blob: d634d6375ed5421e3e4ae40fc4040ca495e85fff [file] [log] [blame]
Ed Tanous0fdddb12017-02-28 11:06:34 -08001#pragma once
Ed Tanous55c7b7a2018-05-22 15:27:24 -07002#ifdef BMCWEB_ENABLE_SSL
Ed Tanous0fdddb12017-02-28 11:06:34 -08003
4#include <openssl/bio.h>
5#include <openssl/dh.h>
6#include <openssl/dsa.h>
Ed Tanous0fdddb12017-02-28 11:06:34 -08007#include <openssl/err.h>
8#include <openssl/evp.h>
9#include <openssl/pem.h>
10#include <openssl/rand.h>
11#include <openssl/rsa.h>
12#include <openssl/ssl.h>
Ed Tanous9b65f1f2017-03-07 15:17:13 -080013
Ed Tanous3112a142018-11-29 15:45:10 -080014#include <boost/asio/ssl/context.hpp>
Ed Tanous1abe55e2018-09-05 08:30:59 -070015#include <random>
16
17namespace ensuressl
18{
Ed Tanous55c7b7a2018-05-22 15:27:24 -070019static void initOpenssl();
Ed Tanousb01bf292019-03-25 19:25:26 +000020static EVP_PKEY *createEcKey();
Ed Tanous0fdddb12017-02-28 11:06:34 -080021
Ramesh Iyyar082f28f2019-06-22 03:31:55 -050022// Trust chain related errors.`
23inline bool isTrustChainError(int errnum)
24{
25 if ((errnum == X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT) ||
26 (errnum == X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN) ||
27 (errnum == X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY) ||
28 (errnum == X509_V_ERR_CERT_UNTRUSTED) ||
29 (errnum == X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE))
30 {
31 return true;
32 }
33 else
34 {
35 return false;
36 }
37}
38
39inline bool validateCertificate(X509 *const cert)
40{
41 // Create an empty X509_STORE structure for certificate validation.
42 X509_STORE *x509Store = X509_STORE_new();
43 if (!x509Store)
44 {
45 BMCWEB_LOG_ERROR << "Error occured during X509_STORE_new call";
46 return false;
47 }
48
49 // Load Certificate file into the X509 structure.
50 X509_STORE_CTX *storeCtx = X509_STORE_CTX_new();
51 if (!storeCtx)
52 {
53 BMCWEB_LOG_ERROR << "Error occured during X509_STORE_CTX_new call";
54 X509_STORE_free(x509Store);
55 return false;
56 }
57
58 int errCode = X509_STORE_CTX_init(storeCtx, x509Store, cert, NULL);
59 if (errCode != 1)
60 {
61 BMCWEB_LOG_ERROR << "Error occured during X509_STORE_CTX_init call";
62 X509_STORE_CTX_free(storeCtx);
63 X509_STORE_free(x509Store);
64 return false;
65 }
66
67 errCode = X509_verify_cert(storeCtx);
68 if (errCode == 1)
69 {
70 BMCWEB_LOG_INFO << "Certificate verification is success";
71 X509_STORE_CTX_free(storeCtx);
72 X509_STORE_free(x509Store);
73 return true;
74 }
75 if (errCode == 0)
76 {
77 errCode = X509_STORE_CTX_get_error(storeCtx);
78 X509_STORE_CTX_free(storeCtx);
79 X509_STORE_free(x509Store);
80 if (isTrustChainError(errCode))
81 {
82 BMCWEB_LOG_DEBUG << "Ignoring Trust Chain error. Reason: "
83 << X509_verify_cert_error_string(errCode);
84 return true;
85 }
86 else
87 {
88 BMCWEB_LOG_ERROR << "Certificate verification failed. Reason: "
89 << X509_verify_cert_error_string(errCode);
90 return false;
91 }
92 }
93
94 BMCWEB_LOG_ERROR
95 << "Error occured during X509_verify_cert call. ErrorCode: " << errCode;
96 X509_STORE_CTX_free(storeCtx);
97 X509_STORE_free(x509Store);
98 return false;
99}
100
Ed Tanous1abe55e2018-09-05 08:30:59 -0700101inline bool verifyOpensslKeyCert(const std::string &filepath)
102{
103 bool privateKeyValid = false;
104 bool certValid = false;
Ed Tanous9b65f1f2017-03-07 15:17:13 -0800105
Ed Tanous1abe55e2018-09-05 08:30:59 -0700106 std::cout << "Checking certs in file " << filepath << "\n";
Ed Tanous9b65f1f2017-03-07 15:17:13 -0800107
Ed Tanous1abe55e2018-09-05 08:30:59 -0700108 FILE *file = fopen(filepath.c_str(), "r");
109 if (file != NULL)
110 {
111 EVP_PKEY *pkey = PEM_read_PrivateKey(file, NULL, NULL, NULL);
Ed Tanous1abe55e2018-09-05 08:30:59 -0700112 if (pkey != nullptr)
113 {
114 RSA *rsa = EVP_PKEY_get1_RSA(pkey);
115 if (rsa != nullptr)
116 {
117 std::cout << "Found an RSA key\n";
118 if (RSA_check_key(rsa) == 1)
119 {
Jayanth Othayoth4d2849a2019-05-13 01:46:34 -0500120 privateKeyValid = true;
Ed Tanous1abe55e2018-09-05 08:30:59 -0700121 }
122 else
123 {
124 std::cerr << "Key not valid error number "
125 << ERR_get_error() << "\n";
126 }
127 RSA_free(rsa);
128 }
129 else
130 {
131 EC_KEY *ec = EVP_PKEY_get1_EC_KEY(pkey);
132 if (ec != nullptr)
133 {
134 std::cout << "Found an EC key\n";
135 if (EC_KEY_check_key(ec) == 1)
136 {
137 privateKeyValid = true;
138 }
139 else
140 {
141 std::cerr << "Key not valid error number "
142 << ERR_get_error() << "\n";
143 }
144 EC_KEY_free(ec);
145 }
146 }
147
148 if (privateKeyValid)
149 {
Ramesh Iyyarc0bf8932019-06-22 00:23:29 -0500150 // If the order is certificate followed by key in input file
151 // then, certificate read will fail. So, setting the file
152 // pointer to point beginning of file to avoid certificate and
153 // key order issue.
154 fseek(file, 0, SEEK_SET);
155
Ed Tanous1abe55e2018-09-05 08:30:59 -0700156 X509 *x509 = PEM_read_X509(file, NULL, NULL, NULL);
157 if (x509 == nullptr)
158 {
159 std::cout << "error getting x509 cert " << ERR_get_error()
160 << "\n";
161 }
162 else
163 {
Ramesh Iyyar082f28f2019-06-22 03:31:55 -0500164 certValid = validateCertificate(x509);
165 X509_free(x509);
Ed Tanous1abe55e2018-09-05 08:30:59 -0700166 }
167 }
168
169 EVP_PKEY_free(pkey);
Ed Tanous9b65f1f2017-03-07 15:17:13 -0800170 }
Ed Tanous1abe55e2018-09-05 08:30:59 -0700171 fclose(file);
Ed Tanous0fdddb12017-02-28 11:06:34 -0800172 }
Ed Tanous1abe55e2018-09-05 08:30:59 -0700173 return certValid;
Ed Tanous0fdddb12017-02-28 11:06:34 -0800174}
175
Ed Tanous1abe55e2018-09-05 08:30:59 -0700176inline void generateSslCertificate(const std::string &filepath)
177{
178 FILE *pFile = NULL;
179 std::cout << "Generating new keys\n";
180 initOpenssl();
Ed Tanous0fdddb12017-02-28 11:06:34 -0800181
Ed Tanous1abe55e2018-09-05 08:30:59 -0700182 // std::cerr << "Generating RSA key";
183 // EVP_PKEY *pRsaPrivKey = create_rsa_key();
Ed Tanous0fdddb12017-02-28 11:06:34 -0800184
Ed Tanous1abe55e2018-09-05 08:30:59 -0700185 std::cerr << "Generating EC key\n";
Ed Tanousb01bf292019-03-25 19:25:26 +0000186 EVP_PKEY *pRsaPrivKey = createEcKey();
Ed Tanous1abe55e2018-09-05 08:30:59 -0700187 if (pRsaPrivKey != nullptr)
188 {
189 std::cerr << "Generating x509 Certificate\n";
190 // Use this code to directly generate a certificate
191 X509 *x509;
192 x509 = X509_new();
193 if (x509 != nullptr)
194 {
195 // get a random number from the RNG for the certificate serial
196 // number If this is not random, regenerating certs throws broswer
197 // errors
198 std::random_device rd;
Ed Tanous271584a2019-07-09 16:24:22 -0700199 int serial = static_cast<int>(rd());
Ed Tanous9b65f1f2017-03-07 15:17:13 -0800200
Ed Tanous1abe55e2018-09-05 08:30:59 -0700201 ASN1_INTEGER_set(X509_get_serialNumber(x509), serial);
Ed Tanous9b65f1f2017-03-07 15:17:13 -0800202
Ed Tanous1abe55e2018-09-05 08:30:59 -0700203 // not before this moment
204 X509_gmtime_adj(X509_get_notBefore(x509), 0);
205 // Cert is valid for 10 years
206 X509_gmtime_adj(X509_get_notAfter(x509),
207 60L * 60L * 24L * 365L * 10L);
Ed Tanous9b65f1f2017-03-07 15:17:13 -0800208
Ed Tanous1abe55e2018-09-05 08:30:59 -0700209 // set the public key to the key we just generated
210 X509_set_pubkey(x509, pRsaPrivKey);
Ed Tanous0fdddb12017-02-28 11:06:34 -0800211
Ed Tanous1abe55e2018-09-05 08:30:59 -0700212 // get the subject name
213 X509_NAME *name;
214 name = X509_get_subject_name(x509);
Ed Tanous0fdddb12017-02-28 11:06:34 -0800215
Ed Tanous1abe55e2018-09-05 08:30:59 -0700216 X509_NAME_add_entry_by_txt(
217 name, "C", MBSTRING_ASC,
218 reinterpret_cast<const unsigned char *>("US"), -1, -1, 0);
219 X509_NAME_add_entry_by_txt(
220 name, "O", MBSTRING_ASC,
Brad Bishop85d2bb52019-04-05 08:31:14 -0400221 reinterpret_cast<const unsigned char *>("OpenBMC"), -1, -1, 0);
Ed Tanous1abe55e2018-09-05 08:30:59 -0700222 X509_NAME_add_entry_by_txt(
223 name, "CN", MBSTRING_ASC,
224 reinterpret_cast<const unsigned char *>("testhost"), -1, -1, 0);
225 // set the CSR options
226 X509_set_issuer_name(x509, name);
Ed Tanous0fdddb12017-02-28 11:06:34 -0800227
Ed Tanous1abe55e2018-09-05 08:30:59 -0700228 // Sign the certificate with our private key
229 X509_sign(x509, pRsaPrivKey, EVP_sha256());
Ed Tanous0fdddb12017-02-28 11:06:34 -0800230
Ed Tanous1abe55e2018-09-05 08:30:59 -0700231 pFile = fopen(filepath.c_str(), "wt");
Ed Tanous0fdddb12017-02-28 11:06:34 -0800232
Ed Tanous1abe55e2018-09-05 08:30:59 -0700233 if (pFile != nullptr)
234 {
235 PEM_write_PrivateKey(pFile, pRsaPrivKey, NULL, NULL, 0, 0,
236 NULL);
Ed Tanous0fdddb12017-02-28 11:06:34 -0800237
Ed Tanous1abe55e2018-09-05 08:30:59 -0700238 PEM_write_X509(pFile, x509);
239 fclose(pFile);
240 pFile = NULL;
241 }
Ed Tanous0fdddb12017-02-28 11:06:34 -0800242
Ed Tanous1abe55e2018-09-05 08:30:59 -0700243 X509_free(x509);
244 }
245
246 EVP_PKEY_free(pRsaPrivKey);
247 pRsaPrivKey = NULL;
Ed Tanous0fdddb12017-02-28 11:06:34 -0800248 }
249
Ed Tanous1abe55e2018-09-05 08:30:59 -0700250 // cleanup_openssl();
Ed Tanous99923322017-03-03 14:21:24 -0800251}
Ed Tanousb01bf292019-03-25 19:25:26 +0000252
Ed Tanousb01bf292019-03-25 19:25:26 +0000253EVP_PKEY *createEcKey()
254{
255 EVP_PKEY *pKey = NULL;
256 int eccgrp = 0;
257 eccgrp = OBJ_txt2nid("prime256v1");
Ed Tanous6ea007a2019-02-13 22:48:25 -0800258
Ed Tanous6ea007a2019-02-13 22:48:25 -0800259 EC_KEY *myecc = EC_KEY_new_by_curve_name(eccgrp);
Ed Tanousb01bf292019-03-25 19:25:26 +0000260 if (myecc != nullptr)
Ed Tanous6ea007a2019-02-13 22:48:25 -0800261 {
Ed Tanousb01bf292019-03-25 19:25:26 +0000262 EC_KEY_set_asn1_flag(myecc, OPENSSL_EC_NAMED_CURVE);
263 EC_KEY_generate_key(myecc);
264 pKey = EVP_PKEY_new();
265 if (pKey != nullptr)
266 {
267 if (EVP_PKEY_assign_EC_KEY(pKey, myecc))
268 {
269 /* pKey owns pRSA from now */
270 if (EC_KEY_check_key(myecc) <= 0)
271 {
272 fprintf(stderr, "EC_check_key failed.\n");
273 }
274 }
275 }
Ed Tanous6ea007a2019-02-13 22:48:25 -0800276 }
Ed Tanous1abe55e2018-09-05 08:30:59 -0700277 return pKey;
278}
279
280void initOpenssl()
281{
Ed Tanous911ac312017-08-15 09:37:42 -0700282#if OPENSSL_VERSION_NUMBER < 0x10100000L
Ed Tanous1abe55e2018-09-05 08:30:59 -0700283 SSL_load_error_strings();
284 OpenSSL_add_all_algorithms();
285 RAND_load_file("/dev/urandom", 1024);
Ed Tanousa1e077c2017-04-25 12:42:19 -0700286#endif
Ed Tanous0fdddb12017-02-28 11:06:34 -0800287}
288
Ed Tanous1abe55e2018-09-05 08:30:59 -0700289inline void ensureOpensslKeyPresentAndValid(const std::string &filepath)
290{
291 bool pemFileValid = false;
Ed Tanous0fdddb12017-02-28 11:06:34 -0800292
Ed Tanous1abe55e2018-09-05 08:30:59 -0700293 pemFileValid = verifyOpensslKeyCert(filepath);
Ed Tanous1ccd57c2017-03-21 13:15:58 -0700294
Ed Tanous1abe55e2018-09-05 08:30:59 -0700295 if (!pemFileValid)
296 {
297 std::cerr << "Error in verifying signature, regenerating\n";
298 generateSslCertificate(filepath);
299 }
Ed Tanous0fdddb12017-02-28 11:06:34 -0800300}
Ed Tanousc4771fb2017-03-13 13:39:49 -0700301
Marri Devender Rao5968cae2019-01-21 10:27:12 -0600302inline std::shared_ptr<boost::asio::ssl::context>
303 getSslContext(const std::string &ssl_pem_file)
Ed Tanous1abe55e2018-09-05 08:30:59 -0700304{
Marri Devender Rao5968cae2019-01-21 10:27:12 -0600305 std::shared_ptr<boost::asio::ssl::context> mSslContext =
306 std::make_shared<boost::asio::ssl::context>(
307 boost::asio::ssl::context::tls_server);
308 mSslContext->set_options(boost::asio::ssl::context::default_workarounds |
309 boost::asio::ssl::context::no_sslv2 |
310 boost::asio::ssl::context::no_sslv3 |
311 boost::asio::ssl::context::single_dh_use |
312 boost::asio::ssl::context::no_tlsv1 |
313 boost::asio::ssl::context::no_tlsv1_1);
Ed Tanousc4771fb2017-03-13 13:39:49 -0700314
Ed Tanous1abe55e2018-09-05 08:30:59 -0700315 // m_ssl_context.set_verify_mode(boost::asio::ssl::verify_peer);
Marri Devender Rao5968cae2019-01-21 10:27:12 -0600316 mSslContext->use_certificate_file(ssl_pem_file,
317 boost::asio::ssl::context::pem);
318 mSslContext->use_private_key_file(ssl_pem_file,
319 boost::asio::ssl::context::pem);
Ed Tanousc4771fb2017-03-13 13:39:49 -0700320
Ed Tanous1abe55e2018-09-05 08:30:59 -0700321 // Set up EC curves to auto (boost asio doesn't have a method for this)
322 // There is a pull request to add this. Once this is included in an asio
323 // drop, use the right way
324 // http://stackoverflow.com/questions/18929049/boost-asio-with-ecdsa-certificate-issue
Marri Devender Rao5968cae2019-01-21 10:27:12 -0600325 if (SSL_CTX_set_ecdh_auto(mSslContext->native_handle(), 1) != 1)
Ed Tanous1abe55e2018-09-05 08:30:59 -0700326 {
327 BMCWEB_LOG_ERROR << "Error setting tmp ecdh list\n";
328 }
Ed Tanousc4771fb2017-03-13 13:39:49 -0700329
Ed Tanous457207f2019-02-07 15:27:14 -0800330 std::string mozillaModern = "ECDHE-ECDSA-AES256-GCM-SHA384:"
331 "ECDHE-RSA-AES256-GCM-SHA384:"
332 "ECDHE-ECDSA-CHACHA20-POLY1305:"
333 "ECDHE-RSA-CHACHA20-POLY1305:"
334 "ECDHE-ECDSA-AES128-GCM-SHA256:"
335 "ECDHE-RSA-AES128-GCM-SHA256:"
336 "ECDHE-ECDSA-AES256-SHA384:"
337 "ECDHE-RSA-AES256-SHA384:"
338 "ECDHE-ECDSA-AES128-SHA256:"
339 "ECDHE-RSA-AES128-SHA256";
Ed Tanousc4771fb2017-03-13 13:39:49 -0700340
Marri Devender Rao5968cae2019-01-21 10:27:12 -0600341 if (SSL_CTX_set_cipher_list(mSslContext->native_handle(),
Ed Tanous457207f2019-02-07 15:27:14 -0800342 mozillaModern.c_str()) != 1)
Ed Tanous1abe55e2018-09-05 08:30:59 -0700343 {
344 BMCWEB_LOG_ERROR << "Error setting cipher list\n";
345 }
346 return mSslContext;
Ed Tanousc4771fb2017-03-13 13:39:49 -0700347}
Ed Tanous1abe55e2018-09-05 08:30:59 -0700348} // namespace ensuressl
Ed Tanous01250f22017-04-18 17:49:51 -0700349
Brad Bishop85d2bb52019-04-05 08:31:14 -0400350#endif