blob: fab31eae0a30b3780379d20e6545bdc5a6844535 [file] [log] [blame]
Ed Tanous0fdddb12017-02-28 11:06:34 -08001#pragma once
Ed Tanous55c7b7a2018-05-22 15:27:24 -07002#ifdef BMCWEB_ENABLE_SSL
Ed Tanous0fdddb12017-02-28 11:06:34 -08003
4#include <openssl/bio.h>
5#include <openssl/dh.h>
6#include <openssl/dsa.h>
Ed Tanous0fdddb12017-02-28 11:06:34 -08007#include <openssl/err.h>
8#include <openssl/evp.h>
9#include <openssl/pem.h>
10#include <openssl/rand.h>
11#include <openssl/rsa.h>
12#include <openssl/ssl.h>
Ed Tanous9b65f1f2017-03-07 15:17:13 -080013
Ed Tanous3112a142018-11-29 15:45:10 -080014#include <boost/asio/ssl/context.hpp>
Ed Tanous1abe55e2018-09-05 08:30:59 -070015#include <random>
16
17namespace ensuressl
18{
Kowalski, Kamil55e43f62019-07-10 13:12:57 +020019constexpr char const *trustStorePath = "/etc/ssl/certs/authority";
Ed Tanous55c7b7a2018-05-22 15:27:24 -070020static void initOpenssl();
Ed Tanousb01bf292019-03-25 19:25:26 +000021static EVP_PKEY *createEcKey();
Ed Tanous0fdddb12017-02-28 11:06:34 -080022
Ramesh Iyyar082f28f2019-06-22 03:31:55 -050023// Trust chain related errors.`
24inline bool isTrustChainError(int errnum)
25{
26 if ((errnum == X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT) ||
27 (errnum == X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN) ||
28 (errnum == X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY) ||
29 (errnum == X509_V_ERR_CERT_UNTRUSTED) ||
30 (errnum == X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE))
31 {
32 return true;
33 }
34 else
35 {
36 return false;
37 }
38}
39
40inline bool validateCertificate(X509 *const cert)
41{
42 // Create an empty X509_STORE structure for certificate validation.
43 X509_STORE *x509Store = X509_STORE_new();
44 if (!x509Store)
45 {
46 BMCWEB_LOG_ERROR << "Error occured during X509_STORE_new call";
47 return false;
48 }
49
50 // Load Certificate file into the X509 structure.
51 X509_STORE_CTX *storeCtx = X509_STORE_CTX_new();
52 if (!storeCtx)
53 {
54 BMCWEB_LOG_ERROR << "Error occured during X509_STORE_CTX_new call";
55 X509_STORE_free(x509Store);
56 return false;
57 }
58
Ed Tanous99131cd2019-10-24 11:12:47 -070059 int errCode = X509_STORE_CTX_init(storeCtx, x509Store, cert, nullptr);
Ramesh Iyyar082f28f2019-06-22 03:31:55 -050060 if (errCode != 1)
61 {
62 BMCWEB_LOG_ERROR << "Error occured during X509_STORE_CTX_init call";
63 X509_STORE_CTX_free(storeCtx);
64 X509_STORE_free(x509Store);
65 return false;
66 }
67
68 errCode = X509_verify_cert(storeCtx);
69 if (errCode == 1)
70 {
71 BMCWEB_LOG_INFO << "Certificate verification is success";
72 X509_STORE_CTX_free(storeCtx);
73 X509_STORE_free(x509Store);
74 return true;
75 }
76 if (errCode == 0)
77 {
78 errCode = X509_STORE_CTX_get_error(storeCtx);
79 X509_STORE_CTX_free(storeCtx);
80 X509_STORE_free(x509Store);
81 if (isTrustChainError(errCode))
82 {
83 BMCWEB_LOG_DEBUG << "Ignoring Trust Chain error. Reason: "
84 << X509_verify_cert_error_string(errCode);
85 return true;
86 }
87 else
88 {
89 BMCWEB_LOG_ERROR << "Certificate verification failed. Reason: "
90 << X509_verify_cert_error_string(errCode);
91 return false;
92 }
93 }
94
95 BMCWEB_LOG_ERROR
96 << "Error occured during X509_verify_cert call. ErrorCode: " << errCode;
97 X509_STORE_CTX_free(storeCtx);
98 X509_STORE_free(x509Store);
99 return false;
100}
101
Ed Tanous1abe55e2018-09-05 08:30:59 -0700102inline bool verifyOpensslKeyCert(const std::string &filepath)
103{
104 bool privateKeyValid = false;
105 bool certValid = false;
Ed Tanous9b65f1f2017-03-07 15:17:13 -0800106
Ed Tanous1abe55e2018-09-05 08:30:59 -0700107 std::cout << "Checking certs in file " << filepath << "\n";
Ed Tanous9b65f1f2017-03-07 15:17:13 -0800108
Ed Tanous1abe55e2018-09-05 08:30:59 -0700109 FILE *file = fopen(filepath.c_str(), "r");
Ed Tanous99131cd2019-10-24 11:12:47 -0700110 if (file != nullptr)
Ed Tanous1abe55e2018-09-05 08:30:59 -0700111 {
Ed Tanous99131cd2019-10-24 11:12:47 -0700112 EVP_PKEY *pkey = PEM_read_PrivateKey(file, nullptr, nullptr, nullptr);
Ed Tanous1abe55e2018-09-05 08:30:59 -0700113 if (pkey != nullptr)
114 {
115 RSA *rsa = EVP_PKEY_get1_RSA(pkey);
116 if (rsa != nullptr)
117 {
118 std::cout << "Found an RSA key\n";
119 if (RSA_check_key(rsa) == 1)
120 {
Jayanth Othayoth4d2849a2019-05-13 01:46:34 -0500121 privateKeyValid = true;
Ed Tanous1abe55e2018-09-05 08:30:59 -0700122 }
123 else
124 {
125 std::cerr << "Key not valid error number "
126 << ERR_get_error() << "\n";
127 }
128 RSA_free(rsa);
129 }
130 else
131 {
132 EC_KEY *ec = EVP_PKEY_get1_EC_KEY(pkey);
133 if (ec != nullptr)
134 {
135 std::cout << "Found an EC key\n";
136 if (EC_KEY_check_key(ec) == 1)
137 {
138 privateKeyValid = true;
139 }
140 else
141 {
142 std::cerr << "Key not valid error number "
143 << ERR_get_error() << "\n";
144 }
145 EC_KEY_free(ec);
146 }
147 }
148
149 if (privateKeyValid)
150 {
Ramesh Iyyarc0bf8932019-06-22 00:23:29 -0500151 // If the order is certificate followed by key in input file
152 // then, certificate read will fail. So, setting the file
153 // pointer to point beginning of file to avoid certificate and
154 // key order issue.
155 fseek(file, 0, SEEK_SET);
156
Ed Tanous99131cd2019-10-24 11:12:47 -0700157 X509 *x509 = PEM_read_X509(file, nullptr, nullptr, nullptr);
Ed Tanous1abe55e2018-09-05 08:30:59 -0700158 if (x509 == nullptr)
159 {
160 std::cout << "error getting x509 cert " << ERR_get_error()
161 << "\n";
162 }
163 else
164 {
Ramesh Iyyar082f28f2019-06-22 03:31:55 -0500165 certValid = validateCertificate(x509);
166 X509_free(x509);
Ed Tanous1abe55e2018-09-05 08:30:59 -0700167 }
168 }
169
170 EVP_PKEY_free(pkey);
Ed Tanous9b65f1f2017-03-07 15:17:13 -0800171 }
Ed Tanous1abe55e2018-09-05 08:30:59 -0700172 fclose(file);
Ed Tanous0fdddb12017-02-28 11:06:34 -0800173 }
Ed Tanous1abe55e2018-09-05 08:30:59 -0700174 return certValid;
Ed Tanous0fdddb12017-02-28 11:06:34 -0800175}
176
Ed Tanous1abe55e2018-09-05 08:30:59 -0700177inline void generateSslCertificate(const std::string &filepath)
178{
Ed Tanous99131cd2019-10-24 11:12:47 -0700179 FILE *pFile = nullptr;
Ed Tanous1abe55e2018-09-05 08:30:59 -0700180 std::cout << "Generating new keys\n";
181 initOpenssl();
Ed Tanous0fdddb12017-02-28 11:06:34 -0800182
Ed Tanous1abe55e2018-09-05 08:30:59 -0700183 // std::cerr << "Generating RSA key";
184 // EVP_PKEY *pRsaPrivKey = create_rsa_key();
Ed Tanous0fdddb12017-02-28 11:06:34 -0800185
Ed Tanous1abe55e2018-09-05 08:30:59 -0700186 std::cerr << "Generating EC key\n";
Ed Tanousb01bf292019-03-25 19:25:26 +0000187 EVP_PKEY *pRsaPrivKey = createEcKey();
Ed Tanous1abe55e2018-09-05 08:30:59 -0700188 if (pRsaPrivKey != nullptr)
189 {
190 std::cerr << "Generating x509 Certificate\n";
191 // Use this code to directly generate a certificate
192 X509 *x509;
193 x509 = X509_new();
194 if (x509 != nullptr)
195 {
196 // get a random number from the RNG for the certificate serial
197 // number If this is not random, regenerating certs throws broswer
198 // errors
199 std::random_device rd;
Ed Tanous271584a2019-07-09 16:24:22 -0700200 int serial = static_cast<int>(rd());
Ed Tanous9b65f1f2017-03-07 15:17:13 -0800201
Ed Tanous1abe55e2018-09-05 08:30:59 -0700202 ASN1_INTEGER_set(X509_get_serialNumber(x509), serial);
Ed Tanous9b65f1f2017-03-07 15:17:13 -0800203
Ed Tanous1abe55e2018-09-05 08:30:59 -0700204 // not before this moment
205 X509_gmtime_adj(X509_get_notBefore(x509), 0);
206 // Cert is valid for 10 years
207 X509_gmtime_adj(X509_get_notAfter(x509),
208 60L * 60L * 24L * 365L * 10L);
Ed Tanous9b65f1f2017-03-07 15:17:13 -0800209
Ed Tanous1abe55e2018-09-05 08:30:59 -0700210 // set the public key to the key we just generated
211 X509_set_pubkey(x509, pRsaPrivKey);
Ed Tanous0fdddb12017-02-28 11:06:34 -0800212
Ed Tanous1abe55e2018-09-05 08:30:59 -0700213 // get the subject name
214 X509_NAME *name;
215 name = X509_get_subject_name(x509);
Ed Tanous0fdddb12017-02-28 11:06:34 -0800216
Ed Tanous1abe55e2018-09-05 08:30:59 -0700217 X509_NAME_add_entry_by_txt(
218 name, "C", MBSTRING_ASC,
219 reinterpret_cast<const unsigned char *>("US"), -1, -1, 0);
220 X509_NAME_add_entry_by_txt(
221 name, "O", MBSTRING_ASC,
Brad Bishop85d2bb52019-04-05 08:31:14 -0400222 reinterpret_cast<const unsigned char *>("OpenBMC"), -1, -1, 0);
Ed Tanous1abe55e2018-09-05 08:30:59 -0700223 X509_NAME_add_entry_by_txt(
224 name, "CN", MBSTRING_ASC,
225 reinterpret_cast<const unsigned char *>("testhost"), -1, -1, 0);
226 // set the CSR options
227 X509_set_issuer_name(x509, name);
Ed Tanous0fdddb12017-02-28 11:06:34 -0800228
Ed Tanous1abe55e2018-09-05 08:30:59 -0700229 // Sign the certificate with our private key
230 X509_sign(x509, pRsaPrivKey, EVP_sha256());
Ed Tanous0fdddb12017-02-28 11:06:34 -0800231
Ed Tanous1abe55e2018-09-05 08:30:59 -0700232 pFile = fopen(filepath.c_str(), "wt");
Ed Tanous0fdddb12017-02-28 11:06:34 -0800233
Ed Tanous1abe55e2018-09-05 08:30:59 -0700234 if (pFile != nullptr)
235 {
Ed Tanous99131cd2019-10-24 11:12:47 -0700236 PEM_write_PrivateKey(pFile, pRsaPrivKey, nullptr, nullptr, 0,
237 nullptr, nullptr);
Ed Tanous0fdddb12017-02-28 11:06:34 -0800238
Ed Tanous1abe55e2018-09-05 08:30:59 -0700239 PEM_write_X509(pFile, x509);
240 fclose(pFile);
Ed Tanous99131cd2019-10-24 11:12:47 -0700241 pFile = nullptr;
Ed Tanous1abe55e2018-09-05 08:30:59 -0700242 }
Ed Tanous0fdddb12017-02-28 11:06:34 -0800243
Ed Tanous1abe55e2018-09-05 08:30:59 -0700244 X509_free(x509);
245 }
246
247 EVP_PKEY_free(pRsaPrivKey);
Ed Tanous99131cd2019-10-24 11:12:47 -0700248 pRsaPrivKey = nullptr;
Ed Tanous0fdddb12017-02-28 11:06:34 -0800249 }
250
Ed Tanous1abe55e2018-09-05 08:30:59 -0700251 // cleanup_openssl();
Ed Tanous99923322017-03-03 14:21:24 -0800252}
Ed Tanousb01bf292019-03-25 19:25:26 +0000253
Ed Tanousb01bf292019-03-25 19:25:26 +0000254EVP_PKEY *createEcKey()
255{
Ed Tanous99131cd2019-10-24 11:12:47 -0700256 EVP_PKEY *pKey = nullptr;
Ed Tanousb01bf292019-03-25 19:25:26 +0000257 int eccgrp = 0;
258 eccgrp = OBJ_txt2nid("prime256v1");
Ed Tanous6ea007a2019-02-13 22:48:25 -0800259
Ed Tanous6ea007a2019-02-13 22:48:25 -0800260 EC_KEY *myecc = EC_KEY_new_by_curve_name(eccgrp);
Ed Tanousb01bf292019-03-25 19:25:26 +0000261 if (myecc != nullptr)
Ed Tanous6ea007a2019-02-13 22:48:25 -0800262 {
Ed Tanousb01bf292019-03-25 19:25:26 +0000263 EC_KEY_set_asn1_flag(myecc, OPENSSL_EC_NAMED_CURVE);
264 EC_KEY_generate_key(myecc);
265 pKey = EVP_PKEY_new();
266 if (pKey != nullptr)
267 {
268 if (EVP_PKEY_assign_EC_KEY(pKey, myecc))
269 {
270 /* pKey owns pRSA from now */
271 if (EC_KEY_check_key(myecc) <= 0)
272 {
273 fprintf(stderr, "EC_check_key failed.\n");
274 }
275 }
276 }
Ed Tanous6ea007a2019-02-13 22:48:25 -0800277 }
Ed Tanous1abe55e2018-09-05 08:30:59 -0700278 return pKey;
279}
280
281void initOpenssl()
282{
Ed Tanous911ac312017-08-15 09:37:42 -0700283#if OPENSSL_VERSION_NUMBER < 0x10100000L
Ed Tanous1abe55e2018-09-05 08:30:59 -0700284 SSL_load_error_strings();
285 OpenSSL_add_all_algorithms();
286 RAND_load_file("/dev/urandom", 1024);
Ed Tanousa1e077c2017-04-25 12:42:19 -0700287#endif
Ed Tanous0fdddb12017-02-28 11:06:34 -0800288}
289
Ed Tanous1abe55e2018-09-05 08:30:59 -0700290inline void ensureOpensslKeyPresentAndValid(const std::string &filepath)
291{
292 bool pemFileValid = false;
Ed Tanous0fdddb12017-02-28 11:06:34 -0800293
Ed Tanous1abe55e2018-09-05 08:30:59 -0700294 pemFileValid = verifyOpensslKeyCert(filepath);
Ed Tanous1ccd57c2017-03-21 13:15:58 -0700295
Ed Tanous1abe55e2018-09-05 08:30:59 -0700296 if (!pemFileValid)
297 {
298 std::cerr << "Error in verifying signature, regenerating\n";
299 generateSslCertificate(filepath);
300 }
Ed Tanous0fdddb12017-02-28 11:06:34 -0800301}
Ed Tanousc4771fb2017-03-13 13:39:49 -0700302
Marri Devender Rao5968cae2019-01-21 10:27:12 -0600303inline std::shared_ptr<boost::asio::ssl::context>
304 getSslContext(const std::string &ssl_pem_file)
Ed Tanous1abe55e2018-09-05 08:30:59 -0700305{
Marri Devender Rao5968cae2019-01-21 10:27:12 -0600306 std::shared_ptr<boost::asio::ssl::context> mSslContext =
307 std::make_shared<boost::asio::ssl::context>(
308 boost::asio::ssl::context::tls_server);
309 mSslContext->set_options(boost::asio::ssl::context::default_workarounds |
310 boost::asio::ssl::context::no_sslv2 |
311 boost::asio::ssl::context::no_sslv3 |
312 boost::asio::ssl::context::single_dh_use |
313 boost::asio::ssl::context::no_tlsv1 |
314 boost::asio::ssl::context::no_tlsv1_1);
Ed Tanousc4771fb2017-03-13 13:39:49 -0700315
James Feist91243c32019-11-12 14:55:40 -0800316 // BIG WARNING: This needs to stay disabled, as there will always be
317 // unauthenticated endpoints
318 // mSslContext->set_verify_mode(boost::asio::ssl::verify_peer);
Kowalski, Kamil55e43f62019-07-10 13:12:57 +0200319
James Feist6a3e1822019-11-06 13:46:35 -0800320 SSL_CTX_set_options(mSslContext->native_handle(), SSL_OP_NO_RENEGOTIATION);
321
Kowalski, Kamil55e43f62019-07-10 13:12:57 +0200322 BMCWEB_LOG_DEBUG << "Using default TrustStore location: " << trustStorePath;
323 mSslContext->add_verify_path(trustStorePath);
324
Marri Devender Rao5968cae2019-01-21 10:27:12 -0600325 mSslContext->use_certificate_file(ssl_pem_file,
326 boost::asio::ssl::context::pem);
327 mSslContext->use_private_key_file(ssl_pem_file,
328 boost::asio::ssl::context::pem);
Ed Tanousc4771fb2017-03-13 13:39:49 -0700329
Ed Tanous1abe55e2018-09-05 08:30:59 -0700330 // Set up EC curves to auto (boost asio doesn't have a method for this)
331 // There is a pull request to add this. Once this is included in an asio
332 // drop, use the right way
333 // http://stackoverflow.com/questions/18929049/boost-asio-with-ecdsa-certificate-issue
Marri Devender Rao5968cae2019-01-21 10:27:12 -0600334 if (SSL_CTX_set_ecdh_auto(mSslContext->native_handle(), 1) != 1)
Ed Tanous1abe55e2018-09-05 08:30:59 -0700335 {
336 BMCWEB_LOG_ERROR << "Error setting tmp ecdh list\n";
337 }
Ed Tanousc4771fb2017-03-13 13:39:49 -0700338
Ed Tanous457207f2019-02-07 15:27:14 -0800339 std::string mozillaModern = "ECDHE-ECDSA-AES256-GCM-SHA384:"
340 "ECDHE-RSA-AES256-GCM-SHA384:"
341 "ECDHE-ECDSA-CHACHA20-POLY1305:"
342 "ECDHE-RSA-CHACHA20-POLY1305:"
343 "ECDHE-ECDSA-AES128-GCM-SHA256:"
344 "ECDHE-RSA-AES128-GCM-SHA256:"
345 "ECDHE-ECDSA-AES256-SHA384:"
346 "ECDHE-RSA-AES256-SHA384:"
347 "ECDHE-ECDSA-AES128-SHA256:"
348 "ECDHE-RSA-AES128-SHA256";
Ed Tanousc4771fb2017-03-13 13:39:49 -0700349
Marri Devender Rao5968cae2019-01-21 10:27:12 -0600350 if (SSL_CTX_set_cipher_list(mSslContext->native_handle(),
Ed Tanous457207f2019-02-07 15:27:14 -0800351 mozillaModern.c_str()) != 1)
Ed Tanous1abe55e2018-09-05 08:30:59 -0700352 {
353 BMCWEB_LOG_ERROR << "Error setting cipher list\n";
354 }
355 return mSslContext;
Ed Tanousc4771fb2017-03-13 13:39:49 -0700356}
Ed Tanous1abe55e2018-09-05 08:30:59 -0700357} // namespace ensuressl
Ed Tanous01250f22017-04-18 17:49:51 -0700358
Brad Bishop85d2bb52019-04-05 08:31:14 -0400359#endif