[FEATURE] stir_shaken reload crl_list and ca_dir

[abieuzent]

Is your feature request related to a problem? Please describe.

We are using STIR-SHAKEN module to be compliant with french regulation.
We should (The obligation to sign our calls start in July 2023) regularly receive the list of revoked certificates.
Currently the crl_list and ca_dir files read by the STIR-SHAKEN module are only read when opensips is started. In case of modification, it is necessary to restart opensips so that they are taken into account.

Describe the solution you'd like

add a possibility to reload the contents of crl_lit and ca_dir without restarting opensips.
for example with an external command from opensips-cli of type stir_shaken_reload.

Thanks

[github-actions]

Any updates here? No progress has been made in the last 15 days, marking as stale. Will close this issue if no further updates are made in the next 30 days.

[Integration-IT]

Hi @abieuzent,

If you inspect the module, init_cert_validation is called during module initialization when opensips starts.
I think hot reloading is possible by using a tweaked version of the init_cert_validation function.

• Copy the init_cert_validation function.
• Mod It to engage the CRL scope.
• Export CRL reload MI function.

Here the POC in my lab.

Code:

< ---SNIP --->
// store check then reload crl_list and crl_dir
static int init_cert_crl_reload(void)
{
	store = X509_STORE_new();
	if (!store) {
		LM_ERR("Failed to create X509_STORE_CTX object\n");
		return -1;
	}
	X509_STORE_set_verify_cb_func(store, verify_callback);

	/* check if crl_list param is set */
	if (!crl_list) {
		LM_ERR("Failed, path to a file containing certificate revocation lists (CRLs) for the verifier is not set.\n");
		return -2;
	}

	/* check if crl_dir param is set */
	if (!crl_dir) {
		LM_ERR("Failed, path to a directory containing certificate revocation lists (CRLs) for the verifier is not set or the CRLs in the directory must be in hashed form, as described in the openssl documentation for the Hashed Directory Method.\n");
		return -3;
	}

	/* params are set, do reload */
	if (crl_list || crl_dir) {
		if (X509_STORE_load_locations(store, crl_list, crl_dir) != 1) {
			LM_ERR("Failed to load CRLs\n");
			return -4;
		}
		X509_STORE_set_flags(store, X509_V_FLAG_CRL_CHECK | X509_V_FLAG_CRL_CHECK_ALL);
	}

	return 0;
}

opensips.cfg

loadmodule "stir_shaken.so"
modparam("stir_shaken", "ca_list", "/usr/local/etc/opensips/stir/ca/myCA.pem")
modparam("stir_shaken", "ca_dir", "/usr/local/etc/opensips/stir/ca/")
modparam("stir_shaken", "crl_list", "/usr/local/etc/opensips/stir/crl/pulp_crl.pem")
modparam("stir_shaken", "crl_dir", "/usr/local/etc/opensips/stir/crl")

opensips-cli

(cli): mi stir_shaken_crl_reload
"OK"
(cli): mi stir_shaken_ca_reload
"OK"

syslog

stir_shaken:mi_stir_shaken_crl_reload: Engage stir shaken crl reload, result <0>
stir_shaken:mi_stir_shaken_ca_reload: Engage stir shaken ca reload, result <0>

I will open a PR to get the dev team feedback.

[Integration-IT]

Hi @abieuzent ,
Dev teams merged the feature.

[github-actions]

Any updates here? No progress has been made in the last 15 days, marking as stale. Will close this issue if no further updates are made in the next 30 days.