fix:CRL revocation support configuration-openHiTLS-AtomGit

Minclude/tls/hitls_cert.h+25-0

	@@ -894,6 +894,20 @@ HITLS_KeyLogCb HITLS_CFG_GetKeyLogCb(HITLS_Config *config);
894	*/	894	*/
895	int32_t HITLS_LogSecret(HITLS_Ctx ctx, const char label, const uint8_t *secret, size_t secretLen);	895	int32_t HITLS_LogSecret(HITLS_Ctx ctx, const char label, const uint8_t *secret, size_t secretLen);
896		896
		897	+/**
		898	+ * @ingroup hitls_cert
		899	+ * @brief Set certificate verification parameters.
		900	+ * @param config [OUT] TLS link configuration
		901	+ * @param store [IN] Certificate store
		902	+ * @param cmd [IN] Operation command, HITLS_CERT_CtrlCmd enum
		903	+ * @param in [IN] Input parameter, integer type
		904	+ * @param inArg [IN] Input parameter, pointer type
		905	+ * @retval HITLS_SUCCESS, if successful.
		906	+ * @retval For other error codes, see hitls_error.h.
		907	+ */
		908	+int32_t HITLS_CFG_CtrlSetVerifyParams(
		909	+ HITLS_Config config, HITLS_CERT_Store store, uint32_t cmd, int64_t in, void *inArg);
		910	+
897	/**	911	/**
898	* @ingroup hitls_cert	912	* @ingroup hitls_cert
899	* @brief Load CRL from file and add it into the verify store of the TLS configuration.	913	* @brief Load CRL from file and add it into the verify store of the TLS configuration.
	@@ -929,6 +943,17 @@ int32_t HITLS_CFG_LoadCrlBuffer(HITLS_Config config, const uint8_t buf, uint32
929	*/	943	*/
930	int32_t HITLS_CFG_ClearVerifyCrls(HITLS_Config *config);	944	int32_t HITLS_CFG_ClearVerifyCrls(HITLS_Config *config);
931		945
		946	+/**
		947	+ * @ingroup hitls_cert
		948	+ * @brief Set the certificate verification flags.
		949	+ *
		950	+ * @param config [OUT] TLS link configuration
		951	+ * @param verifyFlags [IN] Verification flags, type: uint32_t
		952	+ * @retval HITLS_SUCCESS, if successful.
		953	+ * @retval For other error codes, see hitls_error.h.
		954	+ */
		955	+#define HITLS_CFG_SetVerifyFlags(config, verifyFlags) \
		956	+ HITLS_CFG_CtrlSetVerifyParams(config, NULL, CERT_STORE_CTRL_SET_VERIFY_FLAGS, verifyFlags, NULL)
932	/**	957	/**
933	* @ingroup hitls_cert	958	* @ingroup hitls_cert
934	* @brief Load CRL from file and add it into the verify store of the TLS context.	959	* @brief Load CRL from file and add it into the verify store of the TLS context.

Minclude/tls/hitls_cert_type.h+2-1

	@@ -86,7 +86,8 @@ typedef enum {
86	CERT_STORE_CTRL_SET_VERIFY_DEPTH = 0, /*< Set the certificate verification depth. /	86	CERT_STORE_CTRL_SET_VERIFY_DEPTH = 0, /*< Set the certificate verification depth. /
87	CERT_STORE_CTRL_ADD_CERT_LIST, /*< Add ca and chain certificate to store /	87	CERT_STORE_CTRL_ADD_CERT_LIST, /*< Add ca and chain certificate to store /
88	CERT_STORE_CTRL_ADD_CRL_LIST, /*< Add CRL list to store /	88	CERT_STORE_CTRL_ADD_CRL_LIST, /*< Add CRL list to store /
89	- CERT_STORE_CTRL_CLEAR_CRL_LIST ,/*< clear all CRL list /	89	+ CERT_STORE_CTRL_CLEAR_CRL_LIST, /*< clear all CRL list /
		90	+ CERT_STORE_CTRL_SET_VERIFY_FLAGS, /*< Set the certificate verification flags. /
90	CERT_STORE_CTRL_ADD_CA_PATH, /*< Set the CA path. /	91	CERT_STORE_CTRL_ADD_CA_PATH, /*< Set the CA path. /
91		92
92	CERT_CTRL_GET_ENCODE_LEN = 200, /*< Obtain the length of the certificate code. /	93	CERT_CTRL_GET_ENCODE_LEN = 200, /*< Obtain the length of the certificate code. /

Mtestcode/sdv/testcase/tls/interface_tlcp/test_suite_sdv_frame_cert_interface.c+5-1

	@@ -40,6 +40,7 @@
40	#include "hitls_crypt_reg.h"	40	#include "hitls_crypt_reg.h"
41	#include "hitls_crypt_init.h"	41	#include "hitls_crypt_init.h"
42	#include "uio_base.h"	42	#include "uio_base.h"
		43	+#include "hitls_pki_types.h"
43	/* END_HEADER */	44	/* END_HEADER */
44		45
45	#define BUF_MAX_SIZE 4096	46	#define BUF_MAX_SIZE 4096
	@@ -1086,11 +1087,14 @@ void UT_TLS_CRL_VERIFICATION_HANDSHAKE_TC001(void)
1086	ASSERT_TRUE(server != NULL);	1087	ASSERT_TRUE(server != NULL);
1087		1088
1088	ASSERT_EQ(HITLS_CFG_LoadCrlFile(config, crlPath, TLS_PARSE_FORMAT_ASN1), HITLS_SUCCESS);	1089	ASSERT_EQ(HITLS_CFG_LoadCrlFile(config, crlPath, TLS_PARSE_FORMAT_ASN1), HITLS_SUCCESS);
1089	-
1090	client = FRAME_CreateLinkBase(config, BSL_UIO_TCP, false);	1090	client = FRAME_CreateLinkBase(config, BSL_UIO_TCP, false);
1091	ASSERT_TRUE(client != NULL);	1091	ASSERT_TRUE(client != NULL);
		1092	+ HITLS_CFG_SetVerifyFlags(config, HITLS_X509_VFY_FLAG_CRL_DEV);
1092		1093
1093	ASSERT_NE(FRAME_CreateConnection(client, server, true, HS_STATE_BUTT), HITLS_SUCCESS);	1094	ASSERT_NE(FRAME_CreateConnection(client, server, true, HS_STATE_BUTT), HITLS_SUCCESS);
		1095	+ HITLS_ERROR ret;
		1096	+ HITLS_GetVerifyResult(client->ssl, &ret);
		1097	+ ASSERT_EQ(ret, HITLS_X509_ERR_VFY_CERT_REVOKED);
1094	EXIT:	1098	EXIT:
1095	HITLS_CFG_FreeConfig(config);	1099	HITLS_CFG_FreeConfig(config);
1096	FRAME_FreeLink(client);	1100	FRAME_FreeLink(client);

Mtestcode/testdata/tls/certificate/der/ed25519/ed25519.crl.der+0-0

Binary files do not support preview

Mtls/cert/cert_adapt/cert_mgr_ctrl.c+21-0

	@@ -497,4 +497,25 @@ HITLS_VerifyCb SAL_CERT_GetVerifyCb(CERT_MgrCtx *mgrCtx)
497	return NULL;	497	return NULL;
498	}	498	}
499	return mgrCtx->verifyCb;	499	return mgrCtx->verifyCb;
		500	+}
		501	+
		502	+int32_t SAL_CERT_CtrlVerifyParams(HITLS_Config config, HITLS_CERT_Store store, uint32_t cmd, void in, void out)
		503	+{
		504	+ CERT_MgrCtx *mgrCtx = config->certMgrCtx;
		505	+ if (mgrCtx == NULL) {
		506	+ BSL_ERR_PUSH_ERROR(HITLS_NULL_INPUT);
		507	+ return HITLS_NULL_INPUT;
		508	+ }
		509	+ HITLS_CERT_Store *tempStore = store;
		510	+ if (tempStore == NULL) {
		511	+ tempStore = (mgrCtx->verifyStore != NULL) ? mgrCtx->verifyStore : mgrCtx->certStore;
		512	+ if (tempStore == NULL) {
		513	+ return RETURN_ERROR_NUMBER_PROCESS(HITLS_NULL_INPUT, BINLOG_ID15327, "store is null");
		514	+ }
		515	+ }
		516	+ int32_t ret = SAL_CERT_StoreCtrl(config, tempStore, cmd, in, out);
		517	+ if (ret != HITLS_SUCCESS) {
		518	+ return RETURN_ERROR_NUMBER_PROCESS(ret, BINLOG_ID15326, "SAL_CERT_StoreCtrl fail");
		519	+ }
		520	+ return HITLS_SUCCESS;
500	}	521	}

Mtls/cert/hitls_x509_adapt/hitls_x509_cert_store.c+4-2

	@@ -74,13 +74,15 @@ int32_t HITLS_X509_Adapt_StoreCtrl(HITLS_Config config, HITLS_CERT_Store store
74	}	74	}
75	tempCrl = (HITLS_X509_Crl *)BSL_LIST_GET_NEXT(crlList);	75	tempCrl = (HITLS_X509_Crl *)BSL_LIST_GET_NEXT(crlList);
76	}	76	}
77	- int64_t setFlag = HITLS_X509_VFY_FLAG_CRL_ALL;	77	+ return HITLS_SUCCESS;
78	- return HITLS_X509_StoreCtxCtrl(store, HITLS_X509_STORECTX_SET_PARAM_FLAGS, &setFlag, sizeof(int64_t));
79	}	78	}
80	case CERT_STORE_CTRL_CLEAR_CRL_LIST:	79	case CERT_STORE_CTRL_CLEAR_CRL_LIST:
81	return HITLS_X509_StoreCtxCtrl(store, HITLS_X509_STORECTX_CLEAR_CRL, NULL, 0);	80	return HITLS_X509_StoreCtxCtrl(store, HITLS_X509_STORECTX_CLEAR_CRL, NULL, 0);
82	case CERT_STORE_CTRL_ADD_CA_PATH:	81	case CERT_STORE_CTRL_ADD_CA_PATH:
83	return HITLS_X509_StoreCtxCtrl(store, HITLS_X509_STORECTX_ADD_CA_PATH, input, strlen(input));	82	return HITLS_X509_StoreCtxCtrl(store, HITLS_X509_STORECTX_ADD_CA_PATH, input, strlen(input));
		83	+ case CERT_STORE_CTRL_SET_VERIFY_FLAGS:
		84	+ return HITLS_X509_StoreCtxCtrl(store, HITLS_X509_STORECTX_SET_PARAM_FLAGS,
		85	+ (int64_t *)input, sizeof(uint64_t));
84	default:	86	default:
85	return HITLS_CERT_SELF_ADAPT_ERR;	87	return HITLS_CERT_SELF_ADAPT_ERR;
86	}	88	}

Mtls/cert/include/cert_mgr.h+13-0

	@@ -284,6 +284,19 @@ HITLS_CERT_Chain SAL_CERT_GetExtraChainCerts(CERT_MgrCtx mgrCtx);
284		284
285	void SAL_CERT_ClearExtraChainCerts(CERT_MgrCtx *mgrCtx);	285	void SAL_CERT_ClearExtraChainCerts(CERT_MgrCtx *mgrCtx);
286		286
		287	+/**
		288	+ * @brief Set or get certificate verification parameters.
		289	+ *
		290	+ * @param config [IN] TLS link configuration
		291	+ * @param store [IN] Certificate store
		292	+ * @param cmd [IN] Operation command, HITLS_CERT_CtrlCmd enum
		293	+ * @param in [IN] Input parameter
		294	+ * @param out [OUT] Output parameter
		295	+ *
		296	+ * @retval HITLS_SUCCESS succeeded.
		297	+ */
		298	+int32_t SAL_CERT_CtrlVerifyParams(HITLS_Config config, HITLS_CERT_Store store, uint32_t cmd, void in, void out);
		299	+
287	/**	300	/**
288	* @brief Set the verification depth	301	* @brief Set the verification depth
289	*	302	*

Mtls/config/src/config_cert.c+12-0

	@@ -891,6 +891,18 @@ int32_t HITLS_CFG_FreeKey(HITLS_Config config, HITLS_CERT_Key key)
891	return HITLS_SUCCESS;	891	return HITLS_SUCCESS;
892	}	892	}
893		893
		894	+int32_t HITLS_CFG_CtrlSetVerifyParams(
		895	+ HITLS_Config config, HITLS_CERT_Store store, uint32_t cmd, int64_t in, void *inArg)
		896	+{
		897	+ if (config == NULL) {
		898	+ return HITLS_NULL_INPUT;
		899	+ }
		900	+ if (inArg == NULL) {
		901	+ return SAL_CERT_CtrlVerifyParams(config, store, cmd, &in, NULL);
		902	+ }
		903	+ return SAL_CERT_CtrlVerifyParams(config, store, cmd, inArg, NULL);
		904	+}
		905	+
894	static int32_t LoadVerifyDirAddPath(HITLS_Config config, HITLS_CERT_Store store,	906	static int32_t LoadVerifyDirAddPath(HITLS_Config config, HITLS_CERT_Store store,
895	const char *start, size_t len)	907	const char *start, size_t len)
896	{	908	{