Skip to content

Commit

Permalink
cryptocrl: adapt to new XrdSutCache
Browse files Browse the repository at this point in the history 
Port back of a performance improvement required by EOS .
  • Loading branch information
@gganis
gganis committed Jul 6, 2017
1 parent 0db906c commit d8a5133
Show file tree
Hide file tree
Showing 2 changed files with 35 additions and 29 deletions.
63 changes: 35 additions & 28 deletions src/XrdCrypto/XrdCryptosslX509Crl.cc
View file
Expand Up @@ -45,6 +45,13 @@
#include <openssl/bn.h>
#include <openssl/pem.h>

#if OPENSSL_VERSION_NUMBER < 0x10100000L
#define X509_REVOKED_get0_revocationDate(x) (x)->revocationDate
#define X509_REVOKED_get0_serialNumber(x) (x)->serialNumber
#define X509_CRL_get0_lastUpdate X509_CRL_get_lastUpdate
#define X509_CRL_get0_nextUpdate X509_CRL_get_nextUpdate
#endif

//_____________________________________________________________________________
XrdCryptosslX509Crl::XrdCryptosslX509Crl(const char *cf, int opt)
: XrdCryptoX509Crl()
Expand Down Expand Up @@ -185,12 +192,15 @@ int XrdCryptosslX509Crl::Init(const char *cf)
if (!PEM_read_X509_CRL(fc, &crl, 0, 0)) {
DEBUG("Unable to load CRL from file");
return -1;
} else {
DEBUG("CRL successfully loaded");
}
//
// Close the file
fclose(fc);

//
// Notify
DEBUG("CRL successfully loaded from "<< cf);

//
// Save source file name
srcfile = cf;
Expand Down Expand Up @@ -340,7 +350,6 @@ int XrdCryptosslX509Crl::LoadCache()
// Load relevant info into the cache
// Return 0 if ok, -1 in case of error
EPNAME("LoadCache");
XrdSutCacheRef pfeRef;

// The CRL must exists
if (!crl) {
Expand Down Expand Up @@ -371,12 +380,6 @@ int XrdCryptosslX509Crl::LoadCache()
return 0;
}

// Init cache
if (cache.Init(nrevoked) != 0) {
DEBUG("problems init cache for CRL info");
return -1;
}

// Get serial numbers of revoked certificates
char *tagser = 0;
int i = 0;
Expand All @@ -388,28 +391,27 @@ int XrdCryptosslX509Crl::LoadCache()
#endif /* OPENSSL */
if (rev) {
BIGNUM *bn = BN_new();
ASN1_INTEGER_to_BN(rev->serialNumber, bn);
ASN1_INTEGER_to_BN(X509_REVOKED_get0_serialNumber(rev), bn);
tagser = BN_bn2hex(bn);
BN_free(bn);
TRACE(Dump, "certificate with serial number: "<<tagser<<
" has been revoked");
// Add to the cache
XrdSutPFEntry *cent = cache.Add(pfeRef, (const char *)tagser);
bool rdlock = false;
XrdSutCacheEntry *cent = cache.Get((const char *)tagser, rdlock);
if (!cent) {
DEBUG("problems updating the cache");
return -1;
}
// Add revocation date
cent->mtime = XrdCryptosslASN1toUTC(rev->revocationDate);
cent->mtime = XrdCryptosslASN1toUTC(X509_REVOKED_get0_revocationDate(rev));
// Release the string for the serial number
OPENSSL_free(tagser);
// Unlock the entry
cent->rwmtx.UnLock();
}
}

// rehash the cache
pfeRef.UnLock(); // Prevent lock inversion (though it doesn't matter here)
cache.Rehash(1);

return 0;
}

Expand All @@ -423,7 +425,7 @@ int XrdCryptosslX509Crl::LastUpdate()
// Make sure we have a CRL
if (crl)
// Extract UTC time in secs from Epoch
lastupdate = XrdCryptosslASN1toUTC(X509_CRL_get_lastUpdate(crl));
lastupdate = XrdCryptosslASN1toUTC(X509_CRL_get0_lastUpdate(crl));
}
// return what we have
return lastupdate;
Expand All @@ -439,7 +441,7 @@ int XrdCryptosslX509Crl::NextUpdate()
// Make sure we have a CRL
if (crl)
// Extract UTC time in secs from Epoch
nextupdate = XrdCryptosslASN1toUTC(X509_CRL_get_nextUpdate(crl));
nextupdate = XrdCryptosslASN1toUTC(X509_CRL_get0_nextUpdate(crl));
}
// return what we have
return nextupdate;
Expand Down Expand Up @@ -476,14 +478,15 @@ const char *XrdCryptosslX509Crl::IssuerHash(int alg)
// (for v>=1.0.0) when alg = 1
EPNAME("X509::IssuerHash");

#if (OPENSSL_VERSION_NUMBER >= 0x10000000L)
#if (OPENSSL_VERSION_NUMBER >= 0x10000000L && !defined(__APPLE__))
if (alg == 1) {
// md5 based
if (issueroldhash.length() <= 0) {
// Make sure we have a certificate
if (crl) {
char chash[15] = {0};
snprintf(chash,15,"%08lx.0",X509_NAME_hash_old(crl->crl->issuer));
char chash[30] = {0};
snprintf(chash, sizeof(chash),
"%08lx.0",X509_NAME_hash_old(X509_CRL_get_issuer(crl)));
issueroldhash = chash;
} else {
DEBUG("WARNING: no certificate available - cannot extract issuer hash (md5)");
Expand All @@ -501,9 +504,9 @@ const char *XrdCryptosslX509Crl::IssuerHash(int alg)

// Make sure we have a certificate
if (crl) {
char chash[15] = {0};
if (chash[0] == 0)
snprintf(chash,15,"%08lx.0",X509_NAME_hash(crl->crl->issuer));
char chash[30] = {0};
snprintf(chash, sizeof(chash),
"%08lx.0",X509_NAME_hash(X509_CRL_get_issuer(crl)));
issuerhash = chash;
} else {
DEBUG("WARNING: no certificate available - cannot extract issuer hash (default)");
Expand Down Expand Up @@ -539,7 +542,6 @@ bool XrdCryptosslX509Crl::IsRevoked(int serialnumber, int when)
// Check if certificate with serialnumber is in the
// list of revocated certificates
EPNAME("IsRevoked");
XrdSutCacheRef pfeRef;

// Reference time
int now = (when > 0) ? when : time(0);
Expand All @@ -560,13 +562,16 @@ bool XrdCryptosslX509Crl::IsRevoked(int serialnumber, int when)
sprintf(tagser,"%x",serialnumber);

// Look into the cache
XrdSutPFEntry *cent = cache.Get(pfeRef, (const char *)tagser);
bool rdlock = false;
XrdSutCacheEntry *cent = cache.Get((const char *)tagser, rdlock);
if (cent) {
// Check the revocation time
if (now > cent->mtime) {
DEBUG("certificate "<<tagser<<" has been revoked");
cent->rwmtx.UnLock();
return 1;
}
cent->rwmtx.UnLock();
}

// Certificate not revoked
Expand All @@ -579,7 +584,6 @@ bool XrdCryptosslX509Crl::IsRevoked(const char *sernum, int when)
// Check if certificate with 'sernum' is in the
// list of revocated certificates
EPNAME("IsRevoked");
XrdSutCacheRef pfeRef;

// Reference time
int now = (when > 0) ? when : time(0);
Expand All @@ -596,13 +600,16 @@ bool XrdCryptosslX509Crl::IsRevoked(const char *sernum, int when)
}

// Look into the cache
XrdSutPFEntry *cent = cache.Get(pfeRef, (const char *)sernum);
bool rdlock = false;
XrdSutCacheEntry *cent = cache.Get((const char *)sernum, rdlock);
if (cent) {
// Check the revocation time
if (now > cent->mtime) {
DEBUG("certificate "<<sernum<<" has been revoked");
cent->rwmtx.UnLock();
return 1;
}
cent->rwmtx.UnLock();
}

// Certificate not revoked
Expand Down
1 change: 0 additions & 1 deletion src/XrdCrypto/XrdCryptosslX509Crl.hh
View file
Expand Up @@ -45,7 +45,6 @@
//
// ---------------------------------------------------------------------------//

class XrdSutCache;
class XrdCryptoX509;

class XrdCryptosslX509Crl : public XrdCryptoX509Crl {
Expand Down

0 comments on commit d8a5133

Please sign in to comment.