blob: 7aa1c53008ea473cff196d808621de10289602cc [file] [log] [blame]
Ed Tanous0fdddb12017-02-28 11:06:34 -08001#pragma once
Ed Tanous55c7b7a2018-05-22 15:27:24 -07002#ifdef BMCWEB_ENABLE_SSL
Ed Tanous0fdddb12017-02-28 11:06:34 -08003
4#include <openssl/bio.h>
5#include <openssl/dh.h>
6#include <openssl/dsa.h>
Ed Tanous0fdddb12017-02-28 11:06:34 -08007#include <openssl/err.h>
8#include <openssl/evp.h>
9#include <openssl/pem.h>
10#include <openssl/rand.h>
11#include <openssl/rsa.h>
12#include <openssl/ssl.h>
Ed Tanous9b65f1f2017-03-07 15:17:13 -080013
Ed Tanous3112a142018-11-29 15:45:10 -080014#include <boost/asio/ssl/context.hpp>
Ed Tanous1abe55e2018-09-05 08:30:59 -070015#include <random>
16
17namespace ensuressl
18{
Ed Tanous55c7b7a2018-05-22 15:27:24 -070019static void initOpenssl();
Ed Tanousb01bf292019-03-25 19:25:26 +000020static void cleanupOpenssl();
21static EVP_PKEY *createRsaKey();
22static EVP_PKEY *createEcKey();
Ed Tanous55c7b7a2018-05-22 15:27:24 -070023static void handleOpensslError();
Ed Tanous0fdddb12017-02-28 11:06:34 -080024
Ed Tanous1abe55e2018-09-05 08:30:59 -070025inline bool verifyOpensslKeyCert(const std::string &filepath)
26{
27 bool privateKeyValid = false;
28 bool certValid = false;
Ed Tanous9b65f1f2017-03-07 15:17:13 -080029
Ed Tanous1abe55e2018-09-05 08:30:59 -070030 std::cout << "Checking certs in file " << filepath << "\n";
Ed Tanous9b65f1f2017-03-07 15:17:13 -080031
Ed Tanous1abe55e2018-09-05 08:30:59 -070032 FILE *file = fopen(filepath.c_str(), "r");
33 if (file != NULL)
34 {
35 EVP_PKEY *pkey = PEM_read_PrivateKey(file, NULL, NULL, NULL);
36 int rc;
37 if (pkey != nullptr)
38 {
39 RSA *rsa = EVP_PKEY_get1_RSA(pkey);
40 if (rsa != nullptr)
41 {
42 std::cout << "Found an RSA key\n";
43 if (RSA_check_key(rsa) == 1)
44 {
Jayanth Othayoth4d2849a2019-05-13 01:46:34 -050045 privateKeyValid = true;
Ed Tanous1abe55e2018-09-05 08:30:59 -070046 }
47 else
48 {
49 std::cerr << "Key not valid error number "
50 << ERR_get_error() << "\n";
51 }
52 RSA_free(rsa);
53 }
54 else
55 {
56 EC_KEY *ec = EVP_PKEY_get1_EC_KEY(pkey);
57 if (ec != nullptr)
58 {
59 std::cout << "Found an EC key\n";
60 if (EC_KEY_check_key(ec) == 1)
61 {
62 privateKeyValid = true;
63 }
64 else
65 {
66 std::cerr << "Key not valid error number "
67 << ERR_get_error() << "\n";
68 }
69 EC_KEY_free(ec);
70 }
71 }
72
73 if (privateKeyValid)
74 {
Ramesh Iyyarc0bf8932019-06-22 00:23:29 -050075 // If the order is certificate followed by key in input file
76 // then, certificate read will fail. So, setting the file
77 // pointer to point beginning of file to avoid certificate and
78 // key order issue.
79 fseek(file, 0, SEEK_SET);
80
Ed Tanous1abe55e2018-09-05 08:30:59 -070081 X509 *x509 = PEM_read_X509(file, NULL, NULL, NULL);
82 if (x509 == nullptr)
83 {
84 std::cout << "error getting x509 cert " << ERR_get_error()
85 << "\n";
86 }
87 else
88 {
89 rc = X509_verify(x509, pkey);
90 if (rc == 1)
91 {
92 certValid = true;
93 }
94 else
95 {
96 std::cerr << "Error in verifying private key signature "
97 << ERR_get_error() << "\n";
98 }
99 }
100 }
101
102 EVP_PKEY_free(pkey);
Ed Tanous9b65f1f2017-03-07 15:17:13 -0800103 }
Ed Tanous1abe55e2018-09-05 08:30:59 -0700104 fclose(file);
Ed Tanous0fdddb12017-02-28 11:06:34 -0800105 }
Ed Tanous1abe55e2018-09-05 08:30:59 -0700106 return certValid;
Ed Tanous0fdddb12017-02-28 11:06:34 -0800107}
108
Ed Tanous1abe55e2018-09-05 08:30:59 -0700109inline void generateSslCertificate(const std::string &filepath)
110{
111 FILE *pFile = NULL;
112 std::cout << "Generating new keys\n";
113 initOpenssl();
Ed Tanous0fdddb12017-02-28 11:06:34 -0800114
Ed Tanous1abe55e2018-09-05 08:30:59 -0700115 // std::cerr << "Generating RSA key";
116 // EVP_PKEY *pRsaPrivKey = create_rsa_key();
Ed Tanous0fdddb12017-02-28 11:06:34 -0800117
Ed Tanous1abe55e2018-09-05 08:30:59 -0700118 std::cerr << "Generating EC key\n";
Ed Tanousb01bf292019-03-25 19:25:26 +0000119 EVP_PKEY *pRsaPrivKey = createEcKey();
Ed Tanous1abe55e2018-09-05 08:30:59 -0700120 if (pRsaPrivKey != nullptr)
121 {
122 std::cerr << "Generating x509 Certificate\n";
123 // Use this code to directly generate a certificate
124 X509 *x509;
125 x509 = X509_new();
126 if (x509 != nullptr)
127 {
128 // get a random number from the RNG for the certificate serial
129 // number If this is not random, regenerating certs throws broswer
130 // errors
131 std::random_device rd;
132 int serial = rd();
Ed Tanous9b65f1f2017-03-07 15:17:13 -0800133
Ed Tanous1abe55e2018-09-05 08:30:59 -0700134 ASN1_INTEGER_set(X509_get_serialNumber(x509), serial);
Ed Tanous9b65f1f2017-03-07 15:17:13 -0800135
Ed Tanous1abe55e2018-09-05 08:30:59 -0700136 // not before this moment
137 X509_gmtime_adj(X509_get_notBefore(x509), 0);
138 // Cert is valid for 10 years
139 X509_gmtime_adj(X509_get_notAfter(x509),
140 60L * 60L * 24L * 365L * 10L);
Ed Tanous9b65f1f2017-03-07 15:17:13 -0800141
Ed Tanous1abe55e2018-09-05 08:30:59 -0700142 // set the public key to the key we just generated
143 X509_set_pubkey(x509, pRsaPrivKey);
Ed Tanous0fdddb12017-02-28 11:06:34 -0800144
Ed Tanous1abe55e2018-09-05 08:30:59 -0700145 // get the subject name
146 X509_NAME *name;
147 name = X509_get_subject_name(x509);
Ed Tanous0fdddb12017-02-28 11:06:34 -0800148
Ed Tanous1abe55e2018-09-05 08:30:59 -0700149 X509_NAME_add_entry_by_txt(
150 name, "C", MBSTRING_ASC,
151 reinterpret_cast<const unsigned char *>("US"), -1, -1, 0);
152 X509_NAME_add_entry_by_txt(
153 name, "O", MBSTRING_ASC,
Brad Bishop85d2bb52019-04-05 08:31:14 -0400154 reinterpret_cast<const unsigned char *>("OpenBMC"), -1, -1, 0);
Ed Tanous1abe55e2018-09-05 08:30:59 -0700155 X509_NAME_add_entry_by_txt(
156 name, "CN", MBSTRING_ASC,
157 reinterpret_cast<const unsigned char *>("testhost"), -1, -1, 0);
158 // set the CSR options
159 X509_set_issuer_name(x509, name);
Ed Tanous0fdddb12017-02-28 11:06:34 -0800160
Ed Tanous1abe55e2018-09-05 08:30:59 -0700161 // Sign the certificate with our private key
162 X509_sign(x509, pRsaPrivKey, EVP_sha256());
Ed Tanous0fdddb12017-02-28 11:06:34 -0800163
Ed Tanous1abe55e2018-09-05 08:30:59 -0700164 pFile = fopen(filepath.c_str(), "wt");
Ed Tanous0fdddb12017-02-28 11:06:34 -0800165
Ed Tanous1abe55e2018-09-05 08:30:59 -0700166 if (pFile != nullptr)
167 {
168 PEM_write_PrivateKey(pFile, pRsaPrivKey, NULL, NULL, 0, 0,
169 NULL);
Ed Tanous0fdddb12017-02-28 11:06:34 -0800170
Ed Tanous1abe55e2018-09-05 08:30:59 -0700171 PEM_write_X509(pFile, x509);
172 fclose(pFile);
173 pFile = NULL;
174 }
Ed Tanous0fdddb12017-02-28 11:06:34 -0800175
Ed Tanous1abe55e2018-09-05 08:30:59 -0700176 X509_free(x509);
177 }
178
179 EVP_PKEY_free(pRsaPrivKey);
180 pRsaPrivKey = NULL;
Ed Tanous0fdddb12017-02-28 11:06:34 -0800181 }
182
Ed Tanous1abe55e2018-09-05 08:30:59 -0700183 // cleanup_openssl();
Ed Tanous99923322017-03-03 14:21:24 -0800184}
Ed Tanousb01bf292019-03-25 19:25:26 +0000185
186EVP_PKEY *createRsaKey()
Ed Tanous1abe55e2018-09-05 08:30:59 -0700187{
188 RSA *pRSA = NULL;
Ed Tanousa1e077c2017-04-25 12:42:19 -0700189#if OPENSSL_VERSION_NUMBER < 0x00908000L
Ed Tanous1abe55e2018-09-05 08:30:59 -0700190 pRSA = RSA_generate_key(2048, RSA_3, NULL, NULL);
Ed Tanousa1e077c2017-04-25 12:42:19 -0700191#else
Ed Tanous1abe55e2018-09-05 08:30:59 -0700192 RSA_generate_key_ex(pRSA, 2048, NULL, NULL);
Ed Tanousa1e077c2017-04-25 12:42:19 -0700193#endif
194
Ed Tanousb01bf292019-03-25 19:25:26 +0000195 EVP_PKEY *pKey = EVP_PKEY_new();
196 if ((pRSA != nullptr) && (pKey != nullptr) &&
197 EVP_PKEY_assign_RSA(pKey, pRSA))
198 {
199 /* pKey owns pRSA from now */
200 if (RSA_check_key(pRSA) <= 0)
201 {
202 fprintf(stderr, "RSA_check_key failed.\n");
203 handleOpensslError();
204 EVP_PKEY_free(pKey);
205 pKey = NULL;
206 }
207 }
208 else
Ed Tanous1abe55e2018-09-05 08:30:59 -0700209 {
210 handleOpensslError();
211 if (pRSA != nullptr)
212 {
213 RSA_free(pRSA);
Ed Tanousb01bf292019-03-25 19:25:26 +0000214 pRSA = NULL;
Ed Tanous1abe55e2018-09-05 08:30:59 -0700215 }
216 if (pKey != nullptr)
217 {
218 EVP_PKEY_free(pKey);
Ed Tanousb01bf292019-03-25 19:25:26 +0000219 pKey = NULL;
Ed Tanous1abe55e2018-09-05 08:30:59 -0700220 }
221 }
Ed Tanousb01bf292019-03-25 19:25:26 +0000222 return pKey;
223}
Ed Tanous9b65f1f2017-03-07 15:17:13 -0800224
Ed Tanousb01bf292019-03-25 19:25:26 +0000225EVP_PKEY *createEcKey()
226{
227 EVP_PKEY *pKey = NULL;
228 int eccgrp = 0;
229 eccgrp = OBJ_txt2nid("prime256v1");
Ed Tanous6ea007a2019-02-13 22:48:25 -0800230
Ed Tanous6ea007a2019-02-13 22:48:25 -0800231 EC_KEY *myecc = EC_KEY_new_by_curve_name(eccgrp);
Ed Tanousb01bf292019-03-25 19:25:26 +0000232 if (myecc != nullptr)
Ed Tanous6ea007a2019-02-13 22:48:25 -0800233 {
Ed Tanousb01bf292019-03-25 19:25:26 +0000234 EC_KEY_set_asn1_flag(myecc, OPENSSL_EC_NAMED_CURVE);
235 EC_KEY_generate_key(myecc);
236 pKey = EVP_PKEY_new();
237 if (pKey != nullptr)
238 {
239 if (EVP_PKEY_assign_EC_KEY(pKey, myecc))
240 {
241 /* pKey owns pRSA from now */
242 if (EC_KEY_check_key(myecc) <= 0)
243 {
244 fprintf(stderr, "EC_check_key failed.\n");
245 }
246 }
247 }
Ed Tanous6ea007a2019-02-13 22:48:25 -0800248 }
Ed Tanous1abe55e2018-09-05 08:30:59 -0700249 return pKey;
250}
251
252void initOpenssl()
253{
Ed Tanous911ac312017-08-15 09:37:42 -0700254#if OPENSSL_VERSION_NUMBER < 0x10100000L
Ed Tanous1abe55e2018-09-05 08:30:59 -0700255 SSL_load_error_strings();
256 OpenSSL_add_all_algorithms();
257 RAND_load_file("/dev/urandom", 1024);
Ed Tanousa1e077c2017-04-25 12:42:19 -0700258#endif
Ed Tanous0fdddb12017-02-28 11:06:34 -0800259}
260
Ed Tanousb01bf292019-03-25 19:25:26 +0000261void cleanupOpenssl()
262{
263 CRYPTO_cleanup_all_ex_data();
264 ERR_free_strings();
265#if OPENSSL_VERSION_NUMBER < 0x10100000L
266 ERR_remove_thread_state(0);
267#endif
268 EVP_cleanup();
269}
270
Ed Tanous1abe55e2018-09-05 08:30:59 -0700271void handleOpensslError()
272{
273 ERR_print_errors_fp(stderr);
274}
275inline void ensureOpensslKeyPresentAndValid(const std::string &filepath)
276{
277 bool pemFileValid = false;
Ed Tanous0fdddb12017-02-28 11:06:34 -0800278
Ed Tanous1abe55e2018-09-05 08:30:59 -0700279 pemFileValid = verifyOpensslKeyCert(filepath);
Ed Tanous1ccd57c2017-03-21 13:15:58 -0700280
Ed Tanous1abe55e2018-09-05 08:30:59 -0700281 if (!pemFileValid)
282 {
283 std::cerr << "Error in verifying signature, regenerating\n";
284 generateSslCertificate(filepath);
285 }
Ed Tanous0fdddb12017-02-28 11:06:34 -0800286}
Ed Tanousc4771fb2017-03-13 13:39:49 -0700287
Marri Devender Rao5968cae2019-01-21 10:27:12 -0600288inline std::shared_ptr<boost::asio::ssl::context>
289 getSslContext(const std::string &ssl_pem_file)
Ed Tanous1abe55e2018-09-05 08:30:59 -0700290{
Marri Devender Rao5968cae2019-01-21 10:27:12 -0600291 std::shared_ptr<boost::asio::ssl::context> mSslContext =
292 std::make_shared<boost::asio::ssl::context>(
293 boost::asio::ssl::context::tls_server);
294 mSslContext->set_options(boost::asio::ssl::context::default_workarounds |
295 boost::asio::ssl::context::no_sslv2 |
296 boost::asio::ssl::context::no_sslv3 |
297 boost::asio::ssl::context::single_dh_use |
298 boost::asio::ssl::context::no_tlsv1 |
299 boost::asio::ssl::context::no_tlsv1_1);
Ed Tanousc4771fb2017-03-13 13:39:49 -0700300
Ed Tanous1abe55e2018-09-05 08:30:59 -0700301 // m_ssl_context.set_verify_mode(boost::asio::ssl::verify_peer);
Marri Devender Rao5968cae2019-01-21 10:27:12 -0600302 mSslContext->use_certificate_file(ssl_pem_file,
303 boost::asio::ssl::context::pem);
304 mSslContext->use_private_key_file(ssl_pem_file,
305 boost::asio::ssl::context::pem);
Ed Tanousc4771fb2017-03-13 13:39:49 -0700306
Ed Tanous1abe55e2018-09-05 08:30:59 -0700307 // Set up EC curves to auto (boost asio doesn't have a method for this)
308 // There is a pull request to add this. Once this is included in an asio
309 // drop, use the right way
310 // http://stackoverflow.com/questions/18929049/boost-asio-with-ecdsa-certificate-issue
Marri Devender Rao5968cae2019-01-21 10:27:12 -0600311 if (SSL_CTX_set_ecdh_auto(mSslContext->native_handle(), 1) != 1)
Ed Tanous1abe55e2018-09-05 08:30:59 -0700312 {
313 BMCWEB_LOG_ERROR << "Error setting tmp ecdh list\n";
314 }
Ed Tanousc4771fb2017-03-13 13:39:49 -0700315
Ed Tanous457207f2019-02-07 15:27:14 -0800316 std::string mozillaModern = "ECDHE-ECDSA-AES256-GCM-SHA384:"
317 "ECDHE-RSA-AES256-GCM-SHA384:"
318 "ECDHE-ECDSA-CHACHA20-POLY1305:"
319 "ECDHE-RSA-CHACHA20-POLY1305:"
320 "ECDHE-ECDSA-AES128-GCM-SHA256:"
321 "ECDHE-RSA-AES128-GCM-SHA256:"
322 "ECDHE-ECDSA-AES256-SHA384:"
323 "ECDHE-RSA-AES256-SHA384:"
324 "ECDHE-ECDSA-AES128-SHA256:"
325 "ECDHE-RSA-AES128-SHA256";
Ed Tanousc4771fb2017-03-13 13:39:49 -0700326
Marri Devender Rao5968cae2019-01-21 10:27:12 -0600327 if (SSL_CTX_set_cipher_list(mSslContext->native_handle(),
Ed Tanous457207f2019-02-07 15:27:14 -0800328 mozillaModern.c_str()) != 1)
Ed Tanous1abe55e2018-09-05 08:30:59 -0700329 {
330 BMCWEB_LOG_ERROR << "Error setting cipher list\n";
331 }
332 return mSslContext;
Ed Tanousc4771fb2017-03-13 13:39:49 -0700333}
Ed Tanous1abe55e2018-09-05 08:30:59 -0700334} // namespace ensuressl
Ed Tanous01250f22017-04-18 17:49:51 -0700335
Brad Bishop85d2bb52019-04-05 08:31:14 -0400336#endif