Adjust TSL init to throw exceptions

metsma · kristelmerilain · commit e232b19c7bf5 · 2026-03-10T14:00:18.000+02:00
IB-8710, Fixes #694 Signed-off-by: Raul Metsma <raul@metsma.ee>
diff --git a/src/Container.cpp b/src/Container.cpp
@@ -139,16 +139,17 @@ void digidoc::initialize(const string &appInfo, const string &userAgent, initCal
     {
         thread([callBack]{
             try {
-                X509CertStore::instance();
+                X509CertStore::instance()->update();
                 callBack(nullptr);
             }
             catch(const Exception &e) {
+                ERR("Failed to load TSL lists: %s", e.msg().c_str());
                 callBack(&e);
             }
         }).detach();
     }
     else
-        X509CertStore::instance();
+        X509CertStore::instance()->update();
 }
 
 /**
diff --git a/src/crypto/TSL.cpp b/src/crypto/TSL.cpp
@@ -28,12 +28,14 @@
 
 #include <array>
 #include <charconv>
+#include <chrono>
 #include <fstream>
 #include <future>
 
 using namespace digidoc;
 using namespace digidoc::util;
 using namespace std;
+using namespace chrono_literals;
 
 namespace digidoc {
 
@@ -102,14 +104,14 @@ TSL::TSL(string file)
         WARN("Failed to parse configuration: %s", path.c_str());
 }
 
-bool TSL::activate(string territory)
+bool TSL::activate(string_view territory)
 {
     if(territory.size() != 2)
         return false;
     if(territory == "GR")
-        territory = "EL"; // Greece is EL in EU  TL
+        territory = "EL"; // Greece is EL in EU TL
     string cache = CONF(TSLCache);
-    string path = cache + '/' + territory + ".xml";
+    string path = cache + '/' + territory.data() + ".xml";
     if(File::fileExists(path))
         return false;
     ofstream(File::encodeName(path), ofstream::binary) << ' ';
@@ -192,75 +194,70 @@ string_view TSL::operatorName() const noexcept
     return toString(schemeInformation/"SchemeOperatorName");
 }
 
-vector<TSL::Service> TSL::parse()
-{
-    string url = CONF(TSLUrl);
-    string cache = CONF(TSLCache);
-    vector<X509Cert> cert = CONF(TSLCerts);
-    File::createDirectory(cache);
-    return parse(url, cert, cache, string(File::fileName(url)));
-}
-
 vector<TSL::Service> TSL::parse(const string &url, const vector<X509Cert> &certs,
-    const string &cache, const string &territory)
+    const string &cache, string_view territory)
 {
-    vector<Service> list;
-    try {
-        TSL tsl = parseTSL(url, certs, cache, territory);
-        if(tsl.pointers().empty())
-            return tsl.services();
+    TSL tsl = parseTSL(url, certs, cache, territory);
+    auto pointers = tsl.pointers();
+    if(pointers.empty())
+        return tsl.services();
 
-        vector< future< vector<TSL::Service> > > futures;
-        for(const TSL::Pointer &p: tsl.pointers())
-        {
-            if(!File::fileExists(cache + "/" + p.territory + ".xml"))
-                continue;
-            futures.push_back(async(launch::async, [p, cache]{
+    vector< future< vector<TSL::Service> > > futures;
+    for(const TSL::Pointer &p: pointers)
+    {
+        if(!File::fileExists(cache + "/" + p.territory + ".xml"))
+            continue;
+        futures.push_back(async(launch::async, [p, cache] noexcept -> vector<TSL::Service> {
+            try {
                 return parse(p.location, p.certs, cache, p.territory + ".xml");
-            }));
-        }
-        for(auto &f: futures)
-        {
-            vector<Service> services = f.get();
-            list.insert(list.end(), make_move_iterator(services.begin()), make_move_iterator(services.end()));
-        }
+            }
+            catch(const Exception &e)
+            {
+                debugException(e);
+                ERR("TSL %s Failed to validate list", p.territory.c_str());
+                return {};
+            }
+        }));
     }
-    catch(const Exception &e)
+    vector<Service> list;
+    for(auto &f: futures)
     {
-        debugException(e);
-        ERR("TSL %s Failed to validate list", territory.c_str());
-        list.clear();
+        vector<Service> services = f.get();
+        list.insert(list.end(), make_move_iterator(services.begin()), make_move_iterator(services.end()));
     }
     return list;
 }
 
 TSL TSL::parseTSL(const string &url, const vector<X509Cert> &certs,
-    const string &cache, const string &territory)
+    const string &cache, string_view territory)
 {
     string path = File::path(cache, territory);
     TSL valid;
     try {
         TSL tsl(path);
         tsl.validate(certs);
         valid = std::move(tsl);
-        DEBUG("TSL %s (%llu) signature is valid", territory.c_str(), valid.sequenceNumber());
+        DEBUG("TSL %.*s (%llu) signature is valid", STR_VIEW_FMT(territory), valid.sequenceNumber());
 
         if(valid.isExpired())
         {
             if(!CONF(TSLAutoUpdate) && CONF(TSLAllowExpired))
                 return valid;
-            THROW("TSL %s (%llu) is expired", territory.c_str(), valid.sequenceNumber());
+            THROW("TSL %.*s (%llu) is expired", STR_VIEW_FMT(territory), valid.sequenceNumber());
         }
 
-        if(CONF(TSLOnlineDigest) && (File::modifiedTime(valid.path) < (time(nullptr) - (60 * 60 * 24))))
+        if(CONF(TSLOnlineDigest))
         {
-            if(valid.validateETag(url))
-                File::updateModifiedTime(valid.path, time(nullptr));
+            auto encPath = File::encodeName(valid.path);
+            auto now = chrono::file_clock::now();
+            error_code ec;
+            if(filesystem::last_write_time(encPath, ec) < now - 24h && valid.validateETag(url))
+                filesystem::last_write_time(encPath, now, ec);
         }
 
         return valid;
     } catch(const Exception &) {
-        ERR("TSL %s signature is invalid", territory.c_str());
+        ERR("TSL %.*s signature is invalid", STR_VIEW_FMT(territory));
         if(!CONF(TSLAutoUpdate))
             throw;
     }
@@ -272,22 +269,22 @@ TSL TSL::parseTSL(const string &url, const vector<X509Cert> &certs,
         tsl.validate(certs);
         valid = std::move(tsl);
 
-        ofstream(File::encodeName(path), ofstream::binary|fstream::trunc)
-            << ifstream(File::encodeName(valid.path), fstream::binary).rdbuf();
         error_code ec;
-        filesystem::remove(File::encodeName(valid.path), ec);
+        filesystem::copy_file(File::encodeName(valid.path), File::encodeName(path), filesystem::copy_options::overwrite_existing, ec);
+        if(ec == errc{})
+            filesystem::remove(File::encodeName(valid.path), ec);
 
         ofstream(File::encodeName(path + ".etag"), ofstream::trunc) << etag;
 
-        DEBUG("TSL %s (%llu) signature is valid", territory.c_str(), valid.sequenceNumber());
+        DEBUG("TSL %.*s (%llu) signature is valid", STR_VIEW_FMT(territory), valid.sequenceNumber());
     } catch(const Exception &) {
-        ERR("TSL %s signature is invalid", territory.c_str());
+        ERR("TSL %.*s signature is invalid", STR_VIEW_FMT(territory));
         if(!valid)
             throw;
     }
 
     if(valid.isExpired() && !CONF(TSLAllowExpired))
-        THROW("TSL %s (%llu) is expired", territory.c_str(), valid.sequenceNumber());
+        THROW("TSL %.*s (%llu) is expired", STR_VIEW_FMT(territory), valid.sequenceNumber());
 
     return valid;
 }
@@ -393,9 +390,9 @@ vector<string> TSL::pivotURLs() const
 
 vector<TSL::Pointer> TSL::pointers() const
 {
-    if(!contains(SCHEMES_URI, type()))
-        return {};
     vector<Pointer> pointer;
+    if(!contains(SCHEMES_URI, type()))
+        return pointer;
     for(auto other = schemeInformation/"PointersToOtherTSL"/"OtherTSLPointer"; other; other++)
     {
         Pointer p;
@@ -439,12 +436,12 @@ vector<X509Cert> TSL::serviceDigitalIdentity(XMLNode service, string_view ctx)
                 result.emplace_back(cert);
                 continue;
             } catch(const Exception &e) {
-                DEBUG("Failed to parse %.*s certificate, Testing also parse as PEM: %s", int(ctx.size()), ctx.data(), e.msg().c_str());
+                DEBUG("Failed to parse %.*s certificate, Testing also parse as PEM: %s", STR_VIEW_FMT(ctx), e.msg().c_str());
             }
             try {
                 result.emplace_back(cert, X509Cert::Pem);
             } catch(const Exception &e) {
-                DEBUG("Failed to parse %.*s certificate as PEM: %s", int(ctx.size()), ctx.data(), e.msg().c_str());
+                DEBUG("Failed to parse %.*s certificate as PEM: %s", STR_VIEW_FMT(ctx), e.msg().c_str());
             }
         }
     }
@@ -502,9 +499,9 @@ void TSL::validate() const
         THROW("Failed to parse XML");
     auto signature = (*this)/XMLName{"Signature", DSIG_NS};
     if(!signature)
-        THROW("TSL %s Failed to verify signature", territory().data());
+        THROW("TSL %.*s Failed to verify signature", STR_VIEW_FMT(territory()));
     if(!XMLDocument::verifySignature(signature))
-        THROW("TSL %s Signature is invalid", territory().data());
+        THROW("TSL %.*s Signature is invalid", STR_VIEW_FMT(territory()));
 }
 
 void TSL::validate(const vector<X509Cert> &certs, int recursion) const
@@ -521,7 +518,7 @@ void TSL::validate(const vector<X509Cert> &certs, int recursion) const
 
     vector<string> urls = pivotURLs();
     if(urls.empty())
-        THROW("TSL %s Signature is signed with untrusted certificate", territory().data());
+        THROW("TSL %.*s Signature is signed with untrusted certificate", STR_VIEW_FMT(territory()));
 
     // https://ec.europa.eu/tools/lotl/pivot-lotl-explanation.html
     string path = File::path(CONF(TSLCache), File::fileName(urls[0]));
@@ -604,6 +601,6 @@ bool TSL::validateRemoteDigest(const string &url)
     sha.update(is);
 
     if(!digest.empty() && digest != sha.result())
-        THROW("TSL %s remote digest does not match local. TSL might be outdated", territory().data());
+        THROW("TSL %.*s remote digest does not match local. TSL might be outdated", STR_VIEW_FMT(territory()));
     return true;
 }
diff --git a/src/crypto/TSL.h b/src/crypto/TSL.h
@@ -55,8 +55,9 @@ class TSL: private XMLDocument
     std::vector<Pointer> pointers() const;
     std::vector<Service> services() const;
 
-    static bool activate(std::string territory);
-    static std::vector<Service> parse();
+    static bool activate(std::string_view territory);
+    static std::vector<Service> parse(const std::string &url, const std::vector<X509Cert> &certs,
+        const std::string &cache, std::string_view territory);
 
 private:
     std::vector<std::string> pivotURLs() const;
@@ -67,10 +68,8 @@ class TSL: private XMLDocument
 
     static std::string fetch(const std::string &url, const std::string &path);
     static void debugException(const Exception &e);
-    static std::vector<Service> parse(const std::string &url, const std::vector<X509Cert> &certs,
-        const std::string &cache, const std::string &territory);
     static TSL parseTSL(const std::string &url, const std::vector<X509Cert> &certs,
-        const std::string &cache, const std::string &territory) ;
+        const std::string &cache, std::string_view territory) ;
     static bool parseInfo(XMLNode info, Service &s);
     static std::vector<X509Cert> serviceDigitalIdentity(XMLNode other, std::string_view ctx);
     static std::vector<X509Cert> serviceDigitalIdentities(XMLNode other, std::string_view ctx);
diff --git a/src/crypto/X509CertStore.cpp b/src/crypto/X509CertStore.cpp
@@ -25,6 +25,7 @@
 #include "crypto/TSL.h"
 #include "util/algorithm.h"
 #include "util/DateTime.h"
+#include "util/File.h"
 #include "util/log.h"
 
 #include <openssl/conf.h>
@@ -47,34 +48,28 @@ const X509CertStore::Type X509CertStore::OCSP {
     "http://uri.etsi.org/TrstSvc/Svctype/Certstatus/OCSP/QC",
 };
 
-class X509CertStore::Private: public vector<TSL::Service> {
-public:
-    void update()
-    {
-        vector<TSL::Service> list = TSL::parse();
-        swap(list);
-        INFO("Loaded %zu certificates into TSL certificate store.", size());
-    }
-};
+struct X509CertStore::Private: public vector<TSL::Service> {};
 
 /**
  * X509CertStore constructor.
  */
 X509CertStore::X509CertStore()
     : d(make_unique<Private>())
-{
-    d->update();
-}
+{}
 
 /**
  * Release all certificates.
  */
-X509CertStore::~X509CertStore() = default;
+X509CertStore::~X509CertStore() noexcept = default;
 
-void X509CertStore::activate(const X509Cert &cert) const
+void X509CertStore::activate(const X509Cert &cert) const try
 {
     if(std::max<bool>(TSL::activate(cert.issuerName("C")), TSL::activate(cert.subjectName("C"))))
-        d->update();
+        update();
+}
+catch(const Exception &e)
+{
+    ERR("Failed to activate TSL: %s", e.msg().c_str()); 
 }
 
 /**
@@ -190,6 +185,17 @@ int X509CertStore::validate(int ok, X509_STORE_CTX *ctx)
     return ok;
 }
 
+void X509CertStore::update() const
+{
+    string url = CONF(TSLUrl);
+    string cache = CONF(TSLCache);
+    vector<X509Cert> cert = CONF(TSLCerts);
+    util::File::createDirectory(cache);
+    vector<TSL::Service> list = TSL::parse(url, cert, cache, util::File::fileName(url));
+    d->swap(list);
+    INFO("Loaded %zu certificates into TSL certificate store.", d->size());
+}
+
 /**
  * Check if X509Cert is signed by trusted issuer
  * @throw Exception if error
diff --git a/src/crypto/X509CertStore.h b/src/crypto/X509CertStore.h
@@ -49,15 +49,16 @@ namespace digidoc
         X509Cert findIssuer(const X509Cert &cert, const Type &type) const;
         static X509Cert issuerFromAIA(const X509Cert &cert);
         static unique_free_t<X509_STORE> createStore(const Type &type, tm &tm);
+        void update() const;
         bool verify(const X509Cert &cert, bool noqscd, tm validation_time = {}) const;
 
     private:
         X509CertStore();
-        ~X509CertStore();
+        ~X509CertStore() noexcept;
         DISABLE_COPY(X509CertStore);
 
         static int validate(int ok, X509_STORE_CTX *ctx);
-        class Private;
+        struct Private;
         std::unique_ptr<Private> d;
     };
 }
diff --git a/src/util/File.cpp b/src/util/File.cpp
@@ -133,13 +133,6 @@ time_t File::modifiedTime(const string &path)
     return f_stat(encodeName(path).c_str(), &fileInfo) ? time(nullptr) : fileInfo.st_mtime;
 }
 
-void File::updateModifiedTime(const string &path, time_t time)
-{
-    f_utimbuf u_time { time, time };
-    if(f_utime(encodeName(path).c_str(), &u_time))
-        THROW("Failed to update file modified time.");
-}
-
 bool File::fileExtension(string_view path, initializer_list<string_view> list)
 {
     size_t pos = path.find_last_of('.');
diff --git a/src/util/File.h b/src/util/File.h
@@ -39,7 +39,6 @@ namespace digidoc
               static std::string digidocppPath();
               static std::filesystem::path encodeName(std::string_view fileName);
               static time_t modifiedTime(const std::string &path);
-              static void updateModifiedTime(const std::string &path, time_t time);
               static bool fileExists(const std::string& path);
               static bool fileExtension(std::string_view path, std::initializer_list<std::string_view> list);
               static unsigned long fileSize(const std::filesystem::path &path) noexcept;
diff --git a/src/util/log.h b/src/util/log.h
@@ -49,6 +49,7 @@ namespace digidoc
 #define DEBUG(...) digidoc::Log::out(digidoc::Log::DebugType, __FILE__, __LINE__, __VA_ARGS__)
 #define DEBUGMEM(msg, ptr, size) digidoc::Log::dbgPrintfMemImpl(msg, ptr, size, __FILE__, __LINE__)
 
+#define STR_VIEW_FMT(str) int(str.size()), str.data()
 #define EXCEPTION_PARAMS(...) __FILE__, __LINE__, digidoc::Log::format(__VA_ARGS__)
 #define EXCEPTION_ADD(_main, ...) _main.addCause(digidoc::Exception(EXCEPTION_PARAMS(__VA_ARGS__)))
 #define THROW(...) throw digidoc::Exception(EXCEPTION_PARAMS(__VA_ARGS__))
diff --git a/test/data/EE_T-no_QCStatement.xml b/test/data/EE_T-no_QCStatement.xml

Original file line number	Diff line number	Diff line change
`@@ -139,16 +139,17 @@ void digidoc::initialize(const string &appInfo, const string &userAgent, initCal`
`139`	`139`	`{`
`140`	`140`	`thread([callBack]{`
`141`	`141`	`try {`
`142`		`- X509CertStore::instance();`
	`142`	`+ X509CertStore::instance()->update();`
`143`	`143`	`callBack(nullptr);`
`144`	`144`	`}`
`145`	`145`	`catch(const Exception &e) {`
	`146`	`+ ERR("Failed to load TSL lists: %s", e.msg().c_str());`
`146`	`147`	`callBack(&e);`
`147`	`148`	`}`
`148`	`149`	`}).detach();`
`149`	`150`	`}`
`150`	`151`	`else`
`151`		`- X509CertStore::instance();`
	`152`	`+ X509CertStore::instance()->update();`
`152`	`153`	`}`
`153`	`154`
`154`	`155`	`/**`
Original file line number	Diff line number	Diff line change
`@@ -133,13 +133,6 @@ time_t File::modifiedTime(const string &path)`
`133`	`133`	`return f_stat(encodeName(path).c_str(), &fileInfo) ? time(nullptr) : fileInfo.st_mtime;`
`134`	`134`	`}`
`135`	`135`
`136`		`-void File::updateModifiedTime(const string &path, time_t time)`
`137`		`-{`
`138`		`- f_utimbuf u_time { time, time };`
`139`		`- if(f_utime(encodeName(path).c_str(), &u_time))`
`140`		`- THROW("Failed to update file modified time.");`
`141`		`-}`
`142`		`-`
`143`	`136`	`bool File::fileExtension(string_view path, initializer_list<string_view> list)`
`144`	`137`	`{`
`145`	`138`	`size_t pos = path.find_last_of('.');`