generic-library/openssl
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Fix X509_STORE locking

Browse Source
This commit is contained in:
Bodo Möller 2010-02-19 18:27:07 +00:00
parent 69582a592e
commit a839755329
3 changed files with 51 additions and 43 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
CHANGES
View File

@ -896,7 +896,11 @@
*) Change 'Configure' script to enable Camellia by default. *) Change 'Configure' script to enable Camellia by default.
[NTT] [NTT]
Changes between 0.9.8l (?) and 0.9.8m (?) [xx XXX xxxx] Changes between 0.9.8l and 0.9.8m [xx XXX xxxx]
*) Fix X509_STORE locking: Every 'objs' access requires a lock (to
accommodate for stack sorting, always a write lock!).
[Bodo Moeller]
*) On some versions of WIN32 Heap32Next is very slow. This can cause *) On some versions of WIN32 Heap32Next is very slow. This can cause
excessive delays in the RAND_poll(): over a minute. As a workaround excessive delays in the RAND_poll(): over a minute. As a workaround

5
crypto/x509/by_dir.c
View File

@ -420,11 +420,11 @@ static int get_cert_by_subject(X509_LOOKUP *xl, int type, X509_NAME *name,
/* we have added it to the cache so now pull /* we have added it to the cache so now pull
* it out again */ * it out again */
CRYPTO_r_lock(CRYPTO_LOCK_X509_STORE); CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
j = sk_X509_OBJECT_find(xl->store_ctx->objs,&stmp); j = sk_X509_OBJECT_find(xl->store_ctx->objs,&stmp);
if(j != -1) tmp=sk_X509_OBJECT_value(xl->store_ctx->objs,j); if(j != -1) tmp=sk_X509_OBJECT_value(xl->store_ctx->objs,j);
else tmp = NULL; else tmp = NULL;
CRYPTO_r_unlock(CRYPTO_LOCK_X509_STORE); CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
/* If a CRL, update the last file suffix added for this */ /* If a CRL, update the last file suffix added for this */
@ -480,4 +480,3 @@ finish:
if (b != NULL) BUF_MEM_free(b); if (b != NULL) BUF_MEM_free(b);
return(ok); return(ok);
} }

71
crypto/x509/x509_lu.c
View File

@ -294,7 +294,9 @@ int X509_STORE_get_by_subject(X509_STORE_CTX *vs, int type, X509_NAME *name,
X509_OBJECT stmp,*tmp; X509_OBJECT stmp,*tmp;
int i,j; int i,j;
CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
tmp=X509_OBJECT_retrieve_by_subject(ctx->objs,type,name); tmp=X509_OBJECT_retrieve_by_subject(ctx->objs,type,name);
CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
if (tmp == NULL || type == X509_LU_CRL) if (tmp == NULL || type == X509_LU_CRL)
{ {
@ -348,7 +350,6 @@ int X509_STORE_add_cert(X509_STORE *ctx, X509 *x)
X509_OBJECT_up_ref_count(obj); X509_OBJECT_up_ref_count(obj);
if (X509_OBJECT_retrieve_match(ctx->objs, obj)) if (X509_OBJECT_retrieve_match(ctx->objs, obj))
{ {
X509_OBJECT_free_contents(obj); X509_OBJECT_free_contents(obj);
@ -477,12 +478,12 @@ int X509_OBJECT_idx_by_subject(STACK_OF(X509_OBJECT) *h, int type,
X509_OBJECT *X509_OBJECT_retrieve_by_subject(STACK_OF(X509_OBJECT) *h, int type, X509_OBJECT *X509_OBJECT_retrieve_by_subject(STACK_OF(X509_OBJECT) *h, int type,
X509_NAME *name) X509_NAME *name)
{ {
int idx; int idx;
idx = X509_OBJECT_idx_by_subject(h, type, name); idx = X509_OBJECT_idx_by_subject(h, type, name);
if (idx==-1) return NULL; if (idx==-1) return NULL;
return sk_X509_OBJECT_value(h, idx); return sk_X509_OBJECT_value(h, idx);
} }
STACK_OF(X509)* X509_STORE_get1_certs(X509_STORE_CTX *ctx, X509_NAME *nm) STACK_OF(X509)* X509_STORE_get1_certs(X509_STORE_CTX *ctx, X509_NAME *nm)
{ {
@ -491,7 +492,7 @@ STACK_OF(X509)* X509_STORE_get1_certs(X509_STORE_CTX *ctx, X509_NAME *nm)
X509 *x; X509 *x;
X509_OBJECT *obj; X509_OBJECT *obj;
sk = sk_X509_new_null(); sk = sk_X509_new_null();
CRYPTO_r_lock(CRYPTO_LOCK_X509_STORE); CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
idx = x509_object_idx_cnt(ctx->ctx->objs, X509_LU_X509, nm, &cnt); idx = x509_object_idx_cnt(ctx->ctx->objs, X509_LU_X509, nm, &cnt);
if (idx < 0) if (idx < 0)
{ {
@ -499,18 +500,18 @@ STACK_OF(X509)* X509_STORE_get1_certs(X509_STORE_CTX *ctx, X509_NAME *nm)
* objects to cache * objects to cache
*/ */
X509_OBJECT xobj; X509_OBJECT xobj;
CRYPTO_r_unlock(CRYPTO_LOCK_X509_STORE); CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
if (!X509_STORE_get_by_subject(ctx, X509_LU_X509, nm, &xobj)) if (!X509_STORE_get_by_subject(ctx, X509_LU_X509, nm, &xobj))
{ {
sk_X509_free(sk); sk_X509_free(sk);
return NULL; return NULL;
} }
X509_OBJECT_free_contents(&xobj); X509_OBJECT_free_contents(&xobj);
CRYPTO_r_lock(CRYPTO_LOCK_X509_STORE); CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
idx = x509_object_idx_cnt(ctx->ctx->objs,X509_LU_X509,nm, &cnt); idx = x509_object_idx_cnt(ctx->ctx->objs,X509_LU_X509,nm, &cnt);
if (idx < 0) if (idx < 0)
{ {
CRYPTO_r_unlock(CRYPTO_LOCK_X509_STORE); CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
sk_X509_free(sk); sk_X509_free(sk);
return NULL; return NULL;
} }
@ -522,13 +523,13 @@ STACK_OF(X509)* X509_STORE_get1_certs(X509_STORE_CTX *ctx, X509_NAME *nm)
CRYPTO_add(&x->references, 1, CRYPTO_LOCK_X509); CRYPTO_add(&x->references, 1, CRYPTO_LOCK_X509);
if (!sk_X509_push(sk, x)) if (!sk_X509_push(sk, x))
{ {
CRYPTO_r_unlock(CRYPTO_LOCK_X509_STORE); CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
X509_free(x); X509_free(x);
sk_X509_pop_free(sk, X509_free); sk_X509_pop_free(sk, X509_free);
return NULL; return NULL;
} }
} }
CRYPTO_r_unlock(CRYPTO_LOCK_X509_STORE); CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
return sk; return sk;
} }
@ -540,24 +541,24 @@ STACK_OF(X509_CRL)* X509_STORE_get1_crls(X509_STORE_CTX *ctx, X509_NAME *nm)
X509_CRL *x; X509_CRL *x;
X509_OBJECT *obj, xobj; X509_OBJECT *obj, xobj;
sk = sk_X509_CRL_new_null(); sk = sk_X509_CRL_new_null();
CRYPTO_r_lock(CRYPTO_LOCK_X509_STORE); CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
/* Check cache first */ /* Check cache first */
idx = x509_object_idx_cnt(ctx->ctx->objs, X509_LU_CRL, nm, &cnt); idx = x509_object_idx_cnt(ctx->ctx->objs, X509_LU_CRL, nm, &cnt);
/* Always do lookup to possibly add new CRLs to cache /* Always do lookup to possibly add new CRLs to cache
*/ */
CRYPTO_r_unlock(CRYPTO_LOCK_X509_STORE); CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
if (!X509_STORE_get_by_subject(ctx, X509_LU_CRL, nm, &xobj)) if (!X509_STORE_get_by_subject(ctx, X509_LU_CRL, nm, &xobj))
{ {
sk_X509_CRL_free(sk); sk_X509_CRL_free(sk);
return NULL; return NULL;
} }
X509_OBJECT_free_contents(&xobj); X509_OBJECT_free_contents(&xobj);
CRYPTO_r_lock(CRYPTO_LOCK_X509_STORE); CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
idx = x509_object_idx_cnt(ctx->ctx->objs,X509_LU_CRL, nm, &cnt); idx = x509_object_idx_cnt(ctx->ctx->objs,X509_LU_CRL, nm, &cnt);
if (idx < 0) if (idx < 0)
{ {
CRYPTO_r_unlock(CRYPTO_LOCK_X509_STORE); CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
sk_X509_CRL_free(sk); sk_X509_CRL_free(sk);
return NULL; return NULL;
} }
@ -569,19 +570,18 @@ STACK_OF(X509_CRL)* X509_STORE_get1_crls(X509_STORE_CTX *ctx, X509_NAME *nm)
CRYPTO_add(&x->references, 1, CRYPTO_LOCK_X509_CRL); CRYPTO_add(&x->references, 1, CRYPTO_LOCK_X509_CRL);
if (!sk_X509_CRL_push(sk, x)) if (!sk_X509_CRL_push(sk, x))
{ {
CRYPTO_r_unlock(CRYPTO_LOCK_X509_STORE); CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
X509_CRL_free(x); X509_CRL_free(x);
sk_X509_CRL_pop_free(sk, X509_CRL_free); sk_X509_CRL_pop_free(sk, X509_CRL_free);
return NULL; return NULL;
} }
} }
CRYPTO_r_unlock(CRYPTO_LOCK_X509_STORE); CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
return sk; return sk;
} }
X509_OBJECT *X509_OBJECT_retrieve_match(STACK_OF(X509_OBJECT) *h, X509_OBJECT *x) X509_OBJECT *X509_OBJECT_retrieve_match(STACK_OF(X509_OBJECT) *h, X509_OBJECT *x)
{ {
int idx, i; int idx, i;
X509_OBJECT *obj; X509_OBJECT *obj;
idx = sk_X509_OBJECT_find(h, x); idx = sk_X509_OBJECT_find(h, x);
@ -607,7 +607,7 @@ X509_OBJECT *X509_OBJECT_retrieve_match(STACK_OF(X509_OBJECT) *h, X509_OBJECT *x
return obj; return obj;
} }
return NULL; return NULL;
} }
/* Try to get issuer certificate from store. Due to limitations /* Try to get issuer certificate from store. Due to limitations
@ -621,13 +621,11 @@ X509_OBJECT *X509_OBJECT_retrieve_match(STACK_OF(X509_OBJECT) *h, X509_OBJECT *x
* 0 certificate not found. * 0 certificate not found.
* -1 some other error. * -1 some other error.
*/ */
int X509_STORE_CTX_get1_issuer(X509 **issuer, X509_STORE_CTX *ctx, X509 *x) int X509_STORE_CTX_get1_issuer(X509 **issuer, X509_STORE_CTX *ctx, X509 *x)
{ {
X509_NAME *xn; X509_NAME *xn;
X509_OBJECT obj, *pobj; X509_OBJECT obj, *pobj;
int i, ok, idx; int i, ok, idx, ret;
xn=X509_get_issuer_name(x); xn=X509_get_issuer_name(x);
ok=X509_STORE_get_by_subject(ctx,X509_LU_X509,xn,&obj); ok=X509_STORE_get_by_subject(ctx,X509_LU_X509,xn,&obj);
if (ok != X509_LU_X509) if (ok != X509_LU_X509)
@ -653,27 +651,34 @@ int X509_STORE_CTX_get1_issuer(X509 **issuer, X509_STORE_CTX *ctx, X509 *x)
return 1; return 1;
} }
X509_OBJECT_free_contents(&obj); X509_OBJECT_free_contents(&obj);
/* Else find index of first matching cert */
idx = X509_OBJECT_idx_by_subject(ctx->ctx->objs, X509_LU_X509, xn);
/* This shouldn't normally happen since we already have one match */
if (idx == -1) return 0;
/* Look through all matching certificates for a suitable issuer */ /* Else find index of first cert accepted by 'check_issued' */
ret = 0;
CRYPTO_w_lock(CRYPTO_LOCK_X509_STORE);
idx = X509_OBJECT_idx_by_subject(ctx->ctx->objs, X509_LU_X509, xn);
if (idx != -1) /* should be true as we've had at least one match */
{
/* Look through all matching certs for suitable issuer */
for (i = idx; i < sk_X509_OBJECT_num(ctx->ctx->objs); i++) for (i = idx; i < sk_X509_OBJECT_num(ctx->ctx->objs); i++)
{ {
pobj = sk_X509_OBJECT_value(ctx->ctx->objs, i); pobj = sk_X509_OBJECT_value(ctx->ctx->objs, i);
/* See if we've ran out of matches */ /* See if we've run past the matches */
if (pobj->type != X509_LU_X509) return 0; if (pobj->type != X509_LU_X509)
if (X509_NAME_cmp(xn, X509_get_subject_name(pobj->data.x509))) return 0; break;
if (X509_NAME_cmp(xn, X509_get_subject_name(pobj->data.x509)))
break;
if (ctx->check_issued(ctx, x, pobj->data.x509)) if (ctx->check_issued(ctx, x, pobj->data.x509))
{ {
*issuer = pobj->data.x509; *issuer = pobj->data.x509;
X509_OBJECT_up_ref_count(pobj); X509_OBJECT_up_ref_count(pobj);
return 1; ret = 1;
break;
} }
} }
return 0; }
} CRYPTO_w_unlock(CRYPTO_LOCK_X509_STORE);
return ret;
}
int X509_STORE_set_flags(X509_STORE *ctx, unsigned long flags) int X509_STORE_set_flags(X509_STORE *ctx, unsigned long flags)
{ {