MEDIUM: ssl: Add "show ssl crl-file" CLI command

This patch adds the "show ssl crl-file [<crlfile>]" CLI command. This
command can be used to display the list of all the known CRL files when
no specific file name is specified, or to display the details of a
specific CRL file when a name is given.
The details displayed for a specific CRL file are inspired by the ones
shown by a "openssl crl -text -noout -in <filename>".

diff --git a/src/ssl_ckch.c b/src/ssl_ckch.c
index 6839f3ad6e74093605cfd8803cb3ad639e88e9ec..378e95698e04af355e04969b54ad07af11fbf80b 100644 (file)
--- a/src/ssl_ckch.c
+++ b/src/ssl_ckch.c
@@ -3250,6 +3250,284 @@ error:
 }
 
 
+/*
+ * Display a Certificate Resignation List's information.
+ * The information displayed is inspired by the output of 'openssl crl -in
+ * crl.pem -text'.
+ * Returns 0 in case of success.
+ */
+static int show_crl_detail(X509_CRL *crl, struct buffer *out)
+{
+       BIO *bio = NULL;
+       struct buffer *tmp = alloc_trash_chunk();
+       long version;
+       X509_NAME *issuer;
+       int write = -1;
+       STACK_OF(X509_REVOKED) *rev = NULL;
+       X509_REVOKED *rev_entry = NULL;
+       int i;
+
+       if (!tmp)
+               return -1;
+
+       if ((bio = BIO_new(BIO_s_mem())) == NULL)
+               goto end;
+
+       /* Version (as displayed by 'openssl crl') */
+       version = X509_CRL_get_version(crl);
+       chunk_appendf(out, "Version %ld\n", version + 1);
+
+       /* Signature Algorithm */
+       chunk_appendf(out, "Signature Algorithm: %s\n", OBJ_nid2ln(X509_CRL_get_signature_nid(crl)));
+
+       /* Issuer */
+       chunk_appendf(out, "Issuer: ");
+       if ((issuer = X509_CRL_get_issuer(crl)) == NULL)
+               goto end;
+       if ((ssl_sock_get_dn_oneline(issuer, tmp)) == -1)
+               goto end;
+       *(tmp->area + tmp->data) = '\0';
+       chunk_appendf(out, "%s\n", tmp->area);
+
+       /* Last Update */
+       chunk_appendf(out, "Last Update: ");
+       chunk_reset(tmp);
+       BIO_reset(bio);
+       if (ASN1_TIME_print(bio, X509_CRL_get0_lastUpdate(crl)) == 0)
+               goto end;
+       write = BIO_read(bio, tmp->area, tmp->size-1);
+       tmp->area[write] = '\0';
+       chunk_appendf(out, "%s\n", tmp->area);
+
+
+       /* Next Update */
+       chunk_appendf(out, "Next Update: ");
+       chunk_reset(tmp);
+       BIO_reset(bio);
+       if (ASN1_TIME_print(bio, X509_CRL_get0_nextUpdate(crl)) == 0)
+               goto end;
+       write = BIO_read(bio, tmp->area, tmp->size-1);
+       tmp->area[write] = '\0';
+       chunk_appendf(out, "%s\n", tmp->area);
+
+
+       /* Revoked Certificates */
+       rev = X509_CRL_get_REVOKED(crl);
+       if (sk_X509_REVOKED_num(rev) > 0)
+               chunk_appendf(out, "Revoked Certificates:\n");
+       else
+               chunk_appendf(out, "No Revoked Certificates.\n");
+
+       for (i = 0; i < sk_X509_REVOKED_num(rev); i++) {
+               rev_entry = sk_X509_REVOKED_value(rev, i);
+
+               /* Serial Number and Revocation Date */
+               BIO_reset(bio);
+               BIO_printf(bio , "    Serial Number: ");
+               i2a_ASN1_INTEGER(bio, X509_REVOKED_get0_serialNumber(rev_entry));
+               BIO_printf(bio, "\n        Revocation Date: ");
+               ASN1_TIME_print(bio, X509_REVOKED_get0_revocationDate(rev_entry));
+               BIO_printf(bio, "\n");
+
+               write = BIO_read(bio, tmp->area, tmp->size-1);
+               tmp->area[write] = '\0';
+               chunk_appendf(out, "%s", tmp->area);
+       }
+
+end:
+       free_trash_chunk(tmp);
+       if (bio)
+               BIO_free(bio);
+
+       return 0;
+}
+
+/* IO handler of details "show ssl crl-file <filename[:index]>" */
+static int cli_io_handler_show_crlfile_detail(struct appctx *appctx)
+{
+       struct stream_interface *si = appctx->owner;
+       struct cafile_entry *cafile_entry = appctx->ctx.cli.p0;
+       struct buffer *out = alloc_trash_chunk();
+       int i;
+       X509_CRL *crl;
+       STACK_OF(X509_OBJECT) *objs;
+       int retval = 0;
+       long index = (long)appctx->ctx.cli.p1;
+
+       if (!out)
+               goto end_no_putchk;
+
+       chunk_appendf(out, "Filename: ");
+       if (cafile_entry == crlfile_transaction.new_crlfile_entry)
+               chunk_appendf(out, "*");
+       chunk_appendf(out, "%s\n", cafile_entry->path);
+
+       chunk_appendf(out, "Status: ");
+       if (!cafile_entry->ca_store)
+               chunk_appendf(out, "Empty\n");
+       else if (LIST_ISEMPTY(&cafile_entry->ckch_inst_link))
+               chunk_appendf(out, "Unused\n");
+       else
+               chunk_appendf(out, "Used\n");
+
+       if (!cafile_entry->ca_store)
+               goto end;
+
+       objs = X509_STORE_get0_objects(cafile_entry->ca_store);
+       for (i = 0; i < sk_X509_OBJECT_num(objs); i++) {
+               crl = X509_OBJECT_get0_X509_CRL(sk_X509_OBJECT_value(objs, i));
+               if (!crl)
+                       continue;
+
+               /* CRL indexes start at 1 on the CLI output. */
+               if (index && index-1 != i)
+                       continue;
+
+               chunk_appendf(out, "\nCertificate Revocation List #%d:\n", i+1);
+               retval = show_crl_detail(crl, out);
+               if (retval < 0)
+                       goto end_no_putchk;
+               else if (retval || index)
+                       goto end;
+       }
+
+end:
+       if (ci_putchk(si_ic(si), out) == -1) {
+               si_rx_room_blk(si);
+               goto yield;
+       }
+
+end_no_putchk:
+       free_trash_chunk(out);
+       return 1;
+yield:
+       free_trash_chunk(out);
+       return 0; /* should come back */
+}
+
+/* parsing function for 'show ssl crl-file [crlfile[:index]]' */
+static int cli_parse_show_crlfile(char **args, char *payload, struct appctx *appctx, void *private)
+{
+       struct cafile_entry *cafile_entry;
+       long index = 0;
+       char *colons;
+       char *err = NULL;
+
+       if (!cli_has_level(appctx, ACCESS_LVL_OPER))
+               return cli_err(appctx, "Can't allocate memory!\n");
+
+       /* The operations on the CKCH architecture are locked so we can
+        * manipulate ckch_store and ckch_inst */
+       if (HA_SPIN_TRYLOCK(CKCH_LOCK, &ckch_lock))
+               return cli_err(appctx, "Can't show!\nOperations on certificates are currently locked!\n");
+
+       /* check if there is a certificate to lookup */
+       if (*args[3]) {
+
+               /* Look for an optional index after the CRL file name */
+               colons = strchr(args[3], ':');
+               if (colons) {
+                       char *endptr;
+
+                       index = strtol(colons + 1, &endptr, 10);
+                       /* Indexes start at 1 */
+                       if (colons + 1 == endptr || *endptr != '\0' || index <= 0) {
+                               memprintf(&err, "wrong CRL index after colons in '%s'!", args[3]);
+                               goto error;
+                       }
+                       *colons = '\0';
+               }
+
+               if (*args[3] == '*') {
+                       if (!crlfile_transaction.new_crlfile_entry)
+                               goto error;
+
+                       cafile_entry = crlfile_transaction.new_crlfile_entry;
+
+                       if (strcmp(args[3] + 1, cafile_entry->path) != 0)
+                               goto error;
+
+               } else {
+                       /* Get the "original" cafile_entry and not the
+                        * uncommitted one if it exists. */
+                       if ((cafile_entry = ssl_store_get_cafile_entry(args[3], 1)) == NULL || cafile_entry->type != CAFILE_CRL)
+                               goto error;
+               }
+
+               appctx->ctx.cli.p0 = cafile_entry;
+               appctx->ctx.cli.p1 = (void*)index;
+               /* use the IO handler that shows details */
+               appctx->io_handler = cli_io_handler_show_crlfile_detail;
+       }
+
+       return 0;
+
+error:
+       HA_SPIN_UNLOCK(CKCH_LOCK, &ckch_lock);
+       if (err)
+               return cli_dynerr(appctx, err);
+       return cli_err(appctx, "Can't display the CA file : Not found!\n");
+}
+
+/* IO handler of "show ssl crl-file". The command taking a specific CRL file name
+ * is managed in cli_io_handler_show_crlfile_detail. */
+static int cli_io_handler_show_crlfile(struct appctx *appctx)
+{
+       struct buffer *trash = alloc_trash_chunk();
+       struct ebmb_node *node;
+       struct stream_interface *si = appctx->owner;
+       struct cafile_entry *cafile_entry;
+
+       if (trash == NULL)
+               return 1;
+
+       if (!appctx->ctx.ssl.old_crlfile_entry) {
+               if (crlfile_transaction.old_crlfile_entry) {
+                       chunk_appendf(trash, "# transaction\n");
+                       chunk_appendf(trash, "*%s\n", crlfile_transaction.old_crlfile_entry->path);
+               }
+       }
+
+       /* First time in this io_handler. */
+       if (!appctx->ctx.cli.p0) {
+               chunk_appendf(trash, "# filename\n");
+               node = ebmb_first(&cafile_tree);
+       } else {
+               /* We yielded during a previous call. */
+               node = &((struct cafile_entry*)appctx->ctx.cli.p0)->node;
+       }
+
+       while (node) {
+               cafile_entry = ebmb_entry(node, struct cafile_entry, node);
+               if (cafile_entry->type == CAFILE_CRL) {
+                       chunk_appendf(trash, "%s\n", cafile_entry->path);
+               }
+
+               node = ebmb_next(node);
+               if (ci_putchk(si_ic(si), trash) == -1) {
+                       si_rx_room_blk(si);
+                       goto yield;
+               }
+       }
+
+       appctx->ctx.cli.p0 = NULL;
+       free_trash_chunk(trash);
+       return 1;
+yield:
+
+       free_trash_chunk(trash);
+       appctx->ctx.cli.p0 = cafile_entry;
+       return 0; /* should come back */
+}
+
+
+/* release function of the 'show ssl crl-file' command */
+static void cli_release_show_crlfile(struct appctx *appctx)
+{
+       HA_SPIN_UNLOCK(CKCH_LOCK, &ckch_lock);
+}
+
+
 void ckch_deinit()
 {
        struct eb_node *node, *next;
@@ -3285,6 +3563,7 @@ static struct cli_kw_list cli_kws = {{ },{
        { { "commit", "ssl", "crl-file", NULL },"commit ssl crl-file <crlfile>           : commit a CRL file",                                                     cli_parse_commit_crlfile, cli_io_handler_commit_cafile_crlfile, cli_release_commit_crlfile },
        { { "abort", "ssl", "crl-file", NULL }, "abort ssl crl-file <crlfile>            : abort a transaction for a CRL file",                                    cli_parse_abort_crlfile, NULL, NULL },
        { { "del", "ssl", "crl-file", NULL },   "del ssl crl-file <crlfile>              : delete an unused CRL file",                                             cli_parse_del_crlfile, NULL, NULL },
+       { { "show", "ssl", "crl-file", NULL },  "show ssl crl-file [<crlfile[:<index>>]] : display the SSL CRL files used in memory, or the details of a <crlfile>, or a single CRL of index <index> of CRL file <crlfile>", cli_parse_show_crlfile, cli_io_handler_show_crlfile, cli_release_show_crlfile },
        { { NULL }, NULL, NULL, NULL }
 }};