Implement inlining of crl files

PATCH Superseded Arne Schwabe 3 participants 6 messages Mar 5, 2016 – Apr 4, 2016

Share & tools

Arne Schwabe

author

2016-03-05 14:34 UTC #0 lore raw

PATCH 1/1 Implement inlining of crl files

While crl files can change regulary and it is usually not a good idea to statically include them into config files, handling multiple files and updating files on mobile files is tiresome/problematic. Inlining a static version of the crl file is better in these use cases than to use no crl at all.

OpenVPN 3 already supports inlining crl-verify, so <crl-verify> is already used in config files.

---
 doc/openvpn.8                     |  2 +-
 src/openvpn/init.c                |  1 +
 src/openvpn/options.c             | 12 +++++++++---
 src/openvpn/options.h             |  1 +
 src/openvpn/ssl_common.h          |  1 +
 src/openvpn/ssl_verify.c          |  2 +-
 src/openvpn/ssl_verify_backend.h  |  4 ++--
 src/openvpn/ssl_verify_openssl.c  |  7 +++++--
 src/openvpn/ssl_verify_polarssl.c | 19 +++++++++++++++----
 9 files changed, 36 insertions(+), 13 deletions(-)

doc/openvpn.8 +1 -1

index d99aaf5..09cf018 100644
@@ -6498,7 +6498,7 @@ X509_1_C=KG
 .\"*********************************************************
 .SH INLINE FILE SUPPORT
 OpenVPN allows including files in the main configuration for the
-.B \-\-ca, \-\-cert, \-\-dh, \-\-extra\-certs, \-\-key, \-\-pkcs12, \-\-secret
+.B \-\-ca, \-\-cert, \-\-dh, \-\-extra\-certs, \-\-key, \-\-pkcs12, \-\-secret, \-\-crl-verify
 and
 .B \-\-tls\-auth
 options.

src/openvpn/init.c +1 -0

index d518cdc..f5e0811 100644
@@ -2326,6 +2326,7 @@ do_init_crypto_tls (struct context *c, const unsigned int flags)
   to.verify_x509_type = (options->verify_x509_type & 0xff);
   to.verify_x509_name = options->verify_x509_name;
   to.crl_file = options->crl_file;
+  to.crl_file_inline = options->crl_file_inline;
   to.ssl_flags = options->ssl_flags;
   to.ns_cert_type = options->ns_cert_type;
   memmove (to.remote_cert_ku, options->remote_cert_ku, sizeof (to.remote_cert_ku));

src/openvpn/options.c +9 -3

index 4933d9f..3f0bc88 100644
@@ -2729,10 +2729,11 @@ options_postprocess_filechecks (struct options *options)
                              "--pkcs12");
 
   if (options->ssl_flags & SSLF_CRL_VERIFY_DIR)
-    errs |= check_file_access_chroot (options->chroot_dir, CHKACC_FILE, options->crl_file, R_OK|X_OK,
+    errs |= check_file_access_chroot (options->chroot_dir, CHKACC_FILE,
+                                    options->crl_file, R_OK|X_OK,
                                "--crl-verify directory");
   else
-    errs |= check_file_access_chroot (options->chroot_dir, CHKACC_FILE, options->crl_file, R_OK,
+    errs |= check_file_access_chroot (options->chroot_dir, CHKACC_FILE|CHKACC_INLINE, options->crl_file, R_OK,
                                "--crl-verify");
 
   errs |= check_file_access (CHKACC_FILE|CHKACC_INLINE, options->tls_auth_file, R_OK,

@@ -6770,12 +6771,17 @@ add_option (struct options *options,
       VERIFY_PERMISSION (OPT_P_GENERAL);
       options->cipher_list = p[1];
     }
-  else if (streq (p[0], "crl-verify") && p[1] && ((p[2] && streq(p[2], "dir")) || !p[2]) && !p[3])
+  else if (streq (p[0], "crl-verify") && p[1] && ((p[2] && streq(p[2], "dir"))
+		  || (p[2] && streq (p[1], INLINE_FILE_TAG) ) || !p[2]) && !p[3])
     {
       VERIFY_PERMISSION (OPT_P_GENERAL);
       if (p[2] && streq(p[2], "dir"))
 	options->ssl_flags |= SSLF_CRL_VERIFY_DIR;
       options->crl_file = p[1];
+      if (streq (p[1], INLINE_FILE_TAG) && p[2])
+	{
+	  options->crl_file_inline = p[2];
+	}
     }
   else if (streq (p[0], "tls-verify") && p[1])
     {

src/openvpn/options.h +1 -0

index a64fcaf..e1f014f 100644
@@ -508,6 +508,7 @@ struct options
   const char *ca_file_inline;
   const char *cert_file_inline;
   const char *extra_certs_file_inline;
+  const char *crl_file_inline;
   char *priv_key_file_inline;
   const char *dh_file_inline;
   const char *pkcs12_file_inline; /* contains the base64 encoding of pkcs12 file */

src/openvpn/ssl_common.h +1 -0

index 6e3d28c..4220e23 100644
@@ -247,6 +247,7 @@ struct tls_options
   int verify_x509_type;
   const char *verify_x509_name;
   const char *crl_file;
+  const char *crl_file_inline;
   int ns_cert_type;
   unsigned remote_cert_ku[MAX_PARMS];
   const char *remote_cert_eku;

src/openvpn/ssl_verify.c +1 -1

index ccfa9d2..ea381f8 100644
@@ -690,7 +690,7 @@ verify_cert(struct tls_session *session, openvpn_x509_cert_t *cert, int cert_dep
       }
       else
       {
-	if (SUCCESS != x509_verify_crl(opt->crl_file, cert, subject))
+	if (SUCCESS != x509_verify_crl(opt->crl_file, opt->crl_file_inline, cert, subject))
 	  goto cleanup;
       }
     }

src/openvpn/ssl_verify_backend.h +2 -2

index 4e9ad60..4ab496f 100644
@@ -254,7 +254,7 @@ result_t x509_write_pem(FILE *peercert_file, openvpn_x509_cert_t *peercert);
  * 			certificate or does not contain an entry for it.
  * 			\c FAILURE otherwise.
  */
-result_t x509_verify_crl(const char *crl_file, openvpn_x509_cert_t *cert,
-    const char *subject);
+result_t x509_verify_crl(const char *crl_file, const char *crl_inline,
+                         openvpn_x509_cert_t *cert, const char *subject);
 
 #endif /* SSL_VERIFY_BACKEND_H_ */

src/openvpn/ssl_verify_openssl.c +5 -2

index d014f9d..33283a0 100644
@@ -578,7 +578,7 @@ x509_write_pem(FILE *peercert_file, X509 *peercert)
  * check peer cert against CRL
  */
 result_t
-x509_verify_crl(const char *crl_file, X509 *peer_cert, const char *subject)
+x509_verify_crl(const char *crl_file, const char* crl_inline, X509 *peer_cert, const char *subject)
 {
   X509_CRL *crl=NULL;
   X509_REVOKED *revoked;

@@ -588,7 +588,10 @@ x509_verify_crl(const char *crl_file, X509 *peer_cert, const char *subject)
   struct gc_arena gc = gc_new();
   char *serial;
 
-  in = BIO_new_file (crl_file, "r");
+  if (!strcmp (crl_file, INLINE_FILE_TAG) && crl_inline)
+    in = BIO_new_mem_buf ((char *)crl_inline, -1);
+  else
+    in = BIO_new_file (crl_file, "r");
 
   if (in == NULL) {
     msg (M_WARN, "CRL: cannot read: %s", crl_file);

src/openvpn/ssl_verify_polarssl.c +15 -4

index a2e6a8e..c016561 100644
@@ -359,18 +359,29 @@ x509_write_pem(FILE *peercert_file, x509_crt *peercert)
  * check peer cert against CRL
  */
 result_t
-x509_verify_crl(const char *crl_file, x509_crt *cert, const char *subject)
+x509_verify_crl(const char *crl_file, const char* crl_inline, x509_crt *cert, const char *subject)
 {
   result_t retval = FAILURE;
   x509_crl crl = {0};
   struct gc_arena gc = gc_new();
   char *serial;
 
-  if (!polar_ok(x509_crl_parse_file(&crl, crl_file)))
+  if (!strcmp (cert_file, INLINE_FILE_TAG) && crl_inline)
     {
-      msg (M_WARN, "CRL: cannot read CRL from file %s", crl_file);
-      goto end;
+      if (!polar_ok(x509_crl_parse_(&crl, crl_inline, strlen(crl_inline))))
+        {
+           msg (M_WARN, "CRL: cannot read CRL from file %s", crl_file);
+           goto end;
+        }
     }
+  else
+    {
+      if (!polar_ok(x509_crl_parse_file(&crl, crl_file)))
+      {
+          msg (M_WARN, "CRL: cannot read CRL from file %s", crl_file);
+          goto end;
+      }
+  }
 
   if(cert->issuer_raw.len != crl.issuer_raw.len ||
       memcmp(crl.issuer_raw.p, cert->issuer_raw.p, crl.issuer_raw.len) != 0)

Signature · 1 line

2.5.4 (Apple Git-61)

Steffan Karger

2016-03-06 10:17 UTC #1 lore raw

Hi,

Quoted 3 lines · Arne Schwabe

While crl files can change regulary and it is usually not a good idea to statically include them into config files, handling multiple files and updating files on mobile files is tiresome/problematic. Inlining a static version of the crl file is better in these use cases than to use no crl at all.
OpenVPN 3 already supports inlining crl-verify, so <crl-verify> is already used in config files.

Feature-ACK, but some remarks:

doc/openvpn.8 X509_1_C=KG · line 6504

Quoted 9 lines

doc/openvpn.8 +1 -1

@@ -6498,7 +6498,7 @@ X509_1_C=KG
 .\"*********************************************************
 .SH INLINE FILE SUPPORT
 OpenVPN allows including files in the main configuration for the
-.B \-\-ca, \-\-cert, \-\-dh, \-\-extra\-certs, \-\-key, \-\-pkcs12, \-\-secret
+.B \-\-ca, \-\-cert, \-\-dh, \-\-extra\-certs, \-\-key, \-\-pkcs12, \-\-secret, \-\-crl-verify
 and
 .B \-\-tls\-auth
 options.

Real nitpicking, but now that I'm sending mail anyway: this exceeds the 80-char 'limit', while the surrounding text seems to obey. Would you mind putting .B \-\-crl-verify on a new line instead?

src/openvpn/options.c options_postprocess_filechecks (struct options *options) · line 2734

Quoted 8 lines

src/openvpn/options.c +2 -1

@@ -2729,10 +2729,11 @@ options_postprocess_filechecks (struct options *options)
                              "--pkcs12");
 
   if (options->ssl_flags & SSLF_CRL_VERIFY_DIR)
-    errs |= check_file_access_chroot (options->chroot_dir, CHKACC_FILE, options->crl_file, R_OK|X_OK,
+    errs |= check_file_access_chroot (options->chroot_dir, CHKACC_FILE,
+                                    options->crl_file, R_OK|X_OK,
                                "--crl-verify directory");

This looks like an accidental formatting change.

src/openvpn/options.c options_postprocess_filechecks (struct options *options) · line 2737

Quoted 4 lines

src/openvpn/options.c +1 -1

   else
-    errs |= check_file_access_chroot (options->chroot_dir, CHKACC_FILE, options->crl_file, R_OK,
+    errs |= check_file_access_chroot (options->chroot_dir, CHKACC_FILE|CHKACC_INLINE, options->crl_file, R_OK,
                                "--crl-verify");

This line too becomes quite long (it at least exceeds my default editor window width ;) ).

src/openvpn/ssl_verify_backend.h result_t x509_write_pem(FILE *peercert_file, openvpn_x509_cert_t *peercert); · line 258

Quoted 10 lines

src/openvpn/ssl_verify_backend.h +2 -2

@@ -254,7 +254,7 @@ result_t x509_write_pem(FILE *peercert_file, openvpn_x509_cert_t *peercert);
  *                     certificate or does not contain an entry for it.
  *                     \c FAILURE otherwise.
  */
-result_t x509_verify_crl(const char *crl_file, openvpn_x509_cert_t *cert,
-    const char *subject);
+result_t x509_verify_crl(const char *crl_file, const char *crl_inline,
+                         openvpn_x509_cert_t *cert, const char *subject);

Could you add the new parameter to the doxygen too?

src/openvpn/ssl_verify_openssl.c x509_write_pem(FILE *peercert_file, X509 *peercert) · line 581

Quoted 8 lines

src/openvpn/ssl_verify_openssl.c +1 -1

@@ -578,7 +578,7 @@ x509_write_pem(FILE *peercert_file, X509 *peercert)
  * check peer cert against CRL
  */
 result_t
-x509_verify_crl(const char *crl_file, X509 *peer_cert, const char *subject)
+x509_verify_crl(const char *crl_file, const char* crl_inline, X509 *peer_cert, const char *subject)

This becomes a quite long line.

src/openvpn/ssl_verify_polarssl.c x509_write_pem(FILE *peercert_file, x509_crt *peercert) · line 362

Quoted 8 lines

src/openvpn/ssl_verify_polarssl.c +1 -1

@@ -359,18 +359,29 @@ x509_write_pem(FILE *peercert_file, x509_crt *peercert)
  * check peer cert against CRL
  */
 result_t
-x509_verify_crl(const char *crl_file, x509_crt *cert, const char *subject)
+x509_verify_crl(const char *crl_file, const char* crl_inline, x509_crt *cert, const char *subject)

This becomes a quite long line.

src/openvpn/ssl_verify_polarssl.c x509_write_pem(FILE *peercert_file, x509_crt *peercert) · line 369

Quoted 8 lines

src/openvpn/ssl_verify_polarssl.c +1 -1

 {
   result_t retval = FAILURE;
   x509_crl crl = {0};
   struct gc_arena gc = gc_new();
   char *serial;
 
-  if (!polar_ok(x509_crl_parse_file(&crl, crl_file)))
+  if (!strcmp (cert_file, INLINE_FILE_TAG) && crl_inline)

This doesn't compile. I think you meant to write crl_file there, not cert_file.

src/openvpn/ssl_verify_polarssl.c x509_write_pem(FILE *peercert_file, x509_crt *peercert) · line 371

Quoted 4 lines

src/openvpn/ssl_verify_polarssl.c +1 -2

     {
-      msg (M_WARN, "CRL: cannot read CRL from file %s", crl_file);
-      goto end;
+      if (!polar_ok(x509_crl_parse_(&crl, crl_inline, strlen(crl_inline))))

This doesn't compile. The final _ of x509_crl_parse_() should be removed.

src/openvpn/ssl_verify_polarssl.c x509_write_pem(FILE *peercert_file, x509_crt *peercert) · line 375

Quoted 4 lines

src/openvpn/ssl_verify_polarssl.c +4 -0

+        {
+           msg (M_WARN, "CRL: cannot read CRL from file %s", crl_file);
+           goto end;
+        }

This warning message does not make sense for an inline crl. Change to "cannot parse inline CRL"?

After the above changes, I tested the code and it works as expected.

-Steffan

Arne Schwabe

author

2016-03-06 19:19 UTC #2 lore raw

PATCH v2 1/1 Implement inlining of crl files

OpenVPN 3 already supports inlining crl-verify, so <crl-verify> is already used in config files.

V2: Fixed PolarSSL and made formatting respect the 80 column limit

---
 doc/openvpn.8                     |  3 ++-
 src/openvpn/init.c                |  1 +
 src/openvpn/options.c             |  7 ++++++-
 src/openvpn/options.h             |  1 +
 src/openvpn/ssl_common.h          |  1 +
 src/openvpn/ssl_verify.c          |  2 +-
 src/openvpn/ssl_verify_backend.h  |  5 +++--
 src/openvpn/ssl_verify_openssl.c  |  8 ++++++--
 src/openvpn/ssl_verify_polarssl.c | 20 ++++++++++++++++----
 9 files changed, 37 insertions(+), 11 deletions(-)

doc/openvpn.8 +2 -1

index 628d877..decffc7 100644
@@ -6490,7 +6490,8 @@ X509_1_C=KG
 .\"*********************************************************
 .SH INLINE FILE SUPPORT
 OpenVPN allows including files in the main configuration for the
-.B \-\-ca, \-\-cert, \-\-dh, \-\-extra\-certs, \-\-key, \-\-pkcs12, \-\-secret
+.B \-\-ca, \-\-cert, \-\-dh, \-\-extra\-certs, \-\-key, \-\-pkcs12, \-\-secret,
+.B \-\-crl-verify
 and
 .B \-\-tls\-auth
 options.

src/openvpn/init.c +1 -0

index cb73a3d..33a1420 100644
@@ -2323,6 +2323,7 @@ do_init_crypto_tls (struct context *c, const unsigned int flags)
   to.verify_x509_type = (options->verify_x509_type & 0xff);
   to.verify_x509_name = options->verify_x509_name;
   to.crl_file = options->crl_file;
+  to.crl_file_inline = options->crl_file_inline;
   to.ssl_flags = options->ssl_flags;
   to.ns_cert_type = options->ns_cert_type;
   memmove (to.remote_cert_ku, options->remote_cert_ku, sizeof (to.remote_cert_ku));

src/openvpn/options.c +6 -1

index 02def3a..e7fd358 100644
@@ -6783,12 +6783,17 @@ add_option (struct options *options,
       VERIFY_PERMISSION (OPT_P_GENERAL);
       options->cipher_list = p[1];
     }
-  else if (streq (p[0], "crl-verify") && p[1] && ((p[2] && streq(p[2], "dir")) || !p[2]) && !p[3])
+  else if (streq (p[0], "crl-verify") && p[1] && ((p[2] && streq(p[2], "dir"))
+		  || (p[2] && streq (p[1], INLINE_FILE_TAG) ) || !p[2]) && !p[3])
     {
       VERIFY_PERMISSION (OPT_P_GENERAL);
       if (p[2] && streq(p[2], "dir"))
 	options->ssl_flags |= SSLF_CRL_VERIFY_DIR;
       options->crl_file = p[1];
+      if (streq (p[1], INLINE_FILE_TAG) && p[2])
+	{
+	  options->crl_file_inline = p[2];
+	}
     }
   else if (streq (p[0], "tls-verify") && p[1])
     {

src/openvpn/options.h +1 -0

index 23d3992..8a26e14 100644
@@ -511,6 +511,7 @@ struct options
   const char *ca_file_inline;
   const char *cert_file_inline;
   const char *extra_certs_file_inline;
+  const char *crl_file_inline;
   char *priv_key_file_inline;
   const char *dh_file_inline;
   const char *pkcs12_file_inline; /* contains the base64 encoding of pkcs12 file */

src/openvpn/ssl_common.h +1 -0

index eaf4a91..334ccb0 100644
@@ -247,6 +247,7 @@ struct tls_options
   int verify_x509_type;
   const char *verify_x509_name;
   const char *crl_file;
+  const char *crl_file_inline;
   int ns_cert_type;
   unsigned remote_cert_ku[MAX_PARMS];
   const char *remote_cert_eku;

src/openvpn/ssl_verify.c +1 -1

index ccfa9d2..ea381f8 100644
@@ -690,7 +690,7 @@ verify_cert(struct tls_session *session, openvpn_x509_cert_t *cert, int cert_dep
       }
       else
       {
-	if (SUCCESS != x509_verify_crl(opt->crl_file, cert, subject))
+	if (SUCCESS != x509_verify_crl(opt->crl_file, opt->crl_file_inline, cert, subject))
 	  goto cleanup;
       }
     }

src/openvpn/ssl_verify_backend.h +3 -2

index 4e9ad60..5001764 100644
@@ -248,13 +248,14 @@ result_t x509_write_pem(FILE *peercert_file, openvpn_x509_cert_t *peercert);
  *
  * @param crl_file	File name of the CRL file
  * @param cert		Certificate to verify
+ * @param crl_inline Contents of the crl file if it is inlined
  * @param subject	Subject of the given certificate
  *
  * @return 		\c SUCCESS if the CRL was not signed by the issuer of the
  * 			certificate or does not contain an entry for it.
  * 			\c FAILURE otherwise.
  */
-result_t x509_verify_crl(const char *crl_file, openvpn_x509_cert_t *cert,
-    const char *subject);
+result_t x509_verify_crl(const char *crl_file, const char *crl_inline,
+                         openvpn_x509_cert_t *cert, const char *subject);
 
 #endif /* SSL_VERIFY_BACKEND_H_ */

src/openvpn/ssl_verify_openssl.c +6 -2

index d014f9d..edbc2e4 100644
@@ -578,7 +578,8 @@ x509_write_pem(FILE *peercert_file, X509 *peercert)
  * check peer cert against CRL
  */
 result_t
-x509_verify_crl(const char *crl_file, X509 *peer_cert, const char *subject)
+x509_verify_crl(const char *crl_file, const char* crl_inline,
+                X509 *peer_cert, const char *subject)
 {
   X509_CRL *crl=NULL;
   X509_REVOKED *revoked;

@@ -588,7 +589,10 @@ x509_verify_crl(const char *crl_file, X509 *peer_cert, const char *subject)
   struct gc_arena gc = gc_new();
   char *serial;
 
-  in = BIO_new_file (crl_file, "r");
+  if (!strcmp (crl_file, INLINE_FILE_TAG) && crl_inline)
+    in = BIO_new_mem_buf ((char *)crl_inline, -1);
+  else
+    in = BIO_new_file (crl_file, "r");
 
   if (in == NULL) {
     msg (M_WARN, "CRL: cannot read: %s", crl_file);

src/openvpn/ssl_verify_polarssl.c +16 -4

index a2e6a8e..d1b9f02 100644
@@ -359,18 +359,30 @@ x509_write_pem(FILE *peercert_file, x509_crt *peercert)
  * check peer cert against CRL
  */
 result_t
-x509_verify_crl(const char *crl_file, x509_crt *cert, const char *subject)
+x509_verify_crl(const char *crl_file, const char* crl_inline,
+                x509_crt *cert, const char *subject)
 {
   result_t retval = FAILURE;
   x509_crl crl = {0};
   struct gc_arena gc = gc_new();
   char *serial;
 
-  if (!polar_ok(x509_crl_parse_file(&crl, crl_file)))
+  if (!strcmp (crl_file, INLINE_FILE_TAG) && crl_inline)
     {
-      msg (M_WARN, "CRL: cannot read CRL from file %s", crl_file);
-      goto end;
+      if (!polar_ok(x509_crl_parse(&crl, crl_inline, strlen(crl_inline))))
+        {
+           msg (M_WARN, "CRL: cannot parse inline CRL");
+           goto end;
+        }
     }
+  else
+    {
+      if (!polar_ok(x509_crl_parse_file(&crl, crl_file)))
+      {
+          msg (M_WARN, "CRL: cannot read CRL from file %s", crl_file);
+          goto end;
+      }
+  }
 
   if(cert->issuer_raw.len != crl.issuer_raw.len ||
       memcmp(crl.issuer_raw.p, cert->issuer_raw.p, crl.issuer_raw.len) != 0)

Signature · 1 line

2.5.4 (Apple Git-61)

Arne Schwabe

author

2016-03-06 19:39 UTC #3 lore raw

PATCH v3 1/1 Implement inlining of crl files

In reply to Steffan Karger

OpenVPN 3 already supports inlining crl-verify, so <crl-verify> is already used in config files.

V2: Fixed PolarSSL and made formatting respect the 80 column limit
V3: Accidentally reverted one change too much in V2

---
 doc/openvpn.8                     |  3 ++-
 src/openvpn/init.c                |  1 +
 src/openvpn/options.c             | 11 ++++++++---
 src/openvpn/options.h             |  1 +
 src/openvpn/ssl_common.h          |  1 +
 src/openvpn/ssl_verify.c          |  2 +-
 src/openvpn/ssl_verify_backend.h  |  5 +++--
 src/openvpn/ssl_verify_openssl.c  |  8 ++++++--
 src/openvpn/ssl_verify_polarssl.c | 20 ++++++++++++++++----
 9 files changed, 39 insertions(+), 13 deletions(-)

doc/openvpn.8 +2 -1

index 628d877..decffc7 100644
@@ -6490,7 +6490,8 @@ X509_1_C=KG
 .\"*********************************************************
 .SH INLINE FILE SUPPORT
 OpenVPN allows including files in the main configuration for the
-.B \-\-ca, \-\-cert, \-\-dh, \-\-extra\-certs, \-\-key, \-\-pkcs12, \-\-secret
+.B \-\-ca, \-\-cert, \-\-dh, \-\-extra\-certs, \-\-key, \-\-pkcs12, \-\-secret,
+.B \-\-crl-verify
 and
 .B \-\-tls\-auth
 options.

src/openvpn/init.c +1 -0

index cb73a3d..33a1420 100644
@@ -2323,6 +2323,7 @@ do_init_crypto_tls (struct context *c, const unsigned int flags)
   to.verify_x509_type = (options->verify_x509_type & 0xff);
   to.verify_x509_name = options->verify_x509_name;
   to.crl_file = options->crl_file;
+  to.crl_file_inline = options->crl_file_inline;
   to.ssl_flags = options->ssl_flags;
   to.ns_cert_type = options->ns_cert_type;
   memmove (to.remote_cert_ku, options->remote_cert_ku, sizeof (to.remote_cert_ku));

src/openvpn/options.c +8 -3

index 02def3a..57f3dc5 100644
@@ -2747,8 +2747,8 @@ options_postprocess_filechecks (struct options *options)
     errs |= check_file_access_chroot (options->chroot_dir, CHKACC_FILE, options->crl_file, R_OK|X_OK,
                                "--crl-verify directory");
   else
-    errs |= check_file_access_chroot (options->chroot_dir, CHKACC_FILE, options->crl_file, R_OK,
-                               "--crl-verify");
+    errs |= check_file_access_chroot (options->chroot_dir, CHKACC_FILE|CHKACC_INLINE,
+                                      options->crl_file, R_OK, "--crl-verify");
 
   errs |= check_file_access (CHKACC_FILE|CHKACC_INLINE, options->tls_auth_file, R_OK,
                              "--tls-auth");

@@ -6783,12 +6783,17 @@ add_option (struct options *options,
       VERIFY_PERMISSION (OPT_P_GENERAL);
       options->cipher_list = p[1];
     }
-  else if (streq (p[0], "crl-verify") && p[1] && ((p[2] && streq(p[2], "dir")) || !p[2]) && !p[3])
+  else if (streq (p[0], "crl-verify") && p[1] && ((p[2] && streq(p[2], "dir"))
+		  || (p[2] && streq (p[1], INLINE_FILE_TAG) ) || !p[2]) && !p[3])
     {
       VERIFY_PERMISSION (OPT_P_GENERAL);
       if (p[2] && streq(p[2], "dir"))
 	options->ssl_flags |= SSLF_CRL_VERIFY_DIR;
       options->crl_file = p[1];
+      if (streq (p[1], INLINE_FILE_TAG) && p[2])
+	{
+	  options->crl_file_inline = p[2];
+	}
     }
   else if (streq (p[0], "tls-verify") && p[1])
     {

src/openvpn/options.h +1 -0

index 23d3992..8a26e14 100644
@@ -511,6 +511,7 @@ struct options
   const char *ca_file_inline;
   const char *cert_file_inline;
   const char *extra_certs_file_inline;
+  const char *crl_file_inline;
   char *priv_key_file_inline;
   const char *dh_file_inline;
   const char *pkcs12_file_inline; /* contains the base64 encoding of pkcs12 file */

src/openvpn/ssl_common.h +1 -0

index eaf4a91..334ccb0 100644
@@ -247,6 +247,7 @@ struct tls_options
   int verify_x509_type;
   const char *verify_x509_name;
   const char *crl_file;
+  const char *crl_file_inline;
   int ns_cert_type;
   unsigned remote_cert_ku[MAX_PARMS];
   const char *remote_cert_eku;

src/openvpn/ssl_verify.c +1 -1

index ccfa9d2..ea381f8 100644
@@ -690,7 +690,7 @@ verify_cert(struct tls_session *session, openvpn_x509_cert_t *cert, int cert_dep
       }
       else
       {
-	if (SUCCESS != x509_verify_crl(opt->crl_file, cert, subject))
+	if (SUCCESS != x509_verify_crl(opt->crl_file, opt->crl_file_inline, cert, subject))
 	  goto cleanup;
       }
     }

src/openvpn/ssl_verify_backend.h +3 -2

index 4e9ad60..17e88fb 100644
@@ -248,13 +248,14 @@ result_t x509_write_pem(FILE *peercert_file, openvpn_x509_cert_t *peercert);
  *
  * @param crl_file	File name of the CRL file
  * @param cert		Certificate to verify
+ * @param crl_inline	Contents of the crl file if it is inlined
  * @param subject	Subject of the given certificate
  *
  * @return 		\c SUCCESS if the CRL was not signed by the issuer of the
  * 			certificate or does not contain an entry for it.
  * 			\c FAILURE otherwise.
  */
-result_t x509_verify_crl(const char *crl_file, openvpn_x509_cert_t *cert,
-    const char *subject);
+result_t x509_verify_crl(const char *crl_file, const char *crl_inline,
+                         openvpn_x509_cert_t *cert, const char *subject);
 
 #endif /* SSL_VERIFY_BACKEND_H_ */

src/openvpn/ssl_verify_openssl.c +6 -2

index d014f9d..edbc2e4 100644
@@ -578,7 +578,8 @@ x509_write_pem(FILE *peercert_file, X509 *peercert)
  * check peer cert against CRL
  */
 result_t
-x509_verify_crl(const char *crl_file, X509 *peer_cert, const char *subject)
+x509_verify_crl(const char *crl_file, const char* crl_inline,
+                X509 *peer_cert, const char *subject)
 {
   X509_CRL *crl=NULL;
   X509_REVOKED *revoked;

@@ -588,7 +589,10 @@ x509_verify_crl(const char *crl_file, X509 *peer_cert, const char *subject)
   struct gc_arena gc = gc_new();
   char *serial;
 
-  in = BIO_new_file (crl_file, "r");
+  if (!strcmp (crl_file, INLINE_FILE_TAG) && crl_inline)
+    in = BIO_new_mem_buf ((char *)crl_inline, -1);
+  else
+    in = BIO_new_file (crl_file, "r");
 
   if (in == NULL) {
     msg (M_WARN, "CRL: cannot read: %s", crl_file);

src/openvpn/ssl_verify_polarssl.c +16 -4

index a2e6a8e..d1b9f02 100644
@@ -359,18 +359,30 @@ x509_write_pem(FILE *peercert_file, x509_crt *peercert)
  * check peer cert against CRL
  */
 result_t
-x509_verify_crl(const char *crl_file, x509_crt *cert, const char *subject)
+x509_verify_crl(const char *crl_file, const char* crl_inline,
+                x509_crt *cert, const char *subject)
 {
   result_t retval = FAILURE;
   x509_crl crl = {0};
   struct gc_arena gc = gc_new();
   char *serial;
 
-  if (!polar_ok(x509_crl_parse_file(&crl, crl_file)))
+  if (!strcmp (crl_file, INLINE_FILE_TAG) && crl_inline)
     {
-      msg (M_WARN, "CRL: cannot read CRL from file %s", crl_file);
-      goto end;
+      if (!polar_ok(x509_crl_parse(&crl, crl_inline, strlen(crl_inline))))
+        {
+           msg (M_WARN, "CRL: cannot parse inline CRL");
+           goto end;
+        }
     }
+  else
+    {
+      if (!polar_ok(x509_crl_parse_file(&crl, crl_file)))
+      {
+          msg (M_WARN, "CRL: cannot read CRL from file %s", crl_file);
+          goto end;
+      }
+  }
 
   if(cert->issuer_raw.len != crl.issuer_raw.len ||
       memcmp(crl.issuer_raw.p, cert->issuer_raw.p, crl.issuer_raw.len) != 0)

Signature · 1 line

2.5.4 (Apple Git-61)

Steffan Karger

2016-03-06 19:49 UTC #4 lore raw

Quoted 191 lines · Arne Schwabe

OpenVPN 3 already supports inlining crl-verify, so <crl-verify> is already used in config files.

V2: Fixed PolarSSL and made formatting respect the 80 column limit
V3: Accidentally reverted one change too much in V2

---
 doc/openvpn.8                     |  3 ++-
 src/openvpn/init.c                |  1 +
 src/openvpn/options.c             | 11 ++++++++---
 src/openvpn/options.h             |  1 +
 src/openvpn/ssl_common.h          |  1 +
 src/openvpn/ssl_verify.c          |  2 +-
 src/openvpn/ssl_verify_backend.h  |  5 +++--
 src/openvpn/ssl_verify_openssl.c  |  8 ++++++--
 src/openvpn/ssl_verify_polarssl.c | 20 ++++++++++++++++----
 9 files changed, 39 insertions(+), 13 deletions(-)

doc/openvpn.8 +2 -1

index 628d877..decffc7 100644
@@ -6490,7 +6490,8 @@ X509_1_C=KG
 .\"*********************************************************
 .SH INLINE FILE SUPPORT
 OpenVPN allows including files in the main configuration for the
-.B \-\-ca, \-\-cert, \-\-dh, \-\-extra\-certs, \-\-key, \-\-pkcs12, \-\-secret
+.B \-\-ca, \-\-cert, \-\-dh, \-\-extra\-certs, \-\-key, \-\-pkcs12, \-\-secret,
+.B \-\-crl-verify
 and
 .B \-\-tls\-auth
 options.

src/openvpn/init.c +1 -0

index cb73a3d..33a1420 100644
@@ -2323,6 +2323,7 @@ do_init_crypto_tls (struct context *c, const unsigned int flags)
   to.verify_x509_type = (options->verify_x509_type & 0xff);
   to.verify_x509_name = options->verify_x509_name;
   to.crl_file = options->crl_file;
+  to.crl_file_inline = options->crl_file_inline;
   to.ssl_flags = options->ssl_flags;
   to.ns_cert_type = options->ns_cert_type;
   memmove (to.remote_cert_ku, options->remote_cert_ku, sizeof (to.remote_cert_ku));

src/openvpn/options.c +8 -3

index 02def3a..57f3dc5 100644
@@ -2747,8 +2747,8 @@ options_postprocess_filechecks (struct options *options)
     errs |= check_file_access_chroot (options->chroot_dir, CHKACC_FILE, options->crl_file, R_OK|X_OK,
                                "--crl-verify directory");
   else
-    errs |= check_file_access_chroot (options->chroot_dir, CHKACC_FILE, options->crl_file, R_OK,
-                               "--crl-verify");
+    errs |= check_file_access_chroot (options->chroot_dir, CHKACC_FILE|CHKACC_INLINE,
+                                      options->crl_file, R_OK, "--crl-verify");
 
   errs |= check_file_access (CHKACC_FILE|CHKACC_INLINE, options->tls_auth_file, R_OK,
                              "--tls-auth");

@@ -6783,12 +6783,17 @@ add_option (struct options *options,
       VERIFY_PERMISSION (OPT_P_GENERAL);
       options->cipher_list = p[1];
     }
-  else if (streq (p[0], "crl-verify") && p[1] && ((p[2] && streq(p[2], "dir")) || !p[2]) && !p[3])
+  else if (streq (p[0], "crl-verify") && p[1] && ((p[2] && streq(p[2], "dir"))
+                 || (p[2] && streq (p[1], INLINE_FILE_TAG) ) || !p[2]) && !p[3])
     {
       VERIFY_PERMISSION (OPT_P_GENERAL);
       if (p[2] && streq(p[2], "dir"))
        options->ssl_flags |= SSLF_CRL_VERIFY_DIR;
       options->crl_file = p[1];
+      if (streq (p[1], INLINE_FILE_TAG) && p[2])
+       {
+         options->crl_file_inline = p[2];
+       }
     }
   else if (streq (p[0], "tls-verify") && p[1])
     {

src/openvpn/options.h +1 -0

index 23d3992..8a26e14 100644
@@ -511,6 +511,7 @@ struct options
   const char *ca_file_inline;
   const char *cert_file_inline;
   const char *extra_certs_file_inline;
+  const char *crl_file_inline;
   char *priv_key_file_inline;
   const char *dh_file_inline;
   const char *pkcs12_file_inline; /* contains the base64 encoding of pkcs12 file */

src/openvpn/ssl_common.h +1 -0

index eaf4a91..334ccb0 100644
@@ -247,6 +247,7 @@ struct tls_options
   int verify_x509_type;
   const char *verify_x509_name;
   const char *crl_file;
+  const char *crl_file_inline;
   int ns_cert_type;
   unsigned remote_cert_ku[MAX_PARMS];
   const char *remote_cert_eku;

src/openvpn/ssl_verify.c +1 -1

index ccfa9d2..ea381f8 100644
@@ -690,7 +690,7 @@ verify_cert(struct tls_session *session, openvpn_x509_cert_t *cert, int cert_dep
       }
       else
       {
-       if (SUCCESS != x509_verify_crl(opt->crl_file, cert, subject))
+       if (SUCCESS != x509_verify_crl(opt->crl_file, opt->crl_file_inline, cert, subject))
          goto cleanup;
       }
     }

src/openvpn/ssl_verify_backend.h +3 -2

index 4e9ad60..17e88fb 100644
@@ -248,13 +248,14 @@ result_t x509_write_pem(FILE *peercert_file, openvpn_x509_cert_t *peercert);
  *
  * @param crl_file     File name of the CRL file
  * @param cert         Certificate to verify
+ * @param crl_inline   Contents of the crl file if it is inlined
  * @param subject      Subject of the given certificate
  *
  * @return             \c SUCCESS if the CRL was not signed by the issuer of the
  *                     certificate or does not contain an entry for it.
  *                     \c FAILURE otherwise.
  */
-result_t x509_verify_crl(const char *crl_file, openvpn_x509_cert_t *cert,
-    const char *subject);
+result_t x509_verify_crl(const char *crl_file, const char *crl_inline,
+                         openvpn_x509_cert_t *cert, const char *subject);
 
 #endif /* SSL_VERIFY_BACKEND_H_ */

src/openvpn/ssl_verify_openssl.c +6 -2

index d014f9d..edbc2e4 100644
@@ -578,7 +578,8 @@ x509_write_pem(FILE *peercert_file, X509 *peercert)
  * check peer cert against CRL
  */
 result_t
-x509_verify_crl(const char *crl_file, X509 *peer_cert, const char *subject)
+x509_verify_crl(const char *crl_file, const char* crl_inline,
+                X509 *peer_cert, const char *subject)
 {
   X509_CRL *crl=NULL;
   X509_REVOKED *revoked;

@@ -588,7 +589,10 @@ x509_verify_crl(const char *crl_file, X509 *peer_cert, const char *subject)
   struct gc_arena gc = gc_new();
   char *serial;
 
-  in = BIO_new_file (crl_file, "r");
+  if (!strcmp (crl_file, INLINE_FILE_TAG) && crl_inline)
+    in = BIO_new_mem_buf ((char *)crl_inline, -1);
+  else
+    in = BIO_new_file (crl_file, "r");
 
   if (in == NULL) {
     msg (M_WARN, "CRL: cannot read: %s", crl_file);

src/openvpn/ssl_verify_polarssl.c +9 -4

index a2e6a8e..d1b9f02 100644
@@ -359,18 +359,30 @@ x509_write_pem(FILE *peercert_file, x509_crt *peercert)
  * check peer cert against CRL
  */
 result_t
-x509_verify_crl(const char *crl_file, x509_crt *cert, const char *subject)
+x509_verify_crl(const char *crl_file, const char* crl_inline,
+                x509_crt *cert, const char *subject)
 {
   result_t retval = FAILURE;
   x509_crl crl = {0};
   struct gc_arena gc = gc_new();
   char *serial;
 
-  if (!polar_ok(x509_crl_parse_file(&crl, crl_file)))
+  if (!strcmp (crl_file, INLINE_FILE_TAG) && crl_inline)
     {
-      msg (M_WARN, "CRL: cannot read CRL from file %s", crl_file);
-      goto end;
+      if (!polar_ok(x509_crl_parse(&crl, crl_inline, strlen(crl_inline))))
+        {
+           msg (M_WARN, "CRL: cannot parse inline CRL");
+           goto end;
+        }
     }
+  else

src/openvpn/ssl_verify_polarssl.c x509_write_pem(FILE *peercert_file, x509_crt *peercert) · line 388

Quoted 10 lines

src/openvpn/ssl_verify_polarssl.c +7 -0

+    {
+      if (!polar_ok(x509_crl_parse_file(&crl, crl_file)))
+      {
+          msg (M_WARN, "CRL: cannot read CRL from file %s", crl_file);
+          goto end;
+      }
+  }
 
   if(cert->issuer_raw.len != crl.issuer_raw.len ||
       memcmp(crl.issuer_raw.p, cert->issuer_raw.p, crl.issuer_raw.len) != 0)

Thanks, I'm happy now ;) ACK

-Steffan

Gert Doering

2016-04-04 19:36 UTC #5 lore raw

[Openvpn-devel] [PATCH applied] Re: Implement inlining of crl files [v3]

In reply to Arne Schwabe

Your patch has been applied to the master branch.

(I changed one word in the commit message, it said "mobile files" but I think it wanted to say "mobile devices")

commit 7a7a79f62eb04b0089ae304d558f15c5532c0e61 (master)

Author: Arne Schwabe
Date:   Sun Mar 6 20:39:09 2016 +0100

     Implement inlining of crl files

     Acked-by: Steffan Karger <[email protected]...>
     Message-Id: <[email protected]...>
     URL: http://article.gmane.org/gmane.network.openvpn.devel/11337
     Signed-off-by: Gert Doering <[email protected]...>

--
kind regards,

Gert Doering