Adding CRL support

Author: lealem47

certs/crl.pem

@@ -0,0 +1,41 @@
+Certificate Revocation List (CRL):
+        Version 2 (0x1)
+        Signature Algorithm: sha256WithRSAEncryption
+        Issuer: C = US, ST = Montana, L = Bozeman, O = Sawtooth, OU = Consulting, CN = www.wolfssl.com, emailAddress = info@wolfssl.com
+        Last Update: Feb 15 12:50:27 2022 GMT
+        Next Update: Nov 11 12:50:27 2024 GMT
+        CRL extensions:
+            X509v3 CRL Number: 
+                2
+Revoked Certificates:
+    Serial Number: 02
+        Revocation Date: Feb 15 12:50:27 2022 GMT
+    Signature Algorithm: sha256WithRSAEncryption
+         43:e6:3b:30:0e:32:53:32:a4:08:3c:e5:d5:2e:f1:ce:e9:95:
+         ff:ba:d6:fe:2e:59:80:f8:0a:2f:cf:1e:e0:37:fe:ca:cc:33:
+         66:8b:ed:65:50:7d:44:92:d3:5c:52:9a:95:a5:9d:a5:4e:77:
+         8b:b4:7f:59:c8:7a:e0:eb:34:32:ae:a1:03:99:d2:3c:c0:f4:
+         7e:1c:87:4c:6c:5a:ba:0a:95:e8:a1:44:01:7b:8f:3e:a4:e3:
+         e8:1e:07:19:f0:09:7a:85:8f:f3:82:62:f8:1e:08:51:a3:60:
+         30:5b:06:c8:a2:b3:ff:aa:28:66:ad:fe:4b:81:49:30:ef:5f:
+         5d:ac:d9:ad:17:9f:2a:b6:22:d6:35:cc:9f:d9:11:26:dd:7a:
+         06:35:d0:d5:c7:41:6c:52:97:8c:aa:82:5a:e5:a8:58:d4:b7:
+         2b:31:84:34:15:bd:08:e4:9e:71:9e:c5:40:f8:02:a3:a0:1e:
+         4f:98:72:2b:eb:9e:8a:4e:01:83:88:e5:cb:6e:3b:52:e3:a9:
+         34:a1:7c:e4:79:2c:d1:e0:0b:74:22:ba:6d:cb:c3:a1:56:f9:
+         c9:f4:20:bf:00:49:df:6b:59:49:18:c7:75:27:8e:a1:5a:a6:
+         ff:f2:be:34:4a:c9:6d:6e:24:a3:1f:15:7e:34:90:b6:81:bf:
+         15:80:c3:ac
+-----BEGIN X509 CRL-----
+MIICBDCB7QIBATANBgkqhkiG9w0BAQsFADCBlDELMAkGA1UEBhMCVVMxEDAOBgNV
+BAgMB01vbnRhbmExEDAOBgNVBAcMB0JvemVtYW4xETAPBgNVBAoMCFNhd3Rvb3Ro
+MRMwEQYDVQQLDApDb25zdWx0aW5nMRgwFgYDVQQDDA93d3cud29sZnNzbC5jb20x
+HzAdBgkqhkiG9w0BCQEWEGluZm9Ad29sZnNzbC5jb20XDTIyMDIxNTEyNTAyN1oX
+DTI0MTExMTEyNTAyN1owFDASAgECFw0yMjAyMTUxMjUwMjdaoA4wDDAKBgNVHRQE
+AwIBAjANBgkqhkiG9w0BAQsFAAOCAQEAQ+Y7MA4yUzKkCDzl1S7xzumV/7rW/i5Z
+gPgKL88e4Df+yswzZovtZVB9RJLTXFKalaWdpU53i7R/Wch64Os0Mq6hA5nSPMD0
+fhyHTGxaugqV6KFEAXuPPqTj6B4HGfAJeoWP84Ji+B4IUaNgMFsGyKKz/6ooZq3+
+S4FJMO9fXazZrRefKrYi1jXMn9kRJt16BjXQ1cdBbFKXjKqCWuWoWNS3KzGENBW9
+COSecZ7FQPgCo6AeT5hyK+ueik4Bg4jly247UuOpNKF85Hks0eALdCK6bcvDoVb5
+yfQgvwBJ32tZSRjHdSeOoVqm//K+NErJbW4kox8VfjSQtoG/FYDDrA==
+-----END X509 CRL-----

examples/client.py

@@ -89,6 +89,17 @@ def build_arg_parser():
         help="Send server HTTP GET"
     )
 
+    parser.add_argument(
+        "-C", action="store_true",
+        help="Disable CRL"
+    )
+
+    parser.add_argument(
+        "-r", metavar="crl_file", default="./certs/crl.pem",
+        help="CRL file,                   default ./certs/crl.pem"
+    )
+
+
     return parser
 
 
@@ -126,7 +137,11 @@ def main():
 
     try:
         secure_socket = context.wrap_socket(bind_socket)
-
+        
+        if not args.C:
+            secure_socket.enable_crl(1)
+            secure_socket.load_crl_file(args.r, 1);
+        
         secure_socket.connect((args.h, args.p))
 
         if args.g:

wolfssl/__init__.py

@@ -515,6 +515,28 @@ def use_sni(self, server_hostname):
         if ret != _SSL_SUCCESS:
             raise SSLError("Unable to set wolfSSL SNI")
 
+    def enable_crl(self, options):
+        """
+        Enables CRL certificate revocation
+        """
+
+        ret = _lib.wolfSSL_EnableCRL(self.native_object, options)
+
+        if ret != _SSL_SUCCESS:
+            raise SSLError("Unable to enable CRL ")
+
+    def load_crl_file(self, path, filetype):
+        """
+        Load CRL certificate revocation
+        """
+
+        ret = _lib.wolfSSL_LoadCRLFile(self.native_object,
+                                       t2b(path) if path else _ffi.NULL,
+                                       filetype)
+
+        if ret != _SSL_SUCCESS:
+            raise SSLError("Unable to load CRL")
+
     def write(self, data):
         """
         Write DATA to the underlying secure channel.

wolfssl/_build_ffi.py

@@ -156,6 +156,9 @@ def make_flags(prefix, debug):
     # tls 1.3
     flags.append("--enable-tls13")
 
+    # crl
+    flags.append("--enable-crl")
+
     # for urllib3 - requires SNI (tlsx), options (openssl compat), peer cert
     flags.append("--enable-tlsx")
     flags.append("--enable-opensslextra")
@@ -448,6 +451,8 @@ def generate_libwolfssl():
     int           wolfSSL_set_tlsext_host_name(WOLFSSL*, const char*);
     long          wolfSSL_ctrl(WOLFSSL*, int, long, void*);
     void          wolfSSL_set_connect_state(WOLFSSL*);
+    int           wolfSSL_EnableCRL(WOLFSSL*, int);
+    int           wolfSSL_LoadCRLFile(WOLFSSL*, const char*, int);
 
     /**
      * WOLFSSL_X509 functions