blob: ce1e63889c4b4402319d99e049c7fae6c190a6bc [file] [log] [blame]
Ed Tanous0fdddb12017-02-28 11:06:34 -08001#pragma once
2
Ed Tanous62598e32023-07-17 17:06:25 -07003#include "bmcweb_config.h"
4
Ed Tanous3ccb3ad2023-01-13 17:40:03 -08005#include "logging.hpp"
Ed Tanous2c6ffdb2023-06-28 11:28:38 -07006#include "ossl_random.hpp"
Ed Tanous3281bcf2024-06-25 16:02:05 -07007#include "persistent_data.hpp"
Ed Tanous3ccb3ad2023-01-13 17:40:03 -08008
Ed Tanous099225c2024-03-27 22:03:05 -07009#include <boost/beast/core/file_posix.hpp>
10
Ed Tanousfca2cbe2021-01-28 14:49:59 -080011extern "C"
12{
13#include <nghttp2/nghttp2.h>
Ed Tanous0fdddb12017-02-28 11:06:34 -080014#include <openssl/bio.h>
15#include <openssl/dh.h>
16#include <openssl/dsa.h>
Ed Tanous0fdddb12017-02-28 11:06:34 -080017#include <openssl/err.h>
18#include <openssl/evp.h>
19#include <openssl/pem.h>
20#include <openssl/rand.h>
21#include <openssl/rsa.h>
22#include <openssl/ssl.h>
Ed Tanous6dbe9be2024-04-14 10:24:20 -070023}
Ed Tanous9b65f1f2017-03-07 15:17:13 -080024
Ed Tanous3112a142018-11-29 15:45:10 -080025#include <boost/asio/ssl/context.hpp>
Ed Tanous099225c2024-03-27 22:03:05 -070026#include <boost/system/error_code.hpp>
Gunnar Mills1214b7e2020-06-04 10:11:30 -050027
Abhilash Rajud5fb5842024-06-03 11:40:17 -050028#include <filesystem>
29#include <memory>
Ed Tanous3ccb3ad2023-01-13 17:40:03 -080030#include <optional>
Ed Tanous1abe55e2018-09-05 08:30:59 -070031#include <random>
Ed Tanous3ccb3ad2023-01-13 17:40:03 -080032#include <string>
Ed Tanous1abe55e2018-09-05 08:30:59 -070033
34namespace ensuressl
35{
Patrick Williams89492a12023-05-10 07:51:34 -050036constexpr const char* trustStorePath = "/etc/ssl/certs/authority";
37constexpr const char* x509Comment = "Generated from OpenBMC service";
Ed Tanous55c7b7a2018-05-22 15:27:24 -070038static void initOpenssl();
Gunnar Mills1214b7e2020-06-04 10:11:30 -050039static EVP_PKEY* createEcKey();
Ed Tanous0fdddb12017-02-28 11:06:34 -080040
Ramesh Iyyar082f28f2019-06-22 03:31:55 -050041// Trust chain related errors.`
42inline bool isTrustChainError(int errnum)
43{
Ed Tanous55f79e62022-01-25 11:26:16 -080044 return (errnum == X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT) ||
45 (errnum == X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN) ||
46 (errnum == X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY) ||
47 (errnum == X509_V_ERR_CERT_UNTRUSTED) ||
48 (errnum == X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE);
Ramesh Iyyar082f28f2019-06-22 03:31:55 -050049}
50
Gunnar Mills1214b7e2020-06-04 10:11:30 -050051inline bool validateCertificate(X509* const cert)
Ramesh Iyyar082f28f2019-06-22 03:31:55 -050052{
53 // Create an empty X509_STORE structure for certificate validation.
Gunnar Mills1214b7e2020-06-04 10:11:30 -050054 X509_STORE* x509Store = X509_STORE_new();
Ed Tanouse662eae2022-01-25 10:39:19 -080055 if (x509Store == nullptr)
Ramesh Iyyar082f28f2019-06-22 03:31:55 -050056 {
Ed Tanous62598e32023-07-17 17:06:25 -070057 BMCWEB_LOG_ERROR("Error occurred during X509_STORE_new call");
Ramesh Iyyar082f28f2019-06-22 03:31:55 -050058 return false;
59 }
60
61 // Load Certificate file into the X509 structure.
Gunnar Mills1214b7e2020-06-04 10:11:30 -050062 X509_STORE_CTX* storeCtx = X509_STORE_CTX_new();
Ed Tanouse662eae2022-01-25 10:39:19 -080063 if (storeCtx == nullptr)
Ramesh Iyyar082f28f2019-06-22 03:31:55 -050064 {
Ed Tanous62598e32023-07-17 17:06:25 -070065 BMCWEB_LOG_ERROR("Error occurred during X509_STORE_CTX_new call");
Ramesh Iyyar082f28f2019-06-22 03:31:55 -050066 X509_STORE_free(x509Store);
67 return false;
68 }
69
Ed Tanous99131cd2019-10-24 11:12:47 -070070 int errCode = X509_STORE_CTX_init(storeCtx, x509Store, cert, nullptr);
Ramesh Iyyar082f28f2019-06-22 03:31:55 -050071 if (errCode != 1)
72 {
Ed Tanous62598e32023-07-17 17:06:25 -070073 BMCWEB_LOG_ERROR("Error occurred during X509_STORE_CTX_init call");
Ramesh Iyyar082f28f2019-06-22 03:31:55 -050074 X509_STORE_CTX_free(storeCtx);
75 X509_STORE_free(x509Store);
76 return false;
77 }
78
79 errCode = X509_verify_cert(storeCtx);
80 if (errCode == 1)
81 {
Ed Tanous62598e32023-07-17 17:06:25 -070082 BMCWEB_LOG_INFO("Certificate verification is success");
Ramesh Iyyar082f28f2019-06-22 03:31:55 -050083 X509_STORE_CTX_free(storeCtx);
84 X509_STORE_free(x509Store);
85 return true;
86 }
87 if (errCode == 0)
88 {
89 errCode = X509_STORE_CTX_get_error(storeCtx);
90 X509_STORE_CTX_free(storeCtx);
91 X509_STORE_free(x509Store);
92 if (isTrustChainError(errCode))
93 {
Ed Tanous62598e32023-07-17 17:06:25 -070094 BMCWEB_LOG_DEBUG("Ignoring Trust Chain error. Reason: {}",
95 X509_verify_cert_error_string(errCode));
Ramesh Iyyar082f28f2019-06-22 03:31:55 -050096 return true;
97 }
Ed Tanous62598e32023-07-17 17:06:25 -070098 BMCWEB_LOG_ERROR("Certificate verification failed. Reason: {}",
99 X509_verify_cert_error_string(errCode));
Ed Tanous3174e4d2020-10-07 11:41:22 -0700100 return false;
Ramesh Iyyar082f28f2019-06-22 03:31:55 -0500101 }
102
Ed Tanous62598e32023-07-17 17:06:25 -0700103 BMCWEB_LOG_ERROR(
104 "Error occurred during X509_verify_cert call. ErrorCode: {}", errCode);
Ramesh Iyyar082f28f2019-06-22 03:31:55 -0500105 X509_STORE_CTX_free(storeCtx);
106 X509_STORE_free(x509Store);
107 return false;
108}
109
Ed Tanous099225c2024-03-27 22:03:05 -0700110inline std::string verifyOpensslKeyCert(const std::string& filepath)
Ed Tanous1abe55e2018-09-05 08:30:59 -0700111{
112 bool privateKeyValid = false;
Ed Tanous9b65f1f2017-03-07 15:17:13 -0800113
Ed Tanousc160ae72024-03-27 18:45:20 -0700114 BMCWEB_LOG_INFO("Checking certs in file {}", filepath);
Ed Tanous099225c2024-03-27 22:03:05 -0700115 boost::beast::file_posix file;
116 boost::system::error_code ec;
117 file.open(filepath.c_str(), boost::beast::file_mode::read, ec);
118 if (ec)
Ed Tanous1abe55e2018-09-05 08:30:59 -0700119 {
Ed Tanous099225c2024-03-27 22:03:05 -0700120 return "";
121 }
122 bool certValid = false;
123 std::string fileContents;
124 fileContents.resize(static_cast<size_t>(file.size(ec)), '\0');
125 file.read(fileContents.data(), fileContents.size(), ec);
126 if (ec)
127 {
128 BMCWEB_LOG_ERROR("Failed to read file");
129 return "";
130 }
Patrick Williams145bb762021-12-07 21:05:04 -0600131
Ed Tanous099225c2024-03-27 22:03:05 -0700132 BIO* bufio = BIO_new_mem_buf(static_cast<void*>(fileContents.data()),
133 static_cast<int>(fileContents.size()));
134 EVP_PKEY* pkey = PEM_read_bio_PrivateKey(bufio, nullptr, nullptr, nullptr);
135 BIO_free(bufio);
136 if (pkey != nullptr)
137 {
138#if (OPENSSL_VERSION_NUMBER < 0x30000000L)
139 RSA* rsa = EVP_PKEY_get1_RSA(pkey);
140 if (rsa != nullptr)
141 {
142 BMCWEB_LOG_INFO("Found an RSA key");
143 if (RSA_check_key(rsa) == 1)
Patrick Williams145bb762021-12-07 21:05:04 -0600144 {
145 privateKeyValid = true;
146 }
147 else
148 {
Ed Tanousc160ae72024-03-27 18:45:20 -0700149 BMCWEB_LOG_ERROR("Key not valid error number {}",
150 ERR_get_error());
Patrick Williams145bb762021-12-07 21:05:04 -0600151 }
Ed Tanous099225c2024-03-27 22:03:05 -0700152 RSA_free(rsa);
153 }
154 else
155 {
156 EC_KEY* ec = EVP_PKEY_get1_EC_KEY(pkey);
157 if (ec != nullptr)
Ed Tanous1abe55e2018-09-05 08:30:59 -0700158 {
Ed Tanous099225c2024-03-27 22:03:05 -0700159 BMCWEB_LOG_INFO("Found an EC key");
160 if (EC_KEY_check_key(ec) == 1)
Ed Tanous1abe55e2018-09-05 08:30:59 -0700161 {
Ed Tanous099225c2024-03-27 22:03:05 -0700162 privateKeyValid = true;
Ed Tanous1abe55e2018-09-05 08:30:59 -0700163 }
164 else
165 {
Ed Tanous099225c2024-03-27 22:03:05 -0700166 BMCWEB_LOG_ERROR("Key not valid error number {}",
167 ERR_get_error());
Ed Tanous1abe55e2018-09-05 08:30:59 -0700168 }
Ed Tanous099225c2024-03-27 22:03:05 -0700169 EC_KEY_free(ec);
Ed Tanous1abe55e2018-09-05 08:30:59 -0700170 }
Ed Tanous099225c2024-03-27 22:03:05 -0700171 }
172#else
173 EVP_PKEY_CTX* pkeyCtx = EVP_PKEY_CTX_new_from_pkey(nullptr, pkey,
174 nullptr);
175
176 if (pkeyCtx == nullptr)
177 {
178 BMCWEB_LOG_ERROR("Unable to allocate pkeyCtx {}", ERR_get_error());
179 }
180 else if (EVP_PKEY_check(pkeyCtx) == 1)
181 {
182 privateKeyValid = true;
183 }
184 else
185 {
186 BMCWEB_LOG_ERROR("Key not valid error number {}", ERR_get_error());
187 }
188#endif
189
190 if (privateKeyValid)
191 {
192 BIO* bufio2 =
193 BIO_new_mem_buf(static_cast<void*>(fileContents.data()),
194 static_cast<int>(fileContents.size()));
195 X509* x509 = PEM_read_bio_X509(bufio2, nullptr, nullptr, nullptr);
196 BIO_free(bufio2);
197 if (x509 == nullptr)
198 {
199 BMCWEB_LOG_ERROR("error getting x509 cert {}", ERR_get_error());
200 }
201 else
202 {
203 certValid = validateCertificate(x509);
204 X509_free(x509);
205 }
206 }
Ed Tanous1abe55e2018-09-05 08:30:59 -0700207
Patrick Williams145bb762021-12-07 21:05:04 -0600208#if (OPENSSL_VERSION_NUMBER > 0x30000000L)
Ed Tanous099225c2024-03-27 22:03:05 -0700209 EVP_PKEY_CTX_free(pkeyCtx);
Patrick Williams145bb762021-12-07 21:05:04 -0600210#endif
Ed Tanous099225c2024-03-27 22:03:05 -0700211 EVP_PKEY_free(pkey);
Ed Tanous0fdddb12017-02-28 11:06:34 -0800212 }
Ed Tanous099225c2024-03-27 22:03:05 -0700213 if (!certValid)
214 {
215 return "";
216 }
217 return fileContents;
Ed Tanous0fdddb12017-02-28 11:06:34 -0800218}
219
Alan Kuoa8220702020-11-26 11:15:29 +0800220inline X509* loadCert(const std::string& filePath)
221{
222 BIO* certFileBio = BIO_new_file(filePath.c_str(), "rb");
Ed Tanouse662eae2022-01-25 10:39:19 -0800223 if (certFileBio == nullptr)
Alan Kuoa8220702020-11-26 11:15:29 +0800224 {
Ed Tanous8ece0e42024-01-02 13:16:50 -0800225 BMCWEB_LOG_ERROR("Error occurred during BIO_new_file call, FILE= {}",
Ed Tanous62598e32023-07-17 17:06:25 -0700226 filePath);
Alan Kuoa8220702020-11-26 11:15:29 +0800227 return nullptr;
228 }
229
230 X509* cert = X509_new();
Ed Tanouse662eae2022-01-25 10:39:19 -0800231 if (cert == nullptr)
Alan Kuoa8220702020-11-26 11:15:29 +0800232 {
Ed Tanous8ece0e42024-01-02 13:16:50 -0800233 BMCWEB_LOG_ERROR("Error occurred during X509_new call, {}",
Ed Tanous62598e32023-07-17 17:06:25 -0700234 ERR_get_error());
Alan Kuoa8220702020-11-26 11:15:29 +0800235 BIO_free(certFileBio);
236 return nullptr;
237 }
238
Ed Tanouse662eae2022-01-25 10:39:19 -0800239 if (PEM_read_bio_X509(certFileBio, &cert, nullptr, nullptr) == nullptr)
Alan Kuoa8220702020-11-26 11:15:29 +0800240 {
Ed Tanous62598e32023-07-17 17:06:25 -0700241 BMCWEB_LOG_ERROR(
Ed Tanous8ece0e42024-01-02 13:16:50 -0800242 "Error occurred during PEM_read_bio_X509 call, FILE= {}", filePath);
Alan Kuoa8220702020-11-26 11:15:29 +0800243
244 BIO_free(certFileBio);
245 X509_free(cert);
246 return nullptr;
247 }
Alan Kuob295bf92021-04-16 14:16:47 +0800248 BIO_free(certFileBio);
Alan Kuoa8220702020-11-26 11:15:29 +0800249 return cert;
250}
251
252inline int addExt(X509* cert, int nid, const char* value)
253{
254 X509_EXTENSION* ex = nullptr;
Ed Tanousb00dcc22021-02-23 12:52:50 -0800255 X509V3_CTX ctx{};
Alan Kuoa8220702020-11-26 11:15:29 +0800256 X509V3_set_ctx(&ctx, cert, cert, nullptr, nullptr, 0);
Ed Tanous4ecc6182022-01-07 09:36:26 -0800257
258 // NOLINTNEXTLINE(cppcoreguidelines-pro-type-const-cast)
Alan Kuoa8220702020-11-26 11:15:29 +0800259 ex = X509V3_EXT_conf_nid(nullptr, &ctx, nid, const_cast<char*>(value));
Ed Tanouse662eae2022-01-25 10:39:19 -0800260 if (ex == nullptr)
Alan Kuoa8220702020-11-26 11:15:29 +0800261 {
Ed Tanous62598e32023-07-17 17:06:25 -0700262 BMCWEB_LOG_ERROR("Error: In X509V3_EXT_conf_nidn: {}", value);
Alan Kuoa8220702020-11-26 11:15:29 +0800263 return -1;
264 }
265 X509_add_ext(cert, ex, -1);
266 X509_EXTENSION_free(ex);
267 return 0;
268}
269
Ed Tanous099225c2024-03-27 22:03:05 -0700270// Writes a certificate to a path, ignoring errors
271inline void writeCertificateToFile(const std::string& filepath,
272 const std::string& certificate)
Ed Tanous1abe55e2018-09-05 08:30:59 -0700273{
Ed Tanous099225c2024-03-27 22:03:05 -0700274 boost::system::error_code ec;
275 boost::beast::file_posix file;
276 file.open(filepath.c_str(), boost::beast::file_mode::write, ec);
277 if (!ec)
278 {
279 file.write(certificate.data(), certificate.size(), ec);
280 // ignore result
281 }
282}
283
284inline std::string generateSslCertificate(const std::string& cn)
285{
Ed Tanousc160ae72024-03-27 18:45:20 -0700286 BMCWEB_LOG_INFO("Generating new keys");
Ed Tanous1abe55e2018-09-05 08:30:59 -0700287 initOpenssl();
Ed Tanous0fdddb12017-02-28 11:06:34 -0800288
Ed Tanous099225c2024-03-27 22:03:05 -0700289 std::string buffer;
Ed Tanousc160ae72024-03-27 18:45:20 -0700290 BMCWEB_LOG_INFO("Generating EC key");
Gunnar Mills1214b7e2020-06-04 10:11:30 -0500291 EVP_PKEY* pPrivKey = createEcKey();
Vernon Mauery0185c7f2020-03-09 10:56:53 -0700292 if (pPrivKey != nullptr)
Ed Tanous1abe55e2018-09-05 08:30:59 -0700293 {
Ed Tanousc160ae72024-03-27 18:45:20 -0700294 BMCWEB_LOG_INFO("Generating x509 Certificates");
Ed Tanous1abe55e2018-09-05 08:30:59 -0700295 // Use this code to directly generate a certificate
Ed Tanous543f4402022-01-06 13:12:53 -0800296 X509* x509 = X509_new();
Ed Tanous1abe55e2018-09-05 08:30:59 -0700297 if (x509 != nullptr)
298 {
299 // get a random number from the RNG for the certificate serial
Ed Tanous8ece0e42024-01-02 13:16:50 -0800300 // number If this is not random, regenerating certs throws browser
Ed Tanous1abe55e2018-09-05 08:30:59 -0700301 // errors
Alan Kuoa8220702020-11-26 11:15:29 +0800302 bmcweb::OpenSSLGenerator gen;
303 std::uniform_int_distribution<int> dis(
304 1, std::numeric_limits<int>::max());
305 int serial = dis(gen);
Ed Tanous9b65f1f2017-03-07 15:17:13 -0800306
Ed Tanous1abe55e2018-09-05 08:30:59 -0700307 ASN1_INTEGER_set(X509_get_serialNumber(x509), serial);
Ed Tanous9b65f1f2017-03-07 15:17:13 -0800308
Ed Tanous1abe55e2018-09-05 08:30:59 -0700309 // not before this moment
310 X509_gmtime_adj(X509_get_notBefore(x509), 0);
311 // Cert is valid for 10 years
312 X509_gmtime_adj(X509_get_notAfter(x509),
313 60L * 60L * 24L * 365L * 10L);
Ed Tanous9b65f1f2017-03-07 15:17:13 -0800314
Ed Tanous1abe55e2018-09-05 08:30:59 -0700315 // set the public key to the key we just generated
Vernon Mauery0185c7f2020-03-09 10:56:53 -0700316 X509_set_pubkey(x509, pPrivKey);
Ed Tanous0fdddb12017-02-28 11:06:34 -0800317
Ed Tanous1abe55e2018-09-05 08:30:59 -0700318 // get the subject name
Ed Tanous543f4402022-01-06 13:12:53 -0800319 X509_NAME* name = X509_get_subject_name(x509);
Ed Tanous0fdddb12017-02-28 11:06:34 -0800320
Ed Tanous46ff87b2022-01-07 09:25:51 -0800321 using x509String = const unsigned char;
322 // NOLINTNEXTLINE(cppcoreguidelines-pro-type-reinterpret-cast)
323 x509String* country = reinterpret_cast<x509String*>("US");
324 // NOLINTNEXTLINE(cppcoreguidelines-pro-type-reinterpret-cast)
325 x509String* company = reinterpret_cast<x509String*>("OpenBMC");
326 // NOLINTNEXTLINE(cppcoreguidelines-pro-type-reinterpret-cast)
327 x509String* cnStr = reinterpret_cast<x509String*>(cn.c_str());
328
329 X509_NAME_add_entry_by_txt(name, "C", MBSTRING_ASC, country, -1, -1,
330 0);
331 X509_NAME_add_entry_by_txt(name, "O", MBSTRING_ASC, company, -1, -1,
332 0);
333 X509_NAME_add_entry_by_txt(name, "CN", MBSTRING_ASC, cnStr, -1, -1,
334 0);
Ed Tanous1abe55e2018-09-05 08:30:59 -0700335 // set the CSR options
336 X509_set_issuer_name(x509, name);
Ed Tanous0fdddb12017-02-28 11:06:34 -0800337
Alan Kuoa8220702020-11-26 11:15:29 +0800338 X509_set_version(x509, 2);
339 addExt(x509, NID_basic_constraints, ("critical,CA:TRUE"));
340 addExt(x509, NID_subject_alt_name, ("DNS:" + cn).c_str());
341 addExt(x509, NID_subject_key_identifier, ("hash"));
342 addExt(x509, NID_authority_key_identifier, ("keyid"));
343 addExt(x509, NID_key_usage, ("digitalSignature, keyEncipherment"));
344 addExt(x509, NID_ext_key_usage, ("serverAuth"));
345 addExt(x509, NID_netscape_comment, (x509Comment));
346
Ed Tanous1abe55e2018-09-05 08:30:59 -0700347 // Sign the certificate with our private key
Vernon Mauery0185c7f2020-03-09 10:56:53 -0700348 X509_sign(x509, pPrivKey, EVP_sha256());
Ed Tanous0fdddb12017-02-28 11:06:34 -0800349
Ed Tanous099225c2024-03-27 22:03:05 -0700350 BIO* bufio = BIO_new(BIO_s_mem());
Ed Tanous0fdddb12017-02-28 11:06:34 -0800351
Ed Tanous099225c2024-03-27 22:03:05 -0700352 int pkeyRet = PEM_write_bio_PrivateKey(
353 bufio, pPrivKey, nullptr, nullptr, 0, nullptr, nullptr);
354 if (pkeyRet <= 0)
Ed Tanous1abe55e2018-09-05 08:30:59 -0700355 {
Ed Tanous099225c2024-03-27 22:03:05 -0700356 BMCWEB_LOG_ERROR(
357 "Failed to write pkey with code {}. Ignoring.", pkeyRet);
Ed Tanous1abe55e2018-09-05 08:30:59 -0700358 }
Ed Tanous0fdddb12017-02-28 11:06:34 -0800359
Ed Tanous099225c2024-03-27 22:03:05 -0700360 char* data = nullptr;
361 long int dataLen = BIO_get_mem_data(bufio, &data);
362 buffer += std::string_view(data, static_cast<size_t>(dataLen));
363 BIO_free(bufio);
364
365 bufio = BIO_new(BIO_s_mem());
366 pkeyRet = PEM_write_bio_X509(bufio, x509);
367 if (pkeyRet <= 0)
368 {
369 BMCWEB_LOG_ERROR(
370 "Failed to write X509 with code {}. Ignoring.", pkeyRet);
371 }
372 dataLen = BIO_get_mem_data(bufio, &data);
373 buffer += std::string_view(data, static_cast<size_t>(dataLen));
374
375 BIO_free(bufio);
376 BMCWEB_LOG_INFO("Cert size is {}", buffer.size());
Ed Tanous1abe55e2018-09-05 08:30:59 -0700377 X509_free(x509);
378 }
379
Vernon Mauery0185c7f2020-03-09 10:56:53 -0700380 EVP_PKEY_free(pPrivKey);
381 pPrivKey = nullptr;
Ed Tanous0fdddb12017-02-28 11:06:34 -0800382 }
383
Ed Tanous1abe55e2018-09-05 08:30:59 -0700384 // cleanup_openssl();
Ed Tanous099225c2024-03-27 22:03:05 -0700385 return buffer;
Ed Tanous99923322017-03-03 14:21:24 -0800386}
Ed Tanousb01bf292019-03-25 19:25:26 +0000387
Gunnar Mills1214b7e2020-06-04 10:11:30 -0500388EVP_PKEY* createEcKey()
Ed Tanousb01bf292019-03-25 19:25:26 +0000389{
Gunnar Mills1214b7e2020-06-04 10:11:30 -0500390 EVP_PKEY* pKey = nullptr;
Patrick Williamsaec70662021-12-13 16:55:46 -0600391
392#if (OPENSSL_VERSION_NUMBER < 0x30000000L)
Ed Tanousb01bf292019-03-25 19:25:26 +0000393 int eccgrp = 0;
Vernon Maueryaaf32062020-03-09 10:41:31 -0700394 eccgrp = OBJ_txt2nid("secp384r1");
Ed Tanous6ea007a2019-02-13 22:48:25 -0800395
Gunnar Mills1214b7e2020-06-04 10:11:30 -0500396 EC_KEY* myecc = EC_KEY_new_by_curve_name(eccgrp);
Ed Tanousb01bf292019-03-25 19:25:26 +0000397 if (myecc != nullptr)
Ed Tanous6ea007a2019-02-13 22:48:25 -0800398 {
Ed Tanousb01bf292019-03-25 19:25:26 +0000399 EC_KEY_set_asn1_flag(myecc, OPENSSL_EC_NAMED_CURVE);
400 EC_KEY_generate_key(myecc);
401 pKey = EVP_PKEY_new();
402 if (pKey != nullptr)
403 {
Szymon Dompkea327dc52022-03-01 14:04:14 +0100404 if (EVP_PKEY_assign(pKey, EVP_PKEY_EC, myecc) != 0)
Ed Tanousb01bf292019-03-25 19:25:26 +0000405 {
Vernon Mauery0185c7f2020-03-09 10:56:53 -0700406 /* pKey owns myecc from now */
Ed Tanousb01bf292019-03-25 19:25:26 +0000407 if (EC_KEY_check_key(myecc) <= 0)
408 {
Ed Tanousc160ae72024-03-27 18:45:20 -0700409 BMCWEB_LOG_ERROR("EC_check_key failed.");
Ed Tanousb01bf292019-03-25 19:25:26 +0000410 }
411 }
412 }
Ed Tanous6ea007a2019-02-13 22:48:25 -0800413 }
Patrick Williamsaec70662021-12-13 16:55:46 -0600414#else
415 // Create context for curve parameter generation.
416 std::unique_ptr<EVP_PKEY_CTX, decltype(&::EVP_PKEY_CTX_free)> ctx{
417 EVP_PKEY_CTX_new_id(EVP_PKEY_EC, nullptr), &::EVP_PKEY_CTX_free};
418 if (!ctx)
419 {
420 return nullptr;
421 }
422
423 // Set up curve parameters.
424 EVP_PKEY* params = nullptr;
425 if ((EVP_PKEY_paramgen_init(ctx.get()) <= 0) ||
426 (EVP_PKEY_CTX_set_ec_param_enc(ctx.get(), OPENSSL_EC_NAMED_CURVE) <=
427 0) ||
428 (EVP_PKEY_CTX_set_ec_paramgen_curve_nid(ctx.get(), NID_secp384r1) <=
429 0) ||
430 (EVP_PKEY_paramgen(ctx.get(), &params) <= 0))
431 {
432 return nullptr;
433 }
434
435 // Set up RAII holder for params.
436 std::unique_ptr<EVP_PKEY, decltype(&::EVP_PKEY_free)> pparams{
437 params, &::EVP_PKEY_free};
438
439 // Set new context for key generation, using curve parameters.
440 ctx.reset(EVP_PKEY_CTX_new_from_pkey(nullptr, params, nullptr));
441 if (!ctx || (EVP_PKEY_keygen_init(ctx.get()) <= 0))
442 {
443 return nullptr;
444 }
445
446 // Generate key.
447 if (EVP_PKEY_keygen(ctx.get(), &pKey) <= 0)
448 {
449 return nullptr;
450 }
451#endif
452
Ed Tanous1abe55e2018-09-05 08:30:59 -0700453 return pKey;
454}
455
456void initOpenssl()
457{
Ed Tanous911ac312017-08-15 09:37:42 -0700458#if OPENSSL_VERSION_NUMBER < 0x10100000L
Ed Tanous1abe55e2018-09-05 08:30:59 -0700459 SSL_load_error_strings();
460 OpenSSL_add_all_algorithms();
461 RAND_load_file("/dev/urandom", 1024);
Ed Tanousa1e077c2017-04-25 12:42:19 -0700462#endif
Ed Tanous0fdddb12017-02-28 11:06:34 -0800463}
464
Ed Tanous099225c2024-03-27 22:03:05 -0700465inline std::string ensureOpensslKeyPresentAndValid(const std::string& filepath)
Ed Tanous1abe55e2018-09-05 08:30:59 -0700466{
Ed Tanous099225c2024-03-27 22:03:05 -0700467 std::string cert = verifyOpensslKeyCert(filepath);
Ed Tanous0fdddb12017-02-28 11:06:34 -0800468
Ed Tanous099225c2024-03-27 22:03:05 -0700469 if (cert.empty())
Ed Tanous1abe55e2018-09-05 08:30:59 -0700470 {
Ed Tanousc160ae72024-03-27 18:45:20 -0700471 BMCWEB_LOG_WARNING("Error in verifying signature, regenerating");
Ed Tanous099225c2024-03-27 22:03:05 -0700472 cert = generateSslCertificate("testhost");
473 if (cert.empty())
474 {
475 BMCWEB_LOG_ERROR("Failed to generate cert");
476 }
477 else
478 {
479 writeCertificateToFile(filepath, cert);
480 }
Ed Tanous1abe55e2018-09-05 08:30:59 -0700481 }
Ed Tanous099225c2024-03-27 22:03:05 -0700482 return cert;
Ed Tanous0fdddb12017-02-28 11:06:34 -0800483}
Ed Tanousc4771fb2017-03-13 13:39:49 -0700484
Abhilash Rajud5fb5842024-06-03 11:40:17 -0500485inline std::string ensureCertificate()
486{
487 namespace fs = std::filesystem;
488 // Cleanup older certificate file existing in the system
489 fs::path oldcertPath = fs::path("/home/root/server.pem");
490 std::error_code ec;
491 fs::remove(oldcertPath, ec);
492 // Ignore failure to remove; File might not exist.
493
494 fs::path certPath = "/etc/ssl/certs/https/";
495 // if path does not exist create the path so that
496 // self signed certificate can be created in the
497 // path
498 fs::path certFile = certPath / "server.pem";
499
500 if (!fs::exists(certPath, ec))
501 {
Andrew Geissler00a0fe42024-06-11 11:21:30 -0400502 fs::create_directories(certPath, ec);
Abhilash Rajud5fb5842024-06-03 11:40:17 -0500503 }
504 BMCWEB_LOG_INFO("Building SSL Context file= {}", certFile.string());
505 std::string sslPemFile(certFile);
506 return ensuressl::ensureOpensslKeyPresentAndValid(sslPemFile);
507}
508
Ed Tanousfca2cbe2021-01-28 14:49:59 -0800509inline int nextProtoCallback(SSL* /*unused*/, const unsigned char** data,
510 unsigned int* len, void* /*unused*/)
511{
512 // First byte is the length.
513 constexpr std::string_view h2 = "\x02h2";
514 *data = std::bit_cast<const unsigned char*>(h2.data());
515 *len = static_cast<unsigned int>(h2.size());
516 return SSL_TLSEXT_ERR_OK;
517}
518
519inline int alpnSelectProtoCallback(SSL* /*unused*/, const unsigned char** out,
520 unsigned char* outlen,
521 const unsigned char* in, unsigned int inlen,
522 void* /*unused*/)
523{
524 // There's a mismatch in constness for nghttp2_select_next_protocol. The
525 // examples in nghttp2 don't show this problem. Unclear what the right fix
526 // is here.
527
528 // NOLINTNEXTLINE(cppcoreguidelines-pro-type-const-cast)
529 unsigned char** outNew = const_cast<unsigned char**>(out);
530 int rv = nghttp2_select_next_protocol(outNew, outlen, in, inlen);
531 if (rv != 1)
532 {
533 return SSL_TLSEXT_ERR_NOACK;
534 }
535
536 return SSL_TLSEXT_ERR_OK;
537}
538
Abhilash Rajud5fb5842024-06-03 11:40:17 -0500539inline bool getSslContext(boost::asio::ssl::context& mSslContext,
540 const std::string& sslPemFile)
Ed Tanous1abe55e2018-09-05 08:30:59 -0700541{
Abhilash Rajud5fb5842024-06-03 11:40:17 -0500542 mSslContext.set_options(boost::asio::ssl::context::default_workarounds |
543 boost::asio::ssl::context::no_sslv2 |
544 boost::asio::ssl::context::no_sslv3 |
545 boost::asio::ssl::context::single_dh_use |
546 boost::asio::ssl::context::no_tlsv1 |
547 boost::asio::ssl::context::no_tlsv1_1);
James Feist6a3e1822019-11-06 13:46:35 -0800548
Ed Tanous62598e32023-07-17 17:06:25 -0700549 BMCWEB_LOG_DEBUG("Using default TrustStore location: {}", trustStorePath);
Abhilash Rajud5fb5842024-06-03 11:40:17 -0500550 mSslContext.add_verify_path(trustStorePath);
Kowalski, Kamil55e43f62019-07-10 13:12:57 +0200551
Abhilash Rajud5fb5842024-06-03 11:40:17 -0500552 if (!sslPemFile.empty())
Ed Tanous099225c2024-03-27 22:03:05 -0700553 {
Abhilash Rajud5fb5842024-06-03 11:40:17 -0500554 boost::system::error_code ec;
555
556 boost::asio::const_buffer buf(sslPemFile.data(), sslPemFile.size());
557 mSslContext.use_certificate(buf, boost::asio::ssl::context::pem, ec);
558 if (ec)
559 {
560 return false;
561 }
562 mSslContext.use_private_key(buf, boost::asio::ssl::context::pem, ec);
563 if (ec)
564 {
565 BMCWEB_LOG_CRITICAL("Failed to open ssl pkey");
566 return false;
567 }
Ed Tanous099225c2024-03-27 22:03:05 -0700568 }
Ed Tanousc4771fb2017-03-13 13:39:49 -0700569
Ed Tanous1abe55e2018-09-05 08:30:59 -0700570 // Set up EC curves to auto (boost asio doesn't have a method for this)
571 // There is a pull request to add this. Once this is included in an asio
572 // drop, use the right way
573 // http://stackoverflow.com/questions/18929049/boost-asio-with-ecdsa-certificate-issue
Marri Devender Rao5968cae2019-01-21 10:27:12 -0600574 if (SSL_CTX_set_ecdh_auto(mSslContext->native_handle(), 1) != 1)
Ed Tanous62598e32023-07-17 17:06:25 -0700575 {}
Ed Tanousc4771fb2017-03-13 13:39:49 -0700576
Ed Tanouse96d7fb2023-06-14 14:53:29 -0700577 // Mozilla intermediate cipher suites v5.7
578 // Sourced from: https://ssl-config.mozilla.org/guidelines/5.7.json
579 const char* mozillaIntermediate = "ECDHE-ECDSA-AES128-GCM-SHA256:"
580 "ECDHE-RSA-AES128-GCM-SHA256:"
581 "ECDHE-ECDSA-AES256-GCM-SHA384:"
582 "ECDHE-RSA-AES256-GCM-SHA384:"
583 "ECDHE-ECDSA-CHACHA20-POLY1305:"
584 "ECDHE-RSA-CHACHA20-POLY1305:"
585 "DHE-RSA-AES128-GCM-SHA256:"
586 "DHE-RSA-AES256-GCM-SHA384:"
587 "DHE-RSA-CHACHA20-POLY1305";
Ed Tanousc4771fb2017-03-13 13:39:49 -0700588
Abhilash Rajud5fb5842024-06-03 11:40:17 -0500589 if (SSL_CTX_set_cipher_list(mSslContext.native_handle(),
Ed Tanouse96d7fb2023-06-14 14:53:29 -0700590 mozillaIntermediate) != 1)
Ed Tanous1abe55e2018-09-05 08:30:59 -0700591 {
Ed Tanous62598e32023-07-17 17:06:25 -0700592 BMCWEB_LOG_ERROR("Error setting cipher list");
Abhilash Rajud5fb5842024-06-03 11:40:17 -0500593 return false;
Ed Tanous1abe55e2018-09-05 08:30:59 -0700594 }
Abhilash Rajud5fb5842024-06-03 11:40:17 -0500595 return true;
596}
597
598inline std::shared_ptr<boost::asio::ssl::context> getSslServerContext()
599{
600 boost::asio::ssl::context sslCtx(boost::asio::ssl::context::tls_server);
601
602 auto certFile = ensureCertificate();
603 if (!getSslContext(sslCtx, certFile))
604 {
605 BMCWEB_LOG_CRITICAL("Couldn't get server context");
606 return nullptr;
607 }
Ed Tanous3281bcf2024-06-25 16:02:05 -0700608 const persistent_data::AuthConfigMethods& c =
609 persistent_data::SessionStore::getInstance().getAuthMethodsConfig();
Abhilash Rajud5fb5842024-06-03 11:40:17 -0500610
Ed Tanous3281bcf2024-06-25 16:02:05 -0700611 boost::asio::ssl::verify_mode mode = boost::asio::ssl::verify_peer;
612 if (c.tlsStrict)
613 {
614 BMCWEB_LOG_DEBUG("Setting verify peer");
615 mode |= boost::asio::ssl::verify_fail_if_no_peer_cert;
616 }
Abhilash Rajud5fb5842024-06-03 11:40:17 -0500617
Ed Tanous3281bcf2024-06-25 16:02:05 -0700618 boost::system::error_code ec;
619 sslCtx.set_verify_mode(mode, ec);
620 if (ec)
621 {
622 BMCWEB_LOG_DEBUG("Failed to set verify mode {}", ec.message());
623 return nullptr;
624 }
Abhilash Rajud5fb5842024-06-03 11:40:17 -0500625 SSL_CTX_set_options(sslCtx.native_handle(), SSL_OP_NO_RENEGOTIATION);
626
627 if constexpr (BMCWEB_EXPERIMENTAL_HTTP2)
628 {
629 SSL_CTX_set_next_protos_advertised_cb(sslCtx.native_handle(),
630 nextProtoCallback, nullptr);
631
632 SSL_CTX_set_alpn_select_cb(sslCtx.native_handle(),
633 alpnSelectProtoCallback, nullptr);
634 }
635
636 return std::make_shared<boost::asio::ssl::context>(std::move(sslCtx));
Ed Tanousc4771fb2017-03-13 13:39:49 -0700637}
AppaRao Pulie38778a2022-06-27 23:09:03 +0000638
639inline std::optional<boost::asio::ssl::context> getSSLClientContext()
640{
Abhilash Rajud5fb5842024-06-03 11:40:17 -0500641 namespace fs = std::filesystem;
642
AppaRao Pulie38778a2022-06-27 23:09:03 +0000643 boost::asio::ssl::context sslCtx(boost::asio::ssl::context::tls_client);
644
Abhilash Rajud5fb5842024-06-03 11:40:17 -0500645 // NOTE, this path is temporary; In the future it will need to change to
646 // be set per subscription. Do not rely on this.
647 fs::path certPath = "/etc/ssl/certs/https/client.pem";
648 std::string cert = verifyOpensslKeyCert(certPath);
AppaRao Pulie38778a2022-06-27 23:09:03 +0000649
Abhilash Rajud5fb5842024-06-03 11:40:17 -0500650 if (!getSslContext(sslCtx, cert))
AppaRao Pulie38778a2022-06-27 23:09:03 +0000651 {
AppaRao Pulie38778a2022-06-27 23:09:03 +0000652 return std::nullopt;
653 }
654
655 // Add a directory containing certificate authority files to be used
656 // for performing verification.
Abhilash Rajud5fb5842024-06-03 11:40:17 -0500657 boost::system::error_code ec;
AppaRao Pulie38778a2022-06-27 23:09:03 +0000658 sslCtx.set_default_verify_paths(ec);
659 if (ec)
660 {
Ed Tanous62598e32023-07-17 17:06:25 -0700661 BMCWEB_LOG_ERROR("SSL context set_default_verify failed");
AppaRao Pulie38778a2022-06-27 23:09:03 +0000662 return std::nullopt;
663 }
664
665 // Verify the remote server's certificate
666 sslCtx.set_verify_mode(boost::asio::ssl::verify_peer, ec);
667 if (ec)
668 {
Ed Tanous62598e32023-07-17 17:06:25 -0700669 BMCWEB_LOG_ERROR("SSL context set_verify_mode failed");
AppaRao Pulie38778a2022-06-27 23:09:03 +0000670 return std::nullopt;
671 }
672
673 // All cipher suites are set as per OWASP datasheet.
674 // https://cheatsheetseries.owasp.org/cheatsheets/TLS_Cipher_String_Cheat_Sheet.html
675 constexpr const char* sslCiphers = "ECDHE-ECDSA-AES128-GCM-SHA256:"
676 "ECDHE-RSA-AES128-GCM-SHA256:"
677 "ECDHE-ECDSA-AES256-GCM-SHA384:"
678 "ECDHE-RSA-AES256-GCM-SHA384:"
679 "ECDHE-ECDSA-CHACHA20-POLY1305:"
680 "ECDHE-RSA-CHACHA20-POLY1305:"
681 "DHE-RSA-AES128-GCM-SHA256:"
682 "DHE-RSA-AES256-GCM-SHA384"
683 "TLS_AES_128_GCM_SHA256:"
684 "TLS_AES_256_GCM_SHA384:"
685 "TLS_CHACHA20_POLY1305_SHA256";
686
687 if (SSL_CTX_set_cipher_list(sslCtx.native_handle(), sslCiphers) != 1)
688 {
Ed Tanous62598e32023-07-17 17:06:25 -0700689 BMCWEB_LOG_ERROR("SSL_CTX_set_cipher_list failed");
AppaRao Pulie38778a2022-06-27 23:09:03 +0000690 return std::nullopt;
691 }
692
Abhilash Rajud5fb5842024-06-03 11:40:17 -0500693 return {std::move(sslCtx)};
AppaRao Pulie38778a2022-06-27 23:09:03 +0000694}
695
Ed Tanous1abe55e2018-09-05 08:30:59 -0700696} // namespace ensuressl