blob: 19d3ec7f604514248ec2c55aa097cef6dc1604c8 [file] [log] [blame]
Ed Tanous0fdddb12017-02-28 11:06:34 -08001#pragma once
Ed Tanous55c7b7a2018-05-22 15:27:24 -07002#ifdef BMCWEB_ENABLE_SSL
Ed Tanous0fdddb12017-02-28 11:06:34 -08003
4#include <openssl/bio.h>
5#include <openssl/dh.h>
6#include <openssl/dsa.h>
Ed Tanous0fdddb12017-02-28 11:06:34 -08007#include <openssl/err.h>
8#include <openssl/evp.h>
9#include <openssl/pem.h>
10#include <openssl/rand.h>
11#include <openssl/rsa.h>
12#include <openssl/ssl.h>
Ed Tanous9b65f1f2017-03-07 15:17:13 -080013
Ed Tanous3112a142018-11-29 15:45:10 -080014#include <boost/asio/ssl/context.hpp>
Gunnar Mills1214b7e2020-06-04 10:11:30 -050015
Ed Tanous1abe55e2018-09-05 08:30:59 -070016#include <random>
17
18namespace ensuressl
19{
Gunnar Mills1214b7e2020-06-04 10:11:30 -050020constexpr char const* trustStorePath = "/etc/ssl/certs/authority";
Ed Tanous55c7b7a2018-05-22 15:27:24 -070021static void initOpenssl();
Gunnar Mills1214b7e2020-06-04 10:11:30 -050022static EVP_PKEY* createEcKey();
Ed Tanous0fdddb12017-02-28 11:06:34 -080023
Ramesh Iyyar082f28f2019-06-22 03:31:55 -050024// Trust chain related errors.`
25inline bool isTrustChainError(int errnum)
26{
27 if ((errnum == X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT) ||
28 (errnum == X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN) ||
29 (errnum == X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY) ||
30 (errnum == X509_V_ERR_CERT_UNTRUSTED) ||
31 (errnum == X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE))
32 {
33 return true;
34 }
Ed Tanous3174e4d2020-10-07 11:41:22 -070035 return false;
Ramesh Iyyar082f28f2019-06-22 03:31:55 -050036}
37
Gunnar Mills1214b7e2020-06-04 10:11:30 -050038inline bool validateCertificate(X509* const cert)
Ramesh Iyyar082f28f2019-06-22 03:31:55 -050039{
40 // Create an empty X509_STORE structure for certificate validation.
Gunnar Mills1214b7e2020-06-04 10:11:30 -050041 X509_STORE* x509Store = X509_STORE_new();
Ramesh Iyyar082f28f2019-06-22 03:31:55 -050042 if (!x509Store)
43 {
Gunnar Millsc61704a2020-07-08 13:47:06 -050044 BMCWEB_LOG_ERROR << "Error occurred during X509_STORE_new call";
Ramesh Iyyar082f28f2019-06-22 03:31:55 -050045 return false;
46 }
47
48 // Load Certificate file into the X509 structure.
Gunnar Mills1214b7e2020-06-04 10:11:30 -050049 X509_STORE_CTX* storeCtx = X509_STORE_CTX_new();
Ramesh Iyyar082f28f2019-06-22 03:31:55 -050050 if (!storeCtx)
51 {
Gunnar Millsc61704a2020-07-08 13:47:06 -050052 BMCWEB_LOG_ERROR << "Error occurred during X509_STORE_CTX_new call";
Ramesh Iyyar082f28f2019-06-22 03:31:55 -050053 X509_STORE_free(x509Store);
54 return false;
55 }
56
Ed Tanous99131cd2019-10-24 11:12:47 -070057 int errCode = X509_STORE_CTX_init(storeCtx, x509Store, cert, nullptr);
Ramesh Iyyar082f28f2019-06-22 03:31:55 -050058 if (errCode != 1)
59 {
Gunnar Millsc61704a2020-07-08 13:47:06 -050060 BMCWEB_LOG_ERROR << "Error occurred during X509_STORE_CTX_init call";
Ramesh Iyyar082f28f2019-06-22 03:31:55 -050061 X509_STORE_CTX_free(storeCtx);
62 X509_STORE_free(x509Store);
63 return false;
64 }
65
66 errCode = X509_verify_cert(storeCtx);
67 if (errCode == 1)
68 {
69 BMCWEB_LOG_INFO << "Certificate verification is success";
70 X509_STORE_CTX_free(storeCtx);
71 X509_STORE_free(x509Store);
72 return true;
73 }
74 if (errCode == 0)
75 {
76 errCode = X509_STORE_CTX_get_error(storeCtx);
77 X509_STORE_CTX_free(storeCtx);
78 X509_STORE_free(x509Store);
79 if (isTrustChainError(errCode))
80 {
81 BMCWEB_LOG_DEBUG << "Ignoring Trust Chain error. Reason: "
82 << X509_verify_cert_error_string(errCode);
83 return true;
84 }
Ed Tanous3174e4d2020-10-07 11:41:22 -070085 BMCWEB_LOG_ERROR << "Certificate verification failed. Reason: "
86 << X509_verify_cert_error_string(errCode);
87 return false;
Ramesh Iyyar082f28f2019-06-22 03:31:55 -050088 }
89
90 BMCWEB_LOG_ERROR
Gunnar Millsc61704a2020-07-08 13:47:06 -050091 << "Error occurred during X509_verify_cert call. ErrorCode: "
92 << errCode;
Ramesh Iyyar082f28f2019-06-22 03:31:55 -050093 X509_STORE_CTX_free(storeCtx);
94 X509_STORE_free(x509Store);
95 return false;
96}
97
Gunnar Mills1214b7e2020-06-04 10:11:30 -050098inline bool verifyOpensslKeyCert(const std::string& filepath)
Ed Tanous1abe55e2018-09-05 08:30:59 -070099{
100 bool privateKeyValid = false;
101 bool certValid = false;
Ed Tanous9b65f1f2017-03-07 15:17:13 -0800102
Ed Tanous1abe55e2018-09-05 08:30:59 -0700103 std::cout << "Checking certs in file " << filepath << "\n";
Ed Tanous9b65f1f2017-03-07 15:17:13 -0800104
Gunnar Mills1214b7e2020-06-04 10:11:30 -0500105 FILE* file = fopen(filepath.c_str(), "r");
Ed Tanous99131cd2019-10-24 11:12:47 -0700106 if (file != nullptr)
Ed Tanous1abe55e2018-09-05 08:30:59 -0700107 {
Gunnar Mills1214b7e2020-06-04 10:11:30 -0500108 EVP_PKEY* pkey = PEM_read_PrivateKey(file, nullptr, nullptr, nullptr);
Ed Tanous1abe55e2018-09-05 08:30:59 -0700109 if (pkey != nullptr)
110 {
Gunnar Mills1214b7e2020-06-04 10:11:30 -0500111 RSA* rsa = EVP_PKEY_get1_RSA(pkey);
Ed Tanous1abe55e2018-09-05 08:30:59 -0700112 if (rsa != nullptr)
113 {
114 std::cout << "Found an RSA key\n";
115 if (RSA_check_key(rsa) == 1)
116 {
Jayanth Othayoth4d2849a2019-05-13 01:46:34 -0500117 privateKeyValid = true;
Ed Tanous1abe55e2018-09-05 08:30:59 -0700118 }
119 else
120 {
121 std::cerr << "Key not valid error number "
122 << ERR_get_error() << "\n";
123 }
124 RSA_free(rsa);
125 }
126 else
127 {
Gunnar Mills1214b7e2020-06-04 10:11:30 -0500128 EC_KEY* ec = EVP_PKEY_get1_EC_KEY(pkey);
Ed Tanous1abe55e2018-09-05 08:30:59 -0700129 if (ec != nullptr)
130 {
131 std::cout << "Found an EC key\n";
132 if (EC_KEY_check_key(ec) == 1)
133 {
134 privateKeyValid = true;
135 }
136 else
137 {
138 std::cerr << "Key not valid error number "
139 << ERR_get_error() << "\n";
140 }
141 EC_KEY_free(ec);
142 }
143 }
144
145 if (privateKeyValid)
146 {
Ramesh Iyyarc0bf8932019-06-22 00:23:29 -0500147 // If the order is certificate followed by key in input file
148 // then, certificate read will fail. So, setting the file
149 // pointer to point beginning of file to avoid certificate and
150 // key order issue.
151 fseek(file, 0, SEEK_SET);
152
Gunnar Mills1214b7e2020-06-04 10:11:30 -0500153 X509* x509 = PEM_read_X509(file, nullptr, nullptr, nullptr);
Ed Tanous1abe55e2018-09-05 08:30:59 -0700154 if (x509 == nullptr)
155 {
156 std::cout << "error getting x509 cert " << ERR_get_error()
157 << "\n";
158 }
159 else
160 {
Ramesh Iyyar082f28f2019-06-22 03:31:55 -0500161 certValid = validateCertificate(x509);
162 X509_free(x509);
Ed Tanous1abe55e2018-09-05 08:30:59 -0700163 }
164 }
165
166 EVP_PKEY_free(pkey);
Ed Tanous9b65f1f2017-03-07 15:17:13 -0800167 }
Ed Tanous1abe55e2018-09-05 08:30:59 -0700168 fclose(file);
Ed Tanous0fdddb12017-02-28 11:06:34 -0800169 }
Ed Tanous1abe55e2018-09-05 08:30:59 -0700170 return certValid;
Ed Tanous0fdddb12017-02-28 11:06:34 -0800171}
172
Gunnar Mills1214b7e2020-06-04 10:11:30 -0500173inline void generateSslCertificate(const std::string& filepath)
Ed Tanous1abe55e2018-09-05 08:30:59 -0700174{
Gunnar Mills1214b7e2020-06-04 10:11:30 -0500175 FILE* pFile = nullptr;
Ed Tanous1abe55e2018-09-05 08:30:59 -0700176 std::cout << "Generating new keys\n";
177 initOpenssl();
Ed Tanous0fdddb12017-02-28 11:06:34 -0800178
Ed Tanous1abe55e2018-09-05 08:30:59 -0700179 std::cerr << "Generating EC key\n";
Gunnar Mills1214b7e2020-06-04 10:11:30 -0500180 EVP_PKEY* pPrivKey = createEcKey();
Vernon Mauery0185c7f2020-03-09 10:56:53 -0700181 if (pPrivKey != nullptr)
Ed Tanous1abe55e2018-09-05 08:30:59 -0700182 {
183 std::cerr << "Generating x509 Certificate\n";
184 // Use this code to directly generate a certificate
Gunnar Mills1214b7e2020-06-04 10:11:30 -0500185 X509* x509;
Ed Tanous1abe55e2018-09-05 08:30:59 -0700186 x509 = X509_new();
187 if (x509 != nullptr)
188 {
189 // get a random number from the RNG for the certificate serial
190 // number If this is not random, regenerating certs throws broswer
191 // errors
192 std::random_device rd;
Ed Tanous271584a2019-07-09 16:24:22 -0700193 int serial = static_cast<int>(rd());
Ed Tanous9b65f1f2017-03-07 15:17:13 -0800194
Ed Tanous1abe55e2018-09-05 08:30:59 -0700195 ASN1_INTEGER_set(X509_get_serialNumber(x509), serial);
Ed Tanous9b65f1f2017-03-07 15:17:13 -0800196
Ed Tanous1abe55e2018-09-05 08:30:59 -0700197 // not before this moment
198 X509_gmtime_adj(X509_get_notBefore(x509), 0);
199 // Cert is valid for 10 years
200 X509_gmtime_adj(X509_get_notAfter(x509),
201 60L * 60L * 24L * 365L * 10L);
Ed Tanous9b65f1f2017-03-07 15:17:13 -0800202
Ed Tanous1abe55e2018-09-05 08:30:59 -0700203 // set the public key to the key we just generated
Vernon Mauery0185c7f2020-03-09 10:56:53 -0700204 X509_set_pubkey(x509, pPrivKey);
Ed Tanous0fdddb12017-02-28 11:06:34 -0800205
Ed Tanous1abe55e2018-09-05 08:30:59 -0700206 // get the subject name
Gunnar Mills1214b7e2020-06-04 10:11:30 -0500207 X509_NAME* name;
Ed Tanous1abe55e2018-09-05 08:30:59 -0700208 name = X509_get_subject_name(x509);
Ed Tanous0fdddb12017-02-28 11:06:34 -0800209
Ed Tanous1abe55e2018-09-05 08:30:59 -0700210 X509_NAME_add_entry_by_txt(
211 name, "C", MBSTRING_ASC,
Gunnar Mills1214b7e2020-06-04 10:11:30 -0500212 reinterpret_cast<const unsigned char*>("US"), -1, -1, 0);
Ed Tanous1abe55e2018-09-05 08:30:59 -0700213 X509_NAME_add_entry_by_txt(
214 name, "O", MBSTRING_ASC,
Gunnar Mills1214b7e2020-06-04 10:11:30 -0500215 reinterpret_cast<const unsigned char*>("OpenBMC"), -1, -1, 0);
Ed Tanous1abe55e2018-09-05 08:30:59 -0700216 X509_NAME_add_entry_by_txt(
217 name, "CN", MBSTRING_ASC,
Gunnar Mills1214b7e2020-06-04 10:11:30 -0500218 reinterpret_cast<const unsigned char*>("testhost"), -1, -1, 0);
Ed Tanous1abe55e2018-09-05 08:30:59 -0700219 // set the CSR options
220 X509_set_issuer_name(x509, name);
Ed Tanous0fdddb12017-02-28 11:06:34 -0800221
Ed Tanous1abe55e2018-09-05 08:30:59 -0700222 // Sign the certificate with our private key
Vernon Mauery0185c7f2020-03-09 10:56:53 -0700223 X509_sign(x509, pPrivKey, EVP_sha256());
Ed Tanous0fdddb12017-02-28 11:06:34 -0800224
Ed Tanous1abe55e2018-09-05 08:30:59 -0700225 pFile = fopen(filepath.c_str(), "wt");
Ed Tanous0fdddb12017-02-28 11:06:34 -0800226
Ed Tanous1abe55e2018-09-05 08:30:59 -0700227 if (pFile != nullptr)
228 {
Vernon Mauery0185c7f2020-03-09 10:56:53 -0700229 PEM_write_PrivateKey(pFile, pPrivKey, nullptr, nullptr, 0,
Ed Tanous99131cd2019-10-24 11:12:47 -0700230 nullptr, nullptr);
Ed Tanous0fdddb12017-02-28 11:06:34 -0800231
Ed Tanous1abe55e2018-09-05 08:30:59 -0700232 PEM_write_X509(pFile, x509);
233 fclose(pFile);
Ed Tanous99131cd2019-10-24 11:12:47 -0700234 pFile = nullptr;
Ed Tanous1abe55e2018-09-05 08:30:59 -0700235 }
Ed Tanous0fdddb12017-02-28 11:06:34 -0800236
Ed Tanous1abe55e2018-09-05 08:30:59 -0700237 X509_free(x509);
238 }
239
Vernon Mauery0185c7f2020-03-09 10:56:53 -0700240 EVP_PKEY_free(pPrivKey);
241 pPrivKey = nullptr;
Ed Tanous0fdddb12017-02-28 11:06:34 -0800242 }
243
Ed Tanous1abe55e2018-09-05 08:30:59 -0700244 // cleanup_openssl();
Ed Tanous99923322017-03-03 14:21:24 -0800245}
Ed Tanousb01bf292019-03-25 19:25:26 +0000246
Gunnar Mills1214b7e2020-06-04 10:11:30 -0500247EVP_PKEY* createEcKey()
Ed Tanousb01bf292019-03-25 19:25:26 +0000248{
Gunnar Mills1214b7e2020-06-04 10:11:30 -0500249 EVP_PKEY* pKey = nullptr;
Ed Tanousb01bf292019-03-25 19:25:26 +0000250 int eccgrp = 0;
Vernon Maueryaaf32062020-03-09 10:41:31 -0700251 eccgrp = OBJ_txt2nid("secp384r1");
Ed Tanous6ea007a2019-02-13 22:48:25 -0800252
Gunnar Mills1214b7e2020-06-04 10:11:30 -0500253 EC_KEY* myecc = EC_KEY_new_by_curve_name(eccgrp);
Ed Tanousb01bf292019-03-25 19:25:26 +0000254 if (myecc != nullptr)
Ed Tanous6ea007a2019-02-13 22:48:25 -0800255 {
Ed Tanousb01bf292019-03-25 19:25:26 +0000256 EC_KEY_set_asn1_flag(myecc, OPENSSL_EC_NAMED_CURVE);
257 EC_KEY_generate_key(myecc);
258 pKey = EVP_PKEY_new();
259 if (pKey != nullptr)
260 {
261 if (EVP_PKEY_assign_EC_KEY(pKey, myecc))
262 {
Vernon Mauery0185c7f2020-03-09 10:56:53 -0700263 /* pKey owns myecc from now */
Ed Tanousb01bf292019-03-25 19:25:26 +0000264 if (EC_KEY_check_key(myecc) <= 0)
265 {
266 fprintf(stderr, "EC_check_key failed.\n");
267 }
268 }
269 }
Ed Tanous6ea007a2019-02-13 22:48:25 -0800270 }
Ed Tanous1abe55e2018-09-05 08:30:59 -0700271 return pKey;
272}
273
274void initOpenssl()
275{
Ed Tanous911ac312017-08-15 09:37:42 -0700276#if OPENSSL_VERSION_NUMBER < 0x10100000L
Ed Tanous1abe55e2018-09-05 08:30:59 -0700277 SSL_load_error_strings();
278 OpenSSL_add_all_algorithms();
279 RAND_load_file("/dev/urandom", 1024);
Ed Tanousa1e077c2017-04-25 12:42:19 -0700280#endif
Ed Tanous0fdddb12017-02-28 11:06:34 -0800281}
282
Gunnar Mills1214b7e2020-06-04 10:11:30 -0500283inline void ensureOpensslKeyPresentAndValid(const std::string& filepath)
Ed Tanous1abe55e2018-09-05 08:30:59 -0700284{
285 bool pemFileValid = false;
Ed Tanous0fdddb12017-02-28 11:06:34 -0800286
Ed Tanous1abe55e2018-09-05 08:30:59 -0700287 pemFileValid = verifyOpensslKeyCert(filepath);
Ed Tanous1ccd57c2017-03-21 13:15:58 -0700288
Ed Tanous1abe55e2018-09-05 08:30:59 -0700289 if (!pemFileValid)
290 {
291 std::cerr << "Error in verifying signature, regenerating\n";
292 generateSslCertificate(filepath);
293 }
Ed Tanous0fdddb12017-02-28 11:06:34 -0800294}
Ed Tanousc4771fb2017-03-13 13:39:49 -0700295
Marri Devender Rao5968cae2019-01-21 10:27:12 -0600296inline std::shared_ptr<boost::asio::ssl::context>
Gunnar Mills1214b7e2020-06-04 10:11:30 -0500297 getSslContext(const std::string& ssl_pem_file)
Ed Tanous1abe55e2018-09-05 08:30:59 -0700298{
Marri Devender Rao5968cae2019-01-21 10:27:12 -0600299 std::shared_ptr<boost::asio::ssl::context> mSslContext =
300 std::make_shared<boost::asio::ssl::context>(
301 boost::asio::ssl::context::tls_server);
302 mSslContext->set_options(boost::asio::ssl::context::default_workarounds |
303 boost::asio::ssl::context::no_sslv2 |
304 boost::asio::ssl::context::no_sslv3 |
305 boost::asio::ssl::context::single_dh_use |
306 boost::asio::ssl::context::no_tlsv1 |
307 boost::asio::ssl::context::no_tlsv1_1);
Ed Tanousc4771fb2017-03-13 13:39:49 -0700308
James Feist91243c32019-11-12 14:55:40 -0800309 // BIG WARNING: This needs to stay disabled, as there will always be
310 // unauthenticated endpoints
311 // mSslContext->set_verify_mode(boost::asio::ssl::verify_peer);
Kowalski, Kamil55e43f62019-07-10 13:12:57 +0200312
James Feist6a3e1822019-11-06 13:46:35 -0800313 SSL_CTX_set_options(mSslContext->native_handle(), SSL_OP_NO_RENEGOTIATION);
314
Kowalski, Kamil55e43f62019-07-10 13:12:57 +0200315 BMCWEB_LOG_DEBUG << "Using default TrustStore location: " << trustStorePath;
316 mSslContext->add_verify_path(trustStorePath);
317
Marri Devender Rao5968cae2019-01-21 10:27:12 -0600318 mSslContext->use_certificate_file(ssl_pem_file,
319 boost::asio::ssl::context::pem);
320 mSslContext->use_private_key_file(ssl_pem_file,
321 boost::asio::ssl::context::pem);
Ed Tanousc4771fb2017-03-13 13:39:49 -0700322
Ed Tanous1abe55e2018-09-05 08:30:59 -0700323 // Set up EC curves to auto (boost asio doesn't have a method for this)
324 // There is a pull request to add this. Once this is included in an asio
325 // drop, use the right way
326 // http://stackoverflow.com/questions/18929049/boost-asio-with-ecdsa-certificate-issue
Marri Devender Rao5968cae2019-01-21 10:27:12 -0600327 if (SSL_CTX_set_ecdh_auto(mSslContext->native_handle(), 1) != 1)
Ed Tanous1abe55e2018-09-05 08:30:59 -0700328 {
329 BMCWEB_LOG_ERROR << "Error setting tmp ecdh list\n";
330 }
Ed Tanousc4771fb2017-03-13 13:39:49 -0700331
Ed Tanous457207f2019-02-07 15:27:14 -0800332 std::string mozillaModern = "ECDHE-ECDSA-AES256-GCM-SHA384:"
333 "ECDHE-RSA-AES256-GCM-SHA384:"
334 "ECDHE-ECDSA-CHACHA20-POLY1305:"
335 "ECDHE-RSA-CHACHA20-POLY1305:"
336 "ECDHE-ECDSA-AES128-GCM-SHA256:"
337 "ECDHE-RSA-AES128-GCM-SHA256:"
338 "ECDHE-ECDSA-AES256-SHA384:"
339 "ECDHE-RSA-AES256-SHA384:"
340 "ECDHE-ECDSA-AES128-SHA256:"
341 "ECDHE-RSA-AES128-SHA256";
Ed Tanousc4771fb2017-03-13 13:39:49 -0700342
Marri Devender Rao5968cae2019-01-21 10:27:12 -0600343 if (SSL_CTX_set_cipher_list(mSslContext->native_handle(),
Ed Tanous457207f2019-02-07 15:27:14 -0800344 mozillaModern.c_str()) != 1)
Ed Tanous1abe55e2018-09-05 08:30:59 -0700345 {
346 BMCWEB_LOG_ERROR << "Error setting cipher list\n";
347 }
348 return mSslContext;
Ed Tanousc4771fb2017-03-13 13:39:49 -0700349}
Ed Tanous1abe55e2018-09-05 08:30:59 -0700350} // namespace ensuressl
Ed Tanous01250f22017-04-18 17:49:51 -0700351
Brad Bishop85d2bb52019-04-05 08:31:14 -0400352#endif