wolfKeyMgr v0.4

* Fix for stray `wolfSSL_CTX_free`.
* Added mutex protection on ETSI client.
* Added URL decoding to HTTP module.
* Added SIGPIPE ignore to ETSI client.
* Added test key/certificate for Apache HTTPD.
* Added "-r" argument for key manager for the key update interval.

Author: dgarske

README.md

@@ -99,12 +99,13 @@ wolfKeyManager 0.3
 -f <str>    Log file name, default None
 -o <num>    Max open files, default  1024
 -s <num>    Seconds to timeout, default 60
+-r <num>    Key renewal timeout, default 3600
 -t <num>    Thread pool size, default  48
 -d          TLS Disable Mutual Authentication
 -k <pem>    TLS Server TLS Key, default ./certs/server-key.pem
 -w <pass>   TLS Server Key Password, default wolfssl
 -c <pem>    TLS Server Certificate, default ./certs/server-cert.pem
--c <pem>    TLS CA Certificate, default ./certs/ca-cert.pem
+-A <pem>    TLS CA Certificate, default ./certs/ca-cert.pem
 ```
 
 ```sh

certs/test-cert.pem

@@ -0,0 +1,15 @@
+-----BEGIN CERTIFICATE-----
+MIICajCCAg+gAwIBAgIUMkpxF7cixTbgy2s3ZtLYCCq7pmEwCgYIKoZIzj0EAwIw
+gYkxCzAJBgNVBAYTAlVTMQswCQYDVQQIDAJDQTEQMA4GA1UEBwwHU2VhdHRsZTEQ
+MA4GA1UECgwHd29sZlNTTDEUMBIGA1UECwwLRGV2ZWxvcG1lbnQxEjAQBgNVBAMM
+CWxvY2FsaG9zdDEfMB0GCSqGSIb3DQEJARYQaW5mb0B3b2xmc3NsLmNvbTAeFw0y
+MTAzMDExOTU2MjFaFw00MTAyMjQxOTU2MjFaMIGJMQswCQYDVQQGEwJVUzELMAkG
+A1UECAwCQ0ExEDAOBgNVBAcMB1NlYXR0bGUxEDAOBgNVBAoMB3dvbGZTU0wxFDAS
+BgNVBAsMC0RldmVsb3BtZW50MRIwEAYDVQQDDAlsb2NhbGhvc3QxHzAdBgkqhkiG
+9w0BCQEWEGluZm9Ad29sZnNzbC5jb20wWTATBgcqhkjOPQIBBggqhkjOPQMBBwNC
+AAToBp+YdaHpiRuvAWYXgK/mv7M1szpyfv7EXYDQXibu3moryej10+ReWc5neXgD
+VfQEZ1O6CkwPo7lZU6FBhGxmo1MwUTAdBgNVHQ4EFgQUvWcAwbZL6I6LHUZYMSdT
+FBzD3cswHwYDVR0jBBgwFoAUvWcAwbZL6I6LHUZYMSdTFBzD3cswDwYDVR0TAQH/
+BAUwAwEB/zAKBggqhkjOPQQDAgNJADBGAiEAtC5RgbHrOuOOZznMc62hjjmSHFCz
+3GJOj6dVuZkbFxMCIQC+RA9BvaXbUirbRZzyQThhN9ohZR5cu2G9PAwy7o1cXw==
+-----END CERTIFICATE-----

certs/test-key.pem

@@ -0,0 +1,8 @@
+-----BEGIN EC PARAMETERS-----
+BggqhkjOPQMBBw==
+-----END EC PARAMETERS-----
+-----BEGIN EC PRIVATE KEY-----
+MHcCAQEEIP59qE0IungH9iZIsR9XFytv308g4XQWnWC1XUSvyF3soAoGCCqGSM49
+AwEHoUQDQgAE6AafmHWh6YkbrwFmF4Cv5r+zNbM6cn7+xF2A0F4m7t5qK8no9dPk
+XlnOZ3l4A1X0BGdTugpMD6O5WVOhQYRsZg==
+-----END EC PRIVATE KEY-----

configure.ac

@@ -5,7 +5,7 @@
 
 AC_PREREQ(2.59)
 
-AC_INIT([wolfKeyManager],[0.3],[http://www.wolfssl.com])
+AC_INIT([wolfKeyManager],[0.4],[http://www.wolfssl.com])
 AC_CONFIG_AUX_DIR(config)
 AC_CONFIG_HEADERS([wolfkeymgr/config.h])
 AC_CONFIG_MACRO_DIR(m4)
@@ -71,7 +71,7 @@ LT_PREREQ([2.2])
 LT_INIT([disable-static win32-dll])
 
 # Shared library versioning
-WOLFKM_LIBRARY_VERSION=3:0:0
+WOLFKM_LIBRARY_VERSION=3:0:1
 #                      | | |
 #               +------+ | +---+
 #               |        |     |

src/keymanager.c

@@ -37,6 +37,7 @@ static void Usage(void)
                           WOLFKM_DEFAULT_LOG_NAME ? WOLFKM_DEFAULT_LOG_NAME : "None");
     printf("-o <num>    Max open files, default  %d\n", WOLFKM_DEFAULT_FILES);
     printf("-s <num>    Seconds to timeout, default %d\n", WOLFKM_DEFAULT_TIMEOUT);
+    printf("-r <num>    Key renewal timeout, default %d\n", WOLFKM_KEY_RENEW_TIMEOUT);
     printf("-t <num>    Thread pool size, default  %ld\n",
                                                  sysconf(_SC_NPROCESSORS_CONF));
     printf("-d          TLS Disable Mutual Authentication\n");
@@ -70,7 +71,8 @@ int main(int argc, char** argv)
     struct event_base*      mainBase = NULL;    /* main thread's base  */
     FILE*                   pidF = 0;
     svcInfo* etsiSvc = NULL;
-    word32 timeoutSec  = WOLFKM_DEFAULT_TIMEOUT;
+    int sec;
+    word32 timeoutSec  = WOLFKM_DEFAULT_TIMEOUT, renewSec = WOLFKM_KEY_RENEW_TIMEOUT;
     int disableMutualAuth = 0; /* on by default */
     const char* serverKey = WOLFKM_ETSISVC_KEY;
     const char* serverKeyPass = WOLFKM_ETSISVC_KEY_PASSWORD;
@@ -79,7 +81,7 @@ int main(int argc, char** argv)
     signalArg sigArgInt, sigArgTerm;
 
     /* argument processing */
-    while ((ch = getopt(argc, argv, "?bis:t:o:f:l:dk:w:c:A:")) != -1) {
+    while ((ch = getopt(argc, argv, "?bis:t:o:f:l:dk:w:c:A:r:")) != -1) {
         switch (ch) {
             case '?' :
                 Usage();
@@ -91,15 +93,13 @@ int main(int argc, char** argv)
                 core = 1;
                 break;
             case 's' :
-            {
-                int sec = atoi(optarg);
+                sec = atoi(optarg);
                 if (sec < 0) {
                     perror("timeout positive values only accepted");
                     exit(EX_USAGE);
                 }
                 timeoutSec = (word32)sec;
                 break;
-            }
             case 't' :
                 poolSize = atoi(optarg);
                 break;
@@ -134,6 +134,14 @@ int main(int argc, char** argv)
             case 'A':
                 caCert = optarg;
                 break;
+            case 'r':
+                sec = atoi(optarg);
+                if (sec < 0) {
+                    perror("timeout positive values only accepted");
+                    exit(EX_USAGE);
+                }
+                renewSec = (word32)sec;
+                break;
 
             default:
                 Usage();
@@ -185,7 +193,7 @@ int main(int argc, char** argv)
     }
 
     /* setup signal stuff */
-    if (wolfKeyMgr_SigIgnore(SIGPIPE) == -1) {
+    if (wolfSigIgnore(SIGPIPE) == -1) {
         XLOG(WOLFKM_LOG_ERROR, "Failed to ignore SIGPIPE\n");
         ret = EX_OSERR; goto exit;
     }
@@ -201,8 +209,11 @@ int main(int argc, char** argv)
     wolfKeyMgr_SetMaxFiles(maxFiles);
 
     /********** ETSI Service **********/
-    etsiSvc = wolfEtsiSvc_Init(mainBase, timeoutSec);
+    etsiSvc = wolfEtsiSvc_Init(mainBase, renewSec);
     if (etsiSvc) {
+        /* set socket timeut */
+        wolfKeyMgr_SetTimeout(etsiSvc, timeoutSec);
+
         ret = wolfKeyMgr_LoadCAFile(etsiSvc, caCert, WOLFSSL_FILETYPE_PEM);
         if (ret != 0) {
             XLOG(WOLFKM_LOG_ERROR, "Error loading ETSI TLS CA cert\n");

src/mod_etsi.c

@@ -23,17 +23,22 @@
 
 #include "wolfkeymgr/mod_etsi.h"
 
+#include <signal.h>
+
 struct EtsiClientCtx {
     WOLFSSL_CTX*   sslCtx;
     WOLFSSL*       ssl;
     EtsiClientType type;
+    wolfSSL_Mutex  lock;
 };
 
+
 EtsiClientCtx* wolfEtsiClientNew(void)
 {
     EtsiClientCtx* client = (EtsiClientCtx*)malloc(sizeof(EtsiClientCtx));
     if (client) {
         memset(client, 0, sizeof(EtsiClientCtx));
+        wc_InitMutex(&client->lock);
         client->sslCtx = wolfTlsClientNew();
         if (client->sslCtx == NULL) {
             XLOG(WOLFKM_LOG_ERROR, "Error creating TLS client!\n");
@@ -47,10 +52,14 @@ EtsiClientCtx* wolfEtsiClientNew(void)
 int wolfEtsiClientSetKey(EtsiClientCtx* client, const char* keyFile, 
     const char* keyPassword, const char* certFile, int fileType)
 {
+    int ret;
     if (client == NULL) {
         return WOLFKM_BAD_ARGS;
     }
-    return wolfTlsSetKey(client->sslCtx, keyFile, keyPassword, certFile, fileType);
+    wc_LockMutex(&client->lock);
+    ret = wolfTlsSetKey(client->sslCtx, keyFile, keyPassword, certFile, fileType);
+    wc_UnLockMutex(&client->lock);
+    return ret;
 }
 
 int wolfEtsiClientAddCA(EtsiClientCtx* client, const char* caFile)
@@ -60,7 +69,9 @@ int wolfEtsiClientAddCA(EtsiClientCtx* client, const char* caFile)
         return WOLFKM_BAD_ARGS;
     }
 
+    wc_LockMutex(&client->lock);
     ret = wolfTlsAddCA(client->sslCtx, caFile);
+    wc_UnLockMutex(&client->lock);
     return ret;
 }
 
@@ -73,13 +84,15 @@ int wolfEtsiClientConnect(EtsiClientCtx* client, const char* host,
         return WOLFKM_BAD_ARGS;
     }
 
+    wc_LockMutex(&client->lock);
     ret = wolfTlsConnect(client->sslCtx, &client->ssl, host, port, timeoutSec);
     if (ret == 0) {
         XLOG(WOLFKM_LOG_INFO, "Connected to ETSI service\n");
     }
     else {
         XLOG(WOLFKM_LOG_ERROR, "Failure connecting to ETSI service %d\n", ret);   
     }
+    wc_UnLockMutex(&client->lock);
 
     return ret;
 }
@@ -125,12 +138,14 @@ int wolfEtsiClientGet(EtsiClientCtx* client,
         return WOLFKM_BAD_ARGS;
     }
 
+    wc_LockMutex(&client->lock);
+
     /* only send request if we need to */
     if (type != ETSI_CLIENT_PUSH || client->type != type) {
         ret = EtsiClientMakeRequest(type, fingerprint, request, &requestSz);
         if (ret != 0) {
             XLOG(WOLFKM_LOG_INFO, "EtsiClientMakeRequest failed: %d\n", ret);
-            return ret;
+            goto exit;
         }
 
         /* send key request */
@@ -141,7 +156,7 @@ int wolfEtsiClientGet(EtsiClientCtx* client,
             if (ret < 0) {
                 XLOG(WOLFKM_LOG_INFO, "DoClientSend failed: %d (%s)\n", ret,
                     wolfSSL_ERR_reason_error_string(ret));
-                return ret;
+                goto exit;
             }
             pos += ret;
         }
@@ -181,6 +196,9 @@ int wolfEtsiClientGet(EtsiClientCtx* client,
         XLOG(WOLFKM_LOG_INFO, "Got ETSI response (%d bytes)\n", *responseSz);
     }
 
+exit:
+    wc_UnLockMutex(&client->lock);
+
     return ret;
 }
 
@@ -204,15 +222,18 @@ int wolfEtsiClientClose(EtsiClientCtx* client)
     int ret = 0;
     if (client && client->ssl) {
         /* send shutdown */
+        wc_LockMutex(&client->lock);
         ret = wolfTlsClose(client->ssl, 1);
         client->ssl = NULL;
+        wc_UnLockMutex(&client->lock);
     }
     return ret;
 }
 
 void wolfEtsiClientFree(EtsiClientCtx* client)
 {
     if (client) {
+        wc_LockMutex(&client->lock);
         if (client->ssl) {
             wolfTlsClose(client->ssl, 0);
             client->ssl = NULL;
@@ -221,12 +242,17 @@ void wolfEtsiClientFree(EtsiClientCtx* client)
             wolfTlsFree(client->sslCtx);
             client->sslCtx = NULL;
         }
+        wc_UnLockMutex(&client->lock);
+        wc_FreeMutex(&client->lock);
         free(client);
     }
 }
 
 int wolfEtsiClientInit(void)
 {
+    /* Ignore SIGPIPE */
+    wolfSigIgnore(SIGPIPE);
+
 #if 0
     wolfSSL_Debugging_ON();
 #endif

src/mod_http.c

@@ -476,3 +476,39 @@ byte* wolfHttpUriDecode(const char *s, byte *dec)
     }
     return dec;
 }
+
+int wolfHttpUrlDecode(HttpUrl* url, char* s)
+{
+    char* dec;
+    if (url == NULL || s == NULL) {
+        return WOLFKM_BAD_ARGS;
+    }
+    memset(url, 0, sizeof(*url));
+
+    /* find :// */
+    dec = strstr(s, "://");
+    if (dec == NULL) {
+        return WOLFKM_BAD_ARGS;
+    }
+
+    *dec = '\0';
+    url->protocol = s;
+    s = dec+3;
+
+    /* find next "/" */
+    url->domain = s;
+    dec = strstr(s, "/");
+    if (dec) {
+        *dec = '\0';
+        url->path = dec+1;
+    }
+    
+    /* find ":" */
+    dec = strstr(s, ":");
+    if (dec) {
+        /* port specified */
+        url->port = atoi(dec+1);
+        *dec = '\0';
+    }
+    return 0;
+}

src/mod_tls.c

@@ -142,7 +142,6 @@ int wolfTlsAddCA(WOLFSSL_CTX* ctx, const char* caFile)
     if (ret != WOLFSSL_SUCCESS) {
         XLOG(WOLFKM_LOG_ERROR, "Can't load TLS CA %s into context. Error: %s (%d)\n", 
             caFile, wolfSSL_ERR_reason_error_string(ret), ret);
-        wolfSSL_CTX_free(ctx);
         return WOLFKM_BAD_FILE;
     }
 

src/sock_mgr.c

@@ -823,19 +823,6 @@ static void AcceptCB(struct evconnlistener* listener, evutil_socket_t fd,
 
 
 /* --- PUBLIC FUNCTIONS --- */
-/* Clear action on supplied sig event */
-int wolfKeyMgr_SigIgnore(int sig)
-{
-    struct sigaction sa;
-
-    sa.sa_handler = SIG_IGN;
-    sa.sa_flags = 0;
-
-    if (sigemptyset(&sa.sa_mask) == -1 || sigaction(sig, &sa, 0) == -1)
-        return -1;
-
-    return 0;
-}
 
 /* Our signal handler callback */
 void wolfKeyMgr_SignalCb(evutil_socket_t fd, short event, void* arg)

src/svc_etsi.c

@@ -30,7 +30,7 @@ typedef struct etsiSvcCtx {
     ecc_key         key;  /* last generated key */
     WC_RNG          rng;
     double          last; /* time last generated */
-    word32          timeoutSec;
+    word32          renewSec;
     word32          index;
     pthread_mutex_t lock; /* queue lock */
     pthread_t       thread; /* key gen worker */
@@ -171,8 +171,8 @@ static void* KeyPushWorker(void* arg)
         /* push to any connected clients */
         wolfKeyMgr_NotifyAllClients(svc);
 
-        /* wait timeoutSec */
-        sleep(svcCtx->timeoutSec);
+        /* wait seconds */
+        sleep(svcCtx->renewSec);
     } while (1);
 
     return NULL;
@@ -342,7 +342,7 @@ void wolfEtsiSvc_WorkerFree(svcInfo* svc, void* svcThreadCtx)
 #endif /* WOLFKM_ETSI_SERVICE */
 
 
-svcInfo* wolfEtsiSvc_Init(struct event_base* mainBase, int timeoutSec)
+svcInfo* wolfEtsiSvc_Init(struct event_base* mainBase, int renewSec)
 {
 #ifdef WOLFKM_ETSI_SERVICE
     int ret;
@@ -358,9 +358,7 @@ svcInfo* wolfEtsiSvc_Init(struct event_base* mainBase, int timeoutSec)
 
     pthread_mutex_init(&svcCtx->lock, NULL);
 
-    /* use the timeout to trigger sending new set of keys */
-    wolfKeyMgr_SetTimeout(svc, timeoutSec);
-    svcCtx->timeoutSec = timeoutSec;
+    svcCtx->renewSec = renewSec;
 
     /* start key generation thread */
     if (pthread_create(&svcCtx->thread, NULL, KeyPushWorker, svc) != 0) {
@@ -383,8 +381,8 @@ svcInfo* wolfEtsiSvc_Init(struct event_base* mainBase, int timeoutSec)
     return svc;
 #else
     (void)mainBase;
-    (void)timeoutSec;
-    (void)disableMutalAuth;
+    (void)renewSec;
+
     return NULL;
 #endif
 }