wolf SSL / wolfSSL-TLS13-Beta

wolfSSL 3.11.1 for TLS1.3 beta

Fork of wolfSSL by wolf SSL

src/crl.c@7:481bce714567, 2017-05-02 (annotated)

Committer:
wolfSSL
Date:
Tue May 02 08:44:47 2017 +0000
Revision:
7:481bce714567
wolfSSL3.10.2

Who changed what in which revision?

UserRevisionLine numberNew contents of line
wolfSSL 7:481bce714567 1 /* crl.c
wolfSSL 7:481bce714567 2 *
wolfSSL 7:481bce714567 3 * Copyright (C) 2006-2016 wolfSSL Inc.
wolfSSL 7:481bce714567 4 *
wolfSSL 7:481bce714567 5 * This file is part of wolfSSL.
wolfSSL 7:481bce714567 6 *
wolfSSL 7:481bce714567 7 * wolfSSL is free software; you can redistribute it and/or modify
wolfSSL 7:481bce714567 8 * it under the terms of the GNU General Public License as published by
wolfSSL 7:481bce714567 9 * the Free Software Foundation; either version 2 of the License, or
wolfSSL 7:481bce714567 10 * (at your option) any later version.
wolfSSL 7:481bce714567 11 *
wolfSSL 7:481bce714567 12 * wolfSSL is distributed in the hope that it will be useful,
wolfSSL 7:481bce714567 13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
wolfSSL 7:481bce714567 14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
wolfSSL 7:481bce714567 15 * GNU General Public License for more details.
wolfSSL 7:481bce714567 16 *
wolfSSL 7:481bce714567 17 * You should have received a copy of the GNU General Public License
wolfSSL 7:481bce714567 18 * along with this program; if not, write to the Free Software
wolfSSL 7:481bce714567 19 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
wolfSSL 7:481bce714567 20 */
wolfSSL 7:481bce714567 21
wolfSSL 7:481bce714567 22
wolfSSL 7:481bce714567 23 /* Name change compatibility layer no longer needs included here */
wolfSSL 7:481bce714567 24
wolfSSL 7:481bce714567 25 #ifdef HAVE_CONFIG_H
wolfSSL 7:481bce714567 26 #include <config.h>
wolfSSL 7:481bce714567 27 #endif
wolfSSL 7:481bce714567 28
wolfSSL 7:481bce714567 29 #include <wolfssl/wolfcrypt/settings.h>
wolfSSL 7:481bce714567 30
wolfSSL 7:481bce714567 31 #ifndef WOLFCRYPT_ONLY
wolfSSL 7:481bce714567 32 #ifdef HAVE_CRL
wolfSSL 7:481bce714567 33
wolfSSL 7:481bce714567 34 #include <wolfssl/internal.h>
wolfSSL 7:481bce714567 35 #include <wolfssl/error-ssl.h>
wolfSSL 7:481bce714567 36
wolfSSL 7:481bce714567 37 #include <string.h>
wolfSSL 7:481bce714567 38
wolfSSL 7:481bce714567 39 #ifdef HAVE_CRL_MONITOR
wolfSSL 7:481bce714567 40 #if (defined(__MACH__) || defined(__FreeBSD__) || defined(__linux__))
wolfSSL 7:481bce714567 41 static int StopMonitor(int mfd);
wolfSSL 7:481bce714567 42 #else
wolfSSL 7:481bce714567 43 #error "CRL monitor only currently supported on linux or mach"
wolfSSL 7:481bce714567 44 #endif
wolfSSL 7:481bce714567 45 #endif /* HAVE_CRL_MONITOR */
wolfSSL 7:481bce714567 46
wolfSSL 7:481bce714567 47
wolfSSL 7:481bce714567 48 /* Initialize CRL members */
wolfSSL 7:481bce714567 49 int InitCRL(WOLFSSL_CRL* crl, WOLFSSL_CERT_MANAGER* cm)
wolfSSL 7:481bce714567 50 {
wolfSSL 7:481bce714567 51 WOLFSSL_ENTER("InitCRL");
wolfSSL 7:481bce714567 52
wolfSSL 7:481bce714567 53 crl->heap = cm->heap;
wolfSSL 7:481bce714567 54 crl->cm = cm;
wolfSSL 7:481bce714567 55 crl->crlList = NULL;
wolfSSL 7:481bce714567 56 crl->monitors[0].path = NULL;
wolfSSL 7:481bce714567 57 crl->monitors[1].path = NULL;
wolfSSL 7:481bce714567 58 #ifdef HAVE_CRL_MONITOR
wolfSSL 7:481bce714567 59 crl->tid = 0;
wolfSSL 7:481bce714567 60 crl->mfd = -1; /* mfd for bsd is kqueue fd, eventfd for linux */
wolfSSL 7:481bce714567 61 crl->setup = 0; /* thread setup done predicate */
wolfSSL 7:481bce714567 62 if (pthread_cond_init(&crl->cond, 0) != 0) {
wolfSSL 7:481bce714567 63 WOLFSSL_MSG("Pthread condition init failed");
wolfSSL 7:481bce714567 64 return BAD_COND_E;
wolfSSL 7:481bce714567 65 }
wolfSSL 7:481bce714567 66 #endif
wolfSSL 7:481bce714567 67 if (wc_InitMutex(&crl->crlLock) != 0) {
wolfSSL 7:481bce714567 68 WOLFSSL_MSG("Init Mutex failed");
wolfSSL 7:481bce714567 69 return BAD_MUTEX_E;
wolfSSL 7:481bce714567 70 }
wolfSSL 7:481bce714567 71
wolfSSL 7:481bce714567 72 return 0;
wolfSSL 7:481bce714567 73 }
wolfSSL 7:481bce714567 74
wolfSSL 7:481bce714567 75
wolfSSL 7:481bce714567 76 /* Initialize CRL Entry */
wolfSSL 7:481bce714567 77 static int InitCRL_Entry(CRL_Entry* crle, DecodedCRL* dcrl)
wolfSSL 7:481bce714567 78 {
wolfSSL 7:481bce714567 79 WOLFSSL_ENTER("InitCRL_Entry");
wolfSSL 7:481bce714567 80
wolfSSL 7:481bce714567 81 XMEMCPY(crle->issuerHash, dcrl->issuerHash, CRL_DIGEST_SIZE);
wolfSSL 7:481bce714567 82 /* XMEMCPY(crle->crlHash, dcrl->crlHash, CRL_DIGEST_SIZE);
wolfSSL 7:481bce714567 83 * copy the hash here if needed for optimized comparisons */
wolfSSL 7:481bce714567 84 XMEMCPY(crle->lastDate, dcrl->lastDate, MAX_DATE_SIZE);
wolfSSL 7:481bce714567 85 XMEMCPY(crle->nextDate, dcrl->nextDate, MAX_DATE_SIZE);
wolfSSL 7:481bce714567 86 crle->lastDateFormat = dcrl->lastDateFormat;
wolfSSL 7:481bce714567 87 crle->nextDateFormat = dcrl->nextDateFormat;
wolfSSL 7:481bce714567 88
wolfSSL 7:481bce714567 89 crle->certs = dcrl->certs; /* take ownsership */
wolfSSL 7:481bce714567 90 dcrl->certs = NULL;
wolfSSL 7:481bce714567 91 crle->totalCerts = dcrl->totalCerts;
wolfSSL 7:481bce714567 92
wolfSSL 7:481bce714567 93 return 0;
wolfSSL 7:481bce714567 94 }
wolfSSL 7:481bce714567 95
wolfSSL 7:481bce714567 96
wolfSSL 7:481bce714567 97 /* Free all CRL Entry resources */
wolfSSL 7:481bce714567 98 static void FreeCRL_Entry(CRL_Entry* crle, void* heap)
wolfSSL 7:481bce714567 99 {
wolfSSL 7:481bce714567 100 RevokedCert* tmp = crle->certs;
wolfSSL 7:481bce714567 101
wolfSSL 7:481bce714567 102 WOLFSSL_ENTER("FreeCRL_Entry");
wolfSSL 7:481bce714567 103
wolfSSL 7:481bce714567 104 while(tmp) {
wolfSSL 7:481bce714567 105 RevokedCert* next = tmp->next;
wolfSSL 7:481bce714567 106 XFREE(tmp, heap, DYNAMIC_TYPE_REVOKED);
wolfSSL 7:481bce714567 107 tmp = next;
wolfSSL 7:481bce714567 108 }
wolfSSL 7:481bce714567 109
wolfSSL 7:481bce714567 110 (void)heap;
wolfSSL 7:481bce714567 111 }
wolfSSL 7:481bce714567 112
wolfSSL 7:481bce714567 113
wolfSSL 7:481bce714567 114
wolfSSL 7:481bce714567 115 /* Free all CRL resources */
wolfSSL 7:481bce714567 116 void FreeCRL(WOLFSSL_CRL* crl, int dynamic)
wolfSSL 7:481bce714567 117 {
wolfSSL 7:481bce714567 118 CRL_Entry* tmp = crl->crlList;
wolfSSL 7:481bce714567 119
wolfSSL 7:481bce714567 120 WOLFSSL_ENTER("FreeCRL");
wolfSSL 7:481bce714567 121
wolfSSL 7:481bce714567 122 if (crl->monitors[0].path)
wolfSSL 7:481bce714567 123 XFREE(crl->monitors[0].path, crl->heap, DYNAMIC_TYPE_CRL_MONITOR);
wolfSSL 7:481bce714567 124
wolfSSL 7:481bce714567 125 if (crl->monitors[1].path)
wolfSSL 7:481bce714567 126 XFREE(crl->monitors[1].path, crl->heap, DYNAMIC_TYPE_CRL_MONITOR);
wolfSSL 7:481bce714567 127
wolfSSL 7:481bce714567 128 while(tmp) {
wolfSSL 7:481bce714567 129 CRL_Entry* next = tmp->next;
wolfSSL 7:481bce714567 130 FreeCRL_Entry(tmp, crl->heap);
wolfSSL 7:481bce714567 131 XFREE(tmp, crl->heap, DYNAMIC_TYPE_CRL_ENTRY);
wolfSSL 7:481bce714567 132 tmp = next;
wolfSSL 7:481bce714567 133 }
wolfSSL 7:481bce714567 134
wolfSSL 7:481bce714567 135 #ifdef HAVE_CRL_MONITOR
wolfSSL 7:481bce714567 136 if (crl->tid != 0) {
wolfSSL 7:481bce714567 137 WOLFSSL_MSG("stopping monitor thread");
wolfSSL 7:481bce714567 138 if (StopMonitor(crl->mfd) == 0)
wolfSSL 7:481bce714567 139 pthread_join(crl->tid, NULL);
wolfSSL 7:481bce714567 140 else {
wolfSSL 7:481bce714567 141 WOLFSSL_MSG("stop monitor failed");
wolfSSL 7:481bce714567 142 }
wolfSSL 7:481bce714567 143 }
wolfSSL 7:481bce714567 144 pthread_cond_destroy(&crl->cond);
wolfSSL 7:481bce714567 145 #endif
wolfSSL 7:481bce714567 146 wc_FreeMutex(&crl->crlLock);
wolfSSL 7:481bce714567 147 if (dynamic) /* free self */
wolfSSL 7:481bce714567 148 XFREE(crl, crl->heap, DYNAMIC_TYPE_CRL);
wolfSSL 7:481bce714567 149 }
wolfSSL 7:481bce714567 150
wolfSSL 7:481bce714567 151
wolfSSL 7:481bce714567 152 /* Is the cert ok with CRL, return 0 on success */
wolfSSL 7:481bce714567 153 int CheckCertCRL(WOLFSSL_CRL* crl, DecodedCert* cert)
wolfSSL 7:481bce714567 154 {
wolfSSL 7:481bce714567 155 CRL_Entry* crle;
wolfSSL 7:481bce714567 156 int foundEntry = 0;
wolfSSL 7:481bce714567 157 int ret = 0;
wolfSSL 7:481bce714567 158
wolfSSL 7:481bce714567 159 WOLFSSL_ENTER("CheckCertCRL");
wolfSSL 7:481bce714567 160
wolfSSL 7:481bce714567 161 if (wc_LockMutex(&crl->crlLock) != 0) {
wolfSSL 7:481bce714567 162 WOLFSSL_MSG("wc_LockMutex failed");
wolfSSL 7:481bce714567 163 return BAD_MUTEX_E;
wolfSSL 7:481bce714567 164 }
wolfSSL 7:481bce714567 165
wolfSSL 7:481bce714567 166 crle = crl->crlList;
wolfSSL 7:481bce714567 167
wolfSSL 7:481bce714567 168 while (crle) {
wolfSSL 7:481bce714567 169 if (XMEMCMP(crle->issuerHash, cert->issuerHash, CRL_DIGEST_SIZE) == 0) {
wolfSSL 7:481bce714567 170 int doNextDate = 1;
wolfSSL 7:481bce714567 171
wolfSSL 7:481bce714567 172 WOLFSSL_MSG("Found CRL Entry on list");
wolfSSL 7:481bce714567 173 WOLFSSL_MSG("Checking next date validity");
wolfSSL 7:481bce714567 174
wolfSSL 7:481bce714567 175 #ifdef WOLFSSL_NO_CRL_NEXT_DATE
wolfSSL 7:481bce714567 176 if (crle->nextDateFormat == ASN_OTHER_TYPE)
wolfSSL 7:481bce714567 177 doNextDate = 0; /* skip */
wolfSSL 7:481bce714567 178 #endif
wolfSSL 7:481bce714567 179
wolfSSL 7:481bce714567 180 if (doNextDate && !ValidateDate(crle->nextDate,
wolfSSL 7:481bce714567 181 crle->nextDateFormat, AFTER)) {
wolfSSL 7:481bce714567 182 WOLFSSL_MSG("CRL next date is no longer valid");
wolfSSL 7:481bce714567 183 ret = ASN_AFTER_DATE_E;
wolfSSL 7:481bce714567 184 }
wolfSSL 7:481bce714567 185 else
wolfSSL 7:481bce714567 186 foundEntry = 1;
wolfSSL 7:481bce714567 187 break;
wolfSSL 7:481bce714567 188 }
wolfSSL 7:481bce714567 189 crle = crle->next;
wolfSSL 7:481bce714567 190 }
wolfSSL 7:481bce714567 191
wolfSSL 7:481bce714567 192 if (foundEntry) {
wolfSSL 7:481bce714567 193 RevokedCert* rc = crle->certs;
wolfSSL 7:481bce714567 194
wolfSSL 7:481bce714567 195 while (rc) {
wolfSSL 7:481bce714567 196 if (XMEMCMP(rc->serialNumber, cert->serial, rc->serialSz) == 0) {
wolfSSL 7:481bce714567 197 WOLFSSL_MSG("Cert revoked");
wolfSSL 7:481bce714567 198 ret = CRL_CERT_REVOKED;
wolfSSL 7:481bce714567 199 break;
wolfSSL 7:481bce714567 200 }
wolfSSL 7:481bce714567 201 rc = rc->next;
wolfSSL 7:481bce714567 202 }
wolfSSL 7:481bce714567 203 }
wolfSSL 7:481bce714567 204
wolfSSL 7:481bce714567 205 wc_UnLockMutex(&crl->crlLock);
wolfSSL 7:481bce714567 206
wolfSSL 7:481bce714567 207 if (foundEntry == 0) {
wolfSSL 7:481bce714567 208 WOLFSSL_MSG("Couldn't find CRL for status check");
wolfSSL 7:481bce714567 209 ret = CRL_MISSING;
wolfSSL 7:481bce714567 210 if (crl->cm->cbMissingCRL) {
wolfSSL 7:481bce714567 211 char url[256];
wolfSSL 7:481bce714567 212
wolfSSL 7:481bce714567 213 WOLFSSL_MSG("Issuing missing CRL callback");
wolfSSL 7:481bce714567 214 url[0] = '\0';
wolfSSL 7:481bce714567 215 if (cert->extCrlInfoSz < (int)sizeof(url) -1 ) {
wolfSSL 7:481bce714567 216 XMEMCPY(url, cert->extCrlInfo, cert->extCrlInfoSz);
wolfSSL 7:481bce714567 217 url[cert->extCrlInfoSz] = '\0';
wolfSSL 7:481bce714567 218 }
wolfSSL 7:481bce714567 219 else {
wolfSSL 7:481bce714567 220 WOLFSSL_MSG("CRL url too long");
wolfSSL 7:481bce714567 221 }
wolfSSL 7:481bce714567 222 crl->cm->cbMissingCRL(url);
wolfSSL 7:481bce714567 223 }
wolfSSL 7:481bce714567 224 }
wolfSSL 7:481bce714567 225
wolfSSL 7:481bce714567 226
wolfSSL 7:481bce714567 227 return ret;
wolfSSL 7:481bce714567 228 }
wolfSSL 7:481bce714567 229
wolfSSL 7:481bce714567 230
wolfSSL 7:481bce714567 231 /* Add Decoded CRL, 0 on success */
wolfSSL 7:481bce714567 232 static int AddCRL(WOLFSSL_CRL* crl, DecodedCRL* dcrl)
wolfSSL 7:481bce714567 233 {
wolfSSL 7:481bce714567 234 CRL_Entry* crle;
wolfSSL 7:481bce714567 235
wolfSSL 7:481bce714567 236 WOLFSSL_ENTER("AddCRL");
wolfSSL 7:481bce714567 237
wolfSSL 7:481bce714567 238 crle = (CRL_Entry*)XMALLOC(sizeof(CRL_Entry), crl->heap, DYNAMIC_TYPE_CRL_ENTRY);
wolfSSL 7:481bce714567 239 if (crle == NULL) {
wolfSSL 7:481bce714567 240 WOLFSSL_MSG("alloc CRL Entry failed");
wolfSSL 7:481bce714567 241 return -1;
wolfSSL 7:481bce714567 242 }
wolfSSL 7:481bce714567 243
wolfSSL 7:481bce714567 244 if (InitCRL_Entry(crle, dcrl) < 0) {
wolfSSL 7:481bce714567 245 WOLFSSL_MSG("Init CRL Entry failed");
wolfSSL 7:481bce714567 246 XFREE(crle, crl->heap, DYNAMIC_TYPE_CRL_ENTRY);
wolfSSL 7:481bce714567 247 return -1;
wolfSSL 7:481bce714567 248 }
wolfSSL 7:481bce714567 249
wolfSSL 7:481bce714567 250 if (wc_LockMutex(&crl->crlLock) != 0) {
wolfSSL 7:481bce714567 251 WOLFSSL_MSG("wc_LockMutex failed");
wolfSSL 7:481bce714567 252 FreeCRL_Entry(crle, crl->heap);
wolfSSL 7:481bce714567 253 XFREE(crle, crl->heap, DYNAMIC_TYPE_CRL_ENTRY);
wolfSSL 7:481bce714567 254 return BAD_MUTEX_E;
wolfSSL 7:481bce714567 255 }
wolfSSL 7:481bce714567 256 crle->next = crl->crlList;
wolfSSL 7:481bce714567 257 crl->crlList = crle;
wolfSSL 7:481bce714567 258 wc_UnLockMutex(&crl->crlLock);
wolfSSL 7:481bce714567 259
wolfSSL 7:481bce714567 260 return 0;
wolfSSL 7:481bce714567 261 }
wolfSSL 7:481bce714567 262
wolfSSL 7:481bce714567 263
wolfSSL 7:481bce714567 264 /* Load CRL File of type, SSL_SUCCESS on ok */
wolfSSL 7:481bce714567 265 int BufferLoadCRL(WOLFSSL_CRL* crl, const byte* buff, long sz, int type)
wolfSSL 7:481bce714567 266 {
wolfSSL 7:481bce714567 267 int ret = SSL_SUCCESS;
wolfSSL 7:481bce714567 268 const byte* myBuffer = buff; /* if DER ok, otherwise switch */
wolfSSL 7:481bce714567 269 DerBuffer* der = NULL;
wolfSSL 7:481bce714567 270 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 7:481bce714567 271 DecodedCRL* dcrl;
wolfSSL 7:481bce714567 272 #else
wolfSSL 7:481bce714567 273 DecodedCRL dcrl[1];
wolfSSL 7:481bce714567 274 #endif
wolfSSL 7:481bce714567 275
wolfSSL 7:481bce714567 276 WOLFSSL_ENTER("BufferLoadCRL");
wolfSSL 7:481bce714567 277
wolfSSL 7:481bce714567 278 if (crl == NULL || buff == NULL || sz == 0)
wolfSSL 7:481bce714567 279 return BAD_FUNC_ARG;
wolfSSL 7:481bce714567 280
wolfSSL 7:481bce714567 281 if (type == SSL_FILETYPE_PEM) {
wolfSSL 7:481bce714567 282 int eccKey = 0; /* not used */
wolfSSL 7:481bce714567 283 EncryptedInfo info;
wolfSSL 7:481bce714567 284 info.ctx = NULL;
wolfSSL 7:481bce714567 285
wolfSSL 7:481bce714567 286 ret = PemToDer(buff, sz, CRL_TYPE, &der, NULL, &info, &eccKey);
wolfSSL 7:481bce714567 287 if (ret == 0) {
wolfSSL 7:481bce714567 288 myBuffer = der->buffer;
wolfSSL 7:481bce714567 289 sz = der->length;
wolfSSL 7:481bce714567 290 }
wolfSSL 7:481bce714567 291 else {
wolfSSL 7:481bce714567 292 WOLFSSL_MSG("Pem to Der failed");
wolfSSL 7:481bce714567 293 FreeDer(&der);
wolfSSL 7:481bce714567 294 return -1;
wolfSSL 7:481bce714567 295 }
wolfSSL 7:481bce714567 296 }
wolfSSL 7:481bce714567 297
wolfSSL 7:481bce714567 298 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 7:481bce714567 299 dcrl = (DecodedCRL*)XMALLOC(sizeof(DecodedCRL), NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 7:481bce714567 300 if (dcrl == NULL) {
wolfSSL 7:481bce714567 301 FreeDer(&der);
wolfSSL 7:481bce714567 302 return MEMORY_E;
wolfSSL 7:481bce714567 303 }
wolfSSL 7:481bce714567 304 #endif
wolfSSL 7:481bce714567 305
wolfSSL 7:481bce714567 306 InitDecodedCRL(dcrl, crl->heap);
wolfSSL 7:481bce714567 307 ret = ParseCRL(dcrl, myBuffer, (word32)sz, crl->cm);
wolfSSL 7:481bce714567 308 if (ret != 0) {
wolfSSL 7:481bce714567 309 WOLFSSL_MSG("ParseCRL error");
wolfSSL 7:481bce714567 310 }
wolfSSL 7:481bce714567 311 else {
wolfSSL 7:481bce714567 312 ret = AddCRL(crl, dcrl);
wolfSSL 7:481bce714567 313 if (ret != 0) {
wolfSSL 7:481bce714567 314 WOLFSSL_MSG("AddCRL error");
wolfSSL 7:481bce714567 315 }
wolfSSL 7:481bce714567 316 }
wolfSSL 7:481bce714567 317
wolfSSL 7:481bce714567 318 FreeDecodedCRL(dcrl);
wolfSSL 7:481bce714567 319
wolfSSL 7:481bce714567 320 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 7:481bce714567 321 XFREE(dcrl, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 7:481bce714567 322 #endif
wolfSSL 7:481bce714567 323
wolfSSL 7:481bce714567 324 FreeDer(&der);
wolfSSL 7:481bce714567 325
wolfSSL 7:481bce714567 326 return ret ? ret : SSL_SUCCESS; /* convert 0 to SSL_SUCCESS */
wolfSSL 7:481bce714567 327 }
wolfSSL 7:481bce714567 328
wolfSSL 7:481bce714567 329
wolfSSL 7:481bce714567 330 #ifdef HAVE_CRL_MONITOR
wolfSSL 7:481bce714567 331
wolfSSL 7:481bce714567 332
wolfSSL 7:481bce714567 333 /* Signal Monitor thread is setup, save status to setup flag, 0 on success */
wolfSSL 7:481bce714567 334 static int SignalSetup(WOLFSSL_CRL* crl, int status)
wolfSSL 7:481bce714567 335 {
wolfSSL 7:481bce714567 336 int ret;
wolfSSL 7:481bce714567 337
wolfSSL 7:481bce714567 338 /* signal to calling thread we're setup */
wolfSSL 7:481bce714567 339 if (wc_LockMutex(&crl->crlLock) != 0) {
wolfSSL 7:481bce714567 340 WOLFSSL_MSG("wc_LockMutex crlLock failed");
wolfSSL 7:481bce714567 341 return BAD_MUTEX_E;
wolfSSL 7:481bce714567 342 }
wolfSSL 7:481bce714567 343
wolfSSL 7:481bce714567 344 crl->setup = status;
wolfSSL 7:481bce714567 345 ret = pthread_cond_signal(&crl->cond);
wolfSSL 7:481bce714567 346
wolfSSL 7:481bce714567 347 wc_UnLockMutex(&crl->crlLock);
wolfSSL 7:481bce714567 348
wolfSSL 7:481bce714567 349 if (ret != 0)
wolfSSL 7:481bce714567 350 return BAD_COND_E;
wolfSSL 7:481bce714567 351
wolfSSL 7:481bce714567 352 return 0;
wolfSSL 7:481bce714567 353 }
wolfSSL 7:481bce714567 354
wolfSSL 7:481bce714567 355
wolfSSL 7:481bce714567 356 /* read in new CRL entries and save new list */
wolfSSL 7:481bce714567 357 static int SwapLists(WOLFSSL_CRL* crl)
wolfSSL 7:481bce714567 358 {
wolfSSL 7:481bce714567 359 int ret;
wolfSSL 7:481bce714567 360 CRL_Entry* newList;
wolfSSL 7:481bce714567 361 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 7:481bce714567 362 WOLFSSL_CRL* tmp;
wolfSSL 7:481bce714567 363 #else
wolfSSL 7:481bce714567 364 WOLFSSL_CRL tmp[1];
wolfSSL 7:481bce714567 365 #endif
wolfSSL 7:481bce714567 366
wolfSSL 7:481bce714567 367 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 7:481bce714567 368 tmp = (WOLFSSL_CRL*)XMALLOC(sizeof(WOLFSSL_CRL), NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 7:481bce714567 369 if (tmp == NULL)
wolfSSL 7:481bce714567 370 return MEMORY_E;
wolfSSL 7:481bce714567 371 #endif
wolfSSL 7:481bce714567 372
wolfSSL 7:481bce714567 373 if (InitCRL(tmp, crl->cm) < 0) {
wolfSSL 7:481bce714567 374 WOLFSSL_MSG("Init tmp CRL failed");
wolfSSL 7:481bce714567 375 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 7:481bce714567 376 XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 7:481bce714567 377 #endif
wolfSSL 7:481bce714567 378 return -1;
wolfSSL 7:481bce714567 379 }
wolfSSL 7:481bce714567 380
wolfSSL 7:481bce714567 381 if (crl->monitors[0].path) {
wolfSSL 7:481bce714567 382 ret = LoadCRL(tmp, crl->monitors[0].path, SSL_FILETYPE_PEM, 0);
wolfSSL 7:481bce714567 383 if (ret != SSL_SUCCESS) {
wolfSSL 7:481bce714567 384 WOLFSSL_MSG("PEM LoadCRL on dir change failed");
wolfSSL 7:481bce714567 385 FreeCRL(tmp, 0);
wolfSSL 7:481bce714567 386 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 7:481bce714567 387 XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 7:481bce714567 388 #endif
wolfSSL 7:481bce714567 389 return -1;
wolfSSL 7:481bce714567 390 }
wolfSSL 7:481bce714567 391 }
wolfSSL 7:481bce714567 392
wolfSSL 7:481bce714567 393 if (crl->monitors[1].path) {
wolfSSL 7:481bce714567 394 ret = LoadCRL(tmp, crl->monitors[1].path, SSL_FILETYPE_ASN1, 0);
wolfSSL 7:481bce714567 395 if (ret != SSL_SUCCESS) {
wolfSSL 7:481bce714567 396 WOLFSSL_MSG("DER LoadCRL on dir change failed");
wolfSSL 7:481bce714567 397 FreeCRL(tmp, 0);
wolfSSL 7:481bce714567 398 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 7:481bce714567 399 XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 7:481bce714567 400 #endif
wolfSSL 7:481bce714567 401 return -1;
wolfSSL 7:481bce714567 402 }
wolfSSL 7:481bce714567 403 }
wolfSSL 7:481bce714567 404
wolfSSL 7:481bce714567 405 if (wc_LockMutex(&crl->crlLock) != 0) {
wolfSSL 7:481bce714567 406 WOLFSSL_MSG("wc_LockMutex failed");
wolfSSL 7:481bce714567 407 FreeCRL(tmp, 0);
wolfSSL 7:481bce714567 408 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 7:481bce714567 409 XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 7:481bce714567 410 #endif
wolfSSL 7:481bce714567 411 return -1;
wolfSSL 7:481bce714567 412 }
wolfSSL 7:481bce714567 413
wolfSSL 7:481bce714567 414 newList = tmp->crlList;
wolfSSL 7:481bce714567 415
wolfSSL 7:481bce714567 416 /* swap lists */
wolfSSL 7:481bce714567 417 tmp->crlList = crl->crlList;
wolfSSL 7:481bce714567 418 crl->crlList = newList;
wolfSSL 7:481bce714567 419
wolfSSL 7:481bce714567 420 wc_UnLockMutex(&crl->crlLock);
wolfSSL 7:481bce714567 421
wolfSSL 7:481bce714567 422 FreeCRL(tmp, 0);
wolfSSL 7:481bce714567 423
wolfSSL 7:481bce714567 424 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 7:481bce714567 425 XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 7:481bce714567 426 #endif
wolfSSL 7:481bce714567 427
wolfSSL 7:481bce714567 428 return 0;
wolfSSL 7:481bce714567 429 }
wolfSSL 7:481bce714567 430
wolfSSL 7:481bce714567 431
wolfSSL 7:481bce714567 432 #if (defined(__MACH__) || defined(__FreeBSD__))
wolfSSL 7:481bce714567 433
wolfSSL 7:481bce714567 434 #include <sys/types.h>
wolfSSL 7:481bce714567 435 #include <sys/event.h>
wolfSSL 7:481bce714567 436 #include <sys/time.h>
wolfSSL 7:481bce714567 437 #include <fcntl.h>
wolfSSL 7:481bce714567 438 #include <unistd.h>
wolfSSL 7:481bce714567 439
wolfSSL 7:481bce714567 440 #ifdef __MACH__
wolfSSL 7:481bce714567 441 #define XEVENT_MODE O_EVTONLY
wolfSSL 7:481bce714567 442 #elif defined(__FreeBSD__)
wolfSSL 7:481bce714567 443 #define XEVENT_MODE EVFILT_VNODE
wolfSSL 7:481bce714567 444 #endif
wolfSSL 7:481bce714567 445
wolfSSL 7:481bce714567 446
wolfSSL 7:481bce714567 447 /* we need a unique kqueue user filter fd for crl in case user is doing custom
wolfSSL 7:481bce714567 448 * events too */
wolfSSL 7:481bce714567 449 #ifndef CRL_CUSTOM_FD
wolfSSL 7:481bce714567 450 #define CRL_CUSTOM_FD 123456
wolfSSL 7:481bce714567 451 #endif
wolfSSL 7:481bce714567 452
wolfSSL 7:481bce714567 453
wolfSSL 7:481bce714567 454 /* shutdown monitor thread, 0 on success */
wolfSSL 7:481bce714567 455 static int StopMonitor(int mfd)
wolfSSL 7:481bce714567 456 {
wolfSSL 7:481bce714567 457 struct kevent change;
wolfSSL 7:481bce714567 458
wolfSSL 7:481bce714567 459 /* trigger custom shutdown */
wolfSSL 7:481bce714567 460 EV_SET(&change, CRL_CUSTOM_FD, EVFILT_USER, 0, NOTE_TRIGGER, 0, NULL);
wolfSSL 7:481bce714567 461 if (kevent(mfd, &change, 1, NULL, 0, NULL) < 0) {
wolfSSL 7:481bce714567 462 WOLFSSL_MSG("kevent trigger customer event failed");
wolfSSL 7:481bce714567 463 return -1;
wolfSSL 7:481bce714567 464 }
wolfSSL 7:481bce714567 465
wolfSSL 7:481bce714567 466 return 0;
wolfSSL 7:481bce714567 467 }
wolfSSL 7:481bce714567 468
wolfSSL 7:481bce714567 469
wolfSSL 7:481bce714567 470 /* OS X monitoring */
wolfSSL 7:481bce714567 471 static void* DoMonitor(void* arg)
wolfSSL 7:481bce714567 472 {
wolfSSL 7:481bce714567 473 int fPEM, fDER;
wolfSSL 7:481bce714567 474 struct kevent change;
wolfSSL 7:481bce714567 475
wolfSSL 7:481bce714567 476 WOLFSSL_CRL* crl = (WOLFSSL_CRL*)arg;
wolfSSL 7:481bce714567 477
wolfSSL 7:481bce714567 478 WOLFSSL_ENTER("DoMonitor");
wolfSSL 7:481bce714567 479
wolfSSL 7:481bce714567 480 crl->mfd = kqueue();
wolfSSL 7:481bce714567 481 if (crl->mfd == -1) {
wolfSSL 7:481bce714567 482 WOLFSSL_MSG("kqueue failed");
wolfSSL 7:481bce714567 483 SignalSetup(crl, MONITOR_SETUP_E);
wolfSSL 7:481bce714567 484 return NULL;
wolfSSL 7:481bce714567 485 }
wolfSSL 7:481bce714567 486
wolfSSL 7:481bce714567 487 /* listen for custom shutdown event */
wolfSSL 7:481bce714567 488 EV_SET(&change, CRL_CUSTOM_FD, EVFILT_USER, EV_ADD, 0, 0, NULL);
wolfSSL 7:481bce714567 489 if (kevent(crl->mfd, &change, 1, NULL, 0, NULL) < 0) {
wolfSSL 7:481bce714567 490 WOLFSSL_MSG("kevent monitor customer event failed");
wolfSSL 7:481bce714567 491 SignalSetup(crl, MONITOR_SETUP_E);
wolfSSL 7:481bce714567 492 close(crl->mfd);
wolfSSL 7:481bce714567 493 return NULL;
wolfSSL 7:481bce714567 494 }
wolfSSL 7:481bce714567 495
wolfSSL 7:481bce714567 496 fPEM = -1;
wolfSSL 7:481bce714567 497 fDER = -1;
wolfSSL 7:481bce714567 498
wolfSSL 7:481bce714567 499 if (crl->monitors[0].path) {
wolfSSL 7:481bce714567 500 fPEM = open(crl->monitors[0].path, XEVENT_MODE);
wolfSSL 7:481bce714567 501 if (fPEM == -1) {
wolfSSL 7:481bce714567 502 WOLFSSL_MSG("PEM event dir open failed");
wolfSSL 7:481bce714567 503 SignalSetup(crl, MONITOR_SETUP_E);
wolfSSL 7:481bce714567 504 close(crl->mfd);
wolfSSL 7:481bce714567 505 return NULL;
wolfSSL 7:481bce714567 506 }
wolfSSL 7:481bce714567 507 }
wolfSSL 7:481bce714567 508
wolfSSL 7:481bce714567 509 if (crl->monitors[1].path) {
wolfSSL 7:481bce714567 510 fDER = open(crl->monitors[1].path, XEVENT_MODE);
wolfSSL 7:481bce714567 511 if (fDER == -1) {
wolfSSL 7:481bce714567 512 WOLFSSL_MSG("DER event dir open failed");
wolfSSL 7:481bce714567 513 if (fPEM != -1)
wolfSSL 7:481bce714567 514 close(fPEM);
wolfSSL 7:481bce714567 515 close(crl->mfd);
wolfSSL 7:481bce714567 516 SignalSetup(crl, MONITOR_SETUP_E);
wolfSSL 7:481bce714567 517 return NULL;
wolfSSL 7:481bce714567 518 }
wolfSSL 7:481bce714567 519 }
wolfSSL 7:481bce714567 520
wolfSSL 7:481bce714567 521 if (fPEM != -1)
wolfSSL 7:481bce714567 522 EV_SET(&change, fPEM, EVFILT_VNODE, EV_ADD | EV_ENABLE | EV_ONESHOT,
wolfSSL 7:481bce714567 523 NOTE_DELETE | NOTE_EXTEND | NOTE_WRITE | NOTE_ATTRIB, 0, 0);
wolfSSL 7:481bce714567 524
wolfSSL 7:481bce714567 525 if (fDER != -1)
wolfSSL 7:481bce714567 526 EV_SET(&change, fDER, EVFILT_VNODE, EV_ADD | EV_ENABLE | EV_ONESHOT,
wolfSSL 7:481bce714567 527 NOTE_DELETE | NOTE_EXTEND | NOTE_WRITE | NOTE_ATTRIB, 0, 0);
wolfSSL 7:481bce714567 528
wolfSSL 7:481bce714567 529 /* signal to calling thread we're setup */
wolfSSL 7:481bce714567 530 if (SignalSetup(crl, 1) != 0) {
wolfSSL 7:481bce714567 531 if (fPEM != -1)
wolfSSL 7:481bce714567 532 close(fPEM);
wolfSSL 7:481bce714567 533 if (fDER != -1)
wolfSSL 7:481bce714567 534 close(fDER);
wolfSSL 7:481bce714567 535 close(crl->mfd);
wolfSSL 7:481bce714567 536 return NULL;
wolfSSL 7:481bce714567 537 }
wolfSSL 7:481bce714567 538
wolfSSL 7:481bce714567 539 for (;;) {
wolfSSL 7:481bce714567 540 struct kevent event;
wolfSSL 7:481bce714567 541 int numEvents = kevent(crl->mfd, &change, 1, &event, 1, NULL);
wolfSSL 7:481bce714567 542
wolfSSL 7:481bce714567 543 WOLFSSL_MSG("Got kevent");
wolfSSL 7:481bce714567 544
wolfSSL 7:481bce714567 545 if (numEvents == -1) {
wolfSSL 7:481bce714567 546 WOLFSSL_MSG("kevent problem, continue");
wolfSSL 7:481bce714567 547 continue;
wolfSSL 7:481bce714567 548 }
wolfSSL 7:481bce714567 549
wolfSSL 7:481bce714567 550 if (event.filter == EVFILT_USER) {
wolfSSL 7:481bce714567 551 WOLFSSL_MSG("Got user shutdown event, breaking out");
wolfSSL 7:481bce714567 552 break;
wolfSSL 7:481bce714567 553 }
wolfSSL 7:481bce714567 554
wolfSSL 7:481bce714567 555 if (SwapLists(crl) < 0) {
wolfSSL 7:481bce714567 556 WOLFSSL_MSG("SwapLists problem, continue");
wolfSSL 7:481bce714567 557 }
wolfSSL 7:481bce714567 558 }
wolfSSL 7:481bce714567 559
wolfSSL 7:481bce714567 560 if (fPEM != -1)
wolfSSL 7:481bce714567 561 close(fPEM);
wolfSSL 7:481bce714567 562 if (fDER != -1)
wolfSSL 7:481bce714567 563 close(fDER);
wolfSSL 7:481bce714567 564
wolfSSL 7:481bce714567 565 close(crl->mfd);
wolfSSL 7:481bce714567 566
wolfSSL 7:481bce714567 567 return NULL;
wolfSSL 7:481bce714567 568 }
wolfSSL 7:481bce714567 569
wolfSSL 7:481bce714567 570
wolfSSL 7:481bce714567 571 #elif defined(__linux__)
wolfSSL 7:481bce714567 572
wolfSSL 7:481bce714567 573 #include <sys/types.h>
wolfSSL 7:481bce714567 574 #include <sys/inotify.h>
wolfSSL 7:481bce714567 575 #include <sys/eventfd.h>
wolfSSL 7:481bce714567 576 #include <unistd.h>
wolfSSL 7:481bce714567 577
wolfSSL 7:481bce714567 578
wolfSSL 7:481bce714567 579 #ifndef max
wolfSSL 7:481bce714567 580 static INLINE int max(int a, int b)
wolfSSL 7:481bce714567 581 {
wolfSSL 7:481bce714567 582 return a > b ? a : b;
wolfSSL 7:481bce714567 583 }
wolfSSL 7:481bce714567 584 #endif /* max */
wolfSSL 7:481bce714567 585
wolfSSL 7:481bce714567 586
wolfSSL 7:481bce714567 587 /* shutdown monitor thread, 0 on success */
wolfSSL 7:481bce714567 588 static int StopMonitor(int mfd)
wolfSSL 7:481bce714567 589 {
wolfSSL 7:481bce714567 590 word64 w64 = 1;
wolfSSL 7:481bce714567 591
wolfSSL 7:481bce714567 592 /* write to our custom event */
wolfSSL 7:481bce714567 593 if (write(mfd, &w64, sizeof(w64)) < 0) {
wolfSSL 7:481bce714567 594 WOLFSSL_MSG("StopMonitor write failed");
wolfSSL 7:481bce714567 595 return -1;
wolfSSL 7:481bce714567 596 }
wolfSSL 7:481bce714567 597
wolfSSL 7:481bce714567 598 return 0;
wolfSSL 7:481bce714567 599 }
wolfSSL 7:481bce714567 600
wolfSSL 7:481bce714567 601
wolfSSL 7:481bce714567 602 /* linux monitoring */
wolfSSL 7:481bce714567 603 static void* DoMonitor(void* arg)
wolfSSL 7:481bce714567 604 {
wolfSSL 7:481bce714567 605 int notifyFd;
wolfSSL 7:481bce714567 606 int wd = -1;
wolfSSL 7:481bce714567 607 WOLFSSL_CRL* crl = (WOLFSSL_CRL*)arg;
wolfSSL 7:481bce714567 608 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 7:481bce714567 609 char* buff;
wolfSSL 7:481bce714567 610 #else
wolfSSL 7:481bce714567 611 char buff[8192];
wolfSSL 7:481bce714567 612 #endif
wolfSSL 7:481bce714567 613
wolfSSL 7:481bce714567 614 WOLFSSL_ENTER("DoMonitor");
wolfSSL 7:481bce714567 615
wolfSSL 7:481bce714567 616 crl->mfd = eventfd(0, 0); /* our custom shutdown event */
wolfSSL 7:481bce714567 617 if (crl->mfd < 0) {
wolfSSL 7:481bce714567 618 WOLFSSL_MSG("eventfd failed");
wolfSSL 7:481bce714567 619 SignalSetup(crl, MONITOR_SETUP_E);
wolfSSL 7:481bce714567 620 return NULL;
wolfSSL 7:481bce714567 621 }
wolfSSL 7:481bce714567 622
wolfSSL 7:481bce714567 623 notifyFd = inotify_init();
wolfSSL 7:481bce714567 624 if (notifyFd < 0) {
wolfSSL 7:481bce714567 625 WOLFSSL_MSG("inotify failed");
wolfSSL 7:481bce714567 626 close(crl->mfd);
wolfSSL 7:481bce714567 627 SignalSetup(crl, MONITOR_SETUP_E);
wolfSSL 7:481bce714567 628 return NULL;
wolfSSL 7:481bce714567 629 }
wolfSSL 7:481bce714567 630
wolfSSL 7:481bce714567 631 if (crl->monitors[0].path) {
wolfSSL 7:481bce714567 632 wd = inotify_add_watch(notifyFd, crl->monitors[0].path, IN_CLOSE_WRITE |
wolfSSL 7:481bce714567 633 IN_DELETE);
wolfSSL 7:481bce714567 634 if (wd < 0) {
wolfSSL 7:481bce714567 635 WOLFSSL_MSG("PEM notify add watch failed");
wolfSSL 7:481bce714567 636 close(crl->mfd);
wolfSSL 7:481bce714567 637 close(notifyFd);
wolfSSL 7:481bce714567 638 SignalSetup(crl, MONITOR_SETUP_E);
wolfSSL 7:481bce714567 639 return NULL;
wolfSSL 7:481bce714567 640 }
wolfSSL 7:481bce714567 641 }
wolfSSL 7:481bce714567 642
wolfSSL 7:481bce714567 643 if (crl->monitors[1].path) {
wolfSSL 7:481bce714567 644 wd = inotify_add_watch(notifyFd, crl->monitors[1].path, IN_CLOSE_WRITE |
wolfSSL 7:481bce714567 645 IN_DELETE);
wolfSSL 7:481bce714567 646 if (wd < 0) {
wolfSSL 7:481bce714567 647 WOLFSSL_MSG("DER notify add watch failed");
wolfSSL 7:481bce714567 648 close(crl->mfd);
wolfSSL 7:481bce714567 649 close(notifyFd);
wolfSSL 7:481bce714567 650 SignalSetup(crl, MONITOR_SETUP_E);
wolfSSL 7:481bce714567 651 return NULL;
wolfSSL 7:481bce714567 652 }
wolfSSL 7:481bce714567 653 }
wolfSSL 7:481bce714567 654
wolfSSL 7:481bce714567 655 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 7:481bce714567 656 buff = (char*)XMALLOC(8192, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 7:481bce714567 657 if (buff == NULL)
wolfSSL 7:481bce714567 658 return NULL;
wolfSSL 7:481bce714567 659 #endif
wolfSSL 7:481bce714567 660
wolfSSL 7:481bce714567 661 /* signal to calling thread we're setup */
wolfSSL 7:481bce714567 662 if (SignalSetup(crl, 1) != 0) {
wolfSSL 7:481bce714567 663 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 7:481bce714567 664 XFREE(buff, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 7:481bce714567 665 #endif
wolfSSL 7:481bce714567 666
wolfSSL 7:481bce714567 667 if (wd > 0)
wolfSSL 7:481bce714567 668 inotify_rm_watch(notifyFd, wd);
wolfSSL 7:481bce714567 669 close(crl->mfd);
wolfSSL 7:481bce714567 670 close(notifyFd);
wolfSSL 7:481bce714567 671 return NULL;
wolfSSL 7:481bce714567 672 }
wolfSSL 7:481bce714567 673
wolfSSL 7:481bce714567 674 for (;;) {
wolfSSL 7:481bce714567 675 fd_set readfds;
wolfSSL 7:481bce714567 676 int result;
wolfSSL 7:481bce714567 677 int length;
wolfSSL 7:481bce714567 678
wolfSSL 7:481bce714567 679 FD_ZERO(&readfds);
wolfSSL 7:481bce714567 680 FD_SET(notifyFd, &readfds);
wolfSSL 7:481bce714567 681 FD_SET(crl->mfd, &readfds);
wolfSSL 7:481bce714567 682
wolfSSL 7:481bce714567 683 result = select(max(notifyFd, crl->mfd) + 1, &readfds, NULL, NULL,NULL);
wolfSSL 7:481bce714567 684
wolfSSL 7:481bce714567 685 WOLFSSL_MSG("Got notify event");
wolfSSL 7:481bce714567 686
wolfSSL 7:481bce714567 687 if (result < 0) {
wolfSSL 7:481bce714567 688 WOLFSSL_MSG("select problem, continue");
wolfSSL 7:481bce714567 689 continue;
wolfSSL 7:481bce714567 690 }
wolfSSL 7:481bce714567 691
wolfSSL 7:481bce714567 692 if (FD_ISSET(crl->mfd, &readfds)) {
wolfSSL 7:481bce714567 693 WOLFSSL_MSG("got custom shutdown event, breaking out");
wolfSSL 7:481bce714567 694 break;
wolfSSL 7:481bce714567 695 }
wolfSSL 7:481bce714567 696
wolfSSL 7:481bce714567 697 length = (int) read(notifyFd, buff, 8192);
wolfSSL 7:481bce714567 698 if (length < 0) {
wolfSSL 7:481bce714567 699 WOLFSSL_MSG("notify read problem, continue");
wolfSSL 7:481bce714567 700 continue;
wolfSSL 7:481bce714567 701 }
wolfSSL 7:481bce714567 702
wolfSSL 7:481bce714567 703 if (SwapLists(crl) < 0) {
wolfSSL 7:481bce714567 704 WOLFSSL_MSG("SwapLists problem, continue");
wolfSSL 7:481bce714567 705 }
wolfSSL 7:481bce714567 706 }
wolfSSL 7:481bce714567 707
wolfSSL 7:481bce714567 708 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 7:481bce714567 709 XFREE(buff, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 7:481bce714567 710 #endif
wolfSSL 7:481bce714567 711
wolfSSL 7:481bce714567 712 if (wd > 0)
wolfSSL 7:481bce714567 713 inotify_rm_watch(notifyFd, wd);
wolfSSL 7:481bce714567 714 close(crl->mfd);
wolfSSL 7:481bce714567 715 close(notifyFd);
wolfSSL 7:481bce714567 716
wolfSSL 7:481bce714567 717 return NULL;
wolfSSL 7:481bce714567 718 }
wolfSSL 7:481bce714567 719
wolfSSL 7:481bce714567 720 #endif /* MACH or linux */
wolfSSL 7:481bce714567 721
wolfSSL 7:481bce714567 722
wolfSSL 7:481bce714567 723 /* Start Monitoring the CRL path(s) in a thread */
wolfSSL 7:481bce714567 724 static int StartMonitorCRL(WOLFSSL_CRL* crl)
wolfSSL 7:481bce714567 725 {
wolfSSL 7:481bce714567 726 int ret = SSL_SUCCESS;
wolfSSL 7:481bce714567 727
wolfSSL 7:481bce714567 728 WOLFSSL_ENTER("StartMonitorCRL");
wolfSSL 7:481bce714567 729
wolfSSL 7:481bce714567 730 if (crl == NULL)
wolfSSL 7:481bce714567 731 return BAD_FUNC_ARG;
wolfSSL 7:481bce714567 732
wolfSSL 7:481bce714567 733 if (crl->tid != 0) {
wolfSSL 7:481bce714567 734 WOLFSSL_MSG("Monitor thread already running");
wolfSSL 7:481bce714567 735 return ret; /* that's ok, someone already started */
wolfSSL 7:481bce714567 736 }
wolfSSL 7:481bce714567 737
wolfSSL 7:481bce714567 738 if (pthread_create(&crl->tid, NULL, DoMonitor, crl) != 0) {
wolfSSL 7:481bce714567 739 WOLFSSL_MSG("Thread creation error");
wolfSSL 7:481bce714567 740 return THREAD_CREATE_E;
wolfSSL 7:481bce714567 741 }
wolfSSL 7:481bce714567 742
wolfSSL 7:481bce714567 743 /* wait for setup to complete */
wolfSSL 7:481bce714567 744 if (wc_LockMutex(&crl->crlLock) != 0) {
wolfSSL 7:481bce714567 745 WOLFSSL_MSG("wc_LockMutex crlLock error");
wolfSSL 7:481bce714567 746 return BAD_MUTEX_E;
wolfSSL 7:481bce714567 747 }
wolfSSL 7:481bce714567 748
wolfSSL 7:481bce714567 749 while (crl->setup == 0) {
wolfSSL 7:481bce714567 750 if (pthread_cond_wait(&crl->cond, &crl->crlLock) != 0) {
wolfSSL 7:481bce714567 751 ret = BAD_COND_E;
wolfSSL 7:481bce714567 752 break;
wolfSSL 7:481bce714567 753 }
wolfSSL 7:481bce714567 754 }
wolfSSL 7:481bce714567 755
wolfSSL 7:481bce714567 756 if (crl->setup < 0)
wolfSSL 7:481bce714567 757 ret = crl->setup; /* store setup error */
wolfSSL 7:481bce714567 758
wolfSSL 7:481bce714567 759 wc_UnLockMutex(&crl->crlLock);
wolfSSL 7:481bce714567 760
wolfSSL 7:481bce714567 761 if (ret < 0) {
wolfSSL 7:481bce714567 762 WOLFSSL_MSG("DoMonitor setup failure");
wolfSSL 7:481bce714567 763 crl->tid = 0; /* thread already done */
wolfSSL 7:481bce714567 764 }
wolfSSL 7:481bce714567 765
wolfSSL 7:481bce714567 766 return ret;
wolfSSL 7:481bce714567 767 }
wolfSSL 7:481bce714567 768
wolfSSL 7:481bce714567 769
wolfSSL 7:481bce714567 770 #else /* HAVE_CRL_MONITOR */
wolfSSL 7:481bce714567 771
wolfSSL 7:481bce714567 772 #ifndef NO_FILESYSTEM
wolfSSL 7:481bce714567 773
wolfSSL 7:481bce714567 774 static int StartMonitorCRL(WOLFSSL_CRL* crl)
wolfSSL 7:481bce714567 775 {
wolfSSL 7:481bce714567 776 (void)crl;
wolfSSL 7:481bce714567 777
wolfSSL 7:481bce714567 778 WOLFSSL_ENTER("StartMonitorCRL");
wolfSSL 7:481bce714567 779 WOLFSSL_MSG("Not compiled in");
wolfSSL 7:481bce714567 780
wolfSSL 7:481bce714567 781 return NOT_COMPILED_IN;
wolfSSL 7:481bce714567 782 }
wolfSSL 7:481bce714567 783
wolfSSL 7:481bce714567 784 #endif /* NO_FILESYSTEM */
wolfSSL 7:481bce714567 785
wolfSSL 7:481bce714567 786 #endif /* HAVE_CRL_MONITOR */
wolfSSL 7:481bce714567 787
wolfSSL 7:481bce714567 788 #if !defined(NO_FILESYSTEM) && !defined(NO_WOLFSSL_DIR)
wolfSSL 7:481bce714567 789
wolfSSL 7:481bce714567 790 /* Load CRL path files of type, SSL_SUCCESS on ok */
wolfSSL 7:481bce714567 791 int LoadCRL(WOLFSSL_CRL* crl, const char* path, int type, int monitor)
wolfSSL 7:481bce714567 792 {
wolfSSL 7:481bce714567 793 int ret = SSL_SUCCESS;
wolfSSL 7:481bce714567 794 char* name = NULL;
wolfSSL 7:481bce714567 795 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 7:481bce714567 796 ReadDirCtx* readCtx = NULL;
wolfSSL 7:481bce714567 797 #else
wolfSSL 7:481bce714567 798 ReadDirCtx readCtx[1];
wolfSSL 7:481bce714567 799 #endif
wolfSSL 7:481bce714567 800
wolfSSL 7:481bce714567 801 WOLFSSL_ENTER("LoadCRL");
wolfSSL 7:481bce714567 802 if (crl == NULL)
wolfSSL 7:481bce714567 803 return BAD_FUNC_ARG;
wolfSSL 7:481bce714567 804
wolfSSL 7:481bce714567 805 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 7:481bce714567 806 ReadDirCtx* readCtx = NULL;
wolfSSL 7:481bce714567 807 readCtx = (char*)XMALLOC(sizeof(ReadDirCtx), ctx->heap,
wolfSSL 7:481bce714567 808 DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 7:481bce714567 809 if (name == NULL)
wolfSSL 7:481bce714567 810 return MEMORY_E;
wolfSSL 7:481bce714567 811 #endif
wolfSSL 7:481bce714567 812
wolfSSL 7:481bce714567 813 /* try to load each regular file in path */
wolfSSL 7:481bce714567 814 ret = wc_ReadDirFirst(readCtx, path, &name);
wolfSSL 7:481bce714567 815 while (ret == 0 && name) {
wolfSSL 7:481bce714567 816 int skip = 0;
wolfSSL 7:481bce714567 817 if (type == SSL_FILETYPE_PEM) {
wolfSSL 7:481bce714567 818 if (XSTRSTR(name, ".pem") == NULL) {
wolfSSL 7:481bce714567 819 WOLFSSL_MSG("not .pem file, skipping");
wolfSSL 7:481bce714567 820 skip = 1;
wolfSSL 7:481bce714567 821 }
wolfSSL 7:481bce714567 822 }
wolfSSL 7:481bce714567 823 else {
wolfSSL 7:481bce714567 824 if (XSTRSTR(name, ".der") == NULL &&
wolfSSL 7:481bce714567 825 XSTRSTR(name, ".crl") == NULL)
wolfSSL 7:481bce714567 826 {
wolfSSL 7:481bce714567 827 WOLFSSL_MSG("not .der or .crl file, skipping");
wolfSSL 7:481bce714567 828 skip = 1;
wolfSSL 7:481bce714567 829 }
wolfSSL 7:481bce714567 830 }
wolfSSL 7:481bce714567 831
wolfSSL 7:481bce714567 832 if (!skip && ProcessFile(NULL, name, type, CRL_TYPE, NULL, 0, crl)
wolfSSL 7:481bce714567 833 != SSL_SUCCESS) {
wolfSSL 7:481bce714567 834 WOLFSSL_MSG("CRL file load failed, continuing");
wolfSSL 7:481bce714567 835 }
wolfSSL 7:481bce714567 836
wolfSSL 7:481bce714567 837 ret = wc_ReadDirNext(readCtx, path, &name);
wolfSSL 7:481bce714567 838 }
wolfSSL 7:481bce714567 839 wc_ReadDirClose(readCtx);
wolfSSL 7:481bce714567 840 ret = SSL_SUCCESS; /* load failures not reported, for backwards compat */
wolfSSL 7:481bce714567 841
wolfSSL 7:481bce714567 842 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 7:481bce714567 843 XFREE(readCtx, ctx->heap, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 7:481bce714567 844 #endif
wolfSSL 7:481bce714567 845
wolfSSL 7:481bce714567 846 if (monitor & WOLFSSL_CRL_MONITOR) {
wolfSSL 7:481bce714567 847 word32 pathLen;
wolfSSL 7:481bce714567 848 char* pathBuf;
wolfSSL 7:481bce714567 849
wolfSSL 7:481bce714567 850 WOLFSSL_MSG("monitor path requested");
wolfSSL 7:481bce714567 851
wolfSSL 7:481bce714567 852 pathLen = (word32)XSTRLEN(path);
wolfSSL 7:481bce714567 853 pathBuf = (char*)XMALLOC(pathLen+1, crl->heap,DYNAMIC_TYPE_CRL_MONITOR);
wolfSSL 7:481bce714567 854 if (pathBuf) {
wolfSSL 7:481bce714567 855 XSTRNCPY(pathBuf, path, pathLen);
wolfSSL 7:481bce714567 856 pathBuf[pathLen] = '\0'; /* Null Terminate */
wolfSSL 7:481bce714567 857
wolfSSL 7:481bce714567 858 if (type == SSL_FILETYPE_PEM) {
wolfSSL 7:481bce714567 859 /* free old path before setting a new one */
wolfSSL 7:481bce714567 860 if (crl->monitors[0].path) {
wolfSSL 7:481bce714567 861 XFREE(crl->monitors[0].path, crl->heap,
wolfSSL 7:481bce714567 862 DYNAMIC_TYPE_CRL_MONITOR);
wolfSSL 7:481bce714567 863 }
wolfSSL 7:481bce714567 864 crl->monitors[0].path = pathBuf;
wolfSSL 7:481bce714567 865 crl->monitors[0].type = SSL_FILETYPE_PEM;
wolfSSL 7:481bce714567 866 } else {
wolfSSL 7:481bce714567 867 /* free old path before setting a new one */
wolfSSL 7:481bce714567 868 if (crl->monitors[1].path) {
wolfSSL 7:481bce714567 869 XFREE(crl->monitors[1].path, crl->heap,
wolfSSL 7:481bce714567 870 DYNAMIC_TYPE_CRL_MONITOR);
wolfSSL 7:481bce714567 871 }
wolfSSL 7:481bce714567 872 crl->monitors[1].path = pathBuf;
wolfSSL 7:481bce714567 873 crl->monitors[1].type = SSL_FILETYPE_ASN1;
wolfSSL 7:481bce714567 874 }
wolfSSL 7:481bce714567 875
wolfSSL 7:481bce714567 876 if (monitor & WOLFSSL_CRL_START_MON) {
wolfSSL 7:481bce714567 877 WOLFSSL_MSG("start monitoring requested");
wolfSSL 7:481bce714567 878
wolfSSL 7:481bce714567 879 ret = StartMonitorCRL(crl);
wolfSSL 7:481bce714567 880 }
wolfSSL 7:481bce714567 881 }
wolfSSL 7:481bce714567 882 else {
wolfSSL 7:481bce714567 883 ret = MEMORY_E;
wolfSSL 7:481bce714567 884 }
wolfSSL 7:481bce714567 885 }
wolfSSL 7:481bce714567 886
wolfSSL 7:481bce714567 887 return ret;
wolfSSL 7:481bce714567 888 }
wolfSSL 7:481bce714567 889
wolfSSL 7:481bce714567 890 #else
wolfSSL 7:481bce714567 891 int LoadCRL(WOLFSSL_CRL* crl, const char* path, int type, int monitor)
wolfSSL 7:481bce714567 892 {
wolfSSL 7:481bce714567 893 (void)crl;
wolfSSL 7:481bce714567 894 (void)path;
wolfSSL 7:481bce714567 895 (void)type;
wolfSSL 7:481bce714567 896 (void)monitor;
wolfSSL 7:481bce714567 897
wolfSSL 7:481bce714567 898 /* stub for scenario where file system is not supported */
wolfSSL 7:481bce714567 899 return NOT_COMPILED_IN;
wolfSSL 7:481bce714567 900 }
wolfSSL 7:481bce714567 901 #endif /* !NO_FILESYSTEM && !NO_WOLFSSL_DIR */
wolfSSL 7:481bce714567 902
wolfSSL 7:481bce714567 903 #endif /* HAVE_CRL */
wolfSSL 7:481bce714567 904 #endif /* !WOLFCRYPT_ONLY */
wolfSSL 7:481bce714567 905