romenskiy2012/curl
1
0
Fork 0
mirror of https://github.com/curl/curl.git synced 2026-07-26 02:47:18 +03:00
Code Issues Projects Releases Packages Wiki Activity

curl.h: add CURLOPT_CA_CACHE_TIMEOUT option

Browse source 
Adds a new option to control the maximum time that a cached
certificate store may be retained for.

Currently only the OpenSSL backend implements support for
caching certificate stores.

Closes #9620
This commit is contained in:
Michael Drake 2022-10-12 12:12:08 +01:00 • committed by Daniel Stenberg
parent 3c16697ebd
commit 1fdca35ddd
No known key found for this signature in database
GPG key ID: 5CC908FDB71E12C2
10 changed files with 116 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

3
lib/easyoptions.c
View file

@ -42,6 +42,7 @@ struct curl_easyoption Curl_easyopts[] = {
{"CAINFO", CURLOPT_CAINFO, CURLOT_STRING, 0},
{"CAINFO_BLOB", CURLOPT_CAINFO_BLOB, CURLOT_BLOB, 0},
{"CAPATH", CURLOPT_CAPATH, CURLOT_STRING, 0},
{"CA_CACHE_TIMEOUT", CURLOPT_CA_CACHE_TIMEOUT, CURLOT_LONG, 0},
{"CERTINFO", CURLOPT_CERTINFO, CURLOT_LONG, 0},
{"CHUNK_BGN_FUNCTION", CURLOPT_CHUNK_BGN_FUNCTION, CURLOT_FUNCTION, 0},
{"CHUNK_DATA", CURLOPT_CHUNK_DATA, CURLOT_CBPTR, 0},
@ -368,6 +369,6 @@ struct curl_easyoption Curl_easyopts[] = {
*/
int Curl_easyopts_check(void)
{
return ((CURLOPT_LASTENTRY%10000) != (320 + 1));
return ((CURLOPT_LASTENTRY%10000) != (321 + 1));
}
#endif

9
lib/setopt.c
View file

@ -204,6 +204,15 @@ CURLcode Curl_vsetopt(struct Curl_easy *data, CURLoption option, va_list param)
data->set.dns_cache_timeout = (int)arg;
break;
case CURLOPT_CA_CACHE_TIMEOUT:
arg = va_arg(param, long);
if(arg < -1)
return CURLE_BAD_FUNCTION_ARGUMENT;
else if(arg > INT_MAX)
arg = INT_MAX;
data->set.general_ssl.ca_cache_timeout = (int)arg;
break;
case CURLOPT_DNS_USE_GLOBAL_CACHE:
/* deprecated */
break;

2
lib/url.c
View file

@ -539,6 +539,8 @@ CURLcode Curl_init_userdefined(struct Curl_easy *data)
/* Set the default size of the SSL session ID cache */
set->general_ssl.max_ssl_sessions = 5;
/* Timeout every 24 hours by default */
set->general_ssl.ca_cache_timeout = 24 * 60 * 60;
set->proxyport = 0;
set->proxytype = CURLPROXY_HTTP; /* defaults to HTTP proxy */

1
lib/urldata.h
View file

@ -313,6 +313,7 @@ struct ssl_config_data {
struct ssl_general_config {
size_t max_ssl_sessions; /* SSL session id cache size */
int ca_cache_timeout; /* Certificate store cache timeout (seconds) */
};
/* information stored about one single SSL session */

29
lib/vtls/openssl.c
View file

@ -3164,12 +3164,18 @@ static CURLcode populate_x509_store(struct Curl_easy *data,
}
#if defined(HAVE_SSL_X509_STORE_SHARE)
#define X509_STORE_EXPIRY_MS (24 * 60 * 60 * 1000) /* 24 hours */
static bool cached_x509_store_expired(const struct multi_ssl_backend_data *mb)
static bool cached_x509_store_expired(const struct Curl_easy *data,
const struct multi_ssl_backend_data *mb)
{
const struct ssl_general_config *cfg = &data->set.general_ssl;
struct curltime now = Curl_now();
timediff_t elapsed_ms = Curl_timediff(now, mb->time);
timediff_t timeout_ms = cfg->ca_cache_timeout * (timediff_t)1000;
return Curl_timediff(now, mb->time) >= X509_STORE_EXPIRY_MS;
if(timeout_ms < 0)
return false;
return elapsed_ms >= timeout_ms;
}
static bool cached_x509_store_different(
@ -3191,7 +3197,7 @@ static X509_STORE *get_cached_x509_store(const struct Curl_easy *data,
if(multi &&
multi->ssl_backend_data &&
multi->ssl_backend_data->store &&
!cached_x509_store_expired(multi->ssl_backend_data) &&
!cached_x509_store_expired(data, multi->ssl_backend_data) &&
!cached_x509_store_different(multi->ssl_backend_data, conn)) {
store = multi->ssl_backend_data->store;
}
@ -3244,17 +3250,20 @@ static CURLcode set_up_x509_store(struct Curl_easy *data,
struct ssl_backend_data *backend)
{
CURLcode result = CURLE_OK;
X509_STORE *cached_store = get_cached_x509_store(data, conn);
X509_STORE *cached_store;
bool cache_criteria_met;
/* Consider the X509 store cacheable if it comes exclusively from a CAfile,
or no source is provided and we are falling back to openssl's built-in
default. */
bool cache_criteria_met = SSL_CONN_CONFIG(verifypeer) &&
!SSL_CONN_CONFIG(CApath) &&
!SSL_CONN_CONFIG(ca_info_blob) &&
!SSL_SET_OPTION(primary.CRLfile) &&
!SSL_SET_OPTION(native_ca_store);
cache_criteria_met = (data->set.general_ssl.ca_cache_timeout != 0) &&
SSL_CONN_CONFIG(verifypeer) &&
!SSL_CONN_CONFIG(CApath) &&
!SSL_CONN_CONFIG(ca_info_blob) &&
!SSL_SET_OPTION(primary.CRLfile) &&
!SSL_SET_OPTION(native_ca_store);
cached_store = get_cached_x509_store(data, conn);
if(cached_store && cache_criteria_met && X509_STORE_up_ref(cached_store)) {
SSL_CTX_set_cert_store(backend->ctx, cached_store);
}