GnuTLS: CRL revocation

#include <gnutls/gnutls.h>
#include <gnutls/x509.h>

/* Retrieve the entire chain of certificates stored in array of gnutls_datum_t structures */
/* Each certificate is stored in DER format */
/* Leaf node certificate is placed at index 0, its issuer at index 1, etc. */
unsigned int server_chain_size = 0;
const gnutls_datum_t *server_chain_der = gnutls_certificate_get_peers(session, &server_chain_size);
if (server_chain_der == NULL) {
    exit(EXIT_FAILURE);
}

/* Convert the certificate array of gnutls_datum_t structures to certificate array of gnutls_crt_t structures */
gnutls_x509_crt_t *server_chain_crt = gnutls_calloc(server_chain_size, sizeof(gnutls_x509_crt_t));
if (server_chain_crt == NULL) {
    exit(EXIT_FAILURE);
}

for (int i=0; i < server_chain_size; i++) {
    if (gnutls_x509_crt_init(&server_chain_crt[i]) < 0) {
        exit(EXIT_FAILURE);
    }
    if (gnutls_x509_crt_import(server_chain_crt[i], &server_chain_der[i], GNUTLS_X509_FMT_DER) < 0) {
        exit(EXIT_FAILURE);
    }
}

/* For example, get the leaf server's certificate from the chain */
gnutls_x509_crt_t server_certificate = server_chain_crt[0];

/* Print the server's certificate to stdout */
gnutls_datum_t server_cert_pretty;
gnutls_x509_crt_print(server_chain_crt[0], GNUTLS_CRT_PRINT_ONELINE, &server_cert_pretty);
printf("%s\n", server_cert_pretty.data);
gnutls_free(server_cert_pretty.data);

/* Trusted list is in GnuTls represented with the gnutls_x509_trust_list_t structure */
gnutls_x509_trust_list_t trusted_list;
gnutls_x509_trust_list_init(&trusted_list, 0);

/* Add the system's default trusted certificate authorities to the trusted list. */
/* Function returns number of added elements or negative error code on failure. */
if (gnutls_x509_trust_list_add_system_trust(trusted_list, 0, 0) <= 0) {
    exit(EXIT_FAILURE);
}

gnutls_x509_crt_t certificate;
gnutls_x509_crt_t issuer_certificate

for (int index = 0; index < server_chain_size - 1; index++) {
    certificate = server_chain_crt[index];
    issuer_certificate = server_chain_crt[index + 1];

    download_crls_single_certificate(trusted_list, certificate, issuer_certificate);
}

#include <curl/curl.h>

void download_crls_single_certificate(gnutls_x509_trust_list_t trusted_list, gnutls_x509_crt_t certificate, 
                                      gnutls_x509_crt_t issuer_certificate) {

    /* Prepare buffer for storing the URL adress for one CRL distribution point. */
    size_t buffer_crl_dist_point_size = 1024;
    char *buffer_crl_dist_point = (char *) calloc(buffer_crl_dist_point_size, sizeof(char));
    if (buffer_crl_dist_point == NULL) {
        exit(EXIT_FAILURE);
    }

    /* Prepare gnutls_datum_t structure, where the downloaded CRL in DER format will be stored. */
    gnutls_datum_t downloaded_crl_DER = { 0 };

    /* Prepare the native gnutls_x509_crl_t structure where the downloaded CRL will be imported. */
    gnutls_x509_crl_t downloaded_crl = { 0 };
    if (gnutls_x509_crl_init(&downloaded_crl) < 0) {
        exit(EXIT_FAILURE);
    }

    /* Prepare and initialize the curl for making out-of-band connection and downloading CRLs from distribution point. */
    curl_global_init(CURL_GLOBAL_ALL);
    CURL *handle = curl_easy_init();
    if (handle == NULL) {
        exit(EXIT_FAILURE);
    }

    /* Tell curl to write each chunk of data (our CRL list during downloading) with this function callback. */
    curl_easy_setopt(handle, CURLOPT_WRITEFUNCTION, get_data);
    /* Tell curl to write each chunk of data to the given location, in our case, to the variable in the memory. */
    curl_easy_setopt(handle, CURLOPT_WRITEDATA, &downloaded_crl_DER);

    /* Each certificate can have more than one CRL distribution point entry. */
    /* This cycle will iterate through every distribution point, until GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE will be returned. */
    unsigned int revocation_reasons;
    int dist_points_index= 0;
    int ret;
    while (1) {
        ret = gnutls_x509_crt_get_crl_dist_points(certificate, dist_points_index, buffer_crl_dist_point, 
                                                  &buffer_crl_dist_point_size, &revocation_reasons, NULL);

        if (ret == GNUTLS_E_SHORT_MEMORY_BUFFER) {
            /* If buffer for storing URL of Distribution point is not big enough, reallocate it with returned required size. */
            buffer_crl_dist_point = (char *) realloc(buffer_crl_dist_point, buffer_crl_dist_point_size);
            if (buffer_crl_dist_point == NULL)
            {
                exit(EXIT_FAILURE);
            }
            continue;
        }

        if (ret == GNUTLS_E_REQUESTED_DATA_NOT_AVAILABLE) {
            break;
        }

        /* Other error occured. */
        if (ret < 0) {
            exit(EXIT_FAILURE);
        }

        /* Successfully parsed the distribution point (at actual index). */

        /* Tell curl to download CRL from the retrieved distribution point URL. */
        curl_easy_setopt(handle, CURLOPT_URL, buffer_crl_dist_point);

        /* Start downloading. */
        if (curl_easy_perform(handle) != 0) {
            exit(EXIT_FAILURE);
        }

         /* The download has successfully finished. */

        /* Convert the downloaded CRL from structure gnutls_datum_t to structure gnutls_crl_t. */
        if (gnutls_x509_crl_import(downloaded_crl, &downloaded_crl_DER, GNUTLS_X509_FMT_DER) < 0) {
            exit(EXIT_FAILURE);
        }

        /* Verify the signature of the downloaded CRL against issuer's certificate. */
        if (gnutls_x509_crl_check_issuer(downloaded_crl, issuer_certificate) != 1) {
            exit(EXIT_FAILURE);
        }

        /* Add downloaded DER encoded CRL to the trusted list. */
        /* Function returns the number of added elements. */
        if (gnutls_x509_trust_list_add_trust_mem(trusted_list, NULL, &downloaded_crl_DER, GNUTLS_X509_FMT_DER, 0, 0) <= 0 {
            exit(EXIT_FAILURE);
        }

        /* Deinitialize and set variables after each loop. */
        gnutls_free(downloaded_crl_DER.data);
        downloaded_crl_DER.data = NULL;
        downloaded_crl_DER.size = 0;

        memset(buffer_crl_dist_point, 0, buffer_crl_dist_point_size);
        dist_points_index++;
    }

    /* If the current certificate has no CRL distribution point entry in its extensions, CRL revocation check could not be performed. */
    /* If server's certificate has not a single CRL distribution point, we can not provide CRL revocation check. */
    if (dist_points_index == 0) {
        fprintf(stderr, "No distribution point has been found\n");
        exit(EXIT_SUCCESS);
    }

    /* Deinitialize before leaving function. */
    free(buffer_crl_dist_point);
    gnutls_x509_crl_deinit(downloaded_crl);
    curl_easy_cleanup(handle);
}

size_t get_data(void *buffer, size_t size, size_t nmemb, void *userp) {
    /* Already processed data from previous transfers. */
    gnutls_datum_t *ud = (gnutls_datum_t *) userp;

    /* nmemb bytes of new data */
    size *= nmemb;

    /* Reallocate the buffer containing the previous data so that it can also accommodate nmemb of new data. */
    ud->data = realloc(ud->data, ud->size + size);
    if (ud->data == NULL) {
        exit(EXIT_FAILURE);
    }

    /* Append nmemb new bytes to the previous data. */
    memcpy(&ud->data[ud->size], buffer, size);
    ud->size += size;

    return size;
}

/* Verify the server's chain against filled trusted list. */
unsigned int verify_output;
if (gnutls_x509_trust_list_verify_crt(trusted_list, server_chain_crt, server_chain_size, 0, &verify_output, NULL) != 0) {
    exit(EXIT_FAILURE);
}

/* The GNUTLS_CERT_INVALID flag is always set on a verification error. */
/* More detailed flags (gnutls_certificate_status_t) will also be set when appropriate. */
if (verify_output & GNUTLS_CERT_INVALID) {
    if (verify_output & GNUTLS_CERT_REVOKED) {
        /* Certificate chain is revoked. */
    }
    else {
        /* Other verification error. */
    }
}
else {
    /* No verification error. */
}

for (int i=0; i < server_chain_size; i++) {
    gnutls_x509_crt_deinit(server_chain_crt[i]);
}
gnutls_free(server_chain_crt);
gnutls_x509_trust_list_deinit(trusted_list, 1);