Skip to content

Commit efeb903

Browse files
opencryptoopencrypto
committed
Added initial skeleton for caching of responses.
1 parent 4cfab21 commit efeb903

File tree

8 files changed

+181
-14
lines changed

8 files changed

+181
-14
lines changed

‎src/ocspd/Makefile.am

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,8 @@ ocspd_SOURCES = \
1414
request.c \
1515
response.c \
1616
config.c \
17-
crl.c
17+
crl.c \
18+
cache.c
1819

1920
EXTRA_DIST = \
2021
includes/*.h

‎src/ocspd/Makefile.in

Lines changed: 18 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -108,7 +108,7 @@ PROGRAMS = $(sbin_PROGRAMS)
108108
am_ocspd_OBJECTS = ocspd-ocspd.$(OBJEXT) ocspd-core.$(OBJEXT) \
109109
ocspd-threads.$(OBJEXT) ocspd-request.$(OBJEXT) \
110110
ocspd-response.$(OBJEXT) ocspd-config.$(OBJEXT) \
111-
ocspd-crl.$(OBJEXT)
111+
ocspd-crl.$(OBJEXT) ocspd-cache.$(OBJEXT)
112112
ocspd_OBJECTS = $(am_ocspd_OBJECTS)
113113
ocspd_DEPENDENCIES =
114114
AM_V_lt = $(am__v_lt_@AM_V@)
@@ -339,7 +339,8 @@ ocspd_SOURCES = \
339339
request.c \
340340
response.c \
341341
config.c \
342-
crl.c
342+
crl.c \
343+
cache.c
343344

344345
EXTRA_DIST = \
345346
includes/*.h
@@ -439,6 +440,7 @@ mostlyclean-compile:
439440
distclean-compile:
440441
-rm -f *.tab.c
441442

443+
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ocspd-cache.Po@am__quote@
442444
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ocspd-config.Po@am__quote@
443445
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ocspd-core.Po@am__quote@
444446
@AMDEP_TRUE@@am__include@ @am__quote@./$(DEPDIR)/ocspd-crl.Po@am__quote@
@@ -566,6 +568,20 @@ ocspd-crl.obj: crl.c
566568
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
567569
@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(ocspd_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ocspd-crl.obj `if test -f 'crl.c'; then $(CYGPATH_W) 'crl.c'; else $(CYGPATH_W) '$(srcdir)/crl.c'; fi`
568570

571+
ocspd-cache.o: cache.c
572+
@am__fastdepCC_TRUE@ $(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(ocspd_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ocspd-cache.o -MD -MP -MF $(DEPDIR)/ocspd-cache.Tpo -c -o ocspd-cache.o `test -f 'cache.c' || echo '$(srcdir)/'`cache.c
573+
@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) $(DEPDIR)/ocspd-cache.Tpo $(DEPDIR)/ocspd-cache.Po
574+
@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='cache.c' object='ocspd-cache.o' libtool=no @AMDEPBACKSLASH@
575+
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
576+
@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(ocspd_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ocspd-cache.o `test -f 'cache.c' || echo '$(srcdir)/'`cache.c
577+
578+
ocspd-cache.obj: cache.c
579+
@am__fastdepCC_TRUE@ $(AM_V_CC)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(ocspd_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -MT ocspd-cache.obj -MD -MP -MF $(DEPDIR)/ocspd-cache.Tpo -c -o ocspd-cache.obj `if test -f 'cache.c'; then $(CYGPATH_W) 'cache.c'; else $(CYGPATH_W) '$(srcdir)/cache.c'; fi`
580+
@am__fastdepCC_TRUE@ $(AM_V_at)$(am__mv) $(DEPDIR)/ocspd-cache.Tpo $(DEPDIR)/ocspd-cache.Po
581+
@AMDEP_TRUE@@am__fastdepCC_FALSE@ $(AM_V_CC)source='cache.c' object='ocspd-cache.obj' libtool=no @AMDEPBACKSLASH@
582+
@AMDEP_TRUE@@am__fastdepCC_FALSE@ DEPDIR=$(DEPDIR) $(CCDEPMODE) $(depcomp) @AMDEPBACKSLASH@
583+
@am__fastdepCC_FALSE@ $(AM_V_CC@am__nodep@)$(CC) $(DEFS) $(DEFAULT_INCLUDES) $(INCLUDES) $(ocspd_CPPFLAGS) $(CPPFLAGS) $(AM_CFLAGS) $(CFLAGS) -c -o ocspd-cache.obj `if test -f 'cache.c'; then $(CYGPATH_W) 'cache.c'; else $(CYGPATH_W) '$(srcdir)/cache.c'; fi`
584+
569585
mostlyclean-libtool:
570586
-rm -f *.lo
571587

‎src/ocspd/cache.c

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
/* src/ocspd/cache.c */
2+
3+
#include "general.h"
4+
5+
void OCSPD_CACHE_free(OCSPD_CACHE * oc) {
6+
7+
// Input check
8+
if (!oc) return;
9+
10+
// Free the memory
11+
if (oc->idx) PKI_Free(oc->idx);
12+
13+
// Free the data structure
14+
PKI_Free(oc);
15+
}
16+
17+
OCSPD_CACHE * OCSPD_CACHE_new(size_t size) {
18+
19+
OCSPD_CACHE * oc = NULL;
20+
21+
// Input checks
22+
if (size <= 0) size = 1000;
23+
24+
// Allocates the memory
25+
if ((oc = PKI_Malloc(sizeof(OCSPD_CACHE))) == NULL) {
26+
PKI_log_err("Can not allocate cache memory");
27+
return NULL;
28+
}
29+
30+
// Allocates the memory for the cache
31+
if ((oc->idx = PKI_Malloc(sizeof(OCSPD_CACHE_ENTRY) * size)) == NULL) {
32+
OCSPD_CACHE_free(oc);
33+
PKI_log_err("Can not allocate cache memory");
34+
return NULL;
35+
}
36+
37+
// Sets the size of the index
38+
oc->size = size;
39+
40+
// Initializes the lock
41+
PKI_RWLOCK_init(&oc->lock);
42+
43+
// Return the initialized data structure
44+
return oc;
45+
46+
}
47+
48+
int OCSPD_CACHE_entry_idx(OCSPD_CACHE_ENTRY *entry) {
49+
}
50+
51+
int OCSPD_CACHE_set_entry(OCSPD_CACHE * cache, OCSPD_CACHE_ENTRY *entry) {
52+
}
53+
54+
OCSPD_CACHE_ENTRY * OCSPD_CACHE_get0_entry(OCSPD_CACHE * cache, ASN1_INTEGER *serialNumber) {
55+
}
56+

‎src/ocspd/config.c

Lines changed: 8 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -519,8 +519,6 @@ int OCSPD_build_ca_list ( OCSPD_CONFIG *handler,
519519
}
520520
else
521521
{
522-
PKI_log_debug("Got CRL Url -> %s", tmp_s );
523-
524522
if((ca->crl_url = URL_new ( tmp_s )) == NULL )
525523
{
526524
PKI_log_err ("Error Parsing CRL URL [%s] for CA [%s]", ca->ca_id, tmp_s);
@@ -585,12 +583,17 @@ int OCSPD_build_ca_list ( OCSPD_CONFIG *handler,
585583
}
586584
*/
587585

586+
// Failure loading the CRL was a fatal error, now
587+
// we let the OCSP continue since the loading error
588+
// might be temporary
588589
if (OCSPD_load_crl(ca, handler) == PKI_ERR )
589590
{
590-
PKI_log_err ( "Can not get CRL for %s", ca->ca_id);
591-
CA_LIST_ENTRY_free ( ca );
591+
PKI_log_err ( "Can not get CRL for %s (%s)",
592+
ca->ca_id, ca->crl_url->addr);
592593

593-
continue;
594+
// Switched to non-fatal error
595+
// CA_LIST_ENTRY_free ( ca );
596+
// continue;
594597
}
595598

596599
/* If the Server has a Token to be used with this CA, let's

‎src/ocspd/crl.c

Lines changed: 4 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -77,15 +77,13 @@ int ocspd_load_ca_crl ( CA_LIST_ENTRY *a, OCSPD_CONFIG *conf ) {
7777
if ( a->nextUpdate ) ASN1_TIME_free(a->nextUpdate);
7878

7979
/* Get new values from the recently loaded CRL */
80-
a->lastUpdate = M_ASN1_TIME_dup (
80+
a->lastUpdate = PKI_TIME_dup(
8181
PKI_X509_CRL_get_data ( a->crl, PKI_X509_DATA_LASTUPDATE ));
82-
a->nextUpdate = M_ASN1_TIME_dup (
82+
a->nextUpdate = PKI_TIME_dup (
8383
PKI_X509_CRL_get_data ( a->crl, PKI_X509_DATA_NEXTUPDATE ));
8484

85-
if(conf->debug) PKI_log_debug("RELEASING LOCK (CRL RELOAD)");
85+
// Releases the lock
8686
PKI_RWLOCK_release_write ( &conf->crl_lock );
87-
// pthread_rwlock_unlock ( &crl_lock );
88-
if(conf->debug) PKI_log_debug ( "LOCK RELEASED --END--");
8987

9088
/* Now check the CRL validity */
9189
a->crl_status = check_crl_validity( a, conf );
@@ -366,4 +364,4 @@ void force_crl_reload ( int sig ) {
366364
ocspd_reload_crls ( ocspd_conf );
367365

368366
return;
369-
};
367+
}

‎src/ocspd/includes/cache.h

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
/*
2+
* OCSP responder
3+
* by Massimiliano Pala (madwolf@openca.org)
4+
* OpenCA Labs project 2001-2017
5+
*
6+
* Copyright (c) 2001-2017 The OpenCA Project. All rights reserved.
7+
*
8+
* ====================================================================
9+
*
10+
* This product includes cryptographic software written by Eric Young
11+
* (eay@cryptsoft.com). This product includes software written by Tim
12+
* Hudson (tjh@cryptsoft.com).
13+
*
14+
*/
15+
16+
/* Functions prototypes*/
17+
18+
#ifndef OCSPD_CACHE_H
19+
#define OCSPD_CACHE_H
20+
21+
typedef struct ocspd_cache_entry_st {
22+
// Serial Number of the Certificate
23+
ASN1_INTEGER * serialNumber;
24+
// Cached Response
25+
PKI_OCSP_RESP * response;
26+
// Time until the response is valid
27+
time_t expires;
28+
// Mutex to be acquired before updating the entry
29+
PKI_MUTEX mutext;
30+
} OCSPD_CACHE_ENTRY;
31+
32+
typedef struct ocspd_cache_st {
33+
34+
// Lock for the [data] access
35+
PKI_RWLOCK lock;
36+
37+
// Condition Variable and Mutex (TBD)
38+
PKI_COND cond_var;
39+
PKI_MUTEX mutext;
40+
41+
// Size of the [data] pointers array
42+
size_t size;
43+
44+
// Pointers array
45+
OCSPD_CACHE_ENTRY ** idx;
46+
} OCSPD_CACHE;
47+
48+
// Allocates a new caching buffer
49+
OCSPD_CACHE * OCSPD_CACHE_new(size_t num_of_entries);
50+
51+
// Frees all the memory associated with the cache structure
52+
void OCSPD_CACHE_free(OCSPD_CACHE * oc);
53+
54+
// Returns the number of the entry in the hash table
55+
int OCSPD_CACHE_entry_idx(OCSPD_CACHE_ENTRY *e);
56+
57+
// Adds the entry to the cache (no copy)
58+
int OCSPD_CACHE_add0_entry(OCSPD_CACHE * oc, OCSPD_CACHE_ENTRY *e);
59+
60+
// Returns the entry for the serial number
61+
OCSPD_CACHE_ENTRY * OCSPD_CACHE_get0_entry(OCSPD_CACHE * oc, ASN1_INTEGER *serialNumber);
62+
63+
#endif

‎src/ocspd/includes/general.h

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -117,6 +117,7 @@ typedef struct ca_entry_certid
117117

118118
/* List of available CAs */
119119
typedef struct ca_list_st {
120+
120121
/* CA Identifier - Name from config file */
121122
char *ca_id;
122123

@@ -165,6 +166,12 @@ typedef struct ca_list_st {
165166
/* CREDS for TLS connections */
166167
PKI_CRED * creds;
167168

169+
/* Basic Template for the response */
170+
PKI_OCSP_RESP * resp_template;
171+
172+
/* CA Cache */
173+
OCSPD_CACHE * oc;
174+
168175
} CA_LIST_ENTRY;
169176

170177
typedef struct {
@@ -289,6 +296,7 @@ typedef struct ocspd_config {
289296
#include "response.h"
290297
#include "request.h"
291298
#include "crl.h"
299+
#include "cache.h"
292300

293301
#define HTTP_POST 0
294302
#endif

‎src/ocspd/response.c

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -419,7 +419,11 @@ PKI_X509_OCSP_RESP *make_ocsp_response(PKI_X509_OCSP_REQ *req, OCSPD_CONFIG *con
419419
void *ext = NULL;
420420

421421
// If extensions are found, process them
422+
#if OPENSSL_VERSION_NUMBER >= 0x1010000fL
423+
if (X509_REVOKED_get0_extensions(entry))
424+
#else
422425
if (entry->extensions)
426+
#endif
423427
{
424428
ASN1_ENUMERATED *asn = NULL;
425429

@@ -433,8 +437,14 @@ PKI_X509_OCSP_RESP *make_ocsp_response(PKI_X509_OCSP_REQ *req, OCSPD_CONFIG *con
433437
ext = X509_REVOKED_get_ext_d2i( entry, NID_invalidity_date, NULL, NULL );
434438
}
435439

440+
#if OPENSSL_VERSION_NUMBER >= 0x1010000fL
441+
if ((PKI_X509_OCSP_RESP_add(resp, cid, PKI_OCSP_CERTSTATUS_REVOKED,
442+
X509_REVOKED_get0_serialNumber(entry), thisupd,
443+
nextupd, reason, ext )) == PKI_ERR)
444+
#else
436445
if ((PKI_X509_OCSP_RESP_add(resp, cid, PKI_OCSP_CERTSTATUS_REVOKED,
437446
entry->revocationDate, thisupd, nextupd, reason, ext )) == PKI_ERR)
447+
#endif
438448
{
439449
PKI_log_err ("Can not add a simple resp into the OCSP response");
440450

@@ -675,7 +685,11 @@ CA_LIST_ENTRY *OCSPD_CA_ENTRY_find(OCSPD_CONFIG *conf, OCSP_CERTID *cid)
675685
tmp = ca->cid;
676686

677687
/* Check for hashes */
688+
#if OPENSSL_VERSION_NUMBER >= 0x1010000fL
689+
if((ret = ASN1_OCTET_STRING_cmp(tmp->nameHash, &(b->issuerNameHash))) != 0 )
690+
#else
678691
if((ret = ASN1_OCTET_STRING_cmp(tmp->nameHash, b->issuerNameHash)) != 0 )
692+
#endif
679693
{
680694
if (conf->debug)
681695
{
@@ -689,7 +703,11 @@ CA_LIST_ENTRY *OCSPD_CA_ENTRY_find(OCSPD_CONFIG *conf, OCSP_CERTID *cid)
689703
PKI_log_debug("CRL::CA [%s] nameHash OK", ca->ca_id);
690704
}
691705

706+
#if OPENSSL_VERSION_NUMBER >= 0x1010000fL
707+
if ((ret = ASN1_OCTET_STRING_cmp(tmp->keyHash, &(b->issuerKeyHash))) != 0)
708+
#else
692709
if ((ret = ASN1_OCTET_STRING_cmp(tmp->keyHash, b->issuerKeyHash)) != 0)
710+
#endif
693711
{
694712
if (conf->debug)
695713
{
@@ -740,7 +758,11 @@ X509_REVOKED *OCSPD_REVOKED_find (CA_LIST_ENTRY *ca, ASN1_INTEGER *serial) {
740758
r = sk_X509_REVOKED_value(ca->crl_list, curr);
741759

742760
/* Compare the two serials */
761+
#if OPENSSL_VERSION_NUMBER >= 0x1010000fL
762+
cmp_val = ASN1_INTEGER_cmp(X509_REVOKED_get0_serialNumber(r), serial);
763+
#else
743764
cmp_val = ASN1_INTEGER_cmp(r->serialNumber, serial);
765+
#endif
744766

745767
if( cmp_val > 0 ) {
746768
end = curr - 1;

0 commit comments

Comments
 (0)