xref: /openbmc/bmcweb/include/ssl_key_handler.hpp (revision 3174e4dfd3185c131a07371b4b5a5b40cf0e0bdb)
1 #pragma once
2 #ifdef BMCWEB_ENABLE_SSL
3 
4 #include <openssl/bio.h>
5 #include <openssl/dh.h>
6 #include <openssl/dsa.h>
7 #include <openssl/err.h>
8 #include <openssl/evp.h>
9 #include <openssl/pem.h>
10 #include <openssl/rand.h>
11 #include <openssl/rsa.h>
12 #include <openssl/ssl.h>
13 
14 #include <boost/asio/ssl/context.hpp>
15 
16 #include <random>
17 
18 namespace ensuressl
19 {
20 constexpr char const* trustStorePath = "/etc/ssl/certs/authority";
21 static void initOpenssl();
22 static EVP_PKEY* createEcKey();
23 
24 // Trust chain related errors.`
25 inline bool isTrustChainError(int errnum)
26 {
27     if ((errnum == X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT) ||
28         (errnum == X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN) ||
29         (errnum == X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY) ||
30         (errnum == X509_V_ERR_CERT_UNTRUSTED) ||
31         (errnum == X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE))
32     {
33         return true;
34     }
35     return false;
36 }
37 
38 inline bool validateCertificate(X509* const cert)
39 {
40     // Create an empty X509_STORE structure for certificate validation.
41     X509_STORE* x509Store = X509_STORE_new();
42     if (!x509Store)
43     {
44         BMCWEB_LOG_ERROR << "Error occurred during X509_STORE_new call";
45         return false;
46     }
47 
48     // Load Certificate file into the X509 structure.
49     X509_STORE_CTX* storeCtx = X509_STORE_CTX_new();
50     if (!storeCtx)
51     {
52         BMCWEB_LOG_ERROR << "Error occurred during X509_STORE_CTX_new call";
53         X509_STORE_free(x509Store);
54         return false;
55     }
56 
57     int errCode = X509_STORE_CTX_init(storeCtx, x509Store, cert, nullptr);
58     if (errCode != 1)
59     {
60         BMCWEB_LOG_ERROR << "Error occurred during X509_STORE_CTX_init call";
61         X509_STORE_CTX_free(storeCtx);
62         X509_STORE_free(x509Store);
63         return false;
64     }
65 
66     errCode = X509_verify_cert(storeCtx);
67     if (errCode == 1)
68     {
69         BMCWEB_LOG_INFO << "Certificate verification is success";
70         X509_STORE_CTX_free(storeCtx);
71         X509_STORE_free(x509Store);
72         return true;
73     }
74     if (errCode == 0)
75     {
76         errCode = X509_STORE_CTX_get_error(storeCtx);
77         X509_STORE_CTX_free(storeCtx);
78         X509_STORE_free(x509Store);
79         if (isTrustChainError(errCode))
80         {
81             BMCWEB_LOG_DEBUG << "Ignoring Trust Chain error. Reason: "
82                              << X509_verify_cert_error_string(errCode);
83             return true;
84         }
85         BMCWEB_LOG_ERROR << "Certificate verification failed. Reason: "
86                          << X509_verify_cert_error_string(errCode);
87         return false;
88     }
89 
90     BMCWEB_LOG_ERROR
91         << "Error occurred during X509_verify_cert call. ErrorCode: "
92         << errCode;
93     X509_STORE_CTX_free(storeCtx);
94     X509_STORE_free(x509Store);
95     return false;
96 }
97 
98 inline bool verifyOpensslKeyCert(const std::string& filepath)
99 {
100     bool privateKeyValid = false;
101     bool certValid = false;
102 
103     std::cout << "Checking certs in file " << filepath << "\n";
104 
105     FILE* file = fopen(filepath.c_str(), "r");
106     if (file != nullptr)
107     {
108         EVP_PKEY* pkey = PEM_read_PrivateKey(file, nullptr, nullptr, nullptr);
109         if (pkey != nullptr)
110         {
111             RSA* rsa = EVP_PKEY_get1_RSA(pkey);
112             if (rsa != nullptr)
113             {
114                 std::cout << "Found an RSA key\n";
115                 if (RSA_check_key(rsa) == 1)
116                 {
117                     privateKeyValid = true;
118                 }
119                 else
120                 {
121                     std::cerr << "Key not valid error number "
122                               << ERR_get_error() << "\n";
123                 }
124                 RSA_free(rsa);
125             }
126             else
127             {
128                 EC_KEY* ec = EVP_PKEY_get1_EC_KEY(pkey);
129                 if (ec != nullptr)
130                 {
131                     std::cout << "Found an EC key\n";
132                     if (EC_KEY_check_key(ec) == 1)
133                     {
134                         privateKeyValid = true;
135                     }
136                     else
137                     {
138                         std::cerr << "Key not valid error number "
139                                   << ERR_get_error() << "\n";
140                     }
141                     EC_KEY_free(ec);
142                 }
143             }
144 
145             if (privateKeyValid)
146             {
147                 // If the order is certificate followed by key in input file
148                 // then, certificate read will fail. So, setting the file
149                 // pointer to point beginning of file to avoid certificate and
150                 // key order issue.
151                 fseek(file, 0, SEEK_SET);
152 
153                 X509* x509 = PEM_read_X509(file, nullptr, nullptr, nullptr);
154                 if (x509 == nullptr)
155                 {
156                     std::cout << "error getting x509 cert " << ERR_get_error()
157                               << "\n";
158                 }
159                 else
160                 {
161                     certValid = validateCertificate(x509);
162                     X509_free(x509);
163                 }
164             }
165 
166             EVP_PKEY_free(pkey);
167         }
168         fclose(file);
169     }
170     return certValid;
171 }
172 
173 inline void generateSslCertificate(const std::string& filepath)
174 {
175     FILE* pFile = nullptr;
176     std::cout << "Generating new keys\n";
177     initOpenssl();
178 
179     std::cerr << "Generating EC key\n";
180     EVP_PKEY* pPrivKey = createEcKey();
181     if (pPrivKey != nullptr)
182     {
183         std::cerr << "Generating x509 Certificate\n";
184         // Use this code to directly generate a certificate
185         X509* x509;
186         x509 = X509_new();
187         if (x509 != nullptr)
188         {
189             // get a random number from the RNG for the certificate serial
190             // number If this is not random, regenerating certs throws broswer
191             // errors
192             std::random_device rd;
193             int serial = static_cast<int>(rd());
194 
195             ASN1_INTEGER_set(X509_get_serialNumber(x509), serial);
196 
197             // not before this moment
198             X509_gmtime_adj(X509_get_notBefore(x509), 0);
199             // Cert is valid for 10 years
200             X509_gmtime_adj(X509_get_notAfter(x509),
201                             60L * 60L * 24L * 365L * 10L);
202 
203             // set the public key to the key we just generated
204             X509_set_pubkey(x509, pPrivKey);
205 
206             // get the subject name
207             X509_NAME* name;
208             name = X509_get_subject_name(x509);
209 
210             X509_NAME_add_entry_by_txt(
211                 name, "C", MBSTRING_ASC,
212                 reinterpret_cast<const unsigned char*>("US"), -1, -1, 0);
213             X509_NAME_add_entry_by_txt(
214                 name, "O", MBSTRING_ASC,
215                 reinterpret_cast<const unsigned char*>("OpenBMC"), -1, -1, 0);
216             X509_NAME_add_entry_by_txt(
217                 name, "CN", MBSTRING_ASC,
218                 reinterpret_cast<const unsigned char*>("testhost"), -1, -1, 0);
219             // set the CSR options
220             X509_set_issuer_name(x509, name);
221 
222             // Sign the certificate with our private key
223             X509_sign(x509, pPrivKey, EVP_sha256());
224 
225             pFile = fopen(filepath.c_str(), "wt");
226 
227             if (pFile != nullptr)
228             {
229                 PEM_write_PrivateKey(pFile, pPrivKey, nullptr, nullptr, 0,
230                                      nullptr, nullptr);
231 
232                 PEM_write_X509(pFile, x509);
233                 fclose(pFile);
234                 pFile = nullptr;
235             }
236 
237             X509_free(x509);
238         }
239 
240         EVP_PKEY_free(pPrivKey);
241         pPrivKey = nullptr;
242     }
243 
244     // cleanup_openssl();
245 }
246 
247 EVP_PKEY* createEcKey()
248 {
249     EVP_PKEY* pKey = nullptr;
250     int eccgrp = 0;
251     eccgrp = OBJ_txt2nid("secp384r1");
252 
253     EC_KEY* myecc = EC_KEY_new_by_curve_name(eccgrp);
254     if (myecc != nullptr)
255     {
256         EC_KEY_set_asn1_flag(myecc, OPENSSL_EC_NAMED_CURVE);
257         EC_KEY_generate_key(myecc);
258         pKey = EVP_PKEY_new();
259         if (pKey != nullptr)
260         {
261             if (EVP_PKEY_assign_EC_KEY(pKey, myecc))
262             {
263                 /* pKey owns myecc from now */
264                 if (EC_KEY_check_key(myecc) <= 0)
265                 {
266                     fprintf(stderr, "EC_check_key failed.\n");
267                 }
268             }
269         }
270     }
271     return pKey;
272 }
273 
274 void initOpenssl()
275 {
276 #if OPENSSL_VERSION_NUMBER < 0x10100000L
277     SSL_load_error_strings();
278     OpenSSL_add_all_algorithms();
279     RAND_load_file("/dev/urandom", 1024);
280 #endif
281 }
282 
283 inline void ensureOpensslKeyPresentAndValid(const std::string& filepath)
284 {
285     bool pemFileValid = false;
286 
287     pemFileValid = verifyOpensslKeyCert(filepath);
288 
289     if (!pemFileValid)
290     {
291         std::cerr << "Error in verifying signature, regenerating\n";
292         generateSslCertificate(filepath);
293     }
294 }
295 
296 inline std::shared_ptr<boost::asio::ssl::context>
297     getSslContext(const std::string& ssl_pem_file)
298 {
299     std::shared_ptr<boost::asio::ssl::context> mSslContext =
300         std::make_shared<boost::asio::ssl::context>(
301             boost::asio::ssl::context::tls_server);
302     mSslContext->set_options(boost::asio::ssl::context::default_workarounds |
303                              boost::asio::ssl::context::no_sslv2 |
304                              boost::asio::ssl::context::no_sslv3 |
305                              boost::asio::ssl::context::single_dh_use |
306                              boost::asio::ssl::context::no_tlsv1 |
307                              boost::asio::ssl::context::no_tlsv1_1);
308 
309     // BIG WARNING: This needs to stay disabled, as there will always be
310     // unauthenticated endpoints
311     // mSslContext->set_verify_mode(boost::asio::ssl::verify_peer);
312 
313     SSL_CTX_set_options(mSslContext->native_handle(), SSL_OP_NO_RENEGOTIATION);
314 
315     BMCWEB_LOG_DEBUG << "Using default TrustStore location: " << trustStorePath;
316     mSslContext->add_verify_path(trustStorePath);
317 
318     mSslContext->use_certificate_file(ssl_pem_file,
319                                       boost::asio::ssl::context::pem);
320     mSslContext->use_private_key_file(ssl_pem_file,
321                                       boost::asio::ssl::context::pem);
322 
323     // Set up EC curves to auto (boost asio doesn't have a method for this)
324     // There is a pull request to add this.  Once this is included in an asio
325     // drop, use the right way
326     // http://stackoverflow.com/questions/18929049/boost-asio-with-ecdsa-certificate-issue
327     if (SSL_CTX_set_ecdh_auto(mSslContext->native_handle(), 1) != 1)
328     {
329         BMCWEB_LOG_ERROR << "Error setting tmp ecdh list\n";
330     }
331 
332     std::string mozillaModern = "ECDHE-ECDSA-AES256-GCM-SHA384:"
333                                 "ECDHE-RSA-AES256-GCM-SHA384:"
334                                 "ECDHE-ECDSA-CHACHA20-POLY1305:"
335                                 "ECDHE-RSA-CHACHA20-POLY1305:"
336                                 "ECDHE-ECDSA-AES128-GCM-SHA256:"
337                                 "ECDHE-RSA-AES128-GCM-SHA256:"
338                                 "ECDHE-ECDSA-AES256-SHA384:"
339                                 "ECDHE-RSA-AES256-SHA384:"
340                                 "ECDHE-ECDSA-AES128-SHA256:"
341                                 "ECDHE-RSA-AES128-SHA256";
342 
343     if (SSL_CTX_set_cipher_list(mSslContext->native_handle(),
344                                 mozillaModern.c_str()) != 1)
345     {
346         BMCWEB_LOG_ERROR << "Error setting cipher list\n";
347     }
348     return mSslContext;
349 }
350 } // namespace ensuressl
351 
352 #endif
353