rlm_crl.c File Reference

Check a certificate's serial number against a CRL. More...

#include <freeradius-devel/util/dlist.h>
#include <freeradius-devel/util/pair.h>
#include <freeradius-devel/util/value.h>
#include <freeradius-devel/util/time.h>
#include <freeradius-devel/util/rb.h>
#include <freeradius-devel/util/timer.h>
#include <freeradius-devel/server/module_rlm.h>
#include <freeradius-devel/server/rcode.h>
#include <freeradius-devel/server/signal.h>
#include <freeradius-devel/server/pair.h>
#include <freeradius-devel/server/log.h>
#include <freeradius-devel/unlang/call_env.h>
#include <freeradius-devel/unlang/action.h>
#include <freeradius-devel/unlang/interpret.h>
#include <freeradius-devel/unlang/module.h>
#include <freeradius-devel/tls/strerror.h>
#include <freeradius-devel/tls/utils.h>
#include <openssl/x509.h>
#include <openssl/x509v3.h>
#include <openssl/pem.h>
#include <openssl/asn1.h>
#include <openssl/bn.h>

Include dependency graph for rlm_crl.c:

Go to the source code of this file.

Data Structures
struct	crl_entry_t
	A single CRL in the global list of CRLs. More...
struct	rlm_crl_env_t
struct	rlm_crl_mutable_t
	Global tree of CRLs. More...
struct	rlm_crl_rctx_t
struct	rlm_crl_t

Enumerations
enum	crl_check_status_t {   CRL_CHECK_BASE = 0 ,   CRL_CHECK_FETCH_DELTA ,   CRL_CHECK_DELTA }
	A status used to track which CRL is being checked. More...
enum	crl_ret_t {   CRL_ERROR = -1 ,   CRL_ENTRY_NOT_FOUND = 0 ,   CRL_ENTRY_FOUND = 1 ,   CRL_ENTRY_REMOVED = 2 ,   CRL_NOT_FOUND = 3 ,   CRL_MISSING_DELTA = 4 }

Functions
static int	mod_detach (UNUSED module_detach_ctx_t const *mctx)
static int	mod_instantiate (module_inst_ctx_t const *mctx)
	Instantiate the module.

Variables
static fr_dict_attr_t const *	attr_crl_cdp_url
static fr_dict_attr_t const *	attr_crl_data
static fr_dict_t const *	dict_freeradius
static conf_parser_t	module_config []
module_rlm_t	rlm_crl
fr_dict_autoload_t	rlm_crl_dict []
fr_dict_attr_autoload_t	rlm_crl_dict_attr []

Detailed Description

Check a certificate's serial number against a CRL.

Id

67210b48a732b93063254846da8ee12469b97df3

Author

Arran Cudbard-Bell (a.cud.nosp@m.bard.nosp@m.b@fre.nosp@m.erad.nosp@m.ius.o.nosp@m.rg)

Copyright

2025 Network RADIUS SAS (legal.nosp@m.@net.nosp@m.workr.nosp@m.adiu.nosp@m.s.com)

Definition in file rlm_crl.c.

---

Data Structure Documentation

crl_entry_t

struct crl_entry_t

A single CRL in the global list of CRLs.

Definition at line 79 of file rlm_crl.c.

Collaboration diagram for crl_entry_t:

Data Fields
char const *	cdp_url	The URL of the CRL.
X509_CRL *	crl	The CRL.
ASN1_INTEGER *	crl_num	The CRL number.
fr_value_box_list_t	delta_urls	URLs from which a delta CRL can be retrieved.
fr_timer_t *	ev	When to expire the CRL.
rlm_crl_t const *	inst	The instance of the CRL module.
fr_rb_node_t	node	The node in the tree.

rlm_crl_env_t

struct rlm_crl_env_t

Definition at line 131 of file rlm_crl.c.

Collaboration diagram for rlm_crl_env_t:

Data Fields
fr_value_box_list_head_t *	cdp	The CRL distribution points.
tmpl_t *	http_exp	The xlat expansion used to retrieve the CRL via http://.
tmpl_t *	ldap_exp	The xlat expansion used to retrieve the CRL via ldap://.
fr_value_box_t	serial	The serial to check.

rlm_crl_mutable_t

struct rlm_crl_mutable_t

Global tree of CRLs.

Separate from the instance data because that's protected.

Definition at line 58 of file rlm_crl.c.

Collaboration diagram for rlm_crl_mutable_t:

Data Fields
fr_rb_tree_t *	crls	A tree of CRLs organised by CDP URL.
pthread_mutex_t	mutex
fr_timer_list_t *	timer_list	The timer list to use for CRL expiry. This gets serviced by the main loop.

rlm_crl_rctx_t

struct rlm_crl_rctx_t

Definition at line 96 of file rlm_crl.c.

Collaboration diagram for rlm_crl_rctx_t:

Data Fields
crl_entry_t *	base_crl	The base CRL relating to the delta currently being fetched.
fr_value_box_t *	cdp_url	The URL we're currently attempting to load.
fr_value_box_list_t	crl_data	Data from CRL expansion.
fr_value_box_list_t	missing_crls	CRLs missing from the tree.
crl_check_status_t	status	Status of the current CRL check.

rlm_crl_t

struct rlm_crl_t

Definition at line 65 of file rlm_crl.c.

Collaboration diagram for rlm_crl_t:

Data Fields
char const *	ca_file	File containing certs for verifying CRL signatures.
char const *	ca_path	Directory containing certs for verifying CRL signatures.
fr_time_delta_t	early_refresh	Time interval before nextUpdate to refresh.
fr_time_delta_t	force_delta_expiry	Force expiry of delta CRLs after this time.
bool	force_delta_expiry_is_set
fr_time_delta_t	force_expiry	Force expiry of CRLs after this time.
bool	force_expiry_is_set
rlm_crl_mutable_t *	mutable	Mutable data that's shared between all threads.
X509_STORE *	verify_store	Store of certificates to verify CRL signatures.
CONF_SECTION *	virtual_server	Virtual server to use when retrieving CRLs.

Enumeration Type Documentation

crl_check_status_t

enum crl_check_status_t

A status used to track which CRL is being checked.

Enumerator
CRL_CHECK_BASE	The base CRL is being checked.
CRL_CHECK_FETCH_DELTA	The delta CRL is being fetched.
CRL_CHECK_DELTA	The delta CRL exists and is being checked.

Definition at line 90 of file rlm_crl.c.

crl_ret_t

enum crl_ret_t

Enumerator
CRL_ERROR	Unspecified error ocurred.
CRL_ENTRY_NOT_FOUND	Serial not found in this CRL.
CRL_ENTRY_FOUND	Serial was found in this CRL.
CRL_ENTRY_REMOVED	Serial was "un-revoked" in this delta CRL.
CRL_NOT_FOUND	No CRL found, need to load it from the CDP URL.
CRL_MISSING_DELTA	Need to load a delta CRL to supplement this CRL.

Definition at line 138 of file rlm_crl.c.

Function Documentation

mod_detach()

static int mod_detach ( UNUSED module_detach_ctx_t const *  mctx )

static

Definition at line 739 of file rlm_crl.c.

Here is the call graph for this function:

mod_instantiate()

static int mod_instantiate ( module_inst_ctx_t const *  mctx )

static

Instantiate the module.

Definition at line 708 of file rlm_crl.c.

Variable Documentation

attr_crl_cdp_url

fr_dict_attr_t const* attr_crl_cdp_url

static

Definition at line 122 of file rlm_crl.c.

attr_crl_data

fr_dict_attr_t const* attr_crl_data

static

Definition at line 121 of file rlm_crl.c.

dict_freeradius

fr_dict_t const* dict_freeradius

static

Definition at line 113 of file rlm_crl.c.

module_config

conf_parser_t module_config[]

static

Initial value:

= {
        { FR_CONF_OFFSET_IS_SET("force_expiry", FR_TYPE_TIME_DELTA, 0, rlm_crl_t, force_expiry) },
        { FR_CONF_OFFSET_IS_SET("force_delta_expiry", FR_TYPE_TIME_DELTA, 0, rlm_crl_t, force_delta_expiry) },
        { FR_CONF_OFFSET("early_refresh", rlm_crl_t, early_refresh) },
        { FR_CONF_OFFSET("ca_file", rlm_crl_t, ca_file) },
        { FR_CONF_OFFSET("ca_path", rlm_crl_t, ca_path) },
        CONF_PARSER_TERMINATOR
}

Definition at line 104 of file rlm_crl.c.

rlm_crl

module_rlm_t rlm_crl

Initial value:

= {
        .common = {
                .magic          = MODULE_MAGIC_INIT,
                .inst_size      = sizeof(rlm_crl_t),
                .instantiate    = mod_instantiate,
                .detach         = mod_detach,
                .name           = "crl",
                .config         = module_config,
        },
 
 
 
 
 
 
 
 
}

Definition at line 755 of file rlm_crl.c.

rlm_crl_dict

fr_dict_autoload_t rlm_crl_dict

Initial value:

= {
        { .out = &dict_freeradius, .proto = "freeradius" },
        { NULL }
}

Definition at line 116 of file rlm_crl.c.

rlm_crl_dict_attr

fr_dict_attr_autoload_t rlm_crl_dict_attr

Initial value:

= {
        { .out = &attr_crl_data, .name = "CRL.Data", .type = FR_TYPE_OCTETS, .dict = &dict_freeradius },
        { .out = &attr_crl_cdp_url, .name = "CRL.CDP-URL", .type = FR_TYPE_STRING, .dict = &dict_freeradius },
        { NULL }
}

Definition at line 125 of file rlm_crl.c.