Marri Devender Rao | cd30c49 | 2019-06-12 01:40:17 -0500 | [diff] [blame] | 1 | #include "config.h" |
| 2 | |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 3 | #include "certificate.hpp" |
| 4 | |
Zbigniew Kurzynski | a3bb38f | 2019-09-17 13:34:25 +0200 | [diff] [blame] | 5 | #include "certs_manager.hpp" |
| 6 | |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 7 | #include <openssl/bio.h> |
| 8 | #include <openssl/crypto.h> |
| 9 | #include <openssl/err.h> |
| 10 | #include <openssl/evp.h> |
| 11 | #include <openssl/pem.h> |
Nidhin MS | 811a29e | 2021-05-13 12:54:32 +0530 | [diff] [blame] | 12 | #include <openssl/ssl.h> |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 13 | #include <openssl/x509v3.h> |
| 14 | |
| 15 | #include <fstream> |
| 16 | #include <phosphor-logging/elog-errors.hpp> |
Marri Devender Rao | 13bf74e | 2019-03-26 01:52:17 -0500 | [diff] [blame] | 17 | #include <xyz/openbmc_project/Certs/error.hpp> |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 18 | #include <xyz/openbmc_project/Common/error.hpp> |
Marri Devender Rao | 13bf74e | 2019-03-26 01:52:17 -0500 | [diff] [blame] | 19 | |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 20 | namespace phosphor |
| 21 | { |
| 22 | namespace certs |
| 23 | { |
| 24 | // RAII support for openSSL functions. |
| 25 | using BIO_MEM_Ptr = std::unique_ptr<BIO, decltype(&::BIO_free)>; |
Patrick Williams | 83e6eab | 2021-12-05 06:32:24 -0600 | [diff] [blame] | 26 | using X509_STORE_Ptr = |
| 27 | std::unique_ptr<X509_STORE, decltype(&::X509_STORE_free)>; |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 28 | using X509_STORE_CTX_Ptr = |
| 29 | std::unique_ptr<X509_STORE_CTX, decltype(&::X509_STORE_CTX_free)>; |
Dhruvaraj Subhashchandran | 36f2514 | 2019-02-14 05:06:26 -0600 | [diff] [blame] | 30 | using ASN1_TIME_ptr = std::unique_ptr<ASN1_TIME, decltype(&ASN1_STRING_free)>; |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 31 | using EVP_PKEY_Ptr = std::unique_ptr<EVP_PKEY, decltype(&::EVP_PKEY_free)>; |
| 32 | using BUF_MEM_Ptr = std::unique_ptr<BUF_MEM, decltype(&::BUF_MEM_free)>; |
| 33 | using InternalFailure = |
| 34 | sdbusplus::xyz::openbmc_project::Common::Error::InternalFailure; |
| 35 | using InvalidCertificate = |
Marri Devender Rao | 13bf74e | 2019-03-26 01:52:17 -0500 | [diff] [blame] | 36 | sdbusplus::xyz::openbmc_project::Certs::Error::InvalidCertificate; |
| 37 | using Reason = xyz::openbmc_project::Certs::InvalidCertificate::REASON; |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 38 | |
| 39 | // Trust chain related errors.` |
| 40 | #define TRUST_CHAIN_ERR(errnum) \ |
| 41 | ((errnum == X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT) || \ |
| 42 | (errnum == X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN) || \ |
| 43 | (errnum == X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY) || \ |
Nan Zhou | 6354013 | 2021-11-25 15:47:52 -0800 | [diff] [blame] | 44 | (errnum == X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT) || \ |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 45 | (errnum == X509_V_ERR_CERT_UNTRUSTED) || \ |
| 46 | (errnum == X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE)) |
| 47 | |
Dhruvaraj Subhashchandran | 36f2514 | 2019-02-14 05:06:26 -0600 | [diff] [blame] | 48 | // Refer to schema 2018.3 |
| 49 | // http://redfish.dmtf.org/schemas/v1/Certificate.json#/definitions/KeyUsage for |
| 50 | // supported KeyUsage types in redfish |
| 51 | // Refer to |
| 52 | // https://github.com/openssl/openssl/blob/master/include/openssl/x509v3.h for |
| 53 | // key usage bit fields |
| 54 | std::map<uint8_t, std::string> keyUsageToRfStr = { |
| 55 | {KU_DIGITAL_SIGNATURE, "DigitalSignature"}, |
| 56 | {KU_NON_REPUDIATION, "NonRepudiation"}, |
| 57 | {KU_KEY_ENCIPHERMENT, "KeyEncipherment"}, |
| 58 | {KU_DATA_ENCIPHERMENT, "DataEncipherment"}, |
| 59 | {KU_KEY_AGREEMENT, "KeyAgreement"}, |
| 60 | {KU_KEY_CERT_SIGN, "KeyCertSign"}, |
| 61 | {KU_CRL_SIGN, "CRLSigning"}, |
| 62 | {KU_ENCIPHER_ONLY, "EncipherOnly"}, |
| 63 | {KU_DECIPHER_ONLY, "DecipherOnly"}}; |
| 64 | |
| 65 | // Refer to schema 2018.3 |
| 66 | // http://redfish.dmtf.org/schemas/v1/Certificate.json#/definitions/KeyUsage for |
| 67 | // supported Extended KeyUsage types in redfish |
| 68 | std::map<uint8_t, std::string> extendedKeyUsageToRfStr = { |
| 69 | {NID_server_auth, "ServerAuthentication"}, |
| 70 | {NID_client_auth, "ClientAuthentication"}, |
| 71 | {NID_email_protect, "EmailProtection"}, |
| 72 | {NID_OCSP_sign, "OCSPSigning"}, |
| 73 | {NID_ad_timeStamping, "Timestamping"}, |
| 74 | {NID_code_sign, "CodeSigning"}}; |
| 75 | |
Zbigniew Lukwinski | 2f3563c | 2020-01-08 12:35:23 +0100 | [diff] [blame] | 76 | std::string Certificate::generateCertId(const std::string& certPath) |
Kowalski, Kamil | db029c9 | 2019-07-08 17:09:39 +0200 | [diff] [blame] | 77 | { |
Zbigniew Lukwinski | 2f3563c | 2020-01-08 12:35:23 +0100 | [diff] [blame] | 78 | const X509_Ptr cert = loadCert(certPath); |
| 79 | unsigned long subjectNameHash = X509_subject_name_hash(cert.get()); |
Zbigniew Lukwinski | 73d1fbf | 2020-01-15 15:31:12 +0100 | [diff] [blame] | 80 | unsigned long issuerSerialHash = X509_issuer_and_serial_hash(cert.get()); |
| 81 | static constexpr auto CERT_ID_LENGTH = 17; |
Zbigniew Lukwinski | 2f3563c | 2020-01-08 12:35:23 +0100 | [diff] [blame] | 82 | char idBuff[CERT_ID_LENGTH]; |
| 83 | |
Zbigniew Lukwinski | 73d1fbf | 2020-01-15 15:31:12 +0100 | [diff] [blame] | 84 | snprintf(idBuff, CERT_ID_LENGTH, "%08lx%08lx", subjectNameHash, |
| 85 | issuerSerialHash); |
Zbigniew Lukwinski | 2f3563c | 2020-01-08 12:35:23 +0100 | [diff] [blame] | 86 | |
| 87 | return std::string(idBuff); |
| 88 | } |
| 89 | |
| 90 | std::string |
| 91 | Certificate::generateUniqueFilePath(const std::string& directoryPath) |
| 92 | { |
Nan Zhou | cfb5802 | 2021-12-28 11:02:26 -0800 | [diff] [blame^] | 93 | char* filePath = tempnam(directoryPath.c_str(), nullptr); |
| 94 | if (filePath == nullptr) |
Zbigniew Lukwinski | 2f3563c | 2020-01-08 12:35:23 +0100 | [diff] [blame] | 95 | { |
| 96 | log<level::ERR>( |
Nan Zhou | bf3cf75 | 2021-12-28 11:02:07 -0800 | [diff] [blame] | 97 | "Error occurred while creating random certificate file path", |
Zbigniew Lukwinski | 2f3563c | 2020-01-08 12:35:23 +0100 | [diff] [blame] | 98 | entry("DIR=%s", directoryPath.c_str())); |
| 99 | elog<InternalFailure>(); |
| 100 | } |
| 101 | std::string filePathStr(filePath); |
| 102 | free(filePath); |
| 103 | return filePathStr; |
| 104 | } |
| 105 | |
| 106 | std::string Certificate::generateAuthCertFileX509Path( |
| 107 | const std::string& certSrcFilePath, const std::string& certDstDirPath) |
| 108 | { |
| 109 | const X509_Ptr cert = loadCert(certSrcFilePath); |
Kowalski, Kamil | db029c9 | 2019-07-08 17:09:39 +0200 | [diff] [blame] | 110 | unsigned long hash = X509_subject_name_hash(cert.get()); |
Zbigniew Lukwinski | 2f3563c | 2020-01-08 12:35:23 +0100 | [diff] [blame] | 111 | static constexpr auto CERT_HASH_LENGTH = 9; |
| 112 | char hashBuf[CERT_HASH_LENGTH]; |
Kowalski, Kamil | db029c9 | 2019-07-08 17:09:39 +0200 | [diff] [blame] | 113 | |
Zbigniew Lukwinski | 2f3563c | 2020-01-08 12:35:23 +0100 | [diff] [blame] | 114 | snprintf(hashBuf, CERT_HASH_LENGTH, "%08lx", hash); |
Kowalski, Kamil | db029c9 | 2019-07-08 17:09:39 +0200 | [diff] [blame] | 115 | |
Zbigniew Lukwinski | 2f3563c | 2020-01-08 12:35:23 +0100 | [diff] [blame] | 116 | const std::string certHash(hashBuf); |
Zbigniew Lukwinski | 73d1fbf | 2020-01-15 15:31:12 +0100 | [diff] [blame] | 117 | for (int i = 0; i < AUTHORITY_CERTIFICATES_LIMIT; ++i) |
Zbigniew Lukwinski | 2f3563c | 2020-01-08 12:35:23 +0100 | [diff] [blame] | 118 | { |
Zbigniew Lukwinski | 73d1fbf | 2020-01-15 15:31:12 +0100 | [diff] [blame] | 119 | const std::string certDstFileX509Path = |
| 120 | certDstDirPath + "/" + certHash + "." + std::to_string(i); |
| 121 | if (!fs::exists(certDstFileX509Path)) |
| 122 | { |
| 123 | return certDstFileX509Path; |
| 124 | } |
Zbigniew Lukwinski | 2f3563c | 2020-01-08 12:35:23 +0100 | [diff] [blame] | 125 | } |
Kowalski, Kamil | db029c9 | 2019-07-08 17:09:39 +0200 | [diff] [blame] | 126 | |
Zbigniew Lukwinski | 73d1fbf | 2020-01-15 15:31:12 +0100 | [diff] [blame] | 127 | log<level::ERR>("Authority certificate x509 file path already used", |
| 128 | entry("DIR=%s", certDstDirPath.c_str())); |
| 129 | elog<InternalFailure>(); |
Zbigniew Lukwinski | 2f3563c | 2020-01-08 12:35:23 +0100 | [diff] [blame] | 130 | } |
| 131 | |
| 132 | std::string |
| 133 | Certificate::generateAuthCertFilePath(const std::string& certSrcFilePath) |
| 134 | { |
| 135 | // If there is a certificate file path (which means certificate replacement |
| 136 | // is doing) use it (do not create new one) |
| 137 | if (!certFilePath.empty()) |
| 138 | { |
| 139 | return certFilePath; |
| 140 | } |
| 141 | // If source certificate file is located in the certificates directory use |
| 142 | // it (do not create new one) |
| 143 | else if (fs::path(certSrcFilePath).parent_path().string() == |
| 144 | certInstallPath) |
| 145 | { |
| 146 | return certSrcFilePath; |
| 147 | } |
| 148 | // Otherwise generate new file name/path |
| 149 | else |
| 150 | { |
| 151 | return generateUniqueFilePath(certInstallPath); |
| 152 | } |
| 153 | } |
| 154 | |
| 155 | std::string |
| 156 | Certificate::generateCertFilePath(const std::string& certSrcFilePath) |
| 157 | { |
| 158 | if (certType == phosphor::certs::AUTHORITY) |
| 159 | { |
| 160 | return generateAuthCertFilePath(certSrcFilePath); |
| 161 | } |
| 162 | else |
| 163 | { |
| 164 | return certInstallPath; |
| 165 | } |
Kowalski, Kamil | db029c9 | 2019-07-08 17:09:39 +0200 | [diff] [blame] | 166 | } |
| 167 | |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 168 | Certificate::Certificate(sdbusplus::bus::bus& bus, const std::string& objPath, |
| 169 | const CertificateType& type, |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 170 | const CertInstallPath& installPath, |
Marri Devender Rao | 8f80c35 | 2019-05-13 00:53:01 -0500 | [diff] [blame] | 171 | const CertUploadPath& uploadPath, |
Zbigniew Kurzynski | a3bb38f | 2019-09-17 13:34:25 +0200 | [diff] [blame] | 172 | const CertWatchPtr& certWatchPtr, Manager& parent) : |
Marri Devender Rao | edd1131 | 2019-02-27 08:45:10 -0600 | [diff] [blame] | 173 | CertIfaces(bus, objPath.c_str(), true), |
Zbigniew Lukwinski | 2f3563c | 2020-01-08 12:35:23 +0100 | [diff] [blame] | 174 | bus(bus), objectPath(objPath), certType(type), certInstallPath(installPath), |
| 175 | certWatchPtr(certWatchPtr), manager(parent) |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 176 | { |
| 177 | auto installHelper = [this](const auto& filePath) { |
| 178 | if (!compareKeys(filePath)) |
| 179 | { |
| 180 | elog<InvalidCertificate>( |
| 181 | Reason("Private key does not match the Certificate")); |
| 182 | }; |
| 183 | }; |
| 184 | typeFuncMap[SERVER] = installHelper; |
| 185 | typeFuncMap[CLIENT] = installHelper; |
Patrick Williams | 7e2797e | 2021-12-03 13:37:07 -0600 | [diff] [blame] | 186 | typeFuncMap[AUTHORITY] = [](const std::string&) {}; |
Marri Devender Rao | cd30c49 | 2019-06-12 01:40:17 -0500 | [diff] [blame] | 187 | |
| 188 | auto appendPrivateKey = [this](const std::string& filePath) { |
| 189 | checkAndAppendPrivateKey(filePath); |
| 190 | }; |
| 191 | |
| 192 | appendKeyMap[SERVER] = appendPrivateKey; |
| 193 | appendKeyMap[CLIENT] = appendPrivateKey; |
Patrick Williams | 7e2797e | 2021-12-03 13:37:07 -0600 | [diff] [blame] | 194 | appendKeyMap[AUTHORITY] = [](const std::string&) {}; |
Marri Devender Rao | cd30c49 | 2019-06-12 01:40:17 -0500 | [diff] [blame] | 195 | |
Zbigniew Lukwinski | 2f3563c | 2020-01-08 12:35:23 +0100 | [diff] [blame] | 196 | // Generate certificate file path |
| 197 | certFilePath = generateCertFilePath(uploadPath); |
| 198 | |
Marri Devender Rao | cd30c49 | 2019-06-12 01:40:17 -0500 | [diff] [blame] | 199 | // install the certificate |
Zbigniew Lukwinski | 2f3563c | 2020-01-08 12:35:23 +0100 | [diff] [blame] | 200 | install(uploadPath); |
Marri Devender Rao | cd30c49 | 2019-06-12 01:40:17 -0500 | [diff] [blame] | 201 | |
Marri Devender Rao | edd1131 | 2019-02-27 08:45:10 -0600 | [diff] [blame] | 202 | this->emit_object_added(); |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 203 | } |
| 204 | |
| 205 | Certificate::~Certificate() |
| 206 | { |
Zbigniew Lukwinski | 2f3563c | 2020-01-08 12:35:23 +0100 | [diff] [blame] | 207 | if (!fs::remove(certFilePath)) |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 208 | { |
| 209 | log<level::INFO>("Certificate file not found!", |
Zbigniew Lukwinski | 2f3563c | 2020-01-08 12:35:23 +0100 | [diff] [blame] | 210 | entry("PATH=%s", certFilePath.c_str())); |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 211 | } |
| 212 | } |
| 213 | |
Marri Devender Rao | 13bf74e | 2019-03-26 01:52:17 -0500 | [diff] [blame] | 214 | void Certificate::replace(const std::string filePath) |
| 215 | { |
Zbigniew Lukwinski | 2f3563c | 2020-01-08 12:35:23 +0100 | [diff] [blame] | 216 | manager.replaceCertificate(this, filePath); |
Marri Devender Rao | 13bf74e | 2019-03-26 01:52:17 -0500 | [diff] [blame] | 217 | } |
| 218 | |
Zbigniew Lukwinski | 2f3563c | 2020-01-08 12:35:23 +0100 | [diff] [blame] | 219 | void Certificate::install(const std::string& certSrcFilePath) |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 220 | { |
| 221 | log<level::INFO>("Certificate install ", |
Zbigniew Lukwinski | 2f3563c | 2020-01-08 12:35:23 +0100 | [diff] [blame] | 222 | entry("FILEPATH=%s", certSrcFilePath.c_str())); |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 223 | auto errCode = X509_V_OK; |
| 224 | |
Marri Devender Rao | ffad1ef | 2019-06-03 04:54:12 -0500 | [diff] [blame] | 225 | // stop watch for user initiated certificate install |
| 226 | if (certWatchPtr) |
| 227 | { |
| 228 | certWatchPtr->stopWatch(); |
| 229 | } |
| 230 | |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 231 | // Verify the certificate file |
Zbigniew Lukwinski | 2f3563c | 2020-01-08 12:35:23 +0100 | [diff] [blame] | 232 | fs::path file(certSrcFilePath); |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 233 | if (!fs::exists(file)) |
| 234 | { |
Zbigniew Lukwinski | 2f3563c | 2020-01-08 12:35:23 +0100 | [diff] [blame] | 235 | log<level::ERR>("File is Missing", |
| 236 | entry("FILE=%s", certSrcFilePath.c_str())); |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 237 | elog<InternalFailure>(); |
| 238 | } |
| 239 | |
| 240 | try |
| 241 | { |
Zbigniew Lukwinski | 2f3563c | 2020-01-08 12:35:23 +0100 | [diff] [blame] | 242 | if (fs::file_size(certSrcFilePath) == 0) |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 243 | { |
| 244 | // file is empty |
| 245 | log<level::ERR>("File is empty", |
Zbigniew Lukwinski | 2f3563c | 2020-01-08 12:35:23 +0100 | [diff] [blame] | 246 | entry("FILE=%s", certSrcFilePath.c_str())); |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 247 | elog<InvalidCertificate>(Reason("File is empty")); |
| 248 | } |
| 249 | } |
| 250 | catch (const fs::filesystem_error& e) |
| 251 | { |
| 252 | // Log Error message |
Zbigniew Lukwinski | 2f3563c | 2020-01-08 12:35:23 +0100 | [diff] [blame] | 253 | log<level::ERR>(e.what(), entry("FILE=%s", certSrcFilePath.c_str())); |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 254 | elog<InternalFailure>(); |
| 255 | } |
| 256 | |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 257 | // Create an empty X509_STORE structure for certificate validation. |
Patrick Williams | 83e6eab | 2021-12-05 06:32:24 -0600 | [diff] [blame] | 258 | X509_STORE_Ptr x509Store(X509_STORE_new(), &X509_STORE_free); |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 259 | if (!x509Store) |
| 260 | { |
Nan Zhou | bf3cf75 | 2021-12-28 11:02:07 -0800 | [diff] [blame] | 261 | log<level::ERR>("Error occurred during X509_STORE_new call"); |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 262 | elog<InternalFailure>(); |
| 263 | } |
| 264 | |
| 265 | OpenSSL_add_all_algorithms(); |
| 266 | |
| 267 | // ADD Certificate Lookup method. |
Patrick Williams | 83e6eab | 2021-12-05 06:32:24 -0600 | [diff] [blame] | 268 | // lookup will be cleaned up automatically when the holding Store goes away. |
| 269 | auto lookup = X509_STORE_add_lookup(x509Store.get(), X509_LOOKUP_file()); |
| 270 | |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 271 | if (!lookup) |
| 272 | { |
Nan Zhou | bf3cf75 | 2021-12-28 11:02:07 -0800 | [diff] [blame] | 273 | log<level::ERR>("Error occurred during X509_STORE_add_lookup call"); |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 274 | elog<InternalFailure>(); |
| 275 | } |
| 276 | // Load Certificate file. |
Patrick Williams | 83e6eab | 2021-12-05 06:32:24 -0600 | [diff] [blame] | 277 | errCode = X509_LOOKUP_load_file(lookup, certSrcFilePath.c_str(), |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 278 | X509_FILETYPE_PEM); |
| 279 | if (errCode != 1) |
| 280 | { |
Nan Zhou | bf3cf75 | 2021-12-28 11:02:07 -0800 | [diff] [blame] | 281 | log<level::ERR>("Error occurred during X509_LOOKUP_load_file call", |
Zbigniew Lukwinski | 2f3563c | 2020-01-08 12:35:23 +0100 | [diff] [blame] | 282 | entry("FILE=%s", certSrcFilePath.c_str())); |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 283 | elog<InvalidCertificate>(Reason("Invalid certificate file format")); |
| 284 | } |
| 285 | |
Nan Zhou | bf3cf75 | 2021-12-28 11:02:07 -0800 | [diff] [blame] | 286 | // Load Certificate file into the X509 structure. |
Zbigniew Lukwinski | 2f3563c | 2020-01-08 12:35:23 +0100 | [diff] [blame] | 287 | X509_Ptr cert = loadCert(certSrcFilePath); |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 288 | X509_STORE_CTX_Ptr storeCtx(X509_STORE_CTX_new(), ::X509_STORE_CTX_free); |
| 289 | if (!storeCtx) |
| 290 | { |
Nan Zhou | bf3cf75 | 2021-12-28 11:02:07 -0800 | [diff] [blame] | 291 | log<level::ERR>("Error occurred during X509_STORE_CTX_new call", |
Zbigniew Lukwinski | 2f3563c | 2020-01-08 12:35:23 +0100 | [diff] [blame] | 292 | entry("FILE=%s", certSrcFilePath.c_str())); |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 293 | elog<InternalFailure>(); |
| 294 | } |
| 295 | |
Nan Zhou | cfb5802 | 2021-12-28 11:02:26 -0800 | [diff] [blame^] | 296 | errCode = X509_STORE_CTX_init(storeCtx.get(), x509Store.get(), cert.get(), |
| 297 | nullptr); |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 298 | if (errCode != 1) |
| 299 | { |
Nan Zhou | bf3cf75 | 2021-12-28 11:02:07 -0800 | [diff] [blame] | 300 | log<level::ERR>("Error occurred during X509_STORE_CTX_init call", |
Zbigniew Lukwinski | 2f3563c | 2020-01-08 12:35:23 +0100 | [diff] [blame] | 301 | entry("FILE=%s", certSrcFilePath.c_str())); |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 302 | elog<InternalFailure>(); |
| 303 | } |
| 304 | |
| 305 | // Set time to current time. |
| 306 | auto locTime = time(nullptr); |
| 307 | |
| 308 | X509_STORE_CTX_set_time(storeCtx.get(), X509_V_FLAG_USE_CHECK_TIME, |
| 309 | locTime); |
| 310 | |
| 311 | errCode = X509_verify_cert(storeCtx.get()); |
| 312 | if (errCode == 1) |
| 313 | { |
| 314 | errCode = X509_V_OK; |
| 315 | } |
| 316 | else if (errCode == 0) |
| 317 | { |
| 318 | errCode = X509_STORE_CTX_get_error(storeCtx.get()); |
Marri Devender Rao | 2e8c3a5 | 2019-08-09 01:26:35 -0500 | [diff] [blame] | 319 | log<level::INFO>( |
Nan Zhou | bf3cf75 | 2021-12-28 11:02:07 -0800 | [diff] [blame] | 320 | "Error occurred during X509_verify_cert call, checking for known " |
Marri Devender Rao | 2e8c3a5 | 2019-08-09 01:26:35 -0500 | [diff] [blame] | 321 | "error", |
Zbigniew Lukwinski | 2f3563c | 2020-01-08 12:35:23 +0100 | [diff] [blame] | 322 | entry("FILE=%s", certSrcFilePath.c_str()), |
| 323 | entry("ERRCODE=%d", errCode), |
Marri Devender Rao | 2e8c3a5 | 2019-08-09 01:26:35 -0500 | [diff] [blame] | 324 | entry("ERROR_STR=%s", X509_verify_cert_error_string(errCode))); |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 325 | } |
| 326 | else |
| 327 | { |
Nan Zhou | bf3cf75 | 2021-12-28 11:02:07 -0800 | [diff] [blame] | 328 | log<level::ERR>("Error occurred during X509_verify_cert call", |
Zbigniew Lukwinski | 2f3563c | 2020-01-08 12:35:23 +0100 | [diff] [blame] | 329 | entry("FILE=%s", certSrcFilePath.c_str())); |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 330 | elog<InternalFailure>(); |
| 331 | } |
| 332 | |
| 333 | // Allow certificate upload, for "certificate is not yet valid" and |
| 334 | // trust chain related errors. |
| 335 | if (!((errCode == X509_V_OK) || |
| 336 | (errCode == X509_V_ERR_CERT_NOT_YET_VALID) || |
| 337 | TRUST_CHAIN_ERR(errCode))) |
| 338 | { |
| 339 | if (errCode == X509_V_ERR_CERT_HAS_EXPIRED) |
| 340 | { |
Marri Devender Rao | c4522d2 | 2020-03-12 06:50:17 -0500 | [diff] [blame] | 341 | log<level::ERR>("Expired certificate "); |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 342 | elog<InvalidCertificate>(Reason("Expired Certificate")); |
| 343 | } |
Nan Zhou | bf3cf75 | 2021-12-28 11:02:07 -0800 | [diff] [blame] | 344 | // Logging general error here. |
Marri Devender Rao | c4522d2 | 2020-03-12 06:50:17 -0500 | [diff] [blame] | 345 | log<level::ERR>( |
| 346 | "Certificate validation failed", entry("ERRCODE=%d", errCode), |
| 347 | entry("ERROR_STR=%s", X509_verify_cert_error_string(errCode))); |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 348 | elog<InvalidCertificate>(Reason("Certificate validation failed")); |
| 349 | } |
| 350 | |
Nan Zhou | cf811c4 | 2021-12-02 14:56:17 -0800 | [diff] [blame] | 351 | validateCertificateStartDate(cert); |
Marri Devender Rao | c4522d2 | 2020-03-12 06:50:17 -0500 | [diff] [blame] | 352 | |
Nidhin MS | 811a29e | 2021-05-13 12:54:32 +0530 | [diff] [blame] | 353 | // Verify that the certificate can be used in a TLS context |
| 354 | const SSL_METHOD* method = TLS_method(); |
| 355 | std::unique_ptr<SSL_CTX, decltype(&::SSL_CTX_free)> ctx(SSL_CTX_new(method), |
| 356 | SSL_CTX_free); |
| 357 | if (SSL_CTX_use_certificate(ctx.get(), cert.get()) != 1) |
| 358 | { |
| 359 | log<level::ERR>("Certificate is not usable", |
| 360 | entry("ERRCODE=%x", ERR_get_error())); |
| 361 | elog<InvalidCertificate>(Reason("Certificate is not usable")); |
| 362 | } |
| 363 | |
Marri Devender Rao | cd30c49 | 2019-06-12 01:40:17 -0500 | [diff] [blame] | 364 | // Invoke type specific append private key function. |
| 365 | auto appendIter = appendKeyMap.find(certType); |
| 366 | if (appendIter == appendKeyMap.end()) |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 367 | { |
| 368 | log<level::ERR>("Unsupported Type", entry("TYPE=%s", certType.c_str())); |
| 369 | elog<InternalFailure>(); |
| 370 | } |
Zbigniew Lukwinski | 2f3563c | 2020-01-08 12:35:23 +0100 | [diff] [blame] | 371 | appendIter->second(certSrcFilePath); |
Marri Devender Rao | cd30c49 | 2019-06-12 01:40:17 -0500 | [diff] [blame] | 372 | |
| 373 | // Invoke type specific compare keys function. |
| 374 | auto compIter = typeFuncMap.find(certType); |
| 375 | if (compIter == typeFuncMap.end()) |
| 376 | { |
| 377 | log<level::ERR>("Unsupported Type", entry("TYPE=%s", certType.c_str())); |
| 378 | elog<InternalFailure>(); |
| 379 | } |
Zbigniew Lukwinski | 2f3563c | 2020-01-08 12:35:23 +0100 | [diff] [blame] | 380 | compIter->second(certSrcFilePath); |
Kowalski, Kamil | db029c9 | 2019-07-08 17:09:39 +0200 | [diff] [blame] | 381 | |
Marri Devender Rao | ffad1ef | 2019-06-03 04:54:12 -0500 | [diff] [blame] | 382 | // Copy the certificate to the installation path |
| 383 | // During bootup will be parsing existing file so no need to |
| 384 | // copy it. |
Zbigniew Lukwinski | 2f3563c | 2020-01-08 12:35:23 +0100 | [diff] [blame] | 385 | if (certSrcFilePath != certFilePath) |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 386 | { |
Marri Devender Rao | ffad1ef | 2019-06-03 04:54:12 -0500 | [diff] [blame] | 387 | std::ifstream inputCertFileStream; |
| 388 | std::ofstream outputCertFileStream; |
| 389 | inputCertFileStream.exceptions(std::ifstream::failbit | |
| 390 | std::ifstream::badbit | |
| 391 | std::ifstream::eofbit); |
| 392 | outputCertFileStream.exceptions(std::ofstream::failbit | |
| 393 | std::ofstream::badbit | |
| 394 | std::ofstream::eofbit); |
Kowalski, Kamil | db029c9 | 2019-07-08 17:09:39 +0200 | [diff] [blame] | 395 | |
Marri Devender Rao | ffad1ef | 2019-06-03 04:54:12 -0500 | [diff] [blame] | 396 | try |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 397 | { |
Zbigniew Lukwinski | 2f3563c | 2020-01-08 12:35:23 +0100 | [diff] [blame] | 398 | inputCertFileStream.open(certSrcFilePath); |
| 399 | outputCertFileStream.open(certFilePath, std::ios::out); |
Marri Devender Rao | ffad1ef | 2019-06-03 04:54:12 -0500 | [diff] [blame] | 400 | outputCertFileStream << inputCertFileStream.rdbuf() << std::flush; |
| 401 | inputCertFileStream.close(); |
| 402 | outputCertFileStream.close(); |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 403 | } |
Marri Devender Rao | ffad1ef | 2019-06-03 04:54:12 -0500 | [diff] [blame] | 404 | catch (const std::exception& e) |
| 405 | { |
| 406 | log<level::ERR>("Failed to copy certificate", |
| 407 | entry("ERR=%s", e.what()), |
Zbigniew Lukwinski | 2f3563c | 2020-01-08 12:35:23 +0100 | [diff] [blame] | 408 | entry("SRC=%s", certSrcFilePath.c_str()), |
| 409 | entry("DST=%s", certFilePath.c_str())); |
Marri Devender Rao | ffad1ef | 2019-06-03 04:54:12 -0500 | [diff] [blame] | 410 | elog<InternalFailure>(); |
| 411 | } |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 412 | } |
Marri Devender Rao | 8f80c35 | 2019-05-13 00:53:01 -0500 | [diff] [blame] | 413 | |
Zbigniew Lukwinski | 2f3563c | 2020-01-08 12:35:23 +0100 | [diff] [blame] | 414 | storageUpdate(); |
Dhruvaraj Subhashchandran | 36f2514 | 2019-02-14 05:06:26 -0600 | [diff] [blame] | 415 | |
Zbigniew Lukwinski | 2f3563c | 2020-01-08 12:35:23 +0100 | [diff] [blame] | 416 | // Keep certificate ID |
| 417 | certId = generateCertId(certFilePath); |
Kowalski, Kamil | db029c9 | 2019-07-08 17:09:39 +0200 | [diff] [blame] | 418 | |
Dhruvaraj Subhashchandran | 36f2514 | 2019-02-14 05:06:26 -0600 | [diff] [blame] | 419 | // Parse the certificate file and populate properties |
Zbigniew Lukwinski | 2f3563c | 2020-01-08 12:35:23 +0100 | [diff] [blame] | 420 | populateProperties(certFilePath); |
Marri Devender Rao | ffad1ef | 2019-06-03 04:54:12 -0500 | [diff] [blame] | 421 | |
| 422 | // restart watch |
| 423 | if (certWatchPtr) |
| 424 | { |
| 425 | certWatchPtr->startWatch(); |
| 426 | } |
Dhruvaraj Subhashchandran | 36f2514 | 2019-02-14 05:06:26 -0600 | [diff] [blame] | 427 | } |
| 428 | |
Nan Zhou | cf811c4 | 2021-12-02 14:56:17 -0800 | [diff] [blame] | 429 | // Checks that notBefore is not earlier than the unix epoch given that |
| 430 | // the corresponding DBus interface is uint64_t. |
| 431 | void Certificate::validateCertificateStartDate(const X509_Ptr& cert) |
Marri Devender Rao | c4522d2 | 2020-03-12 06:50:17 -0500 | [diff] [blame] | 432 | { |
| 433 | int days = 0; |
| 434 | int secs = 0; |
| 435 | |
| 436 | ASN1_TIME_ptr epoch(ASN1_TIME_new(), ASN1_STRING_free); |
Nan Zhou | cf811c4 | 2021-12-02 14:56:17 -0800 | [diff] [blame] | 437 | // Set time to 00:00am GMT, Jan 1 1970; format: YYYYMMDDHHMMSSZ |
| 438 | ASN1_TIME_set_string(epoch.get(), "19700101000000Z"); |
Marri Devender Rao | c4522d2 | 2020-03-12 06:50:17 -0500 | [diff] [blame] | 439 | |
Nan Zhou | cf811c4 | 2021-12-02 14:56:17 -0800 | [diff] [blame] | 440 | ASN1_TIME* notBefore = X509_get_notBefore(cert.get()); |
| 441 | ASN1_TIME_diff(&days, &secs, epoch.get(), notBefore); |
Marri Devender Rao | c4522d2 | 2020-03-12 06:50:17 -0500 | [diff] [blame] | 442 | |
Nan Zhou | cf811c4 | 2021-12-02 14:56:17 -0800 | [diff] [blame] | 443 | if (days < 0 || secs < 0) |
Marri Devender Rao | c4522d2 | 2020-03-12 06:50:17 -0500 | [diff] [blame] | 444 | { |
Nan Zhou | cf811c4 | 2021-12-02 14:56:17 -0800 | [diff] [blame] | 445 | log<level::ERR>("Certificate valid date starts before the Unix Epoch"); |
| 446 | elog<InvalidCertificate>( |
| 447 | Reason("NotBefore should after 19700101000000Z")); |
Marri Devender Rao | c4522d2 | 2020-03-12 06:50:17 -0500 | [diff] [blame] | 448 | } |
| 449 | } |
| 450 | |
Dhruvaraj Subhashchandran | 36f2514 | 2019-02-14 05:06:26 -0600 | [diff] [blame] | 451 | void Certificate::populateProperties() |
| 452 | { |
Kowalski, Kamil | db029c9 | 2019-07-08 17:09:39 +0200 | [diff] [blame] | 453 | populateProperties(certInstallPath); |
| 454 | } |
| 455 | |
Zbigniew Lukwinski | 2f3563c | 2020-01-08 12:35:23 +0100 | [diff] [blame] | 456 | std::string Certificate::getCertId() const |
Kowalski, Kamil | db029c9 | 2019-07-08 17:09:39 +0200 | [diff] [blame] | 457 | { |
Zbigniew Lukwinski | 2f3563c | 2020-01-08 12:35:23 +0100 | [diff] [blame] | 458 | return certId; |
| 459 | } |
| 460 | |
| 461 | bool Certificate::isSame(const std::string& certPath) |
| 462 | { |
| 463 | return getCertId() == generateCertId(certPath); |
| 464 | } |
| 465 | |
| 466 | void Certificate::storageUpdate() |
| 467 | { |
| 468 | if (certType == phosphor::certs::AUTHORITY) |
| 469 | { |
| 470 | // Create symbolic link in the certificate directory |
| 471 | std::string certFileX509Path; |
| 472 | try |
| 473 | { |
| 474 | if (!certFilePath.empty() && |
| 475 | fs::is_regular_file(fs::path(certFilePath))) |
| 476 | { |
| 477 | certFileX509Path = |
| 478 | generateAuthCertFileX509Path(certFilePath, certInstallPath); |
| 479 | fs::create_symlink(fs::path(certFilePath), |
| 480 | fs::path(certFileX509Path)); |
| 481 | } |
| 482 | } |
| 483 | catch (const std::exception& e) |
| 484 | { |
| 485 | log<level::ERR>("Failed to create symlink for certificate", |
| 486 | entry("ERR=%s", e.what()), |
| 487 | entry("FILE=%s", certFilePath.c_str()), |
| 488 | entry("SYMLINK=%s", certFileX509Path.c_str())); |
| 489 | elog<InternalFailure>(); |
| 490 | } |
| 491 | } |
Kowalski, Kamil | db029c9 | 2019-07-08 17:09:39 +0200 | [diff] [blame] | 492 | } |
| 493 | |
| 494 | void Certificate::populateProperties(const std::string& certPath) |
| 495 | { |
Zbigniew Lukwinski | 2f3563c | 2020-01-08 12:35:23 +0100 | [diff] [blame] | 496 | X509_Ptr cert = loadCert(certPath); |
Dhruvaraj Subhashchandran | 36f2514 | 2019-02-14 05:06:26 -0600 | [diff] [blame] | 497 | // Update properties if no error thrown |
| 498 | BIO_MEM_Ptr certBio(BIO_new(BIO_s_mem()), BIO_free); |
| 499 | PEM_write_bio_X509(certBio.get(), cert.get()); |
| 500 | BUF_MEM_Ptr certBuf(BUF_MEM_new(), BUF_MEM_free); |
| 501 | BUF_MEM* buf = certBuf.get(); |
| 502 | BIO_get_mem_ptr(certBio.get(), &buf); |
| 503 | std::string certStr(buf->data, buf->length); |
| 504 | CertificateIface::certificateString(certStr); |
| 505 | |
| 506 | static const int maxKeySize = 4096; |
| 507 | char subBuffer[maxKeySize] = {0}; |
Marri Devender Rao | dec5877 | 2019-06-11 03:10:00 -0500 | [diff] [blame] | 508 | BIO_MEM_Ptr subBio(BIO_new(BIO_s_mem()), BIO_free); |
Nan Zhou | bf3cf75 | 2021-12-28 11:02:07 -0800 | [diff] [blame] | 509 | // This pointer cannot be freed independently. |
Dhruvaraj Subhashchandran | 36f2514 | 2019-02-14 05:06:26 -0600 | [diff] [blame] | 510 | X509_NAME* sub = X509_get_subject_name(cert.get()); |
Marri Devender Rao | dec5877 | 2019-06-11 03:10:00 -0500 | [diff] [blame] | 511 | X509_NAME_print_ex(subBio.get(), sub, 0, XN_FLAG_SEP_COMMA_PLUS); |
| 512 | BIO_read(subBio.get(), subBuffer, maxKeySize); |
Dhruvaraj Subhashchandran | 36f2514 | 2019-02-14 05:06:26 -0600 | [diff] [blame] | 513 | CertificateIface::subject(subBuffer); |
| 514 | |
Dhruvaraj Subhashchandran | 36f2514 | 2019-02-14 05:06:26 -0600 | [diff] [blame] | 515 | char issuerBuffer[maxKeySize] = {0}; |
Marri Devender Rao | dec5877 | 2019-06-11 03:10:00 -0500 | [diff] [blame] | 516 | BIO_MEM_Ptr issuerBio(BIO_new(BIO_s_mem()), BIO_free); |
Nan Zhou | bf3cf75 | 2021-12-28 11:02:07 -0800 | [diff] [blame] | 517 | // This pointer cannot be freed independently. |
Dhruvaraj Subhashchandran | 36f2514 | 2019-02-14 05:06:26 -0600 | [diff] [blame] | 518 | X509_NAME* issuer_name = X509_get_issuer_name(cert.get()); |
Marri Devender Rao | dec5877 | 2019-06-11 03:10:00 -0500 | [diff] [blame] | 519 | X509_NAME_print_ex(issuerBio.get(), issuer_name, 0, XN_FLAG_SEP_COMMA_PLUS); |
| 520 | BIO_read(issuerBio.get(), issuerBuffer, maxKeySize); |
Dhruvaraj Subhashchandran | 36f2514 | 2019-02-14 05:06:26 -0600 | [diff] [blame] | 521 | CertificateIface::issuer(issuerBuffer); |
| 522 | |
| 523 | std::vector<std::string> keyUsageList; |
| 524 | ASN1_BIT_STRING* usage; |
| 525 | |
| 526 | // Go through each usage in the bit string and convert to |
| 527 | // corresponding string value |
| 528 | if ((usage = static_cast<ASN1_BIT_STRING*>( |
Nan Zhou | cfb5802 | 2021-12-28 11:02:26 -0800 | [diff] [blame^] | 529 | X509_get_ext_d2i(cert.get(), NID_key_usage, nullptr, nullptr)))) |
Dhruvaraj Subhashchandran | 36f2514 | 2019-02-14 05:06:26 -0600 | [diff] [blame] | 530 | { |
| 531 | for (auto i = 0; i < usage->length; ++i) |
| 532 | { |
| 533 | for (auto& x : keyUsageToRfStr) |
| 534 | { |
| 535 | if (x.first & usage->data[i]) |
| 536 | { |
| 537 | keyUsageList.push_back(x.second); |
| 538 | break; |
| 539 | } |
| 540 | } |
| 541 | } |
| 542 | } |
| 543 | |
| 544 | EXTENDED_KEY_USAGE* extUsage; |
Nan Zhou | cfb5802 | 2021-12-28 11:02:26 -0800 | [diff] [blame^] | 545 | if ((extUsage = static_cast<EXTENDED_KEY_USAGE*>(X509_get_ext_d2i( |
| 546 | cert.get(), NID_ext_key_usage, nullptr, nullptr)))) |
Dhruvaraj Subhashchandran | 36f2514 | 2019-02-14 05:06:26 -0600 | [diff] [blame] | 547 | { |
| 548 | for (int i = 0; i < sk_ASN1_OBJECT_num(extUsage); i++) |
| 549 | { |
| 550 | keyUsageList.push_back(extendedKeyUsageToRfStr[OBJ_obj2nid( |
| 551 | sk_ASN1_OBJECT_value(extUsage, i))]); |
| 552 | } |
| 553 | } |
| 554 | CertificateIface::keyUsage(keyUsageList); |
| 555 | |
| 556 | int days = 0; |
| 557 | int secs = 0; |
| 558 | |
| 559 | ASN1_TIME_ptr epoch(ASN1_TIME_new(), ASN1_STRING_free); |
Nan Zhou | cf811c4 | 2021-12-02 14:56:17 -0800 | [diff] [blame] | 560 | // Set time to 00:00am GMT, Jan 1 1970; format: YYYYMMDDHHMMSSZ |
| 561 | ASN1_TIME_set_string(epoch.get(), "19700101000000Z"); |
Dhruvaraj Subhashchandran | 36f2514 | 2019-02-14 05:06:26 -0600 | [diff] [blame] | 562 | |
Nan Zhou | cf811c4 | 2021-12-02 14:56:17 -0800 | [diff] [blame] | 563 | static const uint64_t dayToSeconds = 24 * 60 * 60; |
Dhruvaraj Subhashchandran | 36f2514 | 2019-02-14 05:06:26 -0600 | [diff] [blame] | 564 | ASN1_TIME* notAfter = X509_get_notAfter(cert.get()); |
| 565 | ASN1_TIME_diff(&days, &secs, epoch.get(), notAfter); |
| 566 | CertificateIface::validNotAfter((days * dayToSeconds) + secs); |
| 567 | |
| 568 | ASN1_TIME* notBefore = X509_get_notBefore(cert.get()); |
| 569 | ASN1_TIME_diff(&days, &secs, epoch.get(), notBefore); |
| 570 | CertificateIface::validNotBefore((days * dayToSeconds) + secs); |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 571 | } |
| 572 | |
| 573 | X509_Ptr Certificate::loadCert(const std::string& filePath) |
| 574 | { |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 575 | // Read Certificate file |
| 576 | X509_Ptr cert(X509_new(), ::X509_free); |
| 577 | if (!cert) |
| 578 | { |
Nan Zhou | bf3cf75 | 2021-12-28 11:02:07 -0800 | [diff] [blame] | 579 | log<level::ERR>("Error occurred during X509_new call", |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 580 | entry("FILE=%s", filePath.c_str()), |
| 581 | entry("ERRCODE=%lu", ERR_get_error())); |
| 582 | elog<InternalFailure>(); |
| 583 | } |
| 584 | |
| 585 | BIO_MEM_Ptr bioCert(BIO_new_file(filePath.c_str(), "rb"), ::BIO_free); |
| 586 | if (!bioCert) |
| 587 | { |
Nan Zhou | bf3cf75 | 2021-12-28 11:02:07 -0800 | [diff] [blame] | 588 | log<level::ERR>("Error occurred during BIO_new_file call", |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 589 | entry("FILE=%s", filePath.c_str())); |
| 590 | elog<InternalFailure>(); |
| 591 | } |
| 592 | |
| 593 | X509* x509 = cert.get(); |
| 594 | if (!PEM_read_bio_X509(bioCert.get(), &x509, nullptr, nullptr)) |
| 595 | { |
Nan Zhou | bf3cf75 | 2021-12-28 11:02:07 -0800 | [diff] [blame] | 596 | log<level::ERR>("Error occurred during PEM_read_bio_X509 call", |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 597 | entry("FILE=%s", filePath.c_str())); |
| 598 | elog<InternalFailure>(); |
| 599 | } |
| 600 | return cert; |
| 601 | } |
Marri Devender Rao | cd30c49 | 2019-06-12 01:40:17 -0500 | [diff] [blame] | 602 | |
| 603 | void Certificate::checkAndAppendPrivateKey(const std::string& filePath) |
| 604 | { |
| 605 | BIO_MEM_Ptr keyBio(BIO_new(BIO_s_file()), ::BIO_free); |
| 606 | if (!keyBio) |
| 607 | { |
Nan Zhou | bf3cf75 | 2021-12-28 11:02:07 -0800 | [diff] [blame] | 608 | log<level::ERR>("Error occurred during BIO_s_file call", |
Marri Devender Rao | cd30c49 | 2019-06-12 01:40:17 -0500 | [diff] [blame] | 609 | entry("FILE=%s", filePath.c_str())); |
| 610 | elog<InternalFailure>(); |
| 611 | } |
| 612 | BIO_read_filename(keyBio.get(), filePath.c_str()); |
| 613 | |
| 614 | EVP_PKEY_Ptr priKey( |
| 615 | PEM_read_bio_PrivateKey(keyBio.get(), nullptr, nullptr, nullptr), |
| 616 | ::EVP_PKEY_free); |
| 617 | if (!priKey) |
| 618 | { |
| 619 | log<level::INFO>("Private key not present in file", |
| 620 | entry("FILE=%s", filePath.c_str())); |
| 621 | fs::path privateKeyFile = fs::path(certInstallPath).parent_path(); |
| 622 | privateKeyFile = privateKeyFile / PRIV_KEY_FILE_NAME; |
| 623 | if (!fs::exists(privateKeyFile)) |
| 624 | { |
| 625 | log<level::ERR>("Private key file is not found", |
| 626 | entry("FILE=%s", privateKeyFile.c_str())); |
| 627 | elog<InternalFailure>(); |
| 628 | } |
| 629 | |
| 630 | std::ifstream privKeyFileStream; |
| 631 | std::ofstream certFileStream; |
| 632 | privKeyFileStream.exceptions(std::ifstream::failbit | |
| 633 | std::ifstream::badbit | |
| 634 | std::ifstream::eofbit); |
| 635 | certFileStream.exceptions(std::ofstream::failbit | |
| 636 | std::ofstream::badbit | |
| 637 | std::ofstream::eofbit); |
| 638 | try |
| 639 | { |
| 640 | privKeyFileStream.open(privateKeyFile); |
| 641 | certFileStream.open(filePath, std::ios::app); |
Marri Devender Rao | 18e51c9 | 2019-07-15 04:59:01 -0500 | [diff] [blame] | 642 | certFileStream << std::endl; // insert line break |
Marri Devender Rao | cd30c49 | 2019-06-12 01:40:17 -0500 | [diff] [blame] | 643 | certFileStream << privKeyFileStream.rdbuf() << std::flush; |
| 644 | privKeyFileStream.close(); |
| 645 | certFileStream.close(); |
| 646 | } |
| 647 | catch (const std::exception& e) |
| 648 | { |
| 649 | log<level::ERR>("Failed to append private key", |
| 650 | entry("ERR=%s", e.what()), |
| 651 | entry("SRC=%s", privateKeyFile.c_str()), |
| 652 | entry("DST=%s", filePath.c_str())); |
| 653 | elog<InternalFailure>(); |
| 654 | } |
| 655 | } |
| 656 | } |
| 657 | |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 658 | bool Certificate::compareKeys(const std::string& filePath) |
| 659 | { |
| 660 | log<level::INFO>("Certificate compareKeys", |
| 661 | entry("FILEPATH=%s", filePath.c_str())); |
| 662 | X509_Ptr cert(X509_new(), ::X509_free); |
| 663 | if (!cert) |
| 664 | { |
Nan Zhou | bf3cf75 | 2021-12-28 11:02:07 -0800 | [diff] [blame] | 665 | log<level::ERR>("Error occurred during X509_new call", |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 666 | entry("FILE=%s", filePath.c_str()), |
| 667 | entry("ERRCODE=%lu", ERR_get_error())); |
| 668 | elog<InternalFailure>(); |
| 669 | } |
| 670 | |
| 671 | BIO_MEM_Ptr bioCert(BIO_new_file(filePath.c_str(), "rb"), ::BIO_free); |
| 672 | if (!bioCert) |
| 673 | { |
Nan Zhou | bf3cf75 | 2021-12-28 11:02:07 -0800 | [diff] [blame] | 674 | log<level::ERR>("Error occurred during BIO_new_file call", |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 675 | entry("FILE=%s", filePath.c_str())); |
| 676 | elog<InternalFailure>(); |
| 677 | } |
| 678 | |
| 679 | X509* x509 = cert.get(); |
| 680 | PEM_read_bio_X509(bioCert.get(), &x509, nullptr, nullptr); |
| 681 | |
| 682 | EVP_PKEY_Ptr pubKey(X509_get_pubkey(cert.get()), ::EVP_PKEY_free); |
| 683 | if (!pubKey) |
| 684 | { |
| 685 | log<level::ERR>("Error occurred during X509_get_pubkey", |
| 686 | entry("FILE=%s", filePath.c_str()), |
| 687 | entry("ERRCODE=%lu", ERR_get_error())); |
| 688 | elog<InvalidCertificate>(Reason("Failed to get public key info")); |
| 689 | } |
| 690 | |
| 691 | BIO_MEM_Ptr keyBio(BIO_new(BIO_s_file()), ::BIO_free); |
| 692 | if (!keyBio) |
| 693 | { |
Nan Zhou | bf3cf75 | 2021-12-28 11:02:07 -0800 | [diff] [blame] | 694 | log<level::ERR>("Error occurred during BIO_s_file call", |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 695 | entry("FILE=%s", filePath.c_str())); |
| 696 | elog<InternalFailure>(); |
| 697 | } |
| 698 | BIO_read_filename(keyBio.get(), filePath.c_str()); |
| 699 | |
| 700 | EVP_PKEY_Ptr priKey( |
| 701 | PEM_read_bio_PrivateKey(keyBio.get(), nullptr, nullptr, nullptr), |
| 702 | ::EVP_PKEY_free); |
| 703 | if (!priKey) |
| 704 | { |
| 705 | log<level::ERR>("Error occurred during PEM_read_bio_PrivateKey", |
| 706 | entry("FILE=%s", filePath.c_str()), |
| 707 | entry("ERRCODE=%lu", ERR_get_error())); |
| 708 | elog<InvalidCertificate>(Reason("Failed to get private key info")); |
| 709 | } |
| 710 | |
Patrick Williams | 55ceaa2 | 2021-12-14 06:52:26 -0600 | [diff] [blame] | 711 | #if (OPENSSL_VERSION_NUMBER < 0x30000000L) |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 712 | int32_t rc = EVP_PKEY_cmp(priKey.get(), pubKey.get()); |
Patrick Williams | 55ceaa2 | 2021-12-14 06:52:26 -0600 | [diff] [blame] | 713 | #else |
| 714 | int32_t rc = EVP_PKEY_eq(priKey.get(), pubKey.get()); |
| 715 | #endif |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 716 | if (rc != 1) |
| 717 | { |
| 718 | log<level::ERR>("Private key is not matching with Certificate", |
| 719 | entry("FILE=%s", filePath.c_str()), |
| 720 | entry("ERRCODE=%d", rc)); |
| 721 | return false; |
| 722 | } |
| 723 | return true; |
| 724 | } |
| 725 | |
Zbigniew Kurzynski | a3bb38f | 2019-09-17 13:34:25 +0200 | [diff] [blame] | 726 | void Certificate::delete_() |
| 727 | { |
Zbigniew Lukwinski | 2f3563c | 2020-01-08 12:35:23 +0100 | [diff] [blame] | 728 | manager.deleteCertificate(this); |
Zbigniew Kurzynski | a3bb38f | 2019-09-17 13:34:25 +0200 | [diff] [blame] | 729 | } |
Marri Devender Rao | 6ceec40 | 2019-02-01 03:15:19 -0600 | [diff] [blame] | 730 | } // namespace certs |
| 731 | } // namespace phosphor |