Ed Tanous | 0fdddb1 | 2017-02-28 11:06:34 -0800 | [diff] [blame] | 1 | #pragma once |
| 2 | |
Ed Tanous | 62598e3 | 2023-07-17 17:06:25 -0700 | [diff] [blame] | 3 | #include "bmcweb_config.h" |
| 4 | |
Ed Tanous | 3ccb3ad | 2023-01-13 17:40:03 -0800 | [diff] [blame] | 5 | #include "logging.hpp" |
Ed Tanous | 2c6ffdb | 2023-06-28 11:28:38 -0700 | [diff] [blame] | 6 | #include "ossl_random.hpp" |
Ed Tanous | 3ccb3ad | 2023-01-13 17:40:03 -0800 | [diff] [blame] | 7 | |
Ed Tanous | 099225c | 2024-03-27 22:03:05 -0700 | [diff] [blame^] | 8 | #include <boost/beast/core/file_posix.hpp> |
| 9 | |
Ed Tanous | fca2cbe | 2021-01-28 14:49:59 -0800 | [diff] [blame] | 10 | extern "C" |
| 11 | { |
| 12 | #include <nghttp2/nghttp2.h> |
Ed Tanous | 0fdddb1 | 2017-02-28 11:06:34 -0800 | [diff] [blame] | 13 | #include <openssl/bio.h> |
| 14 | #include <openssl/dh.h> |
| 15 | #include <openssl/dsa.h> |
Ed Tanous | 0fdddb1 | 2017-02-28 11:06:34 -0800 | [diff] [blame] | 16 | #include <openssl/err.h> |
| 17 | #include <openssl/evp.h> |
| 18 | #include <openssl/pem.h> |
| 19 | #include <openssl/rand.h> |
| 20 | #include <openssl/rsa.h> |
| 21 | #include <openssl/ssl.h> |
Ed Tanous | 6dbe9be | 2024-04-14 10:24:20 -0700 | [diff] [blame] | 22 | } |
Ed Tanous | 9b65f1f | 2017-03-07 15:17:13 -0800 | [diff] [blame] | 23 | |
Ed Tanous | 3112a14 | 2018-11-29 15:45:10 -0800 | [diff] [blame] | 24 | #include <boost/asio/ssl/context.hpp> |
Ed Tanous | 099225c | 2024-03-27 22:03:05 -0700 | [diff] [blame^] | 25 | #include <boost/system/error_code.hpp> |
Gunnar Mills | 1214b7e | 2020-06-04 10:11:30 -0500 | [diff] [blame] | 26 | |
Ed Tanous | 3ccb3ad | 2023-01-13 17:40:03 -0800 | [diff] [blame] | 27 | #include <optional> |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 28 | #include <random> |
Ed Tanous | 3ccb3ad | 2023-01-13 17:40:03 -0800 | [diff] [blame] | 29 | #include <string> |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 30 | |
| 31 | namespace ensuressl |
| 32 | { |
Patrick Williams | 89492a1 | 2023-05-10 07:51:34 -0500 | [diff] [blame] | 33 | constexpr const char* trustStorePath = "/etc/ssl/certs/authority"; |
| 34 | constexpr const char* x509Comment = "Generated from OpenBMC service"; |
Ed Tanous | 55c7b7a | 2018-05-22 15:27:24 -0700 | [diff] [blame] | 35 | static void initOpenssl(); |
Gunnar Mills | 1214b7e | 2020-06-04 10:11:30 -0500 | [diff] [blame] | 36 | static EVP_PKEY* createEcKey(); |
Ed Tanous | 0fdddb1 | 2017-02-28 11:06:34 -0800 | [diff] [blame] | 37 | |
Ramesh Iyyar | 082f28f | 2019-06-22 03:31:55 -0500 | [diff] [blame] | 38 | // Trust chain related errors.` |
| 39 | inline bool isTrustChainError(int errnum) |
| 40 | { |
Ed Tanous | 55f79e6 | 2022-01-25 11:26:16 -0800 | [diff] [blame] | 41 | return (errnum == X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT) || |
| 42 | (errnum == X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN) || |
| 43 | (errnum == X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY) || |
| 44 | (errnum == X509_V_ERR_CERT_UNTRUSTED) || |
| 45 | (errnum == X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE); |
Ramesh Iyyar | 082f28f | 2019-06-22 03:31:55 -0500 | [diff] [blame] | 46 | } |
| 47 | |
Gunnar Mills | 1214b7e | 2020-06-04 10:11:30 -0500 | [diff] [blame] | 48 | inline bool validateCertificate(X509* const cert) |
Ramesh Iyyar | 082f28f | 2019-06-22 03:31:55 -0500 | [diff] [blame] | 49 | { |
| 50 | // Create an empty X509_STORE structure for certificate validation. |
Gunnar Mills | 1214b7e | 2020-06-04 10:11:30 -0500 | [diff] [blame] | 51 | X509_STORE* x509Store = X509_STORE_new(); |
Ed Tanous | e662eae | 2022-01-25 10:39:19 -0800 | [diff] [blame] | 52 | if (x509Store == nullptr) |
Ramesh Iyyar | 082f28f | 2019-06-22 03:31:55 -0500 | [diff] [blame] | 53 | { |
Ed Tanous | 62598e3 | 2023-07-17 17:06:25 -0700 | [diff] [blame] | 54 | BMCWEB_LOG_ERROR("Error occurred during X509_STORE_new call"); |
Ramesh Iyyar | 082f28f | 2019-06-22 03:31:55 -0500 | [diff] [blame] | 55 | return false; |
| 56 | } |
| 57 | |
| 58 | // Load Certificate file into the X509 structure. |
Gunnar Mills | 1214b7e | 2020-06-04 10:11:30 -0500 | [diff] [blame] | 59 | X509_STORE_CTX* storeCtx = X509_STORE_CTX_new(); |
Ed Tanous | e662eae | 2022-01-25 10:39:19 -0800 | [diff] [blame] | 60 | if (storeCtx == nullptr) |
Ramesh Iyyar | 082f28f | 2019-06-22 03:31:55 -0500 | [diff] [blame] | 61 | { |
Ed Tanous | 62598e3 | 2023-07-17 17:06:25 -0700 | [diff] [blame] | 62 | BMCWEB_LOG_ERROR("Error occurred during X509_STORE_CTX_new call"); |
Ramesh Iyyar | 082f28f | 2019-06-22 03:31:55 -0500 | [diff] [blame] | 63 | X509_STORE_free(x509Store); |
| 64 | return false; |
| 65 | } |
| 66 | |
Ed Tanous | 99131cd | 2019-10-24 11:12:47 -0700 | [diff] [blame] | 67 | int errCode = X509_STORE_CTX_init(storeCtx, x509Store, cert, nullptr); |
Ramesh Iyyar | 082f28f | 2019-06-22 03:31:55 -0500 | [diff] [blame] | 68 | if (errCode != 1) |
| 69 | { |
Ed Tanous | 62598e3 | 2023-07-17 17:06:25 -0700 | [diff] [blame] | 70 | BMCWEB_LOG_ERROR("Error occurred during X509_STORE_CTX_init call"); |
Ramesh Iyyar | 082f28f | 2019-06-22 03:31:55 -0500 | [diff] [blame] | 71 | X509_STORE_CTX_free(storeCtx); |
| 72 | X509_STORE_free(x509Store); |
| 73 | return false; |
| 74 | } |
| 75 | |
| 76 | errCode = X509_verify_cert(storeCtx); |
| 77 | if (errCode == 1) |
| 78 | { |
Ed Tanous | 62598e3 | 2023-07-17 17:06:25 -0700 | [diff] [blame] | 79 | BMCWEB_LOG_INFO("Certificate verification is success"); |
Ramesh Iyyar | 082f28f | 2019-06-22 03:31:55 -0500 | [diff] [blame] | 80 | X509_STORE_CTX_free(storeCtx); |
| 81 | X509_STORE_free(x509Store); |
| 82 | return true; |
| 83 | } |
| 84 | if (errCode == 0) |
| 85 | { |
| 86 | errCode = X509_STORE_CTX_get_error(storeCtx); |
| 87 | X509_STORE_CTX_free(storeCtx); |
| 88 | X509_STORE_free(x509Store); |
| 89 | if (isTrustChainError(errCode)) |
| 90 | { |
Ed Tanous | 62598e3 | 2023-07-17 17:06:25 -0700 | [diff] [blame] | 91 | BMCWEB_LOG_DEBUG("Ignoring Trust Chain error. Reason: {}", |
| 92 | X509_verify_cert_error_string(errCode)); |
Ramesh Iyyar | 082f28f | 2019-06-22 03:31:55 -0500 | [diff] [blame] | 93 | return true; |
| 94 | } |
Ed Tanous | 62598e3 | 2023-07-17 17:06:25 -0700 | [diff] [blame] | 95 | BMCWEB_LOG_ERROR("Certificate verification failed. Reason: {}", |
| 96 | X509_verify_cert_error_string(errCode)); |
Ed Tanous | 3174e4d | 2020-10-07 11:41:22 -0700 | [diff] [blame] | 97 | return false; |
Ramesh Iyyar | 082f28f | 2019-06-22 03:31:55 -0500 | [diff] [blame] | 98 | } |
| 99 | |
Ed Tanous | 62598e3 | 2023-07-17 17:06:25 -0700 | [diff] [blame] | 100 | BMCWEB_LOG_ERROR( |
| 101 | "Error occurred during X509_verify_cert call. ErrorCode: {}", errCode); |
Ramesh Iyyar | 082f28f | 2019-06-22 03:31:55 -0500 | [diff] [blame] | 102 | X509_STORE_CTX_free(storeCtx); |
| 103 | X509_STORE_free(x509Store); |
| 104 | return false; |
| 105 | } |
| 106 | |
Ed Tanous | 099225c | 2024-03-27 22:03:05 -0700 | [diff] [blame^] | 107 | inline std::string verifyOpensslKeyCert(const std::string& filepath) |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 108 | { |
| 109 | bool privateKeyValid = false; |
Ed Tanous | 9b65f1f | 2017-03-07 15:17:13 -0800 | [diff] [blame] | 110 | |
Ed Tanous | c160ae7 | 2024-03-27 18:45:20 -0700 | [diff] [blame] | 111 | BMCWEB_LOG_INFO("Checking certs in file {}", filepath); |
Ed Tanous | 099225c | 2024-03-27 22:03:05 -0700 | [diff] [blame^] | 112 | boost::beast::file_posix file; |
| 113 | boost::system::error_code ec; |
| 114 | file.open(filepath.c_str(), boost::beast::file_mode::read, ec); |
| 115 | if (ec) |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 116 | { |
Ed Tanous | 099225c | 2024-03-27 22:03:05 -0700 | [diff] [blame^] | 117 | return ""; |
| 118 | } |
| 119 | bool certValid = false; |
| 120 | std::string fileContents; |
| 121 | fileContents.resize(static_cast<size_t>(file.size(ec)), '\0'); |
| 122 | file.read(fileContents.data(), fileContents.size(), ec); |
| 123 | if (ec) |
| 124 | { |
| 125 | BMCWEB_LOG_ERROR("Failed to read file"); |
| 126 | return ""; |
| 127 | } |
Patrick Williams | 145bb76 | 2021-12-07 21:05:04 -0600 | [diff] [blame] | 128 | |
Ed Tanous | 099225c | 2024-03-27 22:03:05 -0700 | [diff] [blame^] | 129 | BIO* bufio = BIO_new_mem_buf(static_cast<void*>(fileContents.data()), |
| 130 | static_cast<int>(fileContents.size())); |
| 131 | EVP_PKEY* pkey = PEM_read_bio_PrivateKey(bufio, nullptr, nullptr, nullptr); |
| 132 | BIO_free(bufio); |
| 133 | if (pkey != nullptr) |
| 134 | { |
| 135 | #if (OPENSSL_VERSION_NUMBER < 0x30000000L) |
| 136 | RSA* rsa = EVP_PKEY_get1_RSA(pkey); |
| 137 | if (rsa != nullptr) |
| 138 | { |
| 139 | BMCWEB_LOG_INFO("Found an RSA key"); |
| 140 | if (RSA_check_key(rsa) == 1) |
Patrick Williams | 145bb76 | 2021-12-07 21:05:04 -0600 | [diff] [blame] | 141 | { |
| 142 | privateKeyValid = true; |
| 143 | } |
| 144 | else |
| 145 | { |
Ed Tanous | c160ae7 | 2024-03-27 18:45:20 -0700 | [diff] [blame] | 146 | BMCWEB_LOG_ERROR("Key not valid error number {}", |
| 147 | ERR_get_error()); |
Patrick Williams | 145bb76 | 2021-12-07 21:05:04 -0600 | [diff] [blame] | 148 | } |
Ed Tanous | 099225c | 2024-03-27 22:03:05 -0700 | [diff] [blame^] | 149 | RSA_free(rsa); |
| 150 | } |
| 151 | else |
| 152 | { |
| 153 | EC_KEY* ec = EVP_PKEY_get1_EC_KEY(pkey); |
| 154 | if (ec != nullptr) |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 155 | { |
Ed Tanous | 099225c | 2024-03-27 22:03:05 -0700 | [diff] [blame^] | 156 | BMCWEB_LOG_INFO("Found an EC key"); |
| 157 | if (EC_KEY_check_key(ec) == 1) |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 158 | { |
Ed Tanous | 099225c | 2024-03-27 22:03:05 -0700 | [diff] [blame^] | 159 | privateKeyValid = true; |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 160 | } |
| 161 | else |
| 162 | { |
Ed Tanous | 099225c | 2024-03-27 22:03:05 -0700 | [diff] [blame^] | 163 | BMCWEB_LOG_ERROR("Key not valid error number {}", |
| 164 | ERR_get_error()); |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 165 | } |
Ed Tanous | 099225c | 2024-03-27 22:03:05 -0700 | [diff] [blame^] | 166 | EC_KEY_free(ec); |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 167 | } |
Ed Tanous | 099225c | 2024-03-27 22:03:05 -0700 | [diff] [blame^] | 168 | } |
| 169 | #else |
| 170 | EVP_PKEY_CTX* pkeyCtx = EVP_PKEY_CTX_new_from_pkey(nullptr, pkey, |
| 171 | nullptr); |
| 172 | |
| 173 | if (pkeyCtx == nullptr) |
| 174 | { |
| 175 | BMCWEB_LOG_ERROR("Unable to allocate pkeyCtx {}", ERR_get_error()); |
| 176 | } |
| 177 | else if (EVP_PKEY_check(pkeyCtx) == 1) |
| 178 | { |
| 179 | privateKeyValid = true; |
| 180 | } |
| 181 | else |
| 182 | { |
| 183 | BMCWEB_LOG_ERROR("Key not valid error number {}", ERR_get_error()); |
| 184 | } |
| 185 | #endif |
| 186 | |
| 187 | if (privateKeyValid) |
| 188 | { |
| 189 | BIO* bufio2 = |
| 190 | BIO_new_mem_buf(static_cast<void*>(fileContents.data()), |
| 191 | static_cast<int>(fileContents.size())); |
| 192 | X509* x509 = PEM_read_bio_X509(bufio2, nullptr, nullptr, nullptr); |
| 193 | BIO_free(bufio2); |
| 194 | if (x509 == nullptr) |
| 195 | { |
| 196 | BMCWEB_LOG_ERROR("error getting x509 cert {}", ERR_get_error()); |
| 197 | } |
| 198 | else |
| 199 | { |
| 200 | certValid = validateCertificate(x509); |
| 201 | X509_free(x509); |
| 202 | } |
| 203 | } |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 204 | |
Patrick Williams | 145bb76 | 2021-12-07 21:05:04 -0600 | [diff] [blame] | 205 | #if (OPENSSL_VERSION_NUMBER > 0x30000000L) |
Ed Tanous | 099225c | 2024-03-27 22:03:05 -0700 | [diff] [blame^] | 206 | EVP_PKEY_CTX_free(pkeyCtx); |
Patrick Williams | 145bb76 | 2021-12-07 21:05:04 -0600 | [diff] [blame] | 207 | #endif |
Ed Tanous | 099225c | 2024-03-27 22:03:05 -0700 | [diff] [blame^] | 208 | EVP_PKEY_free(pkey); |
Ed Tanous | 0fdddb1 | 2017-02-28 11:06:34 -0800 | [diff] [blame] | 209 | } |
Ed Tanous | 099225c | 2024-03-27 22:03:05 -0700 | [diff] [blame^] | 210 | if (!certValid) |
| 211 | { |
| 212 | return ""; |
| 213 | } |
| 214 | return fileContents; |
Ed Tanous | 0fdddb1 | 2017-02-28 11:06:34 -0800 | [diff] [blame] | 215 | } |
| 216 | |
Alan Kuo | a822070 | 2020-11-26 11:15:29 +0800 | [diff] [blame] | 217 | inline X509* loadCert(const std::string& filePath) |
| 218 | { |
| 219 | BIO* certFileBio = BIO_new_file(filePath.c_str(), "rb"); |
Ed Tanous | e662eae | 2022-01-25 10:39:19 -0800 | [diff] [blame] | 220 | if (certFileBio == nullptr) |
Alan Kuo | a822070 | 2020-11-26 11:15:29 +0800 | [diff] [blame] | 221 | { |
Ed Tanous | 8ece0e4 | 2024-01-02 13:16:50 -0800 | [diff] [blame] | 222 | BMCWEB_LOG_ERROR("Error occurred during BIO_new_file call, FILE= {}", |
Ed Tanous | 62598e3 | 2023-07-17 17:06:25 -0700 | [diff] [blame] | 223 | filePath); |
Alan Kuo | a822070 | 2020-11-26 11:15:29 +0800 | [diff] [blame] | 224 | return nullptr; |
| 225 | } |
| 226 | |
| 227 | X509* cert = X509_new(); |
Ed Tanous | e662eae | 2022-01-25 10:39:19 -0800 | [diff] [blame] | 228 | if (cert == nullptr) |
Alan Kuo | a822070 | 2020-11-26 11:15:29 +0800 | [diff] [blame] | 229 | { |
Ed Tanous | 8ece0e4 | 2024-01-02 13:16:50 -0800 | [diff] [blame] | 230 | BMCWEB_LOG_ERROR("Error occurred during X509_new call, {}", |
Ed Tanous | 62598e3 | 2023-07-17 17:06:25 -0700 | [diff] [blame] | 231 | ERR_get_error()); |
Alan Kuo | a822070 | 2020-11-26 11:15:29 +0800 | [diff] [blame] | 232 | BIO_free(certFileBio); |
| 233 | return nullptr; |
| 234 | } |
| 235 | |
Ed Tanous | e662eae | 2022-01-25 10:39:19 -0800 | [diff] [blame] | 236 | if (PEM_read_bio_X509(certFileBio, &cert, nullptr, nullptr) == nullptr) |
Alan Kuo | a822070 | 2020-11-26 11:15:29 +0800 | [diff] [blame] | 237 | { |
Ed Tanous | 62598e3 | 2023-07-17 17:06:25 -0700 | [diff] [blame] | 238 | BMCWEB_LOG_ERROR( |
Ed Tanous | 8ece0e4 | 2024-01-02 13:16:50 -0800 | [diff] [blame] | 239 | "Error occurred during PEM_read_bio_X509 call, FILE= {}", filePath); |
Alan Kuo | a822070 | 2020-11-26 11:15:29 +0800 | [diff] [blame] | 240 | |
| 241 | BIO_free(certFileBio); |
| 242 | X509_free(cert); |
| 243 | return nullptr; |
| 244 | } |
Alan Kuo | b295bf9 | 2021-04-16 14:16:47 +0800 | [diff] [blame] | 245 | BIO_free(certFileBio); |
Alan Kuo | a822070 | 2020-11-26 11:15:29 +0800 | [diff] [blame] | 246 | return cert; |
| 247 | } |
| 248 | |
| 249 | inline int addExt(X509* cert, int nid, const char* value) |
| 250 | { |
| 251 | X509_EXTENSION* ex = nullptr; |
Ed Tanous | b00dcc2 | 2021-02-23 12:52:50 -0800 | [diff] [blame] | 252 | X509V3_CTX ctx{}; |
Alan Kuo | a822070 | 2020-11-26 11:15:29 +0800 | [diff] [blame] | 253 | X509V3_set_ctx(&ctx, cert, cert, nullptr, nullptr, 0); |
Ed Tanous | 4ecc618 | 2022-01-07 09:36:26 -0800 | [diff] [blame] | 254 | |
| 255 | // NOLINTNEXTLINE(cppcoreguidelines-pro-type-const-cast) |
Alan Kuo | a822070 | 2020-11-26 11:15:29 +0800 | [diff] [blame] | 256 | ex = X509V3_EXT_conf_nid(nullptr, &ctx, nid, const_cast<char*>(value)); |
Ed Tanous | e662eae | 2022-01-25 10:39:19 -0800 | [diff] [blame] | 257 | if (ex == nullptr) |
Alan Kuo | a822070 | 2020-11-26 11:15:29 +0800 | [diff] [blame] | 258 | { |
Ed Tanous | 62598e3 | 2023-07-17 17:06:25 -0700 | [diff] [blame] | 259 | BMCWEB_LOG_ERROR("Error: In X509V3_EXT_conf_nidn: {}", value); |
Alan Kuo | a822070 | 2020-11-26 11:15:29 +0800 | [diff] [blame] | 260 | return -1; |
| 261 | } |
| 262 | X509_add_ext(cert, ex, -1); |
| 263 | X509_EXTENSION_free(ex); |
| 264 | return 0; |
| 265 | } |
| 266 | |
Ed Tanous | 099225c | 2024-03-27 22:03:05 -0700 | [diff] [blame^] | 267 | // Writes a certificate to a path, ignoring errors |
| 268 | inline void writeCertificateToFile(const std::string& filepath, |
| 269 | const std::string& certificate) |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 270 | { |
Ed Tanous | 099225c | 2024-03-27 22:03:05 -0700 | [diff] [blame^] | 271 | boost::system::error_code ec; |
| 272 | boost::beast::file_posix file; |
| 273 | file.open(filepath.c_str(), boost::beast::file_mode::write, ec); |
| 274 | if (!ec) |
| 275 | { |
| 276 | file.write(certificate.data(), certificate.size(), ec); |
| 277 | // ignore result |
| 278 | } |
| 279 | } |
| 280 | |
| 281 | inline std::string generateSslCertificate(const std::string& cn) |
| 282 | { |
Ed Tanous | c160ae7 | 2024-03-27 18:45:20 -0700 | [diff] [blame] | 283 | BMCWEB_LOG_INFO("Generating new keys"); |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 284 | initOpenssl(); |
Ed Tanous | 0fdddb1 | 2017-02-28 11:06:34 -0800 | [diff] [blame] | 285 | |
Ed Tanous | 099225c | 2024-03-27 22:03:05 -0700 | [diff] [blame^] | 286 | std::string buffer; |
Ed Tanous | c160ae7 | 2024-03-27 18:45:20 -0700 | [diff] [blame] | 287 | BMCWEB_LOG_INFO("Generating EC key"); |
Gunnar Mills | 1214b7e | 2020-06-04 10:11:30 -0500 | [diff] [blame] | 288 | EVP_PKEY* pPrivKey = createEcKey(); |
Vernon Mauery | 0185c7f | 2020-03-09 10:56:53 -0700 | [diff] [blame] | 289 | if (pPrivKey != nullptr) |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 290 | { |
Ed Tanous | c160ae7 | 2024-03-27 18:45:20 -0700 | [diff] [blame] | 291 | BMCWEB_LOG_INFO("Generating x509 Certificates"); |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 292 | // Use this code to directly generate a certificate |
Ed Tanous | 543f440 | 2022-01-06 13:12:53 -0800 | [diff] [blame] | 293 | X509* x509 = X509_new(); |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 294 | if (x509 != nullptr) |
| 295 | { |
| 296 | // get a random number from the RNG for the certificate serial |
Ed Tanous | 8ece0e4 | 2024-01-02 13:16:50 -0800 | [diff] [blame] | 297 | // number If this is not random, regenerating certs throws browser |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 298 | // errors |
Alan Kuo | a822070 | 2020-11-26 11:15:29 +0800 | [diff] [blame] | 299 | bmcweb::OpenSSLGenerator gen; |
| 300 | std::uniform_int_distribution<int> dis( |
| 301 | 1, std::numeric_limits<int>::max()); |
| 302 | int serial = dis(gen); |
Ed Tanous | 9b65f1f | 2017-03-07 15:17:13 -0800 | [diff] [blame] | 303 | |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 304 | ASN1_INTEGER_set(X509_get_serialNumber(x509), serial); |
Ed Tanous | 9b65f1f | 2017-03-07 15:17:13 -0800 | [diff] [blame] | 305 | |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 306 | // not before this moment |
| 307 | X509_gmtime_adj(X509_get_notBefore(x509), 0); |
| 308 | // Cert is valid for 10 years |
| 309 | X509_gmtime_adj(X509_get_notAfter(x509), |
| 310 | 60L * 60L * 24L * 365L * 10L); |
Ed Tanous | 9b65f1f | 2017-03-07 15:17:13 -0800 | [diff] [blame] | 311 | |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 312 | // set the public key to the key we just generated |
Vernon Mauery | 0185c7f | 2020-03-09 10:56:53 -0700 | [diff] [blame] | 313 | X509_set_pubkey(x509, pPrivKey); |
Ed Tanous | 0fdddb1 | 2017-02-28 11:06:34 -0800 | [diff] [blame] | 314 | |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 315 | // get the subject name |
Ed Tanous | 543f440 | 2022-01-06 13:12:53 -0800 | [diff] [blame] | 316 | X509_NAME* name = X509_get_subject_name(x509); |
Ed Tanous | 0fdddb1 | 2017-02-28 11:06:34 -0800 | [diff] [blame] | 317 | |
Ed Tanous | 46ff87b | 2022-01-07 09:25:51 -0800 | [diff] [blame] | 318 | using x509String = const unsigned char; |
| 319 | // NOLINTNEXTLINE(cppcoreguidelines-pro-type-reinterpret-cast) |
| 320 | x509String* country = reinterpret_cast<x509String*>("US"); |
| 321 | // NOLINTNEXTLINE(cppcoreguidelines-pro-type-reinterpret-cast) |
| 322 | x509String* company = reinterpret_cast<x509String*>("OpenBMC"); |
| 323 | // NOLINTNEXTLINE(cppcoreguidelines-pro-type-reinterpret-cast) |
| 324 | x509String* cnStr = reinterpret_cast<x509String*>(cn.c_str()); |
| 325 | |
| 326 | X509_NAME_add_entry_by_txt(name, "C", MBSTRING_ASC, country, -1, -1, |
| 327 | 0); |
| 328 | X509_NAME_add_entry_by_txt(name, "O", MBSTRING_ASC, company, -1, -1, |
| 329 | 0); |
| 330 | X509_NAME_add_entry_by_txt(name, "CN", MBSTRING_ASC, cnStr, -1, -1, |
| 331 | 0); |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 332 | // set the CSR options |
| 333 | X509_set_issuer_name(x509, name); |
Ed Tanous | 0fdddb1 | 2017-02-28 11:06:34 -0800 | [diff] [blame] | 334 | |
Alan Kuo | a822070 | 2020-11-26 11:15:29 +0800 | [diff] [blame] | 335 | X509_set_version(x509, 2); |
| 336 | addExt(x509, NID_basic_constraints, ("critical,CA:TRUE")); |
| 337 | addExt(x509, NID_subject_alt_name, ("DNS:" + cn).c_str()); |
| 338 | addExt(x509, NID_subject_key_identifier, ("hash")); |
| 339 | addExt(x509, NID_authority_key_identifier, ("keyid")); |
| 340 | addExt(x509, NID_key_usage, ("digitalSignature, keyEncipherment")); |
| 341 | addExt(x509, NID_ext_key_usage, ("serverAuth")); |
| 342 | addExt(x509, NID_netscape_comment, (x509Comment)); |
| 343 | |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 344 | // Sign the certificate with our private key |
Vernon Mauery | 0185c7f | 2020-03-09 10:56:53 -0700 | [diff] [blame] | 345 | X509_sign(x509, pPrivKey, EVP_sha256()); |
Ed Tanous | 0fdddb1 | 2017-02-28 11:06:34 -0800 | [diff] [blame] | 346 | |
Ed Tanous | 099225c | 2024-03-27 22:03:05 -0700 | [diff] [blame^] | 347 | BIO* bufio = BIO_new(BIO_s_mem()); |
Ed Tanous | 0fdddb1 | 2017-02-28 11:06:34 -0800 | [diff] [blame] | 348 | |
Ed Tanous | 099225c | 2024-03-27 22:03:05 -0700 | [diff] [blame^] | 349 | int pkeyRet = PEM_write_bio_PrivateKey( |
| 350 | bufio, pPrivKey, nullptr, nullptr, 0, nullptr, nullptr); |
| 351 | if (pkeyRet <= 0) |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 352 | { |
Ed Tanous | 099225c | 2024-03-27 22:03:05 -0700 | [diff] [blame^] | 353 | BMCWEB_LOG_ERROR( |
| 354 | "Failed to write pkey with code {}. Ignoring.", pkeyRet); |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 355 | } |
Ed Tanous | 0fdddb1 | 2017-02-28 11:06:34 -0800 | [diff] [blame] | 356 | |
Ed Tanous | 099225c | 2024-03-27 22:03:05 -0700 | [diff] [blame^] | 357 | char* data = nullptr; |
| 358 | long int dataLen = BIO_get_mem_data(bufio, &data); |
| 359 | buffer += std::string_view(data, static_cast<size_t>(dataLen)); |
| 360 | BIO_free(bufio); |
| 361 | |
| 362 | bufio = BIO_new(BIO_s_mem()); |
| 363 | pkeyRet = PEM_write_bio_X509(bufio, x509); |
| 364 | if (pkeyRet <= 0) |
| 365 | { |
| 366 | BMCWEB_LOG_ERROR( |
| 367 | "Failed to write X509 with code {}. Ignoring.", pkeyRet); |
| 368 | } |
| 369 | dataLen = BIO_get_mem_data(bufio, &data); |
| 370 | buffer += std::string_view(data, static_cast<size_t>(dataLen)); |
| 371 | |
| 372 | BIO_free(bufio); |
| 373 | BMCWEB_LOG_INFO("Cert size is {}", buffer.size()); |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 374 | X509_free(x509); |
| 375 | } |
| 376 | |
Vernon Mauery | 0185c7f | 2020-03-09 10:56:53 -0700 | [diff] [blame] | 377 | EVP_PKEY_free(pPrivKey); |
| 378 | pPrivKey = nullptr; |
Ed Tanous | 0fdddb1 | 2017-02-28 11:06:34 -0800 | [diff] [blame] | 379 | } |
| 380 | |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 381 | // cleanup_openssl(); |
Ed Tanous | 099225c | 2024-03-27 22:03:05 -0700 | [diff] [blame^] | 382 | return buffer; |
Ed Tanous | 9992332 | 2017-03-03 14:21:24 -0800 | [diff] [blame] | 383 | } |
Ed Tanous | b01bf29 | 2019-03-25 19:25:26 +0000 | [diff] [blame] | 384 | |
Gunnar Mills | 1214b7e | 2020-06-04 10:11:30 -0500 | [diff] [blame] | 385 | EVP_PKEY* createEcKey() |
Ed Tanous | b01bf29 | 2019-03-25 19:25:26 +0000 | [diff] [blame] | 386 | { |
Gunnar Mills | 1214b7e | 2020-06-04 10:11:30 -0500 | [diff] [blame] | 387 | EVP_PKEY* pKey = nullptr; |
Patrick Williams | aec7066 | 2021-12-13 16:55:46 -0600 | [diff] [blame] | 388 | |
| 389 | #if (OPENSSL_VERSION_NUMBER < 0x30000000L) |
Ed Tanous | b01bf29 | 2019-03-25 19:25:26 +0000 | [diff] [blame] | 390 | int eccgrp = 0; |
Vernon Mauery | aaf3206 | 2020-03-09 10:41:31 -0700 | [diff] [blame] | 391 | eccgrp = OBJ_txt2nid("secp384r1"); |
Ed Tanous | 6ea007a | 2019-02-13 22:48:25 -0800 | [diff] [blame] | 392 | |
Gunnar Mills | 1214b7e | 2020-06-04 10:11:30 -0500 | [diff] [blame] | 393 | EC_KEY* myecc = EC_KEY_new_by_curve_name(eccgrp); |
Ed Tanous | b01bf29 | 2019-03-25 19:25:26 +0000 | [diff] [blame] | 394 | if (myecc != nullptr) |
Ed Tanous | 6ea007a | 2019-02-13 22:48:25 -0800 | [diff] [blame] | 395 | { |
Ed Tanous | b01bf29 | 2019-03-25 19:25:26 +0000 | [diff] [blame] | 396 | EC_KEY_set_asn1_flag(myecc, OPENSSL_EC_NAMED_CURVE); |
| 397 | EC_KEY_generate_key(myecc); |
| 398 | pKey = EVP_PKEY_new(); |
| 399 | if (pKey != nullptr) |
| 400 | { |
Szymon Dompke | a327dc5 | 2022-03-01 14:04:14 +0100 | [diff] [blame] | 401 | if (EVP_PKEY_assign(pKey, EVP_PKEY_EC, myecc) != 0) |
Ed Tanous | b01bf29 | 2019-03-25 19:25:26 +0000 | [diff] [blame] | 402 | { |
Vernon Mauery | 0185c7f | 2020-03-09 10:56:53 -0700 | [diff] [blame] | 403 | /* pKey owns myecc from now */ |
Ed Tanous | b01bf29 | 2019-03-25 19:25:26 +0000 | [diff] [blame] | 404 | if (EC_KEY_check_key(myecc) <= 0) |
| 405 | { |
Ed Tanous | c160ae7 | 2024-03-27 18:45:20 -0700 | [diff] [blame] | 406 | BMCWEB_LOG_ERROR("EC_check_key failed."); |
Ed Tanous | b01bf29 | 2019-03-25 19:25:26 +0000 | [diff] [blame] | 407 | } |
| 408 | } |
| 409 | } |
Ed Tanous | 6ea007a | 2019-02-13 22:48:25 -0800 | [diff] [blame] | 410 | } |
Patrick Williams | aec7066 | 2021-12-13 16:55:46 -0600 | [diff] [blame] | 411 | #else |
| 412 | // Create context for curve parameter generation. |
| 413 | std::unique_ptr<EVP_PKEY_CTX, decltype(&::EVP_PKEY_CTX_free)> ctx{ |
| 414 | EVP_PKEY_CTX_new_id(EVP_PKEY_EC, nullptr), &::EVP_PKEY_CTX_free}; |
| 415 | if (!ctx) |
| 416 | { |
| 417 | return nullptr; |
| 418 | } |
| 419 | |
| 420 | // Set up curve parameters. |
| 421 | EVP_PKEY* params = nullptr; |
| 422 | if ((EVP_PKEY_paramgen_init(ctx.get()) <= 0) || |
| 423 | (EVP_PKEY_CTX_set_ec_param_enc(ctx.get(), OPENSSL_EC_NAMED_CURVE) <= |
| 424 | 0) || |
| 425 | (EVP_PKEY_CTX_set_ec_paramgen_curve_nid(ctx.get(), NID_secp384r1) <= |
| 426 | 0) || |
| 427 | (EVP_PKEY_paramgen(ctx.get(), ¶ms) <= 0)) |
| 428 | { |
| 429 | return nullptr; |
| 430 | } |
| 431 | |
| 432 | // Set up RAII holder for params. |
| 433 | std::unique_ptr<EVP_PKEY, decltype(&::EVP_PKEY_free)> pparams{ |
| 434 | params, &::EVP_PKEY_free}; |
| 435 | |
| 436 | // Set new context for key generation, using curve parameters. |
| 437 | ctx.reset(EVP_PKEY_CTX_new_from_pkey(nullptr, params, nullptr)); |
| 438 | if (!ctx || (EVP_PKEY_keygen_init(ctx.get()) <= 0)) |
| 439 | { |
| 440 | return nullptr; |
| 441 | } |
| 442 | |
| 443 | // Generate key. |
| 444 | if (EVP_PKEY_keygen(ctx.get(), &pKey) <= 0) |
| 445 | { |
| 446 | return nullptr; |
| 447 | } |
| 448 | #endif |
| 449 | |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 450 | return pKey; |
| 451 | } |
| 452 | |
| 453 | void initOpenssl() |
| 454 | { |
Ed Tanous | 911ac31 | 2017-08-15 09:37:42 -0700 | [diff] [blame] | 455 | #if OPENSSL_VERSION_NUMBER < 0x10100000L |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 456 | SSL_load_error_strings(); |
| 457 | OpenSSL_add_all_algorithms(); |
| 458 | RAND_load_file("/dev/urandom", 1024); |
Ed Tanous | a1e077c | 2017-04-25 12:42:19 -0700 | [diff] [blame] | 459 | #endif |
Ed Tanous | 0fdddb1 | 2017-02-28 11:06:34 -0800 | [diff] [blame] | 460 | } |
| 461 | |
Ed Tanous | 099225c | 2024-03-27 22:03:05 -0700 | [diff] [blame^] | 462 | inline std::string ensureOpensslKeyPresentAndValid(const std::string& filepath) |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 463 | { |
Ed Tanous | 099225c | 2024-03-27 22:03:05 -0700 | [diff] [blame^] | 464 | std::string cert = verifyOpensslKeyCert(filepath); |
Ed Tanous | 0fdddb1 | 2017-02-28 11:06:34 -0800 | [diff] [blame] | 465 | |
Ed Tanous | 099225c | 2024-03-27 22:03:05 -0700 | [diff] [blame^] | 466 | if (cert.empty()) |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 467 | { |
Ed Tanous | c160ae7 | 2024-03-27 18:45:20 -0700 | [diff] [blame] | 468 | BMCWEB_LOG_WARNING("Error in verifying signature, regenerating"); |
Ed Tanous | 099225c | 2024-03-27 22:03:05 -0700 | [diff] [blame^] | 469 | cert = generateSslCertificate("testhost"); |
| 470 | if (cert.empty()) |
| 471 | { |
| 472 | BMCWEB_LOG_ERROR("Failed to generate cert"); |
| 473 | } |
| 474 | else |
| 475 | { |
| 476 | writeCertificateToFile(filepath, cert); |
| 477 | } |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 478 | } |
Ed Tanous | 099225c | 2024-03-27 22:03:05 -0700 | [diff] [blame^] | 479 | return cert; |
Ed Tanous | 0fdddb1 | 2017-02-28 11:06:34 -0800 | [diff] [blame] | 480 | } |
Ed Tanous | c4771fb | 2017-03-13 13:39:49 -0700 | [diff] [blame] | 481 | |
Ed Tanous | fca2cbe | 2021-01-28 14:49:59 -0800 | [diff] [blame] | 482 | inline int nextProtoCallback(SSL* /*unused*/, const unsigned char** data, |
| 483 | unsigned int* len, void* /*unused*/) |
| 484 | { |
| 485 | // First byte is the length. |
| 486 | constexpr std::string_view h2 = "\x02h2"; |
| 487 | *data = std::bit_cast<const unsigned char*>(h2.data()); |
| 488 | *len = static_cast<unsigned int>(h2.size()); |
| 489 | return SSL_TLSEXT_ERR_OK; |
| 490 | } |
| 491 | |
| 492 | inline int alpnSelectProtoCallback(SSL* /*unused*/, const unsigned char** out, |
| 493 | unsigned char* outlen, |
| 494 | const unsigned char* in, unsigned int inlen, |
| 495 | void* /*unused*/) |
| 496 | { |
| 497 | // There's a mismatch in constness for nghttp2_select_next_protocol. The |
| 498 | // examples in nghttp2 don't show this problem. Unclear what the right fix |
| 499 | // is here. |
| 500 | |
| 501 | // NOLINTNEXTLINE(cppcoreguidelines-pro-type-const-cast) |
| 502 | unsigned char** outNew = const_cast<unsigned char**>(out); |
| 503 | int rv = nghttp2_select_next_protocol(outNew, outlen, in, inlen); |
| 504 | if (rv != 1) |
| 505 | { |
| 506 | return SSL_TLSEXT_ERR_NOACK; |
| 507 | } |
| 508 | |
| 509 | return SSL_TLSEXT_ERR_OK; |
| 510 | } |
| 511 | |
Marri Devender Rao | 5968cae | 2019-01-21 10:27:12 -0600 | [diff] [blame] | 512 | inline std::shared_ptr<boost::asio::ssl::context> |
Ed Tanous | 81ce609 | 2020-12-17 16:54:55 +0000 | [diff] [blame] | 513 | getSslContext(const std::string& sslPemFile) |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 514 | { |
Marri Devender Rao | 5968cae | 2019-01-21 10:27:12 -0600 | [diff] [blame] | 515 | std::shared_ptr<boost::asio::ssl::context> mSslContext = |
| 516 | std::make_shared<boost::asio::ssl::context>( |
| 517 | boost::asio::ssl::context::tls_server); |
| 518 | mSslContext->set_options(boost::asio::ssl::context::default_workarounds | |
| 519 | boost::asio::ssl::context::no_sslv2 | |
| 520 | boost::asio::ssl::context::no_sslv3 | |
| 521 | boost::asio::ssl::context::single_dh_use | |
| 522 | boost::asio::ssl::context::no_tlsv1 | |
| 523 | boost::asio::ssl::context::no_tlsv1_1); |
Ed Tanous | c4771fb | 2017-03-13 13:39:49 -0700 | [diff] [blame] | 524 | |
James Feist | 91243c3 | 2019-11-12 14:55:40 -0800 | [diff] [blame] | 525 | // BIG WARNING: This needs to stay disabled, as there will always be |
| 526 | // unauthenticated endpoints |
| 527 | // mSslContext->set_verify_mode(boost::asio::ssl::verify_peer); |
Kowalski, Kamil | 55e43f6 | 2019-07-10 13:12:57 +0200 | [diff] [blame] | 528 | |
James Feist | 6a3e182 | 2019-11-06 13:46:35 -0800 | [diff] [blame] | 529 | SSL_CTX_set_options(mSslContext->native_handle(), SSL_OP_NO_RENEGOTIATION); |
| 530 | |
Ed Tanous | 62598e3 | 2023-07-17 17:06:25 -0700 | [diff] [blame] | 531 | BMCWEB_LOG_DEBUG("Using default TrustStore location: {}", trustStorePath); |
Kowalski, Kamil | 55e43f6 | 2019-07-10 13:12:57 +0200 | [diff] [blame] | 532 | mSslContext->add_verify_path(trustStorePath); |
| 533 | |
Ed Tanous | 099225c | 2024-03-27 22:03:05 -0700 | [diff] [blame^] | 534 | boost::system::error_code ec; |
| 535 | boost::asio::const_buffer buf(sslPemFile.data(), sslPemFile.size()); |
| 536 | mSslContext->use_certificate(buf, boost::asio::ssl::context::pem, ec); |
| 537 | if (ec) |
| 538 | { |
| 539 | BMCWEB_LOG_CRITICAL("Failed to open ssl certificate"); |
| 540 | return nullptr; |
| 541 | } |
| 542 | mSslContext->use_private_key(buf, boost::asio::ssl::context::pem); |
| 543 | if (ec) |
| 544 | { |
| 545 | BMCWEB_LOG_CRITICAL("Failed to open ssl pkey"); |
| 546 | return nullptr; |
| 547 | } |
Ed Tanous | c4771fb | 2017-03-13 13:39:49 -0700 | [diff] [blame] | 548 | |
Ed Tanous | 25b54db | 2024-04-17 15:40:31 -0700 | [diff] [blame] | 549 | if constexpr (BMCWEB_EXPERIMENTAL_HTTP2) |
Ed Tanous | fca2cbe | 2021-01-28 14:49:59 -0800 | [diff] [blame] | 550 | { |
| 551 | SSL_CTX_set_next_protos_advertised_cb(mSslContext->native_handle(), |
| 552 | nextProtoCallback, nullptr); |
| 553 | |
| 554 | SSL_CTX_set_alpn_select_cb(mSslContext->native_handle(), |
| 555 | alpnSelectProtoCallback, nullptr); |
| 556 | } |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 557 | // Set up EC curves to auto (boost asio doesn't have a method for this) |
| 558 | // There is a pull request to add this. Once this is included in an asio |
| 559 | // drop, use the right way |
| 560 | // http://stackoverflow.com/questions/18929049/boost-asio-with-ecdsa-certificate-issue |
Marri Devender Rao | 5968cae | 2019-01-21 10:27:12 -0600 | [diff] [blame] | 561 | if (SSL_CTX_set_ecdh_auto(mSslContext->native_handle(), 1) != 1) |
Ed Tanous | 62598e3 | 2023-07-17 17:06:25 -0700 | [diff] [blame] | 562 | {} |
Ed Tanous | c4771fb | 2017-03-13 13:39:49 -0700 | [diff] [blame] | 563 | |
Ed Tanous | e96d7fb | 2023-06-14 14:53:29 -0700 | [diff] [blame] | 564 | // Mozilla intermediate cipher suites v5.7 |
| 565 | // Sourced from: https://ssl-config.mozilla.org/guidelines/5.7.json |
| 566 | const char* mozillaIntermediate = "ECDHE-ECDSA-AES128-GCM-SHA256:" |
| 567 | "ECDHE-RSA-AES128-GCM-SHA256:" |
| 568 | "ECDHE-ECDSA-AES256-GCM-SHA384:" |
| 569 | "ECDHE-RSA-AES256-GCM-SHA384:" |
| 570 | "ECDHE-ECDSA-CHACHA20-POLY1305:" |
| 571 | "ECDHE-RSA-CHACHA20-POLY1305:" |
| 572 | "DHE-RSA-AES128-GCM-SHA256:" |
| 573 | "DHE-RSA-AES256-GCM-SHA384:" |
| 574 | "DHE-RSA-CHACHA20-POLY1305"; |
Ed Tanous | c4771fb | 2017-03-13 13:39:49 -0700 | [diff] [blame] | 575 | |
Marri Devender Rao | 5968cae | 2019-01-21 10:27:12 -0600 | [diff] [blame] | 576 | if (SSL_CTX_set_cipher_list(mSslContext->native_handle(), |
Ed Tanous | e96d7fb | 2023-06-14 14:53:29 -0700 | [diff] [blame] | 577 | mozillaIntermediate) != 1) |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 578 | { |
Ed Tanous | 62598e3 | 2023-07-17 17:06:25 -0700 | [diff] [blame] | 579 | BMCWEB_LOG_ERROR("Error setting cipher list"); |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 580 | } |
| 581 | return mSslContext; |
Ed Tanous | c4771fb | 2017-03-13 13:39:49 -0700 | [diff] [blame] | 582 | } |
AppaRao Puli | e38778a | 2022-06-27 23:09:03 +0000 | [diff] [blame] | 583 | |
| 584 | inline std::optional<boost::asio::ssl::context> getSSLClientContext() |
| 585 | { |
| 586 | boost::asio::ssl::context sslCtx(boost::asio::ssl::context::tls_client); |
| 587 | |
| 588 | boost::system::error_code ec; |
| 589 | |
| 590 | // Support only TLS v1.2 & v1.3 |
| 591 | sslCtx.set_options(boost::asio::ssl::context::default_workarounds | |
| 592 | boost::asio::ssl::context::no_sslv2 | |
| 593 | boost::asio::ssl::context::no_sslv3 | |
| 594 | boost::asio::ssl::context::single_dh_use | |
| 595 | boost::asio::ssl::context::no_tlsv1 | |
| 596 | boost::asio::ssl::context::no_tlsv1_1, |
| 597 | ec); |
| 598 | if (ec) |
| 599 | { |
Ed Tanous | 62598e3 | 2023-07-17 17:06:25 -0700 | [diff] [blame] | 600 | BMCWEB_LOG_ERROR("SSL context set_options failed"); |
AppaRao Puli | e38778a | 2022-06-27 23:09:03 +0000 | [diff] [blame] | 601 | return std::nullopt; |
| 602 | } |
| 603 | |
| 604 | // Add a directory containing certificate authority files to be used |
| 605 | // for performing verification. |
| 606 | sslCtx.set_default_verify_paths(ec); |
| 607 | if (ec) |
| 608 | { |
Ed Tanous | 62598e3 | 2023-07-17 17:06:25 -0700 | [diff] [blame] | 609 | BMCWEB_LOG_ERROR("SSL context set_default_verify failed"); |
AppaRao Puli | e38778a | 2022-06-27 23:09:03 +0000 | [diff] [blame] | 610 | return std::nullopt; |
| 611 | } |
| 612 | |
| 613 | // Verify the remote server's certificate |
| 614 | sslCtx.set_verify_mode(boost::asio::ssl::verify_peer, ec); |
| 615 | if (ec) |
| 616 | { |
Ed Tanous | 62598e3 | 2023-07-17 17:06:25 -0700 | [diff] [blame] | 617 | BMCWEB_LOG_ERROR("SSL context set_verify_mode failed"); |
AppaRao Puli | e38778a | 2022-06-27 23:09:03 +0000 | [diff] [blame] | 618 | return std::nullopt; |
| 619 | } |
| 620 | |
| 621 | // All cipher suites are set as per OWASP datasheet. |
| 622 | // https://cheatsheetseries.owasp.org/cheatsheets/TLS_Cipher_String_Cheat_Sheet.html |
| 623 | constexpr const char* sslCiphers = "ECDHE-ECDSA-AES128-GCM-SHA256:" |
| 624 | "ECDHE-RSA-AES128-GCM-SHA256:" |
| 625 | "ECDHE-ECDSA-AES256-GCM-SHA384:" |
| 626 | "ECDHE-RSA-AES256-GCM-SHA384:" |
| 627 | "ECDHE-ECDSA-CHACHA20-POLY1305:" |
| 628 | "ECDHE-RSA-CHACHA20-POLY1305:" |
| 629 | "DHE-RSA-AES128-GCM-SHA256:" |
| 630 | "DHE-RSA-AES256-GCM-SHA384" |
| 631 | "TLS_AES_128_GCM_SHA256:" |
| 632 | "TLS_AES_256_GCM_SHA384:" |
| 633 | "TLS_CHACHA20_POLY1305_SHA256"; |
| 634 | |
| 635 | if (SSL_CTX_set_cipher_list(sslCtx.native_handle(), sslCiphers) != 1) |
| 636 | { |
Ed Tanous | 62598e3 | 2023-07-17 17:06:25 -0700 | [diff] [blame] | 637 | BMCWEB_LOG_ERROR("SSL_CTX_set_cipher_list failed"); |
AppaRao Puli | e38778a | 2022-06-27 23:09:03 +0000 | [diff] [blame] | 638 | return std::nullopt; |
| 639 | } |
| 640 | |
| 641 | return sslCtx; |
| 642 | } |
| 643 | |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 644 | } // namespace ensuressl |