Ed Tanous | 0fdddb1 | 2017-02-28 11:06:34 -0800 | [diff] [blame] | 1 | #pragma once |
| 2 | |
| 3 | #include <openssl/bio.h> |
| 4 | #include <openssl/dh.h> |
| 5 | #include <openssl/dsa.h> |
Ed Tanous | 0fdddb1 | 2017-02-28 11:06:34 -0800 | [diff] [blame] | 6 | #include <openssl/err.h> |
| 7 | #include <openssl/evp.h> |
| 8 | #include <openssl/pem.h> |
| 9 | #include <openssl/rand.h> |
| 10 | #include <openssl/rsa.h> |
| 11 | #include <openssl/ssl.h> |
Ed Tanous | 9b65f1f | 2017-03-07 15:17:13 -0800 | [diff] [blame] | 12 | |
Ed Tanous | 3112a14 | 2018-11-29 15:45:10 -0800 | [diff] [blame] | 13 | #include <boost/asio/ssl/context.hpp> |
Nan Zhou | 97128e9 | 2021-08-17 12:01:55 -0700 | [diff] [blame] | 14 | #include <random.hpp> |
Gunnar Mills | 1214b7e | 2020-06-04 10:11:30 -0500 | [diff] [blame] | 15 | |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 16 | #include <random> |
| 17 | |
| 18 | namespace ensuressl |
| 19 | { |
Gunnar Mills | 1214b7e | 2020-06-04 10:11:30 -0500 | [diff] [blame] | 20 | constexpr char const* trustStorePath = "/etc/ssl/certs/authority"; |
Alan Kuo | a822070 | 2020-11-26 11:15:29 +0800 | [diff] [blame] | 21 | constexpr char const* x509Comment = "Generated from OpenBMC service"; |
Ed Tanous | 55c7b7a | 2018-05-22 15:27:24 -0700 | [diff] [blame] | 22 | static void initOpenssl(); |
Gunnar Mills | 1214b7e | 2020-06-04 10:11:30 -0500 | [diff] [blame] | 23 | static EVP_PKEY* createEcKey(); |
Ed Tanous | 0fdddb1 | 2017-02-28 11:06:34 -0800 | [diff] [blame] | 24 | |
Ramesh Iyyar | 082f28f | 2019-06-22 03:31:55 -0500 | [diff] [blame] | 25 | // Trust chain related errors.` |
| 26 | inline bool isTrustChainError(int errnum) |
| 27 | { |
| 28 | if ((errnum == X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT) || |
| 29 | (errnum == X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN) || |
| 30 | (errnum == X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY) || |
| 31 | (errnum == X509_V_ERR_CERT_UNTRUSTED) || |
| 32 | (errnum == X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE)) |
| 33 | { |
| 34 | return true; |
| 35 | } |
Ed Tanous | 3174e4d | 2020-10-07 11:41:22 -0700 | [diff] [blame] | 36 | return false; |
Ramesh Iyyar | 082f28f | 2019-06-22 03:31:55 -0500 | [diff] [blame] | 37 | } |
| 38 | |
Gunnar Mills | 1214b7e | 2020-06-04 10:11:30 -0500 | [diff] [blame] | 39 | inline bool validateCertificate(X509* const cert) |
Ramesh Iyyar | 082f28f | 2019-06-22 03:31:55 -0500 | [diff] [blame] | 40 | { |
| 41 | // Create an empty X509_STORE structure for certificate validation. |
Gunnar Mills | 1214b7e | 2020-06-04 10:11:30 -0500 | [diff] [blame] | 42 | X509_STORE* x509Store = X509_STORE_new(); |
Ramesh Iyyar | 082f28f | 2019-06-22 03:31:55 -0500 | [diff] [blame] | 43 | if (!x509Store) |
| 44 | { |
Gunnar Mills | c61704a | 2020-07-08 13:47:06 -0500 | [diff] [blame] | 45 | BMCWEB_LOG_ERROR << "Error occurred during X509_STORE_new call"; |
Ramesh Iyyar | 082f28f | 2019-06-22 03:31:55 -0500 | [diff] [blame] | 46 | return false; |
| 47 | } |
| 48 | |
| 49 | // Load Certificate file into the X509 structure. |
Gunnar Mills | 1214b7e | 2020-06-04 10:11:30 -0500 | [diff] [blame] | 50 | X509_STORE_CTX* storeCtx = X509_STORE_CTX_new(); |
Ramesh Iyyar | 082f28f | 2019-06-22 03:31:55 -0500 | [diff] [blame] | 51 | if (!storeCtx) |
| 52 | { |
Gunnar Mills | c61704a | 2020-07-08 13:47:06 -0500 | [diff] [blame] | 53 | BMCWEB_LOG_ERROR << "Error occurred during X509_STORE_CTX_new call"; |
Ramesh Iyyar | 082f28f | 2019-06-22 03:31:55 -0500 | [diff] [blame] | 54 | X509_STORE_free(x509Store); |
| 55 | return false; |
| 56 | } |
| 57 | |
Ed Tanous | 99131cd | 2019-10-24 11:12:47 -0700 | [diff] [blame] | 58 | int errCode = X509_STORE_CTX_init(storeCtx, x509Store, cert, nullptr); |
Ramesh Iyyar | 082f28f | 2019-06-22 03:31:55 -0500 | [diff] [blame] | 59 | if (errCode != 1) |
| 60 | { |
Gunnar Mills | c61704a | 2020-07-08 13:47:06 -0500 | [diff] [blame] | 61 | BMCWEB_LOG_ERROR << "Error occurred during X509_STORE_CTX_init call"; |
Ramesh Iyyar | 082f28f | 2019-06-22 03:31:55 -0500 | [diff] [blame] | 62 | X509_STORE_CTX_free(storeCtx); |
| 63 | X509_STORE_free(x509Store); |
| 64 | return false; |
| 65 | } |
| 66 | |
| 67 | errCode = X509_verify_cert(storeCtx); |
| 68 | if (errCode == 1) |
| 69 | { |
| 70 | BMCWEB_LOG_INFO << "Certificate verification is success"; |
| 71 | X509_STORE_CTX_free(storeCtx); |
| 72 | X509_STORE_free(x509Store); |
| 73 | return true; |
| 74 | } |
| 75 | if (errCode == 0) |
| 76 | { |
| 77 | errCode = X509_STORE_CTX_get_error(storeCtx); |
| 78 | X509_STORE_CTX_free(storeCtx); |
| 79 | X509_STORE_free(x509Store); |
| 80 | if (isTrustChainError(errCode)) |
| 81 | { |
| 82 | BMCWEB_LOG_DEBUG << "Ignoring Trust Chain error. Reason: " |
| 83 | << X509_verify_cert_error_string(errCode); |
| 84 | return true; |
| 85 | } |
Ed Tanous | 3174e4d | 2020-10-07 11:41:22 -0700 | [diff] [blame] | 86 | BMCWEB_LOG_ERROR << "Certificate verification failed. Reason: " |
| 87 | << X509_verify_cert_error_string(errCode); |
| 88 | return false; |
Ramesh Iyyar | 082f28f | 2019-06-22 03:31:55 -0500 | [diff] [blame] | 89 | } |
| 90 | |
| 91 | BMCWEB_LOG_ERROR |
Gunnar Mills | c61704a | 2020-07-08 13:47:06 -0500 | [diff] [blame] | 92 | << "Error occurred during X509_verify_cert call. ErrorCode: " |
| 93 | << errCode; |
Ramesh Iyyar | 082f28f | 2019-06-22 03:31:55 -0500 | [diff] [blame] | 94 | X509_STORE_CTX_free(storeCtx); |
| 95 | X509_STORE_free(x509Store); |
| 96 | return false; |
| 97 | } |
| 98 | |
Gunnar Mills | 1214b7e | 2020-06-04 10:11:30 -0500 | [diff] [blame] | 99 | inline bool verifyOpensslKeyCert(const std::string& filepath) |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 100 | { |
| 101 | bool privateKeyValid = false; |
| 102 | bool certValid = false; |
Ed Tanous | 9b65f1f | 2017-03-07 15:17:13 -0800 | [diff] [blame] | 103 | |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 104 | std::cout << "Checking certs in file " << filepath << "\n"; |
Ed Tanous | 9b65f1f | 2017-03-07 15:17:13 -0800 | [diff] [blame] | 105 | |
Gunnar Mills | 1214b7e | 2020-06-04 10:11:30 -0500 | [diff] [blame] | 106 | FILE* file = fopen(filepath.c_str(), "r"); |
Ed Tanous | 99131cd | 2019-10-24 11:12:47 -0700 | [diff] [blame] | 107 | if (file != nullptr) |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 108 | { |
Gunnar Mills | 1214b7e | 2020-06-04 10:11:30 -0500 | [diff] [blame] | 109 | EVP_PKEY* pkey = PEM_read_PrivateKey(file, nullptr, nullptr, nullptr); |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 110 | if (pkey != nullptr) |
| 111 | { |
Patrick Williams | 145bb76 | 2021-12-07 21:05:04 -0600 | [diff] [blame] | 112 | #if (OPENSSL_VERSION_NUMBER < 0x30000000L) |
Gunnar Mills | 1214b7e | 2020-06-04 10:11:30 -0500 | [diff] [blame] | 113 | RSA* rsa = EVP_PKEY_get1_RSA(pkey); |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 114 | if (rsa != nullptr) |
| 115 | { |
| 116 | std::cout << "Found an RSA key\n"; |
| 117 | if (RSA_check_key(rsa) == 1) |
| 118 | { |
Jayanth Othayoth | 4d2849a | 2019-05-13 01:46:34 -0500 | [diff] [blame] | 119 | privateKeyValid = true; |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 120 | } |
| 121 | else |
| 122 | { |
| 123 | std::cerr << "Key not valid error number " |
| 124 | << ERR_get_error() << "\n"; |
| 125 | } |
| 126 | RSA_free(rsa); |
| 127 | } |
| 128 | else |
| 129 | { |
Gunnar Mills | 1214b7e | 2020-06-04 10:11:30 -0500 | [diff] [blame] | 130 | EC_KEY* ec = EVP_PKEY_get1_EC_KEY(pkey); |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 131 | if (ec != nullptr) |
| 132 | { |
| 133 | std::cout << "Found an EC key\n"; |
| 134 | if (EC_KEY_check_key(ec) == 1) |
| 135 | { |
| 136 | privateKeyValid = true; |
| 137 | } |
| 138 | else |
| 139 | { |
| 140 | std::cerr << "Key not valid error number " |
| 141 | << ERR_get_error() << "\n"; |
| 142 | } |
| 143 | EC_KEY_free(ec); |
| 144 | } |
| 145 | } |
Patrick Williams | 145bb76 | 2021-12-07 21:05:04 -0600 | [diff] [blame] | 146 | #else |
Gunnar Mills | 91359f9 | 2022-01-04 14:50:18 -0600 | [diff] [blame] | 147 | EVP_PKEY_CTX* pkeyCtx = |
Patrick Williams | 145bb76 | 2021-12-07 21:05:04 -0600 | [diff] [blame] | 148 | EVP_PKEY_CTX_new_from_pkey(nullptr, pkey, nullptr); |
| 149 | |
Gunnar Mills | 91359f9 | 2022-01-04 14:50:18 -0600 | [diff] [blame] | 150 | if (!pkeyCtx) |
Patrick Williams | 145bb76 | 2021-12-07 21:05:04 -0600 | [diff] [blame] | 151 | { |
Gunnar Mills | 91359f9 | 2022-01-04 14:50:18 -0600 | [diff] [blame] | 152 | std::cerr << "Unable to allocate pkeyCtx " << ERR_get_error() |
Patrick Williams | 145bb76 | 2021-12-07 21:05:04 -0600 | [diff] [blame] | 153 | << "\n"; |
| 154 | } |
Gunnar Mills | 91359f9 | 2022-01-04 14:50:18 -0600 | [diff] [blame] | 155 | else if (EVP_PKEY_check(pkeyCtx) == 1) |
Patrick Williams | 145bb76 | 2021-12-07 21:05:04 -0600 | [diff] [blame] | 156 | { |
| 157 | privateKeyValid = true; |
| 158 | } |
| 159 | else |
| 160 | { |
| 161 | |
| 162 | std::cerr << "Key not valid error number " << ERR_get_error() |
| 163 | << "\n"; |
| 164 | } |
| 165 | #endif |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 166 | |
| 167 | if (privateKeyValid) |
| 168 | { |
Ramesh Iyyar | c0bf893 | 2019-06-22 00:23:29 -0500 | [diff] [blame] | 169 | // If the order is certificate followed by key in input file |
| 170 | // then, certificate read will fail. So, setting the file |
| 171 | // pointer to point beginning of file to avoid certificate and |
| 172 | // key order issue. |
| 173 | fseek(file, 0, SEEK_SET); |
| 174 | |
Gunnar Mills | 1214b7e | 2020-06-04 10:11:30 -0500 | [diff] [blame] | 175 | X509* x509 = PEM_read_X509(file, nullptr, nullptr, nullptr); |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 176 | if (x509 == nullptr) |
| 177 | { |
| 178 | std::cout << "error getting x509 cert " << ERR_get_error() |
| 179 | << "\n"; |
| 180 | } |
| 181 | else |
| 182 | { |
Ramesh Iyyar | 082f28f | 2019-06-22 03:31:55 -0500 | [diff] [blame] | 183 | certValid = validateCertificate(x509); |
| 184 | X509_free(x509); |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 185 | } |
| 186 | } |
| 187 | |
Patrick Williams | 145bb76 | 2021-12-07 21:05:04 -0600 | [diff] [blame] | 188 | #if (OPENSSL_VERSION_NUMBER > 0x30000000L) |
Gunnar Mills | 91359f9 | 2022-01-04 14:50:18 -0600 | [diff] [blame] | 189 | EVP_PKEY_CTX_free(pkeyCtx); |
Patrick Williams | 145bb76 | 2021-12-07 21:05:04 -0600 | [diff] [blame] | 190 | #endif |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 191 | EVP_PKEY_free(pkey); |
Ed Tanous | 9b65f1f | 2017-03-07 15:17:13 -0800 | [diff] [blame] | 192 | } |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 193 | fclose(file); |
Ed Tanous | 0fdddb1 | 2017-02-28 11:06:34 -0800 | [diff] [blame] | 194 | } |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 195 | return certValid; |
Ed Tanous | 0fdddb1 | 2017-02-28 11:06:34 -0800 | [diff] [blame] | 196 | } |
| 197 | |
Alan Kuo | a822070 | 2020-11-26 11:15:29 +0800 | [diff] [blame] | 198 | inline X509* loadCert(const std::string& filePath) |
| 199 | { |
| 200 | BIO* certFileBio = BIO_new_file(filePath.c_str(), "rb"); |
| 201 | if (!certFileBio) |
| 202 | { |
| 203 | BMCWEB_LOG_ERROR << "Error occured during BIO_new_file call, " |
| 204 | << "FILE= " << filePath; |
| 205 | return nullptr; |
| 206 | } |
| 207 | |
| 208 | X509* cert = X509_new(); |
| 209 | if (!cert) |
| 210 | { |
| 211 | BMCWEB_LOG_ERROR << "Error occured during X509_new call, " |
| 212 | << ERR_get_error(); |
| 213 | BIO_free(certFileBio); |
| 214 | return nullptr; |
| 215 | } |
| 216 | |
| 217 | if (!PEM_read_bio_X509(certFileBio, &cert, nullptr, nullptr)) |
| 218 | { |
| 219 | BMCWEB_LOG_ERROR << "Error occured during PEM_read_bio_X509 call, " |
| 220 | << "FILE= " << filePath; |
| 221 | |
| 222 | BIO_free(certFileBio); |
| 223 | X509_free(cert); |
| 224 | return nullptr; |
| 225 | } |
Alan Kuo | b295bf9 | 2021-04-16 14:16:47 +0800 | [diff] [blame] | 226 | BIO_free(certFileBio); |
Alan Kuo | a822070 | 2020-11-26 11:15:29 +0800 | [diff] [blame] | 227 | return cert; |
| 228 | } |
| 229 | |
| 230 | inline int addExt(X509* cert, int nid, const char* value) |
| 231 | { |
| 232 | X509_EXTENSION* ex = nullptr; |
Ed Tanous | b00dcc2 | 2021-02-23 12:52:50 -0800 | [diff] [blame] | 233 | X509V3_CTX ctx{}; |
Alan Kuo | a822070 | 2020-11-26 11:15:29 +0800 | [diff] [blame] | 234 | X509V3_set_ctx(&ctx, cert, cert, nullptr, nullptr, 0); |
Ed Tanous | 4ecc618 | 2022-01-07 09:36:26 -0800 | [diff] [blame^] | 235 | |
| 236 | // NOLINTNEXTLINE(cppcoreguidelines-pro-type-const-cast) |
Alan Kuo | a822070 | 2020-11-26 11:15:29 +0800 | [diff] [blame] | 237 | ex = X509V3_EXT_conf_nid(nullptr, &ctx, nid, const_cast<char*>(value)); |
| 238 | if (!ex) |
| 239 | { |
| 240 | BMCWEB_LOG_ERROR << "Error: In X509V3_EXT_conf_nidn: " << value; |
| 241 | return -1; |
| 242 | } |
| 243 | X509_add_ext(cert, ex, -1); |
| 244 | X509_EXTENSION_free(ex); |
| 245 | return 0; |
| 246 | } |
| 247 | |
| 248 | inline void generateSslCertificate(const std::string& filepath, |
| 249 | const std::string& cn) |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 250 | { |
Gunnar Mills | 1214b7e | 2020-06-04 10:11:30 -0500 | [diff] [blame] | 251 | FILE* pFile = nullptr; |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 252 | std::cout << "Generating new keys\n"; |
| 253 | initOpenssl(); |
Ed Tanous | 0fdddb1 | 2017-02-28 11:06:34 -0800 | [diff] [blame] | 254 | |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 255 | std::cerr << "Generating EC key\n"; |
Gunnar Mills | 1214b7e | 2020-06-04 10:11:30 -0500 | [diff] [blame] | 256 | EVP_PKEY* pPrivKey = createEcKey(); |
Vernon Mauery | 0185c7f | 2020-03-09 10:56:53 -0700 | [diff] [blame] | 257 | if (pPrivKey != nullptr) |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 258 | { |
| 259 | std::cerr << "Generating x509 Certificate\n"; |
| 260 | // Use this code to directly generate a certificate |
Ed Tanous | 543f440 | 2022-01-06 13:12:53 -0800 | [diff] [blame] | 261 | X509* x509 = X509_new(); |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 262 | if (x509 != nullptr) |
| 263 | { |
| 264 | // get a random number from the RNG for the certificate serial |
| 265 | // number If this is not random, regenerating certs throws broswer |
| 266 | // errors |
Alan Kuo | a822070 | 2020-11-26 11:15:29 +0800 | [diff] [blame] | 267 | bmcweb::OpenSSLGenerator gen; |
| 268 | std::uniform_int_distribution<int> dis( |
| 269 | 1, std::numeric_limits<int>::max()); |
| 270 | int serial = dis(gen); |
Ed Tanous | 9b65f1f | 2017-03-07 15:17:13 -0800 | [diff] [blame] | 271 | |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 272 | ASN1_INTEGER_set(X509_get_serialNumber(x509), serial); |
Ed Tanous | 9b65f1f | 2017-03-07 15:17:13 -0800 | [diff] [blame] | 273 | |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 274 | // not before this moment |
| 275 | X509_gmtime_adj(X509_get_notBefore(x509), 0); |
| 276 | // Cert is valid for 10 years |
| 277 | X509_gmtime_adj(X509_get_notAfter(x509), |
| 278 | 60L * 60L * 24L * 365L * 10L); |
Ed Tanous | 9b65f1f | 2017-03-07 15:17:13 -0800 | [diff] [blame] | 279 | |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 280 | // set the public key to the key we just generated |
Vernon Mauery | 0185c7f | 2020-03-09 10:56:53 -0700 | [diff] [blame] | 281 | X509_set_pubkey(x509, pPrivKey); |
Ed Tanous | 0fdddb1 | 2017-02-28 11:06:34 -0800 | [diff] [blame] | 282 | |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 283 | // get the subject name |
Ed Tanous | 543f440 | 2022-01-06 13:12:53 -0800 | [diff] [blame] | 284 | X509_NAME* name = X509_get_subject_name(x509); |
Ed Tanous | 0fdddb1 | 2017-02-28 11:06:34 -0800 | [diff] [blame] | 285 | |
Ed Tanous | 46ff87b | 2022-01-07 09:25:51 -0800 | [diff] [blame] | 286 | using x509String = const unsigned char; |
| 287 | // NOLINTNEXTLINE(cppcoreguidelines-pro-type-reinterpret-cast) |
| 288 | x509String* country = reinterpret_cast<x509String*>("US"); |
| 289 | // NOLINTNEXTLINE(cppcoreguidelines-pro-type-reinterpret-cast) |
| 290 | x509String* company = reinterpret_cast<x509String*>("OpenBMC"); |
| 291 | // NOLINTNEXTLINE(cppcoreguidelines-pro-type-reinterpret-cast) |
| 292 | x509String* cnStr = reinterpret_cast<x509String*>(cn.c_str()); |
| 293 | |
| 294 | X509_NAME_add_entry_by_txt(name, "C", MBSTRING_ASC, country, -1, -1, |
| 295 | 0); |
| 296 | X509_NAME_add_entry_by_txt(name, "O", MBSTRING_ASC, company, -1, -1, |
| 297 | 0); |
| 298 | X509_NAME_add_entry_by_txt(name, "CN", MBSTRING_ASC, cnStr, -1, -1, |
| 299 | 0); |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 300 | // set the CSR options |
| 301 | X509_set_issuer_name(x509, name); |
Ed Tanous | 0fdddb1 | 2017-02-28 11:06:34 -0800 | [diff] [blame] | 302 | |
Alan Kuo | a822070 | 2020-11-26 11:15:29 +0800 | [diff] [blame] | 303 | X509_set_version(x509, 2); |
| 304 | addExt(x509, NID_basic_constraints, ("critical,CA:TRUE")); |
| 305 | addExt(x509, NID_subject_alt_name, ("DNS:" + cn).c_str()); |
| 306 | addExt(x509, NID_subject_key_identifier, ("hash")); |
| 307 | addExt(x509, NID_authority_key_identifier, ("keyid")); |
| 308 | addExt(x509, NID_key_usage, ("digitalSignature, keyEncipherment")); |
| 309 | addExt(x509, NID_ext_key_usage, ("serverAuth")); |
| 310 | addExt(x509, NID_netscape_comment, (x509Comment)); |
| 311 | |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 312 | // Sign the certificate with our private key |
Vernon Mauery | 0185c7f | 2020-03-09 10:56:53 -0700 | [diff] [blame] | 313 | X509_sign(x509, pPrivKey, EVP_sha256()); |
Ed Tanous | 0fdddb1 | 2017-02-28 11:06:34 -0800 | [diff] [blame] | 314 | |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 315 | pFile = fopen(filepath.c_str(), "wt"); |
Ed Tanous | 0fdddb1 | 2017-02-28 11:06:34 -0800 | [diff] [blame] | 316 | |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 317 | if (pFile != nullptr) |
| 318 | { |
Vernon Mauery | 0185c7f | 2020-03-09 10:56:53 -0700 | [diff] [blame] | 319 | PEM_write_PrivateKey(pFile, pPrivKey, nullptr, nullptr, 0, |
Ed Tanous | 99131cd | 2019-10-24 11:12:47 -0700 | [diff] [blame] | 320 | nullptr, nullptr); |
Ed Tanous | 0fdddb1 | 2017-02-28 11:06:34 -0800 | [diff] [blame] | 321 | |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 322 | PEM_write_X509(pFile, x509); |
| 323 | fclose(pFile); |
Ed Tanous | 99131cd | 2019-10-24 11:12:47 -0700 | [diff] [blame] | 324 | pFile = nullptr; |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 325 | } |
Ed Tanous | 0fdddb1 | 2017-02-28 11:06:34 -0800 | [diff] [blame] | 326 | |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 327 | X509_free(x509); |
| 328 | } |
| 329 | |
Vernon Mauery | 0185c7f | 2020-03-09 10:56:53 -0700 | [diff] [blame] | 330 | EVP_PKEY_free(pPrivKey); |
| 331 | pPrivKey = nullptr; |
Ed Tanous | 0fdddb1 | 2017-02-28 11:06:34 -0800 | [diff] [blame] | 332 | } |
| 333 | |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 334 | // cleanup_openssl(); |
Ed Tanous | 9992332 | 2017-03-03 14:21:24 -0800 | [diff] [blame] | 335 | } |
Ed Tanous | b01bf29 | 2019-03-25 19:25:26 +0000 | [diff] [blame] | 336 | |
Gunnar Mills | 1214b7e | 2020-06-04 10:11:30 -0500 | [diff] [blame] | 337 | EVP_PKEY* createEcKey() |
Ed Tanous | b01bf29 | 2019-03-25 19:25:26 +0000 | [diff] [blame] | 338 | { |
Gunnar Mills | 1214b7e | 2020-06-04 10:11:30 -0500 | [diff] [blame] | 339 | EVP_PKEY* pKey = nullptr; |
Patrick Williams | aec7066 | 2021-12-13 16:55:46 -0600 | [diff] [blame] | 340 | |
| 341 | #if (OPENSSL_VERSION_NUMBER < 0x30000000L) |
Ed Tanous | b01bf29 | 2019-03-25 19:25:26 +0000 | [diff] [blame] | 342 | int eccgrp = 0; |
Vernon Mauery | aaf3206 | 2020-03-09 10:41:31 -0700 | [diff] [blame] | 343 | eccgrp = OBJ_txt2nid("secp384r1"); |
Ed Tanous | 6ea007a | 2019-02-13 22:48:25 -0800 | [diff] [blame] | 344 | |
Gunnar Mills | 1214b7e | 2020-06-04 10:11:30 -0500 | [diff] [blame] | 345 | EC_KEY* myecc = EC_KEY_new_by_curve_name(eccgrp); |
Ed Tanous | b01bf29 | 2019-03-25 19:25:26 +0000 | [diff] [blame] | 346 | if (myecc != nullptr) |
Ed Tanous | 6ea007a | 2019-02-13 22:48:25 -0800 | [diff] [blame] | 347 | { |
Ed Tanous | b01bf29 | 2019-03-25 19:25:26 +0000 | [diff] [blame] | 348 | EC_KEY_set_asn1_flag(myecc, OPENSSL_EC_NAMED_CURVE); |
| 349 | EC_KEY_generate_key(myecc); |
| 350 | pKey = EVP_PKEY_new(); |
| 351 | if (pKey != nullptr) |
| 352 | { |
| 353 | if (EVP_PKEY_assign_EC_KEY(pKey, myecc)) |
| 354 | { |
Vernon Mauery | 0185c7f | 2020-03-09 10:56:53 -0700 | [diff] [blame] | 355 | /* pKey owns myecc from now */ |
Ed Tanous | b01bf29 | 2019-03-25 19:25:26 +0000 | [diff] [blame] | 356 | if (EC_KEY_check_key(myecc) <= 0) |
| 357 | { |
| 358 | fprintf(stderr, "EC_check_key failed.\n"); |
| 359 | } |
| 360 | } |
| 361 | } |
Ed Tanous | 6ea007a | 2019-02-13 22:48:25 -0800 | [diff] [blame] | 362 | } |
Patrick Williams | aec7066 | 2021-12-13 16:55:46 -0600 | [diff] [blame] | 363 | #else |
| 364 | // Create context for curve parameter generation. |
| 365 | std::unique_ptr<EVP_PKEY_CTX, decltype(&::EVP_PKEY_CTX_free)> ctx{ |
| 366 | EVP_PKEY_CTX_new_id(EVP_PKEY_EC, nullptr), &::EVP_PKEY_CTX_free}; |
| 367 | if (!ctx) |
| 368 | { |
| 369 | return nullptr; |
| 370 | } |
| 371 | |
| 372 | // Set up curve parameters. |
| 373 | EVP_PKEY* params = nullptr; |
| 374 | if ((EVP_PKEY_paramgen_init(ctx.get()) <= 0) || |
| 375 | (EVP_PKEY_CTX_set_ec_param_enc(ctx.get(), OPENSSL_EC_NAMED_CURVE) <= |
| 376 | 0) || |
| 377 | (EVP_PKEY_CTX_set_ec_paramgen_curve_nid(ctx.get(), NID_secp384r1) <= |
| 378 | 0) || |
| 379 | (EVP_PKEY_paramgen(ctx.get(), ¶ms) <= 0)) |
| 380 | { |
| 381 | return nullptr; |
| 382 | } |
| 383 | |
| 384 | // Set up RAII holder for params. |
| 385 | std::unique_ptr<EVP_PKEY, decltype(&::EVP_PKEY_free)> pparams{ |
| 386 | params, &::EVP_PKEY_free}; |
| 387 | |
| 388 | // Set new context for key generation, using curve parameters. |
| 389 | ctx.reset(EVP_PKEY_CTX_new_from_pkey(nullptr, params, nullptr)); |
| 390 | if (!ctx || (EVP_PKEY_keygen_init(ctx.get()) <= 0)) |
| 391 | { |
| 392 | return nullptr; |
| 393 | } |
| 394 | |
| 395 | // Generate key. |
| 396 | if (EVP_PKEY_keygen(ctx.get(), &pKey) <= 0) |
| 397 | { |
| 398 | return nullptr; |
| 399 | } |
| 400 | #endif |
| 401 | |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 402 | return pKey; |
| 403 | } |
| 404 | |
| 405 | void initOpenssl() |
| 406 | { |
Ed Tanous | 911ac31 | 2017-08-15 09:37:42 -0700 | [diff] [blame] | 407 | #if OPENSSL_VERSION_NUMBER < 0x10100000L |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 408 | SSL_load_error_strings(); |
| 409 | OpenSSL_add_all_algorithms(); |
| 410 | RAND_load_file("/dev/urandom", 1024); |
Ed Tanous | a1e077c | 2017-04-25 12:42:19 -0700 | [diff] [blame] | 411 | #endif |
Ed Tanous | 0fdddb1 | 2017-02-28 11:06:34 -0800 | [diff] [blame] | 412 | } |
| 413 | |
Gunnar Mills | 1214b7e | 2020-06-04 10:11:30 -0500 | [diff] [blame] | 414 | inline void ensureOpensslKeyPresentAndValid(const std::string& filepath) |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 415 | { |
| 416 | bool pemFileValid = false; |
Ed Tanous | 0fdddb1 | 2017-02-28 11:06:34 -0800 | [diff] [blame] | 417 | |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 418 | pemFileValid = verifyOpensslKeyCert(filepath); |
Ed Tanous | 1ccd57c | 2017-03-21 13:15:58 -0700 | [diff] [blame] | 419 | |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 420 | if (!pemFileValid) |
| 421 | { |
| 422 | std::cerr << "Error in verifying signature, regenerating\n"; |
Alan Kuo | a822070 | 2020-11-26 11:15:29 +0800 | [diff] [blame] | 423 | generateSslCertificate(filepath, "testhost"); |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 424 | } |
Ed Tanous | 0fdddb1 | 2017-02-28 11:06:34 -0800 | [diff] [blame] | 425 | } |
Ed Tanous | c4771fb | 2017-03-13 13:39:49 -0700 | [diff] [blame] | 426 | |
Marri Devender Rao | 5968cae | 2019-01-21 10:27:12 -0600 | [diff] [blame] | 427 | inline std::shared_ptr<boost::asio::ssl::context> |
Ed Tanous | 81ce609 | 2020-12-17 16:54:55 +0000 | [diff] [blame] | 428 | getSslContext(const std::string& sslPemFile) |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 429 | { |
Marri Devender Rao | 5968cae | 2019-01-21 10:27:12 -0600 | [diff] [blame] | 430 | std::shared_ptr<boost::asio::ssl::context> mSslContext = |
| 431 | std::make_shared<boost::asio::ssl::context>( |
| 432 | boost::asio::ssl::context::tls_server); |
| 433 | mSslContext->set_options(boost::asio::ssl::context::default_workarounds | |
| 434 | boost::asio::ssl::context::no_sslv2 | |
| 435 | boost::asio::ssl::context::no_sslv3 | |
| 436 | boost::asio::ssl::context::single_dh_use | |
| 437 | boost::asio::ssl::context::no_tlsv1 | |
| 438 | boost::asio::ssl::context::no_tlsv1_1); |
Ed Tanous | c4771fb | 2017-03-13 13:39:49 -0700 | [diff] [blame] | 439 | |
James Feist | 91243c3 | 2019-11-12 14:55:40 -0800 | [diff] [blame] | 440 | // BIG WARNING: This needs to stay disabled, as there will always be |
| 441 | // unauthenticated endpoints |
| 442 | // mSslContext->set_verify_mode(boost::asio::ssl::verify_peer); |
Kowalski, Kamil | 55e43f6 | 2019-07-10 13:12:57 +0200 | [diff] [blame] | 443 | |
James Feist | 6a3e182 | 2019-11-06 13:46:35 -0800 | [diff] [blame] | 444 | SSL_CTX_set_options(mSslContext->native_handle(), SSL_OP_NO_RENEGOTIATION); |
| 445 | |
Kowalski, Kamil | 55e43f6 | 2019-07-10 13:12:57 +0200 | [diff] [blame] | 446 | BMCWEB_LOG_DEBUG << "Using default TrustStore location: " << trustStorePath; |
| 447 | mSslContext->add_verify_path(trustStorePath); |
| 448 | |
Ed Tanous | 81ce609 | 2020-12-17 16:54:55 +0000 | [diff] [blame] | 449 | mSslContext->use_certificate_file(sslPemFile, |
Marri Devender Rao | 5968cae | 2019-01-21 10:27:12 -0600 | [diff] [blame] | 450 | boost::asio::ssl::context::pem); |
Ed Tanous | 81ce609 | 2020-12-17 16:54:55 +0000 | [diff] [blame] | 451 | mSslContext->use_private_key_file(sslPemFile, |
Marri Devender Rao | 5968cae | 2019-01-21 10:27:12 -0600 | [diff] [blame] | 452 | boost::asio::ssl::context::pem); |
Ed Tanous | c4771fb | 2017-03-13 13:39:49 -0700 | [diff] [blame] | 453 | |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 454 | // Set up EC curves to auto (boost asio doesn't have a method for this) |
| 455 | // There is a pull request to add this. Once this is included in an asio |
| 456 | // drop, use the right way |
| 457 | // http://stackoverflow.com/questions/18929049/boost-asio-with-ecdsa-certificate-issue |
Marri Devender Rao | 5968cae | 2019-01-21 10:27:12 -0600 | [diff] [blame] | 458 | if (SSL_CTX_set_ecdh_auto(mSslContext->native_handle(), 1) != 1) |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 459 | { |
| 460 | BMCWEB_LOG_ERROR << "Error setting tmp ecdh list\n"; |
| 461 | } |
Ed Tanous | c4771fb | 2017-03-13 13:39:49 -0700 | [diff] [blame] | 462 | |
Ed Tanous | 457207f | 2019-02-07 15:27:14 -0800 | [diff] [blame] | 463 | std::string mozillaModern = "ECDHE-ECDSA-AES256-GCM-SHA384:" |
| 464 | "ECDHE-RSA-AES256-GCM-SHA384:" |
| 465 | "ECDHE-ECDSA-CHACHA20-POLY1305:" |
| 466 | "ECDHE-RSA-CHACHA20-POLY1305:" |
| 467 | "ECDHE-ECDSA-AES128-GCM-SHA256:" |
| 468 | "ECDHE-RSA-AES128-GCM-SHA256:" |
| 469 | "ECDHE-ECDSA-AES256-SHA384:" |
| 470 | "ECDHE-RSA-AES256-SHA384:" |
| 471 | "ECDHE-ECDSA-AES128-SHA256:" |
| 472 | "ECDHE-RSA-AES128-SHA256"; |
Ed Tanous | c4771fb | 2017-03-13 13:39:49 -0700 | [diff] [blame] | 473 | |
Marri Devender Rao | 5968cae | 2019-01-21 10:27:12 -0600 | [diff] [blame] | 474 | if (SSL_CTX_set_cipher_list(mSslContext->native_handle(), |
Ed Tanous | 457207f | 2019-02-07 15:27:14 -0800 | [diff] [blame] | 475 | mozillaModern.c_str()) != 1) |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 476 | { |
| 477 | BMCWEB_LOG_ERROR << "Error setting cipher list\n"; |
| 478 | } |
| 479 | return mSslContext; |
Ed Tanous | c4771fb | 2017-03-13 13:39:49 -0700 | [diff] [blame] | 480 | } |
Ed Tanous | 1abe55e | 2018-09-05 08:30:59 -0700 | [diff] [blame] | 481 | } // namespace ensuressl |