Skip to content

Commit 35cf683

Browse files
mcdonaldseanpmcdonaldseanp
authored
Merge pull request #253 from donoghuc/mergeup-crl
Mergeup crl
2 parents 5f28f71 + e83f6ad commit 35cf683

34 files changed

+669
-20
lines changed

‎.travis.yml

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,6 @@ services:
44

55
before_install:
66
- docker pull gcr.io/cpp-projects/cpp-ci:1
7-
87
script:
98
- >
109
docker run -v `pwd`:/cpp-pcp-client gcr.io/cpp-projects/cpp-ci:1 /bin/bash -c "

‎README.md

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -169,6 +169,7 @@ The constructor of the Connector class is defined as:
169169
std::string ca_crt_path,
170170
std::string client_crt_path,
171171
std::string client_key_path,
172+
std::string client_crl_path,
172173
std::string proxy,
173174
long ws_connection_timeout_ms = 5000,
174175
uint32_t association_timeout_s = 15,
@@ -186,6 +187,7 @@ The parameters are described as:
186187
- ca_crt_path - The path to your CA certificate file.
187188
- client_crt_path - The path to a client certificate file generated by your CA.
188189
- client_key_path - The path to a client public key file generated by you CA.
190+
- client_crl_path - The path to a certificate revocation list file.
189191
- proxy - The proxy URI you wish to connect to PCP-broker over. ex: `http://localhost:3128`
190192
- ws_connection_timeout_ms - The timeout for initiating the WebSocket handshake (in milliseconds). Defaults to 5000 ms.
191193
- association_timeout_s - The timeout for the completion of the PCP Association. Defaults to 3 s.
@@ -199,6 +201,7 @@ This means that you can instantiate a Connector object as follows:
199201
"/etc/puppet/ssl/ca/ca_crt.pem",
200202
"/etc/puppet/ssl/certs/client_crt.pem",
201203
"/etc/puppet/ssl/public_keys/client_key.pem",
204+
"/etc/puppet/ssl/crl.pem",
202205
"", // no proxy
203206
4000, // WebSocket connection timeout
204207
5 }; // PCP Association timeout
@@ -212,6 +215,7 @@ An alternate constructor for Connector also exists that takes a list of brokers,
212215
"/etc/puppet/ssl/ca/ca_crt.pem",
213216
"/etc/puppet/ssl/certs/client_crt.pem",
214217
"/etc/puppet/ssl/public_keys/client_key.pem",
218+
"/etc/puppet/ssl/crl.pem",
215219
"", // no proxy
216220
4000, // WebSocket connection timeout
217221
5 }; // PCP Association timeout

‎lib/inc/cpp-pcp-client/connector/client_metadata.hpp

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ class LIBCPP_PCP_CLIENT_EXPORT ClientMetadata {
1717
std::string ca;
1818
std::string crt;
1919
std::string key;
20+
std::string crl;
2021
std::string client_type;
2122
std::string common_name;
2223
std::string uri;
@@ -39,7 +40,7 @@ class LIBCPP_PCP_CLIENT_EXPORT ClientMetadata {
3940
uint32_t _pong_timeouts_before_retry,
4041
long _pong_timeout_ms);
4142

42-
// constructor for proxy addition
43+
// constructor proxy addition
4344
ClientMetadata(std::string _client_type,
4445
std::string _ca,
4546
std::string _crt,
@@ -48,6 +49,17 @@ class LIBCPP_PCP_CLIENT_EXPORT ClientMetadata {
4849
long _ws_connection_timeout_ms,
4950
uint32_t _pong_timeouts_before_retry,
5051
long _pong_timeout_ms);
52+
53+
// constructor crl addition
54+
ClientMetadata(std::string _client_type,
55+
std::string _ca,
56+
std::string _crt,
57+
std::string _key,
58+
std::string _crl,
59+
std::string proxy,
60+
long _ws_connection_timeout_ms,
61+
uint32_t _pong_timeouts_before_retry,
62+
long _pong_timeout_ms);
5163
};
5264

5365
} // namespace PCPClient

‎lib/inc/cpp-pcp-client/connector/connector_base.hpp

Lines changed: 13 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@ class LIBCPP_PCP_CLIENT_EXPORT ConnectorBase {
3737
uint32_t pong_timeouts_before_retry,
3838
long ws_pong_timeout_ms);
3939

40-
// constructor for proxy addition
40+
// constructor proxy addition
4141
ConnectorBase(std::vector<std::string> broker_ws_uris,
4242
std::string client_type,
4343
std::string ca_crt_path,
@@ -48,6 +48,18 @@ class LIBCPP_PCP_CLIENT_EXPORT ConnectorBase {
4848
uint32_t pong_timeouts_before_retry,
4949
long ws_pong_timeout_ms);
5050

51+
// constructor crl addition
52+
ConnectorBase(std::vector<std::string> broker_ws_uris,
53+
std::string client_type,
54+
std::string ca_crt_path,
55+
std::string client_crt_path,
56+
std::string client_key_path,
57+
std::string client_crl_path,
58+
std::string ws_proxy,
59+
long ws_connection_timeout_ms,
60+
uint32_t pong_timeouts_before_retry,
61+
long ws_pong_timeout_ms);
62+
5163
/// Calls stopMonitorTaskAndWait if the Monitoring Task thread is
5264
/// still active. In case an exception was previously stored by
5365
/// the Monitoring Task, the error message will be logged, but

‎lib/inc/cpp-pcp-client/connector/v1/connector.hpp

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,20 @@ class LIBCPP_PCP_CLIENT_EXPORT Connector : public ConnectorBase {
5353
uint32_t pong_timeouts_before_retry = 3,
5454
long ws_pong_timeout_ms = 5000);
5555

56+
// constructor for crl addition
57+
Connector(std::string broker_ws_uri,
58+
std::string client_type,
59+
std::string ca_crt_path,
60+
std::string client_crt_path,
61+
std::string client_key_path,
62+
std::string client_crl_path,
63+
std::string ws_proxy,
64+
long ws_connection_timeout_ms = 5000,
65+
uint32_t association_timeout_s = 15,
66+
uint32_t association_request_ttl_s = 10, // Unused
67+
uint32_t pong_timeouts_before_retry = 3,
68+
long ws_pong_timeout_ms = 5000);
69+
5670
// legacy constructor: pre proxy
5771
Connector(std::vector<std::string> broker_ws_uris,
5872
std::string client_type,
@@ -78,6 +92,20 @@ class LIBCPP_PCP_CLIENT_EXPORT Connector : public ConnectorBase {
7892
uint32_t pong_timeouts_before_retry = 3,
7993
long ws_pong_timeout_ms = 5000);
8094

95+
// constructor for crl addition
96+
Connector(std::vector<std::string> broker_ws_uris,
97+
std::string client_type,
98+
std::string ca_crt_path,
99+
std::string client_crt_path,
100+
std::string client_key_path,
101+
std::string client_crl_path,
102+
std::string ws_proxy,
103+
long ws_connection_timeout_ms = 5000,
104+
uint32_t association_timeout_s = 15,
105+
uint32_t association_request_ttl_s = 10, // Unused
106+
uint32_t pong_timeouts_before_retry = 3,
107+
long ws_pong_timeout_ms = 5000);
108+
81109
/// Set an optional callback for associate responses
82110
void setAssociateCallback(MessageCallback callback);
83111

‎lib/inc/cpp-pcp-client/connector/v2/connector.hpp

Lines changed: 24 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -48,6 +48,18 @@ class LIBCPP_PCP_CLIENT_EXPORT Connector : public ConnectorBase {
4848
uint32_t pong_timeouts_before_retry = 3,
4949
long ws_pong_timeout_ms = 5000);
5050

51+
// constructor for crl addition
52+
Connector(std::string broker_ws_uri,
53+
std::string client_type,
54+
std::string ca_crt_path,
55+
std::string client_crt_path,
56+
std::string client_key_path,
57+
std::string client_crl_path,
58+
std::string ws_proxy,
59+
long ws_connection_timeout_ms = 5000,
60+
uint32_t pong_timeouts_before_retry = 3,
61+
long ws_pong_timeout_ms = 5000);
62+
5163
// legacy constructor: pre proxy
5264
Connector(std::vector<std::string> broker_ws_uris,
5365
std::string client_type,
@@ -69,6 +81,18 @@ class LIBCPP_PCP_CLIENT_EXPORT Connector : public ConnectorBase {
6981
uint32_t pong_timeouts_before_retry = 3,
7082
long ws_pong_timeout_ms = 5000);
7183

84+
// constructor for proxy addition
85+
Connector(std::vector<std::string> broker_ws_uris,
86+
std::string client_type,
87+
std::string ca_crt_path,
88+
std::string client_crt_path,
89+
std::string client_key_path,
90+
std::string client_crl_path,
91+
std::string ws_proxy,
92+
long ws_connection_timeout_ms = 5000,
93+
uint32_t pong_timeouts_before_retry = 3,
94+
long ws_pong_timeout_ms = 5000);
95+
7296
/// Send the specified message.
7397
/// Throw a connection_processing_error in case of failure;
7498
/// throw a connection_not_init_error in case the connection

‎lib/src/connector/client_metadata.cc

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -154,4 +154,33 @@ ClientMetadata::ClientMetadata(std::string _client_type,
154154
LOG_DEBUG("Validated the private key / certificate pair");
155155
}
156156

157+
// constructor for crl addition
158+
ClientMetadata::ClientMetadata(std::string _client_type,
159+
std::string _ca,
160+
std::string _crt,
161+
std::string _key,
162+
std::string _crl,
163+
std::string _proxy,
164+
long _ws_connection_timeout_ms,
165+
uint32_t _pong_timeouts_before_retry,
166+
long _pong_timeout_ms)
167+
: ca { std::move(_ca) },
168+
crt { std::move(_crt) },
169+
key { std::move(_key) },
170+
crl { std::move(_crl) },
171+
proxy { std::move(_proxy) },
172+
client_type { std::move(_client_type) },
173+
common_name { getCommonNameFromCert(crt) },
174+
uri { PCP_URI_SCHEME + common_name + "/" + client_type },
175+
ws_connection_timeout_ms { std::move(_ws_connection_timeout_ms) },
176+
pong_timeouts_before_retry { std::move(_pong_timeouts_before_retry) },
177+
pong_timeout_ms { std::move(_pong_timeout_ms) }
178+
{
179+
LOG_INFO("Retrieved common name from the certificate and determined "
180+
"the client URI: {1}", uri);
181+
validatePrivateKeyCertPair(key, crt);
182+
LOG_DEBUG("Validated the private key / certificate pair");
183+
}
184+
185+
157186
} // namespace PCPClient

‎lib/src/connector/connection.cc

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,11 @@
4040
#include <random>
4141
#include <algorithm>
4242

43+
// We need to modify underlying openssl object to set CRL.
44+
// These includes exposes methods for reading and validating
45+
// against a CRL.
46+
#include <openssl/x509_vfy.h>
47+
4348
// TODO(ale): disable assert() once we're confident with the code...
4449
// To disable assert()
4550
// #define NDEBUG
@@ -500,6 +505,17 @@ WS_Context_Ptr Connection::onTlsInit(WS_Connection_Handle hdl)
500505
boost::asio::ssl::context::file_format::pem);
501506
ctx->load_verify_file(client_metadata_.ca);
502507

508+
if (client_metadata_.crl.length() > 0) {
509+
LOG_DEBUG("Using CRL file: {1}", client_metadata_.crl);
510+
auto x509_store = SSL_CTX_get_cert_store(ctx->native_handle());
511+
X509_LOOKUP* lu = X509_STORE_add_lookup(x509_store, X509_LOOKUP_file());
512+
// Returns the number of objects loaded from CRL file or 0 on error
513+
if (X509_load_crl_file(lu, client_metadata_.crl.c_str(), X509_FILETYPE_PEM) == 0) {
514+
throw connection_config_error {
515+
lth_loc::format("Cannot load crl file: {1}", client_metadata_.crl) };
516+
}
517+
X509_STORE_set_flags(x509_store, (X509_V_FLAG_CRL_CHECK_ALL | X509_V_FLAG_CRL_CHECK));
518+
}
503519
auto uri_txt = getWsUri();
504520
auto uri = websocketpp::uri(uri_txt);
505521
ctx->set_verify_mode(boost::asio::ssl::verify_peer);

‎lib/src/connector/connector_base.cc

Lines changed: 32 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -71,6 +71,38 @@ ConnectorBase::ConnectorBase(std::vector<std::string> broker_ws_uris,
7171
must_stop_monitoring_ { false }
7272
{ }
7373

74+
// constructor for crl addition
75+
ConnectorBase::ConnectorBase(std::vector<std::string> broker_ws_uris,
76+
std::string client_type,
77+
std::string ca_crt_path,
78+
std::string client_crt_path,
79+
std::string client_key_path,
80+
std::string client_crl_path,
81+
std::string ws_proxy,
82+
long ws_connection_timeout_ms,
83+
uint32_t pong_timeouts_before_retry,
84+
long ws_pong_timeout_ms)
85+
: connection_ptr_ { nullptr },
86+
broker_ws_uris_ { std::move(broker_ws_uris) },
87+
client_metadata_ { std::move(client_type),
88+
std::move(ca_crt_path),
89+
std::move(client_crt_path),
90+
std::move(client_key_path),
91+
std::move(client_crl_path),
92+
std::move(ws_proxy),
93+
std::move(ws_connection_timeout_ms),
94+
std::move(pong_timeouts_before_retry),
95+
std::move(ws_pong_timeout_ms)},
96+
validator_ {},
97+
schema_callback_pairs_ {},
98+
error_callback_ {},
99+
is_monitoring_ { false },
100+
monitor_thread_ {},
101+
monitor_mutex_ {},
102+
monitor_cond_var_ {},
103+
must_stop_monitoring_ { false }
104+
{ }
105+
74106
ConnectorBase::~ConnectorBase()
75107
{
76108
if (connection_ptr_ != nullptr) {

‎lib/src/connector/v1/connector.cc

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -88,6 +88,33 @@ Connector::Connector(std::string broker_ws_uri,
8888
std::move(ws_pong_timeout_ms)}
8989
{
9090
}
91+
// constructor for crl addition
92+
Connector::Connector(std::string broker_ws_uri,
93+
std::string client_type,
94+
std::string ca_crt_path,
95+
std::string client_crt_path,
96+
std::string client_key_path,
97+
std::string client_crl_path,
98+
std::string ws_proxy,
99+
long ws_connection_timeout_ms,
100+
uint32_t association_timeout_s,
101+
uint32_t association_request_ttl_s,
102+
uint32_t pong_timeouts_before_retry,
103+
long ws_pong_timeout_ms)
104+
: Connector { std::vector<std::string> { std::move(broker_ws_uri) },
105+
std::move(client_type),
106+
std::move(ca_crt_path),
107+
std::move(client_crt_path),
108+
std::move(client_key_path),
109+
std::move(client_crl_path),
110+
std::move(ws_proxy),
111+
std::move(ws_connection_timeout_ms),
112+
std::move(association_timeout_s),
113+
std::move(association_request_ttl_s),
114+
std::move(pong_timeouts_before_retry),
115+
std::move(ws_pong_timeout_ms)}
116+
{
117+
}
91118
// legacy constructor: pre proxy
92119
Connector::Connector(std::vector<std::string> broker_ws_uris,
93120
std::string client_type,
@@ -182,6 +209,56 @@ Connector::Connector(std::vector<std::string> broker_ws_uris,
182209
TTLMessageCallback(parsed_chunks);
183210
});
184211
}
212+
// constructor for crl addition
213+
Connector::Connector(std::vector<std::string> broker_ws_uris,
214+
std::string client_type,
215+
std::string ca_crt_path,
216+
std::string client_crt_path,
217+
std::string client_key_path,
218+
std::string client_crl_path,
219+
std::string ws_proxy,
220+
long ws_connection_timeout_ms,
221+
uint32_t association_timeout_s,
222+
uint32_t association_request_ttl_s,
223+
uint32_t pong_timeouts_before_retry,
224+
long ws_pong_timeout_ms)
225+
: ConnectorBase { std::move(broker_ws_uris),
226+
std::move(client_type),
227+
std::move(ca_crt_path),
228+
std::move(client_crt_path),
229+
std::move(client_key_path),
230+
std::move(client_crl_path),
231+
std::move(ws_proxy),
232+
std::move(ws_connection_timeout_ms),
233+
std::move(pong_timeouts_before_retry),
234+
std::move(ws_pong_timeout_ms) },
235+
associate_response_callback_ {},
236+
session_association_ { std::move(association_timeout_s) }
237+
{
238+
// Add PCP schemas to the Validator instance member
239+
validator_.registerSchema(Protocol::EnvelopeSchema());
240+
validator_.registerSchema(Protocol::DebugSchema());
241+
validator_.registerSchema(Protocol::DebugItemSchema());
242+
243+
// Register PCP callbacks
244+
registerMessageCallback(
245+
Protocol::AssociateResponseSchema(),
246+
[this](const ParsedChunks& parsed_chunks) {
247+
associateResponseCallback(parsed_chunks);
248+
});
249+
250+
registerMessageCallback(
251+
Protocol::ErrorMessageSchema(),
252+
[this](const ParsedChunks& parsed_chunks) {
253+
errorMessageCallback(parsed_chunks);
254+
});
255+
256+
registerMessageCallback(
257+
Protocol::TTLExpiredSchema(),
258+
[this](const ParsedChunks& parsed_chunks) {
259+
TTLMessageCallback(parsed_chunks);
260+
});
261+
}
185262

186263
// Set an optional callback for associate responses
187264
void Connector::setAssociateCallback(MessageCallback callback)

0 commit comments

Comments
 (0)