1 #pragma once 2 #ifdef BMCWEB_ENABLE_SSL 3 4 #include <openssl/bio.h> 5 #include <openssl/dh.h> 6 #include <openssl/dsa.h> 7 #include <openssl/err.h> 8 #include <openssl/evp.h> 9 #include <openssl/pem.h> 10 #include <openssl/rand.h> 11 #include <openssl/rsa.h> 12 #include <openssl/ssl.h> 13 14 #include <boost/asio/ssl/context.hpp> 15 16 #include <random> 17 18 namespace ensuressl 19 { 20 constexpr char const* trustStorePath = "/etc/ssl/certs/authority"; 21 constexpr char const* x509Comment = "Generated from OpenBMC service"; 22 static void initOpenssl(); 23 static EVP_PKEY* createEcKey(); 24 25 // Trust chain related errors.` 26 inline bool isTrustChainError(int errnum) 27 { 28 if ((errnum == X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT) || 29 (errnum == X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN) || 30 (errnum == X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY) || 31 (errnum == X509_V_ERR_CERT_UNTRUSTED) || 32 (errnum == X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE)) 33 { 34 return true; 35 } 36 return false; 37 } 38 39 inline bool validateCertificate(X509* const cert) 40 { 41 // Create an empty X509_STORE structure for certificate validation. 42 X509_STORE* x509Store = X509_STORE_new(); 43 if (!x509Store) 44 { 45 BMCWEB_LOG_ERROR << "Error occurred during X509_STORE_new call"; 46 return false; 47 } 48 49 // Load Certificate file into the X509 structure. 50 X509_STORE_CTX* storeCtx = X509_STORE_CTX_new(); 51 if (!storeCtx) 52 { 53 BMCWEB_LOG_ERROR << "Error occurred during X509_STORE_CTX_new call"; 54 X509_STORE_free(x509Store); 55 return false; 56 } 57 58 int errCode = X509_STORE_CTX_init(storeCtx, x509Store, cert, nullptr); 59 if (errCode != 1) 60 { 61 BMCWEB_LOG_ERROR << "Error occurred during X509_STORE_CTX_init call"; 62 X509_STORE_CTX_free(storeCtx); 63 X509_STORE_free(x509Store); 64 return false; 65 } 66 67 errCode = X509_verify_cert(storeCtx); 68 if (errCode == 1) 69 { 70 BMCWEB_LOG_INFO << "Certificate verification is success"; 71 X509_STORE_CTX_free(storeCtx); 72 X509_STORE_free(x509Store); 73 return true; 74 } 75 if (errCode == 0) 76 { 77 errCode = X509_STORE_CTX_get_error(storeCtx); 78 X509_STORE_CTX_free(storeCtx); 79 X509_STORE_free(x509Store); 80 if (isTrustChainError(errCode)) 81 { 82 BMCWEB_LOG_DEBUG << "Ignoring Trust Chain error. Reason: " 83 << X509_verify_cert_error_string(errCode); 84 return true; 85 } 86 BMCWEB_LOG_ERROR << "Certificate verification failed. Reason: " 87 << X509_verify_cert_error_string(errCode); 88 return false; 89 } 90 91 BMCWEB_LOG_ERROR 92 << "Error occurred during X509_verify_cert call. ErrorCode: " 93 << errCode; 94 X509_STORE_CTX_free(storeCtx); 95 X509_STORE_free(x509Store); 96 return false; 97 } 98 99 inline bool verifyOpensslKeyCert(const std::string& filepath) 100 { 101 bool privateKeyValid = false; 102 bool certValid = false; 103 104 std::cout << "Checking certs in file " << filepath << "\n"; 105 106 FILE* file = fopen(filepath.c_str(), "r"); 107 if (file != nullptr) 108 { 109 EVP_PKEY* pkey = PEM_read_PrivateKey(file, nullptr, nullptr, nullptr); 110 if (pkey != nullptr) 111 { 112 RSA* rsa = EVP_PKEY_get1_RSA(pkey); 113 if (rsa != nullptr) 114 { 115 std::cout << "Found an RSA key\n"; 116 if (RSA_check_key(rsa) == 1) 117 { 118 privateKeyValid = true; 119 } 120 else 121 { 122 std::cerr << "Key not valid error number " 123 << ERR_get_error() << "\n"; 124 } 125 RSA_free(rsa); 126 } 127 else 128 { 129 EC_KEY* ec = EVP_PKEY_get1_EC_KEY(pkey); 130 if (ec != nullptr) 131 { 132 std::cout << "Found an EC key\n"; 133 if (EC_KEY_check_key(ec) == 1) 134 { 135 privateKeyValid = true; 136 } 137 else 138 { 139 std::cerr << "Key not valid error number " 140 << ERR_get_error() << "\n"; 141 } 142 EC_KEY_free(ec); 143 } 144 } 145 146 if (privateKeyValid) 147 { 148 // If the order is certificate followed by key in input file 149 // then, certificate read will fail. So, setting the file 150 // pointer to point beginning of file to avoid certificate and 151 // key order issue. 152 fseek(file, 0, SEEK_SET); 153 154 X509* x509 = PEM_read_X509(file, nullptr, nullptr, nullptr); 155 if (x509 == nullptr) 156 { 157 std::cout << "error getting x509 cert " << ERR_get_error() 158 << "\n"; 159 } 160 else 161 { 162 certValid = validateCertificate(x509); 163 X509_free(x509); 164 } 165 } 166 167 EVP_PKEY_free(pkey); 168 } 169 fclose(file); 170 } 171 return certValid; 172 } 173 174 inline X509* loadCert(const std::string& filePath) 175 { 176 BIO* certFileBio = BIO_new_file(filePath.c_str(), "rb"); 177 if (!certFileBio) 178 { 179 BMCWEB_LOG_ERROR << "Error occured during BIO_new_file call, " 180 << "FILE= " << filePath; 181 return nullptr; 182 } 183 184 X509* cert = X509_new(); 185 if (!cert) 186 { 187 BMCWEB_LOG_ERROR << "Error occured during X509_new call, " 188 << ERR_get_error(); 189 BIO_free(certFileBio); 190 return nullptr; 191 } 192 193 if (!PEM_read_bio_X509(certFileBio, &cert, nullptr, nullptr)) 194 { 195 BMCWEB_LOG_ERROR << "Error occured during PEM_read_bio_X509 call, " 196 << "FILE= " << filePath; 197 198 BIO_free(certFileBio); 199 X509_free(cert); 200 return nullptr; 201 } 202 return cert; 203 } 204 205 inline int addExt(X509* cert, int nid, const char* value) 206 { 207 X509_EXTENSION* ex = nullptr; 208 X509V3_CTX ctx; 209 X509V3_set_ctx_nodb(&ctx); 210 X509V3_set_ctx(&ctx, cert, cert, nullptr, nullptr, 0); 211 ex = X509V3_EXT_conf_nid(nullptr, &ctx, nid, const_cast<char*>(value)); 212 if (!ex) 213 { 214 BMCWEB_LOG_ERROR << "Error: In X509V3_EXT_conf_nidn: " << value; 215 return -1; 216 } 217 X509_add_ext(cert, ex, -1); 218 X509_EXTENSION_free(ex); 219 return 0; 220 } 221 222 inline void generateSslCertificate(const std::string& filepath, 223 const std::string& cn) 224 { 225 FILE* pFile = nullptr; 226 std::cout << "Generating new keys\n"; 227 initOpenssl(); 228 229 std::cerr << "Generating EC key\n"; 230 EVP_PKEY* pPrivKey = createEcKey(); 231 if (pPrivKey != nullptr) 232 { 233 std::cerr << "Generating x509 Certificate\n"; 234 // Use this code to directly generate a certificate 235 X509* x509; 236 x509 = X509_new(); 237 if (x509 != nullptr) 238 { 239 // get a random number from the RNG for the certificate serial 240 // number If this is not random, regenerating certs throws broswer 241 // errors 242 bmcweb::OpenSSLGenerator gen; 243 std::uniform_int_distribution<int> dis( 244 1, std::numeric_limits<int>::max()); 245 int serial = dis(gen); 246 247 ASN1_INTEGER_set(X509_get_serialNumber(x509), serial); 248 249 // not before this moment 250 X509_gmtime_adj(X509_get_notBefore(x509), 0); 251 // Cert is valid for 10 years 252 X509_gmtime_adj(X509_get_notAfter(x509), 253 60L * 60L * 24L * 365L * 10L); 254 255 // set the public key to the key we just generated 256 X509_set_pubkey(x509, pPrivKey); 257 258 // get the subject name 259 X509_NAME* name; 260 name = X509_get_subject_name(x509); 261 262 X509_NAME_add_entry_by_txt( 263 name, "C", MBSTRING_ASC, 264 reinterpret_cast<const unsigned char*>("US"), -1, -1, 0); 265 X509_NAME_add_entry_by_txt( 266 name, "O", MBSTRING_ASC, 267 reinterpret_cast<const unsigned char*>("OpenBMC"), -1, -1, 0); 268 X509_NAME_add_entry_by_txt( 269 name, "CN", MBSTRING_ASC, 270 reinterpret_cast<const unsigned char*>(cn.c_str()), -1, -1, 0); 271 // set the CSR options 272 X509_set_issuer_name(x509, name); 273 274 X509_set_version(x509, 2); 275 addExt(x509, NID_basic_constraints, ("critical,CA:TRUE")); 276 addExt(x509, NID_subject_alt_name, ("DNS:" + cn).c_str()); 277 addExt(x509, NID_subject_key_identifier, ("hash")); 278 addExt(x509, NID_authority_key_identifier, ("keyid")); 279 addExt(x509, NID_key_usage, ("digitalSignature, keyEncipherment")); 280 addExt(x509, NID_ext_key_usage, ("serverAuth")); 281 addExt(x509, NID_netscape_comment, (x509Comment)); 282 283 // Sign the certificate with our private key 284 X509_sign(x509, pPrivKey, EVP_sha256()); 285 286 pFile = fopen(filepath.c_str(), "wt"); 287 288 if (pFile != nullptr) 289 { 290 PEM_write_PrivateKey(pFile, pPrivKey, nullptr, nullptr, 0, 291 nullptr, nullptr); 292 293 PEM_write_X509(pFile, x509); 294 fclose(pFile); 295 pFile = nullptr; 296 } 297 298 X509_free(x509); 299 } 300 301 EVP_PKEY_free(pPrivKey); 302 pPrivKey = nullptr; 303 } 304 305 // cleanup_openssl(); 306 } 307 308 EVP_PKEY* createEcKey() 309 { 310 EVP_PKEY* pKey = nullptr; 311 int eccgrp = 0; 312 eccgrp = OBJ_txt2nid("secp384r1"); 313 314 EC_KEY* myecc = EC_KEY_new_by_curve_name(eccgrp); 315 if (myecc != nullptr) 316 { 317 EC_KEY_set_asn1_flag(myecc, OPENSSL_EC_NAMED_CURVE); 318 EC_KEY_generate_key(myecc); 319 pKey = EVP_PKEY_new(); 320 if (pKey != nullptr) 321 { 322 if (EVP_PKEY_assign_EC_KEY(pKey, myecc)) 323 { 324 /* pKey owns myecc from now */ 325 if (EC_KEY_check_key(myecc) <= 0) 326 { 327 fprintf(stderr, "EC_check_key failed.\n"); 328 } 329 } 330 } 331 } 332 return pKey; 333 } 334 335 void initOpenssl() 336 { 337 #if OPENSSL_VERSION_NUMBER < 0x10100000L 338 SSL_load_error_strings(); 339 OpenSSL_add_all_algorithms(); 340 RAND_load_file("/dev/urandom", 1024); 341 #endif 342 } 343 344 inline void ensureOpensslKeyPresentAndValid(const std::string& filepath) 345 { 346 bool pemFileValid = false; 347 348 pemFileValid = verifyOpensslKeyCert(filepath); 349 350 if (!pemFileValid) 351 { 352 std::cerr << "Error in verifying signature, regenerating\n"; 353 generateSslCertificate(filepath, "testhost"); 354 } 355 } 356 357 inline std::shared_ptr<boost::asio::ssl::context> 358 getSslContext(const std::string& sslPemFile) 359 { 360 std::shared_ptr<boost::asio::ssl::context> mSslContext = 361 std::make_shared<boost::asio::ssl::context>( 362 boost::asio::ssl::context::tls_server); 363 mSslContext->set_options(boost::asio::ssl::context::default_workarounds | 364 boost::asio::ssl::context::no_sslv2 | 365 boost::asio::ssl::context::no_sslv3 | 366 boost::asio::ssl::context::single_dh_use | 367 boost::asio::ssl::context::no_tlsv1 | 368 boost::asio::ssl::context::no_tlsv1_1); 369 370 // BIG WARNING: This needs to stay disabled, as there will always be 371 // unauthenticated endpoints 372 // mSslContext->set_verify_mode(boost::asio::ssl::verify_peer); 373 374 SSL_CTX_set_options(mSslContext->native_handle(), SSL_OP_NO_RENEGOTIATION); 375 376 BMCWEB_LOG_DEBUG << "Using default TrustStore location: " << trustStorePath; 377 mSslContext->add_verify_path(trustStorePath); 378 379 mSslContext->use_certificate_file(sslPemFile, 380 boost::asio::ssl::context::pem); 381 mSslContext->use_private_key_file(sslPemFile, 382 boost::asio::ssl::context::pem); 383 384 // Set up EC curves to auto (boost asio doesn't have a method for this) 385 // There is a pull request to add this. Once this is included in an asio 386 // drop, use the right way 387 // http://stackoverflow.com/questions/18929049/boost-asio-with-ecdsa-certificate-issue 388 if (SSL_CTX_set_ecdh_auto(mSslContext->native_handle(), 1) != 1) 389 { 390 BMCWEB_LOG_ERROR << "Error setting tmp ecdh list\n"; 391 } 392 393 std::string mozillaModern = "ECDHE-ECDSA-AES256-GCM-SHA384:" 394 "ECDHE-RSA-AES256-GCM-SHA384:" 395 "ECDHE-ECDSA-CHACHA20-POLY1305:" 396 "ECDHE-RSA-CHACHA20-POLY1305:" 397 "ECDHE-ECDSA-AES128-GCM-SHA256:" 398 "ECDHE-RSA-AES128-GCM-SHA256:" 399 "ECDHE-ECDSA-AES256-SHA384:" 400 "ECDHE-RSA-AES256-SHA384:" 401 "ECDHE-ECDSA-AES128-SHA256:" 402 "ECDHE-RSA-AES128-SHA256"; 403 404 if (SSL_CTX_set_cipher_list(mSslContext->native_handle(), 405 mozillaModern.c_str()) != 1) 406 { 407 BMCWEB_LOG_ERROR << "Error setting cipher list\n"; 408 } 409 return mSslContext; 410 } 411 } // namespace ensuressl 412 413 #endif 414