Re: [PATCH 0/3] Add CRL checking to server and client

Rik Theys
2025-06-17T05:22:23Z

Hi,

On Mon, Jun 16, 2025 at 4:40 PM Chuck Lever <chuck.lever@oracle.com> wrote:
>
> On 6/12/25 10:28 AM, Long Xin wrote:
> > On Wed, Jun 11, 2025 at 9:49 AM Chuck Lever <chuck.lever@oracle.com> wrote:
> >>
> >> On 6/11/25 3:09 AM, Rik Theys wrote:
> >>> These patches add CRL checking to the TLS client and server code.
> >>>
> >>> It introduces an x509.crl configuration option that specifies the
> >>> location of a CRL in PEM format.
> >>>
> >>> The CRL (certificate revocation list) can be used by an administrator
> >>> to block access to certificates that should no longer be trusted
> >>> for some reason.
> >>>
> >>> See https://github.com/oracle/ktls-utils/issues/103
> >>>
> >>> Rik Theys (3):
> >>> Add server-side CRL checking
> >>> Add client-side CRL checking
> >>> Add x509.crl option to man page.
> >>>
> >>> src/tlshd/client.c | 28 +++++++++++++++++
> >>> src/tlshd/config.c | 66 ++++++++++++++++++++++++++++++++++++++++
> >>> src/tlshd/server.c | 14 +++++++++
> >>> src/tlshd/tlshd.conf.man | 9 +++++-
> >>> src/tlshd/tlshd.h | 2 ++
> >>> 5 files changed, 118 insertions(+), 1 deletion(-)
> >>>
> >>
> >> Also note that this will need a similar code change to the QUIC paths,
> >> eventually.
> >>
> > Yes, there's no difference for the certificate credentials
> > configuration for QUIC.
> >
> > I think it will be nice to have a function like:
> >
> > static int tlshd_server_configure_credentials(gnutls_certificate_credentials_t
> > xcred)
> > {
> > char *crlfile;
> > char *cafile;
> > int ret;
> >
> > if (tlshd_config_get_server_truststore(&cafile)) {
> > ret = gnutls_certificate_set_x509_trust_file(xcred, cafile,
> >
> > GNUTLS_X509_FMT_PEM);
> > free(cafile);
> > } else
> > ret = gnutls_certificate_set_x509_system_trust(xcred);
> > if (ret < 0)
> > return ret;
> > tlshd_log_debug("System trust: Loaded %d certificate(s).", ret);
> >
> > if (tlshd_config_get_server_crl(&crlfile)) {
> > ret = gnutls_certificate_set_x509_crl_file(xcred, crlfile,
> > GNUTLS_X509_FMT_PEM);
> > free(crlfile);
> > if (ret < 0 )
> > return ret;
> > tlshd_log_debug("System CRL: Loaded %d CRL(s).", ret);
> > } else {
> > tlshd_log_debug("System CRL: No CRL file configured.");
> > }
> >
> > gnutls_certificate_set_retrieve_function2(xcred,
> > tlshd_x509_retrieve_key_cb);
> > return GNUTLS_E_SUCCESS;
> > }
> >
> > then use it in both tlshd_tls13/quic_server_x509_handshake().
> > and do the same thing in client.c.
> >
> > Thanks.
>
> Rik, do you want to take a crack at the suggested code re-organization,
> or do you want me to just take your series as-is and fix it up? Either
> way is fine with me.

This week is a very busy week for me. I can look into it next week.

Feel free to take the series and fix it up as you've suggested.

Regards,
Rik