wolf SSL / wolfSSL

wolfSSL SSL/TLS library, support up to TLS1.3

Dependents:   CyaSSL-Twitter-OAuth4Tw Example-client-tls-cert TwitterReader TweetTest ... more

src/crl.c@11:cee25a834751, 2017-05-30 (annotated)

Committer:
wolfSSL
Date:
Tue May 30 01:44:10 2017 +0000
Revision:
11:cee25a834751
wolfSSL 3.11.0

Who changed what in which revision?

UserRevisionLine numberNew contents of line
wolfSSL 11:cee25a834751 1 /* crl.c
wolfSSL 11:cee25a834751 2 *
wolfSSL 11:cee25a834751 3 * Copyright (C) 2006-2016 wolfSSL Inc.
wolfSSL 11:cee25a834751 4 *
wolfSSL 11:cee25a834751 5 * This file is part of wolfSSL.
wolfSSL 11:cee25a834751 6 *
wolfSSL 11:cee25a834751 7 * wolfSSL is free software; you can redistribute it and/or modify
wolfSSL 11:cee25a834751 8 * it under the terms of the GNU General Public License as published by
wolfSSL 11:cee25a834751 9 * the Free Software Foundation; either version 2 of the License, or
wolfSSL 11:cee25a834751 10 * (at your option) any later version.
wolfSSL 11:cee25a834751 11 *
wolfSSL 11:cee25a834751 12 * wolfSSL is distributed in the hope that it will be useful,
wolfSSL 11:cee25a834751 13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
wolfSSL 11:cee25a834751 14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
wolfSSL 11:cee25a834751 15 * GNU General Public License for more details.
wolfSSL 11:cee25a834751 16 *
wolfSSL 11:cee25a834751 17 * You should have received a copy of the GNU General Public License
wolfSSL 11:cee25a834751 18 * along with this program; if not, write to the Free Software
wolfSSL 11:cee25a834751 19 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
wolfSSL 11:cee25a834751 20 */
wolfSSL 11:cee25a834751 21
wolfSSL 11:cee25a834751 22
wolfSSL 11:cee25a834751 23 /* Name change compatibility layer no longer needs included here */
wolfSSL 11:cee25a834751 24
wolfSSL 11:cee25a834751 25 #ifdef HAVE_CONFIG_H
wolfSSL 11:cee25a834751 26 #include <config.h>
wolfSSL 11:cee25a834751 27 #endif
wolfSSL 11:cee25a834751 28
wolfSSL 11:cee25a834751 29 #include <wolfssl/wolfcrypt/settings.h>
wolfSSL 11:cee25a834751 30
wolfSSL 11:cee25a834751 31 #ifndef WOLFCRYPT_ONLY
wolfSSL 11:cee25a834751 32 #ifdef HAVE_CRL
wolfSSL 11:cee25a834751 33
wolfSSL 11:cee25a834751 34 #include <wolfssl/internal.h>
wolfSSL 11:cee25a834751 35 #include <wolfssl/error-ssl.h>
wolfSSL 11:cee25a834751 36
wolfSSL 11:cee25a834751 37 #include <string.h>
wolfSSL 11:cee25a834751 38
wolfSSL 11:cee25a834751 39 #ifdef HAVE_CRL_MONITOR
wolfSSL 11:cee25a834751 40 #if (defined(__MACH__) || defined(__FreeBSD__) || defined(__linux__))
wolfSSL 11:cee25a834751 41 static int StopMonitor(int mfd);
wolfSSL 11:cee25a834751 42 #else
wolfSSL 11:cee25a834751 43 #error "CRL monitor only currently supported on linux or mach"
wolfSSL 11:cee25a834751 44 #endif
wolfSSL 11:cee25a834751 45 #endif /* HAVE_CRL_MONITOR */
wolfSSL 11:cee25a834751 46
wolfSSL 11:cee25a834751 47
wolfSSL 11:cee25a834751 48 /* Initialize CRL members */
wolfSSL 11:cee25a834751 49 int InitCRL(WOLFSSL_CRL* crl, WOLFSSL_CERT_MANAGER* cm)
wolfSSL 11:cee25a834751 50 {
wolfSSL 11:cee25a834751 51 WOLFSSL_ENTER("InitCRL");
wolfSSL 11:cee25a834751 52
wolfSSL 11:cee25a834751 53 crl->heap = cm->heap;
wolfSSL 11:cee25a834751 54 crl->cm = cm;
wolfSSL 11:cee25a834751 55 crl->crlList = NULL;
wolfSSL 11:cee25a834751 56 crl->monitors[0].path = NULL;
wolfSSL 11:cee25a834751 57 crl->monitors[1].path = NULL;
wolfSSL 11:cee25a834751 58 #ifdef HAVE_CRL_MONITOR
wolfSSL 11:cee25a834751 59 crl->tid = 0;
wolfSSL 11:cee25a834751 60 crl->mfd = -1; /* mfd for bsd is kqueue fd, eventfd for linux */
wolfSSL 11:cee25a834751 61 crl->setup = 0; /* thread setup done predicate */
wolfSSL 11:cee25a834751 62 if (pthread_cond_init(&crl->cond, 0) != 0) {
wolfSSL 11:cee25a834751 63 WOLFSSL_MSG("Pthread condition init failed");
wolfSSL 11:cee25a834751 64 return BAD_COND_E;
wolfSSL 11:cee25a834751 65 }
wolfSSL 11:cee25a834751 66 #endif
wolfSSL 11:cee25a834751 67 if (wc_InitMutex(&crl->crlLock) != 0) {
wolfSSL 11:cee25a834751 68 WOLFSSL_MSG("Init Mutex failed");
wolfSSL 11:cee25a834751 69 return BAD_MUTEX_E;
wolfSSL 11:cee25a834751 70 }
wolfSSL 11:cee25a834751 71
wolfSSL 11:cee25a834751 72 return 0;
wolfSSL 11:cee25a834751 73 }
wolfSSL 11:cee25a834751 74
wolfSSL 11:cee25a834751 75
wolfSSL 11:cee25a834751 76 /* Initialize CRL Entry */
wolfSSL 11:cee25a834751 77 static int InitCRL_Entry(CRL_Entry* crle, DecodedCRL* dcrl)
wolfSSL 11:cee25a834751 78 {
wolfSSL 11:cee25a834751 79 WOLFSSL_ENTER("InitCRL_Entry");
wolfSSL 11:cee25a834751 80
wolfSSL 11:cee25a834751 81 XMEMCPY(crle->issuerHash, dcrl->issuerHash, CRL_DIGEST_SIZE);
wolfSSL 11:cee25a834751 82 /* XMEMCPY(crle->crlHash, dcrl->crlHash, CRL_DIGEST_SIZE);
wolfSSL 11:cee25a834751 83 * copy the hash here if needed for optimized comparisons */
wolfSSL 11:cee25a834751 84 XMEMCPY(crle->lastDate, dcrl->lastDate, MAX_DATE_SIZE);
wolfSSL 11:cee25a834751 85 XMEMCPY(crle->nextDate, dcrl->nextDate, MAX_DATE_SIZE);
wolfSSL 11:cee25a834751 86 crle->lastDateFormat = dcrl->lastDateFormat;
wolfSSL 11:cee25a834751 87 crle->nextDateFormat = dcrl->nextDateFormat;
wolfSSL 11:cee25a834751 88
wolfSSL 11:cee25a834751 89 crle->certs = dcrl->certs; /* take ownsership */
wolfSSL 11:cee25a834751 90 dcrl->certs = NULL;
wolfSSL 11:cee25a834751 91 crle->totalCerts = dcrl->totalCerts;
wolfSSL 11:cee25a834751 92
wolfSSL 11:cee25a834751 93 return 0;
wolfSSL 11:cee25a834751 94 }
wolfSSL 11:cee25a834751 95
wolfSSL 11:cee25a834751 96
wolfSSL 11:cee25a834751 97 /* Free all CRL Entry resources */
wolfSSL 11:cee25a834751 98 static void FreeCRL_Entry(CRL_Entry* crle, void* heap)
wolfSSL 11:cee25a834751 99 {
wolfSSL 11:cee25a834751 100 RevokedCert* tmp = crle->certs;
wolfSSL 11:cee25a834751 101
wolfSSL 11:cee25a834751 102 WOLFSSL_ENTER("FreeCRL_Entry");
wolfSSL 11:cee25a834751 103
wolfSSL 11:cee25a834751 104 while(tmp) {
wolfSSL 11:cee25a834751 105 RevokedCert* next = tmp->next;
wolfSSL 11:cee25a834751 106 XFREE(tmp, heap, DYNAMIC_TYPE_REVOKED);
wolfSSL 11:cee25a834751 107 tmp = next;
wolfSSL 11:cee25a834751 108 }
wolfSSL 11:cee25a834751 109
wolfSSL 11:cee25a834751 110 (void)heap;
wolfSSL 11:cee25a834751 111 }
wolfSSL 11:cee25a834751 112
wolfSSL 11:cee25a834751 113
wolfSSL 11:cee25a834751 114
wolfSSL 11:cee25a834751 115 /* Free all CRL resources */
wolfSSL 11:cee25a834751 116 void FreeCRL(WOLFSSL_CRL* crl, int dynamic)
wolfSSL 11:cee25a834751 117 {
wolfSSL 11:cee25a834751 118 CRL_Entry* tmp = crl->crlList;
wolfSSL 11:cee25a834751 119
wolfSSL 11:cee25a834751 120 WOLFSSL_ENTER("FreeCRL");
wolfSSL 11:cee25a834751 121
wolfSSL 11:cee25a834751 122 if (crl->monitors[0].path)
wolfSSL 11:cee25a834751 123 XFREE(crl->monitors[0].path, crl->heap, DYNAMIC_TYPE_CRL_MONITOR);
wolfSSL 11:cee25a834751 124
wolfSSL 11:cee25a834751 125 if (crl->monitors[1].path)
wolfSSL 11:cee25a834751 126 XFREE(crl->monitors[1].path, crl->heap, DYNAMIC_TYPE_CRL_MONITOR);
wolfSSL 11:cee25a834751 127
wolfSSL 11:cee25a834751 128 while(tmp) {
wolfSSL 11:cee25a834751 129 CRL_Entry* next = tmp->next;
wolfSSL 11:cee25a834751 130 FreeCRL_Entry(tmp, crl->heap);
wolfSSL 11:cee25a834751 131 XFREE(tmp, crl->heap, DYNAMIC_TYPE_CRL_ENTRY);
wolfSSL 11:cee25a834751 132 tmp = next;
wolfSSL 11:cee25a834751 133 }
wolfSSL 11:cee25a834751 134
wolfSSL 11:cee25a834751 135 #ifdef HAVE_CRL_MONITOR
wolfSSL 11:cee25a834751 136 if (crl->tid != 0) {
wolfSSL 11:cee25a834751 137 WOLFSSL_MSG("stopping monitor thread");
wolfSSL 11:cee25a834751 138 if (StopMonitor(crl->mfd) == 0)
wolfSSL 11:cee25a834751 139 pthread_join(crl->tid, NULL);
wolfSSL 11:cee25a834751 140 else {
wolfSSL 11:cee25a834751 141 WOLFSSL_MSG("stop monitor failed");
wolfSSL 11:cee25a834751 142 }
wolfSSL 11:cee25a834751 143 }
wolfSSL 11:cee25a834751 144 pthread_cond_destroy(&crl->cond);
wolfSSL 11:cee25a834751 145 #endif
wolfSSL 11:cee25a834751 146 wc_FreeMutex(&crl->crlLock);
wolfSSL 11:cee25a834751 147 if (dynamic) /* free self */
wolfSSL 11:cee25a834751 148 XFREE(crl, crl->heap, DYNAMIC_TYPE_CRL);
wolfSSL 11:cee25a834751 149 }
wolfSSL 11:cee25a834751 150
wolfSSL 11:cee25a834751 151
wolfSSL 11:cee25a834751 152 static int CheckCertCRLList(WOLFSSL_CRL* crl, DecodedCert* cert, int *pFoundEntry)
wolfSSL 11:cee25a834751 153 {
wolfSSL 11:cee25a834751 154 CRL_Entry* crle;
wolfSSL 11:cee25a834751 155 int foundEntry = 0;
wolfSSL 11:cee25a834751 156 int ret = 0;
wolfSSL 11:cee25a834751 157
wolfSSL 11:cee25a834751 158 if (wc_LockMutex(&crl->crlLock) != 0) {
wolfSSL 11:cee25a834751 159 WOLFSSL_MSG("wc_LockMutex failed");
wolfSSL 11:cee25a834751 160 return BAD_MUTEX_E;
wolfSSL 11:cee25a834751 161 }
wolfSSL 11:cee25a834751 162
wolfSSL 11:cee25a834751 163 crle = crl->crlList;
wolfSSL 11:cee25a834751 164
wolfSSL 11:cee25a834751 165 while (crle) {
wolfSSL 11:cee25a834751 166 if (XMEMCMP(crle->issuerHash, cert->issuerHash, CRL_DIGEST_SIZE) == 0) {
wolfSSL 11:cee25a834751 167 int doNextDate = 1;
wolfSSL 11:cee25a834751 168
wolfSSL 11:cee25a834751 169 WOLFSSL_MSG("Found CRL Entry on list");
wolfSSL 11:cee25a834751 170 WOLFSSL_MSG("Checking next date validity");
wolfSSL 11:cee25a834751 171
wolfSSL 11:cee25a834751 172 #ifdef WOLFSSL_NO_CRL_NEXT_DATE
wolfSSL 11:cee25a834751 173 if (crle->nextDateFormat == ASN_OTHER_TYPE)
wolfSSL 11:cee25a834751 174 doNextDate = 0; /* skip */
wolfSSL 11:cee25a834751 175 #endif
wolfSSL 11:cee25a834751 176
wolfSSL 11:cee25a834751 177 if (doNextDate) {
wolfSSL 11:cee25a834751 178 #ifndef NO_ASN_TIME
wolfSSL 11:cee25a834751 179 if (!ValidateDate(crle->nextDate,crle->nextDateFormat, AFTER)) {
wolfSSL 11:cee25a834751 180 WOLFSSL_MSG("CRL next date is no longer valid");
wolfSSL 11:cee25a834751 181 ret = ASN_AFTER_DATE_E;
wolfSSL 11:cee25a834751 182 }
wolfSSL 11:cee25a834751 183 #endif
wolfSSL 11:cee25a834751 184 }
wolfSSL 11:cee25a834751 185 if (ret == 0) {
wolfSSL 11:cee25a834751 186 foundEntry = 1;
wolfSSL 11:cee25a834751 187 }
wolfSSL 11:cee25a834751 188 break;
wolfSSL 11:cee25a834751 189 }
wolfSSL 11:cee25a834751 190 crle = crle->next;
wolfSSL 11:cee25a834751 191 }
wolfSSL 11:cee25a834751 192
wolfSSL 11:cee25a834751 193 if (foundEntry) {
wolfSSL 11:cee25a834751 194 RevokedCert* rc = crle->certs;
wolfSSL 11:cee25a834751 195
wolfSSL 11:cee25a834751 196 while (rc) {
wolfSSL 11:cee25a834751 197 if (XMEMCMP(rc->serialNumber, cert->serial, rc->serialSz) == 0) {
wolfSSL 11:cee25a834751 198 WOLFSSL_MSG("Cert revoked");
wolfSSL 11:cee25a834751 199 ret = CRL_CERT_REVOKED;
wolfSSL 11:cee25a834751 200 break;
wolfSSL 11:cee25a834751 201 }
wolfSSL 11:cee25a834751 202 rc = rc->next;
wolfSSL 11:cee25a834751 203 }
wolfSSL 11:cee25a834751 204 }
wolfSSL 11:cee25a834751 205
wolfSSL 11:cee25a834751 206 wc_UnLockMutex(&crl->crlLock);
wolfSSL 11:cee25a834751 207
wolfSSL 11:cee25a834751 208 *pFoundEntry = foundEntry;
wolfSSL 11:cee25a834751 209
wolfSSL 11:cee25a834751 210 return ret;
wolfSSL 11:cee25a834751 211 }
wolfSSL 11:cee25a834751 212
wolfSSL 11:cee25a834751 213 /* Is the cert ok with CRL, return 0 on success */
wolfSSL 11:cee25a834751 214 int CheckCertCRL(WOLFSSL_CRL* crl, DecodedCert* cert)
wolfSSL 11:cee25a834751 215 {
wolfSSL 11:cee25a834751 216 int foundEntry = 0;
wolfSSL 11:cee25a834751 217 int ret = 0;
wolfSSL 11:cee25a834751 218
wolfSSL 11:cee25a834751 219 WOLFSSL_ENTER("CheckCertCRL");
wolfSSL 11:cee25a834751 220
wolfSSL 11:cee25a834751 221 ret = CheckCertCRLList(crl, cert, &foundEntry);
wolfSSL 11:cee25a834751 222
wolfSSL 11:cee25a834751 223 #ifdef HAVE_CRL_IO
wolfSSL 11:cee25a834751 224 if (foundEntry == 0) {
wolfSSL 11:cee25a834751 225 /* perform embedded lookup */
wolfSSL 11:cee25a834751 226 if (crl->crlIOCb) {
wolfSSL 11:cee25a834751 227 ret = crl->crlIOCb(crl, (const char*)cert->extCrlInfo,
wolfSSL 11:cee25a834751 228 cert->extCrlInfoSz);
wolfSSL 11:cee25a834751 229 if (ret >= 0) {
wolfSSL 11:cee25a834751 230 /* try again */
wolfSSL 11:cee25a834751 231 ret = CheckCertCRLList(crl, cert, &foundEntry);
wolfSSL 11:cee25a834751 232 }
wolfSSL 11:cee25a834751 233 }
wolfSSL 11:cee25a834751 234 }
wolfSSL 11:cee25a834751 235 #endif
wolfSSL 11:cee25a834751 236
wolfSSL 11:cee25a834751 237 if (foundEntry == 0) {
wolfSSL 11:cee25a834751 238 WOLFSSL_MSG("Couldn't find CRL for status check");
wolfSSL 11:cee25a834751 239 ret = CRL_MISSING;
wolfSSL 11:cee25a834751 240
wolfSSL 11:cee25a834751 241 if (crl->cm->cbMissingCRL) {
wolfSSL 11:cee25a834751 242 char url[256];
wolfSSL 11:cee25a834751 243
wolfSSL 11:cee25a834751 244 WOLFSSL_MSG("Issuing missing CRL callback");
wolfSSL 11:cee25a834751 245 url[0] = '\0';
wolfSSL 11:cee25a834751 246 if (cert->extCrlInfoSz < (int)sizeof(url) -1 ) {
wolfSSL 11:cee25a834751 247 XMEMCPY(url, cert->extCrlInfo, cert->extCrlInfoSz);
wolfSSL 11:cee25a834751 248 url[cert->extCrlInfoSz] = '\0';
wolfSSL 11:cee25a834751 249 }
wolfSSL 11:cee25a834751 250 else {
wolfSSL 11:cee25a834751 251 WOLFSSL_MSG("CRL url too long");
wolfSSL 11:cee25a834751 252 }
wolfSSL 11:cee25a834751 253
wolfSSL 11:cee25a834751 254 crl->cm->cbMissingCRL(url);
wolfSSL 11:cee25a834751 255 }
wolfSSL 11:cee25a834751 256 }
wolfSSL 11:cee25a834751 257
wolfSSL 11:cee25a834751 258 return ret;
wolfSSL 11:cee25a834751 259 }
wolfSSL 11:cee25a834751 260
wolfSSL 11:cee25a834751 261
wolfSSL 11:cee25a834751 262 /* Add Decoded CRL, 0 on success */
wolfSSL 11:cee25a834751 263 static int AddCRL(WOLFSSL_CRL* crl, DecodedCRL* dcrl)
wolfSSL 11:cee25a834751 264 {
wolfSSL 11:cee25a834751 265 CRL_Entry* crle;
wolfSSL 11:cee25a834751 266
wolfSSL 11:cee25a834751 267 WOLFSSL_ENTER("AddCRL");
wolfSSL 11:cee25a834751 268
wolfSSL 11:cee25a834751 269 crle = (CRL_Entry*)XMALLOC(sizeof(CRL_Entry), crl->heap, DYNAMIC_TYPE_CRL_ENTRY);
wolfSSL 11:cee25a834751 270 if (crle == NULL) {
wolfSSL 11:cee25a834751 271 WOLFSSL_MSG("alloc CRL Entry failed");
wolfSSL 11:cee25a834751 272 return -1;
wolfSSL 11:cee25a834751 273 }
wolfSSL 11:cee25a834751 274
wolfSSL 11:cee25a834751 275 if (InitCRL_Entry(crle, dcrl) < 0) {
wolfSSL 11:cee25a834751 276 WOLFSSL_MSG("Init CRL Entry failed");
wolfSSL 11:cee25a834751 277 XFREE(crle, crl->heap, DYNAMIC_TYPE_CRL_ENTRY);
wolfSSL 11:cee25a834751 278 return -1;
wolfSSL 11:cee25a834751 279 }
wolfSSL 11:cee25a834751 280
wolfSSL 11:cee25a834751 281 if (wc_LockMutex(&crl->crlLock) != 0) {
wolfSSL 11:cee25a834751 282 WOLFSSL_MSG("wc_LockMutex failed");
wolfSSL 11:cee25a834751 283 FreeCRL_Entry(crle, crl->heap);
wolfSSL 11:cee25a834751 284 XFREE(crle, crl->heap, DYNAMIC_TYPE_CRL_ENTRY);
wolfSSL 11:cee25a834751 285 return BAD_MUTEX_E;
wolfSSL 11:cee25a834751 286 }
wolfSSL 11:cee25a834751 287 crle->next = crl->crlList;
wolfSSL 11:cee25a834751 288 crl->crlList = crle;
wolfSSL 11:cee25a834751 289 wc_UnLockMutex(&crl->crlLock);
wolfSSL 11:cee25a834751 290
wolfSSL 11:cee25a834751 291 return 0;
wolfSSL 11:cee25a834751 292 }
wolfSSL 11:cee25a834751 293
wolfSSL 11:cee25a834751 294
wolfSSL 11:cee25a834751 295 /* Load CRL File of type, SSL_SUCCESS on ok */
wolfSSL 11:cee25a834751 296 int BufferLoadCRL(WOLFSSL_CRL* crl, const byte* buff, long sz, int type)
wolfSSL 11:cee25a834751 297 {
wolfSSL 11:cee25a834751 298 int ret = SSL_SUCCESS;
wolfSSL 11:cee25a834751 299 const byte* myBuffer = buff; /* if DER ok, otherwise switch */
wolfSSL 11:cee25a834751 300 DerBuffer* der = NULL;
wolfSSL 11:cee25a834751 301 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 302 DecodedCRL* dcrl;
wolfSSL 11:cee25a834751 303 #else
wolfSSL 11:cee25a834751 304 DecodedCRL dcrl[1];
wolfSSL 11:cee25a834751 305 #endif
wolfSSL 11:cee25a834751 306
wolfSSL 11:cee25a834751 307 WOLFSSL_ENTER("BufferLoadCRL");
wolfSSL 11:cee25a834751 308
wolfSSL 11:cee25a834751 309 if (crl == NULL || buff == NULL || sz == 0)
wolfSSL 11:cee25a834751 310 return BAD_FUNC_ARG;
wolfSSL 11:cee25a834751 311
wolfSSL 11:cee25a834751 312 if (type == SSL_FILETYPE_PEM) {
wolfSSL 11:cee25a834751 313 int eccKey = 0; /* not used */
wolfSSL 11:cee25a834751 314 EncryptedInfo info;
wolfSSL 11:cee25a834751 315 info.ctx = NULL;
wolfSSL 11:cee25a834751 316
wolfSSL 11:cee25a834751 317 ret = PemToDer(buff, sz, CRL_TYPE, &der, NULL, &info, &eccKey);
wolfSSL 11:cee25a834751 318 if (ret == 0) {
wolfSSL 11:cee25a834751 319 myBuffer = der->buffer;
wolfSSL 11:cee25a834751 320 sz = der->length;
wolfSSL 11:cee25a834751 321 }
wolfSSL 11:cee25a834751 322 else {
wolfSSL 11:cee25a834751 323 WOLFSSL_MSG("Pem to Der failed");
wolfSSL 11:cee25a834751 324 FreeDer(&der);
wolfSSL 11:cee25a834751 325 return -1;
wolfSSL 11:cee25a834751 326 }
wolfSSL 11:cee25a834751 327 }
wolfSSL 11:cee25a834751 328
wolfSSL 11:cee25a834751 329 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 330 dcrl = (DecodedCRL*)XMALLOC(sizeof(DecodedCRL), NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 331 if (dcrl == NULL) {
wolfSSL 11:cee25a834751 332 FreeDer(&der);
wolfSSL 11:cee25a834751 333 return MEMORY_E;
wolfSSL 11:cee25a834751 334 }
wolfSSL 11:cee25a834751 335 #endif
wolfSSL 11:cee25a834751 336
wolfSSL 11:cee25a834751 337 InitDecodedCRL(dcrl, crl->heap);
wolfSSL 11:cee25a834751 338 ret = ParseCRL(dcrl, myBuffer, (word32)sz, crl->cm);
wolfSSL 11:cee25a834751 339 if (ret != 0) {
wolfSSL 11:cee25a834751 340 WOLFSSL_MSG("ParseCRL error");
wolfSSL 11:cee25a834751 341 }
wolfSSL 11:cee25a834751 342 else {
wolfSSL 11:cee25a834751 343 ret = AddCRL(crl, dcrl);
wolfSSL 11:cee25a834751 344 if (ret != 0) {
wolfSSL 11:cee25a834751 345 WOLFSSL_MSG("AddCRL error");
wolfSSL 11:cee25a834751 346 }
wolfSSL 11:cee25a834751 347 }
wolfSSL 11:cee25a834751 348
wolfSSL 11:cee25a834751 349 FreeDecodedCRL(dcrl);
wolfSSL 11:cee25a834751 350
wolfSSL 11:cee25a834751 351 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 352 XFREE(dcrl, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 353 #endif
wolfSSL 11:cee25a834751 354
wolfSSL 11:cee25a834751 355 FreeDer(&der);
wolfSSL 11:cee25a834751 356
wolfSSL 11:cee25a834751 357 return ret ? ret : SSL_SUCCESS; /* convert 0 to SSL_SUCCESS */
wolfSSL 11:cee25a834751 358 }
wolfSSL 11:cee25a834751 359
wolfSSL 11:cee25a834751 360
wolfSSL 11:cee25a834751 361 #ifdef HAVE_CRL_MONITOR
wolfSSL 11:cee25a834751 362
wolfSSL 11:cee25a834751 363
wolfSSL 11:cee25a834751 364 /* Signal Monitor thread is setup, save status to setup flag, 0 on success */
wolfSSL 11:cee25a834751 365 static int SignalSetup(WOLFSSL_CRL* crl, int status)
wolfSSL 11:cee25a834751 366 {
wolfSSL 11:cee25a834751 367 int ret;
wolfSSL 11:cee25a834751 368
wolfSSL 11:cee25a834751 369 /* signal to calling thread we're setup */
wolfSSL 11:cee25a834751 370 if (wc_LockMutex(&crl->crlLock) != 0) {
wolfSSL 11:cee25a834751 371 WOLFSSL_MSG("wc_LockMutex crlLock failed");
wolfSSL 11:cee25a834751 372 return BAD_MUTEX_E;
wolfSSL 11:cee25a834751 373 }
wolfSSL 11:cee25a834751 374
wolfSSL 11:cee25a834751 375 crl->setup = status;
wolfSSL 11:cee25a834751 376 ret = pthread_cond_signal(&crl->cond);
wolfSSL 11:cee25a834751 377
wolfSSL 11:cee25a834751 378 wc_UnLockMutex(&crl->crlLock);
wolfSSL 11:cee25a834751 379
wolfSSL 11:cee25a834751 380 if (ret != 0)
wolfSSL 11:cee25a834751 381 return BAD_COND_E;
wolfSSL 11:cee25a834751 382
wolfSSL 11:cee25a834751 383 return 0;
wolfSSL 11:cee25a834751 384 }
wolfSSL 11:cee25a834751 385
wolfSSL 11:cee25a834751 386
wolfSSL 11:cee25a834751 387 /* read in new CRL entries and save new list */
wolfSSL 11:cee25a834751 388 static int SwapLists(WOLFSSL_CRL* crl)
wolfSSL 11:cee25a834751 389 {
wolfSSL 11:cee25a834751 390 int ret;
wolfSSL 11:cee25a834751 391 CRL_Entry* newList;
wolfSSL 11:cee25a834751 392 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 393 WOLFSSL_CRL* tmp;
wolfSSL 11:cee25a834751 394 #else
wolfSSL 11:cee25a834751 395 WOLFSSL_CRL tmp[1];
wolfSSL 11:cee25a834751 396 #endif
wolfSSL 11:cee25a834751 397
wolfSSL 11:cee25a834751 398 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 399 tmp = (WOLFSSL_CRL*)XMALLOC(sizeof(WOLFSSL_CRL), NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 400 if (tmp == NULL)
wolfSSL 11:cee25a834751 401 return MEMORY_E;
wolfSSL 11:cee25a834751 402 #endif
wolfSSL 11:cee25a834751 403
wolfSSL 11:cee25a834751 404 if (InitCRL(tmp, crl->cm) < 0) {
wolfSSL 11:cee25a834751 405 WOLFSSL_MSG("Init tmp CRL failed");
wolfSSL 11:cee25a834751 406 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 407 XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 408 #endif
wolfSSL 11:cee25a834751 409 return -1;
wolfSSL 11:cee25a834751 410 }
wolfSSL 11:cee25a834751 411
wolfSSL 11:cee25a834751 412 if (crl->monitors[0].path) {
wolfSSL 11:cee25a834751 413 ret = LoadCRL(tmp, crl->monitors[0].path, SSL_FILETYPE_PEM, 0);
wolfSSL 11:cee25a834751 414 if (ret != SSL_SUCCESS) {
wolfSSL 11:cee25a834751 415 WOLFSSL_MSG("PEM LoadCRL on dir change failed");
wolfSSL 11:cee25a834751 416 FreeCRL(tmp, 0);
wolfSSL 11:cee25a834751 417 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 418 XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 419 #endif
wolfSSL 11:cee25a834751 420 return -1;
wolfSSL 11:cee25a834751 421 }
wolfSSL 11:cee25a834751 422 }
wolfSSL 11:cee25a834751 423
wolfSSL 11:cee25a834751 424 if (crl->monitors[1].path) {
wolfSSL 11:cee25a834751 425 ret = LoadCRL(tmp, crl->monitors[1].path, SSL_FILETYPE_ASN1, 0);
wolfSSL 11:cee25a834751 426 if (ret != SSL_SUCCESS) {
wolfSSL 11:cee25a834751 427 WOLFSSL_MSG("DER LoadCRL on dir change failed");
wolfSSL 11:cee25a834751 428 FreeCRL(tmp, 0);
wolfSSL 11:cee25a834751 429 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 430 XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 431 #endif
wolfSSL 11:cee25a834751 432 return -1;
wolfSSL 11:cee25a834751 433 }
wolfSSL 11:cee25a834751 434 }
wolfSSL 11:cee25a834751 435
wolfSSL 11:cee25a834751 436 if (wc_LockMutex(&crl->crlLock) != 0) {
wolfSSL 11:cee25a834751 437 WOLFSSL_MSG("wc_LockMutex failed");
wolfSSL 11:cee25a834751 438 FreeCRL(tmp, 0);
wolfSSL 11:cee25a834751 439 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 440 XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 441 #endif
wolfSSL 11:cee25a834751 442 return -1;
wolfSSL 11:cee25a834751 443 }
wolfSSL 11:cee25a834751 444
wolfSSL 11:cee25a834751 445 newList = tmp->crlList;
wolfSSL 11:cee25a834751 446
wolfSSL 11:cee25a834751 447 /* swap lists */
wolfSSL 11:cee25a834751 448 tmp->crlList = crl->crlList;
wolfSSL 11:cee25a834751 449 crl->crlList = newList;
wolfSSL 11:cee25a834751 450
wolfSSL 11:cee25a834751 451 wc_UnLockMutex(&crl->crlLock);
wolfSSL 11:cee25a834751 452
wolfSSL 11:cee25a834751 453 FreeCRL(tmp, 0);
wolfSSL 11:cee25a834751 454
wolfSSL 11:cee25a834751 455 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 456 XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 457 #endif
wolfSSL 11:cee25a834751 458
wolfSSL 11:cee25a834751 459 return 0;
wolfSSL 11:cee25a834751 460 }
wolfSSL 11:cee25a834751 461
wolfSSL 11:cee25a834751 462
wolfSSL 11:cee25a834751 463 #if (defined(__MACH__) || defined(__FreeBSD__))
wolfSSL 11:cee25a834751 464
wolfSSL 11:cee25a834751 465 #include <sys/types.h>
wolfSSL 11:cee25a834751 466 #include <sys/event.h>
wolfSSL 11:cee25a834751 467 #include <sys/time.h>
wolfSSL 11:cee25a834751 468 #include <fcntl.h>
wolfSSL 11:cee25a834751 469 #include <unistd.h>
wolfSSL 11:cee25a834751 470
wolfSSL 11:cee25a834751 471 #ifdef __MACH__
wolfSSL 11:cee25a834751 472 #define XEVENT_MODE O_EVTONLY
wolfSSL 11:cee25a834751 473 #elif defined(__FreeBSD__)
wolfSSL 11:cee25a834751 474 #define XEVENT_MODE EVFILT_VNODE
wolfSSL 11:cee25a834751 475 #endif
wolfSSL 11:cee25a834751 476
wolfSSL 11:cee25a834751 477
wolfSSL 11:cee25a834751 478 /* we need a unique kqueue user filter fd for crl in case user is doing custom
wolfSSL 11:cee25a834751 479 * events too */
wolfSSL 11:cee25a834751 480 #ifndef CRL_CUSTOM_FD
wolfSSL 11:cee25a834751 481 #define CRL_CUSTOM_FD 123456
wolfSSL 11:cee25a834751 482 #endif
wolfSSL 11:cee25a834751 483
wolfSSL 11:cee25a834751 484
wolfSSL 11:cee25a834751 485 /* shutdown monitor thread, 0 on success */
wolfSSL 11:cee25a834751 486 static int StopMonitor(int mfd)
wolfSSL 11:cee25a834751 487 {
wolfSSL 11:cee25a834751 488 struct kevent change;
wolfSSL 11:cee25a834751 489
wolfSSL 11:cee25a834751 490 /* trigger custom shutdown */
wolfSSL 11:cee25a834751 491 EV_SET(&change, CRL_CUSTOM_FD, EVFILT_USER, 0, NOTE_TRIGGER, 0, NULL);
wolfSSL 11:cee25a834751 492 if (kevent(mfd, &change, 1, NULL, 0, NULL) < 0) {
wolfSSL 11:cee25a834751 493 WOLFSSL_MSG("kevent trigger customer event failed");
wolfSSL 11:cee25a834751 494 return -1;
wolfSSL 11:cee25a834751 495 }
wolfSSL 11:cee25a834751 496
wolfSSL 11:cee25a834751 497 return 0;
wolfSSL 11:cee25a834751 498 }
wolfSSL 11:cee25a834751 499
wolfSSL 11:cee25a834751 500
wolfSSL 11:cee25a834751 501 /* OS X monitoring */
wolfSSL 11:cee25a834751 502 static void* DoMonitor(void* arg)
wolfSSL 11:cee25a834751 503 {
wolfSSL 11:cee25a834751 504 int fPEM, fDER;
wolfSSL 11:cee25a834751 505 struct kevent change;
wolfSSL 11:cee25a834751 506
wolfSSL 11:cee25a834751 507 WOLFSSL_CRL* crl = (WOLFSSL_CRL*)arg;
wolfSSL 11:cee25a834751 508
wolfSSL 11:cee25a834751 509 WOLFSSL_ENTER("DoMonitor");
wolfSSL 11:cee25a834751 510
wolfSSL 11:cee25a834751 511 crl->mfd = kqueue();
wolfSSL 11:cee25a834751 512 if (crl->mfd == -1) {
wolfSSL 11:cee25a834751 513 WOLFSSL_MSG("kqueue failed");
wolfSSL 11:cee25a834751 514 SignalSetup(crl, MONITOR_SETUP_E);
wolfSSL 11:cee25a834751 515 return NULL;
wolfSSL 11:cee25a834751 516 }
wolfSSL 11:cee25a834751 517
wolfSSL 11:cee25a834751 518 /* listen for custom shutdown event */
wolfSSL 11:cee25a834751 519 EV_SET(&change, CRL_CUSTOM_FD, EVFILT_USER, EV_ADD, 0, 0, NULL);
wolfSSL 11:cee25a834751 520 if (kevent(crl->mfd, &change, 1, NULL, 0, NULL) < 0) {
wolfSSL 11:cee25a834751 521 WOLFSSL_MSG("kevent monitor customer event failed");
wolfSSL 11:cee25a834751 522 SignalSetup(crl, MONITOR_SETUP_E);
wolfSSL 11:cee25a834751 523 close(crl->mfd);
wolfSSL 11:cee25a834751 524 return NULL;
wolfSSL 11:cee25a834751 525 }
wolfSSL 11:cee25a834751 526
wolfSSL 11:cee25a834751 527 fPEM = -1;
wolfSSL 11:cee25a834751 528 fDER = -1;
wolfSSL 11:cee25a834751 529
wolfSSL 11:cee25a834751 530 if (crl->monitors[0].path) {
wolfSSL 11:cee25a834751 531 fPEM = open(crl->monitors[0].path, XEVENT_MODE);
wolfSSL 11:cee25a834751 532 if (fPEM == -1) {
wolfSSL 11:cee25a834751 533 WOLFSSL_MSG("PEM event dir open failed");
wolfSSL 11:cee25a834751 534 SignalSetup(crl, MONITOR_SETUP_E);
wolfSSL 11:cee25a834751 535 close(crl->mfd);
wolfSSL 11:cee25a834751 536 return NULL;
wolfSSL 11:cee25a834751 537 }
wolfSSL 11:cee25a834751 538 }
wolfSSL 11:cee25a834751 539
wolfSSL 11:cee25a834751 540 if (crl->monitors[1].path) {
wolfSSL 11:cee25a834751 541 fDER = open(crl->monitors[1].path, XEVENT_MODE);
wolfSSL 11:cee25a834751 542 if (fDER == -1) {
wolfSSL 11:cee25a834751 543 WOLFSSL_MSG("DER event dir open failed");
wolfSSL 11:cee25a834751 544 if (fPEM != -1)
wolfSSL 11:cee25a834751 545 close(fPEM);
wolfSSL 11:cee25a834751 546 close(crl->mfd);
wolfSSL 11:cee25a834751 547 SignalSetup(crl, MONITOR_SETUP_E);
wolfSSL 11:cee25a834751 548 return NULL;
wolfSSL 11:cee25a834751 549 }
wolfSSL 11:cee25a834751 550 }
wolfSSL 11:cee25a834751 551
wolfSSL 11:cee25a834751 552 if (fPEM != -1)
wolfSSL 11:cee25a834751 553 EV_SET(&change, fPEM, EVFILT_VNODE, EV_ADD | EV_ENABLE | EV_ONESHOT,
wolfSSL 11:cee25a834751 554 NOTE_DELETE | NOTE_EXTEND | NOTE_WRITE | NOTE_ATTRIB, 0, 0);
wolfSSL 11:cee25a834751 555
wolfSSL 11:cee25a834751 556 if (fDER != -1)
wolfSSL 11:cee25a834751 557 EV_SET(&change, fDER, EVFILT_VNODE, EV_ADD | EV_ENABLE | EV_ONESHOT,
wolfSSL 11:cee25a834751 558 NOTE_DELETE | NOTE_EXTEND | NOTE_WRITE | NOTE_ATTRIB, 0, 0);
wolfSSL 11:cee25a834751 559
wolfSSL 11:cee25a834751 560 /* signal to calling thread we're setup */
wolfSSL 11:cee25a834751 561 if (SignalSetup(crl, 1) != 0) {
wolfSSL 11:cee25a834751 562 if (fPEM != -1)
wolfSSL 11:cee25a834751 563 close(fPEM);
wolfSSL 11:cee25a834751 564 if (fDER != -1)
wolfSSL 11:cee25a834751 565 close(fDER);
wolfSSL 11:cee25a834751 566 close(crl->mfd);
wolfSSL 11:cee25a834751 567 return NULL;
wolfSSL 11:cee25a834751 568 }
wolfSSL 11:cee25a834751 569
wolfSSL 11:cee25a834751 570 for (;;) {
wolfSSL 11:cee25a834751 571 struct kevent event;
wolfSSL 11:cee25a834751 572 int numEvents = kevent(crl->mfd, &change, 1, &event, 1, NULL);
wolfSSL 11:cee25a834751 573
wolfSSL 11:cee25a834751 574 WOLFSSL_MSG("Got kevent");
wolfSSL 11:cee25a834751 575
wolfSSL 11:cee25a834751 576 if (numEvents == -1) {
wolfSSL 11:cee25a834751 577 WOLFSSL_MSG("kevent problem, continue");
wolfSSL 11:cee25a834751 578 continue;
wolfSSL 11:cee25a834751 579 }
wolfSSL 11:cee25a834751 580
wolfSSL 11:cee25a834751 581 if (event.filter == EVFILT_USER) {
wolfSSL 11:cee25a834751 582 WOLFSSL_MSG("Got user shutdown event, breaking out");
wolfSSL 11:cee25a834751 583 break;
wolfSSL 11:cee25a834751 584 }
wolfSSL 11:cee25a834751 585
wolfSSL 11:cee25a834751 586 if (SwapLists(crl) < 0) {
wolfSSL 11:cee25a834751 587 WOLFSSL_MSG("SwapLists problem, continue");
wolfSSL 11:cee25a834751 588 }
wolfSSL 11:cee25a834751 589 }
wolfSSL 11:cee25a834751 590
wolfSSL 11:cee25a834751 591 if (fPEM != -1)
wolfSSL 11:cee25a834751 592 close(fPEM);
wolfSSL 11:cee25a834751 593 if (fDER != -1)
wolfSSL 11:cee25a834751 594 close(fDER);
wolfSSL 11:cee25a834751 595
wolfSSL 11:cee25a834751 596 close(crl->mfd);
wolfSSL 11:cee25a834751 597
wolfSSL 11:cee25a834751 598 return NULL;
wolfSSL 11:cee25a834751 599 }
wolfSSL 11:cee25a834751 600
wolfSSL 11:cee25a834751 601
wolfSSL 11:cee25a834751 602 #elif defined(__linux__)
wolfSSL 11:cee25a834751 603
wolfSSL 11:cee25a834751 604 #include <sys/types.h>
wolfSSL 11:cee25a834751 605 #include <sys/inotify.h>
wolfSSL 11:cee25a834751 606 #include <sys/eventfd.h>
wolfSSL 11:cee25a834751 607 #include <unistd.h>
wolfSSL 11:cee25a834751 608
wolfSSL 11:cee25a834751 609
wolfSSL 11:cee25a834751 610 #ifndef max
wolfSSL 11:cee25a834751 611 static INLINE int max(int a, int b)
wolfSSL 11:cee25a834751 612 {
wolfSSL 11:cee25a834751 613 return a > b ? a : b;
wolfSSL 11:cee25a834751 614 }
wolfSSL 11:cee25a834751 615 #endif /* max */
wolfSSL 11:cee25a834751 616
wolfSSL 11:cee25a834751 617
wolfSSL 11:cee25a834751 618 /* shutdown monitor thread, 0 on success */
wolfSSL 11:cee25a834751 619 static int StopMonitor(int mfd)
wolfSSL 11:cee25a834751 620 {
wolfSSL 11:cee25a834751 621 word64 w64 = 1;
wolfSSL 11:cee25a834751 622
wolfSSL 11:cee25a834751 623 /* write to our custom event */
wolfSSL 11:cee25a834751 624 if (write(mfd, &w64, sizeof(w64)) < 0) {
wolfSSL 11:cee25a834751 625 WOLFSSL_MSG("StopMonitor write failed");
wolfSSL 11:cee25a834751 626 return -1;
wolfSSL 11:cee25a834751 627 }
wolfSSL 11:cee25a834751 628
wolfSSL 11:cee25a834751 629 return 0;
wolfSSL 11:cee25a834751 630 }
wolfSSL 11:cee25a834751 631
wolfSSL 11:cee25a834751 632
wolfSSL 11:cee25a834751 633 /* linux monitoring */
wolfSSL 11:cee25a834751 634 static void* DoMonitor(void* arg)
wolfSSL 11:cee25a834751 635 {
wolfSSL 11:cee25a834751 636 int notifyFd;
wolfSSL 11:cee25a834751 637 int wd = -1;
wolfSSL 11:cee25a834751 638 WOLFSSL_CRL* crl = (WOLFSSL_CRL*)arg;
wolfSSL 11:cee25a834751 639 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 640 char* buff;
wolfSSL 11:cee25a834751 641 #else
wolfSSL 11:cee25a834751 642 char buff[8192];
wolfSSL 11:cee25a834751 643 #endif
wolfSSL 11:cee25a834751 644
wolfSSL 11:cee25a834751 645 WOLFSSL_ENTER("DoMonitor");
wolfSSL 11:cee25a834751 646
wolfSSL 11:cee25a834751 647 crl->mfd = eventfd(0, 0); /* our custom shutdown event */
wolfSSL 11:cee25a834751 648 if (crl->mfd < 0) {
wolfSSL 11:cee25a834751 649 WOLFSSL_MSG("eventfd failed");
wolfSSL 11:cee25a834751 650 SignalSetup(crl, MONITOR_SETUP_E);
wolfSSL 11:cee25a834751 651 return NULL;
wolfSSL 11:cee25a834751 652 }
wolfSSL 11:cee25a834751 653
wolfSSL 11:cee25a834751 654 notifyFd = inotify_init();
wolfSSL 11:cee25a834751 655 if (notifyFd < 0) {
wolfSSL 11:cee25a834751 656 WOLFSSL_MSG("inotify failed");
wolfSSL 11:cee25a834751 657 close(crl->mfd);
wolfSSL 11:cee25a834751 658 SignalSetup(crl, MONITOR_SETUP_E);
wolfSSL 11:cee25a834751 659 return NULL;
wolfSSL 11:cee25a834751 660 }
wolfSSL 11:cee25a834751 661
wolfSSL 11:cee25a834751 662 if (crl->monitors[0].path) {
wolfSSL 11:cee25a834751 663 wd = inotify_add_watch(notifyFd, crl->monitors[0].path, IN_CLOSE_WRITE |
wolfSSL 11:cee25a834751 664 IN_DELETE);
wolfSSL 11:cee25a834751 665 if (wd < 0) {
wolfSSL 11:cee25a834751 666 WOLFSSL_MSG("PEM notify add watch failed");
wolfSSL 11:cee25a834751 667 close(crl->mfd);
wolfSSL 11:cee25a834751 668 close(notifyFd);
wolfSSL 11:cee25a834751 669 SignalSetup(crl, MONITOR_SETUP_E);
wolfSSL 11:cee25a834751 670 return NULL;
wolfSSL 11:cee25a834751 671 }
wolfSSL 11:cee25a834751 672 }
wolfSSL 11:cee25a834751 673
wolfSSL 11:cee25a834751 674 if (crl->monitors[1].path) {
wolfSSL 11:cee25a834751 675 wd = inotify_add_watch(notifyFd, crl->monitors[1].path, IN_CLOSE_WRITE |
wolfSSL 11:cee25a834751 676 IN_DELETE);
wolfSSL 11:cee25a834751 677 if (wd < 0) {
wolfSSL 11:cee25a834751 678 WOLFSSL_MSG("DER notify add watch failed");
wolfSSL 11:cee25a834751 679 close(crl->mfd);
wolfSSL 11:cee25a834751 680 close(notifyFd);
wolfSSL 11:cee25a834751 681 SignalSetup(crl, MONITOR_SETUP_E);
wolfSSL 11:cee25a834751 682 return NULL;
wolfSSL 11:cee25a834751 683 }
wolfSSL 11:cee25a834751 684 }
wolfSSL 11:cee25a834751 685
wolfSSL 11:cee25a834751 686 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 687 buff = (char*)XMALLOC(8192, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 688 if (buff == NULL)
wolfSSL 11:cee25a834751 689 return NULL;
wolfSSL 11:cee25a834751 690 #endif
wolfSSL 11:cee25a834751 691
wolfSSL 11:cee25a834751 692 /* signal to calling thread we're setup */
wolfSSL 11:cee25a834751 693 if (SignalSetup(crl, 1) != 0) {
wolfSSL 11:cee25a834751 694 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 695 XFREE(buff, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 696 #endif
wolfSSL 11:cee25a834751 697
wolfSSL 11:cee25a834751 698 if (wd > 0)
wolfSSL 11:cee25a834751 699 inotify_rm_watch(notifyFd, wd);
wolfSSL 11:cee25a834751 700 close(crl->mfd);
wolfSSL 11:cee25a834751 701 close(notifyFd);
wolfSSL 11:cee25a834751 702 return NULL;
wolfSSL 11:cee25a834751 703 }
wolfSSL 11:cee25a834751 704
wolfSSL 11:cee25a834751 705 for (;;) {
wolfSSL 11:cee25a834751 706 fd_set readfds;
wolfSSL 11:cee25a834751 707 int result;
wolfSSL 11:cee25a834751 708 int length;
wolfSSL 11:cee25a834751 709
wolfSSL 11:cee25a834751 710 FD_ZERO(&readfds);
wolfSSL 11:cee25a834751 711 FD_SET(notifyFd, &readfds);
wolfSSL 11:cee25a834751 712 FD_SET(crl->mfd, &readfds);
wolfSSL 11:cee25a834751 713
wolfSSL 11:cee25a834751 714 result = select(max(notifyFd, crl->mfd) + 1, &readfds, NULL, NULL,NULL);
wolfSSL 11:cee25a834751 715
wolfSSL 11:cee25a834751 716 WOLFSSL_MSG("Got notify event");
wolfSSL 11:cee25a834751 717
wolfSSL 11:cee25a834751 718 if (result < 0) {
wolfSSL 11:cee25a834751 719 WOLFSSL_MSG("select problem, continue");
wolfSSL 11:cee25a834751 720 continue;
wolfSSL 11:cee25a834751 721 }
wolfSSL 11:cee25a834751 722
wolfSSL 11:cee25a834751 723 if (FD_ISSET(crl->mfd, &readfds)) {
wolfSSL 11:cee25a834751 724 WOLFSSL_MSG("got custom shutdown event, breaking out");
wolfSSL 11:cee25a834751 725 break;
wolfSSL 11:cee25a834751 726 }
wolfSSL 11:cee25a834751 727
wolfSSL 11:cee25a834751 728 length = (int) read(notifyFd, buff, 8192);
wolfSSL 11:cee25a834751 729 if (length < 0) {
wolfSSL 11:cee25a834751 730 WOLFSSL_MSG("notify read problem, continue");
wolfSSL 11:cee25a834751 731 continue;
wolfSSL 11:cee25a834751 732 }
wolfSSL 11:cee25a834751 733
wolfSSL 11:cee25a834751 734 if (SwapLists(crl) < 0) {
wolfSSL 11:cee25a834751 735 WOLFSSL_MSG("SwapLists problem, continue");
wolfSSL 11:cee25a834751 736 }
wolfSSL 11:cee25a834751 737 }
wolfSSL 11:cee25a834751 738
wolfSSL 11:cee25a834751 739 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 740 XFREE(buff, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 741 #endif
wolfSSL 11:cee25a834751 742
wolfSSL 11:cee25a834751 743 if (wd > 0)
wolfSSL 11:cee25a834751 744 inotify_rm_watch(notifyFd, wd);
wolfSSL 11:cee25a834751 745 close(crl->mfd);
wolfSSL 11:cee25a834751 746 close(notifyFd);
wolfSSL 11:cee25a834751 747
wolfSSL 11:cee25a834751 748 return NULL;
wolfSSL 11:cee25a834751 749 }
wolfSSL 11:cee25a834751 750
wolfSSL 11:cee25a834751 751 #endif /* MACH or linux */
wolfSSL 11:cee25a834751 752
wolfSSL 11:cee25a834751 753
wolfSSL 11:cee25a834751 754 /* Start Monitoring the CRL path(s) in a thread */
wolfSSL 11:cee25a834751 755 static int StartMonitorCRL(WOLFSSL_CRL* crl)
wolfSSL 11:cee25a834751 756 {
wolfSSL 11:cee25a834751 757 int ret = SSL_SUCCESS;
wolfSSL 11:cee25a834751 758
wolfSSL 11:cee25a834751 759 WOLFSSL_ENTER("StartMonitorCRL");
wolfSSL 11:cee25a834751 760
wolfSSL 11:cee25a834751 761 if (crl == NULL)
wolfSSL 11:cee25a834751 762 return BAD_FUNC_ARG;
wolfSSL 11:cee25a834751 763
wolfSSL 11:cee25a834751 764 if (crl->tid != 0) {
wolfSSL 11:cee25a834751 765 WOLFSSL_MSG("Monitor thread already running");
wolfSSL 11:cee25a834751 766 return ret; /* that's ok, someone already started */
wolfSSL 11:cee25a834751 767 }
wolfSSL 11:cee25a834751 768
wolfSSL 11:cee25a834751 769 if (pthread_create(&crl->tid, NULL, DoMonitor, crl) != 0) {
wolfSSL 11:cee25a834751 770 WOLFSSL_MSG("Thread creation error");
wolfSSL 11:cee25a834751 771 return THREAD_CREATE_E;
wolfSSL 11:cee25a834751 772 }
wolfSSL 11:cee25a834751 773
wolfSSL 11:cee25a834751 774 /* wait for setup to complete */
wolfSSL 11:cee25a834751 775 if (wc_LockMutex(&crl->crlLock) != 0) {
wolfSSL 11:cee25a834751 776 WOLFSSL_MSG("wc_LockMutex crlLock error");
wolfSSL 11:cee25a834751 777 return BAD_MUTEX_E;
wolfSSL 11:cee25a834751 778 }
wolfSSL 11:cee25a834751 779
wolfSSL 11:cee25a834751 780 while (crl->setup == 0) {
wolfSSL 11:cee25a834751 781 if (pthread_cond_wait(&crl->cond, &crl->crlLock) != 0) {
wolfSSL 11:cee25a834751 782 ret = BAD_COND_E;
wolfSSL 11:cee25a834751 783 break;
wolfSSL 11:cee25a834751 784 }
wolfSSL 11:cee25a834751 785 }
wolfSSL 11:cee25a834751 786
wolfSSL 11:cee25a834751 787 if (crl->setup < 0)
wolfSSL 11:cee25a834751 788 ret = crl->setup; /* store setup error */
wolfSSL 11:cee25a834751 789
wolfSSL 11:cee25a834751 790 wc_UnLockMutex(&crl->crlLock);
wolfSSL 11:cee25a834751 791
wolfSSL 11:cee25a834751 792 if (ret < 0) {
wolfSSL 11:cee25a834751 793 WOLFSSL_MSG("DoMonitor setup failure");
wolfSSL 11:cee25a834751 794 crl->tid = 0; /* thread already done */
wolfSSL 11:cee25a834751 795 }
wolfSSL 11:cee25a834751 796
wolfSSL 11:cee25a834751 797 return ret;
wolfSSL 11:cee25a834751 798 }
wolfSSL 11:cee25a834751 799
wolfSSL 11:cee25a834751 800
wolfSSL 11:cee25a834751 801 #else /* HAVE_CRL_MONITOR */
wolfSSL 11:cee25a834751 802
wolfSSL 11:cee25a834751 803 #ifndef NO_FILESYSTEM
wolfSSL 11:cee25a834751 804
wolfSSL 11:cee25a834751 805 static int StartMonitorCRL(WOLFSSL_CRL* crl)
wolfSSL 11:cee25a834751 806 {
wolfSSL 11:cee25a834751 807 (void)crl;
wolfSSL 11:cee25a834751 808
wolfSSL 11:cee25a834751 809 WOLFSSL_ENTER("StartMonitorCRL");
wolfSSL 11:cee25a834751 810 WOLFSSL_MSG("Not compiled in");
wolfSSL 11:cee25a834751 811
wolfSSL 11:cee25a834751 812 return NOT_COMPILED_IN;
wolfSSL 11:cee25a834751 813 }
wolfSSL 11:cee25a834751 814
wolfSSL 11:cee25a834751 815 #endif /* NO_FILESYSTEM */
wolfSSL 11:cee25a834751 816
wolfSSL 11:cee25a834751 817 #endif /* HAVE_CRL_MONITOR */
wolfSSL 11:cee25a834751 818
wolfSSL 11:cee25a834751 819 #if !defined(NO_FILESYSTEM) && !defined(NO_WOLFSSL_DIR)
wolfSSL 11:cee25a834751 820
wolfSSL 11:cee25a834751 821 /* Load CRL path files of type, SSL_SUCCESS on ok */
wolfSSL 11:cee25a834751 822 int LoadCRL(WOLFSSL_CRL* crl, const char* path, int type, int monitor)
wolfSSL 11:cee25a834751 823 {
wolfSSL 11:cee25a834751 824 int ret = SSL_SUCCESS;
wolfSSL 11:cee25a834751 825 char* name = NULL;
wolfSSL 11:cee25a834751 826 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 827 ReadDirCtx* readCtx = NULL;
wolfSSL 11:cee25a834751 828 #else
wolfSSL 11:cee25a834751 829 ReadDirCtx readCtx[1];
wolfSSL 11:cee25a834751 830 #endif
wolfSSL 11:cee25a834751 831
wolfSSL 11:cee25a834751 832 WOLFSSL_ENTER("LoadCRL");
wolfSSL 11:cee25a834751 833 if (crl == NULL)
wolfSSL 11:cee25a834751 834 return BAD_FUNC_ARG;
wolfSSL 11:cee25a834751 835
wolfSSL 11:cee25a834751 836 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 837 readCtx = (ReadDirCtx*)XMALLOC(sizeof(ReadDirCtx), crl->heap,
wolfSSL 11:cee25a834751 838 DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 839 if (readCtx == NULL)
wolfSSL 11:cee25a834751 840 return MEMORY_E;
wolfSSL 11:cee25a834751 841 #endif
wolfSSL 11:cee25a834751 842
wolfSSL 11:cee25a834751 843 /* try to load each regular file in path */
wolfSSL 11:cee25a834751 844 ret = wc_ReadDirFirst(readCtx, path, &name);
wolfSSL 11:cee25a834751 845 while (ret == 0 && name) {
wolfSSL 11:cee25a834751 846 int skip = 0;
wolfSSL 11:cee25a834751 847 if (type == SSL_FILETYPE_PEM) {
wolfSSL 11:cee25a834751 848 if (XSTRSTR(name, ".pem") == NULL) {
wolfSSL 11:cee25a834751 849 WOLFSSL_MSG("not .pem file, skipping");
wolfSSL 11:cee25a834751 850 skip = 1;
wolfSSL 11:cee25a834751 851 }
wolfSSL 11:cee25a834751 852 }
wolfSSL 11:cee25a834751 853 else {
wolfSSL 11:cee25a834751 854 if (XSTRSTR(name, ".der") == NULL &&
wolfSSL 11:cee25a834751 855 XSTRSTR(name, ".crl") == NULL)
wolfSSL 11:cee25a834751 856 {
wolfSSL 11:cee25a834751 857 WOLFSSL_MSG("not .der or .crl file, skipping");
wolfSSL 11:cee25a834751 858 skip = 1;
wolfSSL 11:cee25a834751 859 }
wolfSSL 11:cee25a834751 860 }
wolfSSL 11:cee25a834751 861
wolfSSL 11:cee25a834751 862 if (!skip && ProcessFile(NULL, name, type, CRL_TYPE, NULL, 0, crl)
wolfSSL 11:cee25a834751 863 != SSL_SUCCESS) {
wolfSSL 11:cee25a834751 864 WOLFSSL_MSG("CRL file load failed, continuing");
wolfSSL 11:cee25a834751 865 }
wolfSSL 11:cee25a834751 866
wolfSSL 11:cee25a834751 867 ret = wc_ReadDirNext(readCtx, path, &name);
wolfSSL 11:cee25a834751 868 }
wolfSSL 11:cee25a834751 869 wc_ReadDirClose(readCtx);
wolfSSL 11:cee25a834751 870 ret = SSL_SUCCESS; /* load failures not reported, for backwards compat */
wolfSSL 11:cee25a834751 871
wolfSSL 11:cee25a834751 872 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 11:cee25a834751 873 XFREE(readCtx, ctx->heap, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 11:cee25a834751 874 #endif
wolfSSL 11:cee25a834751 875
wolfSSL 11:cee25a834751 876 if (monitor & WOLFSSL_CRL_MONITOR) {
wolfSSL 11:cee25a834751 877 word32 pathLen;
wolfSSL 11:cee25a834751 878 char* pathBuf;
wolfSSL 11:cee25a834751 879
wolfSSL 11:cee25a834751 880 WOLFSSL_MSG("monitor path requested");
wolfSSL 11:cee25a834751 881
wolfSSL 11:cee25a834751 882 pathLen = (word32)XSTRLEN(path);
wolfSSL 11:cee25a834751 883 pathBuf = (char*)XMALLOC(pathLen+1, crl->heap,DYNAMIC_TYPE_CRL_MONITOR);
wolfSSL 11:cee25a834751 884 if (pathBuf) {
wolfSSL 11:cee25a834751 885 XSTRNCPY(pathBuf, path, pathLen);
wolfSSL 11:cee25a834751 886 pathBuf[pathLen] = '\0'; /* Null Terminate */
wolfSSL 11:cee25a834751 887
wolfSSL 11:cee25a834751 888 if (type == SSL_FILETYPE_PEM) {
wolfSSL 11:cee25a834751 889 /* free old path before setting a new one */
wolfSSL 11:cee25a834751 890 if (crl->monitors[0].path) {
wolfSSL 11:cee25a834751 891 XFREE(crl->monitors[0].path, crl->heap,
wolfSSL 11:cee25a834751 892 DYNAMIC_TYPE_CRL_MONITOR);
wolfSSL 11:cee25a834751 893 }
wolfSSL 11:cee25a834751 894 crl->monitors[0].path = pathBuf;
wolfSSL 11:cee25a834751 895 crl->monitors[0].type = SSL_FILETYPE_PEM;
wolfSSL 11:cee25a834751 896 } else {
wolfSSL 11:cee25a834751 897 /* free old path before setting a new one */
wolfSSL 11:cee25a834751 898 if (crl->monitors[1].path) {
wolfSSL 11:cee25a834751 899 XFREE(crl->monitors[1].path, crl->heap,
wolfSSL 11:cee25a834751 900 DYNAMIC_TYPE_CRL_MONITOR);
wolfSSL 11:cee25a834751 901 }
wolfSSL 11:cee25a834751 902 crl->monitors[1].path = pathBuf;
wolfSSL 11:cee25a834751 903 crl->monitors[1].type = SSL_FILETYPE_ASN1;
wolfSSL 11:cee25a834751 904 }
wolfSSL 11:cee25a834751 905
wolfSSL 11:cee25a834751 906 if (monitor & WOLFSSL_CRL_START_MON) {
wolfSSL 11:cee25a834751 907 WOLFSSL_MSG("start monitoring requested");
wolfSSL 11:cee25a834751 908
wolfSSL 11:cee25a834751 909 ret = StartMonitorCRL(crl);
wolfSSL 11:cee25a834751 910 }
wolfSSL 11:cee25a834751 911 }
wolfSSL 11:cee25a834751 912 else {
wolfSSL 11:cee25a834751 913 ret = MEMORY_E;
wolfSSL 11:cee25a834751 914 }
wolfSSL 11:cee25a834751 915 }
wolfSSL 11:cee25a834751 916
wolfSSL 11:cee25a834751 917 return ret;
wolfSSL 11:cee25a834751 918 }
wolfSSL 11:cee25a834751 919
wolfSSL 11:cee25a834751 920 #else
wolfSSL 11:cee25a834751 921 int LoadCRL(WOLFSSL_CRL* crl, const char* path, int type, int monitor)
wolfSSL 11:cee25a834751 922 {
wolfSSL 11:cee25a834751 923 (void)crl;
wolfSSL 11:cee25a834751 924 (void)path;
wolfSSL 11:cee25a834751 925 (void)type;
wolfSSL 11:cee25a834751 926 (void)monitor;
wolfSSL 11:cee25a834751 927
wolfSSL 11:cee25a834751 928 /* stub for scenario where file system is not supported */
wolfSSL 11:cee25a834751 929 return NOT_COMPILED_IN;
wolfSSL 11:cee25a834751 930 }
wolfSSL 11:cee25a834751 931 #endif /* !NO_FILESYSTEM && !NO_WOLFSSL_DIR */
wolfSSL 11:cee25a834751 932
wolfSSL 11:cee25a834751 933 #endif /* HAVE_CRL */
wolfSSL 11:cee25a834751 934 #endif /* !WOLFCRYPT_ONLY */
wolfSSL 11:cee25a834751 935