPTH_UP_LIMIT,	40	HITLS_X509_ERR_CHAIN_DEPTH_UP_LIMIT,
		41	HITLS_X509_ERR_VFY_KEY_ALGID,
		42	HITLS_X509_ERR_VFY_KEY_PSS_MDALG,
		43	HITLS_X509_ERR_VFY_KEY_PSS_MGFALG,
		44	HITLS_X509_ERR_VFY_KEY_PSS_SALTLEN,
		45	HITLS_X509_ERR_VFY_AKI_SKI_NOT_MATCH,
41		46
42	HITLS_X509_ERR_CERT_NOT_CA = 0x04010001,	47	HITLS_X509_ERR_CERT_NOT_CA = 0x04010001,
43	HITLS_X509_ERR_CERT_EXIST,	48	HITLS_X509_ERR_CERT_EXIST,
	@@ -60,6 +65,13 @@ typedef enum {
60	HITLS_X509_ERR_CRL_NOT_FOUND,	65	HITLS_X509_ERR_CRL_NOT_FOUND,
61	HITLS_X509_ERR_CRL_INACCURACY_VERSION,	66	HITLS_X509_ERR_CRL_INACCURACY_VERSION,
62	HITLS_X509_ERR_CRL_ENTRY,	67	HITLS_X509_ERR_CRL_ENTRY,
		68	HITLS_X509_ERR_CRL_THISUPDATE_UNEXIST,
		69	HITLS_X509_ERR_CRL_NEXTUPDATE_UNEXIST,
		70	HITLS_X509_ERR_CRL_REVOKELIST_UNEXIST,
		71	HITLS_X509_ERR_INVALID_SIGNALG,
		72	HITLS_X509_ERR_CRL_ISSUER_EMPTY,
		73	HITLS_X509_ERR_CRL_TIME_INVALID,
		74	HITLS_X509_ERR_CRL_LACK_SIGNATURE,
63		75
64	HITLS_X509_ERR_NOT_SUPPORT_FORMAT = 0x04030001,	76	HITLS_X509_ERR_NOT_SUPPORT_FORMAT = 0x04030001,
65	HITLS_X509_ERR_ALG_OID,	77	HITLS_X509_ERR_ALG_OID,
	@@ -96,6 +108,7 @@ typedef enum {
96		108
97	/* extensions */	109	/* extensions */
98	HITLS_X509_ERR_EXT_NOT_FOUND = 0x04040001,	110	HITLS_X509_ERR_EXT_NOT_FOUND = 0x04040001,
		111	HITLS_X509_ERR_EXT_NOT_SUPPORT,
99	HITLS_X509_ERR_EXT_PARSE_AFTER_SET,	112	HITLS_X509_ERR_EXT_PARSE_AFTER_SET,
100	HITLS_X509_ERR_EXT_SET_AFTER_PARSE,	113	HITLS_X509_ERR_EXT_SET_AFTER_PARSE,
101	HITLS_X509_ERR_EXT_SET,	114	HITLS_X509_ERR_EXT_SET,
	@@ -107,6 +120,7 @@ typedef enum {
107	HITLS_X509_ERR_EXT_EXTENDED_KU,	120	HITLS_X509_ERR_EXT_EXTENDED_KU,
108	HITLS_X509_ERR_EXT_EXTENDED_KU_ELE,	121	HITLS_X509_ERR_EXT_EXTENDED_KU_ELE,
109	HITLS_X509_ERR_EXT_GN_UNSUPPORT,	122	HITLS_X509_ERR_EXT_GN_UNSUPPORT,
		123	HITLS_X509_ERR_EXT_CRLNUMBER,
110	HITLS_X509_ERR_PARSE_EXT_KU,	124	HITLS_X509_ERR_PARSE_EXT_KU,
111	HITLS_X509_ERR_PARSE_EXT_BUF,	125	HITLS_X509_ERR_PARSE_EXT_BUF,
112	HITLS_X509_ERR_PARSE_EXT_REPEAT,	126	HITLS_X509_ERR_PARSE_EXT_REPEAT,
	@@ -117,6 +131,7 @@ typedef enum {
117	HITLS_X509_ERR_PARSE_SAN_ITEM_UNKNOW,	131	HITLS_X509_ERR_PARSE_SAN_ITEM_UNKNOW,
118	HITLS_X509_ERR_PARSE_EXKU,	132	HITLS_X509_ERR_PARSE_EXKU,
119	HITLS_X509_ERR_PARSE_EXKU_ITEM,	133	HITLS_X509_ERR_PARSE_EXKU_ITEM,
		134	HITLS_X509_ERR_PARSE_ERROR_TYPE,
120		135
121	HITLS_X509_ERR_CSR_INVALID_PARAM = 0x04050001,	136	HITLS_X509_ERR_CSR_INVALID_PARAM = 0x04050001,
122	HITLS_X509_ERR_CSR_INVALID_VERSION,	137	HITLS_X509_ERR_CSR_INVALID_VERSION,

Mx509/x509_cert/src/hitls_x509_cert.c+53-40

	@@ -164,17 +164,16 @@ void HITLS_X509_CertFree(HITLS_X509_Cert *cert)
164	}	164	}
165		165
166	if (cert->flag == HITLS_X509_CERT_GEN_FLAG) {	166	if (cert->flag == HITLS_X509_CERT_GEN_FLAG) {
167	BSL_LIST_FREE(cert->tbs.ext.list, (BSL_LIST_PFUNC_FREE)HITLS_X509_ExtEntryFree);
168	BSL_SAL_FREE(cert->tbs.serialNum.buff);	167	BSL_SAL_FREE(cert->tbs.serialNum.buff);
169	BSL_SAL_FREE(cert->tbs.tbsRawData);	168	BSL_SAL_FREE(cert->tbs.tbsRawData);
170	BSL_SAL_FREE(cert->signature.buff);	169	BSL_SAL_FREE(cert->signature.buff);
171	BSL_LIST_FREE(cert->tbs.issuerName, (BSL_LIST_PFUNC_FREE)HITLS_X509_FreeNameNode);	170	BSL_LIST_FREE(cert->tbs.issuerName, (BSL_LIST_PFUNC_FREE)HITLS_X509_FreeNameNode);
172	BSL_LIST_FREE(cert->tbs.subjectName, (BSL_LIST_PFUNC_FREE)HITLS_X509_FreeNameNode);	171	BSL_LIST_FREE(cert->tbs.subjectName, (BSL_LIST_PFUNC_FREE)HITLS_X509_FreeNameNode);
173	} else {	172	} else {
174	BSL_LIST_FREE(cert->tbs.ext.list, NULL);
175	BSL_LIST_FREE(cert->tbs.issuerName, NULL);	173	BSL_LIST_FREE(cert->tbs.issuerName, NULL);
176	BSL_LIST_FREE(cert->tbs.subjectName, NULL);	174	BSL_LIST_FREE(cert->tbs.subjectName, NULL);
177	}	175	}
		176	X509_ExtFree(&cert->tbs.ext, false);
178	BSL_SAL_FREE(cert->rawData);	177	BSL_SAL_FREE(cert->rawData);
179	CRYPT_EAL_PkeyFreeCtx(cert->tbs.ealPubKey);	178	CRYPT_EAL_PkeyFreeCtx(cert->tbs.ealPubKey);
180	CRYPT_EAL_PkeyFreeCtx(cert->ealPrivKey);	179	CRYPT_EAL_PkeyFreeCtx(cert->ealPrivKey);
	@@ -188,7 +187,7 @@ HITLS_X509_Cert *HITLS_X509_CertNew(void)
188	HITLS_X509_Cert *cert = NULL;	187	HITLS_X509_Cert *cert = NULL;
189	BSL_ASN1_List *issuerName = NULL;	188	BSL_ASN1_List *issuerName = NULL;
190	BSL_ASN1_List *subjectName = NULL;	189	BSL_ASN1_List *subjectName = NULL;
191	BSL_ASN1_List *extList = NULL;	190	HITLS_X509_Ext *ext = NULL;
192	cert = (HITLS_X509_Cert *)BSL_SAL_Calloc(1, sizeof(HITLS_X509_Cert));	191	cert = (HITLS_X509_Cert *)BSL_SAL_Calloc(1, sizeof(HITLS_X509_Cert));
193	if (cert == NULL) {	192	if (cert == NULL) {
194	return NULL;	193	return NULL;
	@@ -203,15 +202,14 @@ HITLS_X509_Cert *HITLS_X509_CertNew(void)
203	if (subjectName == NULL) {	202	if (subjectName == NULL) {
204	goto ERR;	203	goto ERR;
205	}	204	}
206	extList = BSL_LIST_New(sizeof(HITLS_X509_ExtEntry));	205
207	if (extList == NULL) {	206	ext = X509_ExtNew(&cert->tbs.ext, HITLS_X509_EXT_TYPE_CERT);
		207	if (ext == NULL) {
208	goto ERR;	208	goto ERR;
209	}	209	}
210	BSL_SAL_ReferencesInit(&(cert->references));	210	BSL_SAL_ReferencesInit(&(cert->references));
211	cert->tbs.issuerName = issuerName;	211	cert->tbs.issuerName = issuerName;
212	cert->tbs.subjectName = subjectName;	212	cert->tbs.subjectName = subjectName;
213	cert->tbs.ext.list = extList;
214	cert->tbs.ext.maxPathLen = -1;
215	cert->flag = HITLS_X509_CERT_GEN_FLAG;	213	cert->flag = HITLS_X509_CERT_GEN_FLAG;
216	return cert;	214	return cert;
217	ERR:	215	ERR:
	@@ -292,13 +290,12 @@ ERR:
292	return ret;	290	return ret;
293	}	291	}
294		292
295	int32_t HITLS_X509_ParseAsn1Cert(bool isCopy, uint8_t *encode, uint32_t encodeLen, HITLS_X509_Cert *cert)	293	int32_t HITLS_X509_ParseAsn1Cert(uint8_t *encode, uint32_t encodeLen, HITLS_X509_Cert *cert)
296	{	294	{
297	uint8_t temp = encode;	295	uint8_t temp = encode;
298	uint32_t tempLen = *encodeLen;	296	uint32_t tempLen = *encodeLen;
299	if (isCopy) {	297	cert->flag = HITLS_X509_CERT_PARSE_FLAG;
300	cert->flag = HITLS_X509_CERT_PARSE_FLAG;	298
301	}
302	// template parse	299	// template parse
303	BSL_ASN1_Buffer asnArr[HITLS_X509_CERT_MAX_IDX] = {0};	300	BSL_ASN1_Buffer asnArr[HITLS_X509_CERT_MAX_IDX] = {0};
304	BSL_ASN1_Template templ = {g_certTempl, sizeof(g_certTempl) / sizeof(g_certTempl[0])};	301	BSL_ASN1_Template templ = {g_certTempl, sizeof(g_certTempl) / sizeof(g_certTempl[0])};
	@@ -317,8 +314,7 @@ int32_t HITLS_X509_ParseAsn1Cert(bool isCopy, uint8_t *encode, uint32_t encode
317	// parse tbs	314	// parse tbs
318	ret = HITLS_X509_ParseCertTbs(asnArr, cert);	315	ret = HITLS_X509_ParseCertTbs(asnArr, cert);
319	if (ret != HITLS_X509_SUCCESS) {	316	if (ret != HITLS_X509_SUCCESS) {
320	BSL_LOG_BINLOG_FIXLEN(BINLOG_ID05065, BSL_LOG_LEVEL_ERR, BSL_LOG_BINLOG_TYPE_RUN,	317	BSL_ERR_PUSH_ERROR(ret);
321	"cert: failed to parse tbs.", 0, 0, 0, 0);
322	return ret;	318	return ret;
323	}	319	}
324	// parse sign alg	320	// parse sign alg
	@@ -345,7 +341,7 @@ ERR:
345	cert->tbs.ealPubKey = NULL;	341	cert->tbs.ealPubKey = NULL;
346	BSL_LIST_DeleteAll(cert->tbs.issuerName, NULL);	342	BSL_LIST_DeleteAll(cert->tbs.issuerName, NULL);
347	BSL_LIST_DeleteAll(cert->tbs.subjectName, NULL);	343	BSL_LIST_DeleteAll(cert->tbs.subjectName, NULL);
348	BSL_LIST_DeleteAll(cert->tbs.ext.list, NULL);	344	BSL_LIST_DeleteAll(cert->tbs.ext.extList, NULL);
349	return ret;	345	return ret;
350	}	346	}
351		347
	@@ -440,7 +436,8 @@ static int32_t X509_KeyUsageCheck(HITLS_X509_Cert cert, bool val, int32_t valL
440	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_INVALID_PARAM);	436	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_INVALID_PARAM);
441	return HITLS_X509_ERR_INVALID_PARAM;	437	return HITLS_X509_ERR_INVALID_PARAM;
442	}	438	}
443	*val = (cert->tbs.ext.keyUsage & exp);	439	HITLS_X509_CertExt certExt = (HITLS_X509_CertExt )cert->tbs.ext.extData;
		440	*val = (certExt->keyUsage & exp);
444	return HITLS_X509_SUCCESS;	441	return HITLS_X509_SUCCESS;
445	}	442	}
446		443
	@@ -654,16 +651,6 @@ static int32_t X509_GetAsn1BslTimeStr(HITLS_X509_Cert cert, BSL_Buffer val, in
654	}	651	}
655	}	652	}
656		653
657	static int32_t X509_GetCertExt(HITLS_X509_Ext ext, HITLS_X509_Ext *val, int32_t valLen)
658	{
659	if (val == NULL \|\| valLen != sizeof(HITLS_X509_Ext *)) {
660	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_INVALID_PARAM);
661	return HITLS_X509_ERR_INVALID_PARAM;
662	}
663	*val = ext;
664	return HITLS_X509_SUCCESS;
665	}
666
667	static int32_t X509_CertGetCtrl(HITLS_X509_Cert cert, int32_t cmd, void val, int32_t valLen)	654	static int32_t X509_CertGetCtrl(HITLS_X509_Cert cert, int32_t cmd, void val, int32_t valLen)
668	{	655	{
669	switch (cmd) {	656	switch (cmd) {
	@@ -683,14 +670,14 @@ static int32_t X509_CertGetCtrl(HITLS_X509_Cert cert, int32_t cmd, void val, i
683	return X509_GetDistinguishNameStr(cert, val, HITLS_X509_SUBJECT_DN_NAME);	670	return X509_GetDistinguishNameStr(cert, val, HITLS_X509_SUBJECT_DN_NAME);
684	case HITLS_X509_GET_ISSUER_DNNAME_STR:	671	case HITLS_X509_GET_ISSUER_DNNAME_STR:
685	return X509_GetDistinguishNameStr(cert, val, HITLS_X509_ISSUER_DN_NAME);	672	return X509_GetDistinguishNameStr(cert, val, HITLS_X509_ISSUER_DN_NAME);
686	case HITLS_X509_GET_SERIALNUM:	673	case HITLS_X509_GET_SERIALNUM_STR:
687	return X509_GetSerialNumStr(cert, val);	674	return X509_GetSerialNumStr(cert, val);
		675	case HITLS_X509_GET_SERIALNUM:
		676	return HITLS_X509_GetSerial(&cert->tbs.serialNum, val, valLen);
688	case HITLS_X509_GET_BEFORE_TIME:	677	case HITLS_X509_GET_BEFORE_TIME:
689	return X509_GetAsn1BslTimeStr(cert, val, HITLS_X509_BEFORE_TIME);	678	return X509_GetAsn1BslTimeStr(cert, val, HITLS_X509_BEFORE_TIME);
690	case HITLS_X509_GET_AFTER_TIME:	679	case HITLS_X509_GET_AFTER_TIME:
691	return X509_GetAsn1BslTimeStr(cert, val, HITLS_X509_AFTER_TIME);	680	return X509_GetAsn1BslTimeStr(cert, val, HITLS_X509_AFTER_TIME);
692	case HITLS_X509_GET_EXT:
693	return X509_GetCertExt(&cert->tbs.ext, val, valLen);
694	default:	681	default:
695	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_INVALID_PARAM);	682	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_INVALID_PARAM);
696	return HITLS_X509_ERR_INVALID_PARAM;	683	return HITLS_X509_ERR_INVALID_PARAM;
	@@ -752,7 +739,7 @@ static int32_t HITLS_X509_SetCsrExt(HITLS_X509_Ext ext, HITLS_X509_Csr csr)
752	}	739	}
753	HITLS_X509_Ext csrExt = (HITLS_X509_Ext )attr.value;	740	HITLS_X509_Ext csrExt = (HITLS_X509_Ext )attr.value;
754	ret = HITLS_X509_ExtReplace(ext, csrExt);	741	ret = HITLS_X509_ExtReplace(ext, csrExt);
755	HITLS_X509_ExtFree(csrExt);	742	X509_ExtFree(csrExt, true);
756	return ret;	743	return ret;
757	}	744	}
758		745
	@@ -833,14 +820,27 @@ int32_t HITLS_X509_CertCtrl(HITLS_X509_Cert cert, int32_t cmd, void val, int32
833	return HITLS_X509_RefUp(&cert->references, val, valLen);	820	return HITLS_X509_RefUp(&cert->references, val, valLen);
834	} else if (cmd >= HITLS_X509_GET_ENCODELEN && cmd < HITLS_X509_SET_VERSION) {	821	} else if (cmd >= HITLS_X509_GET_ENCODELEN && cmd < HITLS_X509_SET_VERSION) {
835	return X509_CertGetCtrl(cert, cmd, val, valLen);	822	return X509_CertGetCtrl(cert, cmd, val, valLen);
836	} else if (cmd < HITLS_X509_EXT_KU_KEYENC) {	823	} else if (cmd >= HITLS_X509_SET_VERSION && cmd < HITLS_X509_EXT_KU_KEYENC) {
837	if (cert->flag == HITLS_X509_CERT_PARSE_FLAG) {	824	if (cert->flag == HITLS_X509_CERT_PARSE_FLAG) {
838	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_SET_AFTER_PARSE);	825	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_SET_AFTER_PARSE);
839	return HITLS_X509_ERR_SET_AFTER_PARSE;	826	return HITLS_X509_ERR_SET_AFTER_PARSE;
840	}	827	}
841	return X509_CertSetCtrl(cert, cmd, val, valLen);	828	return X509_CertSetCtrl(cert, cmd, val, valLen);
842	} else {	829	} else if (cmd >= HITLS_X509_EXT_KU_KEYENC && cmd < HITLS_X509_EXT_SET_SKI) {
843	return X509_CertExtCtrl(cert, cmd, val, valLen);	830	return X509_CertExtCtrl(cert, cmd, val, valLen);
		831	} else if (cmd <= HITLS_X509_EXT_CHECK_SKI) {
		832	static int32_t cmdSet[] = {HITLS_X509_EXT_SET_SKI, HITLS_X509_EXT_SET_AKI, HITLS_X509_EXT_SET_KUSAGE,
		833	HITLS_X509_EXT_SET_SAN, HITLS_X509_EXT_SET_BCONS, HITLS_X509_EXT_SET_EXKUSAGE, HITLS_X509_EXT_GET_SKI,
		834	HITLS_X509_EXT_GET_AKI, HITLS_X509_EXT_CHECK_SKI, HITLS_X509_EXT_KU_KEYENC, HITLS_X509_EXT_KU_DIGITALSIGN,
		835	HITLS_X509_EXT_KU_CERTSIGN, HITLS_X509_EXT_KU_KEYAGREEMENT};
		836	if (!X509_CheckCmdVaild(cmdSet, sizeof(cmdSet) / sizeof(int32_t), cmd)) {
		837	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_EXT_NOT_SUPPORT);
		838	return HITLS_X509_ERR_EXT_NOT_SUPPORT;
		839	}
		840	return X509_ExtCtrl(&cert->tbs.ext, cmd, val, valLen);
		841	} else {
		842	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_INVALID_PARAM);
		843	return HITLS_X509_ERR_INVALID_PARAM;
844	}	844	}
845	}	845	}
846		846
	@@ -871,17 +871,29 @@ int32_t HITLS_X509_CertDup(HITLS_X509_Cert src, HITLS_X509_Cert *dest)
871	int32_t HITLS_X509_CheckIssued(HITLS_X509_Cert issue, HITLS_X509_Cert subject, bool *res)	871	int32_t HITLS_X509_CheckIssued(HITLS_X509_Cert issue, HITLS_X509_Cert subject, bool *res)
872	{	872	{
873	int32_t ret = HITLS_X509_CmpNameNode(issue->tbs.subjectName, subject->tbs.issuerName);	873	int32_t ret = HITLS_X509_CmpNameNode(issue->tbs.subjectName, subject->tbs.issuerName);
874	if (ret != 0) {	874	if (ret != HITLS_X509_SUCCESS) {
875	*res = false;	875	*res = false;
876	return HITLS_X509_SUCCESS;	876	return HITLS_X509_SUCCESS;
877	}	877	}
		878	if (issue->tbs.version == HITLS_CERT_VERSION_3 && subject->tbs.version == HITLS_CERT_VERSION_3) {
		879	ret = HITLS_X509_CheckAki(&issue->tbs.ext, &subject->tbs.ext, issue->tbs.subjectName, &issue->tbs.serialNum);
		880	if (ret != HITLS_X509_SUCCESS && ret != HITLS_X509_ERR_VFY_AKI_SKI_NOT_MATCH) {
		881	return ret;
		882	}
		883	if (ret == HITLS_X509_ERR_VFY_AKI_SKI_NOT_MATCH) {
		884	*res = false;
		885	return HITLS_X509_SUCCESS;
		886	}
		887	}
		888
878	/**	889	/**
879	* If the basic constraints extension is not present in a version 3 certificate,	890	* If the basic constraints extension is not present in a version 3 certificate,
880	* or the extension is present but the cA boolean is not asserted,	891	* or the extension is present but the cA boolean is not asserted,
881	* then the certified public key MUST NOT be used to verify certificate signatures.	892	* then the certified public key MUST NOT be used to verify certificate signatures.
882	*/	893	*/
883	if (issue->tbs.version == HITLS_CERT_VERSION_3 && !(issue->tbs.ext.extFlags & HITLS_X509_EXT_FLAG_BCONS) &&	894	HITLS_X509_CertExt certExt = (HITLS_X509_CertExt )issue->tbs.ext.extData;
884	!issue->tbs.ext.isCa) {	895	if (issue->tbs.version == HITLS_CERT_VERSION_3 && !(certExt->extFlags & HITLS_X509_EXT_FLAG_BCONS) &&
		896	!certExt->isCa) {
885	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_CERT_NOT_CA);	897	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_CERT_NOT_CA);
886	return HITLS_X509_ERR_CERT_NOT_CA;	898	return HITLS_X509_ERR_CERT_NOT_CA;
887	}	899	}
	@@ -896,8 +908,8 @@ int32_t HITLS_X509_CheckIssued(HITLS_X509_Cert issue, HITLS_X509_Cert subject,
896	* in certificates that contain public keys that are used to validate digital signatures on	908	* in certificates that contain public keys that are used to validate digital signatures on
897	* other public key certificates or CRLs.	909	* other public key certificates or CRLs.
898	*/	910	*/
899	if (issue->tbs.ext.extFlags & HITLS_X509_EXT_FLAG_KUSAGE) {	911	if (certExt->extFlags & HITLS_X509_EXT_FLAG_KUSAGE) {
900	if (((issue->tbs.ext.keyUsage & HITLS_X509_EXT_KU_KEY_CERT_SIGN)) == 0) {	912	if (((certExt->keyUsage & HITLS_X509_EXT_KU_KEY_CERT_SIGN)) == 0) {
901	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_VFY_KU_NO_CERTSIGN);	913	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_VFY_KU_NO_CERTSIGN);
902	return HITLS_X509_ERR_VFY_KU_NO_CERTSIGN;	914	return HITLS_X509_ERR_VFY_KU_NO_CERTSIGN;
903	}	915	}
	@@ -909,11 +921,12 @@ int32_t HITLS_X509_CheckIssued(HITLS_X509_Cert issue, HITLS_X509_Cert subject,
909	int32_t HITLS_X509_CertIsCA(HITLS_X509_Cert cert, bool res)	921	int32_t HITLS_X509_CertIsCA(HITLS_X509_Cert cert, bool res)
910	{	922	{
911	*res = true;	923	*res = true;
		924	HITLS_X509_CertExt certExt = (HITLS_X509_CertExt )cert->tbs.ext.extData;
912	if (cert->tbs.version == HITLS_CERT_VERSION_3) {	925	if (cert->tbs.version == HITLS_CERT_VERSION_3) {
913	if (!(cert->tbs.ext.extFlags & HITLS_X509_EXT_FLAG_BCONS)) {	926	if (!(certExt->extFlags & HITLS_X509_EXT_FLAG_BCONS)) {
914	*res = false;	927	*res = false;
915	} else {	928	} else {
916	*res = cert->tbs.ext.isCa;	929	*res = certExt->isCa;
917	}	930	}
918	}	931	}
919	return HITLS_X509_SUCCESS;	932	return HITLS_X509_SUCCESS;
	@@ -944,7 +957,7 @@ static int32_t EncodeTbsItems(HITLS_X509_CertTbs tbs, BSL_ASN1_Buffer issuer,
944		957
945	if (tbs->version == HITLS_CERT_VERSION_3) {	958	if (tbs->version == HITLS_CERT_VERSION_3) {
946	ret = HITLS_X509_EncodeExt(BSL_ASN1_CLASS_CTX_SPECIFIC \| BSL_ASN1_TAG_CONSTRUCTED \|	959	ret = HITLS_X509_EncodeExt(BSL_ASN1_CLASS_CTX_SPECIFIC \| BSL_ASN1_TAG_CONSTRUCTED \|
947	HITLS_CERT_CTX_SPECIFIC_TAG_EXTENSION, tbs->ext.list, ext);	960	HITLS_CERT_CTX_SPECIFIC_TAG_EXTENSION, tbs->ext.extList, ext);
948	if (ret != HITLS_X509_SUCCESS) {	961	if (ret != HITLS_X509_SUCCESS) {
949	BSL_SAL_Free(issuer->buff);	962	BSL_SAL_Free(issuer->buff);
950	BSL_SAL_Free(subject->buff);	963	BSL_SAL_Free(subject->buff);
	@@ -1088,7 +1101,7 @@ static int32_t CheckCertValid(HITLS_X509_Cert *cert)
1088	if (cert == NULL) {	1101	if (cert == NULL) {
1089	return HITLS_X509_ERR_INVALID_PARAM;	1102	return HITLS_X509_ERR_INVALID_PARAM;
1090	}	1103	}
1091	if (BSL_LIST_COUNT(cert->tbs.ext.list) != 0 && cert->tbs.version != HITLS_CERT_VERSION_3) {	1104	if (BSL_LIST_COUNT(cert->tbs.ext.extList) != 0 && cert->tbs.version != HITLS_CERT_VERSION_3) {
1092	return HITLS_X509_ERR_CERT_INACCURACY_VERSION;	1105	return HITLS_X509_ERR_CERT_INACCURACY_VERSION;
1093	}	1106	}
1094	if (cert->tbs.serialNum.buff == NULL \|\| cert->tbs.serialNum.len == 0) {	1107	if (cert->tbs.serialNum.buff == NULL \|\| cert->tbs.serialNum.len == 0) {

Mx509/x509_common/include/hitls_x509_local.h+52-11

	@@ -57,10 +57,15 @@ extern "C" {
57	#define BSL_TIME_BEFORE_IS_UTC 0x04	57	#define BSL_TIME_BEFORE_IS_UTC 0x04
58	#define BSL_TIME_AFTER_IS_UTC 0x08	58	#define BSL_TIME_AFTER_IS_UTC 0x08
59		59
		60	/* Identifies the current ext as a parsed state */
60	#define HITLS_X509_EXT_FLAG_PARSE (1 << 0)	61	#define HITLS_X509_EXT_FLAG_PARSE (1 << 0)
61	#define HITLS_X509_EXT_FLAG_SET (1 << 1)	62	/* Identifies the current ext as a generated state */
62	#define HITLS_X509_EXT_FLAG_KUSAGE (1 << 2)	63	#define HITLS_X509_EXT_FLAG_GEN (1 << 1)
63	#define HITLS_X509_EXT_FLAG_BCONS (1 << 3)	64
		65	/* Identifies the keyusage extension in the current structure */
		66	#define HITLS_X509_EXT_FLAG_KUSAGE (1 << 0)
		67	/* Identifies the basic constraints extension in the current structure */
		68	#define HITLS_X509_EXT_FLAG_BCONS (1 << 1)
64		69
65	#define HITLS_X509_GN_OTHER (HITLS_X509_GN_IP + 1)	70	#define HITLS_X509_GN_OTHER (HITLS_X509_GN_IP + 1)
66	#define HITLS_X509_GN_X400 (HITLS_X509_GN_OTHER + 1)	71	#define HITLS_X509_GN_X400 (HITLS_X509_GN_OTHER + 1)
	@@ -80,15 +85,26 @@ typedef struct _HITLS_X509_ExtEntry {
80	BSL_ASN1_Buffer extnValue;	85	BSL_ASN1_Buffer extnValue;
81	} HITLS_X509_ExtEntry;	86	} HITLS_X509_ExtEntry;
82		87
83	typedef struct _HITLS_X509_Ext {	88	typedef struct _HITLS_X509_CertExt {
84	BslList *list;	89	uint32_t extFlags; // Indicates which extensions exist
85	uint32_t extFlags;
86	// basic usage ext	90	// basic usage ext
87	bool isCa;	91	bool isCa;
88	// -1 no check, 0 no intermediate certificate	92	// -1 no check, 0 no intermediate certificate
89	int32_t maxPathLen;	93	int32_t maxPathLen;
90	// key usage ext	94	// key usage ext
91	uint32_t keyUsage;	95	uint32_t keyUsage;
		96	} HITLS_X509_CertExt;
		97
		98	typedef enum {
		99	HITLS_X509_EXT_TYPE_CERT = 1,
		100	HITLS_X509_EXT_TYPE_CRL,
		101	} HITLS_X509_ExtInnerType;
		102
		103	typedef struct _HITLS_X509_Ext {
		104	uint32_t flag; // Identifies the status of the current ext, generate or parse
		105	BslList *extList;
		106	uint32_t type;
		107	void *extData;
92	} HITLS_X509_Ext;	108	} HITLS_X509_Ext;
93		109
94	typedef struct _HITLS_X509_AttrEntry {	110	typedef struct _HITLS_X509_AttrEntry {
	@@ -110,7 +126,7 @@ typedef struct _HITLS_X509_Asn1AlgId {
110	};	126	};
111	} HITLS_X509_Asn1AlgId;	127	} HITLS_X509_Asn1AlgId;
112		128
113	typedef int32_t (HITLS_X509_Asn1Parse)(bool isCopy, uint8_t encode, uint32_t encodeLen, void *out);	129	typedef int32_t (HITLS_X509_Asn1Parse)(uint8_t encode, uint32_t encodeLen, void *out);
114	typedef void (HITLS_X509_New)(void);	130	typedef void (HITLS_X509_New)(void);
115	typedef void (HITLS_X509_Free)(void elem);	131	typedef void (HITLS_X509_Free)(void elem);
116		132
	@@ -145,8 +161,6 @@ void HITLS_X509_ClearGeneralNames(BslList *names);
145		161
146	int32_t HITLS_X509_ParseAuthorityKeyId(HITLS_X509_ExtEntry extEntry, HITLS_X509_ExtAki aki);	162	int32_t HITLS_X509_ParseAuthorityKeyId(HITLS_X509_ExtEntry extEntry, HITLS_X509_ExtAki aki);
147		163
148	void HITLS_X509_ClearAuthorityKeyId(HITLS_X509_ExtAki *aki);
149
150	int32_t HITLS_X509_ParseSubjectKeyId(HITLS_X509_ExtEntry extEntry, HITLS_X509_ExtSki ski);	164	int32_t HITLS_X509_ParseSubjectKeyId(HITLS_X509_ExtEntry extEntry, HITLS_X509_ExtSki ski);
151		165
152	int32_t HITLS_X509_ParseExtendedKeyUsage(HITLS_X509_ExtEntry extEntry, HITLS_X509_ExtExKeyUsage exku);	166	int32_t HITLS_X509_ParseExtendedKeyUsage(HITLS_X509_ExtEntry extEntry, HITLS_X509_ExtExKeyUsage exku);
	@@ -157,9 +171,9 @@ int32_t HITLS_X509_ParseSubjectAltName(HITLS_X509_ExtEntry *extEntry, HITLS_X50
157		171
158	void HITLS_X509_ClearSubjectAltName(HITLS_X509_ExtSan *san);	172	void HITLS_X509_ClearSubjectAltName(HITLS_X509_ExtSan *san);
159		173
160	HITLS_X509_Ext *HITLS_X509_ExtNew(void);	174	HITLS_X509_Ext X509_ExtNew(HITLS_X509_Ext ext, int32_t type);
161		175
162	void HITLS_X509_ExtFree(HITLS_X509_Ext *ext);	176	void X509_ExtFree(HITLS_X509_Ext *ext, bool isFreeOut);
163		177
164	int32_t HITLS_X509_ParseExt(BSL_ASN1_Buffer ext, HITLS_X509_Ext certExt);	178	int32_t HITLS_X509_ParseExt(BSL_ASN1_Buffer ext, HITLS_X509_Ext certExt);
165		179
	@@ -215,6 +229,33 @@ int32_t HITLS_X509_SetSignMdId(CRYPT_MD_AlgId mdAlgId, void val, int32_t valLe
215		229
216	int32_t HITLS_X509_ExtReplace(HITLS_X509_Ext dest, HITLS_X509_Ext src);	230	int32_t HITLS_X509_ExtReplace(HITLS_X509_Ext dest, HITLS_X509_Ext src);
217		231
		232	int32_t HITLS_X509_SetSerial(BSL_ASN1_Buffer serial, const void val, int32_t valLen);
		233
		234	int32_t HITLS_X509_GetSerial(BSL_ASN1_Buffer serial, const void val, int32_t valLen);
		235
		236	typedef int32_t (EncodeExtCb)(void , HITLS_X509_ExtEntry , const void );
		237
		238	int32_t HITLS_X509_SetExtList(void param, BslList extList, BslCid cid, BSL_Buffer *val, EncodeExtCb encodeExt);
		239
		240	typedef int32_t (DecodeExtCb)(HITLS_X509_ExtEntry , void *);
		241
		242	int32_t HITLS_X509_GetExt(BslList ext, BslCid cid, BSL_Buffer val, uint32_t expectLen, DecodeExtCb decodeExt);
		243
		244	HITLS_X509_ExtEntry X509_DupExtEntry(const HITLS_X509_ExtEntry src);
		245
		246	int32_t X509_SetSignAlgParm(CRYPT_EAL_PkeyCtx signKey, const HITLS_X509_SignAlgParam algParam);
		247
		248	bool X509_IsValidHashAlg(CRYPT_MD_AlgId id);
		249
		250	int32_t HITLS_X509_EncodeExtEntry(BSL_ASN1_List list, BSL_ASN1_Buffer ext);
		251
		252	int32_t HITLS_X509_CheckAki(HITLS_X509_Ext issueExt, HITLS_X509_Ext subjectExt, BSL_ASN1_List *subName,
		253	BSL_ASN1_Buffer *serialNum);
		254
		255	bool X509_CheckCmdVaild(int32_t *cmdSet, uint32_t cmdSize, int32_t cmd);
		256
		257	int32_t X509_ExtCtrl(HITLS_X509_Ext ext, int32_t cmd, void val, int32_t valLen);
		258
218	#ifdef __cplusplus	259	#ifdef __cplusplus
219	}	260	}
220	#endif	261	#endif

Mx509/x509_common/src/hitls_x509_attrs.c+2-2

	@@ -160,7 +160,7 @@ static int32_t EncodeReqExtAttr(void attrItem, BSL_ASN1_Buffer attrValue)
160	return HITLS_X509_ERR_INVALID_PARAM;	160	return HITLS_X509_ERR_INVALID_PARAM;
161	}	161	}
162	HITLS_X509_Ext ext = (HITLS_X509_Ext )attrItem;	162	HITLS_X509_Ext ext = (HITLS_X509_Ext )attrItem;
163	return HITLS_X509_EncodeExt(BSL_ASN1_TAG_CONSTRUCTED \| BSL_ASN1_TAG_SET, ext->list, attrValue);	163	return HITLS_X509_EncodeExt(BSL_ASN1_TAG_CONSTRUCTED \| BSL_ASN1_TAG_SET, ext->extList, attrValue);
164	}	164	}
165		165
166	static int32_t SetAttr(BSL_ASN1_List attributes, void val, uint32_t valLen, EncodeAttrCb encodeAttrCb)	166	static int32_t SetAttr(BSL_ASN1_List attributes, void val, uint32_t valLen, EncodeAttrCb encodeAttrCb)
	@@ -207,7 +207,7 @@ ERR:
207		207
208	static int32_t DecodeReqExtAttr(HITLS_X509_AttrEntry attrEntry, void attrItem)	208	static int32_t DecodeReqExtAttr(HITLS_X509_AttrEntry attrEntry, void attrItem)
209	{	209	{
210	HITLS_X509_Ext *ext = HITLS_X509_ExtNew();	210	HITLS_X509_Ext *ext = HITLS_X509_ExtNew(HITLS_X509_EXT_TYPE_CSR);
211	if (ext == NULL) {	211	if (ext == NULL) {
212	BSL_ERR_PUSH_ERROR(BSL_MALLOC_FAIL);	212	BSL_ERR_PUSH_ERROR(BSL_MALLOC_FAIL);
213	return BSL_MALLOC_FAIL;	213	return BSL_MALLOC_FAIL;

Mx509/x509_common/src/hitls_x509_common.c+160-14

	@@ -326,14 +326,14 @@ static void X509_GetPemSymbol(bool isCert, BSL_PEM_Symbol *symbol)
326	}	326	}
327	}	327	}
328		328
329	static int32_t X509_ParseAndAddRes(BSL_Buffer asn1Buf, bool isCopy, X509_ParseFuncCbk parsefun, HITLS_X509_List *list)	329	static int32_t X509_ParseAndAddRes(BSL_Buffer asn1Buf, X509_ParseFuncCbk parsefun, HITLS_X509_List *list)
330	{	330	{
331	void *res = parsefun->x509New();	331	void *res = parsefun->x509New();
332	if (res == NULL) {	332	if (res == NULL) {
333	BSL_ERR_PUSH_ERROR(BSL_MALLOC_FAIL);	333	BSL_ERR_PUSH_ERROR(BSL_MALLOC_FAIL);
334	return BSL_MALLOC_FAIL;	334	return BSL_MALLOC_FAIL;
335	}	335	}
336	int32_t ret = parsefun->asn1Parse(isCopy, &(asn1Buf->data), &(asn1Buf->dataLen), res);	336	int32_t ret = parsefun->asn1Parse(&(asn1Buf->data), &(asn1Buf->dataLen), res);
337	if (ret != HITLS_X509_SUCCESS) {	337	if (ret != HITLS_X509_SUCCESS) {
338	parsefun->x509Free(res);	338	parsefun->x509Free(res);
339	BSL_ERR_PUSH_ERROR(ret);	339	BSL_ERR_PUSH_ERROR(ret);
	@@ -348,7 +348,7 @@ static int32_t X509_ParseAndAddRes(BSL_Buffer *asn1Buf, bool isCopy, X509_ParseF
348	return HITLS_X509_SUCCESS;	348	return HITLS_X509_SUCCESS;
349	}	349	}
350		350
351	int32_t HITLS_X509_ParseAsn1(BSL_Buffer encode, bool isCopy, X509_ParseFuncCbk parsefun, HITLS_X509_List *list)	351	int32_t HITLS_X509_ParseAsn1(BSL_Buffer encode, X509_ParseFuncCbk parsefun, HITLS_X509_List *list)
352	{	352	{
353	uint8_t *data = encode->data;	353	uint8_t *data = encode->data;
354	uint32_t dataLen = encode->dataLen;	354	uint32_t dataLen = encode->dataLen;
	@@ -359,13 +359,11 @@ int32_t HITLS_X509_ParseAsn1(BSL_Buffer *encode, bool isCopy, X509_ParseFuncCbk
359	return ret;	359	return ret;
360	}	360	}
361	BSL_Buffer asn1Buf = {data, elemLen};	361	BSL_Buffer asn1Buf = {data, elemLen};
362	if (isCopy) {	362	asn1Buf.data = BSL_SAL_Dump(data, elemLen);
363	asn1Buf.data = BSL_SAL_Dump(data, elemLen);	363	if (asn1Buf.data == NULL) {
364	if (asn1Buf.data == NULL) {	364	return BSL_DUMP_FAIL;
365	return BSL_DUMP_FAIL;
366	}
367	}	365	}
368	ret = X509_ParseAndAddRes(&asn1Buf, isCopy, parsefun, list);	366	ret = X509_ParseAndAddRes(&asn1Buf, parsefun, list);
369	if (ret != HITLS_X509_SUCCESS) {	367	if (ret != HITLS_X509_SUCCESS) {
370	BSL_SAL_Free(asn1Buf.data);	368	BSL_SAL_Free(asn1Buf.data);
371	return ret;	369	return ret;
	@@ -389,7 +387,7 @@ int32_t HITLS_X509_ParsePem(BSL_Buffer encode, bool isCert, X509_ParseFuncCbk
389	if (ret != HITLS_X509_SUCCESS) {	387	if (ret != HITLS_X509_SUCCESS) {
390	break;	388	break;
391	}	389	}
392	ret = X509_ParseAndAddRes(&asn1Buf, true, parsefun, list);	390	ret = X509_ParseAndAddRes(&asn1Buf, parsefun, list);
393	if (ret != HITLS_X509_SUCCESS) {	391	if (ret != HITLS_X509_SUCCESS) {
394	BSL_SAL_Free(asn1Buf.data);	392	BSL_SAL_Free(asn1Buf.data);
395	return ret;	393	return ret;
	@@ -402,14 +400,14 @@ int32_t HITLS_X509_ParsePem(BSL_Buffer encode, bool isCert, X509_ParseFuncCbk
402	return HITLS_X509_SUCCESS;	400	return HITLS_X509_SUCCESS;
403	}	401	}
404		402
405	int32_t HITLS_X509_ParseUnknown(BSL_Buffer encode, bool isCopy, bool isCert, X509_ParseFuncCbk parsefun,	403	int32_t HITLS_X509_ParseUnknown(BSL_Buffer encode, bool isCert, X509_ParseFuncCbk parsefun,
406	HITLS_X509_List *list)	404	HITLS_X509_List *list)
407	{	405	{
408	bool isPem = BSL_PEM_IsPemFormat((char *)(encode->data), encode->dataLen);	406	bool isPem = BSL_PEM_IsPemFormat((char *)(encode->data), encode->dataLen);
409	if (isPem) {	407	if (isPem) {
410	return HITLS_X509_ParsePem(encode, isCert, parsefun, list);	408	return HITLS_X509_ParsePem(encode, isCert, parsefun, list);
411	} else {	409	} else {
412	return HITLS_X509_ParseAsn1(encode, isCopy, parsefun, list);	410	return HITLS_X509_ParseAsn1(encode, parsefun, list);
413	}	411	}
414	}	412	}
415		413
	@@ -419,13 +417,13 @@ int32_t HITLS_X509_ParseX509(int32_t format, BSL_Buffer *encode, bool isCert, X5
419	int32_t ret;	417	int32_t ret;
420	switch (format) {	418	switch (format) {
421	case BSL_FORMAT_ASN1:	419	case BSL_FORMAT_ASN1:
422	ret = HITLS_X509_ParseAsn1(encode, true, parsefun, list);	420	ret = HITLS_X509_ParseAsn1(encode, parsefun, list);
423	break;	421	break;
424	case BSL_FORMAT_PEM:	422	case BSL_FORMAT_PEM:
425	ret = HITLS_X509_ParsePem(encode, isCert, parsefun, list);	423	ret = HITLS_X509_ParsePem(encode, isCert, parsefun, list);
426	break;	424	break;
427	case BSL_FORMAT_UNKNOWN:	425	case BSL_FORMAT_UNKNOWN:
428	ret = HITLS_X509_ParseUnknown(encode, true, isCert, parsefun, list);	426	ret = HITLS_X509_ParseUnknown(encode, isCert, parsefun, list);
429	break;	427	break;
430	default:	428	default:
431	ret = HITLS_X509_ERR_NOT_SUPPORT_FORMAT;	429	ret = HITLS_X509_ERR_NOT_SUPPORT_FORMAT;
	@@ -513,6 +511,59 @@ int32_t HITLS_X509_CmpNameNode(BSL_ASN1_List nameOri, BSL_ASN1_List name)
513	return 0;	511	return 0;
514	}	512	}
515		513
		514	/**
		515	* RFC 4055 section 3.3
		516	*
		517	* The key is identified by the id-RSASSA-PSS signature algorithm identifier, but the parameters field is
		518	* absent. In this case no parameter validation is needed.
		519	* The key is identified by the id-RSASSA-PSS signature algorithm identifier and the parameters are present.
		520	* In this case all parameters in the signature structure algorithm identifier MUST match the parameters
		521	* in the key structure algorithm identifier except the saltLength field. The saltLength field in the
		522	* signature parameters MUST be greater or equal to that in the key parameters field.
		523	*/
		524	static int32_t X509_CheckPssParam(CRYPT_EAL_PkeyCtx key, HITLS_X509_Asn1AlgId subAlg)
		525	{
		526	if (subAlg->algId != BSL_CID_RSASSAPSS) {
		527	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_VFY_KEY_ALGID);
		528	return HITLS_X509_ERR_VFY_KEY_ALGID;
		529	}
		530	uint32_t mdId;
		531	int32_t ret = CRYPT_EAL_PkeyCtrl(key, CRYPT_CTRL_GET_RSA_MD, &mdId, sizeof(uint32_t));
		532	if (ret != CRYPT_SUCCESS) {
		533	BSL_ERR_PUSH_ERROR(ret);
		534	return ret;
		535	}
		536	if (mdId == BSL_CID_UNKNOWN) {
		537	/* If the hash algorithm is unknown, no pss parameter is specified in key. */
		538	return HITLS_X509_SUCCESS;
		539	}
		540	if (mdId != subAlg->rsaPssParam.mdId) {
		541	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_VFY_KEY_PSS_MDALG);
		542	return HITLS_X509_ERR_VFY_KEY_PSS_MDALG;
		543	}
		544	uint32_t mgfId;
		545	ret = CRYPT_EAL_PkeyCtrl(key, CRYPT_CTRL_GET_RSA_MGF, &mgfId, sizeof(uint32_t));
		546	if (ret != CRYPT_SUCCESS) {
		547	BSL_ERR_PUSH_ERROR(ret);
		548	return ret;
		549	}
		550	if (mgfId != subAlg->rsaPssParam.mgfId) {
		551	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_VFY_KEY_PSS_MGFALG);
		552	return HITLS_X509_ERR_VFY_KEY_PSS_MGFALG;
		553	}
		554	int32_t saltLen;
		555	ret = CRYPT_EAL_PkeyCtrl(key, CRYPT_CTRL_GET_RSA_SALT, &saltLen, sizeof(int32_t));
		556	if (ret != CRYPT_SUCCESS) {
		557	BSL_ERR_PUSH_ERROR(ret);
		558	return ret;
		559	}
		560	if (subAlg->rsaPssParam.saltLen < saltLen) {
		561	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_VFY_KEY_PSS_SALTLEN);
		562	return HITLS_X509_ERR_VFY_KEY_PSS_SALTLEN;
		563	}
		564	return HITLS_X509_SUCCESS;
		565	}
		566
516	int32_t HITLS_X509_CheckAlg(CRYPT_EAL_PkeyCtx pubkey, HITLS_X509_Asn1AlgId subAlg)	567	int32_t HITLS_X509_CheckAlg(CRYPT_EAL_PkeyCtx pubkey, HITLS_X509_Asn1AlgId subAlg)
517	{	568	{
518	uint32_t pubKeyId = CRYPT_EAL_PkeyGetId(pubkey);	569	uint32_t pubKeyId = CRYPT_EAL_PkeyGetId(pubkey);
	@@ -520,6 +571,17 @@ int32_t HITLS_X509_CheckAlg(CRYPT_EAL_PkeyCtx pubkey, HITLS_X509_Asn1AlgId sub
520	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_VFY_GET_SIGNID);	571	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_VFY_GET_SIGNID);
521	return HITLS_X509_ERR_VFY_GET_SIGNID;	572	return HITLS_X509_ERR_VFY_GET_SIGNID;
522	}	573	}
		574	if (pubKeyId == CRYPT_PKEY_RSA) {
		575	CRYPT_RsaPadType pad;
		576	int32_t ret = CRYPT_EAL_PkeyCtrl(pubkey, CRYPT_CTRL_GET_RSA_PADDING, &pad, sizeof(pad));
		577	if (ret != CRYPT_SUCCESS) {
		578	BSL_ERR_PUSH_ERROR(ret);
		579	return ret;
		580	}
		581	if (pad == CRYPT_PKEY_EMSA_PSS) {
		582	return X509_CheckPssParam(pubkey, subAlg);
		583	}
		584	}
523	BslCid subSignAlg = BSL_OBJ_GetAsymIdFromSignId(subAlg->algId);	585	BslCid subSignAlg = BSL_OBJ_GetAsymIdFromSignId(subAlg->algId);
524	if (subSignAlg == BSL_CID_UNKNOWN) {	586	if (subSignAlg == BSL_CID_UNKNOWN) {
525	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_VFY_GET_SIGNID);	587	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_VFY_GET_SIGNID);
	@@ -579,6 +641,8 @@ static uint32_t X509_GetHashId(HITLS_X509_Asn1AlgId *alg)
579	static int32_t X509_CtrlAlgInfo(const CRYPT_EAL_PkeyCtx pubKey, uint32_t hashId, HITLS_X509_Asn1AlgId alg)	641	static int32_t X509_CtrlAlgInfo(const CRYPT_EAL_PkeyCtx pubKey, uint32_t hashId, HITLS_X509_Asn1AlgId alg)
580	{	642	{
581	switch (alg->algId) {	643	switch (alg->algId) {
		644	case BSL_CID_MD5WITHRSA:
		645	case BSL_CID_SHA1WITHRSA:
582	case BSL_CID_SHA224WITHRSAENCRYPTION:	646	case BSL_CID_SHA224WITHRSAENCRYPTION:
583	case BSL_CID_SHA256WITHRSAENCRYPTION:	647	case BSL_CID_SHA256WITHRSAENCRYPTION:
584	case BSL_CID_SHA384WITHRSAENCRYPTION:	648	case BSL_CID_SHA384WITHRSAENCRYPTION:
	@@ -623,3 +687,85 @@ int32_t HITLS_X509_CheckSignature(const CRYPT_EAL_PkeyCtx pubKey, uint8_t rawD
623	}	687	}
624	return ret;	688	return ret;
625	}	689	}
		690
		691	int32_t X509_SetSignAlgParm(CRYPT_EAL_PkeyCtx signKey, const HITLS_X509_SignAlgParam algParam)
		692	{
		693	int32_t ret;
		694	CRYPT_RsaPadType pad;
		695	switch (algParam->algId) {
		696	case BSL_CID_RSASSAPSS:
		697	if (!X509_IsValidHashAlg(algParam->rsaPss.mdId)) {
		698	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_INVALID_PARAM);
		699	return HITLS_X509_ERR_INVALID_PARAM;
		700	}
		701	if (!X509_IsValidHashAlg(algParam->rsaPss.mgfId)) {
		702	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_INVALID_PARAM);
		703	return HITLS_X509_ERR_INVALID_PARAM;
		704	}
		705	pad = CRYPT_PKEY_EMSA_PSS;
		706	ret = HITLS_X509_SetRsaPadding(signKey, &pad, sizeof(CRYPT_RsaPadType));
		707	if (ret != HITLS_X509_SUCCESS) {
		708	BSL_ERR_PUSH_ERROR(ret);
		709	return ret;
		710	}
		711	return CRYPT_EAL_PkeyCtrl(signKey, CRYPT_CTRL_SET_RSA_EMSA_PSS,
		712	(void *)&algParam->rsaPss, sizeof(CRYPT_RSA_PssPara));
		713	case BSL_CID_RSA:
		714	if (!X509_IsValidHashAlg(algParam->pkcsV15.mdId)) {
		715	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_INVALID_PARAM);
		716	return HITLS_X509_ERR_INVALID_PARAM;
		717	}
		718	pad = CRYPT_PKEY_EMSA_PKCSV15;
		719	ret = HITLS_X509_SetRsaPadding(signKey, &pad, sizeof(CRYPT_RsaPadType));
		720	if (ret != HITLS_X509_SUCCESS) {
		721	BSL_ERR_PUSH_ERROR(ret);
		722	return ret;
		723	}
		724	return CRYPT_EAL_PkeyCtrl(signKey, CRYPT_CTRL_SET_RSA_EMSA_PKCSV15,
		725	(void *)&algParam->pkcsV15, sizeof(CRYPT_RSA_PkcsV15Para));
		726	default:
		727	return HITLS_X509_SUCCESS;
		728	}
		729	}
		730
		731	int32_t HITLS_X509_CheckAki(HITLS_X509_Ext issueExt, HITLS_X509_Ext subjectExt, BSL_ASN1_List *subName,
		732	BSL_ASN1_Buffer *serialNum)
		733	{
		734	HITLS_X509_ExtAki aki = {0};
		735	HITLS_X509_ExtSki ski = {0};
		736	int32_t ret = X509_ExtCtrl(issueExt, HITLS_X509_EXT_GET_SKI, (void *)&ski, sizeof(HITLS_X509_ExtSki));
		737	if (ret != HITLS_X509_SUCCESS && ret != HITLS_X509_ERR_EXT_NOT_FOUND) {
		738	BSL_ERR_PUSH_ERROR(ret);
		739	return ret;
		740	}
		741	if (ret == HITLS_X509_ERR_EXT_NOT_FOUND) {
		742	return HITLS_X509_SUCCESS;
		743	}
		744	ret = X509_ExtCtrl(subjectExt, HITLS_X509_EXT_GET_AKI, (void *)&aki, sizeof(HITLS_X509_ExtAki));
		745	if (ret != HITLS_X509_SUCCESS && ret != HITLS_X509_ERR_EXT_NOT_FOUND) {
		746	BSL_ERR_PUSH_ERROR(ret);
		747	return ret;
		748	}
		749	if (ret == HITLS_X509_ERR_EXT_NOT_FOUND) {
		750	return HITLS_X509_SUCCESS;
		751	}
		752	if (ski.kid.dataLen != aki.kid.dataLen \|\| memcmp(ski.kid.data, aki.kid.data, ski.kid.dataLen) != 0) {
		753	HITLS_X509_ClearAuthorityKeyId(&aki);
		754	return HITLS_X509_ERR_VFY_AKI_SKI_NOT_MATCH;
		755	}
		756	if (aki.issuerName != NULL) {
		757	ret = HITLS_X509_CmpNameNode(aki.issuerName, subName);
		758	HITLS_X509_ClearAuthorityKeyId(&aki);
		759	if (ret != 0) {
		760	return HITLS_X509_ERR_VFY_AKI_SKI_NOT_MATCH;
		761	}
		762	}
		763	if (aki.serialNum.dataLen != 0 && aki.serialNum.data != NULL) {
		764	if (aki.serialNum.dataLen != serialNum->len \|\|
		765	memcmp(aki.serialNum.data, serialNum->buff, aki.serialNum.dataLen) != 0) {
		766	return HITLS_X509_ERR_VFY_AKI_SKI_NOT_MATCH;
		767	}
		768	}
		769
		770	return HITLS_X509_SUCCESS;
		771	}

Mx509/x509_common/src/hitls_x509_ctrl.c+35-2

	@@ -92,7 +92,7 @@ int32_t HITLS_X509_GetEncodeData(uint8_t rawData, uint8_t *val)
92	return HITLS_X509_SUCCESS;	92	return HITLS_X509_SUCCESS;
93	}	93	}
94		94
95	static bool IsValidHashAlg(CRYPT_MD_AlgId id)	95	bool X509_IsValidHashAlg(CRYPT_MD_AlgId id)
96	{	96	{
97	return id == CRYPT_MD_MD5 \|\| id == CRYPT_MD_SHA1 \|\| id == CRYPT_MD_SHA224 \|\| id == CRYPT_MD_SHA256 \|\|	97	return id == CRYPT_MD_MD5 \|\| id == CRYPT_MD_SHA1 \|\| id == CRYPT_MD_SHA224 \|\| id == CRYPT_MD_SHA256 \|\|
98	id == CRYPT_MD_SHA384 \|\| id == CRYPT_MD_SHA512 \|\| id == CRYPT_MD_SM3;	98	id == CRYPT_MD_SHA384 \|\| id == CRYPT_MD_SHA512 \|\| id == CRYPT_MD_SM3;
	@@ -105,7 +105,7 @@ int32_t HITLS_X509_SetSignMdId(CRYPT_MD_AlgId mdAlgId, void val, int32_t valLe
105	return HITLS_X509_ERR_INVALID_PARAM;	105	return HITLS_X509_ERR_INVALID_PARAM;
106	}	106	}
107	CRYPT_MD_AlgId id = (CRYPT_MD_AlgId )val;	107	CRYPT_MD_AlgId id = (CRYPT_MD_AlgId )val;
108	if (!IsValidHashAlg(id)) {	108	if (!X509_IsValidHashAlg(id)) {
109	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_INVALID_PARAM);	109	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_INVALID_PARAM);
110	return HITLS_X509_ERR_INVALID_PARAM;	110	return HITLS_X509_ERR_INVALID_PARAM;
111	}	111	}
	@@ -582,3 +582,36 @@ ERR:
582	BSL_LIST_FREE(dnNameList, (BSL_LIST_PFUNC_FREE)HITLS_X509_FreeNameNode);	582	BSL_LIST_FREE(dnNameList, (BSL_LIST_PFUNC_FREE)HITLS_X509_FreeNameNode);
583	return ret;	583	return ret;
584	}	584	}
		585
		586	int32_t HITLS_X509_SetSerial(BSL_ASN1_Buffer serial, const void val, int32_t valLen)
		587	{
		588	if (valLen <= 0) {
		589	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_CERT_INVALID_SERIAL_NUM);
		590	return HITLS_X509_ERR_CERT_INVALID_SERIAL_NUM;
		591	}
		592	const uint8_t src = (const uint8_t )val;
		593	serial->buff = BSL_SAL_Dump(src, valLen);
		594	if (serial->buff == NULL) {
		595	BSL_ERR_PUSH_ERROR(BSL_DUMP_FAIL);
		596	return BSL_DUMP_FAIL;
		597	}
		598	serial->len = valLen;
		599	serial->tag = BSL_ASN1_TAG_INTEGER;
		600	return HITLS_X509_SUCCESS;
		601	}
		602
		603	int32_t HITLS_X509_GetSerial(BSL_ASN1_Buffer serial, const void val, int32_t valLen)
		604	{
		605	if (valLen != sizeof(BSL_Buffer)) {
		606	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_INVALID_PARAM);
		607	return HITLS_X509_ERR_INVALID_PARAM;
		608	}
		609	if (serial->buff == NULL \|\| serial->len == 0 \|\| serial->tag != BSL_ASN1_TAG_INTEGER) {
		610	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_INVALID_PARAM);
		611	return HITLS_X509_ERR_INVALID_PARAM;
		612	}
		613	BSL_Buffer buff = (BSL_Buffer )val;
		614	buff->data = serial->buff;
		615	buff->dataLen = serial->len;
		616	return HITLS_X509_SUCCESS;
		617	}

Mx509/x509_common/src/hitls_x509_ext.c+215-96

	@@ -113,6 +113,8 @@ typedef enum {
113	*/	113	*/
114	#define HITLS_X509_KID_MIN_LEN 8	114	#define HITLS_X509_KID_MIN_LEN 8
115	#define HITLS_X509_KID_MAX_LEN 20	115	#define HITLS_X509_KID_MAX_LEN 20
		116	#define HITLS_X509_CRLNUMBER_MIN_LEN 1
		117	#define HITLS_X509_CRLNUMBER_MAX_LEN 20
116		118
117	/**	119	/**
118	* RFC 5280: section-4.2.1.6	120	* RFC 5280: section-4.2.1.6
	@@ -175,7 +177,7 @@ static int32_t CmpExtByCid(const void pExt, const void pCid)
175	return cid == ext->cid ? 0 : HITLS_X509_EXT_NOT_FOUND;	177	return cid == ext->cid ? 0 : HITLS_X509_EXT_NOT_FOUND;
176	}	178	}
177		179
178	static int32_t ParseExtKeyUsage(HITLS_X509_ExtEntry extEntry, HITLS_X509_Ext ext)	180	static int32_t ParseExtKeyUsage(HITLS_X509_ExtEntry extEntry, HITLS_X509_CertExt ext)
179	{	181	{
180	uint32_t len;	182	uint32_t len;
181	uint8_t *temp = extEntry->extnValue.buff;	183	uint8_t *temp = extEntry->extnValue.buff;
	@@ -203,7 +205,7 @@ static int32_t ParseExtKeyUsage(HITLS_X509_ExtEntry extEntry, HITLS_X509_Ext e
203	return HITLS_X509_SUCCESS;	205	return HITLS_X509_SUCCESS;
204	}	206	}
205		207
206	static int32_t ParseExtBasicConstraints(HITLS_X509_ExtEntry extEntry, HITLS_X509_Ext ext)	208	static int32_t ParseExtBasicConstraints(HITLS_X509_ExtEntry extEntry, HITLS_X509_CertExt ext)
207	{	209	{
208	uint8_t *temp = extEntry->extnValue.buff;	210	uint8_t *temp = extEntry->extnValue.buff;
209	uint32_t tempLen = extEntry->extnValue.len;	211	uint32_t tempLen = extEntry->extnValue.len;
	@@ -256,7 +258,6 @@ static int32_t ParseDirName(uint8_t *encode, uint32_t encLen, BslList **list)
256	*encLen -= valueLen;	258	*encLen -= valueLen;
257	} else {	259	} else {
258	BSL_LIST_DeleteAll(*list, NULL);	260	BSL_LIST_DeleteAll(*list, NULL);
259	BSL_SAL_Free(*list);
260	*list = NULL;	261	*list = NULL;
261	}	262	}
262	return ret;	263	return ret;
	@@ -346,32 +347,49 @@ void HITLS_X509_ClearGeneralNames(BslList *names)
346	BSL_LIST_DeleteAll(names, (BSL_LIST_PFUNC_FREE)FreeGenernalName);	347	BSL_LIST_DeleteAll(names, (BSL_LIST_PFUNC_FREE)FreeGenernalName);
347	}	348	}
348		349
349	HITLS_X509_Ext *HITLS_X509_ExtNew(void)	350	HITLS_X509_Ext X509_ExtNew(HITLS_X509_Ext ext, int32_t type)
350	{	351	{
351	HITLS_X509_Ext ext = (HITLS_X509_Ext )BSL_SAL_Calloc(1, sizeof(HITLS_X509_Ext));	352	HITLS_X509_Ext *tmp = NULL;
352	if (ext == NULL) {	353	if (ext == NULL) {
		354	tmp = (HITLS_X509_Ext *)BSL_SAL_Calloc(1, sizeof(HITLS_X509_Ext));
		355	if (tmp == NULL) {
		356	return NULL;
		357	}
		358	ext = tmp;
		359	}
		360	ext->type = type;
		361	ext->extList = BSL_LIST_New(sizeof(HITLS_X509_ExtEntry *));
		362	if (ext->extList == NULL) {
		363	BSL_SAL_Free(tmp);
353	return NULL;	364	return NULL;
354	}	365	}
355	ext->list = BSL_LIST_New(sizeof(HITLS_X509_ExtEntry *));	366	if (type != HITLS_X509_EXT_TYPE_CRL) {
356	if (ext->list == NULL) {	367	ext->extData = BSL_SAL_Calloc(1, sizeof(HITLS_X509_CertExt));
357	BSL_SAL_Free(ext);	368	if (ext->extData == NULL) {
358	return NULL;	369	BSL_SAL_Free(ext->extList);
		370	ext->extList = NULL;
		371	BSL_SAL_Free(tmp);
		372	return NULL;
		373	}
		374	((HITLS_X509_CertExt *)(ext->extData))->maxPathLen = -1;
359	}	375	}
360
361	return ext;	376	return ext;
362	}	377	}
363		378
364	void HITLS_X509_ExtFree(HITLS_X509_Ext *ext)	379	void X509_ExtFree(HITLS_X509_Ext *ext, bool isFreeOut)
365	{	380	{
366	if (ext == NULL) {	381	if (ext == NULL) {
367	return;	382	return;
368	}	383	}
369	if ((ext->extFlags & HITLS_X509_EXT_FLAG_PARSE) != 0) {	384	if ((ext->flag & HITLS_X509_EXT_FLAG_PARSE) != 0) {
370	BSL_LIST_FREE(ext->list, NULL);	385	BSL_LIST_FREE(ext->extList, NULL);
371	} else {	386	} else {
372	BSL_LIST_FREE(ext->list, (BSL_LIST_PFUNC_FREE)HITLS_X509_ExtEntryFree);	387	BSL_LIST_FREE(ext->extList, (BSL_LIST_PFUNC_FREE)HITLS_X509_ExtEntryFree);
		388	}
		389	BSL_SAL_Free(ext->extData);
		390	if (isFreeOut) {
		391	BSL_SAL_Free(ext);
373	}	392	}
374	BSL_SAL_Free(ext);
375	}	393	}
376		394
377	int32_t HITLS_X509_ParseGeneralNames(uint8_t encode, uint32_t encLen, BslList list)	395	int32_t HITLS_X509_ParseGeneralNames(uint8_t encode, uint32_t encLen, BslList list)
	@@ -483,6 +501,33 @@ int32_t HITLS_X509_ParseSubjectKeyId(HITLS_X509_ExtEntry *extEntry, HITLS_X509_E
483	return ret;	501	return ret;
484	}	502	}
485		503
		504	int32_t X509_ParseCrlNumber(HITLS_X509_ExtEntry extEntry, HITLS_X509_ExtCrlNumber crlNumber)
		505	{
		506	uint8_t *temp = extEntry->extnValue.buff;
		507	uint32_t tempLen = extEntry->extnValue.len;
		508	uint32_t valueLen = 0;
		509
		510	// CRL Number is encoded as an INTEGER
		511	int32_t ret = BSL_ASN1_DecodeTagLen(BSL_ASN1_TAG_INTEGER, &temp, &tempLen, &valueLen);
		512	if (ret != BSL_SUCCESS) {
		513	BSL_ERR_PUSH_ERROR(ret);
		514	return ret;
		515	}
		516
		517	// Check CRL Number length
		518	if (valueLen < HITLS_X509_CRLNUMBER_MIN_LEN \|\| valueLen > HITLS_X509_CRLNUMBER_MAX_LEN) {
		519	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_EXT_CRLNUMBER);
		520	return HITLS_X509_ERR_EXT_CRLNUMBER;
		521	}
		522
		523	// Store CRL Number value
		524	crlNumber->crlNumber.data = temp;
		525	crlNumber->crlNumber.dataLen = valueLen;
		526	crlNumber->critical = extEntry->critical;
		527
		528	return HITLS_X509_SUCCESS;
		529	}
		530
486	static int32_t ParseExKeyUsageList(uint32_t layer, BSL_ASN1_Buffer asn, void param, BSL_ASN1_List *list)	531	static int32_t ParseExKeyUsageList(uint32_t layer, BSL_ASN1_Buffer asn, void param, BSL_ASN1_List *list)
487	{	532	{
488	(void)param;	533	(void)param;
	@@ -619,14 +664,14 @@ static void FreeExtEntryCont(HITLS_X509_ExtEntry *entry)
619	entry->extnValue.len = 0;	664	entry->extnValue.len = 0;
620	}	665	}
621		666
622	static int32_t GetExtEntryByCid(HITLS_X509_Ext ext, BslCid cid, HITLS_X509_ExtEntry entry, bool isNew)	667	static int32_t GetExtEntryByCid(BslList extList, BslCid cid, HITLS_X509_ExtEntry entry, bool isNew)
623	{	668	{
624	BslOidString *oid = BSL_OBJ_GetOidFromCID(cid);	669	BslOidString *oid = BSL_OBJ_GetOidFromCID(cid);
625	if (oid == NULL) {	670	if (oid == NULL) {
626	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_EXT_OID);	671	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_EXT_OID);
627	return HITLS_X509_ERR_EXT_OID;	672	return HITLS_X509_ERR_EXT_OID;
628	}	673	}
629	HITLS_X509_ExtEntry *extEntry = BSL_LIST_Search(ext->list, &cid, CmpExtByCid, NULL);	674	HITLS_X509_ExtEntry *extEntry = BSL_LIST_Search(extList, &cid, CmpExtByCid, NULL);
630	if (extEntry != NULL) {	675	if (extEntry != NULL) {
631	*isNew = false;	676	*isNew = false;
632	FreeExtEntryCont(extEntry);	677	FreeExtEntryCont(extEntry);
	@@ -684,9 +729,9 @@ static int32_t ParseExtAsnItem(BSL_ASN1_Buffer asn, void param, BSL_ASN1_List
684	BslOidString oid = {extEntry.extnId.len, (char *)extEntry.extnId.buff, 0};	729	BslOidString oid = {extEntry.extnId.len, (char *)extEntry.extnId.buff, 0};
685	switch (BSL_OBJ_GetCIDFromOid(&oid)) {	730	switch (BSL_OBJ_GetCIDFromOid(&oid)) {
686	case BSL_CID_CE_KEYUSAGE:	731	case BSL_CID_CE_KEYUSAGE:
687	return ParseExtKeyUsage(&extEntry, ext);	732	return ParseExtKeyUsage(&extEntry, (HITLS_X509_CertExt *)ext->extData);
688	case BSL_CID_CE_BASICCONSTRAINTS:	733	case BSL_CID_CE_BASICCONSTRAINTS:
689	return ParseExtBasicConstraints(&extEntry, ext);	734	return ParseExtBasicConstraints(&extEntry, (HITLS_X509_CertExt *)ext->extData);
690	default:	735	default:
691	return HITLS_X509_SUCCESS;	736	return HITLS_X509_SUCCESS;
692	}	737	}
	@@ -699,7 +744,12 @@ static int32_t ParseExtSeqof(uint32_t layer, BSL_ASN1_Buffer asn, void param,
699		744
700	int32_t HITLS_X509_ParseExt(BSL_ASN1_Buffer ext, HITLS_X509_Ext certExt)	745	int32_t HITLS_X509_ParseExt(BSL_ASN1_Buffer ext, HITLS_X509_Ext certExt)
701	{	746	{
702	if (certExt == NULL \|\| (certExt->extFlags & HITLS_X509_EXT_FLAG_SET)) {	747	if (certExt == NULL \|\| certExt->extData == NULL) {
		748	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_EXT_PARSE_AFTER_SET);
		749	return HITLS_X509_ERR_EXT_PARSE_AFTER_SET;
		750	}
		751
		752	if ((certExt->flag & HITLS_X509_EXT_FLAG_GEN) != 0) {
703	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_EXT_PARSE_AFTER_SET);	753	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_EXT_PARSE_AFTER_SET);
704	return HITLS_X509_ERR_EXT_PARSE_AFTER_SET;	754	return HITLS_X509_ERR_EXT_PARSE_AFTER_SET;
705	}	755	}
	@@ -711,13 +761,13 @@ int32_t HITLS_X509_ParseExt(BSL_ASN1_Buffer ext, HITLS_X509_Ext certExt)
711	uint8_t expTag[] = {BSL_ASN1_TAG_CONSTRUCTED \| BSL_ASN1_TAG_SEQUENCE,	761	uint8_t expTag[] = {BSL_ASN1_TAG_CONSTRUCTED \| BSL_ASN1_TAG_SEQUENCE,
712	BSL_ASN1_TAG_CONSTRUCTED \| BSL_ASN1_TAG_SEQUENCE};	762	BSL_ASN1_TAG_CONSTRUCTED \| BSL_ASN1_TAG_SEQUENCE};
713	BSL_ASN1_DecodeListParam listParam = {2, expTag};	763	BSL_ASN1_DecodeListParam listParam = {2, expTag};
714	int ret = BSL_ASN1_DecodeListItem(&listParam, ext, &ParseExtSeqof, certExt, certExt->list);	764	int ret = BSL_ASN1_DecodeListItem(&listParam, ext, &ParseExtSeqof, certExt, certExt->extList);
715	if (ret != BSL_SUCCESS) {	765	if (ret != BSL_SUCCESS) {
716	BSL_LIST_DeleteAll(certExt->list, NULL);	766	BSL_LIST_DeleteAll(certExt->extList, NULL);
717	BSL_ERR_PUSH_ERROR(ret);	767	BSL_ERR_PUSH_ERROR(ret);
718	return ret;	768	return ret;
719	}	769	}
720	certExt->extFlags \|= HITLS_X509_EXT_FLAG_PARSE;	770	certExt->flag \|= HITLS_X509_EXT_FLAG_PARSE;
721	return ret;	771	return ret;
722	}	772	}
723		773
	@@ -753,10 +803,10 @@ static int32_t SetExtBCons(HITLS_X509_Ext ext, HITLS_X509_ExtEntry entry, cons
753	return ret;	803	return ret;
754	}	804	}
755	entry->critical = bCons->critical;	805	entry->critical = bCons->critical;
756		806	HITLS_X509_CertExt certExt = (HITLS_X509_CertExt )ext->extData;
757	ext->isCa = bCons->isCa;	807	certExt->isCa = bCons->isCa;
758	ext->maxPathLen = bCons->maxPathLen;	808	certExt->maxPathLen = bCons->maxPathLen;
759	ext->extFlags \|= HITLS_X509_EXT_FLAG_BCONS;	809	certExt->extFlags \|= HITLS_X509_EXT_FLAG_BCONS;
760	return HITLS_X509_SUCCESS;	810	return HITLS_X509_SUCCESS;
761	}	811	}
762		812
	@@ -792,7 +842,8 @@ static int32_t SetExtKeyUsage(HITLS_X509_Ext ext, HITLS_X509_ExtEntry entry, c
792	}	842	}
793		843
794	entry->critical = ku->critical;	844	entry->critical = ku->critical;
795	ext->extFlags \|= HITLS_X509_EXT_FLAG_KUSAGE;	845	HITLS_X509_CertExt certExt = (HITLS_X509_CertExt )ext->extData;
		846	certExt->extFlags \|= HITLS_X509_EXT_FLAG_KUSAGE;
796	return ret;	847	return ret;
797	}	848	}
798		849
	@@ -1023,27 +1074,41 @@ static int32_t SetExtExKeyUsage(HITLS_X509_Ext ext, HITLS_X509_ExtEntry entry,
1023	return ret;	1074	return ret;
1024	}	1075	}
1025		1076
1026	typedef int32_t (EncodeExtCb)(HITLS_X509_Ext , HITLS_X509_ExtEntry , const void );	1077	static int32_t SetExtCrlNumber(HITLS_X509_Ext ext, HITLS_X509_ExtEntry entry, const void *val)
1027
1028	static int32_t SetExt(HITLS_X509_Ext ext, BslCid cid, BSL_Buffer val, uint32_t expectLen, EncodeExtCb encodeExt)
1029	{	1078	{
1030	if (ext->extFlags & HITLS_X509_EXT_FLAG_PARSE) {	1079	if (ext->type != HITLS_X509_EXT_TYPE_CRL) {
1031	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_EXT_SET_AFTER_PARSE);	1080	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_EXT_SET);
1032	return HITLS_X509_ERR_EXT_SET_AFTER_PARSE;	1081	return HITLS_X509_ERR_EXT_SET;
1033	}	1082	}
1034	if (val->dataLen != expectLen) {	1083	const HITLS_X509_ExtCrlNumber crlNumber = (const HITLS_X509_ExtCrlNumber )val;
1035	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_INVALID_PARAM);	1084	entry->critical = crlNumber->critical;
1036	return HITLS_X509_ERR_INVALID_PARAM;	1085
		1086	if (crlNumber->crlNumber.dataLen < HITLS_X509_CRLNUMBER_MIN_LEN \|\|
		1087	crlNumber->crlNumber.dataLen > HITLS_X509_CRLNUMBER_MAX_LEN) {
		1088	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_EXT_CRLNUMBER);
		1089	return HITLS_X509_ERR_EXT_CRLNUMBER;
1037	}	1090	}
1038		1091
		1092	BSL_ASN1_Buffer asn = {BSL_ASN1_TAG_INTEGER, crlNumber->crlNumber.dataLen, crlNumber->crlNumber.data};
		1093	BSL_ASN1_TemplateItem item = {BSL_ASN1_TAG_INTEGER, 0, 0};
		1094	BSL_ASN1_Template templ = {&item, 1};
		1095	int32_t ret = BSL_ASN1_EncodeTemplate(&templ, &asn, 1, &entry->extnValue.buff, &entry->extnValue.len);
		1096	if (ret != BSL_SUCCESS) {
		1097	BSL_ERR_PUSH_ERROR(ret);
		1098	}
		1099	return ret;
		1100	}
		1101
		1102	int32_t HITLS_X509_SetExtList(void param, BslList extList, BslCid cid, BSL_Buffer *val, EncodeExtCb encodeExt)
		1103	{
1039	HITLS_X509_ExtEntry *extEntry = NULL;	1104	HITLS_X509_ExtEntry *extEntry = NULL;
1040	bool isNew;	1105	bool isNew;
1041	int32_t ret = GetExtEntryByCid(ext, cid, &extEntry, &isNew);	1106	int32_t ret = GetExtEntryByCid(extList, cid, &extEntry, &isNew);
1042	if (ret != HITLS_X509_SUCCESS) {	1107	if (ret != HITLS_X509_SUCCESS) {
1043	return ret;	1108	return ret;
1044	}	1109	}
1045		1110
1046	ret = encodeExt(ext, extEntry, val->data);	1111	ret = encodeExt(param, extEntry, val->data);
1047	if (ret != HITLS_X509_SUCCESS) {	1112	if (ret != HITLS_X509_SUCCESS) {
1048	FreeExtEntryCont(extEntry);	1113	FreeExtEntryCont(extEntry);
1049	if (isNew) {	1114	if (isNew) {
	@@ -1052,7 +1117,7 @@ static int32_t SetExt(HITLS_X509_Ext ext, BslCid cid, BSL_Buffer val, uint32_t
1052	return ret;	1117	return ret;
1053	}	1118	}
1054	if (isNew) {	1119	if (isNew) {
1055	ret = BSL_LIST_AddElement(ext->list, extEntry, BSL_LIST_POS_END);	1120	ret = BSL_LIST_AddElement(extList, extEntry, BSL_LIST_POS_END);
1056	if (ret != BSL_SUCCESS) {	1121	if (ret != BSL_SUCCESS) {
1057	BSL_ERR_PUSH_ERROR(ret);	1122	BSL_ERR_PUSH_ERROR(ret);
1058	FreeExtEntryCont(extEntry);	1123	FreeExtEntryCont(extEntry);
	@@ -1060,65 +1125,68 @@ static int32_t SetExt(HITLS_X509_Ext ext, BslCid cid, BSL_Buffer val, uint32_t
1060	return ret;	1125	return ret;
1061	}	1126	}
1062	}	1127	}
		1128	return HITLS_X509_SUCCESS;
		1129	}
1063		1130
1064	ext->extFlags \|= HITLS_X509_EXT_FLAG_SET;	1131	static int32_t SetExt(HITLS_X509_Ext ext, BslCid cid, BSL_Buffer val, uint32_t expectLen, EncodeExtCb encodeExt)
		1132	{
		1133	if (ext->flag & HITLS_X509_EXT_FLAG_PARSE) {
		1134	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_EXT_SET_AFTER_PARSE);
		1135	return HITLS_X509_ERR_EXT_SET_AFTER_PARSE;
		1136	}
		1137	if (val->dataLen != expectLen) {
		1138	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_INVALID_PARAM);
		1139	return HITLS_X509_ERR_INVALID_PARAM;
		1140	}
		1141
		1142	int32_t ret = HITLS_X509_SetExtList(ext, ext->extList, cid, val, encodeExt);
		1143	if (ret != HITLS_X509_SUCCESS) {
		1144	BSL_ERR_PUSH_ERROR(ret);
		1145	return ret;
		1146	}
		1147
		1148	ext->flag \|= HITLS_X509_EXT_FLAG_GEN;
1065	return ret;	1149	return ret;
1066	}	1150	}
1067		1151
1068	static int32_t SetExtCtrl(HITLS_X509_Ext ext, int32_t cmd, void val, int32_t valLen)	1152	static int32_t SetExtCtrl(HITLS_X509_Ext ext, int32_t cmd, void val, int32_t valLen)
1069	{	1153	{
1070	bool isNew = false;
1071	if (ext->list == NULL) {
1072	ext->list = BSL_LIST_New(sizeof(HITLS_X509_ExtEntry));
1073	if (ext->list == NULL) {
1074	BSL_ERR_PUSH_ERROR(BSL_MALLOC_FAIL);
1075	return BSL_MALLOC_FAIL;
1076	}
1077	isNew = true;
1078	}
1079	BSL_Buffer buff = {val, valLen};	1154	BSL_Buffer buff = {val, valLen};
1080	int32_t ret;
1081	switch (cmd) {	1155	switch (cmd) {
1082	case HITLS_X509_EXT_SET_BCONS:	1156	case HITLS_X509_EXT_SET_BCONS:
1083	ret = SetExt(ext, BSL_CID_CE_BASICCONSTRAINTS, &buff, sizeof(HITLS_X509_ExtBCons), SetExtBCons);	1157	return SetExt(ext, BSL_CID_CE_BASICCONSTRAINTS, &buff, sizeof(HITLS_X509_ExtBCons),
1084	break;	1158	(EncodeExtCb)SetExtBCons);
1085	case HITLS_X509_EXT_SET_KUSAGE:	1159	case HITLS_X509_EXT_SET_KUSAGE:
1086	ret = SetExt(ext, BSL_CID_CE_KEYUSAGE, &buff, sizeof(HITLS_X509_ExtKeyUsage), SetExtKeyUsage);	1160	return SetExt(ext, BSL_CID_CE_KEYUSAGE, &buff, sizeof(HITLS_X509_ExtKeyUsage), (EncodeExtCb)SetExtKeyUsage);
1087	break;
1088	case HITLS_X509_EXT_SET_AKI:	1161	case HITLS_X509_EXT_SET_AKI:
1089	ret = SetExt(ext, BSL_CID_CE_AUTHORITYKEYID, &buff, sizeof(HITLS_X509_ExtAki), SetExtAki);	1162	return SetExt(ext, BSL_CID_CE_AUTHORITYKEYID, &buff, sizeof(HITLS_X509_ExtAki), (EncodeExtCb)SetExtAki);
1090	break;
1091	case HITLS_X509_EXT_SET_SKI:	1163	case HITLS_X509_EXT_SET_SKI:
1092	ret = SetExt(ext, BSL_CID_CE_SUBJECTKEYID, &buff, sizeof(HITLS_X509_ExtSki), SetExtSki);	1164	return SetExt(ext, BSL_CID_CE_SUBJECTKEYID, &buff, sizeof(HITLS_X509_ExtSki), (EncodeExtCb)SetExtSki);
1093	break;
1094	case HITLS_X509_EXT_SET_SAN:	1165	case HITLS_X509_EXT_SET_SAN:
1095	ret = SetExt(ext, BSL_CID_CE_SUBJECTALTNAME, &buff, sizeof(HITLS_X509_ExtSan), SetExtSan);	1166	return SetExt(ext, BSL_CID_CE_SUBJECTALTNAME, &buff, sizeof(HITLS_X509_ExtSan), (EncodeExtCb)SetExtSan);
1096	break;
1097	case HITLS_X509_EXT_SET_EXKUSAGE:	1167	case HITLS_X509_EXT_SET_EXKUSAGE:
1098	ret = SetExt(ext, BSL_CID_CE_EXTENDEDKEYUSAGE, &buff, sizeof(HITLS_X509_ExtExKeyUsage), SetExtExKeyUsage);	1168	return SetExt(ext, BSL_CID_CE_EXTENDEDKEYUSAGE, &buff, sizeof(HITLS_X509_ExtExKeyUsage),
1099	break;	1169	(EncodeExtCb)SetExtExKeyUsage);
		1170	case HITLS_X509_EXT_SET_CRLNUMBER:
		1171	return SetExt(ext, BSL_CID_CE_CRLNUMBER, &buff, sizeof(HITLS_X509_ExtCrlNumber),
		1172	(EncodeExtCb)SetExtCrlNumber);
1100	default:	1173	default:
1101	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_INVALID_PARAM);	1174	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_INVALID_PARAM);
1102	return HITLS_X509_ERR_INVALID_PARAM;	1175	return HITLS_X509_ERR_INVALID_PARAM;
1103	}	1176	}
1104	if (ret != HITLS_X509_SUCCESS) {
1105	if (isNew) {
1106	BSL_SAL_Free(ext->list);
1107	ext->list = NULL;
1108	}
1109	}
1110	return ret;
1111	}	1177	}
1112		1178
1113	typedef int32_t (DecodeExtCb)(HITLS_X509_ExtEntry , void *);	1179	int32_t HITLS_X509_GetExt(BslList ext, BslCid cid, BSL_Buffer val, uint32_t expectLen, DecodeExtCb decodeExt)
1114
1115	static int32_t GetExt(HITLS_X509_Ext ext, BslCid cid, BSL_Buffer val, uint32_t expectLen, DecodeExtCb decodeExt)
1116	{	1180	{
		1181	if (ext == NULL) {
		1182	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_EXT_NOT_FOUND);
		1183	return HITLS_X509_ERR_EXT_NOT_FOUND;
		1184	}
1117	if (val->dataLen != expectLen) {	1185	if (val->dataLen != expectLen) {
1118	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_INVALID_PARAM);	1186	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_INVALID_PARAM);
1119	return HITLS_X509_ERR_INVALID_PARAM;	1187	return HITLS_X509_ERR_INVALID_PARAM;
1120	}	1188	}
1121	HITLS_X509_ExtEntry *extEntry = BSL_LIST_Search(ext->list, &cid, CmpExtByCid, NULL);	1189	HITLS_X509_ExtEntry *extEntry = BSL_LIST_Search(ext, &cid, CmpExtByCid, NULL);
1122	if (extEntry == NULL) {	1190	if (extEntry == NULL) {
1123	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_EXT_NOT_FOUND);	1191	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_EXT_NOT_FOUND);
1124	return HITLS_X509_ERR_EXT_NOT_FOUND;	1192	return HITLS_X509_ERR_EXT_NOT_FOUND;
	@@ -1131,8 +1199,14 @@ static int32_t GetExtCtrl(HITLS_X509_Ext ext, int32_t cmd, void val, int32_t v
1131	BSL_Buffer buff = {val, valLen};	1199	BSL_Buffer buff = {val, valLen};
1132	switch (cmd) {	1200	switch (cmd) {
1133	case HITLS_X509_EXT_GET_SKI:	1201	case HITLS_X509_EXT_GET_SKI:
1134	return GetExt(ext, BSL_CID_CE_SUBJECTKEYID, &buff, sizeof(HITLS_X509_ExtSki),	1202	return HITLS_X509_GetExt(ext->extList, BSL_CID_CE_SUBJECTKEYID, &buff, sizeof(HITLS_X509_ExtSki),
1135	(DecodeExtCb)HITLS_X509_ParseSubjectKeyId);	1203	(DecodeExtCb)HITLS_X509_ParseSubjectKeyId);
		1204	case HITLS_X509_EXT_GET_AKI:
		1205	return HITLS_X509_GetExt(ext->extList, BSL_CID_CE_AUTHORITYKEYID, &buff, sizeof(HITLS_X509_ExtAki),
		1206	(DecodeExtCb)HITLS_X509_ParseAuthorityKeyId);
		1207	case HITLS_X509_EXT_GET_CRLNUMBER:
		1208	return HITLS_X509_GetExt(ext->extList, BSL_CID_CE_CRLNUMBER, &buff, sizeof(HITLS_X509_ExtCrlNumber),
		1209	(DecodeExtCb)X509_ParseCrlNumber);
1136	default:	1210	default:
1137	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_INVALID_PARAM);	1211	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_INVALID_PARAM);
1138	return HITLS_X509_ERR_INVALID_PARAM;	1212	return HITLS_X509_ERR_INVALID_PARAM;
	@@ -1145,16 +1219,22 @@ static int32_t CheckExtByCid(HITLS_X509_Ext ext, int32_t cid, bool val, int32_
1145	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_INVALID_PARAM);	1219	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_INVALID_PARAM);
1146	return HITLS_X509_ERR_INVALID_PARAM;	1220	return HITLS_X509_ERR_INVALID_PARAM;
1147	}	1221	}
1148	*val = BSL_LIST_Search(ext->list, &cid, CmpExtByCid, NULL) != NULL;	1222	*val = BSL_LIST_Search(ext->extList, &cid, CmpExtByCid, NULL) != NULL;
1149	return HITLS_X509_SUCCESS;	1223	return HITLS_X509_SUCCESS;
1150	}	1224	}
1151		1225
1152	int32_t HITLS_X509_ExtCtrl(HITLS_X509_Ext ext, int32_t cmd, void val, int32_t valLen)	1226	bool X509_CheckCmdVaild(int32_t *cmdSet, uint32_t cmdSize, int32_t cmd)
1153	{	1227	{
1154	if (ext == NULL \|\| val == NULL) {	1228	for (uint32_t i = 0; i < cmdSize; i++) {
1155	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_INVALID_PARAM);	1229	if (cmd == cmdSet[i]) {
1156	return HITLS_X509_ERR_INVALID_PARAM;	1230	return true;
		1231	}
1157	}	1232	}
		1233	return false;
		1234	}
		1235
		1236	int32_t X509_ExtCtrl(HITLS_X509_Ext ext, int32_t cmd, void val, int32_t valLen)
		1237	{
1158	if (cmd >= HITLS_X509_EXT_SET_SKI && cmd < HITLS_X509_EXT_GET_SKI) {	1238	if (cmd >= HITLS_X509_EXT_SET_SKI && cmd < HITLS_X509_EXT_GET_SKI) {
1159	return SetExtCtrl(ext, cmd, val, valLen);	1239	return SetExtCtrl(ext, cmd, val, valLen);
1160	}	1240	}
	@@ -1168,6 +1248,28 @@ int32_t HITLS_X509_ExtCtrl(HITLS_X509_Ext ext, int32_t cmd, void val, int32_t
1168	return HITLS_X509_ERR_INVALID_PARAM;	1248	return HITLS_X509_ERR_INVALID_PARAM;
1169	}	1249	}
1170		1250
		1251	int32_t HITLS_X509_ExtCtrl(HITLS_X509_Ext ext, int32_t cmd, void val, int32_t valLen)
		1252	{
		1253	if (ext == NULL \|\| val == NULL) {
		1254	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_INVALID_PARAM);
		1255	return HITLS_X509_ERR_INVALID_PARAM;
		1256	}
		1257	if (ext->type == HITLS_X509_EXT_TYPE_CERT \|\| ext->type == HITLS_X509_EXT_TYPE_CRL) {
		1258	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_EXT_NOT_SUPPORT);
		1259	return HITLS_X509_ERR_EXT_NOT_SUPPORT;
		1260	}
		1261	static int32_t cmdSet[] = {HITLS_X509_EXT_SET_SKI, HITLS_X509_EXT_SET_AKI, HITLS_X509_EXT_SET_KUSAGE,
		1262	HITLS_X509_EXT_SET_SAN, HITLS_X509_EXT_SET_BCONS, HITLS_X509_EXT_SET_EXKUSAGE, HITLS_X509_EXT_GET_SKI,
		1263	HITLS_X509_EXT_GET_AKI, HITLS_X509_EXT_CHECK_SKI, HITLS_X509_EXT_KU_KEYENC, HITLS_X509_EXT_KU_DIGITALSIGN,
		1264	HITLS_X509_EXT_KU_CERTSIGN, HITLS_X509_EXT_KU_KEYAGREEMENT};
		1265	if (!X509_CheckCmdVaild(cmdSet, sizeof(cmdSet) / sizeof(int32_t), cmd)) {
		1266	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_EXT_NOT_SUPPORT);
		1267	return HITLS_X509_ERR_EXT_NOT_SUPPORT;
		1268	}
		1269
		1270	return X509_ExtCtrl(ext, cmd, val, valLen);
		1271	}
		1272
1171	void HITLS_X509_ExtEntryFree(HITLS_X509_ExtEntry *entry)	1273	void HITLS_X509_ExtEntryFree(HITLS_X509_ExtEntry *entry)
1172	{	1274	{
1173	if (entry == NULL) {	1275	if (entry == NULL) {
	@@ -1234,7 +1336,7 @@ int32_t HITLS_X509_EncodeExt(uint8_t tag, BSL_ASN1_List list, BSL_ASN1_Buffer
1234	return HITLS_X509_SUCCESS;	1336	return HITLS_X509_SUCCESS;
1235	}	1337	}
1236		1338
1237	static HITLS_X509_ExtEntry DupExtEntry(const HITLS_X509_ExtEntry src)	1339	HITLS_X509_ExtEntry X509_DupExtEntry(const HITLS_X509_ExtEntry src)
1238	{	1340	{
1239	/* Src is not null. */	1341	/* Src is not null. */
1240	HITLS_X509_ExtEntry *dest = BSL_SAL_Malloc(sizeof(HITLS_X509_ExtEntry));	1342	HITLS_X509_ExtEntry *dest = BSL_SAL_Malloc(sizeof(HITLS_X509_ExtEntry));
	@@ -1273,34 +1375,51 @@ static HITLS_X509_ExtEntry DupExtEntry(const HITLS_X509_ExtEntry src)
1273		1375
1274	int32_t HITLS_X509_ExtReplace(HITLS_X509_Ext dest, HITLS_X509_Ext src)	1376	int32_t HITLS_X509_ExtReplace(HITLS_X509_Ext dest, HITLS_X509_Ext src)
1275	{	1377	{
1276	if (dest == NULL \|\| src == NULL) {	1378	if (dest == NULL \|\| dest->extData == NULL \|\| src == NULL \|\| src->extData == NULL) {
1277	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_INVALID_PARAM);	1379	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_INVALID_PARAM);
1278	return HITLS_X509_ERR_INVALID_PARAM;	1380	return HITLS_X509_ERR_INVALID_PARAM;
1279	}	1381	}
1280	if (dest->extFlags & HITLS_X509_EXT_FLAG_PARSE) {	1382	if (dest->flag & HITLS_X509_EXT_FLAG_PARSE) {
1281	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_EXT_SET_AFTER_PARSE);	1383	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_EXT_SET_AFTER_PARSE);
1282	return HITLS_X509_ERR_EXT_SET_AFTER_PARSE;	1384	return HITLS_X509_ERR_EXT_SET_AFTER_PARSE;
1283	}	1385	}
1284	dest->isCa = src->isCa;	1386	HITLS_X509_CertExt certExt = (HITLS_X509_CertExt )dest->extData;
1285	dest->maxPathLen = src->maxPathLen;	1387	HITLS_X509_CertExt srcExt = (HITLS_X509_CertExt )src->extData;
1286	dest->keyUsage = src->keyUsage;	1388	certExt->isCa = srcExt->isCa;
1287	dest->extFlags = src->extFlags;	1389	certExt->maxPathLen = srcExt->maxPathLen;
1288	if (src->extFlags & HITLS_X509_EXT_FLAG_PARSE) {	1390	certExt->keyUsage = srcExt->keyUsage;
1289	dest->extFlags -= HITLS_X509_EXT_FLAG_PARSE;	1391	certExt->extFlags = srcExt->extFlags;
1290	dest->extFlags \|= HITLS_X509_EXT_FLAG_SET;
1291	}
1292		1392
1293	if (src->list == NULL) {	1393	if (src->extList == NULL) {
1294	BSL_LIST_DeleteAll(dest->list, (BSL_LIST_PFUNC_FREE)HITLS_X509_ExtEntryFree);	1394	BSL_LIST_DeleteAll(dest->extList, (BSL_LIST_PFUNC_FREE)HITLS_X509_ExtEntryFree);
1295	return HITLS_X509_SUCCESS;	1395	return HITLS_X509_SUCCESS;
1296	}	1396	}
1297	BslList *list =	1397	BslList *list =
1298	BSL_LIST_Copy(src->list, (BSL_LIST_PFUNC_DUP)DupExtEntry, (BSL_LIST_PFUNC_FREE)HITLS_X509_ExtEntryFree);	1398	BSL_LIST_Copy(src->extList, (BSL_LIST_PFUNC_DUP)X509_DupExtEntry, (BSL_LIST_PFUNC_FREE)HITLS_X509_ExtEntryFree);
1299	if (list == NULL) {	1399	if (list == NULL) {
1300	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_EXT_SET);	1400	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_EXT_SET);
1301	return HITLS_X509_ERR_EXT_SET;	1401	return HITLS_X509_ERR_EXT_SET;
1302	}	1402	}
1303	BSL_LIST_FREE(dest->list, (BSL_LIST_PFUNC_FREE)HITLS_X509_ExtEntryFree);	1403	BSL_LIST_FREE(dest->extList, (BSL_LIST_PFUNC_FREE)HITLS_X509_ExtEntryFree);
1304	dest->list = list;	1404	dest->extList = list;
		1405	dest->flag = HITLS_X509_EXT_FLAG_GEN;
1305	return HITLS_X509_SUCCESS;	1406	return HITLS_X509_SUCCESS;
1306	}	1407	}
		1408
		1409
		1410	HITLS_X509_Ext *HITLS_X509_ExtNew(int32_t type)
		1411	{
		1412	if (type == HITLS_X509_EXT_TYPE_CERT \|\| type == HITLS_X509_EXT_TYPE_CRL) {
		1413	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_INVALID_PARAM);
		1414	return NULL;
		1415	}
		1416	return X509_ExtNew(NULL, type);
		1417	}
		1418
		1419	void HITLS_X509_ExtFree(HITLS_X509_Ext *ext)
		1420	{
		1421	if (ext == NULL) {
		1422	return;
		1423	}
		1424	X509_ExtFree(ext, true);
		1425	}

Mx509/x509_crl/include/hitls_crl_local.h+8-9

	@@ -26,15 +26,16 @@
26	extern "C" {	26	extern "C" {
27	#endif	27	#endif
28		28
29	typedef struct {	29	#define HITLS_X509_CRL_PARSE_FLAG 0x01
30	BSL_ASN1_List *extList;	30	#define HITLS_X509_CRL_GEN_FLAG 0x02
31	} HITLS_X509_CrlExt;
32		31
33	typedef struct {	32	#define BSL_TIME_REVOKE_TIME_IS_GMT 0x4
		33
		34	typedef struct _HITLS_X509_CrlEntry {
34	uint8_t flag;	35	uint8_t flag;
35	BSL_ASN1_Buffer serialNumber;	36	BSL_ASN1_Buffer serialNumber;
36	BSL_TIME time;	37	BSL_TIME time;
37	BSL_ASN1_Buffer entryExt;	38	BSL_ASN1_List *extList;
38	} HITLS_X509_CrlEntry;	39	} HITLS_X509_CrlEntry;
39		40
40	typedef struct {	41	typedef struct {
	@@ -48,11 +49,11 @@ typedef struct {
48	HITLS_X509_ValidTime validTime;	49	HITLS_X509_ValidTime validTime;
49		50
50	BSL_ASN1_List *revokedCerts;	51	BSL_ASN1_List *revokedCerts;
51	HITLS_X509_CrlExt crlExt;	52	HITLS_X509_Ext crlExt;
52	} HITLS_X509_CrlTbs;	53	} HITLS_X509_CrlTbs;
53		54
54	typedef struct _HITLS_X509_Crl {	55	typedef struct _HITLS_X509_Crl {
55	bool isCopy;	56	uint8_t flag;
56	uint8_t *rawData;	57	uint8_t *rawData;
57	uint32_t rawDataLen;	58	uint32_t rawDataLen;
58	HITLS_X509_CrlTbs tbs;	59	HITLS_X509_CrlTbs tbs;
	@@ -61,9 +62,7 @@ typedef struct _HITLS_X509_Crl {
61	BSL_SAL_RefCount references;	62	BSL_SAL_RefCount references;
62	} HITLS_X509_Crl;	63	} HITLS_X509_Crl;
63		64
64	HITLS_X509_Crl *HITLS_X509_CrlNew(void);
65	int32_t HITLS_X509_CrlMulParseBuff(int32_t format, BSL_Buffer encode, HITLS_X509_List *crllist);	65	int32_t HITLS_X509_CrlMulParseBuff(int32_t format, BSL_Buffer encode, HITLS_X509_List *crllist);
66	int32_t HITLS_X509_EncodeCrlTbs(HITLS_X509_CrlTbs crlTbs, BSL_ASN1_Buffer asn);
67	#ifdef __cplusplus	66	#ifdef __cplusplus
68	}	67	}
69	#endif	68	#endif

Mx509/x509_crl/src/hitls_x509_crl.c+817-35

	@@ -18,6 +18,8 @@
18	#include "sal_file.h"	18	#include "sal_file.h"
19	#include "securec.h"	19	#include "securec.h"
20	#include "hitls_x509_errno.h"	20	#include "hitls_x509_errno.h"
		21	#include "crypt_errno.h"
		22	#include "sal_time.h"
21	#include "hitls_x509_local.h"	23	#include "hitls_x509_local.h"
22	#include "hitls_crl_local.h"	24	#include "hitls_crl_local.h"
23	#include "bsl_obj_internal.h"	25	#include "bsl_obj_internal.h"
	@@ -112,14 +114,17 @@ void HITLS_X509_CrlFree(HITLS_X509_Crl *crl)
112	if (ret > 0) {	114	if (ret > 0) {
113	return;	115	return;
114	}	116	}
115		117	if (crl->flag & HITLS_X509_CRL_GEN_FLAG) {
116	BSL_LIST_FREE(crl->tbs.issuerName, NULL);	118	BSL_LIST_FREE(crl->tbs.issuerName, (BSL_LIST_PFUNC_FREE)HITLS_X509_FreeNameNode);
117	BSL_LIST_FREE(crl->tbs.revokedCerts, NULL);	119	BSL_SAL_FREE(crl->tbs.tbsRawData);
118	BSL_LIST_FREE(crl->tbs.crlExt.extList, NULL);	120	BSL_SAL_FREE(crl->signature.buff);
119	BSL_SAL_ReferencesFree(&(crl->references));	121	} else {
120	if (crl->isCopy == true) {	122	BSL_LIST_FREE(crl->tbs.issuerName, NULL);
121	BSL_SAL_FREE(crl->rawData);
122	}	123	}
		124	BSL_LIST_FREE(crl->tbs.revokedCerts, (BSL_LIST_PFUNC_FREE)HITLS_X509_CrlRevokedFree);
		125	X509_ExtFree(&crl->tbs.crlExt, false);
		126	BSL_SAL_ReferencesFree(&(crl->references));
		127	BSL_SAL_FREE(crl->rawData);
123	BSL_SAL_Free(crl);	128	BSL_SAL_Free(crl);
124	return;	129	return;
125	}	130	}
	@@ -129,7 +134,7 @@ HITLS_X509_Crl *HITLS_X509_CrlNew()
129	HITLS_X509_Crl *crl = NULL;	134	HITLS_X509_Crl *crl = NULL;
130	BSL_ASN1_List *issuerName = NULL;	135	BSL_ASN1_List *issuerName = NULL;
131	BSL_ASN1_List *entryList = NULL;	136	BSL_ASN1_List *entryList = NULL;
132	BSL_ASN1_List *extList = NULL;	137	HITLS_X509_Ext *ext = NULL;
133	crl = (HITLS_X509_Crl *)BSL_SAL_Calloc(1, sizeof(HITLS_X509_Crl));	138	crl = (HITLS_X509_Crl *)BSL_SAL_Calloc(1, sizeof(HITLS_X509_Crl));
134	if (crl == NULL) {	139	if (crl == NULL) {
135	return NULL;	140	return NULL;
	@@ -144,14 +149,13 @@ HITLS_X509_Crl *HITLS_X509_CrlNew()
144	if (entryList == NULL) {	149	if (entryList == NULL) {
145	goto ERR;	150	goto ERR;
146	}	151	}
147	extList = BSL_LIST_New(sizeof(HITLS_X509_ExtEntry));	152	ext = X509_ExtNew(&crl->tbs.crlExt, HITLS_X509_EXT_TYPE_CRL);
148	if (extList == NULL) {	153	if (ext == NULL) {
149	goto ERR;	154	goto ERR;
150	}	155	}
151	BSL_SAL_ReferencesInit(&(crl->references));	156	BSL_SAL_ReferencesInit(&(crl->references));
152	crl->tbs.issuerName = issuerName;	157	crl->tbs.issuerName = issuerName;
153	crl->tbs.revokedCerts = entryList;	158	crl->tbs.revokedCerts = entryList;
154	crl->tbs.crlExt.extList = extList;
155	return crl;	159	return crl;
156	ERR:	160	ERR:
157	BSL_SAL_Free(crl);	161	BSL_SAL_Free(crl);
	@@ -160,9 +164,10 @@ ERR:
160	return NULL;	164	return NULL;
161	}	165	}
162		166
163	int32_t HITLS_CRL_ParseExtAsnItem(BSL_ASN1_Buffer asn, void param, BSL_ASN1_List *list)	167	int32_t HITLS_CRL_ParseExtAsnItem(int32_t layer, BSL_ASN1_Buffer asn, void param, BSL_ASN1_List *list)
164	{	168	{
165	(void) param;	169	(void) param;
		170	(void) layer;
166	HITLS_X509_ExtEntry extEntry = {0};	171	HITLS_X509_ExtEntry extEntry = {0};
167	int32_t ret = HITLS_X509_ParseExtItem(asn, &extEntry);	172	int32_t ret = HITLS_X509_ParseExtItem(asn, &extEntry);
168	if (ret != HITLS_X509_SUCCESS) {	173	if (ret != HITLS_X509_SUCCESS) {
	@@ -178,20 +183,25 @@ int32_t HITLS_CRL_ParseExtSeqof(uint32_t layer, BSL_ASN1_Buffer asn, void para
178	if (layer == 1) {	183	if (layer == 1) {
179	return HITLS_X509_SUCCESS;	184	return HITLS_X509_SUCCESS;
180	}	185	}
181	return HITLS_CRL_ParseExtAsnItem(asn, param, list);	186	return HITLS_CRL_ParseExtAsnItem(layer, asn, param, list);
182	}	187	}
183		188
184	int32_t HITLS_X509_ParseCrlExt(BSL_ASN1_Buffer ext, HITLS_X509_Crl crl)	189	int32_t HITLS_X509_ParseCrlExt(BSL_ASN1_Buffer ext, HITLS_X509_Crl crl)
185	{	190	{
		191	if ((crl->tbs.crlExt.flag & HITLS_X509_EXT_FLAG_GEN) != 0) {
		192	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_EXT_PARSE_AFTER_SET);
		193	return HITLS_X509_ERR_EXT_PARSE_AFTER_SET;
		194	}
186	uint8_t expTag[] = {BSL_ASN1_TAG_CONSTRUCTED \| BSL_ASN1_TAG_SEQUENCE,	195	uint8_t expTag[] = {BSL_ASN1_TAG_CONSTRUCTED \| BSL_ASN1_TAG_SEQUENCE,
187	BSL_ASN1_TAG_CONSTRUCTED \| BSL_ASN1_TAG_SEQUENCE};	196	BSL_ASN1_TAG_CONSTRUCTED \| BSL_ASN1_TAG_SEQUENCE};
188	BSL_ASN1_DecodeListParam listParam = {2, expTag};	197	BSL_ASN1_DecodeListParam listParam = {2, expTag};
189	int ret = BSL_ASN1_DecodeListItem(&listParam, ext, &HITLS_CRL_ParseExtSeqof, crl, crl->tbs.crlExt.extList);	198	int32_t ret = BSL_ASN1_DecodeListItem(&listParam, ext, &HITLS_CRL_ParseExtSeqof, crl, crl->tbs.crlExt.extList);
190	if (ret != BSL_SUCCESS) {	199	if (ret != BSL_SUCCESS) {
191	BSL_LIST_DeleteAll(crl->tbs.crlExt.extList, NULL);	200	BSL_LIST_DeleteAll(crl->tbs.crlExt.extList, NULL);
192	BSL_ERR_PUSH_ERROR(ret);	201	BSL_ERR_PUSH_ERROR(ret);
193	return ret;	202	return ret;
194	}	203	}
		204	crl->tbs.crlExt.flag \|= HITLS_X509_EXT_FLAG_PARSE;
195	return ret;	205	return ret;
196	}	206	}
197		207
	@@ -222,14 +232,37 @@ int32_t HITLS_X509_CrlEntryChoiceCheck(int32_t type, int32_t idx, void *data, vo
222	}	232	}
223	return HITLS_X509_ERR_CHECK_TAG;	233	return HITLS_X509_ERR_CHECK_TAG;
224	}	234	}
225	#define BSL_TIME_REVOKE_TIME_IS_GMT 0x1	235
		236	static int32_t DecodeCrlRevokeExt(BSL_ASN1_Buffer asnArr, HITLS_X509_CrlEntry crlEntry)
		237	{
		238	if (asnArr->buff == NULL) {
		239	return HITLS_X509_SUCCESS;
		240	}
		241	BslList *list = BSL_LIST_New(sizeof(HITLS_X509_ExtEntry));
		242	if (list == NULL) {
		243	BSL_ERR_PUSH_ERROR(BSL_MALLOC_FAIL);
		244	return BSL_MALLOC_FAIL;
		245	}
		246	uint8_t expTag = (BSL_ASN1_TAG_CONSTRUCTED \| BSL_ASN1_TAG_SEQUENCE);
		247	BSL_ASN1_DecodeListParam listParam = {1, &expTag};
		248	int32_t ret = BSL_ASN1_DecodeListItem(&listParam, asnArr, (BSL_ASN1_ParseListAsnItem)HITLS_CRL_ParseExtAsnItem,
		249	NULL, list);
		250	if (ret != BSL_SUCCESS) {
		251	BSL_LIST_FREE(list, NULL);
		252	return ret;
		253	}
		254
		255	crlEntry->extList = list;
		256	return HITLS_X509_SUCCESS;
		257	}
		258
226	int32_t HITLS_CRL_ParseCrlEntry(BSL_ASN1_Buffer extItem, HITLS_X509_CrlEntry crlEntry)	259	int32_t HITLS_CRL_ParseCrlEntry(BSL_ASN1_Buffer extItem, HITLS_X509_CrlEntry crlEntry)
227	{	260	{
228	uint8_t *temp = extItem->buff;	261	uint8_t *temp = extItem->buff;
229	uint32_t tempLen = extItem->len;	262	uint32_t tempLen = extItem->len;
230	BSL_ASN1_Buffer asnArr[HITLS_X509_CRLENTRY_MAX_IDX] = {0};	263	BSL_ASN1_Buffer asnArr[HITLS_X509_CRLENTRY_MAX_IDX] = {0};
231	BSL_ASN1_Template templ = {g_crlEntryTempl, sizeof(g_crlEntryTempl) / sizeof(g_crlEntryTempl[0])};	264	BSL_ASN1_Template templ = {g_crlEntryTempl, sizeof(g_crlEntryTempl) / sizeof(g_crlEntryTempl[0])};
232	int32_t ret = BSL_ASN1_DecodeTemplate(&templ, &HITLS_X509_CrlEntryChoiceCheck,	265	int32_t ret = BSL_ASN1_DecodeTemplate(&templ, HITLS_X509_CrlEntryChoiceCheck,
233	&temp, &tempLen, asnArr, HITLS_X509_CRLENTRY_MAX_IDX);	266	&temp, &tempLen, asnArr, HITLS_X509_CRLENTRY_MAX_IDX);
234	if (tempLen != 0) {	267	if (tempLen != 0) {
235	ret = HITLS_X509_ERR_CRL_ENTRY;	268	ret = HITLS_X509_ERR_CRL_ENTRY;
	@@ -248,8 +281,12 @@ int32_t HITLS_CRL_ParseCrlEntry(BSL_ASN1_Buffer extItem, HITLS_X509_CrlEntry c
248	if (asnArr[HITLS_X509_CRLENTRY_TIME_IDX].tag == BSL_ASN1_TAG_GENERALIZEDTIME) {	281	if (asnArr[HITLS_X509_CRLENTRY_TIME_IDX].tag == BSL_ASN1_TAG_GENERALIZEDTIME) {
249	crlEntry->flag \|= BSL_TIME_REVOKE_TIME_IS_GMT;	282	crlEntry->flag \|= BSL_TIME_REVOKE_TIME_IS_GMT;
250	}	283	}
251	// optinal	284	ret = DecodeCrlRevokeExt(&asnArr[HITLS_X509_CRLENTRY_EXT_IDX], crlEntry);
252	crlEntry->entryExt = asnArr[HITLS_X509_CRLENTRY_EXT_IDX];	285	if (ret != HITLS_X509_SUCCESS) {
		286	BSL_ERR_PUSH_ERROR(ret);
		287	return ret;
		288	}
		289
253	return ret;	290	return ret;
254	}	291	}
255		292
	@@ -263,7 +300,7 @@ int32_t HITLS_CRL_ParseCrlAsnItem(uint32_t layer, BSL_ASN1_Buffer asn, void pa
263	BSL_ERR_PUSH_ERROR(ret);	300	BSL_ERR_PUSH_ERROR(ret);
264	return ret;	301	return ret;
265	}	302	}
266		303	crlEntry.flag \|= HITLS_X509_CRL_PARSE_FLAG;
267	return HITLS_X509_AddListItemDefault(&crlEntry, sizeof(HITLS_X509_CrlEntry), list);	304	return HITLS_X509_AddListItemDefault(&crlEntry, sizeof(HITLS_X509_CrlEntry), list);
268	}	305	}
269		306
	@@ -358,7 +395,7 @@ static void X509_EncodeCrlValidTime(HITLS_X509_ValidTime *crlTime, BSL_ASN1_Buff
358	return;	395	return;
359	}	396	}
360		397
361	static void X509_EncodeCrlEntry(HITLS_X509_CrlEntry crlEntry, BSL_ASN1_Buffer asnBuf)	398	static int32_t X509_EncodeCrlEntry(HITLS_X509_CrlEntry crlEntry, BSL_ASN1_Buffer asnBuf)
362	{	399	{
363	asnBuf[0].tag = crlEntry->serialNumber.tag;	400	asnBuf[0].tag = crlEntry->serialNumber.tag;
364	asnBuf[0].buff = crlEntry->serialNumber.buff;	401	asnBuf[0].buff = crlEntry->serialNumber.buff;
	@@ -367,9 +404,14 @@ static void X509_EncodeCrlEntry(HITLS_X509_CrlEntry crlEntry, BSL_ASN1_Buffer
367	BSL_ASN1_TAG_GENERALIZEDTIME : BSL_ASN1_TAG_UTCTIME;	404	BSL_ASN1_TAG_GENERALIZEDTIME : BSL_ASN1_TAG_UTCTIME;
368	asnBuf[1].buff = (uint8_t *)&(crlEntry->time);	405	asnBuf[1].buff = (uint8_t *)&(crlEntry->time);
369	asnBuf[1].len = sizeof(BSL_TIME);	406	asnBuf[1].len = sizeof(BSL_TIME);
370	asnBuf[2].tag = crlEntry->entryExt.tag; // 2 : extension	407	if (crlEntry->extList != NULL && BSL_LIST_COUNT(crlEntry->extList) != 0) {
371	asnBuf[2].buff = crlEntry->entryExt.buff; // 2 : extension	408	return HITLS_X509_EncodeExtEntry(crlEntry->extList, &asnBuf[2]); // 2 ：extensions
372	asnBuf[2].len = crlEntry->entryExt.len; // 2 : extension	409	} else {
		410	asnBuf[2].tag = 0; // 2 ：extensions
		411	asnBuf[2].buff = NULL; // 2 ：extensions
		412	asnBuf[2].len = 0; // 2 ：extensions
		413	return HITLS_X509_SUCCESS;
		414	}
373	}	415	}
374		416
375	#define X509_CRLENTRY_ELEM_NUMBER 3	417	#define X509_CRLENTRY_ELEM_NUMBER 3
	@@ -387,10 +429,17 @@ int32_t HITLS_X509_EncodeRevokeCrlList(BSL_ASN1_List crlList, BSL_ASN1_Buffer
387	BSL_ERR_PUSH_ERROR(BSL_MALLOC_FAIL);	429	BSL_ERR_PUSH_ERROR(BSL_MALLOC_FAIL);
388	return BSL_MALLOC_FAIL;	430	return BSL_MALLOC_FAIL;
389	}	431	}
		432	(void)memset_s(asnBuf, count * sizeof(BSL_ASN1_Buffer) * X509_CRLENTRY_ELEM_NUMBER, 0,
		433	count * sizeof(BSL_ASN1_Buffer) * X509_CRLENTRY_ELEM_NUMBER);
390	HITLS_X509_CrlEntry *crlEntry = NULL;	434	HITLS_X509_CrlEntry *crlEntry = NULL;
391	uint32_t iter = 0;	435	uint32_t iter = 0;
		436	uint32_t ret;
392	for (crlEntry = BSL_LIST_GET_FIRST(crlList); crlEntry != NULL; crlEntry = BSL_LIST_GET_NEXT(crlList)) {	437	for (crlEntry = BSL_LIST_GET_FIRST(crlList); crlEntry != NULL; crlEntry = BSL_LIST_GET_NEXT(crlList)) {
393	X509_EncodeCrlEntry(crlEntry, &asnBuf[iter]);	438	ret = X509_EncodeCrlEntry(crlEntry, &asnBuf[iter]);
		439	if (ret != HITLS_X509_SUCCESS) {
		440	BSL_ERR_PUSH_ERROR(ret);
		441	goto ERR;
		442	}
394	iter += X509_CRLENTRY_ELEM_NUMBER;	443	iter += X509_CRLENTRY_ELEM_NUMBER;
395	}	444	}
396	BSL_ASN1_TemplateItem crlEntryTempl[] = {	445	BSL_ASN1_TemplateItem crlEntryTempl[] = {
	@@ -400,7 +449,15 @@ int32_t HITLS_X509_EncodeRevokeCrlList(BSL_ASN1_List crlList, BSL_ASN1_Buffer
400	{BSL_ASN1_TAG_CONSTRUCTED \| BSL_ASN1_TAG_SEQUENCE, BSL_ASN1_FLAG_OPTIONAL, 1}	449	{BSL_ASN1_TAG_CONSTRUCTED \| BSL_ASN1_TAG_SEQUENCE, BSL_ASN1_FLAG_OPTIONAL, 1}
401	};	450	};
402	BSL_ASN1_Template templ = {crlEntryTempl, sizeof(crlEntryTempl) / sizeof(crlEntryTempl[0])};	451	BSL_ASN1_Template templ = {crlEntryTempl, sizeof(crlEntryTempl) / sizeof(crlEntryTempl[0])};
403	int32_t ret = BSL_ASN1_EncodeListItem(BSL_ASN1_TAG_SEQUENCE, count, &templ, asnBuf, iter, revokeBuf);	452	ret = BSL_ASN1_EncodeListItem(BSL_ASN1_TAG_SEQUENCE, count, &templ, asnBuf, iter, revokeBuf);
		453	ERR:
		454	for (int32_t i = 0; i < count; i++) {
		455	/**
		456	* The memory for the extension in CRLentry needs to be freed up.
		457	* The subscript 2 corresponds to the extension.
		458	*/
		459	BSL_SAL_Free(asnBuf[i * X509_CRLENTRY_ELEM_NUMBER + 2].buff);
		460	}
404	BSL_SAL_Free(asnBuf);	461	BSL_SAL_Free(asnBuf);
405	return ret;	462	return ret;
406	}	463	}
	@@ -423,7 +480,7 @@ BSL_ASN1_TemplateItem g_crlTbsTempl[] = {
423	BSL_ASN1_FLAG_OPTIONAL \| BSL_ASN1_FLAG_HEADERONLY \| BSL_ASN1_FLAG_SAME, 0}, // 11	480	BSL_ASN1_FLAG_OPTIONAL \| BSL_ASN1_FLAG_HEADERONLY \| BSL_ASN1_FLAG_SAME, 0}, // 11
424	};	481	};
425		482
426	int32_t HITLS_X509_EncodeCrlExt(HITLS_X509_CrlExt crlExt, BSL_ASN1_Buffer ext)	483	int32_t HITLS_X509_EncodeCrlExt(HITLS_X509_Ext crlExt, BSL_ASN1_Buffer ext)
427	{	484	{
428	return HITLS_X509_EncodeExt(	485	return HITLS_X509_EncodeExt(
429	BSL_ASN1_CLASS_CTX_SPECIFIC \| BSL_ASN1_TAG_CONSTRUCTED \| HITLS_CRL_CTX_SPECIFIC_TAG_EXTENSION,	486	BSL_ASN1_CLASS_CTX_SPECIFIC \| BSL_ASN1_TAG_CONSTRUCTED \| HITLS_CRL_CTX_SPECIFIC_TAG_EXTENSION,
	@@ -449,7 +506,7 @@ static void X509_EncodeVersion(uint8_t version, BSL_ASN1_Buffer asn)
449	}	506	}
450		507
451	#define X509_CRLTBS_ELEM_NUMBER 7	508	#define X509_CRLTBS_ELEM_NUMBER 7
452	int32_t HITLS_X509_EncodeCrlTbs(HITLS_X509_CrlTbs crlTbs, BSL_ASN1_Buffer asn)	509	int32_t HITLS_X509_EncodeCrlTbsRaw(HITLS_X509_CrlTbs crlTbs, BSL_ASN1_Buffer asn)
453	{	510	{
454	BSL_ASN1_Buffer asnArr[X509_CRLTBS_ELEM_NUMBER] = {0};	511	BSL_ASN1_Buffer asnArr[X509_CRLTBS_ELEM_NUMBER] = {0};
455	BSL_ASN1_Buffer *revokeBuf = NULL;	512	BSL_ASN1_Buffer *revokeBuf = NULL;
	@@ -499,7 +556,7 @@ EXIT:
499	int32_t HITLS_X509_EncodeAsn1Crl(HITLS_X509_Crl crl, uint8_t encode, uint32_t encodeLen)	556	int32_t HITLS_X509_EncodeAsn1Crl(HITLS_X509_Crl crl, uint8_t encode, uint32_t encodeLen)
500	{	557	{
501	BSL_ASN1_Buffer asnArr[X509_CRL_ELEM_NUMBER] = {0};	558	BSL_ASN1_Buffer asnArr[X509_CRL_ELEM_NUMBER] = {0};
502	int32_t ret = HITLS_X509_EncodeCrlTbs(&crl->tbs, asnArr);	559	int32_t ret = HITLS_X509_EncodeCrlTbsRaw(&crl->tbs, asnArr);
503	if (ret != HITLS_X509_SUCCESS) {	560	if (ret != HITLS_X509_SUCCESS) {
504	BSL_ERR_PUSH_ERROR(ret);	561	BSL_ERR_PUSH_ERROR(ret);
505	return ret;	562	return ret;
	@@ -541,14 +598,99 @@ int32_t HITLS_X509_EncodePemCrl(HITLS_X509_Crl crl, uint8_t *encode, uint32_t
541	return ret;	598	return ret;
542	}	599	}
543		600
544	static int32_t X509_CrlCheckValid(HITLS_X509_Crl *crl)	601	static int32_t X509_CheckCrlRevoke(HITLS_X509_Crl *crl)
545	{	602	{
		603	BSL_ASN1_List *revokedCerts = crl->tbs.revokedCerts;
		604	if (revokedCerts != NULL) {
		605	HITLS_X509_CrlEntry *entry = NULL;
		606	for (entry = BSL_LIST_GET_FIRST(revokedCerts); entry != NULL; entry = BSL_LIST_GET_NEXT(revokedCerts)) {
		607	// Check serial number
		608	if (entry->serialNumber.buff == NULL \|\| entry->serialNumber.len == 0) {
		609	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_CRL_ENTRY);
		610	return HITLS_X509_ERR_CRL_ENTRY;
		611	}
		612
		613	// Check revocation time
		614	if (!BSL_DateTimeCheck(&entry->time)) {
		615	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_CRL_TIME_INVALID);
		616	return HITLS_X509_ERR_CRL_TIME_INVALID;
		617	}
		618
		619	// If entry has extensions and CRL version is v1, that's an error
		620	if (entry->extList != NULL && BSL_LIST_COUNT(entry->extList) > 0 && crl->tbs.version == 0) {
		621	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_CRL_INACCURACY_VERSION);
		622	return HITLS_X509_ERR_CRL_INACCURACY_VERSION;
		623	}
		624	}
		625	}
		626	return HITLS_X509_SUCCESS;
		627	}
		628
		629	static int32_t X509_CheckCrlTbs(HITLS_X509_Crl *crl)
		630	{
		631	int32_t ret;
		632	if (crl == NULL) {
		633	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_INVALID_PARAM);
		634	return HITLS_X509_ERR_INVALID_PARAM;
		635	}
		636	if (crl->tbs.version != 0 && crl->tbs.version != 1) {
		637	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_CRL_INACCURACY_VERSION);
		638	return HITLS_X509_ERR_CRL_INACCURACY_VERSION;
		639	}
546	if (crl->tbs.crlExt.extList != NULL && BSL_LIST_COUNT(crl->tbs.crlExt.extList) != 0) {	640	if (crl->tbs.crlExt.extList != NULL && BSL_LIST_COUNT(crl->tbs.crlExt.extList) != 0) {
547	if (crl->tbs.version != 1) {	641	if (crl->tbs.version != 1) {
548	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_CRL_INACCURACY_VERSION);	642	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_CRL_INACCURACY_VERSION);
549	return HITLS_X509_ERR_CRL_INACCURACY_VERSION;	643	return HITLS_X509_ERR_CRL_INACCURACY_VERSION;
550	}	644	}
551	}	645	}
		646	if (crl->tbs.signAlgId.algId == BSL_CID_UNKNOWN) {
		647	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_INVALID_SIGNALG);
		648	return HITLS_X509_ERR_INVALID_SIGNALG;
		649	}
		650
		651	// Check issuer name
		652	if (crl->tbs.issuerName == NULL \|\| BSL_LIST_COUNT(crl->tbs.issuerName) == 0) {
		653	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_CRL_ISSUER_EMPTY);
		654	return HITLS_X509_ERR_CRL_ISSUER_EMPTY;
		655	}
		656
		657	// Check validity time
		658	if (!(crl->tbs.validTime.flag & BSL_TIME_BEFORE_SET)) {
		659	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_CRL_THISUPDATE_UNEXIST);
		660	return HITLS_X509_ERR_CRL_THISUPDATE_UNEXIST;
		661	}
		662
		663	// If nextUpdate is set, check it's after thisUpdate
		664	if (crl->tbs.validTime.flag & BSL_TIME_AFTER_SET) {
		665	ret = BSL_SAL_DateTimeCompare(&crl->tbs.validTime.start, &crl->tbs.validTime.end, NULL);
		666	if (ret != BSL_TIME_DATE_BEFORE) {
		667	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_CRL_TIME_INVALID);
		668	return HITLS_X509_ERR_CRL_TIME_INVALID;
		669	}
		670	}
		671	ret = X509_CheckCrlRevoke(crl);
		672	if (ret != HITLS_X509_SUCCESS) {
		673	BSL_ERR_PUSH_ERROR(ret);
		674	return ret;
		675	}
		676	return HITLS_X509_SUCCESS;
		677	}
		678
		679	static int32_t X509_CrlCheckValid(HITLS_X509_Crl *crl)
		680	{
		681	int32_t ret = X509_CheckCrlTbs(crl);
		682	if (ret != HITLS_X509_SUCCESS) {
		683	BSL_ERR_PUSH_ERROR(ret);
		684	return ret;
		685	}
		686	if (crl->signature.buff == NULL \|\| crl->signature.len == 0) {
		687	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_CRL_LACK_SIGNATURE);
		688	return HITLS_X509_ERR_CRL_LACK_SIGNATURE;
		689	}
		690	if (crl->signAlgId.algId == BSL_CID_UNKNOWN) {
		691	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_INVALID_SIGNALG);
		692	return HITLS_X509_ERR_INVALID_SIGNALG;
		693	}
552		694
553	return HITLS_X509_SUCCESS;	695	return HITLS_X509_SUCCESS;
554	}	696	}
	@@ -585,14 +727,21 @@ int32_t HITLS_X509_CrlGenFile(int32_t format, HITLS_X509_Crl crl, const char p
585	}	727	}
586	ret = BSL_SAL_WriteFile(path, encode, encodeLen);	728	ret = BSL_SAL_WriteFile(path, encode, encodeLen);
587	BSL_SAL_Free(encode);	729	BSL_SAL_Free(encode);
		730	if (ret != HITLS_X509_SUCCESS) {
		731	BSL_ERR_PUSH_ERROR(ret);
		732	}
588	return ret;	733	return ret;
589	}	734	}
590		735
591	int32_t HITLS_X509_ParseAsn1Crl(bool isCopy, uint8_t *encode, uint32_t encodeLen, HITLS_X509_Crl *crl)	736	int32_t HITLS_X509_ParseAsn1Crl(uint8_t *encode, uint32_t encodeLen, HITLS_X509_Crl *crl)
592	{	737	{
593	uint8_t temp = encode;	738	uint8_t temp = encode;
594	uint32_t tempLen = *encodeLen;	739	uint32_t tempLen = *encodeLen;
595	crl->isCopy = isCopy;	740	if (crl->flag & HITLS_X509_CRL_GEN_FLAG) {
		741	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_INVALID_PARAM);
		742	return HITLS_X509_ERR_INVALID_PARAM;
		743	}
		744
596	// template parse	745	// template parse
597	BSL_ASN1_Buffer asnArr[HITLS_X509_CRL_MAX_IDX] = {0};	746	BSL_ASN1_Buffer asnArr[HITLS_X509_CRL_MAX_IDX] = {0};
598	BSL_ASN1_Template templ = {g_crlTempl, sizeof(g_crlTempl) / sizeof(g_crlTempl[0])};	747	BSL_ASN1_Template templ = {g_crlTempl, sizeof(g_crlTempl) / sizeof(g_crlTempl[0])};
	@@ -631,6 +780,7 @@ int32_t HITLS_X509_ParseAsn1Crl(bool isCopy, uint8_t *encode, uint32_t encodeL
631	crl->rawDataLen = *encodeLen - tempLen;	780	crl->rawDataLen = *encodeLen - tempLen;
632	*encode = temp;	781	*encode = temp;
633	*encodeLen = tempLen;	782	*encodeLen = tempLen;
		783	crl->flag \|= HITLS_X509_CRL_PARSE_FLAG;
634	return HITLS_X509_SUCCESS;	784	return HITLS_X509_SUCCESS;
635	ERR:	785	ERR:
636	BSL_LIST_DeleteAll(crl->tbs.issuerName, NULL);	786	BSL_LIST_DeleteAll(crl->tbs.issuerName, NULL);
	@@ -680,7 +830,7 @@ int32_t HITLS_X509_CrlParseBuff(int32_t format, BSL_Buffer *encode, HITLS_X509_C
680	}	830	}
681	HITLS_X509_Crl *tmp = BSL_LIST_GET_FIRST(list);	831	HITLS_X509_Crl *tmp = BSL_LIST_GET_FIRST(list);
682	int ref;	832	int ref;
683	ret = HITLS_X509_CrlCtrl(tmp, HITLS_X509_CRL_REF_UP, &ref, sizeof(int));	833	ret = HITLS_X509_CrlCtrl(tmp, HITLS_X509_REF_UP, &ref, sizeof(int));
684	BSL_LIST_FREE(list, (BSL_LIST_PFUNC_FREE)HITLS_X509_CrlFree);	834	BSL_LIST_FREE(list, (BSL_LIST_PFUNC_FREE)HITLS_X509_CrlFree);
685	if (ret != HITLS_X509_SUCCESS) {	835	if (ret != HITLS_X509_SUCCESS) {
686	return ret;	836	return ret;
	@@ -728,17 +878,649 @@ static int32_t X509_CrlRefUp(HITLS_X509_Crl crl, int32_t val, int32_t valLen)
728	return BSL_SAL_AtomicUpReferences(&crl->references, val);	878	return BSL_SAL_AtomicUpReferences(&crl->references, val);
729	}	879	}
730		880
		881	static int32_t X509_CrlGetThisUpdate(HITLS_X509_Crl crl, BSL_TIME val, int32_t valLen)
		882	{
		883	if (valLen != sizeof(BSL_TIME)) {
		884	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_INVALID_PARAM);
		885	return HITLS_X509_ERR_INVALID_PARAM;
		886	}
		887	if (!(crl->tbs.validTime.flag & BSL_TIME_BEFORE_SET)) {
		888	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_CRL_THISUPDATE_UNEXIST);
		889	return HITLS_X509_ERR_CRL_THISUPDATE_UNEXIST;
		890	}
		891	*val = crl->tbs.validTime.start;
		892	return HITLS_X509_SUCCESS;
		893	}
		894
		895	static int32_t X509_CrlGetNextUpdate(HITLS_X509_Crl crl, BSL_TIME val, int32_t valLen)
		896	{
		897	if (valLen != sizeof(BSL_TIME)) {
		898	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_INVALID_PARAM);
		899	return HITLS_X509_ERR_INVALID_PARAM;
		900	}
		901	if (!(crl->tbs.validTime.flag & BSL_TIME_AFTER_SET)) {
		902	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_CRL_NEXTUPDATE_UNEXIST);
		903	return HITLS_X509_ERR_CRL_NEXTUPDATE_UNEXIST;
		904	}
		905	*val = crl->tbs.validTime.end;
		906	return HITLS_X509_SUCCESS;
		907	}
		908
		909	static int32_t X509_CrlGetVersion(HITLS_X509_Crl crl, int32_t val, int32_t valLen)
		910	{
		911	if (valLen != sizeof(int32_t)) {
		912	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_INVALID_PARAM);
		913	return HITLS_X509_ERR_INVALID_PARAM;
		914	}
		915
		916	// CRL version is stored as v2(1), v1(0)
		917	*val = crl->tbs.version;
		918
		919	return HITLS_X509_SUCCESS;
		920	}
		921
		922	static int32_t X509_CrlGetRevokeList(HITLS_X509_Crl crl, BSL_ASN1_List *val, int32_t valLen)
		923	{
		924	if (valLen != sizeof(BSL_ASN1_List *)) {
		925	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_INVALID_PARAM);
		926	return HITLS_X509_ERR_INVALID_PARAM;
		927	}
		928
		929	if (crl->tbs.revokedCerts == NULL) {
		930	*val = NULL;
		931	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_CRL_REVOKELIST_UNEXIST);
		932	return HITLS_X509_ERR_CRL_REVOKELIST_UNEXIST;
		933	}
		934
		935	*val = crl->tbs.revokedCerts;
		936	return HITLS_X509_SUCCESS;
		937	}
		938
		939	static int32_t X509_CrlGetCtrl(HITLS_X509_Crl crl, int32_t cmd, void val, int32_t valLen)
		940	{
		941	if (val == NULL) {
		942	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_INVALID_PARAM);
		943	return HITLS_X509_ERR_INVALID_PARAM;
		944	}
		945	switch (cmd) {
		946	case HITLS_X509_GET_VERSION:
		947	return X509_CrlGetVersion(crl, val, valLen);
		948	case HITLS_X509_GET_BEFORE_TIME:
		949	return X509_CrlGetThisUpdate(crl, val, valLen);
		950	case HITLS_X509_GET_AFTER_TIME:
		951	return X509_CrlGetNextUpdate(crl, val, valLen);
		952	case HITLS_X509_GET_ISSUER_DNNAME:
		953	return HITLS_X509_GetList(crl->tbs.issuerName, val, valLen);
		954	case HITLS_X509_GET_REVOKELIST:
		955	return X509_CrlGetRevokeList(crl, val, valLen);
		956	default:
		957	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_INVALID_PARAM);
		958	return HITLS_X509_ERR_INVALID_PARAM;
		959	}
		960	}
		961
		962	static int32_t CrlSetTime(void dest, uint8_t val, uint8_t valLen)
		963	{
		964	if (valLen != sizeof(BSL_TIME) \|\| !BSL_DateTimeCheck((BSL_TIME *)val)) {
		965	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_INVALID_PARAM);
		966	return HITLS_X509_ERR_INVALID_PARAM;
		967	}
		968	(void)memcpy_s(dest, valLen, val, valLen);
		969	return HITLS_X509_SUCCESS;
		970	}
		971
		972	static int32_t CrlSetThisUpdaeTime(HITLS_X509_ValidTime time, uint8_t val, uint8_t valLen)
		973	{
		974	int32_t ret = CrlSetTime(&(time->start), val, valLen);
		975	if (ret != HITLS_X509_SUCCESS) {
		976	return ret;
		977	}
		978	time->flag \|= BSL_TIME_BEFORE_SET;
		979	return HITLS_X509_SUCCESS;
		980	}
		981
		982	static int32_t CrlSetNextUpdateTime(HITLS_X509_ValidTime time, uint8_t val, uint8_t valLen)
		983	{
		984	int32_t ret = CrlSetTime(&(time->end), val, valLen);
		985	if (ret != HITLS_X509_SUCCESS) {
		986	return ret;
		987	}
		988	time->flag \|= BSL_TIME_AFTER_SET;
		989	return HITLS_X509_SUCCESS;
		990	}
		991
		992	static HITLS_X509_CrlEntry X509_CrlEntryDup(const HITLS_X509_CrlEntry src)
		993	{
		994	HITLS_X509_CrlEntry dest = (HITLS_X509_CrlEntry )BSL_SAL_Malloc(sizeof(HITLS_X509_CrlEntry));
		995	if (dest == NULL) {
		996	BSL_ERR_PUSH_ERROR(BSL_MALLOC_FAIL);
		997	return NULL;
		998	}
		999	(void)memset_s(dest, sizeof(HITLS_X509_CrlEntry), 0, sizeof(HITLS_X509_CrlEntry));
		1000
		1001	dest->serialNumber.buff = BSL_SAL_Dump(src->serialNumber.buff, src->serialNumber.len);
		1002	if (dest->serialNumber.buff == NULL) {
		1003	BSL_ERR_PUSH_ERROR(BSL_MALLOC_FAIL);
		1004	goto ERR;
		1005	}
		1006
		1007	dest->serialNumber.len = src->serialNumber.len;
		1008	dest->serialNumber.tag = src->serialNumber.tag;
		1009
		1010	dest->time = src->time;
		1011	dest->flag = src->flag;
		1012	dest->flag &= ~HITLS_X509_CRL_PARSE_FLAG;
		1013	dest->flag \|= HITLS_X509_CRL_GEN_FLAG;
		1014
		1015	if (src->extList != NULL) {
		1016	dest->extList = BSL_LIST_Copy(src->extList, (BSL_LIST_PFUNC_DUP)X509_DupExtEntry,
		1017	(BSL_LIST_PFUNC_FREE)HITLS_X509_ExtEntryFree);
		1018	if (dest->extList == NULL) {
		1019	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_EXT_SET);
		1020	goto ERR;
		1021	}
		1022	}
		1023	return dest;
		1024	ERR:
		1025	BSL_SAL_Free(dest->serialNumber.buff);
		1026	BSL_SAL_Free(dest);
		1027	return NULL;
		1028	}
		1029
		1030	static void X509_CrlEntryFree(HITLS_X509_CrlEntry *entry)
		1031	{
		1032	if (entry == NULL) {
		1033	return;
		1034	}
		1035	BSL_SAL_Free(entry->serialNumber.buff);
		1036	BSL_LIST_FREE(entry->extList, (BSL_LIST_PFUNC_FREE)HITLS_X509_ExtEntryFree);
		1037	BSL_SAL_Free(entry);
		1038	}
		1039
		1040	int32_t HITLS_X509_CrlAddRevokedCert(HITLS_X509_Crl crl, void val, int32_t valLen)
		1041	{
		1042	if (valLen != sizeof(HITLS_X509_CrlEntry)) {
		1043	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_INVALID_PARAM);
		1044	return HITLS_X509_ERR_INVALID_PARAM;
		1045	}
		1046
		1047	HITLS_X509_CrlEntry entry = (HITLS_X509_CrlEntry )val;
		1048
		1049	if (entry->serialNumber.buff == NULL \|\| entry->serialNumber.len == 0) {
		1050	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_CRL_ENTRY);
		1051	return HITLS_X509_ERR_CRL_ENTRY;
		1052	}
		1053
		1054	if (!BSL_DateTimeCheck(&entry->time)) {
		1055	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_CRL_ENTRY);
		1056	return HITLS_X509_ERR_CRL_ENTRY;
		1057	}
		1058
		1059	if (crl->tbs.revokedCerts == NULL) {
		1060	crl->tbs.revokedCerts = BSL_LIST_New(sizeof(HITLS_X509_CrlEntry));
		1061	if (crl->tbs.revokedCerts == NULL) {
		1062	BSL_ERR_PUSH_ERROR(BSL_MALLOC_FAIL);
		1063	return BSL_MALLOC_FAIL;
		1064	}
		1065	}
		1066	HITLS_X509_CrlEntry *newEntry = X509_CrlEntryDup(entry);
		1067	if (newEntry == NULL) {
		1068	BSL_ERR_PUSH_ERROR(BSL_MALLOC_FAIL);
		1069	return BSL_MALLOC_FAIL;
		1070	}
		1071
		1072	int32_t ret = BSL_LIST_AddElement(crl->tbs.revokedCerts, newEntry, BSL_LIST_POS_END);
		1073	if (ret != BSL_SUCCESS) {
		1074	X509_CrlEntryFree(newEntry);
		1075	BSL_ERR_PUSH_ERROR(ret);
		1076	return ret;
		1077	}
		1078
		1079	// If the CRL version is v1 and an extended revocation certificate is added, it needs to be upgraded to v2
		1080	if (crl->tbs.version == 0 && entry->extList != NULL) {
		1081	crl->tbs.version = 1; // v2
		1082	}
		1083
		1084	return HITLS_X509_SUCCESS;
		1085	}
		1086
		1087	static int32_t X509_CrlSetVersion(HITLS_X509_Crl crl, uint8_t val, uint8_t valLen)
		1088	{
		1089	if (valLen != sizeof(int32_t)) {
		1090	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_INVALID_PARAM);
		1091	return HITLS_X509_ERR_INVALID_PARAM;
		1092	}
		1093	int32_t version = (int32_t )val;
		1094	if (version != 0 && version != 1) {
		1095	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_INVALID_PARAM);
		1096	return HITLS_X509_ERR_INVALID_PARAM;
		1097	}
		1098	crl->tbs.version = version;
		1099	return HITLS_X509_SUCCESS;
		1100	}
		1101
		1102	int32_t X509_CrlSetCtrl(HITLS_X509_Crl crl, int32_t cmd, void val, int32_t valLen)
		1103	{
		1104	if (val == NULL) {
		1105	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_INVALID_PARAM);
		1106	return HITLS_X509_ERR_INVALID_PARAM;
		1107	}
		1108	if (crl->flag &= HITLS_X509_CRL_PARSE_FLAG) {
		1109	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_INVALID_PARAM);
		1110	return HITLS_X509_ERR_INVALID_PARAM;
		1111	}
		1112	crl->flag \|= HITLS_X509_CRL_GEN_FLAG;
		1113	switch (cmd) {
		1114	case HITLS_X509_SET_VERSION:
		1115	return X509_CrlSetVersion(crl, val, valLen);
		1116	case HITLS_X509_SET_ISSUER_DNNAME:
		1117	return HITLS_X509_SetNameList(&crl->tbs.issuerName, val, valLen);
		1118	case HITLS_X509_SET_BEFORE_TIME:
		1119	return CrlSetThisUpdaeTime(&crl->tbs.validTime, val, valLen);
		1120	case HITLS_X509_SET_AFTER_TIME:
		1121	return CrlSetNextUpdateTime(&crl->tbs.validTime, val, valLen);
		1122	case HITLS_X509_CRL_ADD_REVOKED_CERT:
		1123	return HITLS_X509_CrlAddRevokedCert(crl, val, valLen);
		1124	default:
		1125	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_INVALID_PARAM);
		1126	return HITLS_X509_ERR_INVALID_PARAM;
		1127	}
		1128	}
		1129
731	int32_t HITLS_X509_CrlCtrl(HITLS_X509_Crl crl, int32_t cmd, void val, int32_t valLen)	1130	int32_t HITLS_X509_CrlCtrl(HITLS_X509_Crl crl, int32_t cmd, void val, int32_t valLen)
732	{	1131	{
733	if (crl == NULL) {	1132	if (crl == NULL) {
734	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_INVALID_PARAM);	1133	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_INVALID_PARAM);
735	return HITLS_X509_ERR_INVALID_PARAM;	1134	return HITLS_X509_ERR_INVALID_PARAM;
736	}	1135	}
		1136	if (cmd == HITLS_X509_REF_UP) {
		1137	return X509_CrlRefUp(crl, val, valLen);
		1138	} else if (cmd >= HITLS_X509_GET_ENCODELEN && cmd < HITLS_X509_SET_VERSION) {
		1139	return X509_CrlGetCtrl(crl, cmd, val, valLen);
		1140	} else if (cmd < HITLS_X509_EXT_KU_KEYENC) {
		1141	return X509_CrlSetCtrl(crl, cmd, val, valLen);
		1142	} else if (cmd <= HITLS_X509_EXT_CHECK_SKI) {
		1143	static int32_t cmdSet[] = {HITLS_X509_EXT_SET_CRLNUMBER, HITLS_X509_EXT_SET_AKI, HITLS_X509_EXT_GET_CRLNUMBER,
		1144	HITLS_X509_EXT_GET_AKI};
		1145	if (!X509_CheckCmdVaild(cmdSet, sizeof(cmdSet) / sizeof(int32_t), cmd)) {
		1146	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_EXT_NOT_SUPPORT);
		1147	return HITLS_X509_ERR_EXT_NOT_SUPPORT;
		1148	}
		1149	return X509_ExtCtrl(&crl->tbs.crlExt, cmd, val, valLen);
		1150	} else {
		1151	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_INVALID_PARAM);
		1152	return HITLS_X509_ERR_INVALID_PARAM;
		1153	}
		1154	}
		1155
		1156	int32_t HITLS_X509_EncodeCrlTbs(HITLS_X509_CrlTbs crlTbs, uint8_t tobeSigned, uint32_t tobeSignedLen)
		1157	{
		1158	BSL_ASN1_Buffer asnArr = {0};
		1159	int32_t ret = HITLS_X509_EncodeCrlTbsRaw(crlTbs, &asnArr);
		1160	if (ret != HITLS_X509_SUCCESS) {
		1161	BSL_ERR_PUSH_ERROR(ret);
		1162	return ret;
		1163	}
		1164	BSL_ASN1_TemplateItem tbsTempl[] = {
		1165	{BSL_ASN1_TAG_CONSTRUCTED \| BSL_ASN1_TAG_SEQUENCE, BSL_ASN1_FLAG_HEADERONLY, 0}, /* tbs */
		1166	};
		1167	BSL_ASN1_Template templ = {tbsTempl, sizeof(tbsTempl) / sizeof(tbsTempl[0])};
		1168	ret = BSL_ASN1_EncodeTemplate(&templ, &asnArr, 1, tobeSigned, tobeSignedLen);
		1169	BSL_SAL_Free(asnArr.buff);
		1170	return ret;
		1171	}
		1172
		1173	static int32_t X509_GetCrlTobeSignedData(HITLS_X509_Crl crl, uint8_t tobeSigned, uint32_t tobeSignedLen)
		1174	{
		1175	if (crl->tbs.tbsRawData != NULL) {
		1176	*tobeSigned = BSL_SAL_Dump(crl->tbs.tbsRawData, crl->tbs.tbsRawDataLen);
		1177	if (*tobeSigned == NULL) {
		1178	BSL_ERR_PUSH_ERROR(BSL_MALLOC_FAIL);
		1179	return BSL_MALLOC_FAIL;
		1180	}
		1181	*tobeSignedLen = crl->tbs.tbsRawDataLen;
		1182	return HITLS_X509_SUCCESS;
		1183	}
		1184
		1185	return HITLS_X509_EncodeCrlTbs(&crl->tbs, tobeSigned, tobeSignedLen);
		1186	}
		1187
		1188	int32_t HITLS_X509_CrlVerify(void pubkey, HITLS_X509_Crl crl)
		1189	{
		1190	if (pubkey == NULL \|\| crl == NULL) {
		1191	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_INVALID_PARAM);
		1192	return HITLS_X509_ERR_INVALID_PARAM;
		1193	}
		1194	int32_t ret = HITLS_X509_CheckAlg(pubkey, &(crl->signAlgId));
		1195	if (ret != HITLS_X509_SUCCESS) {
		1196	return ret;
		1197	}
		1198
		1199	uint8_t *tobeSigned = NULL;
		1200	uint32_t tobeSignedLen = 0;
		1201	ret = X509_GetCrlTobeSignedData(crl, &tobeSigned, &tobeSignedLen);
		1202	if (ret != HITLS_X509_SUCCESS) {
		1203	BSL_ERR_PUSH_ERROR(ret);
		1204	return ret;
		1205	}
		1206
		1207	ret = HITLS_X509_CheckSignature(pubkey, tobeSigned, tobeSignedLen, &(crl->signAlgId), &crl->signature);
		1208	BSL_SAL_Free(tobeSigned);
		1209	if (ret != CRYPT_SUCCESS) {
		1210	BSL_ERR_PUSH_ERROR(ret);
		1211	}
		1212	return ret;
		1213	}
		1214
		1215	HITLS_X509_CrlEntry *HITLS_X509_CrlRevokedNew(void)
		1216	{
		1217	HITLS_X509_CrlEntry *entry = BSL_SAL_Malloc(sizeof(HITLS_X509_CrlEntry));
		1218	if (entry == NULL) {
		1219	BSL_ERR_PUSH_ERROR(BSL_MALLOC_FAIL);
		1220	return NULL;
		1221	}
		1222
		1223	(void)memset_s(entry, sizeof(HITLS_X509_CrlEntry), 0, sizeof(HITLS_X509_CrlEntry));
		1224
		1225	entry->flag \|= HITLS_X509_CRL_GEN_FLAG;
		1226	return entry;
		1227	}
		1228
		1229	void HITLS_X509_CrlRevokedFree(HITLS_X509_CrlEntry *entry)
		1230	{
		1231	if (entry == NULL) {
		1232	return;
		1233	}
		1234	if (entry->flag & HITLS_X509_CRL_GEN_FLAG) {
		1235	BSL_SAL_Free(entry->serialNumber.buff);
		1236	BSL_LIST_FREE(entry->extList, (BSL_LIST_PFUNC_FREE)HITLS_X509_ExtEntryFree);
		1237	} else {
		1238	BSL_LIST_FREE(entry->extList, NULL);
		1239	}
		1240	BSL_SAL_Free(entry);
		1241	}
		1242
		1243	static int32_t X509_CrlGetRevokedRevokeTime(HITLS_X509_CrlEntry entry, void val, int32_t valLen)
		1244	{
		1245	if (valLen != sizeof(BSL_TIME)) {
		1246	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_INVALID_PARAM);
		1247	return HITLS_X509_ERR_INVALID_PARAM;
		1248	}
		1249	(BSL_TIME )val = entry->time;
		1250	return HITLS_X509_SUCCESS;
		1251	}
		1252
		1253	static int32_t X509_CrlSetRevokedExt(HITLS_X509_CrlEntry entry, BslCid cid, BSL_Buffer buff, uint32_t exceptLen,
		1254	EncodeExtCb encodeExt)
		1255	{
		1256	if (buff->dataLen != exceptLen) {
		1257	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_INVALID_PARAM);
		1258	return HITLS_X509_ERR_INVALID_PARAM;
		1259	}
		1260	if (entry->extList == NULL) {
		1261	entry->extList = BSL_LIST_New(sizeof(HITLS_X509_ExtEntry));
		1262	if (entry->extList == NULL) {
		1263	BSL_ERR_PUSH_ERROR(BSL_MALLOC_FAIL);
		1264	return BSL_MALLOC_FAIL;
		1265	}
		1266	}
		1267
		1268	return HITLS_X509_SetExtList(NULL, entry->extList, cid, buff, encodeExt);
		1269	}
		1270
		1271	static int32_t SetExtInvaildTime(void param, HITLS_X509_ExtEntry entry, const void *val)
		1272	{
		1273	(void)param;
		1274	const HITLS_X509_RevokeExtTime invaildTime = (const HITLS_X509_RevokeExtTime )val;
		1275	entry->critical = invaildTime->critical;
		1276	BSL_ASN1_Buffer asns = {0};
		1277	/**
		1278	* CRL issuers conforming to this profile MUST encode thisUpdate as UTCTime for dates through the year 2049.
		1279	* CRL issuers conforming to this profile MUST encode thisUpdate as GeneralizedTime for dates in the year
		1280	* 2050 or later.
		1281	*/
		1282	if (invaildTime->time.year >= 2050) {
		1283	asns.tag = BSL_ASN1_TAG_GENERALIZEDTIME;
		1284	} else {
		1285	asns.tag = BSL_ASN1_TAG_UTCTIME;
		1286	}
		1287	asns.len = sizeof(BSL_TIME);
		1288	asns.buff = (uint8_t *)&invaildTime->time;
		1289	BSL_ASN1_TemplateItem templItem = {BSL_ASN1_TAG_CHOICE, 0, 0};
		1290	BSL_ASN1_Template templ = {&templItem, 1};
		1291	int32_t ret = BSL_ASN1_EncodeTemplate(&templ, &asns, 1, &entry->extnValue.buff, &entry->extnValue.len);
		1292	if (ret != BSL_SUCCESS) {
		1293	BSL_ERR_PUSH_ERROR(ret);
		1294	}
		1295	return ret;
		1296	}
		1297
		1298	static int32_t SetExtReason(void param, HITLS_X509_ExtEntry extEntry, void *val)
		1299	{
		1300	(void)param;
		1301	HITLS_X509_RevokeExtReason reason = (HITLS_X509_RevokeExtReason )val;
		1302	if (reason->reason < HITLS_X509_REVOKED_REASON_UNSPECIFIED \|\|
		1303	reason->reason > HITLS_X509_REVOKED_REASON_AA_COMPROMISE) {
		1304	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_INVALID_PARAM);
		1305	return HITLS_X509_ERR_INVALID_PARAM;
		1306	}
		1307	extEntry->critical = reason->critical;
		1308	BSL_ASN1_Buffer asns = {BSL_ASN1_TAG_ENUMERATED, sizeof(int8_t), (uint8_t *)&reason->reason};
		1309	BSL_ASN1_TemplateItem items = {BSL_ASN1_TAG_ENUMERATED, 0, 0};
		1310	BSL_ASN1_Template reasonTempl = {&items, 1};
		1311
		1312	int32_t ret = BSL_ASN1_EncodeTemplate(&reasonTempl, &asns, 1, &extEntry->extnValue.buff, &extEntry->extnValue.len);
		1313	if (ret != BSL_SUCCESS) {
		1314	BSL_ERR_PUSH_ERROR(ret);
		1315	return ret;
		1316	}
		1317	return HITLS_X509_SUCCESS;
		1318	}
		1319
		1320	static int32_t SetExtCertIssuer(void param, HITLS_X509_ExtEntry extEntry, void *val)
		1321	{
		1322	(void)param;
		1323	HITLS_X509_RevokeExtCertIssuer certIssuer = (HITLS_X509_RevokeExtCertIssuer )val;
		1324	if (certIssuer->issuerName == NULL) {
		1325	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_INVALID_PARAM);
		1326	return HITLS_X509_ERR_INVALID_PARAM;
		1327	}
		1328	BSL_ASN1_Buffer name = {0};
		1329	int32_t ret = HITLS_X509_EncodeNameList(certIssuer->issuerName, &name);
		1330	if (ret != HITLS_X509_SUCCESS) {
		1331	BSL_ERR_PUSH_ERROR(ret);
		1332	return ret;
		1333	}
		1334	BSL_ASN1_TemplateItem item = {BSL_ASN1_TAG_CONSTRUCTED \| BSL_ASN1_TAG_SEQUENCE, 0, 0};
		1335	BSL_ASN1_Template templ = {&item, 1};
		1336	ret = BSL_ASN1_EncodeTemplate(&templ, &name, 1, &extEntry->extnValue.buff, &extEntry->extnValue.len);
		1337	BSL_SAL_Free(name.buff);
		1338	if (ret != BSL_SUCCESS) {
		1339	BSL_ERR_PUSH_ERROR(ret);
		1340	return ret;
		1341	}
		1342	return HITLS_X509_SUCCESS;
		1343	}
		1344
		1345	static int32_t DecodeExtInvaildTime(HITLS_X509_ExtEntry extEntry, void val)
		1346	{
		1347	uint8_t *temp = extEntry->extnValue.buff;
		1348	uint32_t tempLen = extEntry->extnValue.len;
		1349	BSL_ASN1_Buffer asn = {0};
		1350	BSL_ASN1_TemplateItem item = {BSL_ASN1_TAG_CHOICE, 0, 0};
		1351	BSL_ASN1_Template templ = {&item, 1};
		1352	int32_t ret = BSL_ASN1_DecodeTemplate(&templ, HITLS_X509_CrlEntryChoiceCheck,
		1353	&temp, &tempLen, &asn, 1);
		1354	if (ret != BSL_SUCCESS) {
		1355	BSL_ERR_PUSH_ERROR(ret);
		1356	return ret;
		1357	}
		1358	ret = BSL_ASN1_DecodePrimitiveItem(&asn, val);
		1359	if (ret != BSL_SUCCESS) {
		1360	BSL_ERR_PUSH_ERROR(ret);
		1361	return ret;
		1362	}
		1363
		1364	return HITLS_X509_SUCCESS;
		1365	}
		1366
		1367	static int32_t DecodeExtReason(HITLS_X509_ExtEntry extEntry, void val)
		1368	{
		1369	uint8_t *temp = extEntry->extnValue.buff;
		1370	uint32_t tempLen = extEntry->extnValue.len;
		1371	BSL_ASN1_Buffer asn = {0};
		1372	BSL_ASN1_TemplateItem item = {BSL_ASN1_TAG_ENUMERATED, 0, 0};
		1373	BSL_ASN1_Template templ = {&item, 1};
		1374	int32_t ret = BSL_ASN1_DecodeTemplate(&templ, HITLS_X509_CrlEntryChoiceCheck,
		1375	&temp, &tempLen, &asn, 1);
		1376	if (ret != BSL_SUCCESS) {
		1377	BSL_ERR_PUSH_ERROR(ret);
		1378	return ret;
		1379	}
		1380	ret = BSL_ASN1_DecodePrimitiveItem(&asn, val);
		1381	if (ret != BSL_SUCCESS) {
		1382	BSL_ERR_PUSH_ERROR(ret);
		1383	return ret;
		1384	}
		1385
		1386	return HITLS_X509_SUCCESS;
		1387	}
		1388
		1389	static int32_t DecodeExtCertIssuer(HITLS_X509_ExtEntry extEntry, BslList *val)
		1390	{
		1391	BslList *list = BSL_LIST_New(sizeof(HITLS_X509_GeneralName));
		1392	if (list == NULL) {
		1393	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_PARSE_AKI);
		1394	return HITLS_X509_ERR_PARSE_AKI;
		1395	}
		1396	int32_t ret = HITLS_X509_ParseGeneralNames(extEntry->extnValue.buff, extEntry->extnValue.len, list);
		1397	if (ret != HITLS_X509_SUCCESS) {
		1398	BSL_SAL_Free(list);
		1399	BSL_ERR_PUSH_ERROR(ret);
		1400	return ret;
		1401	}
		1402	*val = list;
		1403	return HITLS_X509_SUCCESS;
		1404	}
		1405
		1406	static int32_t RevokedSet(HITLS_X509_CrlEntry revoked, int32_t cmd, void val, int32_t valLen)
		1407	{
		1408	if (revoked->flag & HITLS_X509_CRL_PARSE_FLAG) {
		1409	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_EXT_SET_AFTER_PARSE);
		1410	return HITLS_X509_ERR_EXT_SET_AFTER_PARSE;
		1411	}
		1412	BSL_Buffer buff = {val, valLen};
737	switch (cmd) {	1413	switch (cmd) {
738	case HITLS_X509_CRL_REF_UP:	1414	case HITLS_X509_CRL_SET_REVOKED_SERIALNUM:
739	return X509_CrlRefUp(crl, val, valLen);	1415	return HITLS_X509_SetSerial(&revoked->serialNumber, val, valLen);
		1416	case HITLS_X509_CRL_SET_REVOKED_REVOKE_TIME:
		1417	return CrlSetTime(&revoked->time, val, valLen);
		1418	case HITLS_X509_CRL_SET_REVOKED_INVAILD_TIME:
		1419	return X509_CrlSetRevokedExt(revoked, BSL_CID_CE_INVALIDITYDATE, &buff, sizeof(HITLS_X509_RevokeExtTime),
		1420	(EncodeExtCb)SetExtInvaildTime);
		1421	case HITLS_X509_CRL_SET_REVOKED_REASON:
		1422	return X509_CrlSetRevokedExt(revoked, BSL_CID_CE_CRLREASON, &buff, sizeof(HITLS_X509_RevokeExtReason),
		1423	(EncodeExtCb)SetExtReason);
		1424	case HITLS_X509_CRL_SET_REVOKED_CERTISSUER:
		1425	return X509_CrlSetRevokedExt(revoked, BSL_CID_CE_CERTIFICATEISSUER, &buff,
		1426	sizeof(HITLS_X509_RevokeExtCertIssuer), (EncodeExtCb)SetExtCertIssuer);
740	default:	1427	default:
741	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_INVALID_PARAM);	1428	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_INVALID_PARAM);
742	return HITLS_X509_ERR_INVALID_PARAM;	1429	return HITLS_X509_ERR_INVALID_PARAM;
743	}	1430	}
744	}	1431	}
		1432
		1433	static int32_t RevokedGet(HITLS_X509_CrlEntry revoked, int32_t cmd, void val, int32_t valLen)
		1434	{
		1435	BSL_Buffer buff = {val, valLen};
		1436	switch (cmd) {
		1437	case HITLS_X509_CRL_GET_REVOKED_REVOKE_TIME:
		1438	return X509_CrlGetRevokedRevokeTime(revoked, val, valLen);
		1439	case HITLS_X509_CRL_GET_REVOKED_SERIALNUM:
		1440	return HITLS_X509_GetSerial(&revoked->serialNumber, val, valLen);
		1441	case HITLS_X509_CRL_GET_REVOKED_INVAILD_TIME:
		1442	return HITLS_X509_GetExt(revoked->extList, BSL_CID_CE_INVALIDITYDATE, &buff, sizeof(BSL_TIME),
		1443	(DecodeExtCb)DecodeExtInvaildTime);
		1444	case HITLS_X509_CRL_GET_REVOKED_REASON:
		1445	return HITLS_X509_GetExt(revoked->extList, BSL_CID_CE_CRLREASON, &buff, sizeof(int32_t),
		1446	(DecodeExtCb)DecodeExtReason);
		1447	case HITLS_X509_CRL_GET_REVOKED_CERTISSUER:
		1448	return HITLS_X509_GetExt(revoked->extList, BSL_CID_CE_CERTIFICATEISSUER, &buff, sizeof(BslList *),
		1449	(DecodeExtCb)DecodeExtCertIssuer);
		1450	default:
		1451	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_INVALID_PARAM);
		1452	return HITLS_X509_ERR_INVALID_PARAM;
		1453	}
		1454	}
		1455
		1456	int32_t HITLS_X509_CrlRevokedCtrl(HITLS_X509_CrlEntry revoked, int32_t cmd, void val, int32_t valLen)
		1457	{
		1458	if (revoked == NULL \|\| val == NULL) {
		1459	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_INVALID_PARAM);
		1460	return HITLS_X509_ERR_INVALID_PARAM;
		1461	}
		1462	if (cmd < HITLS_X509_CRL_GET_REVOKED_SERIALNUM) {
		1463	return RevokedSet(revoked, cmd, val, valLen);
		1464	} else {
		1465	return RevokedGet(revoked, cmd, val, valLen);
		1466	}
		1467	}
		1468
		1469	int32_t HITLS_X509_CrlSign(uint32_t mdId, CRYPT_EAL_PkeyCtx pivKey, const HITLS_X509_SignAlgParam algParam,
		1470	HITLS_X509_Crl *crl)
		1471	{
		1472	CRYPT_EAL_PkeyCtx *signKey = pivKey;
		1473	CRYPT_EAL_PkeyCtx *tmp = NULL;
		1474	BSL_Buffer tbsRaw = {0};
		1475	BSL_ASN1_Buffer tobeSigned = {0};
		1476	uint32_t ret;
		1477	if (pivKey == NULL \|\| crl == NULL \|\| (crl->flag & HITLS_X509_CRL_PARSE_FLAG)) {
		1478	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_INVALID_PARAM);
		1479	return HITLS_X509_ERR_INVALID_PARAM;
		1480	}
		1481	if (!X509_IsValidHashAlg(mdId)) {
		1482	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_INVALID_PARAM);
		1483	return HITLS_X509_ERR_INVALID_PARAM;
		1484	}
		1485	if (algParam != NULL) {
		1486	tmp = CRYPT_EAL_PkeyDupCtx(pivKey);
		1487	if (tmp == NULL) {
		1488	BSL_ERR_PUSH_ERROR(HITLS_X509_ERR_VFY_DUP_PUBKEY);
		1489	return HITLS_X509_ERR_VFY_DUP_PUBKEY;
		1490	}
		1491	signKey = tmp;
		1492	ret = X509_SetSignAlgParm(signKey, algParam);
		1493	if (ret != HITLS_X509_SUCCESS) {
		1494	goto ERR;
		1495	}
		1496	}
		1497	ret = HITLS_X509_SetSignAlgInfo(signKey, mdId, &crl->signAlgId);
		1498	if (ret != HITLS_X509_SUCCESS) {
		1499	goto ERR;
		1500	}
		1501	ret = HITLS_X509_SetSignAlgInfo(signKey, mdId, &crl->tbs.signAlgId);
		1502	if (ret != HITLS_X509_SUCCESS) {
		1503	goto ERR;
		1504	}
		1505	ret = X509_CheckCrlTbs(crl);
		1506	if (ret != HITLS_X509_SUCCESS) {
		1507	goto ERR;
		1508	}
		1509	ret = HITLS_X509_EncodeCrlTbsRaw(&crl->tbs, &tobeSigned);
		1510	if (ret != HITLS_X509_SUCCESS) {
		1511	goto ERR;
		1512	}
		1513	ret = HITLS_X509_SignAsn1Data(signKey, mdId, &tobeSigned, &tbsRaw, &crl->signature);
		1514	if (ret != HITLS_X509_SUCCESS) {
		1515	goto ERR;
		1516	}
		1517	crl->tbs.tbsRawData = tbsRaw.data;
		1518	crl->tbs.tbsRawDataLen = tbsRaw.dataLen;
		1519	ERR:
		1520	if (ret != HITLS_X509_SUCCESS) {
		1521	BSL_ERR_PUSH_ERROR(ret);
		1522	}
		1523	CRYPT_EAL_PkeyFreeCtx(tmp);
		1524	BSL_SAL_Free(tobeSigned.buff);
		1525	return ret;
		1526	}

Mx509/x509_csr/src/hitls_x509_csr.c+8-10

	@@ -244,18 +244,16 @@ ERR:
244	return ret;	244	return ret;
245	}	245	}
246		246
247	static int32_t X509CsrAsn1Parse(bool isCopy, BSL_Buffer encode, HITLS_X509_Csr csr)	247	static int32_t X509CsrAsn1Parse(BSL_Buffer encode, HITLS_X509_Csr csr)
248	{	248	{
249	uint8_t *data = encode->data;	249	uint8_t *data = encode->data;
250	uint32_t dataLen = encode->dataLen;	250	uint32_t dataLen = encode->dataLen;
251	BSL_Buffer asn1Buff = {data, dataLen};	251	BSL_Buffer asn1Buff = {data, dataLen};
252	if (isCopy) {	252	csr->flag = HITLS_X509_CSR_PARSE_FLAG;
253	csr->flag = HITLS_X509_CSR_PARSE_FLAG;	253	asn1Buff.data = (uint8_t *)BSL_SAL_Dump(data, dataLen);
254	asn1Buff.data = (uint8_t *)BSL_SAL_Dump(data, dataLen);	254	if (asn1Buff.data == NULL) {
255	if (asn1Buff.data == NULL) {	255	BSL_ERR_PUSH_ERROR(BSL_DUMP_FAIL);
256	BSL_ERR_PUSH_ERROR(BSL_DUMP_FAIL);	256	return BSL_DUMP_FAIL;
257	return BSL_DUMP_FAIL;
258	}
259	}	257	}
260	int32_t ret = X509CsrBuffAsn1Parse(&asn1Buff.data, &asn1Buff.dataLen, csr);	258	int32_t ret = X509CsrBuffAsn1Parse(&asn1Buff.data, &asn1Buff.dataLen, csr);
261	if (ret != HITLS_X509_SUCCESS) {	259	if (ret != HITLS_X509_SUCCESS) {
	@@ -276,7 +274,7 @@ static int32_t X509CsrPemParse(BSL_Buffer encode, HITLS_X509_Csr csr)
276	BSL_ERR_PUSH_ERROR(ret);	274	BSL_ERR_PUSH_ERROR(ret);
277	return ret;	275	return ret;
278	}	276	}
279	ret = X509CsrAsn1Parse(true, &asn1Buf, csr);	277	ret = X509CsrAsn1Parse(&asn1Buf, csr);
280	BSL_SAL_FREE(asn1Buf.data);	278	BSL_SAL_FREE(asn1Buf.data);
281	if (ret != HITLS_X509_SUCCESS) {	279	if (ret != HITLS_X509_SUCCESS) {
282	BSL_ERR_PUSH_ERROR(ret);	280	BSL_ERR_PUSH_ERROR(ret);
	@@ -299,7 +297,7 @@ int32_t HITLS_X509_CsrParseBuff(int32_t format, BSL_Buffer *encode, HITLS_X509_C
299	}	297	}
300	switch (format) {	298	switch (format) {
301	case BSL_FORMAT_ASN1:	299	case BSL_FORMAT_ASN1:
302	ret = X509CsrAsn1Parse(true, encode, tempCsr);	300	ret = X509CsrAsn1Parse(encode, tempCsr);
303	break;	301	break;
304	case BSL_FORMAT_PEM:	302	case BSL_FORMAT_PEM:
305	ret = X509CsrPemParse(encode, tempCsr);	303	ret = X509CsrPemParse(encode, tempCsr);

Mx509/x509_verify/include/hitls_x509_verify.h+1-1

	@@ -51,7 +51,7 @@ int32_t HITLS_X509_VerifyParamAndExt(HITLS_X509_StoreCtx *storeCtx, HITLS_X509_L
51	* Verify the CRL, which is the default full certificate chain validation.	51	* Verify the CRL, which is the default full certificate chain validation.
52	* You can configure not to verify or only verify the terminal certificate	52	* You can configure not to verify or only verify the terminal certificate
53	*/	53	*/
54	int32_t HITLS_X509_CrlVerify(HITLS_X509_StoreCtx storeCtx, HITLS_X509_List chain);	54	int32_t HITLS_X509_VerifyCrl(HITLS_X509_StoreCtx storeCtx, HITLS_X509_List chain);
55		55
56	#ifdef __cplusplus	56	#ifdef __cplusplus
57	}	57	}

Mx509/x509_verify/src/hitls_x509_verify.c+22-12

	@@ -279,7 +279,7 @@ static int32_t X509_SetCRL(HITLS_X509_StoreCtx storeCtx, void val, int32_t val
279	return ret;	279	return ret;
280	}	280	}
281	int ref;	281	int ref;
282	ret = HITLS_X509_CrlCtrl(val, HITLS_X509_CRL_REF_UP, &ref, sizeof(int));	282	ret = HITLS_X509_CrlCtrl(val, HITLS_X509_REF_UP, &ref, sizeof(int));
283	if (ret != HITLS_SUCCESS) {	283	if (ret != HITLS_SUCCESS) {
284	return ret;	284	return ret;
285	}	285	}
	@@ -410,8 +410,8 @@ int32_t X509_GetIssueFromChain(HITLS_X509_List certChain, HITLS_X509_Cert cert
410	return HITLS_X509_ERR_ISSUE_CERT_NOT_FOUND;	410	return HITLS_X509_ERR_ISSUE_CERT_NOT_FOUND;
411	}	411	}
412		412
413	int32_t X509_FindIssueCert(HITLS_X509_StoreCtx storeCtx, HITLS_X509_List certChain, HITLS_X509_Cert cert, HITLS_X509_Cert *issue,	413	int32_t X509_FindIssueCert(HITLS_X509_StoreCtx storeCtx, HITLS_X509_List certChain, HITLS_X509_Cert *cert,
414	bool *issueInTrust)	414	HITLS_X509_Cert *issue, bool issueInTrust)
415	{	415	{
416	HITLS_X509_List *store = storeCtx->store;	416	HITLS_X509_List *store = storeCtx->store;
417	int32_t ret = X509_GetIssueFromChain(store, cert, issue);	417	int32_t ret = X509_GetIssueFromChain(store, cert, issue);
	@@ -430,7 +430,8 @@ int32_t X509_FindIssueCert(HITLS_X509_StoreCtx storeCtx, HITLS_X509_List certC
430	return ret;	430	return ret;
431	}	431	}
432		432
433	int32_t X509_BuildChain(HITLS_X509_StoreCtx storeCtx, HITLS_X509_List certChain, HITLS_X509_Cert cert, HITLS_X509_List chain, HITLS_X509_Cert **root)	433	int32_t X509_BuildChain(HITLS_X509_StoreCtx storeCtx, HITLS_X509_List certChain, HITLS_X509_Cert *cert,
		434	HITLS_X509_List chain, HITLS_X509_Cert *root)
434	{	435	{
435	HITLS_X509_Cert *cur = cert;	436	HITLS_X509_Cert *cur = cert;
436	int32_t ret;	437	int32_t ret;
	@@ -577,7 +578,7 @@ static int32_t HITLS_X509_CheckCertExt(void ctx, HITLS_X509_Cert cert)
577	if (cert->tbs.version != 2) { // no ext v1 cert	578	if (cert->tbs.version != 2) { // no ext v1 cert
578	return HITLS_X509_SUCCESS;	579	return HITLS_X509_SUCCESS;
579	}	580	}
580	return HITLS_X509_TrvList(cert->tbs.ext.list,	581	return HITLS_X509_TrvList(cert->tbs.ext.extList,
581	(HITLS_X509_TrvListCallBack)HITLS_X509_CheckCertExtNode, NULL);	582	(HITLS_X509_TrvListCallBack)HITLS_X509_CheckCertExtNode, NULL);
582	}	583	}
583		584
	@@ -608,8 +609,9 @@ int32_t HITLS_X509_CheckCertCrl(HITLS_X509_StoreCtx storeCtx, HITLS_X509_Cert
608	{	609	{
609	int32_t ret = HITLS_X509_ERR_CRL_NOT_FOUND;	610	int32_t ret = HITLS_X509_ERR_CRL_NOT_FOUND;
610	HITLS_X509_Crl *crl = BSL_LIST_GET_FIRST(storeCtx->crl);	611	HITLS_X509_Crl *crl = BSL_LIST_GET_FIRST(storeCtx->crl);
611	if (parent->tbs.ext.extFlags & HITLS_X509_EXT_FLAG_KUSAGE) {	612	HITLS_X509_CertExt certExt = (HITLS_X509_CertExt )parent->tbs.ext.extData;
612	if (!(parent->tbs.ext.keyUsage & HITLS_X509_EXT_KU_CRL_SIGN)) {	613	if (certExt->extFlags & HITLS_X509_EXT_FLAG_KUSAGE) {
		614	if (!(certExt->keyUsage & HITLS_X509_EXT_KU_CRL_SIGN)) {
613	return HITLS_X509_ERR_VFY_KU_NO_CRLSIGN;	615	return HITLS_X509_ERR_VFY_KU_NO_CRLSIGN;
614	}	616	}
615	}	617	}
	@@ -618,7 +620,13 @@ int32_t HITLS_X509_CheckCertCrl(HITLS_X509_StoreCtx storeCtx, HITLS_X509_Cert
618	crl = BSL_LIST_GET_NEXT(storeCtx->crl);	620	crl = BSL_LIST_GET_NEXT(storeCtx->crl);
619	continue;	621	continue;
620	}	622	}
621		623	if (cert->tbs.version == HITLS_CERT_VERSION_3 && crl->tbs.version == 1) {
		624	if (HITLS_X509_CheckAki(&parent->tbs.ext, &crl->tbs.crlExt, parent->tbs.subjectName, &parent->tbs.serialNum)
		625	!= HITLS_X509_SUCCESS) {
		626	crl = BSL_LIST_GET_NEXT(storeCtx->crl);
		627	continue;
		628	}
		629	}
622	if (HITLS_X509_CheckTime(storeCtx, &(crl->tbs.validTime)) != HITLS_X509_SUCCESS) {	630	if (HITLS_X509_CheckTime(storeCtx, &(crl->tbs.validTime)) != HITLS_X509_SUCCESS) {
623	crl = BSL_LIST_GET_NEXT(storeCtx->crl);	631	crl = BSL_LIST_GET_NEXT(storeCtx->crl);
624	continue;	632	continue;
	@@ -646,7 +654,7 @@ int32_t HITLS_X509_CheckCertCrl(HITLS_X509_StoreCtx storeCtx, HITLS_X509_Cert
646	return ret;	654	return ret;
647	}	655	}
648		656
649	int32_t HITLS_X509_CrlVerify(HITLS_X509_StoreCtx storeCtx, HITLS_X509_List chain)	657	int32_t HITLS_X509_VerifyCrl(HITLS_X509_StoreCtx storeCtx, HITLS_X509_List chain)
650	{	658	{
651	// Only the self-signed certificate, and the CRL is not verified	659	// Only the self-signed certificate, and the CRL is not verified
652	if (BSL_LIST_COUNT(chain) == 1) {	660	if (BSL_LIST_COUNT(chain) == 1) {
	@@ -680,7 +688,8 @@ int32_t X509_VerifyChainCert(HITLS_X509_StoreCtx storeCtx, HITLS_X509_List cha
680	return ret;	688	return ret;
681	}	689	}
682	}	690	}
683	ret = HITLS_X509_CheckSignature(issue->tbs.ealPubKey, cur->tbs.tbsRawData, cur->tbs.tbsRawDataLen, &cur->signAlgId, &cur->signature);	691	ret = HITLS_X509_CheckSignature(issue->tbs.ealPubKey, cur->tbs.tbsRawData, cur->tbs.tbsRawDataLen,
		692	&cur->signAlgId, &cur->signature);
684	if (ret != HITLS_X509_SUCCESS) {	693	if (ret != HITLS_X509_SUCCESS) {
685	return ret;	694	return ret;
686	}	695	}
	@@ -690,7 +699,8 @@ int32_t X509_VerifyChainCert(HITLS_X509_StoreCtx storeCtx, HITLS_X509_List cha
690	return HITLS_X509_SUCCESS;	699	return HITLS_X509_SUCCESS;
691	}	700	}
692		701
693	static int32_t X509_GetVerifyCertChain(HITLS_X509_StoreCtx storeCtx, HITLS_X509_List chain, HITLS_X509_List **comChain)	702	static int32_t X509_GetVerifyCertChain(HITLS_X509_StoreCtx storeCtx, HITLS_X509_List chain,
		703	HITLS_X509_List **comChain)
694	{	704	{
695	HITLS_X509_Cert *cert = BSL_LIST_GET_FIRST(chain);	705	HITLS_X509_Cert *cert = BSL_LIST_GET_FIRST(chain);
696	if (cert == NULL) {	706	if (cert == NULL) {
	@@ -745,7 +755,7 @@ int32_t HITLS_X509_CertVerify(HITLS_X509_StoreCtx storeCtx, HITLS_X509_List ch
745	BSL_LIST_FREE(tmpChain, (BSL_LIST_PFUNC_FREE)HITLS_X509_CertFree);	755	BSL_LIST_FREE(tmpChain, (BSL_LIST_PFUNC_FREE)HITLS_X509_CertFree);
746	return ret;	756	return ret;
747	}	757	}
748	ret = HITLS_X509_CrlVerify(storeCtx, tmpChain);	758	ret = HITLS_X509_VerifyCrl(storeCtx, tmpChain);
749	if (ret != HITLS_X509_SUCCESS) {	759	if (ret != HITLS_X509_SUCCESS) {
750	BSL_LIST_FREE(tmpChain, (BSL_LIST_PFUNC_FREE)HITLS_X509_CertFree);	760	BSL_LIST_FREE(tmpChain, (BSL_LIST_PFUNC_FREE)HITLS_X509_CertFree);
751	return ret;	761	return ret;