wolf SSL / wolfSSL

wolfSSL SSL/TLS library, support up to TLS1.3

Dependents:   CyaSSL-Twitter-OAuth4Tw Example-client-tls-cert TwitterReader TweetTest ... more

src/crl.c@13:f67a6c6013ca, 2017-08-22 (annotated)

Committer:
wolfSSL
Date:
Tue Aug 22 10:48:22 2017 +0000
Revision:
13:f67a6c6013ca
wolfSSL3.12.0 with TLS1.3

Who changed what in which revision?

UserRevisionLine numberNew contents of line
wolfSSL 13:f67a6c6013ca 1 /* crl.c
wolfSSL 13:f67a6c6013ca 2 *
wolfSSL 13:f67a6c6013ca 3 * Copyright (C) 2006-2016 wolfSSL Inc.
wolfSSL 13:f67a6c6013ca 4 *
wolfSSL 13:f67a6c6013ca 5 * This file is part of wolfSSL.
wolfSSL 13:f67a6c6013ca 6 *
wolfSSL 13:f67a6c6013ca 7 * wolfSSL is free software; you can redistribute it and/or modify
wolfSSL 13:f67a6c6013ca 8 * it under the terms of the GNU General Public License as published by
wolfSSL 13:f67a6c6013ca 9 * the Free Software Foundation; either version 2 of the License, or
wolfSSL 13:f67a6c6013ca 10 * (at your option) any later version.
wolfSSL 13:f67a6c6013ca 11 *
wolfSSL 13:f67a6c6013ca 12 * wolfSSL is distributed in the hope that it will be useful,
wolfSSL 13:f67a6c6013ca 13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
wolfSSL 13:f67a6c6013ca 14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
wolfSSL 13:f67a6c6013ca 15 * GNU General Public License for more details.
wolfSSL 13:f67a6c6013ca 16 *
wolfSSL 13:f67a6c6013ca 17 * You should have received a copy of the GNU General Public License
wolfSSL 13:f67a6c6013ca 18 * along with this program; if not, write to the Free Software
wolfSSL 13:f67a6c6013ca 19 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
wolfSSL 13:f67a6c6013ca 20 */
wolfSSL 13:f67a6c6013ca 21
wolfSSL 13:f67a6c6013ca 22
wolfSSL 13:f67a6c6013ca 23 /* Name change compatibility layer no longer needs included here */
wolfSSL 13:f67a6c6013ca 24
wolfSSL 13:f67a6c6013ca 25 #ifdef HAVE_CONFIG_H
wolfSSL 13:f67a6c6013ca 26 #include <config.h>
wolfSSL 13:f67a6c6013ca 27 #endif
wolfSSL 13:f67a6c6013ca 28
wolfSSL 13:f67a6c6013ca 29 #include <wolfssl/wolfcrypt/settings.h>
wolfSSL 13:f67a6c6013ca 30
wolfSSL 13:f67a6c6013ca 31 #ifndef WOLFCRYPT_ONLY
wolfSSL 13:f67a6c6013ca 32 #ifdef HAVE_CRL
wolfSSL 13:f67a6c6013ca 33
wolfSSL 13:f67a6c6013ca 34 #include <wolfssl/internal.h>
wolfSSL 13:f67a6c6013ca 35 #include <wolfssl/error-ssl.h>
wolfSSL 13:f67a6c6013ca 36
wolfSSL 13:f67a6c6013ca 37 #include <string.h>
wolfSSL 13:f67a6c6013ca 38
wolfSSL 13:f67a6c6013ca 39 #ifdef HAVE_CRL_MONITOR
wolfSSL 13:f67a6c6013ca 40 #if (defined(__MACH__) || defined(__FreeBSD__) || defined(__linux__))
wolfSSL 13:f67a6c6013ca 41 static int StopMonitor(int mfd);
wolfSSL 13:f67a6c6013ca 42 #else
wolfSSL 13:f67a6c6013ca 43 #error "CRL monitor only currently supported on linux or mach"
wolfSSL 13:f67a6c6013ca 44 #endif
wolfSSL 13:f67a6c6013ca 45 #endif /* HAVE_CRL_MONITOR */
wolfSSL 13:f67a6c6013ca 46
wolfSSL 13:f67a6c6013ca 47
wolfSSL 13:f67a6c6013ca 48 /* Initialize CRL members */
wolfSSL 13:f67a6c6013ca 49 int InitCRL(WOLFSSL_CRL* crl, WOLFSSL_CERT_MANAGER* cm)
wolfSSL 13:f67a6c6013ca 50 {
wolfSSL 13:f67a6c6013ca 51 WOLFSSL_ENTER("InitCRL");
wolfSSL 13:f67a6c6013ca 52
wolfSSL 13:f67a6c6013ca 53 crl->heap = cm->heap;
wolfSSL 13:f67a6c6013ca 54 crl->cm = cm;
wolfSSL 13:f67a6c6013ca 55 crl->crlList = NULL;
wolfSSL 13:f67a6c6013ca 56 crl->monitors[0].path = NULL;
wolfSSL 13:f67a6c6013ca 57 crl->monitors[1].path = NULL;
wolfSSL 13:f67a6c6013ca 58 #ifdef HAVE_CRL_MONITOR
wolfSSL 13:f67a6c6013ca 59 crl->tid = 0;
wolfSSL 13:f67a6c6013ca 60 crl->mfd = -1; /* mfd for bsd is kqueue fd, eventfd for linux */
wolfSSL 13:f67a6c6013ca 61 crl->setup = 0; /* thread setup done predicate */
wolfSSL 13:f67a6c6013ca 62 if (pthread_cond_init(&crl->cond, 0) != 0) {
wolfSSL 13:f67a6c6013ca 63 WOLFSSL_MSG("Pthread condition init failed");
wolfSSL 13:f67a6c6013ca 64 return BAD_COND_E;
wolfSSL 13:f67a6c6013ca 65 }
wolfSSL 13:f67a6c6013ca 66 #endif
wolfSSL 13:f67a6c6013ca 67 if (wc_InitMutex(&crl->crlLock) != 0) {
wolfSSL 13:f67a6c6013ca 68 WOLFSSL_MSG("Init Mutex failed");
wolfSSL 13:f67a6c6013ca 69 return BAD_MUTEX_E;
wolfSSL 13:f67a6c6013ca 70 }
wolfSSL 13:f67a6c6013ca 71
wolfSSL 13:f67a6c6013ca 72 return 0;
wolfSSL 13:f67a6c6013ca 73 }
wolfSSL 13:f67a6c6013ca 74
wolfSSL 13:f67a6c6013ca 75
wolfSSL 13:f67a6c6013ca 76 /* Initialize CRL Entry */
wolfSSL 13:f67a6c6013ca 77 static int InitCRL_Entry(CRL_Entry* crle, DecodedCRL* dcrl, const byte* buff,
wolfSSL 13:f67a6c6013ca 78 int verified, void* heap)
wolfSSL 13:f67a6c6013ca 79 {
wolfSSL 13:f67a6c6013ca 80 WOLFSSL_ENTER("InitCRL_Entry");
wolfSSL 13:f67a6c6013ca 81
wolfSSL 13:f67a6c6013ca 82 XMEMCPY(crle->issuerHash, dcrl->issuerHash, CRL_DIGEST_SIZE);
wolfSSL 13:f67a6c6013ca 83 /* XMEMCPY(crle->crlHash, dcrl->crlHash, CRL_DIGEST_SIZE);
wolfSSL 13:f67a6c6013ca 84 * copy the hash here if needed for optimized comparisons */
wolfSSL 13:f67a6c6013ca 85 XMEMCPY(crle->lastDate, dcrl->lastDate, MAX_DATE_SIZE);
wolfSSL 13:f67a6c6013ca 86 XMEMCPY(crle->nextDate, dcrl->nextDate, MAX_DATE_SIZE);
wolfSSL 13:f67a6c6013ca 87 crle->lastDateFormat = dcrl->lastDateFormat;
wolfSSL 13:f67a6c6013ca 88 crle->nextDateFormat = dcrl->nextDateFormat;
wolfSSL 13:f67a6c6013ca 89
wolfSSL 13:f67a6c6013ca 90 crle->certs = dcrl->certs; /* take ownsership */
wolfSSL 13:f67a6c6013ca 91 dcrl->certs = NULL;
wolfSSL 13:f67a6c6013ca 92 crle->totalCerts = dcrl->totalCerts;
wolfSSL 13:f67a6c6013ca 93 crle->verified = verified;
wolfSSL 13:f67a6c6013ca 94 if (!verified) {
wolfSSL 13:f67a6c6013ca 95 crle->tbsSz = dcrl->sigIndex - dcrl->certBegin;
wolfSSL 13:f67a6c6013ca 96 crle->signatureSz = dcrl->sigLength;
wolfSSL 13:f67a6c6013ca 97 crle->signatureOID = dcrl->signatureOID;
wolfSSL 13:f67a6c6013ca 98 crle->toBeSigned = (byte*)XMALLOC(crle->tbsSz, heap,
wolfSSL 13:f67a6c6013ca 99 DYNAMIC_TYPE_CRL_ENTRY);
wolfSSL 13:f67a6c6013ca 100 if (crle->toBeSigned == NULL)
wolfSSL 13:f67a6c6013ca 101 return -1;
wolfSSL 13:f67a6c6013ca 102 crle->signature = (byte*)XMALLOC(crle->signatureSz, heap,
wolfSSL 13:f67a6c6013ca 103 DYNAMIC_TYPE_CRL_ENTRY);
wolfSSL 13:f67a6c6013ca 104 if (crle->signature == NULL) {
wolfSSL 13:f67a6c6013ca 105 XFREE(crle->toBeSigned, heap, DYNAMIC_TYPE_CRL_ENTRY);
wolfSSL 13:f67a6c6013ca 106 return -1;
wolfSSL 13:f67a6c6013ca 107 }
wolfSSL 13:f67a6c6013ca 108 XMEMCPY(crle->toBeSigned, buff + dcrl->certBegin, crle->tbsSz);
wolfSSL 13:f67a6c6013ca 109 XMEMCPY(crle->signature, dcrl->signature, crle->signatureSz);
wolfSSL 13:f67a6c6013ca 110 #if !defined(NO_SKID) && defined(CRL_SKID_READY)
wolfSSL 13:f67a6c6013ca 111 crle->extAuthKeyIdSet = dcrl->extAuthKeyIdSet;
wolfSSL 13:f67a6c6013ca 112 if (crle->extAuthKeyIdSet)
wolfSSL 13:f67a6c6013ca 113 XMEMCPY(crle->extAuthKeyId, dcrl->extAuthKeyId, KEYID_SIZE);
wolfSSL 13:f67a6c6013ca 114 #endif
wolfSSL 13:f67a6c6013ca 115 }
wolfSSL 13:f67a6c6013ca 116 else {
wolfSSL 13:f67a6c6013ca 117 crle->toBeSigned = NULL;
wolfSSL 13:f67a6c6013ca 118 crle->signature = NULL;
wolfSSL 13:f67a6c6013ca 119 }
wolfSSL 13:f67a6c6013ca 120
wolfSSL 13:f67a6c6013ca 121 (void)verified;
wolfSSL 13:f67a6c6013ca 122
wolfSSL 13:f67a6c6013ca 123 return 0;
wolfSSL 13:f67a6c6013ca 124 }
wolfSSL 13:f67a6c6013ca 125
wolfSSL 13:f67a6c6013ca 126
wolfSSL 13:f67a6c6013ca 127 /* Free all CRL Entry resources */
wolfSSL 13:f67a6c6013ca 128 static void FreeCRL_Entry(CRL_Entry* crle, void* heap)
wolfSSL 13:f67a6c6013ca 129 {
wolfSSL 13:f67a6c6013ca 130 RevokedCert* tmp = crle->certs;
wolfSSL 13:f67a6c6013ca 131 RevokedCert* next;
wolfSSL 13:f67a6c6013ca 132
wolfSSL 13:f67a6c6013ca 133 WOLFSSL_ENTER("FreeCRL_Entry");
wolfSSL 13:f67a6c6013ca 134
wolfSSL 13:f67a6c6013ca 135 while (tmp) {
wolfSSL 13:f67a6c6013ca 136 next = tmp->next;
wolfSSL 13:f67a6c6013ca 137 XFREE(tmp, heap, DYNAMIC_TYPE_REVOKED);
wolfSSL 13:f67a6c6013ca 138 tmp = next;
wolfSSL 13:f67a6c6013ca 139 }
wolfSSL 13:f67a6c6013ca 140 if (crle->signature != NULL)
wolfSSL 13:f67a6c6013ca 141 XFREE(crle->signature, heap, DYNAMIC_TYPE_REVOKED);
wolfSSL 13:f67a6c6013ca 142 if (crle->toBeSigned != NULL)
wolfSSL 13:f67a6c6013ca 143 XFREE(crle->toBeSigned, heap, DYNAMIC_TYPE_REVOKED);
wolfSSL 13:f67a6c6013ca 144
wolfSSL 13:f67a6c6013ca 145 (void)heap;
wolfSSL 13:f67a6c6013ca 146 }
wolfSSL 13:f67a6c6013ca 147
wolfSSL 13:f67a6c6013ca 148
wolfSSL 13:f67a6c6013ca 149
wolfSSL 13:f67a6c6013ca 150 /* Free all CRL resources */
wolfSSL 13:f67a6c6013ca 151 void FreeCRL(WOLFSSL_CRL* crl, int dynamic)
wolfSSL 13:f67a6c6013ca 152 {
wolfSSL 13:f67a6c6013ca 153 CRL_Entry* tmp = crl->crlList;
wolfSSL 13:f67a6c6013ca 154
wolfSSL 13:f67a6c6013ca 155 WOLFSSL_ENTER("FreeCRL");
wolfSSL 13:f67a6c6013ca 156
wolfSSL 13:f67a6c6013ca 157 if (crl->monitors[0].path)
wolfSSL 13:f67a6c6013ca 158 XFREE(crl->monitors[0].path, crl->heap, DYNAMIC_TYPE_CRL_MONITOR);
wolfSSL 13:f67a6c6013ca 159
wolfSSL 13:f67a6c6013ca 160 if (crl->monitors[1].path)
wolfSSL 13:f67a6c6013ca 161 XFREE(crl->monitors[1].path, crl->heap, DYNAMIC_TYPE_CRL_MONITOR);
wolfSSL 13:f67a6c6013ca 162
wolfSSL 13:f67a6c6013ca 163 while(tmp) {
wolfSSL 13:f67a6c6013ca 164 CRL_Entry* next = tmp->next;
wolfSSL 13:f67a6c6013ca 165 FreeCRL_Entry(tmp, crl->heap);
wolfSSL 13:f67a6c6013ca 166 XFREE(tmp, crl->heap, DYNAMIC_TYPE_CRL_ENTRY);
wolfSSL 13:f67a6c6013ca 167 tmp = next;
wolfSSL 13:f67a6c6013ca 168 }
wolfSSL 13:f67a6c6013ca 169
wolfSSL 13:f67a6c6013ca 170 #ifdef HAVE_CRL_MONITOR
wolfSSL 13:f67a6c6013ca 171 if (crl->tid != 0) {
wolfSSL 13:f67a6c6013ca 172 WOLFSSL_MSG("stopping monitor thread");
wolfSSL 13:f67a6c6013ca 173 if (StopMonitor(crl->mfd) == 0)
wolfSSL 13:f67a6c6013ca 174 pthread_join(crl->tid, NULL);
wolfSSL 13:f67a6c6013ca 175 else {
wolfSSL 13:f67a6c6013ca 176 WOLFSSL_MSG("stop monitor failed");
wolfSSL 13:f67a6c6013ca 177 }
wolfSSL 13:f67a6c6013ca 178 }
wolfSSL 13:f67a6c6013ca 179 pthread_cond_destroy(&crl->cond);
wolfSSL 13:f67a6c6013ca 180 #endif
wolfSSL 13:f67a6c6013ca 181 wc_FreeMutex(&crl->crlLock);
wolfSSL 13:f67a6c6013ca 182 if (dynamic) /* free self */
wolfSSL 13:f67a6c6013ca 183 XFREE(crl, crl->heap, DYNAMIC_TYPE_CRL);
wolfSSL 13:f67a6c6013ca 184 }
wolfSSL 13:f67a6c6013ca 185
wolfSSL 13:f67a6c6013ca 186
wolfSSL 13:f67a6c6013ca 187 static int CheckCertCRLList(WOLFSSL_CRL* crl, DecodedCert* cert, int *pFoundEntry)
wolfSSL 13:f67a6c6013ca 188 {
wolfSSL 13:f67a6c6013ca 189 CRL_Entry* crle;
wolfSSL 13:f67a6c6013ca 190 int foundEntry = 0;
wolfSSL 13:f67a6c6013ca 191 int ret = 0;
wolfSSL 13:f67a6c6013ca 192
wolfSSL 13:f67a6c6013ca 193 if (wc_LockMutex(&crl->crlLock) != 0) {
wolfSSL 13:f67a6c6013ca 194 WOLFSSL_MSG("wc_LockMutex failed");
wolfSSL 13:f67a6c6013ca 195 return BAD_MUTEX_E;
wolfSSL 13:f67a6c6013ca 196 }
wolfSSL 13:f67a6c6013ca 197
wolfSSL 13:f67a6c6013ca 198 crle = crl->crlList;
wolfSSL 13:f67a6c6013ca 199
wolfSSL 13:f67a6c6013ca 200 while (crle) {
wolfSSL 13:f67a6c6013ca 201 if (XMEMCMP(crle->issuerHash, cert->issuerHash, CRL_DIGEST_SIZE) == 0) {
wolfSSL 13:f67a6c6013ca 202 int doNextDate = 1;
wolfSSL 13:f67a6c6013ca 203
wolfSSL 13:f67a6c6013ca 204 WOLFSSL_MSG("Found CRL Entry on list");
wolfSSL 13:f67a6c6013ca 205
wolfSSL 13:f67a6c6013ca 206 if (crle->verified == 0) {
wolfSSL 13:f67a6c6013ca 207 Signer* ca;
wolfSSL 13:f67a6c6013ca 208 #if !defined(NO_SKID) && defined(CRL_SKID_READY)
wolfSSL 13:f67a6c6013ca 209 byte extAuthKeyId[KEYID_SIZE]
wolfSSL 13:f67a6c6013ca 210 #endif
wolfSSL 13:f67a6c6013ca 211 byte issuerHash[CRL_DIGEST_SIZE];
wolfSSL 13:f67a6c6013ca 212 byte* tbs = NULL;
wolfSSL 13:f67a6c6013ca 213 word32 tbsSz = crle->tbsSz;
wolfSSL 13:f67a6c6013ca 214 byte* sig = NULL;
wolfSSL 13:f67a6c6013ca 215 word32 sigSz = crle->signatureSz;
wolfSSL 13:f67a6c6013ca 216 word32 sigOID = crle->signatureOID;
wolfSSL 13:f67a6c6013ca 217 SignatureCtx sigCtx;
wolfSSL 13:f67a6c6013ca 218
wolfSSL 13:f67a6c6013ca 219 tbs = (byte*)XMALLOC(tbsSz, crl->heap, DYNAMIC_TYPE_CRL_ENTRY);
wolfSSL 13:f67a6c6013ca 220 if (tbs == NULL) {
wolfSSL 13:f67a6c6013ca 221 wc_UnLockMutex(&crl->crlLock);
wolfSSL 13:f67a6c6013ca 222 return MEMORY_E;
wolfSSL 13:f67a6c6013ca 223 }
wolfSSL 13:f67a6c6013ca 224 sig = (byte*)XMALLOC(sigSz, crl->heap, DYNAMIC_TYPE_CRL_ENTRY);
wolfSSL 13:f67a6c6013ca 225 if (sig == NULL) {
wolfSSL 13:f67a6c6013ca 226 XFREE(tbs, crl->heap, DYNAMIC_TYPE_CRL_ENTRY);
wolfSSL 13:f67a6c6013ca 227 wc_UnLockMutex(&crl->crlLock);
wolfSSL 13:f67a6c6013ca 228 return MEMORY_E;
wolfSSL 13:f67a6c6013ca 229 }
wolfSSL 13:f67a6c6013ca 230
wolfSSL 13:f67a6c6013ca 231 XMEMCPY(tbs, crle->toBeSigned, tbsSz);
wolfSSL 13:f67a6c6013ca 232 XMEMCPY(sig, crle->signature, sigSz);
wolfSSL 13:f67a6c6013ca 233 #if !defined(NO_SKID) && defined(CRL_SKID_READY)
wolfSSL 13:f67a6c6013ca 234 XMEMCMPY(extAuthKeyId, crle->extAuthKeyId,
wolfSSL 13:f67a6c6013ca 235 sizeof(extAuthKeyId));
wolfSSL 13:f67a6c6013ca 236 #endif
wolfSSL 13:f67a6c6013ca 237 XMEMCPY(issuerHash, crle->issuerHash, sizeof(issuerHash));
wolfSSL 13:f67a6c6013ca 238
wolfSSL 13:f67a6c6013ca 239 wc_UnLockMutex(&crl->crlLock);
wolfSSL 13:f67a6c6013ca 240
wolfSSL 13:f67a6c6013ca 241 #if !defined(NO_SKID) && defined(CRL_SKID_READY)
wolfSSL 13:f67a6c6013ca 242 if (crle->extAuthKeyIdSet)
wolfSSL 13:f67a6c6013ca 243 ca = GetCA(crl->cm, extAuthKeyId);
wolfSSL 13:f67a6c6013ca 244 if (ca == NULL)
wolfSSL 13:f67a6c6013ca 245 ca = GetCAByName(crl->cm, issuerHash);
wolfSSL 13:f67a6c6013ca 246 #else /* NO_SKID */
wolfSSL 13:f67a6c6013ca 247 ca = GetCA(crl->cm, issuerHash);
wolfSSL 13:f67a6c6013ca 248 #endif /* NO_SKID */
wolfSSL 13:f67a6c6013ca 249 if (ca == NULL) {
wolfSSL 13:f67a6c6013ca 250 WOLFSSL_MSG("Did NOT find CRL issuer CA");
wolfSSL 13:f67a6c6013ca 251 return ASN_CRL_NO_SIGNER_E;
wolfSSL 13:f67a6c6013ca 252 }
wolfSSL 13:f67a6c6013ca 253
wolfSSL 13:f67a6c6013ca 254 ret = VerifyCRL_Signature(&sigCtx, tbs, tbsSz, sig, sigSz,
wolfSSL 13:f67a6c6013ca 255 sigOID, ca, crl->heap);
wolfSSL 13:f67a6c6013ca 256
wolfSSL 13:f67a6c6013ca 257 XFREE(sig, crl->heap, DYNAMIC_TYPE_CRL_ENTRY);
wolfSSL 13:f67a6c6013ca 258 XFREE(tbs, crl->heap, DYNAMIC_TYPE_CRL_ENTRY);
wolfSSL 13:f67a6c6013ca 259
wolfSSL 13:f67a6c6013ca 260 if (wc_LockMutex(&crl->crlLock) != 0) {
wolfSSL 13:f67a6c6013ca 261 WOLFSSL_MSG("wc_LockMutex failed");
wolfSSL 13:f67a6c6013ca 262 return BAD_MUTEX_E;
wolfSSL 13:f67a6c6013ca 263 }
wolfSSL 13:f67a6c6013ca 264
wolfSSL 13:f67a6c6013ca 265 crle = crl->crlList;
wolfSSL 13:f67a6c6013ca 266 while (crle) {
wolfSSL 13:f67a6c6013ca 267 if (XMEMCMP(crle->issuerHash, cert->issuerHash,
wolfSSL 13:f67a6c6013ca 268 CRL_DIGEST_SIZE) == 0) {
wolfSSL 13:f67a6c6013ca 269
wolfSSL 13:f67a6c6013ca 270 if (ret == 0)
wolfSSL 13:f67a6c6013ca 271 crle->verified = 1;
wolfSSL 13:f67a6c6013ca 272 else
wolfSSL 13:f67a6c6013ca 273 crle->verified = ret;
wolfSSL 13:f67a6c6013ca 274
wolfSSL 13:f67a6c6013ca 275 XFREE(crle->toBeSigned, crl->heap,
wolfSSL 13:f67a6c6013ca 276 DYNAMIC_TYPE_CRL_ENTRY);
wolfSSL 13:f67a6c6013ca 277 crle->toBeSigned = NULL;
wolfSSL 13:f67a6c6013ca 278 XFREE(crle->signature, crl->heap,
wolfSSL 13:f67a6c6013ca 279 DYNAMIC_TYPE_CRL_ENTRY);
wolfSSL 13:f67a6c6013ca 280 crle->signature = NULL;
wolfSSL 13:f67a6c6013ca 281 break;
wolfSSL 13:f67a6c6013ca 282 }
wolfSSL 13:f67a6c6013ca 283 crle = crle->next;
wolfSSL 13:f67a6c6013ca 284 }
wolfSSL 13:f67a6c6013ca 285 if (crle == NULL || crle->verified < 0)
wolfSSL 13:f67a6c6013ca 286 break;
wolfSSL 13:f67a6c6013ca 287 }
wolfSSL 13:f67a6c6013ca 288 else if (crle->verified < 0) {
wolfSSL 13:f67a6c6013ca 289 WOLFSSL_MSG("Cannot use CRL as it didn't verify");
wolfSSL 13:f67a6c6013ca 290 ret = crle->verified;
wolfSSL 13:f67a6c6013ca 291 break;
wolfSSL 13:f67a6c6013ca 292 }
wolfSSL 13:f67a6c6013ca 293
wolfSSL 13:f67a6c6013ca 294 WOLFSSL_MSG("Checking next date validity");
wolfSSL 13:f67a6c6013ca 295
wolfSSL 13:f67a6c6013ca 296 #ifdef WOLFSSL_NO_CRL_NEXT_DATE
wolfSSL 13:f67a6c6013ca 297 if (crle->nextDateFormat == ASN_OTHER_TYPE)
wolfSSL 13:f67a6c6013ca 298 doNextDate = 0; /* skip */
wolfSSL 13:f67a6c6013ca 299 #endif
wolfSSL 13:f67a6c6013ca 300
wolfSSL 13:f67a6c6013ca 301 if (doNextDate) {
wolfSSL 13:f67a6c6013ca 302 #ifndef NO_ASN_TIME
wolfSSL 13:f67a6c6013ca 303 if (!ValidateDate(crle->nextDate,crle->nextDateFormat, AFTER)) {
wolfSSL 13:f67a6c6013ca 304 WOLFSSL_MSG("CRL next date is no longer valid");
wolfSSL 13:f67a6c6013ca 305 ret = ASN_AFTER_DATE_E;
wolfSSL 13:f67a6c6013ca 306 }
wolfSSL 13:f67a6c6013ca 307 #endif
wolfSSL 13:f67a6c6013ca 308 }
wolfSSL 13:f67a6c6013ca 309 if (ret == 0) {
wolfSSL 13:f67a6c6013ca 310 foundEntry = 1;
wolfSSL 13:f67a6c6013ca 311 }
wolfSSL 13:f67a6c6013ca 312 break;
wolfSSL 13:f67a6c6013ca 313 }
wolfSSL 13:f67a6c6013ca 314 crle = crle->next;
wolfSSL 13:f67a6c6013ca 315 }
wolfSSL 13:f67a6c6013ca 316
wolfSSL 13:f67a6c6013ca 317 if (foundEntry) {
wolfSSL 13:f67a6c6013ca 318 RevokedCert* rc = crle->certs;
wolfSSL 13:f67a6c6013ca 319
wolfSSL 13:f67a6c6013ca 320 while (rc) {
wolfSSL 13:f67a6c6013ca 321 if (rc->serialSz == cert->serialSz &&
wolfSSL 13:f67a6c6013ca 322 XMEMCMP(rc->serialNumber, cert->serial, rc->serialSz) == 0) {
wolfSSL 13:f67a6c6013ca 323 WOLFSSL_MSG("Cert revoked");
wolfSSL 13:f67a6c6013ca 324 ret = CRL_CERT_REVOKED;
wolfSSL 13:f67a6c6013ca 325 break;
wolfSSL 13:f67a6c6013ca 326 }
wolfSSL 13:f67a6c6013ca 327 rc = rc->next;
wolfSSL 13:f67a6c6013ca 328 }
wolfSSL 13:f67a6c6013ca 329 }
wolfSSL 13:f67a6c6013ca 330
wolfSSL 13:f67a6c6013ca 331 wc_UnLockMutex(&crl->crlLock);
wolfSSL 13:f67a6c6013ca 332
wolfSSL 13:f67a6c6013ca 333 *pFoundEntry = foundEntry;
wolfSSL 13:f67a6c6013ca 334
wolfSSL 13:f67a6c6013ca 335 return ret;
wolfSSL 13:f67a6c6013ca 336 }
wolfSSL 13:f67a6c6013ca 337
wolfSSL 13:f67a6c6013ca 338 /* Is the cert ok with CRL, return 0 on success */
wolfSSL 13:f67a6c6013ca 339 int CheckCertCRL(WOLFSSL_CRL* crl, DecodedCert* cert)
wolfSSL 13:f67a6c6013ca 340 {
wolfSSL 13:f67a6c6013ca 341 int foundEntry = 0;
wolfSSL 13:f67a6c6013ca 342 int ret = 0;
wolfSSL 13:f67a6c6013ca 343
wolfSSL 13:f67a6c6013ca 344 WOLFSSL_ENTER("CheckCertCRL");
wolfSSL 13:f67a6c6013ca 345
wolfSSL 13:f67a6c6013ca 346 ret = CheckCertCRLList(crl, cert, &foundEntry);
wolfSSL 13:f67a6c6013ca 347
wolfSSL 13:f67a6c6013ca 348 #ifdef HAVE_CRL_IO
wolfSSL 13:f67a6c6013ca 349 if (foundEntry == 0) {
wolfSSL 13:f67a6c6013ca 350 /* perform embedded lookup */
wolfSSL 13:f67a6c6013ca 351 if (crl->crlIOCb) {
wolfSSL 13:f67a6c6013ca 352 ret = crl->crlIOCb(crl, (const char*)cert->extCrlInfo,
wolfSSL 13:f67a6c6013ca 353 cert->extCrlInfoSz);
wolfSSL 13:f67a6c6013ca 354 if (ret == WOLFSSL_CBIO_ERR_WANT_READ) {
wolfSSL 13:f67a6c6013ca 355 ret = WANT_READ;
wolfSSL 13:f67a6c6013ca 356 }
wolfSSL 13:f67a6c6013ca 357 else if (ret >= 0) {
wolfSSL 13:f67a6c6013ca 358 /* try again */
wolfSSL 13:f67a6c6013ca 359 ret = CheckCertCRLList(crl, cert, &foundEntry);
wolfSSL 13:f67a6c6013ca 360 }
wolfSSL 13:f67a6c6013ca 361 }
wolfSSL 13:f67a6c6013ca 362 }
wolfSSL 13:f67a6c6013ca 363 #endif
wolfSSL 13:f67a6c6013ca 364
wolfSSL 13:f67a6c6013ca 365 if (foundEntry == 0) {
wolfSSL 13:f67a6c6013ca 366 WOLFSSL_MSG("Couldn't find CRL for status check");
wolfSSL 13:f67a6c6013ca 367 ret = CRL_MISSING;
wolfSSL 13:f67a6c6013ca 368
wolfSSL 13:f67a6c6013ca 369 if (crl->cm->cbMissingCRL) {
wolfSSL 13:f67a6c6013ca 370 char url[256];
wolfSSL 13:f67a6c6013ca 371
wolfSSL 13:f67a6c6013ca 372 WOLFSSL_MSG("Issuing missing CRL callback");
wolfSSL 13:f67a6c6013ca 373 url[0] = '\0';
wolfSSL 13:f67a6c6013ca 374 if (cert->extCrlInfoSz < (int)sizeof(url) -1 ) {
wolfSSL 13:f67a6c6013ca 375 XMEMCPY(url, cert->extCrlInfo, cert->extCrlInfoSz);
wolfSSL 13:f67a6c6013ca 376 url[cert->extCrlInfoSz] = '\0';
wolfSSL 13:f67a6c6013ca 377 }
wolfSSL 13:f67a6c6013ca 378 else {
wolfSSL 13:f67a6c6013ca 379 WOLFSSL_MSG("CRL url too long");
wolfSSL 13:f67a6c6013ca 380 }
wolfSSL 13:f67a6c6013ca 381
wolfSSL 13:f67a6c6013ca 382 crl->cm->cbMissingCRL(url);
wolfSSL 13:f67a6c6013ca 383 }
wolfSSL 13:f67a6c6013ca 384 }
wolfSSL 13:f67a6c6013ca 385
wolfSSL 13:f67a6c6013ca 386 return ret;
wolfSSL 13:f67a6c6013ca 387 }
wolfSSL 13:f67a6c6013ca 388
wolfSSL 13:f67a6c6013ca 389
wolfSSL 13:f67a6c6013ca 390 /* Add Decoded CRL, 0 on success */
wolfSSL 13:f67a6c6013ca 391 static int AddCRL(WOLFSSL_CRL* crl, DecodedCRL* dcrl, const byte* buff,
wolfSSL 13:f67a6c6013ca 392 int verified)
wolfSSL 13:f67a6c6013ca 393 {
wolfSSL 13:f67a6c6013ca 394 CRL_Entry* crle;
wolfSSL 13:f67a6c6013ca 395
wolfSSL 13:f67a6c6013ca 396 WOLFSSL_ENTER("AddCRL");
wolfSSL 13:f67a6c6013ca 397
wolfSSL 13:f67a6c6013ca 398 crle = (CRL_Entry*)XMALLOC(sizeof(CRL_Entry), crl->heap, DYNAMIC_TYPE_CRL_ENTRY);
wolfSSL 13:f67a6c6013ca 399 if (crle == NULL) {
wolfSSL 13:f67a6c6013ca 400 WOLFSSL_MSG("alloc CRL Entry failed");
wolfSSL 13:f67a6c6013ca 401 return -1;
wolfSSL 13:f67a6c6013ca 402 }
wolfSSL 13:f67a6c6013ca 403
wolfSSL 13:f67a6c6013ca 404 if (InitCRL_Entry(crle, dcrl, buff, verified, crl->heap) < 0) {
wolfSSL 13:f67a6c6013ca 405 WOLFSSL_MSG("Init CRL Entry failed");
wolfSSL 13:f67a6c6013ca 406 XFREE(crle, crl->heap, DYNAMIC_TYPE_CRL_ENTRY);
wolfSSL 13:f67a6c6013ca 407 return -1;
wolfSSL 13:f67a6c6013ca 408 }
wolfSSL 13:f67a6c6013ca 409
wolfSSL 13:f67a6c6013ca 410 if (wc_LockMutex(&crl->crlLock) != 0) {
wolfSSL 13:f67a6c6013ca 411 WOLFSSL_MSG("wc_LockMutex failed");
wolfSSL 13:f67a6c6013ca 412 FreeCRL_Entry(crle, crl->heap);
wolfSSL 13:f67a6c6013ca 413 XFREE(crle, crl->heap, DYNAMIC_TYPE_CRL_ENTRY);
wolfSSL 13:f67a6c6013ca 414 return BAD_MUTEX_E;
wolfSSL 13:f67a6c6013ca 415 }
wolfSSL 13:f67a6c6013ca 416 crle->next = crl->crlList;
wolfSSL 13:f67a6c6013ca 417 crl->crlList = crle;
wolfSSL 13:f67a6c6013ca 418 wc_UnLockMutex(&crl->crlLock);
wolfSSL 13:f67a6c6013ca 419
wolfSSL 13:f67a6c6013ca 420 return 0;
wolfSSL 13:f67a6c6013ca 421 }
wolfSSL 13:f67a6c6013ca 422
wolfSSL 13:f67a6c6013ca 423
wolfSSL 13:f67a6c6013ca 424 /* Load CRL File of type, SSL_SUCCESS on ok */
wolfSSL 13:f67a6c6013ca 425 int BufferLoadCRL(WOLFSSL_CRL* crl, const byte* buff, long sz, int type,
wolfSSL 13:f67a6c6013ca 426 int noVerify)
wolfSSL 13:f67a6c6013ca 427 {
wolfSSL 13:f67a6c6013ca 428 int ret = SSL_SUCCESS;
wolfSSL 13:f67a6c6013ca 429 const byte* myBuffer = buff; /* if DER ok, otherwise switch */
wolfSSL 13:f67a6c6013ca 430 DerBuffer* der = NULL;
wolfSSL 13:f67a6c6013ca 431 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 13:f67a6c6013ca 432 DecodedCRL* dcrl;
wolfSSL 13:f67a6c6013ca 433 #else
wolfSSL 13:f67a6c6013ca 434 DecodedCRL dcrl[1];
wolfSSL 13:f67a6c6013ca 435 #endif
wolfSSL 13:f67a6c6013ca 436
wolfSSL 13:f67a6c6013ca 437 WOLFSSL_ENTER("BufferLoadCRL");
wolfSSL 13:f67a6c6013ca 438
wolfSSL 13:f67a6c6013ca 439 if (crl == NULL || buff == NULL || sz == 0)
wolfSSL 13:f67a6c6013ca 440 return BAD_FUNC_ARG;
wolfSSL 13:f67a6c6013ca 441
wolfSSL 13:f67a6c6013ca 442 if (type == SSL_FILETYPE_PEM) {
wolfSSL 13:f67a6c6013ca 443 int eccKey = 0; /* not used */
wolfSSL 13:f67a6c6013ca 444 EncryptedInfo info;
wolfSSL 13:f67a6c6013ca 445 info.ctx = NULL;
wolfSSL 13:f67a6c6013ca 446
wolfSSL 13:f67a6c6013ca 447 ret = PemToDer(buff, sz, CRL_TYPE, &der, NULL, &info, &eccKey);
wolfSSL 13:f67a6c6013ca 448 if (ret == 0) {
wolfSSL 13:f67a6c6013ca 449 myBuffer = der->buffer;
wolfSSL 13:f67a6c6013ca 450 sz = der->length;
wolfSSL 13:f67a6c6013ca 451 }
wolfSSL 13:f67a6c6013ca 452 else {
wolfSSL 13:f67a6c6013ca 453 WOLFSSL_MSG("Pem to Der failed");
wolfSSL 13:f67a6c6013ca 454 FreeDer(&der);
wolfSSL 13:f67a6c6013ca 455 return -1;
wolfSSL 13:f67a6c6013ca 456 }
wolfSSL 13:f67a6c6013ca 457 }
wolfSSL 13:f67a6c6013ca 458
wolfSSL 13:f67a6c6013ca 459 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 13:f67a6c6013ca 460 dcrl = (DecodedCRL*)XMALLOC(sizeof(DecodedCRL), NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 13:f67a6c6013ca 461 if (dcrl == NULL) {
wolfSSL 13:f67a6c6013ca 462 FreeDer(&der);
wolfSSL 13:f67a6c6013ca 463 return MEMORY_E;
wolfSSL 13:f67a6c6013ca 464 }
wolfSSL 13:f67a6c6013ca 465 #endif
wolfSSL 13:f67a6c6013ca 466
wolfSSL 13:f67a6c6013ca 467 InitDecodedCRL(dcrl, crl->heap);
wolfSSL 13:f67a6c6013ca 468 ret = ParseCRL(dcrl, myBuffer, (word32)sz, crl->cm);
wolfSSL 13:f67a6c6013ca 469 if (ret != 0 && !(ret == ASN_CRL_NO_SIGNER_E && noVerify)) {
wolfSSL 13:f67a6c6013ca 470 WOLFSSL_MSG("ParseCRL error");
wolfSSL 13:f67a6c6013ca 471 }
wolfSSL 13:f67a6c6013ca 472 else {
wolfSSL 13:f67a6c6013ca 473 ret = AddCRL(crl, dcrl, myBuffer, ret != ASN_CRL_NO_SIGNER_E);
wolfSSL 13:f67a6c6013ca 474 if (ret != 0) {
wolfSSL 13:f67a6c6013ca 475 WOLFSSL_MSG("AddCRL error");
wolfSSL 13:f67a6c6013ca 476 }
wolfSSL 13:f67a6c6013ca 477 }
wolfSSL 13:f67a6c6013ca 478
wolfSSL 13:f67a6c6013ca 479 FreeDecodedCRL(dcrl);
wolfSSL 13:f67a6c6013ca 480
wolfSSL 13:f67a6c6013ca 481 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 13:f67a6c6013ca 482 XFREE(dcrl, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 13:f67a6c6013ca 483 #endif
wolfSSL 13:f67a6c6013ca 484
wolfSSL 13:f67a6c6013ca 485 FreeDer(&der);
wolfSSL 13:f67a6c6013ca 486
wolfSSL 13:f67a6c6013ca 487 return ret ? ret : SSL_SUCCESS; /* convert 0 to SSL_SUCCESS */
wolfSSL 13:f67a6c6013ca 488 }
wolfSSL 13:f67a6c6013ca 489
wolfSSL 13:f67a6c6013ca 490
wolfSSL 13:f67a6c6013ca 491 #ifdef HAVE_CRL_MONITOR
wolfSSL 13:f67a6c6013ca 492
wolfSSL 13:f67a6c6013ca 493
wolfSSL 13:f67a6c6013ca 494 /* Signal Monitor thread is setup, save status to setup flag, 0 on success */
wolfSSL 13:f67a6c6013ca 495 static int SignalSetup(WOLFSSL_CRL* crl, int status)
wolfSSL 13:f67a6c6013ca 496 {
wolfSSL 13:f67a6c6013ca 497 int ret;
wolfSSL 13:f67a6c6013ca 498
wolfSSL 13:f67a6c6013ca 499 /* signal to calling thread we're setup */
wolfSSL 13:f67a6c6013ca 500 if (wc_LockMutex(&crl->crlLock) != 0) {
wolfSSL 13:f67a6c6013ca 501 WOLFSSL_MSG("wc_LockMutex crlLock failed");
wolfSSL 13:f67a6c6013ca 502 return BAD_MUTEX_E;
wolfSSL 13:f67a6c6013ca 503 }
wolfSSL 13:f67a6c6013ca 504
wolfSSL 13:f67a6c6013ca 505 crl->setup = status;
wolfSSL 13:f67a6c6013ca 506 ret = pthread_cond_signal(&crl->cond);
wolfSSL 13:f67a6c6013ca 507
wolfSSL 13:f67a6c6013ca 508 wc_UnLockMutex(&crl->crlLock);
wolfSSL 13:f67a6c6013ca 509
wolfSSL 13:f67a6c6013ca 510 if (ret != 0)
wolfSSL 13:f67a6c6013ca 511 return BAD_COND_E;
wolfSSL 13:f67a6c6013ca 512
wolfSSL 13:f67a6c6013ca 513 return 0;
wolfSSL 13:f67a6c6013ca 514 }
wolfSSL 13:f67a6c6013ca 515
wolfSSL 13:f67a6c6013ca 516
wolfSSL 13:f67a6c6013ca 517 /* read in new CRL entries and save new list */
wolfSSL 13:f67a6c6013ca 518 static int SwapLists(WOLFSSL_CRL* crl)
wolfSSL 13:f67a6c6013ca 519 {
wolfSSL 13:f67a6c6013ca 520 int ret;
wolfSSL 13:f67a6c6013ca 521 CRL_Entry* newList;
wolfSSL 13:f67a6c6013ca 522 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 13:f67a6c6013ca 523 WOLFSSL_CRL* tmp;
wolfSSL 13:f67a6c6013ca 524 #else
wolfSSL 13:f67a6c6013ca 525 WOLFSSL_CRL tmp[1];
wolfSSL 13:f67a6c6013ca 526 #endif
wolfSSL 13:f67a6c6013ca 527
wolfSSL 13:f67a6c6013ca 528 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 13:f67a6c6013ca 529 tmp = (WOLFSSL_CRL*)XMALLOC(sizeof(WOLFSSL_CRL), NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 13:f67a6c6013ca 530 if (tmp == NULL)
wolfSSL 13:f67a6c6013ca 531 return MEMORY_E;
wolfSSL 13:f67a6c6013ca 532 #endif
wolfSSL 13:f67a6c6013ca 533
wolfSSL 13:f67a6c6013ca 534 if (InitCRL(tmp, crl->cm) < 0) {
wolfSSL 13:f67a6c6013ca 535 WOLFSSL_MSG("Init tmp CRL failed");
wolfSSL 13:f67a6c6013ca 536 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 13:f67a6c6013ca 537 XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 13:f67a6c6013ca 538 #endif
wolfSSL 13:f67a6c6013ca 539 return -1;
wolfSSL 13:f67a6c6013ca 540 }
wolfSSL 13:f67a6c6013ca 541
wolfSSL 13:f67a6c6013ca 542 if (crl->monitors[0].path) {
wolfSSL 13:f67a6c6013ca 543 ret = LoadCRL(tmp, crl->monitors[0].path, SSL_FILETYPE_PEM, 0);
wolfSSL 13:f67a6c6013ca 544 if (ret != SSL_SUCCESS) {
wolfSSL 13:f67a6c6013ca 545 WOLFSSL_MSG("PEM LoadCRL on dir change failed");
wolfSSL 13:f67a6c6013ca 546 FreeCRL(tmp, 0);
wolfSSL 13:f67a6c6013ca 547 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 13:f67a6c6013ca 548 XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 13:f67a6c6013ca 549 #endif
wolfSSL 13:f67a6c6013ca 550 return -1;
wolfSSL 13:f67a6c6013ca 551 }
wolfSSL 13:f67a6c6013ca 552 }
wolfSSL 13:f67a6c6013ca 553
wolfSSL 13:f67a6c6013ca 554 if (crl->monitors[1].path) {
wolfSSL 13:f67a6c6013ca 555 ret = LoadCRL(tmp, crl->monitors[1].path, SSL_FILETYPE_ASN1, 0);
wolfSSL 13:f67a6c6013ca 556 if (ret != SSL_SUCCESS) {
wolfSSL 13:f67a6c6013ca 557 WOLFSSL_MSG("DER LoadCRL on dir change failed");
wolfSSL 13:f67a6c6013ca 558 FreeCRL(tmp, 0);
wolfSSL 13:f67a6c6013ca 559 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 13:f67a6c6013ca 560 XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 13:f67a6c6013ca 561 #endif
wolfSSL 13:f67a6c6013ca 562 return -1;
wolfSSL 13:f67a6c6013ca 563 }
wolfSSL 13:f67a6c6013ca 564 }
wolfSSL 13:f67a6c6013ca 565
wolfSSL 13:f67a6c6013ca 566 if (wc_LockMutex(&crl->crlLock) != 0) {
wolfSSL 13:f67a6c6013ca 567 WOLFSSL_MSG("wc_LockMutex failed");
wolfSSL 13:f67a6c6013ca 568 FreeCRL(tmp, 0);
wolfSSL 13:f67a6c6013ca 569 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 13:f67a6c6013ca 570 XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 13:f67a6c6013ca 571 #endif
wolfSSL 13:f67a6c6013ca 572 return -1;
wolfSSL 13:f67a6c6013ca 573 }
wolfSSL 13:f67a6c6013ca 574
wolfSSL 13:f67a6c6013ca 575 newList = tmp->crlList;
wolfSSL 13:f67a6c6013ca 576
wolfSSL 13:f67a6c6013ca 577 /* swap lists */
wolfSSL 13:f67a6c6013ca 578 tmp->crlList = crl->crlList;
wolfSSL 13:f67a6c6013ca 579 crl->crlList = newList;
wolfSSL 13:f67a6c6013ca 580
wolfSSL 13:f67a6c6013ca 581 wc_UnLockMutex(&crl->crlLock);
wolfSSL 13:f67a6c6013ca 582
wolfSSL 13:f67a6c6013ca 583 FreeCRL(tmp, 0);
wolfSSL 13:f67a6c6013ca 584
wolfSSL 13:f67a6c6013ca 585 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 13:f67a6c6013ca 586 XFREE(tmp, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 13:f67a6c6013ca 587 #endif
wolfSSL 13:f67a6c6013ca 588
wolfSSL 13:f67a6c6013ca 589 return 0;
wolfSSL 13:f67a6c6013ca 590 }
wolfSSL 13:f67a6c6013ca 591
wolfSSL 13:f67a6c6013ca 592
wolfSSL 13:f67a6c6013ca 593 #if (defined(__MACH__) || defined(__FreeBSD__))
wolfSSL 13:f67a6c6013ca 594
wolfSSL 13:f67a6c6013ca 595 #include <sys/types.h>
wolfSSL 13:f67a6c6013ca 596 #include <sys/event.h>
wolfSSL 13:f67a6c6013ca 597 #include <sys/time.h>
wolfSSL 13:f67a6c6013ca 598 #include <fcntl.h>
wolfSSL 13:f67a6c6013ca 599 #include <unistd.h>
wolfSSL 13:f67a6c6013ca 600
wolfSSL 13:f67a6c6013ca 601 #ifdef __MACH__
wolfSSL 13:f67a6c6013ca 602 #define XEVENT_MODE O_EVTONLY
wolfSSL 13:f67a6c6013ca 603 #elif defined(__FreeBSD__)
wolfSSL 13:f67a6c6013ca 604 #define XEVENT_MODE EVFILT_VNODE
wolfSSL 13:f67a6c6013ca 605 #endif
wolfSSL 13:f67a6c6013ca 606
wolfSSL 13:f67a6c6013ca 607
wolfSSL 13:f67a6c6013ca 608 /* we need a unique kqueue user filter fd for crl in case user is doing custom
wolfSSL 13:f67a6c6013ca 609 * events too */
wolfSSL 13:f67a6c6013ca 610 #ifndef CRL_CUSTOM_FD
wolfSSL 13:f67a6c6013ca 611 #define CRL_CUSTOM_FD 123456
wolfSSL 13:f67a6c6013ca 612 #endif
wolfSSL 13:f67a6c6013ca 613
wolfSSL 13:f67a6c6013ca 614
wolfSSL 13:f67a6c6013ca 615 /* shutdown monitor thread, 0 on success */
wolfSSL 13:f67a6c6013ca 616 static int StopMonitor(int mfd)
wolfSSL 13:f67a6c6013ca 617 {
wolfSSL 13:f67a6c6013ca 618 struct kevent change;
wolfSSL 13:f67a6c6013ca 619
wolfSSL 13:f67a6c6013ca 620 /* trigger custom shutdown */
wolfSSL 13:f67a6c6013ca 621 EV_SET(&change, CRL_CUSTOM_FD, EVFILT_USER, 0, NOTE_TRIGGER, 0, NULL);
wolfSSL 13:f67a6c6013ca 622 if (kevent(mfd, &change, 1, NULL, 0, NULL) < 0) {
wolfSSL 13:f67a6c6013ca 623 WOLFSSL_MSG("kevent trigger customer event failed");
wolfSSL 13:f67a6c6013ca 624 return -1;
wolfSSL 13:f67a6c6013ca 625 }
wolfSSL 13:f67a6c6013ca 626
wolfSSL 13:f67a6c6013ca 627 return 0;
wolfSSL 13:f67a6c6013ca 628 }
wolfSSL 13:f67a6c6013ca 629
wolfSSL 13:f67a6c6013ca 630
wolfSSL 13:f67a6c6013ca 631 /* OS X monitoring */
wolfSSL 13:f67a6c6013ca 632 static void* DoMonitor(void* arg)
wolfSSL 13:f67a6c6013ca 633 {
wolfSSL 13:f67a6c6013ca 634 int fPEM, fDER;
wolfSSL 13:f67a6c6013ca 635 struct kevent change;
wolfSSL 13:f67a6c6013ca 636
wolfSSL 13:f67a6c6013ca 637 WOLFSSL_CRL* crl = (WOLFSSL_CRL*)arg;
wolfSSL 13:f67a6c6013ca 638
wolfSSL 13:f67a6c6013ca 639 WOLFSSL_ENTER("DoMonitor");
wolfSSL 13:f67a6c6013ca 640
wolfSSL 13:f67a6c6013ca 641 crl->mfd = kqueue();
wolfSSL 13:f67a6c6013ca 642 if (crl->mfd == -1) {
wolfSSL 13:f67a6c6013ca 643 WOLFSSL_MSG("kqueue failed");
wolfSSL 13:f67a6c6013ca 644 SignalSetup(crl, MONITOR_SETUP_E);
wolfSSL 13:f67a6c6013ca 645 return NULL;
wolfSSL 13:f67a6c6013ca 646 }
wolfSSL 13:f67a6c6013ca 647
wolfSSL 13:f67a6c6013ca 648 /* listen for custom shutdown event */
wolfSSL 13:f67a6c6013ca 649 EV_SET(&change, CRL_CUSTOM_FD, EVFILT_USER, EV_ADD, 0, 0, NULL);
wolfSSL 13:f67a6c6013ca 650 if (kevent(crl->mfd, &change, 1, NULL, 0, NULL) < 0) {
wolfSSL 13:f67a6c6013ca 651 WOLFSSL_MSG("kevent monitor customer event failed");
wolfSSL 13:f67a6c6013ca 652 SignalSetup(crl, MONITOR_SETUP_E);
wolfSSL 13:f67a6c6013ca 653 close(crl->mfd);
wolfSSL 13:f67a6c6013ca 654 return NULL;
wolfSSL 13:f67a6c6013ca 655 }
wolfSSL 13:f67a6c6013ca 656
wolfSSL 13:f67a6c6013ca 657 fPEM = -1;
wolfSSL 13:f67a6c6013ca 658 fDER = -1;
wolfSSL 13:f67a6c6013ca 659
wolfSSL 13:f67a6c6013ca 660 if (crl->monitors[0].path) {
wolfSSL 13:f67a6c6013ca 661 fPEM = open(crl->monitors[0].path, XEVENT_MODE);
wolfSSL 13:f67a6c6013ca 662 if (fPEM == -1) {
wolfSSL 13:f67a6c6013ca 663 WOLFSSL_MSG("PEM event dir open failed");
wolfSSL 13:f67a6c6013ca 664 SignalSetup(crl, MONITOR_SETUP_E);
wolfSSL 13:f67a6c6013ca 665 close(crl->mfd);
wolfSSL 13:f67a6c6013ca 666 return NULL;
wolfSSL 13:f67a6c6013ca 667 }
wolfSSL 13:f67a6c6013ca 668 }
wolfSSL 13:f67a6c6013ca 669
wolfSSL 13:f67a6c6013ca 670 if (crl->monitors[1].path) {
wolfSSL 13:f67a6c6013ca 671 fDER = open(crl->monitors[1].path, XEVENT_MODE);
wolfSSL 13:f67a6c6013ca 672 if (fDER == -1) {
wolfSSL 13:f67a6c6013ca 673 WOLFSSL_MSG("DER event dir open failed");
wolfSSL 13:f67a6c6013ca 674 if (fPEM != -1)
wolfSSL 13:f67a6c6013ca 675 close(fPEM);
wolfSSL 13:f67a6c6013ca 676 close(crl->mfd);
wolfSSL 13:f67a6c6013ca 677 SignalSetup(crl, MONITOR_SETUP_E);
wolfSSL 13:f67a6c6013ca 678 return NULL;
wolfSSL 13:f67a6c6013ca 679 }
wolfSSL 13:f67a6c6013ca 680 }
wolfSSL 13:f67a6c6013ca 681
wolfSSL 13:f67a6c6013ca 682 if (fPEM != -1)
wolfSSL 13:f67a6c6013ca 683 EV_SET(&change, fPEM, EVFILT_VNODE, EV_ADD | EV_ENABLE | EV_ONESHOT,
wolfSSL 13:f67a6c6013ca 684 NOTE_DELETE | NOTE_EXTEND | NOTE_WRITE | NOTE_ATTRIB, 0, 0);
wolfSSL 13:f67a6c6013ca 685
wolfSSL 13:f67a6c6013ca 686 if (fDER != -1)
wolfSSL 13:f67a6c6013ca 687 EV_SET(&change, fDER, EVFILT_VNODE, EV_ADD | EV_ENABLE | EV_ONESHOT,
wolfSSL 13:f67a6c6013ca 688 NOTE_DELETE | NOTE_EXTEND | NOTE_WRITE | NOTE_ATTRIB, 0, 0);
wolfSSL 13:f67a6c6013ca 689
wolfSSL 13:f67a6c6013ca 690 /* signal to calling thread we're setup */
wolfSSL 13:f67a6c6013ca 691 if (SignalSetup(crl, 1) != 0) {
wolfSSL 13:f67a6c6013ca 692 if (fPEM != -1)
wolfSSL 13:f67a6c6013ca 693 close(fPEM);
wolfSSL 13:f67a6c6013ca 694 if (fDER != -1)
wolfSSL 13:f67a6c6013ca 695 close(fDER);
wolfSSL 13:f67a6c6013ca 696 close(crl->mfd);
wolfSSL 13:f67a6c6013ca 697 return NULL;
wolfSSL 13:f67a6c6013ca 698 }
wolfSSL 13:f67a6c6013ca 699
wolfSSL 13:f67a6c6013ca 700 for (;;) {
wolfSSL 13:f67a6c6013ca 701 struct kevent event;
wolfSSL 13:f67a6c6013ca 702 int numEvents = kevent(crl->mfd, &change, 1, &event, 1, NULL);
wolfSSL 13:f67a6c6013ca 703
wolfSSL 13:f67a6c6013ca 704 WOLFSSL_MSG("Got kevent");
wolfSSL 13:f67a6c6013ca 705
wolfSSL 13:f67a6c6013ca 706 if (numEvents == -1) {
wolfSSL 13:f67a6c6013ca 707 WOLFSSL_MSG("kevent problem, continue");
wolfSSL 13:f67a6c6013ca 708 continue;
wolfSSL 13:f67a6c6013ca 709 }
wolfSSL 13:f67a6c6013ca 710
wolfSSL 13:f67a6c6013ca 711 if (event.filter == EVFILT_USER) {
wolfSSL 13:f67a6c6013ca 712 WOLFSSL_MSG("Got user shutdown event, breaking out");
wolfSSL 13:f67a6c6013ca 713 break;
wolfSSL 13:f67a6c6013ca 714 }
wolfSSL 13:f67a6c6013ca 715
wolfSSL 13:f67a6c6013ca 716 if (SwapLists(crl) < 0) {
wolfSSL 13:f67a6c6013ca 717 WOLFSSL_MSG("SwapLists problem, continue");
wolfSSL 13:f67a6c6013ca 718 }
wolfSSL 13:f67a6c6013ca 719 }
wolfSSL 13:f67a6c6013ca 720
wolfSSL 13:f67a6c6013ca 721 if (fPEM != -1)
wolfSSL 13:f67a6c6013ca 722 close(fPEM);
wolfSSL 13:f67a6c6013ca 723 if (fDER != -1)
wolfSSL 13:f67a6c6013ca 724 close(fDER);
wolfSSL 13:f67a6c6013ca 725
wolfSSL 13:f67a6c6013ca 726 close(crl->mfd);
wolfSSL 13:f67a6c6013ca 727
wolfSSL 13:f67a6c6013ca 728 return NULL;
wolfSSL 13:f67a6c6013ca 729 }
wolfSSL 13:f67a6c6013ca 730
wolfSSL 13:f67a6c6013ca 731
wolfSSL 13:f67a6c6013ca 732 #elif defined(__linux__)
wolfSSL 13:f67a6c6013ca 733
wolfSSL 13:f67a6c6013ca 734 #include <sys/types.h>
wolfSSL 13:f67a6c6013ca 735 #include <sys/inotify.h>
wolfSSL 13:f67a6c6013ca 736 #include <sys/eventfd.h>
wolfSSL 13:f67a6c6013ca 737 #include <unistd.h>
wolfSSL 13:f67a6c6013ca 738
wolfSSL 13:f67a6c6013ca 739
wolfSSL 13:f67a6c6013ca 740 #ifndef max
wolfSSL 13:f67a6c6013ca 741 static INLINE int max(int a, int b)
wolfSSL 13:f67a6c6013ca 742 {
wolfSSL 13:f67a6c6013ca 743 return a > b ? a : b;
wolfSSL 13:f67a6c6013ca 744 }
wolfSSL 13:f67a6c6013ca 745 #endif /* max */
wolfSSL 13:f67a6c6013ca 746
wolfSSL 13:f67a6c6013ca 747
wolfSSL 13:f67a6c6013ca 748 /* shutdown monitor thread, 0 on success */
wolfSSL 13:f67a6c6013ca 749 static int StopMonitor(int mfd)
wolfSSL 13:f67a6c6013ca 750 {
wolfSSL 13:f67a6c6013ca 751 word64 w64 = 1;
wolfSSL 13:f67a6c6013ca 752
wolfSSL 13:f67a6c6013ca 753 /* write to our custom event */
wolfSSL 13:f67a6c6013ca 754 if (write(mfd, &w64, sizeof(w64)) < 0) {
wolfSSL 13:f67a6c6013ca 755 WOLFSSL_MSG("StopMonitor write failed");
wolfSSL 13:f67a6c6013ca 756 return -1;
wolfSSL 13:f67a6c6013ca 757 }
wolfSSL 13:f67a6c6013ca 758
wolfSSL 13:f67a6c6013ca 759 return 0;
wolfSSL 13:f67a6c6013ca 760 }
wolfSSL 13:f67a6c6013ca 761
wolfSSL 13:f67a6c6013ca 762
wolfSSL 13:f67a6c6013ca 763 /* linux monitoring */
wolfSSL 13:f67a6c6013ca 764 static void* DoMonitor(void* arg)
wolfSSL 13:f67a6c6013ca 765 {
wolfSSL 13:f67a6c6013ca 766 int notifyFd;
wolfSSL 13:f67a6c6013ca 767 int wd = -1;
wolfSSL 13:f67a6c6013ca 768 WOLFSSL_CRL* crl = (WOLFSSL_CRL*)arg;
wolfSSL 13:f67a6c6013ca 769 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 13:f67a6c6013ca 770 char* buff;
wolfSSL 13:f67a6c6013ca 771 #else
wolfSSL 13:f67a6c6013ca 772 char buff[8192];
wolfSSL 13:f67a6c6013ca 773 #endif
wolfSSL 13:f67a6c6013ca 774
wolfSSL 13:f67a6c6013ca 775 WOLFSSL_ENTER("DoMonitor");
wolfSSL 13:f67a6c6013ca 776
wolfSSL 13:f67a6c6013ca 777 crl->mfd = eventfd(0, 0); /* our custom shutdown event */
wolfSSL 13:f67a6c6013ca 778 if (crl->mfd < 0) {
wolfSSL 13:f67a6c6013ca 779 WOLFSSL_MSG("eventfd failed");
wolfSSL 13:f67a6c6013ca 780 SignalSetup(crl, MONITOR_SETUP_E);
wolfSSL 13:f67a6c6013ca 781 return NULL;
wolfSSL 13:f67a6c6013ca 782 }
wolfSSL 13:f67a6c6013ca 783
wolfSSL 13:f67a6c6013ca 784 notifyFd = inotify_init();
wolfSSL 13:f67a6c6013ca 785 if (notifyFd < 0) {
wolfSSL 13:f67a6c6013ca 786 WOLFSSL_MSG("inotify failed");
wolfSSL 13:f67a6c6013ca 787 close(crl->mfd);
wolfSSL 13:f67a6c6013ca 788 SignalSetup(crl, MONITOR_SETUP_E);
wolfSSL 13:f67a6c6013ca 789 return NULL;
wolfSSL 13:f67a6c6013ca 790 }
wolfSSL 13:f67a6c6013ca 791
wolfSSL 13:f67a6c6013ca 792 if (crl->monitors[0].path) {
wolfSSL 13:f67a6c6013ca 793 wd = inotify_add_watch(notifyFd, crl->monitors[0].path, IN_CLOSE_WRITE |
wolfSSL 13:f67a6c6013ca 794 IN_DELETE);
wolfSSL 13:f67a6c6013ca 795 if (wd < 0) {
wolfSSL 13:f67a6c6013ca 796 WOLFSSL_MSG("PEM notify add watch failed");
wolfSSL 13:f67a6c6013ca 797 close(crl->mfd);
wolfSSL 13:f67a6c6013ca 798 close(notifyFd);
wolfSSL 13:f67a6c6013ca 799 SignalSetup(crl, MONITOR_SETUP_E);
wolfSSL 13:f67a6c6013ca 800 return NULL;
wolfSSL 13:f67a6c6013ca 801 }
wolfSSL 13:f67a6c6013ca 802 }
wolfSSL 13:f67a6c6013ca 803
wolfSSL 13:f67a6c6013ca 804 if (crl->monitors[1].path) {
wolfSSL 13:f67a6c6013ca 805 wd = inotify_add_watch(notifyFd, crl->monitors[1].path, IN_CLOSE_WRITE |
wolfSSL 13:f67a6c6013ca 806 IN_DELETE);
wolfSSL 13:f67a6c6013ca 807 if (wd < 0) {
wolfSSL 13:f67a6c6013ca 808 WOLFSSL_MSG("DER notify add watch failed");
wolfSSL 13:f67a6c6013ca 809 close(crl->mfd);
wolfSSL 13:f67a6c6013ca 810 close(notifyFd);
wolfSSL 13:f67a6c6013ca 811 SignalSetup(crl, MONITOR_SETUP_E);
wolfSSL 13:f67a6c6013ca 812 return NULL;
wolfSSL 13:f67a6c6013ca 813 }
wolfSSL 13:f67a6c6013ca 814 }
wolfSSL 13:f67a6c6013ca 815
wolfSSL 13:f67a6c6013ca 816 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 13:f67a6c6013ca 817 buff = (char*)XMALLOC(8192, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 13:f67a6c6013ca 818 if (buff == NULL)
wolfSSL 13:f67a6c6013ca 819 return NULL;
wolfSSL 13:f67a6c6013ca 820 #endif
wolfSSL 13:f67a6c6013ca 821
wolfSSL 13:f67a6c6013ca 822 /* signal to calling thread we're setup */
wolfSSL 13:f67a6c6013ca 823 if (SignalSetup(crl, 1) != 0) {
wolfSSL 13:f67a6c6013ca 824 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 13:f67a6c6013ca 825 XFREE(buff, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 13:f67a6c6013ca 826 #endif
wolfSSL 13:f67a6c6013ca 827
wolfSSL 13:f67a6c6013ca 828 if (wd > 0)
wolfSSL 13:f67a6c6013ca 829 inotify_rm_watch(notifyFd, wd);
wolfSSL 13:f67a6c6013ca 830 close(crl->mfd);
wolfSSL 13:f67a6c6013ca 831 close(notifyFd);
wolfSSL 13:f67a6c6013ca 832 return NULL;
wolfSSL 13:f67a6c6013ca 833 }
wolfSSL 13:f67a6c6013ca 834
wolfSSL 13:f67a6c6013ca 835 for (;;) {
wolfSSL 13:f67a6c6013ca 836 fd_set readfds;
wolfSSL 13:f67a6c6013ca 837 int result;
wolfSSL 13:f67a6c6013ca 838 int length;
wolfSSL 13:f67a6c6013ca 839
wolfSSL 13:f67a6c6013ca 840 FD_ZERO(&readfds);
wolfSSL 13:f67a6c6013ca 841 FD_SET(notifyFd, &readfds);
wolfSSL 13:f67a6c6013ca 842 FD_SET(crl->mfd, &readfds);
wolfSSL 13:f67a6c6013ca 843
wolfSSL 13:f67a6c6013ca 844 result = select(max(notifyFd, crl->mfd) + 1, &readfds, NULL, NULL,NULL);
wolfSSL 13:f67a6c6013ca 845
wolfSSL 13:f67a6c6013ca 846 WOLFSSL_MSG("Got notify event");
wolfSSL 13:f67a6c6013ca 847
wolfSSL 13:f67a6c6013ca 848 if (result < 0) {
wolfSSL 13:f67a6c6013ca 849 WOLFSSL_MSG("select problem, continue");
wolfSSL 13:f67a6c6013ca 850 continue;
wolfSSL 13:f67a6c6013ca 851 }
wolfSSL 13:f67a6c6013ca 852
wolfSSL 13:f67a6c6013ca 853 if (FD_ISSET(crl->mfd, &readfds)) {
wolfSSL 13:f67a6c6013ca 854 WOLFSSL_MSG("got custom shutdown event, breaking out");
wolfSSL 13:f67a6c6013ca 855 break;
wolfSSL 13:f67a6c6013ca 856 }
wolfSSL 13:f67a6c6013ca 857
wolfSSL 13:f67a6c6013ca 858 length = (int) read(notifyFd, buff, 8192);
wolfSSL 13:f67a6c6013ca 859 if (length < 0) {
wolfSSL 13:f67a6c6013ca 860 WOLFSSL_MSG("notify read problem, continue");
wolfSSL 13:f67a6c6013ca 861 continue;
wolfSSL 13:f67a6c6013ca 862 }
wolfSSL 13:f67a6c6013ca 863
wolfSSL 13:f67a6c6013ca 864 if (SwapLists(crl) < 0) {
wolfSSL 13:f67a6c6013ca 865 WOLFSSL_MSG("SwapLists problem, continue");
wolfSSL 13:f67a6c6013ca 866 }
wolfSSL 13:f67a6c6013ca 867 }
wolfSSL 13:f67a6c6013ca 868
wolfSSL 13:f67a6c6013ca 869 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 13:f67a6c6013ca 870 XFREE(buff, NULL, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 13:f67a6c6013ca 871 #endif
wolfSSL 13:f67a6c6013ca 872
wolfSSL 13:f67a6c6013ca 873 if (wd > 0)
wolfSSL 13:f67a6c6013ca 874 inotify_rm_watch(notifyFd, wd);
wolfSSL 13:f67a6c6013ca 875 close(crl->mfd);
wolfSSL 13:f67a6c6013ca 876 close(notifyFd);
wolfSSL 13:f67a6c6013ca 877
wolfSSL 13:f67a6c6013ca 878 return NULL;
wolfSSL 13:f67a6c6013ca 879 }
wolfSSL 13:f67a6c6013ca 880
wolfSSL 13:f67a6c6013ca 881 #endif /* MACH or linux */
wolfSSL 13:f67a6c6013ca 882
wolfSSL 13:f67a6c6013ca 883
wolfSSL 13:f67a6c6013ca 884 /* Start Monitoring the CRL path(s) in a thread */
wolfSSL 13:f67a6c6013ca 885 static int StartMonitorCRL(WOLFSSL_CRL* crl)
wolfSSL 13:f67a6c6013ca 886 {
wolfSSL 13:f67a6c6013ca 887 int ret = SSL_SUCCESS;
wolfSSL 13:f67a6c6013ca 888
wolfSSL 13:f67a6c6013ca 889 WOLFSSL_ENTER("StartMonitorCRL");
wolfSSL 13:f67a6c6013ca 890
wolfSSL 13:f67a6c6013ca 891 if (crl == NULL)
wolfSSL 13:f67a6c6013ca 892 return BAD_FUNC_ARG;
wolfSSL 13:f67a6c6013ca 893
wolfSSL 13:f67a6c6013ca 894 if (crl->tid != 0) {
wolfSSL 13:f67a6c6013ca 895 WOLFSSL_MSG("Monitor thread already running");
wolfSSL 13:f67a6c6013ca 896 return ret; /* that's ok, someone already started */
wolfSSL 13:f67a6c6013ca 897 }
wolfSSL 13:f67a6c6013ca 898
wolfSSL 13:f67a6c6013ca 899 if (pthread_create(&crl->tid, NULL, DoMonitor, crl) != 0) {
wolfSSL 13:f67a6c6013ca 900 WOLFSSL_MSG("Thread creation error");
wolfSSL 13:f67a6c6013ca 901 return THREAD_CREATE_E;
wolfSSL 13:f67a6c6013ca 902 }
wolfSSL 13:f67a6c6013ca 903
wolfSSL 13:f67a6c6013ca 904 /* wait for setup to complete */
wolfSSL 13:f67a6c6013ca 905 if (wc_LockMutex(&crl->crlLock) != 0) {
wolfSSL 13:f67a6c6013ca 906 WOLFSSL_MSG("wc_LockMutex crlLock error");
wolfSSL 13:f67a6c6013ca 907 return BAD_MUTEX_E;
wolfSSL 13:f67a6c6013ca 908 }
wolfSSL 13:f67a6c6013ca 909
wolfSSL 13:f67a6c6013ca 910 while (crl->setup == 0) {
wolfSSL 13:f67a6c6013ca 911 if (pthread_cond_wait(&crl->cond, &crl->crlLock) != 0) {
wolfSSL 13:f67a6c6013ca 912 ret = BAD_COND_E;
wolfSSL 13:f67a6c6013ca 913 break;
wolfSSL 13:f67a6c6013ca 914 }
wolfSSL 13:f67a6c6013ca 915 }
wolfSSL 13:f67a6c6013ca 916
wolfSSL 13:f67a6c6013ca 917 if (crl->setup < 0)
wolfSSL 13:f67a6c6013ca 918 ret = crl->setup; /* store setup error */
wolfSSL 13:f67a6c6013ca 919
wolfSSL 13:f67a6c6013ca 920 wc_UnLockMutex(&crl->crlLock);
wolfSSL 13:f67a6c6013ca 921
wolfSSL 13:f67a6c6013ca 922 if (ret < 0) {
wolfSSL 13:f67a6c6013ca 923 WOLFSSL_MSG("DoMonitor setup failure");
wolfSSL 13:f67a6c6013ca 924 crl->tid = 0; /* thread already done */
wolfSSL 13:f67a6c6013ca 925 }
wolfSSL 13:f67a6c6013ca 926
wolfSSL 13:f67a6c6013ca 927 return ret;
wolfSSL 13:f67a6c6013ca 928 }
wolfSSL 13:f67a6c6013ca 929
wolfSSL 13:f67a6c6013ca 930
wolfSSL 13:f67a6c6013ca 931 #else /* HAVE_CRL_MONITOR */
wolfSSL 13:f67a6c6013ca 932
wolfSSL 13:f67a6c6013ca 933 #ifndef NO_FILESYSTEM
wolfSSL 13:f67a6c6013ca 934
wolfSSL 13:f67a6c6013ca 935 static int StartMonitorCRL(WOLFSSL_CRL* crl)
wolfSSL 13:f67a6c6013ca 936 {
wolfSSL 13:f67a6c6013ca 937 (void)crl;
wolfSSL 13:f67a6c6013ca 938
wolfSSL 13:f67a6c6013ca 939 WOLFSSL_ENTER("StartMonitorCRL");
wolfSSL 13:f67a6c6013ca 940 WOLFSSL_MSG("Not compiled in");
wolfSSL 13:f67a6c6013ca 941
wolfSSL 13:f67a6c6013ca 942 return NOT_COMPILED_IN;
wolfSSL 13:f67a6c6013ca 943 }
wolfSSL 13:f67a6c6013ca 944
wolfSSL 13:f67a6c6013ca 945 #endif /* NO_FILESYSTEM */
wolfSSL 13:f67a6c6013ca 946
wolfSSL 13:f67a6c6013ca 947 #endif /* HAVE_CRL_MONITOR */
wolfSSL 13:f67a6c6013ca 948
wolfSSL 13:f67a6c6013ca 949 #if !defined(NO_FILESYSTEM) && !defined(NO_WOLFSSL_DIR)
wolfSSL 13:f67a6c6013ca 950
wolfSSL 13:f67a6c6013ca 951 /* Load CRL path files of type, SSL_SUCCESS on ok */
wolfSSL 13:f67a6c6013ca 952 int LoadCRL(WOLFSSL_CRL* crl, const char* path, int type, int monitor)
wolfSSL 13:f67a6c6013ca 953 {
wolfSSL 13:f67a6c6013ca 954 int ret = SSL_SUCCESS;
wolfSSL 13:f67a6c6013ca 955 char* name = NULL;
wolfSSL 13:f67a6c6013ca 956 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 13:f67a6c6013ca 957 ReadDirCtx* readCtx = NULL;
wolfSSL 13:f67a6c6013ca 958 #else
wolfSSL 13:f67a6c6013ca 959 ReadDirCtx readCtx[1];
wolfSSL 13:f67a6c6013ca 960 #endif
wolfSSL 13:f67a6c6013ca 961
wolfSSL 13:f67a6c6013ca 962 WOLFSSL_ENTER("LoadCRL");
wolfSSL 13:f67a6c6013ca 963 if (crl == NULL)
wolfSSL 13:f67a6c6013ca 964 return BAD_FUNC_ARG;
wolfSSL 13:f67a6c6013ca 965
wolfSSL 13:f67a6c6013ca 966 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 13:f67a6c6013ca 967 readCtx = (ReadDirCtx*)XMALLOC(sizeof(ReadDirCtx), crl->heap,
wolfSSL 13:f67a6c6013ca 968 DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 13:f67a6c6013ca 969 if (readCtx == NULL)
wolfSSL 13:f67a6c6013ca 970 return MEMORY_E;
wolfSSL 13:f67a6c6013ca 971 #endif
wolfSSL 13:f67a6c6013ca 972
wolfSSL 13:f67a6c6013ca 973 /* try to load each regular file in path */
wolfSSL 13:f67a6c6013ca 974 ret = wc_ReadDirFirst(readCtx, path, &name);
wolfSSL 13:f67a6c6013ca 975 while (ret == 0 && name) {
wolfSSL 13:f67a6c6013ca 976 int skip = 0;
wolfSSL 13:f67a6c6013ca 977 if (type == SSL_FILETYPE_PEM) {
wolfSSL 13:f67a6c6013ca 978 if (XSTRSTR(name, ".pem") == NULL) {
wolfSSL 13:f67a6c6013ca 979 WOLFSSL_MSG("not .pem file, skipping");
wolfSSL 13:f67a6c6013ca 980 skip = 1;
wolfSSL 13:f67a6c6013ca 981 }
wolfSSL 13:f67a6c6013ca 982 }
wolfSSL 13:f67a6c6013ca 983 else {
wolfSSL 13:f67a6c6013ca 984 if (XSTRSTR(name, ".der") == NULL &&
wolfSSL 13:f67a6c6013ca 985 XSTRSTR(name, ".crl") == NULL)
wolfSSL 13:f67a6c6013ca 986 {
wolfSSL 13:f67a6c6013ca 987 WOLFSSL_MSG("not .der or .crl file, skipping");
wolfSSL 13:f67a6c6013ca 988 skip = 1;
wolfSSL 13:f67a6c6013ca 989 }
wolfSSL 13:f67a6c6013ca 990 }
wolfSSL 13:f67a6c6013ca 991
wolfSSL 13:f67a6c6013ca 992 if (!skip && ProcessFile(NULL, name, type, CRL_TYPE, NULL, 0, crl)
wolfSSL 13:f67a6c6013ca 993 != SSL_SUCCESS) {
wolfSSL 13:f67a6c6013ca 994 WOLFSSL_MSG("CRL file load failed, continuing");
wolfSSL 13:f67a6c6013ca 995 }
wolfSSL 13:f67a6c6013ca 996
wolfSSL 13:f67a6c6013ca 997 ret = wc_ReadDirNext(readCtx, path, &name);
wolfSSL 13:f67a6c6013ca 998 }
wolfSSL 13:f67a6c6013ca 999 wc_ReadDirClose(readCtx);
wolfSSL 13:f67a6c6013ca 1000 ret = SSL_SUCCESS; /* load failures not reported, for backwards compat */
wolfSSL 13:f67a6c6013ca 1001
wolfSSL 13:f67a6c6013ca 1002 #ifdef WOLFSSL_SMALL_STACK
wolfSSL 13:f67a6c6013ca 1003 XFREE(readCtx, crl->heap, DYNAMIC_TYPE_TMP_BUFFER);
wolfSSL 13:f67a6c6013ca 1004 #endif
wolfSSL 13:f67a6c6013ca 1005
wolfSSL 13:f67a6c6013ca 1006 if (monitor & WOLFSSL_CRL_MONITOR) {
wolfSSL 13:f67a6c6013ca 1007 word32 pathLen;
wolfSSL 13:f67a6c6013ca 1008 char* pathBuf;
wolfSSL 13:f67a6c6013ca 1009
wolfSSL 13:f67a6c6013ca 1010 WOLFSSL_MSG("monitor path requested");
wolfSSL 13:f67a6c6013ca 1011
wolfSSL 13:f67a6c6013ca 1012 pathLen = (word32)XSTRLEN(path);
wolfSSL 13:f67a6c6013ca 1013 pathBuf = (char*)XMALLOC(pathLen+1, crl->heap,DYNAMIC_TYPE_CRL_MONITOR);
wolfSSL 13:f67a6c6013ca 1014 if (pathBuf) {
wolfSSL 13:f67a6c6013ca 1015 XSTRNCPY(pathBuf, path, pathLen);
wolfSSL 13:f67a6c6013ca 1016 pathBuf[pathLen] = '\0'; /* Null Terminate */
wolfSSL 13:f67a6c6013ca 1017
wolfSSL 13:f67a6c6013ca 1018 if (type == SSL_FILETYPE_PEM) {
wolfSSL 13:f67a6c6013ca 1019 /* free old path before setting a new one */
wolfSSL 13:f67a6c6013ca 1020 if (crl->monitors[0].path) {
wolfSSL 13:f67a6c6013ca 1021 XFREE(crl->monitors[0].path, crl->heap,
wolfSSL 13:f67a6c6013ca 1022 DYNAMIC_TYPE_CRL_MONITOR);
wolfSSL 13:f67a6c6013ca 1023 }
wolfSSL 13:f67a6c6013ca 1024 crl->monitors[0].path = pathBuf;
wolfSSL 13:f67a6c6013ca 1025 crl->monitors[0].type = SSL_FILETYPE_PEM;
wolfSSL 13:f67a6c6013ca 1026 } else {
wolfSSL 13:f67a6c6013ca 1027 /* free old path before setting a new one */
wolfSSL 13:f67a6c6013ca 1028 if (crl->monitors[1].path) {
wolfSSL 13:f67a6c6013ca 1029 XFREE(crl->monitors[1].path, crl->heap,
wolfSSL 13:f67a6c6013ca 1030 DYNAMIC_TYPE_CRL_MONITOR);
wolfSSL 13:f67a6c6013ca 1031 }
wolfSSL 13:f67a6c6013ca 1032 crl->monitors[1].path = pathBuf;
wolfSSL 13:f67a6c6013ca 1033 crl->monitors[1].type = SSL_FILETYPE_ASN1;
wolfSSL 13:f67a6c6013ca 1034 }
wolfSSL 13:f67a6c6013ca 1035
wolfSSL 13:f67a6c6013ca 1036 if (monitor & WOLFSSL_CRL_START_MON) {
wolfSSL 13:f67a6c6013ca 1037 WOLFSSL_MSG("start monitoring requested");
wolfSSL 13:f67a6c6013ca 1038
wolfSSL 13:f67a6c6013ca 1039 ret = StartMonitorCRL(crl);
wolfSSL 13:f67a6c6013ca 1040 }
wolfSSL 13:f67a6c6013ca 1041 }
wolfSSL 13:f67a6c6013ca 1042 else {
wolfSSL 13:f67a6c6013ca 1043 ret = MEMORY_E;
wolfSSL 13:f67a6c6013ca 1044 }
wolfSSL 13:f67a6c6013ca 1045 }
wolfSSL 13:f67a6c6013ca 1046
wolfSSL 13:f67a6c6013ca 1047 return ret;
wolfSSL 13:f67a6c6013ca 1048 }
wolfSSL 13:f67a6c6013ca 1049
wolfSSL 13:f67a6c6013ca 1050 #else
wolfSSL 13:f67a6c6013ca 1051 int LoadCRL(WOLFSSL_CRL* crl, const char* path, int type, int monitor)
wolfSSL 13:f67a6c6013ca 1052 {
wolfSSL 13:f67a6c6013ca 1053 (void)crl;
wolfSSL 13:f67a6c6013ca 1054 (void)path;
wolfSSL 13:f67a6c6013ca 1055 (void)type;
wolfSSL 13:f67a6c6013ca 1056 (void)monitor;
wolfSSL 13:f67a6c6013ca 1057
wolfSSL 13:f67a6c6013ca 1058 /* stub for scenario where file system is not supported */
wolfSSL 13:f67a6c6013ca 1059 return NOT_COMPILED_IN;
wolfSSL 13:f67a6c6013ca 1060 }
wolfSSL 13:f67a6c6013ca 1061 #endif /* !NO_FILESYSTEM && !NO_WOLFSSL_DIR */
wolfSSL 13:f67a6c6013ca 1062
wolfSSL 13:f67a6c6013ca 1063 #endif /* HAVE_CRL */
wolfSSL 13:f67a6c6013ca 1064 #endif /* !WOLFCRYPT_ONLY */
wolfSSL 13:f67a6c6013ca 1065