tls: add tls.crl_file support for certificate revocation checks

include/fluent-bit/flb_input.h

@@ -510,6 +510,7 @@ struct flb_input_instance {
     char *tls_crt_file;                  /* Certificate                  */
     char *tls_key_file;                  /* Cert Key                     */
     char *tls_key_passwd;                /* Cert Key Password            */
+    char *tls_crl_file;                  /* Certificate Revocation List  */
     char *tls_min_version;               /* Minimum protocol version of TLS */
     char *tls_max_version;               /* Maximum protocol version of TLS */
     char *tls_ciphers;                   /* TLS ciphers */

include/fluent-bit/flb_output.h

@@ -387,6 +387,7 @@ struct flb_output_instance {
     char *tls_crt_file;                  /* Certificate                  */
     char *tls_key_file;                  /* Cert Key                     */
     char *tls_key_passwd;                /* Cert Key Password            */
+    char *tls_crl_file;                  /* Certificate Revocation List  */
     char *tls_min_version;               /* Minimum protocol version of TLS */
     char *tls_max_version;               /* Maximum protocol version of TLS */
     char *tls_ciphers;                   /* TLS ciphers */

include/fluent-bit/tls/flb_tls.h

@@ -95,6 +95,7 @@ struct flb_tls_backend {
     /* Additional settings */
     int (*context_alpn_set) (void *, const char *);
     int (*context_set_verify_client) (void *, int);
+    int (*context_set_crl_file) (void *, const char *);
 
     /* TLS Protocol version */
     int (*set_minmax_proto) (struct flb_tls *tls, const char *, const char *);
@@ -139,6 +140,7 @@ struct flb_tls {
     char *crt_file;                   /* Certificate               */
     char *key_file;                   /* Cert Key                  */
     char *key_passwd;                 /* Cert Key Password         */
+    char *crl_file;                   /* Certificate revocation list */
     char *alpn;                       /* ALPN protocol list        */
     char *min_version;                /* Minimum TLS version       */
     char *max_version;                /* Maximum TLS version       */
@@ -178,6 +180,7 @@ int flb_tls_reload_if_needed(struct flb_tls *tls);
 
 int flb_tls_set_alpn(struct flb_tls *tls, const char *alpn);
 int flb_tls_set_verify_client(struct flb_tls *tls, int verify_client);
+int flb_tls_set_crl_file(struct flb_tls *tls, const char *crl_file);
 
 int flb_tls_set_verify_hostname(struct flb_tls *tls, int verify_hostname);
 #if defined(FLB_SYSTEM_WINDOWS)

src/flb_input.c

@@ -618,6 +618,7 @@ struct flb_input_instance *flb_input_new(struct flb_config *config,
         instance->tls_crt_file          = NULL;
         instance->tls_key_file          = NULL;
         instance->tls_key_passwd        = NULL;
+        instance->tls_crl_file          = NULL;
 #endif
 
         /* Plugin requires a co-routine context ? */
@@ -952,6 +953,9 @@ int flb_input_set_property(struct flb_input_instance *ins,
     else if (prop_key_check("tls.key_passwd", k, len) == 0) {
         flb_utils_set_plugin_string_property("tls.key_passwd", &ins->tls_key_passwd, tmp);
     }
+    else if (prop_key_check("tls.crl_file", k, len) == 0) {
+        flb_utils_set_plugin_string_property("tls.crl_file", &ins->tls_crl_file, tmp);
+    }
     else if (prop_key_check("tls.min_version", k, len) == 0) {
         flb_utils_set_plugin_string_property("tls.min_version", &ins->tls_min_version, tmp);
     }
@@ -1208,6 +1212,10 @@ void flb_input_instance_destroy(struct flb_input_instance *ins)
         flb_sds_destroy(ins->tls_key_file);
     }
 
+    if (ins->tls_crl_file) {
+        flb_sds_destroy(ins->tls_crl_file);
+    }
+
     if (ins->tls_key_passwd) {
         flb_sds_destroy(ins->tls_key_passwd);
     }
@@ -1920,6 +1928,16 @@ int flb_input_instance_init(struct flb_input_instance *ins,
                 return -1;
             }
         }
+
+        if (ins->tls_crl_file != NULL) {
+            ret = flb_tls_set_crl_file(ins->tls, ins->tls_crl_file);
+            if (ret != 0) {
+                flb_error("[input %s] error setting up TLS CRL file",
+                          ins->name);
+
+                return -1;
+            }
+        }
     }
 
     struct flb_config_map *m;

src/flb_output.c

@@ -191,6 +191,9 @@ static void flb_output_free_properties(struct flb_output_instance *ins)
     if (ins->tls_key_passwd) {
         flb_sds_destroy(ins->tls_key_passwd);
     }
+    if (ins->tls_crl_file) {
+        flb_sds_destroy(ins->tls_crl_file);
+    }
     if (ins->tls_min_version) {
         flb_sds_destroy(ins->tls_min_version);
     }
@@ -850,6 +853,7 @@ struct flb_output_instance *flb_output_new(struct flb_config *config,
     instance->tls_crt_file          = NULL;
     instance->tls_key_file          = NULL;
     instance->tls_key_passwd        = NULL;
+    instance->tls_crl_file          = NULL;
 # if defined(FLB_SYSTEM_WINDOWS)
     instance->tls_win_certstore_name = NULL;
     instance->tls_win_use_enterprise_certstore = FLB_FALSE;
@@ -1115,6 +1119,9 @@ int flb_output_set_property(struct flb_output_instance *ins,
     else if (prop_key_check("tls.key_passwd", k, len) == 0) {
         flb_utils_set_plugin_string_property("tls.key_passwd", &ins->tls_key_passwd, tmp);
     }
+    else if (prop_key_check("tls.crl_file", k, len) == 0) {
+        flb_utils_set_plugin_string_property("tls.crl_file", &ins->tls_crl_file, tmp);
+    }
     else if (prop_key_check("tls.min_version", k, len) == 0) {
         flb_utils_set_plugin_string_property("tls.min_version", &ins->tls_min_version, tmp);
     }
@@ -1691,6 +1698,16 @@ int flb_output_init_all(struct flb_config *config)
                 }
             }
 
+            if (ins->tls_crl_file != NULL) {
+                ret = flb_tls_set_crl_file(ins->tls, ins->tls_crl_file);
+                if (ret != 0) {
+                    flb_error("[output %s] error setting up TLS CRL file",
+                              ins->name);
+                    flb_output_instance_destroy(ins);
+                    return -1;
+                }
+            }
+
 # if defined (FLB_SYSTEM_WINDOWS)
             if (ins->tls_win_use_enterprise_certstore) {
                 ret = flb_tls_set_use_enterprise_store(ins->tls, ins->tls_win_use_enterprise_certstore);

src/tls/flb_tls.c

@@ -76,6 +76,12 @@ struct flb_config_map tls_configmap[] = {
      "Optional password for tls.key_file file"
     },
 
+    {
+     FLB_CONFIG_MAP_STR, "tls.crl_file", NULL,
+     0, FLB_FALSE, 0,
+     "Absolute path to a Certificate Revocation List (CRL) file in PEM format"
+    },
+
     {
      FLB_CONFIG_MAP_STR, "tls.vhost", NULL,
      0, FLB_FALSE, 0,
@@ -547,6 +553,9 @@ int flb_tls_destroy(struct flb_tls *tls)
     if (tls->key_passwd != NULL) {
         flb_free(tls->key_passwd);
     }
+    if (tls->crl_file != NULL) {
+        flb_free(tls->crl_file);
+    }
     if (tls->alpn != NULL) {
         flb_free(tls->alpn);
     }
@@ -616,6 +625,30 @@ int flb_tls_set_verify_client(struct flb_tls *tls, int verify_client)
     return 0;
 }
 
+int flb_tls_set_crl_file(struct flb_tls *tls, const char *crl_file)
+{
+    int ret;
+
+    if (!tls) {
+        return -1;
+    }
+
+    if (tls->ctx && tls->api->context_set_crl_file) {
+        ret = tls->api->context_set_crl_file(tls->ctx, crl_file);
+        if (ret != 0) {
+            return ret;
+        }
+
+        if (tls_store_string(&tls->crl_file, crl_file) != 0) {
+            return -1;
+        }
+
+        return ret;
+    }
+
+    return 0;
+}
+
 int flb_tls_set_verify_hostname(struct flb_tls *tls, int verify_hostname)
 {
     if (!tls) {

src/tls/openssl.c

@@ -31,6 +31,7 @@
 #include <openssl/err.h>
 #include <openssl/opensslv.h>
 #include <openssl/x509v3.h>
+#include <openssl/pem.h>
 
 #ifdef FLB_SYSTEM_MACOS
 #include <Security/Security.h>
@@ -456,6 +457,74 @@ static int tls_context_set_verify_client(void *ctx_backend, int verify_client)
     return 0;
 }
 
+static int tls_context_set_crl_file(void *ctx_backend, const char *crl_file)
+{
+    struct tls_context *ctx = ctx_backend;
+    X509_STORE *store;
+    X509_CRL *crl;
+    BIO *bio;
+    char err_buf[256];
+    int loaded = 0;
+
+    if (crl_file == NULL) {
+        return 0;
+    }
+
+    pthread_mutex_lock(&ctx->mutex);
+
+    store = SSL_CTX_get_cert_store(ctx->ctx);
+    if (store == NULL) {
+        flb_error("[tls] could not retrieve certificate store for CRL");
+        pthread_mutex_unlock(&ctx->mutex);
+        return -1;
+    }
+
+    bio = BIO_new_file(crl_file, "r");
+    if (bio == NULL) {
+        ERR_error_string_n(ERR_get_error(), err_buf, sizeof(err_buf) - 1);
+        flb_error("[tls] crl_file '%s': %s", crl_file, err_buf);
+        pthread_mutex_unlock(&ctx->mutex);
+        return -1;
+    }
+
+    while ((crl = PEM_read_bio_X509_CRL(bio, NULL, NULL, NULL)) != NULL) {
+        if (X509_STORE_add_crl(store, crl) != 1) {
+            ERR_error_string_n(ERR_get_error(), err_buf, sizeof(err_buf) - 1);
+            flb_warn("[tls] could not add CRL from '%s': %s", crl_file, err_buf);
+        }
+        else {
+            loaded++;
+        }
+        X509_CRL_free(crl);
+    }
+    BIO_free(bio);
+
+    /* PEM_read_bio_X509_CRL leaves a benign EOF error on the stack */
+    ERR_clear_error();
+
+    if (loaded == 0) {
+        flb_error("[tls] no CRL entries loaded from '%s'", crl_file);
+        pthread_mutex_unlock(&ctx->mutex);
+        return -1;
+    }
+
+    if (X509_STORE_set_flags(store,
+                             X509_V_FLAG_CRL_CHECK |
+                             X509_V_FLAG_CRL_CHECK_ALL) != 1) {
+        ERR_error_string_n(ERR_get_error(), err_buf, sizeof(err_buf) - 1);
+        flb_error("[tls] could not enable CRL checking for '%s': %s",
+                  crl_file, err_buf);
+        pthread_mutex_unlock(&ctx->mutex);
+        return -1;
+    }
+
+    pthread_mutex_unlock(&ctx->mutex);
+
+    flb_debug("[tls] loaded %i CRL entrie(s) from '%s'", loaded, crl_file);
+
+    return 0;
+}
+
 #ifdef _MSC_VER
 /* Parse certstore_name prefix like
  *
@@ -716,7 +785,7 @@ static int windows_load_system_certificates(struct tls_context *ctx)
         return -1;
     }
 
-    flb_debug("[tls] successfully loaded certificates from windows system %s store.", 
+    flb_debug("[tls] successfully loaded certificates from windows system %s store.",
               configured_name);
     return 0;
 }
@@ -1251,7 +1320,7 @@ static unsigned char *hex_to_bytes(const char *hex, size_t *out_len) {
     return buf;
 }
 
-static int windows_set_allowed_thumbprints(struct tls_context *ctx, const char *thumbprints) 
+static int windows_set_allowed_thumbprints(struct tls_context *ctx, const char *thumbprints)
 {
     char *token_ctx = NULL, *tok = NULL;
     size_t cap = 4, count = 0;
@@ -1387,6 +1456,12 @@ static int tls_context_reload(struct flb_tls *tls)
         return -1;
     }
 
+    if (tls->crl_file != NULL &&
+        tls_context_set_crl_file(new_ctx, tls->crl_file) != 0) {
+        tls_context_destroy(new_ctx);
+        return -1;
+    }
+
 #if defined(FLB_SYSTEM_WINDOWS)
     if (tls->certstore_name != NULL &&
         tls_set_certstore_name(&tmp_tls, tls->certstore_name) != 0) {
@@ -1973,6 +2048,7 @@ static struct flb_tls_backend tls_openssl = {
     .context_destroy      = tls_context_destroy,
     .context_alpn_set     = tls_context_alpn_set,
     .context_set_verify_client = tls_context_set_verify_client,
+    .context_set_crl_file = tls_context_set_crl_file,
     .session_alpn_get     = tls_session_alpn_get,
     .set_minmax_proto     = tls_set_minmax_proto,
     .set_ciphers          = tls_set_ciphers,