1 #pragma once 2 #ifdef BMCWEB_ENABLE_SSL 3 4 #include <openssl/bio.h> 5 #include <openssl/dh.h> 6 #include <openssl/dsa.h> 7 #include <openssl/err.h> 8 #include <openssl/evp.h> 9 #include <openssl/pem.h> 10 #include <openssl/rand.h> 11 #include <openssl/rsa.h> 12 #include <openssl/ssl.h> 13 14 #include <boost/asio/ssl/context.hpp> 15 #include <random> 16 17 namespace ensuressl 18 { 19 constexpr char const *trustStorePath = "/etc/ssl/certs/authority"; 20 static void initOpenssl(); 21 static EVP_PKEY *createEcKey(); 22 23 // Trust chain related errors.` 24 inline bool isTrustChainError(int errnum) 25 { 26 if ((errnum == X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT) || 27 (errnum == X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN) || 28 (errnum == X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY) || 29 (errnum == X509_V_ERR_CERT_UNTRUSTED) || 30 (errnum == X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE)) 31 { 32 return true; 33 } 34 else 35 { 36 return false; 37 } 38 } 39 40 inline bool validateCertificate(X509 *const cert) 41 { 42 // Create an empty X509_STORE structure for certificate validation. 43 X509_STORE *x509Store = X509_STORE_new(); 44 if (!x509Store) 45 { 46 BMCWEB_LOG_ERROR << "Error occured during X509_STORE_new call"; 47 return false; 48 } 49 50 // Load Certificate file into the X509 structure. 51 X509_STORE_CTX *storeCtx = X509_STORE_CTX_new(); 52 if (!storeCtx) 53 { 54 BMCWEB_LOG_ERROR << "Error occured during X509_STORE_CTX_new call"; 55 X509_STORE_free(x509Store); 56 return false; 57 } 58 59 int errCode = X509_STORE_CTX_init(storeCtx, x509Store, cert, nullptr); 60 if (errCode != 1) 61 { 62 BMCWEB_LOG_ERROR << "Error occured during X509_STORE_CTX_init call"; 63 X509_STORE_CTX_free(storeCtx); 64 X509_STORE_free(x509Store); 65 return false; 66 } 67 68 errCode = X509_verify_cert(storeCtx); 69 if (errCode == 1) 70 { 71 BMCWEB_LOG_INFO << "Certificate verification is success"; 72 X509_STORE_CTX_free(storeCtx); 73 X509_STORE_free(x509Store); 74 return true; 75 } 76 if (errCode == 0) 77 { 78 errCode = X509_STORE_CTX_get_error(storeCtx); 79 X509_STORE_CTX_free(storeCtx); 80 X509_STORE_free(x509Store); 81 if (isTrustChainError(errCode)) 82 { 83 BMCWEB_LOG_DEBUG << "Ignoring Trust Chain error. Reason: " 84 << X509_verify_cert_error_string(errCode); 85 return true; 86 } 87 else 88 { 89 BMCWEB_LOG_ERROR << "Certificate verification failed. Reason: " 90 << X509_verify_cert_error_string(errCode); 91 return false; 92 } 93 } 94 95 BMCWEB_LOG_ERROR 96 << "Error occured during X509_verify_cert call. ErrorCode: " << errCode; 97 X509_STORE_CTX_free(storeCtx); 98 X509_STORE_free(x509Store); 99 return false; 100 } 101 102 inline bool verifyOpensslKeyCert(const std::string &filepath) 103 { 104 bool privateKeyValid = false; 105 bool certValid = false; 106 107 std::cout << "Checking certs in file " << filepath << "\n"; 108 109 FILE *file = fopen(filepath.c_str(), "r"); 110 if (file != nullptr) 111 { 112 EVP_PKEY *pkey = PEM_read_PrivateKey(file, nullptr, nullptr, nullptr); 113 if (pkey != nullptr) 114 { 115 RSA *rsa = EVP_PKEY_get1_RSA(pkey); 116 if (rsa != nullptr) 117 { 118 std::cout << "Found an RSA key\n"; 119 if (RSA_check_key(rsa) == 1) 120 { 121 privateKeyValid = true; 122 } 123 else 124 { 125 std::cerr << "Key not valid error number " 126 << ERR_get_error() << "\n"; 127 } 128 RSA_free(rsa); 129 } 130 else 131 { 132 EC_KEY *ec = EVP_PKEY_get1_EC_KEY(pkey); 133 if (ec != nullptr) 134 { 135 std::cout << "Found an EC key\n"; 136 if (EC_KEY_check_key(ec) == 1) 137 { 138 privateKeyValid = true; 139 } 140 else 141 { 142 std::cerr << "Key not valid error number " 143 << ERR_get_error() << "\n"; 144 } 145 EC_KEY_free(ec); 146 } 147 } 148 149 if (privateKeyValid) 150 { 151 // If the order is certificate followed by key in input file 152 // then, certificate read will fail. So, setting the file 153 // pointer to point beginning of file to avoid certificate and 154 // key order issue. 155 fseek(file, 0, SEEK_SET); 156 157 X509 *x509 = PEM_read_X509(file, nullptr, nullptr, nullptr); 158 if (x509 == nullptr) 159 { 160 std::cout << "error getting x509 cert " << ERR_get_error() 161 << "\n"; 162 } 163 else 164 { 165 certValid = validateCertificate(x509); 166 X509_free(x509); 167 } 168 } 169 170 EVP_PKEY_free(pkey); 171 } 172 fclose(file); 173 } 174 return certValid; 175 } 176 177 inline void generateSslCertificate(const std::string &filepath) 178 { 179 FILE *pFile = nullptr; 180 std::cout << "Generating new keys\n"; 181 initOpenssl(); 182 183 // std::cerr << "Generating RSA key"; 184 // EVP_PKEY *pRsaPrivKey = create_rsa_key(); 185 186 std::cerr << "Generating EC key\n"; 187 EVP_PKEY *pRsaPrivKey = createEcKey(); 188 if (pRsaPrivKey != nullptr) 189 { 190 std::cerr << "Generating x509 Certificate\n"; 191 // Use this code to directly generate a certificate 192 X509 *x509; 193 x509 = X509_new(); 194 if (x509 != nullptr) 195 { 196 // get a random number from the RNG for the certificate serial 197 // number If this is not random, regenerating certs throws broswer 198 // errors 199 std::random_device rd; 200 int serial = static_cast<int>(rd()); 201 202 ASN1_INTEGER_set(X509_get_serialNumber(x509), serial); 203 204 // not before this moment 205 X509_gmtime_adj(X509_get_notBefore(x509), 0); 206 // Cert is valid for 10 years 207 X509_gmtime_adj(X509_get_notAfter(x509), 208 60L * 60L * 24L * 365L * 10L); 209 210 // set the public key to the key we just generated 211 X509_set_pubkey(x509, pRsaPrivKey); 212 213 // get the subject name 214 X509_NAME *name; 215 name = X509_get_subject_name(x509); 216 217 X509_NAME_add_entry_by_txt( 218 name, "C", MBSTRING_ASC, 219 reinterpret_cast<const unsigned char *>("US"), -1, -1, 0); 220 X509_NAME_add_entry_by_txt( 221 name, "O", MBSTRING_ASC, 222 reinterpret_cast<const unsigned char *>("OpenBMC"), -1, -1, 0); 223 X509_NAME_add_entry_by_txt( 224 name, "CN", MBSTRING_ASC, 225 reinterpret_cast<const unsigned char *>("testhost"), -1, -1, 0); 226 // set the CSR options 227 X509_set_issuer_name(x509, name); 228 229 // Sign the certificate with our private key 230 X509_sign(x509, pRsaPrivKey, EVP_sha256()); 231 232 pFile = fopen(filepath.c_str(), "wt"); 233 234 if (pFile != nullptr) 235 { 236 PEM_write_PrivateKey(pFile, pRsaPrivKey, nullptr, nullptr, 0, 237 nullptr, nullptr); 238 239 PEM_write_X509(pFile, x509); 240 fclose(pFile); 241 pFile = nullptr; 242 } 243 244 X509_free(x509); 245 } 246 247 EVP_PKEY_free(pRsaPrivKey); 248 pRsaPrivKey = nullptr; 249 } 250 251 // cleanup_openssl(); 252 } 253 254 EVP_PKEY *createEcKey() 255 { 256 EVP_PKEY *pKey = nullptr; 257 int eccgrp = 0; 258 eccgrp = OBJ_txt2nid("prime256v1"); 259 260 EC_KEY *myecc = EC_KEY_new_by_curve_name(eccgrp); 261 if (myecc != nullptr) 262 { 263 EC_KEY_set_asn1_flag(myecc, OPENSSL_EC_NAMED_CURVE); 264 EC_KEY_generate_key(myecc); 265 pKey = EVP_PKEY_new(); 266 if (pKey != nullptr) 267 { 268 if (EVP_PKEY_assign_EC_KEY(pKey, myecc)) 269 { 270 /* pKey owns pRSA from now */ 271 if (EC_KEY_check_key(myecc) <= 0) 272 { 273 fprintf(stderr, "EC_check_key failed.\n"); 274 } 275 } 276 } 277 } 278 return pKey; 279 } 280 281 void initOpenssl() 282 { 283 #if OPENSSL_VERSION_NUMBER < 0x10100000L 284 SSL_load_error_strings(); 285 OpenSSL_add_all_algorithms(); 286 RAND_load_file("/dev/urandom", 1024); 287 #endif 288 } 289 290 inline void ensureOpensslKeyPresentAndValid(const std::string &filepath) 291 { 292 bool pemFileValid = false; 293 294 pemFileValid = verifyOpensslKeyCert(filepath); 295 296 if (!pemFileValid) 297 { 298 std::cerr << "Error in verifying signature, regenerating\n"; 299 generateSslCertificate(filepath); 300 } 301 } 302 303 inline std::shared_ptr<boost::asio::ssl::context> 304 getSslContext(const std::string &ssl_pem_file) 305 { 306 std::shared_ptr<boost::asio::ssl::context> mSslContext = 307 std::make_shared<boost::asio::ssl::context>( 308 boost::asio::ssl::context::tls_server); 309 mSslContext->set_options(boost::asio::ssl::context::default_workarounds | 310 boost::asio::ssl::context::no_sslv2 | 311 boost::asio::ssl::context::no_sslv3 | 312 boost::asio::ssl::context::single_dh_use | 313 boost::asio::ssl::context::no_tlsv1 | 314 boost::asio::ssl::context::no_tlsv1_1); 315 316 // BIG WARNING: This needs to stay disabled, as there will always be 317 // unauthenticated endpoints 318 // mSslContext->set_verify_mode(boost::asio::ssl::verify_peer); 319 320 SSL_CTX_set_options(mSslContext->native_handle(), SSL_OP_NO_RENEGOTIATION); 321 322 BMCWEB_LOG_DEBUG << "Using default TrustStore location: " << trustStorePath; 323 mSslContext->add_verify_path(trustStorePath); 324 325 mSslContext->use_certificate_file(ssl_pem_file, 326 boost::asio::ssl::context::pem); 327 mSslContext->use_private_key_file(ssl_pem_file, 328 boost::asio::ssl::context::pem); 329 330 // Set up EC curves to auto (boost asio doesn't have a method for this) 331 // There is a pull request to add this. Once this is included in an asio 332 // drop, use the right way 333 // http://stackoverflow.com/questions/18929049/boost-asio-with-ecdsa-certificate-issue 334 if (SSL_CTX_set_ecdh_auto(mSslContext->native_handle(), 1) != 1) 335 { 336 BMCWEB_LOG_ERROR << "Error setting tmp ecdh list\n"; 337 } 338 339 std::string mozillaModern = "ECDHE-ECDSA-AES256-GCM-SHA384:" 340 "ECDHE-RSA-AES256-GCM-SHA384:" 341 "ECDHE-ECDSA-CHACHA20-POLY1305:" 342 "ECDHE-RSA-CHACHA20-POLY1305:" 343 "ECDHE-ECDSA-AES128-GCM-SHA256:" 344 "ECDHE-RSA-AES128-GCM-SHA256:" 345 "ECDHE-ECDSA-AES256-SHA384:" 346 "ECDHE-RSA-AES256-SHA384:" 347 "ECDHE-ECDSA-AES128-SHA256:" 348 "ECDHE-RSA-AES128-SHA256"; 349 350 if (SSL_CTX_set_cipher_list(mSslContext->native_handle(), 351 mozillaModern.c_str()) != 1) 352 { 353 BMCWEB_LOG_ERROR << "Error setting cipher list\n"; 354 } 355 return mSslContext; 356 } 357 } // namespace ensuressl 358 359 #endif 360