Marri Devender Rao | cd30c49 | 2019-06-12 01:40:17 -0500 | [diff] [blame] | 1 | #include "config.h" |
| 2 | |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 3 | #include "certificate.hpp" |
| 4 | |
Zbigniew Kurzynski | a3bb38f | 2019-09-17 13:34:25 +0200 | [diff] [blame] | 5 | #include "certs_manager.hpp" |
| 6 | |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 7 | #include <openssl/bio.h> |
| 8 | #include <openssl/crypto.h> |
| 9 | #include <openssl/err.h> |
| 10 | #include <openssl/evp.h> |
| 11 | #include <openssl/pem.h> |
| 12 | #include <openssl/x509v3.h> |
| 13 | |
| 14 | #include <fstream> |
| 15 | #include <phosphor-logging/elog-errors.hpp> |
Marri Devender Rao | 13bf74e | 2019-03-26 01:52:17 -0500 | [diff] [blame] | 16 | #include <xyz/openbmc_project/Certs/error.hpp> |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 17 | #include <xyz/openbmc_project/Common/error.hpp> |
Marri Devender Rao | 13bf74e | 2019-03-26 01:52:17 -0500 | [diff] [blame] | 18 | |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 19 | namespace phosphor |
| 20 | { |
| 21 | namespace certs |
| 22 | { |
| 23 | // RAII support for openSSL functions. |
| 24 | using BIO_MEM_Ptr = std::unique_ptr<BIO, decltype(&::BIO_free)>; |
| 25 | using X509_STORE_CTX_Ptr = |
| 26 | std::unique_ptr<X509_STORE_CTX, decltype(&::X509_STORE_CTX_free)>; |
| 27 | using X509_LOOKUP_Ptr = |
| 28 | std::unique_ptr<X509_LOOKUP, decltype(&::X509_LOOKUP_free)>; |
Dhruvaraj Subhashchandran | 36f2514 | 2019-02-14 05:06:26 -0600 | [diff] [blame] | 29 | using ASN1_TIME_ptr = std::unique_ptr<ASN1_TIME, decltype(&ASN1_STRING_free)>; |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 30 | using EVP_PKEY_Ptr = std::unique_ptr<EVP_PKEY, decltype(&::EVP_PKEY_free)>; |
| 31 | using BUF_MEM_Ptr = std::unique_ptr<BUF_MEM, decltype(&::BUF_MEM_free)>; |
| 32 | using InternalFailure = |
| 33 | sdbusplus::xyz::openbmc_project::Common::Error::InternalFailure; |
| 34 | using InvalidCertificate = |
Marri Devender Rao | 13bf74e | 2019-03-26 01:52:17 -0500 | [diff] [blame] | 35 | sdbusplus::xyz::openbmc_project::Certs::Error::InvalidCertificate; |
| 36 | using Reason = xyz::openbmc_project::Certs::InvalidCertificate::REASON; |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 37 | |
| 38 | // Trust chain related errors.` |
| 39 | #define TRUST_CHAIN_ERR(errnum) \ |
| 40 | ((errnum == X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT) || \ |
| 41 | (errnum == X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN) || \ |
| 42 | (errnum == X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY) || \ |
| 43 | (errnum == X509_V_ERR_CERT_UNTRUSTED) || \ |
| 44 | (errnum == X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE)) |
| 45 | |
Dhruvaraj Subhashchandran | 36f2514 | 2019-02-14 05:06:26 -0600 | [diff] [blame] | 46 | // Refer to schema 2018.3 |
| 47 | // http://redfish.dmtf.org/schemas/v1/Certificate.json#/definitions/KeyUsage for |
| 48 | // supported KeyUsage types in redfish |
| 49 | // Refer to |
| 50 | // https://github.com/openssl/openssl/blob/master/include/openssl/x509v3.h for |
| 51 | // key usage bit fields |
| 52 | std::map<uint8_t, std::string> keyUsageToRfStr = { |
| 53 | {KU_DIGITAL_SIGNATURE, "DigitalSignature"}, |
| 54 | {KU_NON_REPUDIATION, "NonRepudiation"}, |
| 55 | {KU_KEY_ENCIPHERMENT, "KeyEncipherment"}, |
| 56 | {KU_DATA_ENCIPHERMENT, "DataEncipherment"}, |
| 57 | {KU_KEY_AGREEMENT, "KeyAgreement"}, |
| 58 | {KU_KEY_CERT_SIGN, "KeyCertSign"}, |
| 59 | {KU_CRL_SIGN, "CRLSigning"}, |
| 60 | {KU_ENCIPHER_ONLY, "EncipherOnly"}, |
| 61 | {KU_DECIPHER_ONLY, "DecipherOnly"}}; |
| 62 | |
| 63 | // Refer to schema 2018.3 |
| 64 | // http://redfish.dmtf.org/schemas/v1/Certificate.json#/definitions/KeyUsage for |
| 65 | // supported Extended KeyUsage types in redfish |
| 66 | std::map<uint8_t, std::string> extendedKeyUsageToRfStr = { |
| 67 | {NID_server_auth, "ServerAuthentication"}, |
| 68 | {NID_client_auth, "ClientAuthentication"}, |
| 69 | {NID_email_protect, "EmailProtection"}, |
| 70 | {NID_OCSP_sign, "OCSPSigning"}, |
| 71 | {NID_ad_timeStamping, "Timestamping"}, |
| 72 | {NID_code_sign, "CodeSigning"}}; |
| 73 | |
Zbigniew Lukwinski | 2f3563c | 2020-01-08 12:35:23 +0100 | [diff] [blame] | 74 | std::string Certificate::generateCertId(const std::string& certPath) |
Kowalski, Kamil | db029c9 | 2019-07-08 17:09:39 +0200 | [diff] [blame] | 75 | { |
Zbigniew Lukwinski | 2f3563c | 2020-01-08 12:35:23 +0100 | [diff] [blame] | 76 | const X509_Ptr cert = loadCert(certPath); |
| 77 | unsigned long subjectNameHash = X509_subject_name_hash(cert.get()); |
Zbigniew Lukwinski | 73d1fbf | 2020-01-15 15:31:12 +0100 | [diff] [blame] | 78 | unsigned long issuerSerialHash = X509_issuer_and_serial_hash(cert.get()); |
| 79 | static constexpr auto CERT_ID_LENGTH = 17; |
Zbigniew Lukwinski | 2f3563c | 2020-01-08 12:35:23 +0100 | [diff] [blame] | 80 | char idBuff[CERT_ID_LENGTH]; |
| 81 | |
Zbigniew Lukwinski | 73d1fbf | 2020-01-15 15:31:12 +0100 | [diff] [blame] | 82 | snprintf(idBuff, CERT_ID_LENGTH, "%08lx%08lx", subjectNameHash, |
| 83 | issuerSerialHash); |
Zbigniew Lukwinski | 2f3563c | 2020-01-08 12:35:23 +0100 | [diff] [blame] | 84 | |
| 85 | return std::string(idBuff); |
| 86 | } |
| 87 | |
| 88 | std::string |
| 89 | Certificate::generateUniqueFilePath(const std::string& directoryPath) |
| 90 | { |
| 91 | char* filePath = tempnam(directoryPath.c_str(), NULL); |
| 92 | if (filePath == NULL) |
| 93 | { |
| 94 | log<level::ERR>( |
| 95 | "Error occured while creating random certificate file path", |
| 96 | entry("DIR=%s", directoryPath.c_str())); |
| 97 | elog<InternalFailure>(); |
| 98 | } |
| 99 | std::string filePathStr(filePath); |
| 100 | free(filePath); |
| 101 | return filePathStr; |
| 102 | } |
| 103 | |
| 104 | std::string Certificate::generateAuthCertFileX509Path( |
| 105 | const std::string& certSrcFilePath, const std::string& certDstDirPath) |
| 106 | { |
| 107 | const X509_Ptr cert = loadCert(certSrcFilePath); |
Kowalski, Kamil | db029c9 | 2019-07-08 17:09:39 +0200 | [diff] [blame] | 108 | unsigned long hash = X509_subject_name_hash(cert.get()); |
Zbigniew Lukwinski | 2f3563c | 2020-01-08 12:35:23 +0100 | [diff] [blame] | 109 | static constexpr auto CERT_HASH_LENGTH = 9; |
| 110 | char hashBuf[CERT_HASH_LENGTH]; |
Kowalski, Kamil | db029c9 | 2019-07-08 17:09:39 +0200 | [diff] [blame] | 111 | |
Zbigniew Lukwinski | 2f3563c | 2020-01-08 12:35:23 +0100 | [diff] [blame] | 112 | snprintf(hashBuf, CERT_HASH_LENGTH, "%08lx", hash); |
Kowalski, Kamil | db029c9 | 2019-07-08 17:09:39 +0200 | [diff] [blame] | 113 | |
Zbigniew Lukwinski | 2f3563c | 2020-01-08 12:35:23 +0100 | [diff] [blame] | 114 | const std::string certHash(hashBuf); |
Zbigniew Lukwinski | 73d1fbf | 2020-01-15 15:31:12 +0100 | [diff] [blame] | 115 | for (int i = 0; i < AUTHORITY_CERTIFICATES_LIMIT; ++i) |
Zbigniew Lukwinski | 2f3563c | 2020-01-08 12:35:23 +0100 | [diff] [blame] | 116 | { |
Zbigniew Lukwinski | 73d1fbf | 2020-01-15 15:31:12 +0100 | [diff] [blame] | 117 | const std::string certDstFileX509Path = |
| 118 | certDstDirPath + "/" + certHash + "." + std::to_string(i); |
| 119 | if (!fs::exists(certDstFileX509Path)) |
| 120 | { |
| 121 | return certDstFileX509Path; |
| 122 | } |
Zbigniew Lukwinski | 2f3563c | 2020-01-08 12:35:23 +0100 | [diff] [blame] | 123 | } |
Kowalski, Kamil | db029c9 | 2019-07-08 17:09:39 +0200 | [diff] [blame] | 124 | |
Zbigniew Lukwinski | 73d1fbf | 2020-01-15 15:31:12 +0100 | [diff] [blame] | 125 | log<level::ERR>("Authority certificate x509 file path already used", |
| 126 | entry("DIR=%s", certDstDirPath.c_str())); |
| 127 | elog<InternalFailure>(); |
Zbigniew Lukwinski | 2f3563c | 2020-01-08 12:35:23 +0100 | [diff] [blame] | 128 | } |
| 129 | |
| 130 | std::string |
| 131 | Certificate::generateAuthCertFilePath(const std::string& certSrcFilePath) |
| 132 | { |
| 133 | // If there is a certificate file path (which means certificate replacement |
| 134 | // is doing) use it (do not create new one) |
| 135 | if (!certFilePath.empty()) |
| 136 | { |
| 137 | return certFilePath; |
| 138 | } |
| 139 | // If source certificate file is located in the certificates directory use |
| 140 | // it (do not create new one) |
| 141 | else if (fs::path(certSrcFilePath).parent_path().string() == |
| 142 | certInstallPath) |
| 143 | { |
| 144 | return certSrcFilePath; |
| 145 | } |
| 146 | // Otherwise generate new file name/path |
| 147 | else |
| 148 | { |
| 149 | return generateUniqueFilePath(certInstallPath); |
| 150 | } |
| 151 | } |
| 152 | |
| 153 | std::string |
| 154 | Certificate::generateCertFilePath(const std::string& certSrcFilePath) |
| 155 | { |
| 156 | if (certType == phosphor::certs::AUTHORITY) |
| 157 | { |
| 158 | return generateAuthCertFilePath(certSrcFilePath); |
| 159 | } |
| 160 | else |
| 161 | { |
| 162 | return certInstallPath; |
| 163 | } |
Kowalski, Kamil | db029c9 | 2019-07-08 17:09:39 +0200 | [diff] [blame] | 164 | } |
| 165 | |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 166 | Certificate::Certificate(sdbusplus::bus::bus& bus, const std::string& objPath, |
| 167 | const CertificateType& type, |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 168 | const CertInstallPath& installPath, |
Marri Devender Rao | 8f80c35 | 2019-05-13 00:53:01 -0500 | [diff] [blame] | 169 | const CertUploadPath& uploadPath, |
Zbigniew Kurzynski | a3bb38f | 2019-09-17 13:34:25 +0200 | [diff] [blame] | 170 | const CertWatchPtr& certWatchPtr, Manager& parent) : |
Marri Devender Rao | edd1131 | 2019-02-27 08:45:10 -0600 | [diff] [blame] | 171 | CertIfaces(bus, objPath.c_str(), true), |
Zbigniew Lukwinski | 2f3563c | 2020-01-08 12:35:23 +0100 | [diff] [blame] | 172 | bus(bus), objectPath(objPath), certType(type), certInstallPath(installPath), |
| 173 | certWatchPtr(certWatchPtr), manager(parent) |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 174 | { |
| 175 | auto installHelper = [this](const auto& filePath) { |
| 176 | if (!compareKeys(filePath)) |
| 177 | { |
| 178 | elog<InvalidCertificate>( |
| 179 | Reason("Private key does not match the Certificate")); |
| 180 | }; |
| 181 | }; |
| 182 | typeFuncMap[SERVER] = installHelper; |
| 183 | typeFuncMap[CLIENT] = installHelper; |
| 184 | typeFuncMap[AUTHORITY] = [](auto filePath) {}; |
Marri Devender Rao | cd30c49 | 2019-06-12 01:40:17 -0500 | [diff] [blame] | 185 | |
| 186 | auto appendPrivateKey = [this](const std::string& filePath) { |
| 187 | checkAndAppendPrivateKey(filePath); |
| 188 | }; |
| 189 | |
| 190 | appendKeyMap[SERVER] = appendPrivateKey; |
| 191 | appendKeyMap[CLIENT] = appendPrivateKey; |
| 192 | appendKeyMap[AUTHORITY] = [](const std::string& filePath) {}; |
| 193 | |
Zbigniew Lukwinski | 2f3563c | 2020-01-08 12:35:23 +0100 | [diff] [blame] | 194 | // Generate certificate file path |
| 195 | certFilePath = generateCertFilePath(uploadPath); |
| 196 | |
Marri Devender Rao | cd30c49 | 2019-06-12 01:40:17 -0500 | [diff] [blame] | 197 | // install the certificate |
Zbigniew Lukwinski | 2f3563c | 2020-01-08 12:35:23 +0100 | [diff] [blame] | 198 | install(uploadPath); |
Marri Devender Rao | cd30c49 | 2019-06-12 01:40:17 -0500 | [diff] [blame] | 199 | |
Marri Devender Rao | edd1131 | 2019-02-27 08:45:10 -0600 | [diff] [blame] | 200 | this->emit_object_added(); |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 201 | } |
| 202 | |
| 203 | Certificate::~Certificate() |
| 204 | { |
Zbigniew Lukwinski | 2f3563c | 2020-01-08 12:35:23 +0100 | [diff] [blame] | 205 | if (!fs::remove(certFilePath)) |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 206 | { |
| 207 | log<level::INFO>("Certificate file not found!", |
Zbigniew Lukwinski | 2f3563c | 2020-01-08 12:35:23 +0100 | [diff] [blame] | 208 | entry("PATH=%s", certFilePath.c_str())); |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 209 | } |
| 210 | } |
| 211 | |
Marri Devender Rao | 13bf74e | 2019-03-26 01:52:17 -0500 | [diff] [blame] | 212 | void Certificate::replace(const std::string filePath) |
| 213 | { |
Zbigniew Lukwinski | 2f3563c | 2020-01-08 12:35:23 +0100 | [diff] [blame] | 214 | manager.replaceCertificate(this, filePath); |
Marri Devender Rao | 13bf74e | 2019-03-26 01:52:17 -0500 | [diff] [blame] | 215 | } |
| 216 | |
Zbigniew Lukwinski | 2f3563c | 2020-01-08 12:35:23 +0100 | [diff] [blame] | 217 | void Certificate::install(const std::string& certSrcFilePath) |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 218 | { |
| 219 | log<level::INFO>("Certificate install ", |
Zbigniew Lukwinski | 2f3563c | 2020-01-08 12:35:23 +0100 | [diff] [blame] | 220 | entry("FILEPATH=%s", certSrcFilePath.c_str())); |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 221 | auto errCode = X509_V_OK; |
| 222 | |
Marri Devender Rao | ffad1ef | 2019-06-03 04:54:12 -0500 | [diff] [blame] | 223 | // stop watch for user initiated certificate install |
| 224 | if (certWatchPtr) |
| 225 | { |
| 226 | certWatchPtr->stopWatch(); |
| 227 | } |
| 228 | |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 229 | // Verify the certificate file |
Zbigniew Lukwinski | 2f3563c | 2020-01-08 12:35:23 +0100 | [diff] [blame] | 230 | fs::path file(certSrcFilePath); |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 231 | if (!fs::exists(file)) |
| 232 | { |
Zbigniew Lukwinski | 2f3563c | 2020-01-08 12:35:23 +0100 | [diff] [blame] | 233 | log<level::ERR>("File is Missing", |
| 234 | entry("FILE=%s", certSrcFilePath.c_str())); |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 235 | elog<InternalFailure>(); |
| 236 | } |
| 237 | |
| 238 | try |
| 239 | { |
Zbigniew Lukwinski | 2f3563c | 2020-01-08 12:35:23 +0100 | [diff] [blame] | 240 | if (fs::file_size(certSrcFilePath) == 0) |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 241 | { |
| 242 | // file is empty |
| 243 | log<level::ERR>("File is empty", |
Zbigniew Lukwinski | 2f3563c | 2020-01-08 12:35:23 +0100 | [diff] [blame] | 244 | entry("FILE=%s", certSrcFilePath.c_str())); |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 245 | elog<InvalidCertificate>(Reason("File is empty")); |
| 246 | } |
| 247 | } |
| 248 | catch (const fs::filesystem_error& e) |
| 249 | { |
| 250 | // Log Error message |
Zbigniew Lukwinski | 2f3563c | 2020-01-08 12:35:23 +0100 | [diff] [blame] | 251 | log<level::ERR>(e.what(), entry("FILE=%s", certSrcFilePath.c_str())); |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 252 | elog<InternalFailure>(); |
| 253 | } |
| 254 | |
| 255 | // Defining store object as RAW to avoid double free. |
| 256 | // X509_LOOKUP_free free up store object. |
| 257 | // Create an empty X509_STORE structure for certificate validation. |
| 258 | auto x509Store = X509_STORE_new(); |
| 259 | if (!x509Store) |
| 260 | { |
| 261 | log<level::ERR>("Error occured during X509_STORE_new call"); |
| 262 | elog<InternalFailure>(); |
| 263 | } |
| 264 | |
| 265 | OpenSSL_add_all_algorithms(); |
| 266 | |
| 267 | // ADD Certificate Lookup method. |
| 268 | X509_LOOKUP_Ptr lookup(X509_STORE_add_lookup(x509Store, X509_LOOKUP_file()), |
| 269 | ::X509_LOOKUP_free); |
| 270 | if (!lookup) |
| 271 | { |
| 272 | // Normally lookup cleanup function interanlly does X509Store cleanup |
| 273 | // Free up the X509Store. |
| 274 | X509_STORE_free(x509Store); |
| 275 | log<level::ERR>("Error occured during X509_STORE_add_lookup call"); |
| 276 | elog<InternalFailure>(); |
| 277 | } |
| 278 | // Load Certificate file. |
Zbigniew Lukwinski | 2f3563c | 2020-01-08 12:35:23 +0100 | [diff] [blame] | 279 | errCode = X509_LOOKUP_load_file(lookup.get(), certSrcFilePath.c_str(), |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 280 | X509_FILETYPE_PEM); |
| 281 | if (errCode != 1) |
| 282 | { |
| 283 | log<level::ERR>("Error occured during X509_LOOKUP_load_file call", |
Zbigniew Lukwinski | 2f3563c | 2020-01-08 12:35:23 +0100 | [diff] [blame] | 284 | entry("FILE=%s", certSrcFilePath.c_str())); |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 285 | elog<InvalidCertificate>(Reason("Invalid certificate file format")); |
| 286 | } |
| 287 | |
| 288 | // Load Certificate file into the X509 structre. |
Zbigniew Lukwinski | 2f3563c | 2020-01-08 12:35:23 +0100 | [diff] [blame] | 289 | X509_Ptr cert = loadCert(certSrcFilePath); |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 290 | X509_STORE_CTX_Ptr storeCtx(X509_STORE_CTX_new(), ::X509_STORE_CTX_free); |
| 291 | if (!storeCtx) |
| 292 | { |
| 293 | log<level::ERR>("Error occured during X509_STORE_CTX_new call", |
Zbigniew Lukwinski | 2f3563c | 2020-01-08 12:35:23 +0100 | [diff] [blame] | 294 | entry("FILE=%s", certSrcFilePath.c_str())); |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 295 | elog<InternalFailure>(); |
| 296 | } |
| 297 | |
| 298 | errCode = X509_STORE_CTX_init(storeCtx.get(), x509Store, cert.get(), NULL); |
| 299 | if (errCode != 1) |
| 300 | { |
| 301 | log<level::ERR>("Error occured during X509_STORE_CTX_init call", |
Zbigniew Lukwinski | 2f3563c | 2020-01-08 12:35:23 +0100 | [diff] [blame] | 302 | entry("FILE=%s", certSrcFilePath.c_str())); |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 303 | elog<InternalFailure>(); |
| 304 | } |
| 305 | |
| 306 | // Set time to current time. |
| 307 | auto locTime = time(nullptr); |
| 308 | |
| 309 | X509_STORE_CTX_set_time(storeCtx.get(), X509_V_FLAG_USE_CHECK_TIME, |
| 310 | locTime); |
| 311 | |
| 312 | errCode = X509_verify_cert(storeCtx.get()); |
| 313 | if (errCode == 1) |
| 314 | { |
| 315 | errCode = X509_V_OK; |
| 316 | } |
| 317 | else if (errCode == 0) |
| 318 | { |
| 319 | errCode = X509_STORE_CTX_get_error(storeCtx.get()); |
Marri Devender Rao | 2e8c3a5 | 2019-08-09 01:26:35 -0500 | [diff] [blame] | 320 | log<level::INFO>( |
| 321 | "Error occured during X509_verify_cert call, checking for known " |
| 322 | "error", |
Zbigniew Lukwinski | 2f3563c | 2020-01-08 12:35:23 +0100 | [diff] [blame] | 323 | entry("FILE=%s", certSrcFilePath.c_str()), |
| 324 | entry("ERRCODE=%d", errCode), |
Marri Devender Rao | 2e8c3a5 | 2019-08-09 01:26:35 -0500 | [diff] [blame] | 325 | entry("ERROR_STR=%s", X509_verify_cert_error_string(errCode))); |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 326 | } |
| 327 | else |
| 328 | { |
| 329 | log<level::ERR>("Error occured during X509_verify_cert call", |
Zbigniew Lukwinski | 2f3563c | 2020-01-08 12:35:23 +0100 | [diff] [blame] | 330 | entry("FILE=%s", certSrcFilePath.c_str())); |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 331 | elog<InternalFailure>(); |
| 332 | } |
| 333 | |
| 334 | // Allow certificate upload, for "certificate is not yet valid" and |
| 335 | // trust chain related errors. |
| 336 | if (!((errCode == X509_V_OK) || |
| 337 | (errCode == X509_V_ERR_CERT_NOT_YET_VALID) || |
| 338 | TRUST_CHAIN_ERR(errCode))) |
| 339 | { |
| 340 | if (errCode == X509_V_ERR_CERT_HAS_EXPIRED) |
| 341 | { |
Marri Devender Rao | c4522d2 | 2020-03-12 06:50:17 -0500 | [diff] [blame^] | 342 | log<level::ERR>("Expired certificate "); |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 343 | elog<InvalidCertificate>(Reason("Expired Certificate")); |
| 344 | } |
| 345 | // Loging general error here. |
Marri Devender Rao | c4522d2 | 2020-03-12 06:50:17 -0500 | [diff] [blame^] | 346 | log<level::ERR>( |
| 347 | "Certificate validation failed", entry("ERRCODE=%d", errCode), |
| 348 | entry("ERROR_STR=%s", X509_verify_cert_error_string(errCode))); |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 349 | elog<InvalidCertificate>(Reason("Certificate validation failed")); |
| 350 | } |
| 351 | |
Marri Devender Rao | c4522d2 | 2020-03-12 06:50:17 -0500 | [diff] [blame^] | 352 | validateCertificateExpiryDate(cert); |
| 353 | |
Marri Devender Rao | cd30c49 | 2019-06-12 01:40:17 -0500 | [diff] [blame] | 354 | // Invoke type specific append private key function. |
| 355 | auto appendIter = appendKeyMap.find(certType); |
| 356 | if (appendIter == appendKeyMap.end()) |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 357 | { |
| 358 | log<level::ERR>("Unsupported Type", entry("TYPE=%s", certType.c_str())); |
| 359 | elog<InternalFailure>(); |
| 360 | } |
Zbigniew Lukwinski | 2f3563c | 2020-01-08 12:35:23 +0100 | [diff] [blame] | 361 | appendIter->second(certSrcFilePath); |
Marri Devender Rao | cd30c49 | 2019-06-12 01:40:17 -0500 | [diff] [blame] | 362 | |
| 363 | // Invoke type specific compare keys function. |
| 364 | auto compIter = typeFuncMap.find(certType); |
| 365 | if (compIter == typeFuncMap.end()) |
| 366 | { |
| 367 | log<level::ERR>("Unsupported Type", entry("TYPE=%s", certType.c_str())); |
| 368 | elog<InternalFailure>(); |
| 369 | } |
Zbigniew Lukwinski | 2f3563c | 2020-01-08 12:35:23 +0100 | [diff] [blame] | 370 | compIter->second(certSrcFilePath); |
Kowalski, Kamil | db029c9 | 2019-07-08 17:09:39 +0200 | [diff] [blame] | 371 | |
Marri Devender Rao | ffad1ef | 2019-06-03 04:54:12 -0500 | [diff] [blame] | 372 | // Copy the certificate to the installation path |
| 373 | // During bootup will be parsing existing file so no need to |
| 374 | // copy it. |
Zbigniew Lukwinski | 2f3563c | 2020-01-08 12:35:23 +0100 | [diff] [blame] | 375 | if (certSrcFilePath != certFilePath) |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 376 | { |
Marri Devender Rao | ffad1ef | 2019-06-03 04:54:12 -0500 | [diff] [blame] | 377 | std::ifstream inputCertFileStream; |
| 378 | std::ofstream outputCertFileStream; |
| 379 | inputCertFileStream.exceptions(std::ifstream::failbit | |
| 380 | std::ifstream::badbit | |
| 381 | std::ifstream::eofbit); |
| 382 | outputCertFileStream.exceptions(std::ofstream::failbit | |
| 383 | std::ofstream::badbit | |
| 384 | std::ofstream::eofbit); |
Kowalski, Kamil | db029c9 | 2019-07-08 17:09:39 +0200 | [diff] [blame] | 385 | |
Marri Devender Rao | ffad1ef | 2019-06-03 04:54:12 -0500 | [diff] [blame] | 386 | try |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 387 | { |
Zbigniew Lukwinski | 2f3563c | 2020-01-08 12:35:23 +0100 | [diff] [blame] | 388 | inputCertFileStream.open(certSrcFilePath); |
| 389 | outputCertFileStream.open(certFilePath, std::ios::out); |
Marri Devender Rao | ffad1ef | 2019-06-03 04:54:12 -0500 | [diff] [blame] | 390 | outputCertFileStream << inputCertFileStream.rdbuf() << std::flush; |
| 391 | inputCertFileStream.close(); |
| 392 | outputCertFileStream.close(); |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 393 | } |
Marri Devender Rao | ffad1ef | 2019-06-03 04:54:12 -0500 | [diff] [blame] | 394 | catch (const std::exception& e) |
| 395 | { |
| 396 | log<level::ERR>("Failed to copy certificate", |
| 397 | entry("ERR=%s", e.what()), |
Zbigniew Lukwinski | 2f3563c | 2020-01-08 12:35:23 +0100 | [diff] [blame] | 398 | entry("SRC=%s", certSrcFilePath.c_str()), |
| 399 | entry("DST=%s", certFilePath.c_str())); |
Marri Devender Rao | ffad1ef | 2019-06-03 04:54:12 -0500 | [diff] [blame] | 400 | elog<InternalFailure>(); |
| 401 | } |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 402 | } |
Marri Devender Rao | 8f80c35 | 2019-05-13 00:53:01 -0500 | [diff] [blame] | 403 | |
Zbigniew Lukwinski | 2f3563c | 2020-01-08 12:35:23 +0100 | [diff] [blame] | 404 | storageUpdate(); |
Dhruvaraj Subhashchandran | 36f2514 | 2019-02-14 05:06:26 -0600 | [diff] [blame] | 405 | |
Zbigniew Lukwinski | 2f3563c | 2020-01-08 12:35:23 +0100 | [diff] [blame] | 406 | // Keep certificate ID |
| 407 | certId = generateCertId(certFilePath); |
Kowalski, Kamil | db029c9 | 2019-07-08 17:09:39 +0200 | [diff] [blame] | 408 | |
Dhruvaraj Subhashchandran | 36f2514 | 2019-02-14 05:06:26 -0600 | [diff] [blame] | 409 | // Parse the certificate file and populate properties |
Zbigniew Lukwinski | 2f3563c | 2020-01-08 12:35:23 +0100 | [diff] [blame] | 410 | populateProperties(certFilePath); |
Marri Devender Rao | ffad1ef | 2019-06-03 04:54:12 -0500 | [diff] [blame] | 411 | |
| 412 | // restart watch |
| 413 | if (certWatchPtr) |
| 414 | { |
| 415 | certWatchPtr->startWatch(); |
| 416 | } |
Dhruvaraj Subhashchandran | 36f2514 | 2019-02-14 05:06:26 -0600 | [diff] [blame] | 417 | } |
| 418 | |
Marri Devender Rao | c4522d2 | 2020-03-12 06:50:17 -0500 | [diff] [blame^] | 419 | void Certificate::validateCertificateExpiryDate(const X509_Ptr& cert) |
| 420 | { |
| 421 | int days = 0; |
| 422 | int secs = 0; |
| 423 | |
| 424 | ASN1_TIME_ptr epoch(ASN1_TIME_new(), ASN1_STRING_free); |
| 425 | // Set time to 12:00am GMT, Jan 1 1970 |
| 426 | ASN1_TIME_set_string(epoch.get(), "700101120000Z"); |
| 427 | |
| 428 | ASN1_TIME* notAfter = X509_get_notAfter(cert.get()); |
| 429 | ASN1_TIME_diff(&days, &secs, epoch.get(), notAfter); |
| 430 | |
| 431 | static const int dayToSeconds = 24 * 60 * 60; |
| 432 | |
| 433 | // TODO #issue15 - allow only upto year 2038 which time_t supports for now |
| 434 | // time_t is defined as int32 so any expiry date greater than 2038 will |
| 435 | // cause the time_t variable overflow resulting in -ve number. |
| 436 | if (days > (INT_MAX - secs) / dayToSeconds) |
| 437 | { |
| 438 | log<level::ERR>("Certificate expiry date is beyond year 2038", |
| 439 | entry("DAYS=%d", days)); |
| 440 | elog<InvalidCertificate>(Reason("Expiry date should be below 2038")); |
| 441 | } |
| 442 | } |
| 443 | |
Dhruvaraj Subhashchandran | 36f2514 | 2019-02-14 05:06:26 -0600 | [diff] [blame] | 444 | void Certificate::populateProperties() |
| 445 | { |
Kowalski, Kamil | db029c9 | 2019-07-08 17:09:39 +0200 | [diff] [blame] | 446 | populateProperties(certInstallPath); |
| 447 | } |
| 448 | |
Zbigniew Lukwinski | 2f3563c | 2020-01-08 12:35:23 +0100 | [diff] [blame] | 449 | std::string Certificate::getCertId() const |
Kowalski, Kamil | db029c9 | 2019-07-08 17:09:39 +0200 | [diff] [blame] | 450 | { |
Zbigniew Lukwinski | 2f3563c | 2020-01-08 12:35:23 +0100 | [diff] [blame] | 451 | return certId; |
| 452 | } |
| 453 | |
| 454 | bool Certificate::isSame(const std::string& certPath) |
| 455 | { |
| 456 | return getCertId() == generateCertId(certPath); |
| 457 | } |
| 458 | |
| 459 | void Certificate::storageUpdate() |
| 460 | { |
| 461 | if (certType == phosphor::certs::AUTHORITY) |
| 462 | { |
| 463 | // Create symbolic link in the certificate directory |
| 464 | std::string certFileX509Path; |
| 465 | try |
| 466 | { |
| 467 | if (!certFilePath.empty() && |
| 468 | fs::is_regular_file(fs::path(certFilePath))) |
| 469 | { |
| 470 | certFileX509Path = |
| 471 | generateAuthCertFileX509Path(certFilePath, certInstallPath); |
| 472 | fs::create_symlink(fs::path(certFilePath), |
| 473 | fs::path(certFileX509Path)); |
| 474 | } |
| 475 | } |
| 476 | catch (const std::exception& e) |
| 477 | { |
| 478 | log<level::ERR>("Failed to create symlink for certificate", |
| 479 | entry("ERR=%s", e.what()), |
| 480 | entry("FILE=%s", certFilePath.c_str()), |
| 481 | entry("SYMLINK=%s", certFileX509Path.c_str())); |
| 482 | elog<InternalFailure>(); |
| 483 | } |
| 484 | } |
Kowalski, Kamil | db029c9 | 2019-07-08 17:09:39 +0200 | [diff] [blame] | 485 | } |
| 486 | |
| 487 | void Certificate::populateProperties(const std::string& certPath) |
| 488 | { |
Zbigniew Lukwinski | 2f3563c | 2020-01-08 12:35:23 +0100 | [diff] [blame] | 489 | X509_Ptr cert = loadCert(certPath); |
Dhruvaraj Subhashchandran | 36f2514 | 2019-02-14 05:06:26 -0600 | [diff] [blame] | 490 | // Update properties if no error thrown |
| 491 | BIO_MEM_Ptr certBio(BIO_new(BIO_s_mem()), BIO_free); |
| 492 | PEM_write_bio_X509(certBio.get(), cert.get()); |
| 493 | BUF_MEM_Ptr certBuf(BUF_MEM_new(), BUF_MEM_free); |
| 494 | BUF_MEM* buf = certBuf.get(); |
| 495 | BIO_get_mem_ptr(certBio.get(), &buf); |
| 496 | std::string certStr(buf->data, buf->length); |
| 497 | CertificateIface::certificateString(certStr); |
| 498 | |
| 499 | static const int maxKeySize = 4096; |
| 500 | char subBuffer[maxKeySize] = {0}; |
Marri Devender Rao | dec5877 | 2019-06-11 03:10:00 -0500 | [diff] [blame] | 501 | BIO_MEM_Ptr subBio(BIO_new(BIO_s_mem()), BIO_free); |
Dhruvaraj Subhashchandran | 36f2514 | 2019-02-14 05:06:26 -0600 | [diff] [blame] | 502 | // This pointer cannot be freed independantly. |
| 503 | X509_NAME* sub = X509_get_subject_name(cert.get()); |
Marri Devender Rao | dec5877 | 2019-06-11 03:10:00 -0500 | [diff] [blame] | 504 | X509_NAME_print_ex(subBio.get(), sub, 0, XN_FLAG_SEP_COMMA_PLUS); |
| 505 | BIO_read(subBio.get(), subBuffer, maxKeySize); |
Dhruvaraj Subhashchandran | 36f2514 | 2019-02-14 05:06:26 -0600 | [diff] [blame] | 506 | CertificateIface::subject(subBuffer); |
| 507 | |
Dhruvaraj Subhashchandran | 36f2514 | 2019-02-14 05:06:26 -0600 | [diff] [blame] | 508 | char issuerBuffer[maxKeySize] = {0}; |
Marri Devender Rao | dec5877 | 2019-06-11 03:10:00 -0500 | [diff] [blame] | 509 | BIO_MEM_Ptr issuerBio(BIO_new(BIO_s_mem()), BIO_free); |
| 510 | // This pointer cannot be freed independantly. |
Dhruvaraj Subhashchandran | 36f2514 | 2019-02-14 05:06:26 -0600 | [diff] [blame] | 511 | X509_NAME* issuer_name = X509_get_issuer_name(cert.get()); |
Marri Devender Rao | dec5877 | 2019-06-11 03:10:00 -0500 | [diff] [blame] | 512 | X509_NAME_print_ex(issuerBio.get(), issuer_name, 0, XN_FLAG_SEP_COMMA_PLUS); |
| 513 | BIO_read(issuerBio.get(), issuerBuffer, maxKeySize); |
Dhruvaraj Subhashchandran | 36f2514 | 2019-02-14 05:06:26 -0600 | [diff] [blame] | 514 | CertificateIface::issuer(issuerBuffer); |
| 515 | |
| 516 | std::vector<std::string> keyUsageList; |
| 517 | ASN1_BIT_STRING* usage; |
| 518 | |
| 519 | // Go through each usage in the bit string and convert to |
| 520 | // corresponding string value |
| 521 | if ((usage = static_cast<ASN1_BIT_STRING*>( |
| 522 | X509_get_ext_d2i(cert.get(), NID_key_usage, NULL, NULL)))) |
| 523 | { |
| 524 | for (auto i = 0; i < usage->length; ++i) |
| 525 | { |
| 526 | for (auto& x : keyUsageToRfStr) |
| 527 | { |
| 528 | if (x.first & usage->data[i]) |
| 529 | { |
| 530 | keyUsageList.push_back(x.second); |
| 531 | break; |
| 532 | } |
| 533 | } |
| 534 | } |
| 535 | } |
| 536 | |
| 537 | EXTENDED_KEY_USAGE* extUsage; |
| 538 | if ((extUsage = static_cast<EXTENDED_KEY_USAGE*>( |
| 539 | X509_get_ext_d2i(cert.get(), NID_ext_key_usage, NULL, NULL)))) |
| 540 | { |
| 541 | for (int i = 0; i < sk_ASN1_OBJECT_num(extUsage); i++) |
| 542 | { |
| 543 | keyUsageList.push_back(extendedKeyUsageToRfStr[OBJ_obj2nid( |
| 544 | sk_ASN1_OBJECT_value(extUsage, i))]); |
| 545 | } |
| 546 | } |
| 547 | CertificateIface::keyUsage(keyUsageList); |
| 548 | |
| 549 | int days = 0; |
| 550 | int secs = 0; |
| 551 | |
| 552 | ASN1_TIME_ptr epoch(ASN1_TIME_new(), ASN1_STRING_free); |
| 553 | // Set time to 12:00am GMT, Jan 1 1970 |
| 554 | ASN1_TIME_set_string(epoch.get(), "700101120000Z"); |
| 555 | |
Marri Devender Rao | c4522d2 | 2020-03-12 06:50:17 -0500 | [diff] [blame^] | 556 | static const uint32_t dayToSeconds = 24 * 60 * 60; |
Dhruvaraj Subhashchandran | 36f2514 | 2019-02-14 05:06:26 -0600 | [diff] [blame] | 557 | ASN1_TIME* notAfter = X509_get_notAfter(cert.get()); |
| 558 | ASN1_TIME_diff(&days, &secs, epoch.get(), notAfter); |
| 559 | CertificateIface::validNotAfter((days * dayToSeconds) + secs); |
| 560 | |
| 561 | ASN1_TIME* notBefore = X509_get_notBefore(cert.get()); |
| 562 | ASN1_TIME_diff(&days, &secs, epoch.get(), notBefore); |
| 563 | CertificateIface::validNotBefore((days * dayToSeconds) + secs); |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 564 | } |
| 565 | |
| 566 | X509_Ptr Certificate::loadCert(const std::string& filePath) |
| 567 | { |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 568 | // Read Certificate file |
| 569 | X509_Ptr cert(X509_new(), ::X509_free); |
| 570 | if (!cert) |
| 571 | { |
| 572 | log<level::ERR>("Error occured during X509_new call", |
| 573 | entry("FILE=%s", filePath.c_str()), |
| 574 | entry("ERRCODE=%lu", ERR_get_error())); |
| 575 | elog<InternalFailure>(); |
| 576 | } |
| 577 | |
| 578 | BIO_MEM_Ptr bioCert(BIO_new_file(filePath.c_str(), "rb"), ::BIO_free); |
| 579 | if (!bioCert) |
| 580 | { |
| 581 | log<level::ERR>("Error occured during BIO_new_file call", |
| 582 | entry("FILE=%s", filePath.c_str())); |
| 583 | elog<InternalFailure>(); |
| 584 | } |
| 585 | |
| 586 | X509* x509 = cert.get(); |
| 587 | if (!PEM_read_bio_X509(bioCert.get(), &x509, nullptr, nullptr)) |
| 588 | { |
| 589 | log<level::ERR>("Error occured during PEM_read_bio_X509 call", |
| 590 | entry("FILE=%s", filePath.c_str())); |
| 591 | elog<InternalFailure>(); |
| 592 | } |
| 593 | return cert; |
| 594 | } |
Marri Devender Rao | cd30c49 | 2019-06-12 01:40:17 -0500 | [diff] [blame] | 595 | |
| 596 | void Certificate::checkAndAppendPrivateKey(const std::string& filePath) |
| 597 | { |
| 598 | BIO_MEM_Ptr keyBio(BIO_new(BIO_s_file()), ::BIO_free); |
| 599 | if (!keyBio) |
| 600 | { |
| 601 | log<level::ERR>("Error occured during BIO_s_file call", |
| 602 | entry("FILE=%s", filePath.c_str())); |
| 603 | elog<InternalFailure>(); |
| 604 | } |
| 605 | BIO_read_filename(keyBio.get(), filePath.c_str()); |
| 606 | |
| 607 | EVP_PKEY_Ptr priKey( |
| 608 | PEM_read_bio_PrivateKey(keyBio.get(), nullptr, nullptr, nullptr), |
| 609 | ::EVP_PKEY_free); |
| 610 | if (!priKey) |
| 611 | { |
| 612 | log<level::INFO>("Private key not present in file", |
| 613 | entry("FILE=%s", filePath.c_str())); |
| 614 | fs::path privateKeyFile = fs::path(certInstallPath).parent_path(); |
| 615 | privateKeyFile = privateKeyFile / PRIV_KEY_FILE_NAME; |
| 616 | if (!fs::exists(privateKeyFile)) |
| 617 | { |
| 618 | log<level::ERR>("Private key file is not found", |
| 619 | entry("FILE=%s", privateKeyFile.c_str())); |
| 620 | elog<InternalFailure>(); |
| 621 | } |
| 622 | |
| 623 | std::ifstream privKeyFileStream; |
| 624 | std::ofstream certFileStream; |
| 625 | privKeyFileStream.exceptions(std::ifstream::failbit | |
| 626 | std::ifstream::badbit | |
| 627 | std::ifstream::eofbit); |
| 628 | certFileStream.exceptions(std::ofstream::failbit | |
| 629 | std::ofstream::badbit | |
| 630 | std::ofstream::eofbit); |
| 631 | try |
| 632 | { |
| 633 | privKeyFileStream.open(privateKeyFile); |
| 634 | certFileStream.open(filePath, std::ios::app); |
Marri Devender Rao | 18e51c9 | 2019-07-15 04:59:01 -0500 | [diff] [blame] | 635 | certFileStream << std::endl; // insert line break |
Marri Devender Rao | cd30c49 | 2019-06-12 01:40:17 -0500 | [diff] [blame] | 636 | certFileStream << privKeyFileStream.rdbuf() << std::flush; |
| 637 | privKeyFileStream.close(); |
| 638 | certFileStream.close(); |
| 639 | } |
| 640 | catch (const std::exception& e) |
| 641 | { |
| 642 | log<level::ERR>("Failed to append private key", |
| 643 | entry("ERR=%s", e.what()), |
| 644 | entry("SRC=%s", privateKeyFile.c_str()), |
| 645 | entry("DST=%s", filePath.c_str())); |
| 646 | elog<InternalFailure>(); |
| 647 | } |
| 648 | } |
| 649 | } |
| 650 | |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 651 | bool Certificate::compareKeys(const std::string& filePath) |
| 652 | { |
| 653 | log<level::INFO>("Certificate compareKeys", |
| 654 | entry("FILEPATH=%s", filePath.c_str())); |
| 655 | X509_Ptr cert(X509_new(), ::X509_free); |
| 656 | if (!cert) |
| 657 | { |
| 658 | log<level::ERR>("Error occured during X509_new call", |
| 659 | entry("FILE=%s", filePath.c_str()), |
| 660 | entry("ERRCODE=%lu", ERR_get_error())); |
| 661 | elog<InternalFailure>(); |
| 662 | } |
| 663 | |
| 664 | BIO_MEM_Ptr bioCert(BIO_new_file(filePath.c_str(), "rb"), ::BIO_free); |
| 665 | if (!bioCert) |
| 666 | { |
| 667 | log<level::ERR>("Error occured during BIO_new_file call", |
| 668 | entry("FILE=%s", filePath.c_str())); |
| 669 | elog<InternalFailure>(); |
| 670 | } |
| 671 | |
| 672 | X509* x509 = cert.get(); |
| 673 | PEM_read_bio_X509(bioCert.get(), &x509, nullptr, nullptr); |
| 674 | |
| 675 | EVP_PKEY_Ptr pubKey(X509_get_pubkey(cert.get()), ::EVP_PKEY_free); |
| 676 | if (!pubKey) |
| 677 | { |
| 678 | log<level::ERR>("Error occurred during X509_get_pubkey", |
| 679 | entry("FILE=%s", filePath.c_str()), |
| 680 | entry("ERRCODE=%lu", ERR_get_error())); |
| 681 | elog<InvalidCertificate>(Reason("Failed to get public key info")); |
| 682 | } |
| 683 | |
| 684 | BIO_MEM_Ptr keyBio(BIO_new(BIO_s_file()), ::BIO_free); |
| 685 | if (!keyBio) |
| 686 | { |
| 687 | log<level::ERR>("Error occured during BIO_s_file call", |
| 688 | entry("FILE=%s", filePath.c_str())); |
| 689 | elog<InternalFailure>(); |
| 690 | } |
| 691 | BIO_read_filename(keyBio.get(), filePath.c_str()); |
| 692 | |
| 693 | EVP_PKEY_Ptr priKey( |
| 694 | PEM_read_bio_PrivateKey(keyBio.get(), nullptr, nullptr, nullptr), |
| 695 | ::EVP_PKEY_free); |
| 696 | if (!priKey) |
| 697 | { |
| 698 | log<level::ERR>("Error occurred during PEM_read_bio_PrivateKey", |
| 699 | entry("FILE=%s", filePath.c_str()), |
| 700 | entry("ERRCODE=%lu", ERR_get_error())); |
| 701 | elog<InvalidCertificate>(Reason("Failed to get private key info")); |
| 702 | } |
| 703 | |
| 704 | int32_t rc = EVP_PKEY_cmp(priKey.get(), pubKey.get()); |
| 705 | if (rc != 1) |
| 706 | { |
| 707 | log<level::ERR>("Private key is not matching with Certificate", |
| 708 | entry("FILE=%s", filePath.c_str()), |
| 709 | entry("ERRCODE=%d", rc)); |
| 710 | return false; |
| 711 | } |
| 712 | return true; |
| 713 | } |
| 714 | |
Zbigniew Kurzynski | a3bb38f | 2019-09-17 13:34:25 +0200 | [diff] [blame] | 715 | void Certificate::delete_() |
| 716 | { |
Zbigniew Lukwinski | 2f3563c | 2020-01-08 12:35:23 +0100 | [diff] [blame] | 717 | manager.deleteCertificate(this); |
Zbigniew Kurzynski | a3bb38f | 2019-09-17 13:34:25 +0200 | [diff] [blame] | 718 | } |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 719 | } // namespace certs |
| 720 | } // namespace phosphor |