1 #pragma once 2 #ifdef BMCWEB_ENABLE_SSL 3 4 #include <openssl/bio.h> 5 #include <openssl/dh.h> 6 #include <openssl/dsa.h> 7 #include <openssl/err.h> 8 #include <openssl/evp.h> 9 #include <openssl/pem.h> 10 #include <openssl/rand.h> 11 #include <openssl/rsa.h> 12 #include <openssl/ssl.h> 13 14 #include <boost/asio/ssl/context.hpp> 15 16 #include <random> 17 18 namespace ensuressl 19 { 20 constexpr char const* trustStorePath = "/etc/ssl/certs/authority"; 21 static void initOpenssl(); 22 static EVP_PKEY* createEcKey(); 23 24 // Trust chain related errors.` 25 inline bool isTrustChainError(int errnum) 26 { 27 if ((errnum == X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT) || 28 (errnum == X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN) || 29 (errnum == X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY) || 30 (errnum == X509_V_ERR_CERT_UNTRUSTED) || 31 (errnum == X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE)) 32 { 33 return true; 34 } 35 else 36 { 37 return false; 38 } 39 } 40 41 inline bool validateCertificate(X509* const cert) 42 { 43 // Create an empty X509_STORE structure for certificate validation. 44 X509_STORE* x509Store = X509_STORE_new(); 45 if (!x509Store) 46 { 47 BMCWEB_LOG_ERROR << "Error occured during X509_STORE_new call"; 48 return false; 49 } 50 51 // Load Certificate file into the X509 structure. 52 X509_STORE_CTX* storeCtx = X509_STORE_CTX_new(); 53 if (!storeCtx) 54 { 55 BMCWEB_LOG_ERROR << "Error occured during X509_STORE_CTX_new call"; 56 X509_STORE_free(x509Store); 57 return false; 58 } 59 60 int errCode = X509_STORE_CTX_init(storeCtx, x509Store, cert, nullptr); 61 if (errCode != 1) 62 { 63 BMCWEB_LOG_ERROR << "Error occured during X509_STORE_CTX_init call"; 64 X509_STORE_CTX_free(storeCtx); 65 X509_STORE_free(x509Store); 66 return false; 67 } 68 69 errCode = X509_verify_cert(storeCtx); 70 if (errCode == 1) 71 { 72 BMCWEB_LOG_INFO << "Certificate verification is success"; 73 X509_STORE_CTX_free(storeCtx); 74 X509_STORE_free(x509Store); 75 return true; 76 } 77 if (errCode == 0) 78 { 79 errCode = X509_STORE_CTX_get_error(storeCtx); 80 X509_STORE_CTX_free(storeCtx); 81 X509_STORE_free(x509Store); 82 if (isTrustChainError(errCode)) 83 { 84 BMCWEB_LOG_DEBUG << "Ignoring Trust Chain error. Reason: " 85 << X509_verify_cert_error_string(errCode); 86 return true; 87 } 88 else 89 { 90 BMCWEB_LOG_ERROR << "Certificate verification failed. Reason: " 91 << X509_verify_cert_error_string(errCode); 92 return false; 93 } 94 } 95 96 BMCWEB_LOG_ERROR 97 << "Error occured during X509_verify_cert call. ErrorCode: " << errCode; 98 X509_STORE_CTX_free(storeCtx); 99 X509_STORE_free(x509Store); 100 return false; 101 } 102 103 inline bool verifyOpensslKeyCert(const std::string& filepath) 104 { 105 bool privateKeyValid = false; 106 bool certValid = false; 107 108 std::cout << "Checking certs in file " << filepath << "\n"; 109 110 FILE* file = fopen(filepath.c_str(), "r"); 111 if (file != nullptr) 112 { 113 EVP_PKEY* pkey = PEM_read_PrivateKey(file, nullptr, nullptr, nullptr); 114 if (pkey != nullptr) 115 { 116 RSA* rsa = EVP_PKEY_get1_RSA(pkey); 117 if (rsa != nullptr) 118 { 119 std::cout << "Found an RSA key\n"; 120 if (RSA_check_key(rsa) == 1) 121 { 122 privateKeyValid = true; 123 } 124 else 125 { 126 std::cerr << "Key not valid error number " 127 << ERR_get_error() << "\n"; 128 } 129 RSA_free(rsa); 130 } 131 else 132 { 133 EC_KEY* ec = EVP_PKEY_get1_EC_KEY(pkey); 134 if (ec != nullptr) 135 { 136 std::cout << "Found an EC key\n"; 137 if (EC_KEY_check_key(ec) == 1) 138 { 139 privateKeyValid = true; 140 } 141 else 142 { 143 std::cerr << "Key not valid error number " 144 << ERR_get_error() << "\n"; 145 } 146 EC_KEY_free(ec); 147 } 148 } 149 150 if (privateKeyValid) 151 { 152 // If the order is certificate followed by key in input file 153 // then, certificate read will fail. So, setting the file 154 // pointer to point beginning of file to avoid certificate and 155 // key order issue. 156 fseek(file, 0, SEEK_SET); 157 158 X509* x509 = PEM_read_X509(file, nullptr, nullptr, nullptr); 159 if (x509 == nullptr) 160 { 161 std::cout << "error getting x509 cert " << ERR_get_error() 162 << "\n"; 163 } 164 else 165 { 166 certValid = validateCertificate(x509); 167 X509_free(x509); 168 } 169 } 170 171 EVP_PKEY_free(pkey); 172 } 173 fclose(file); 174 } 175 return certValid; 176 } 177 178 inline void generateSslCertificate(const std::string& filepath) 179 { 180 FILE* pFile = nullptr; 181 std::cout << "Generating new keys\n"; 182 initOpenssl(); 183 184 std::cerr << "Generating EC key\n"; 185 EVP_PKEY* pPrivKey = createEcKey(); 186 if (pPrivKey != nullptr) 187 { 188 std::cerr << "Generating x509 Certificate\n"; 189 // Use this code to directly generate a certificate 190 X509* x509; 191 x509 = X509_new(); 192 if (x509 != nullptr) 193 { 194 // get a random number from the RNG for the certificate serial 195 // number If this is not random, regenerating certs throws broswer 196 // errors 197 std::random_device rd; 198 int serial = static_cast<int>(rd()); 199 200 ASN1_INTEGER_set(X509_get_serialNumber(x509), serial); 201 202 // not before this moment 203 X509_gmtime_adj(X509_get_notBefore(x509), 0); 204 // Cert is valid for 10 years 205 X509_gmtime_adj(X509_get_notAfter(x509), 206 60L * 60L * 24L * 365L * 10L); 207 208 // set the public key to the key we just generated 209 X509_set_pubkey(x509, pPrivKey); 210 211 // get the subject name 212 X509_NAME* name; 213 name = X509_get_subject_name(x509); 214 215 X509_NAME_add_entry_by_txt( 216 name, "C", MBSTRING_ASC, 217 reinterpret_cast<const unsigned char*>("US"), -1, -1, 0); 218 X509_NAME_add_entry_by_txt( 219 name, "O", MBSTRING_ASC, 220 reinterpret_cast<const unsigned char*>("OpenBMC"), -1, -1, 0); 221 X509_NAME_add_entry_by_txt( 222 name, "CN", MBSTRING_ASC, 223 reinterpret_cast<const unsigned char*>("testhost"), -1, -1, 0); 224 // set the CSR options 225 X509_set_issuer_name(x509, name); 226 227 // Sign the certificate with our private key 228 X509_sign(x509, pPrivKey, EVP_sha256()); 229 230 pFile = fopen(filepath.c_str(), "wt"); 231 232 if (pFile != nullptr) 233 { 234 PEM_write_PrivateKey(pFile, pPrivKey, nullptr, nullptr, 0, 235 nullptr, nullptr); 236 237 PEM_write_X509(pFile, x509); 238 fclose(pFile); 239 pFile = nullptr; 240 } 241 242 X509_free(x509); 243 } 244 245 EVP_PKEY_free(pPrivKey); 246 pPrivKey = nullptr; 247 } 248 249 // cleanup_openssl(); 250 } 251 252 EVP_PKEY* createEcKey() 253 { 254 EVP_PKEY* pKey = nullptr; 255 int eccgrp = 0; 256 eccgrp = OBJ_txt2nid("secp384r1"); 257 258 EC_KEY* myecc = EC_KEY_new_by_curve_name(eccgrp); 259 if (myecc != nullptr) 260 { 261 EC_KEY_set_asn1_flag(myecc, OPENSSL_EC_NAMED_CURVE); 262 EC_KEY_generate_key(myecc); 263 pKey = EVP_PKEY_new(); 264 if (pKey != nullptr) 265 { 266 if (EVP_PKEY_assign_EC_KEY(pKey, myecc)) 267 { 268 /* pKey owns myecc from now */ 269 if (EC_KEY_check_key(myecc) <= 0) 270 { 271 fprintf(stderr, "EC_check_key failed.\n"); 272 } 273 } 274 } 275 } 276 return pKey; 277 } 278 279 void initOpenssl() 280 { 281 #if OPENSSL_VERSION_NUMBER < 0x10100000L 282 SSL_load_error_strings(); 283 OpenSSL_add_all_algorithms(); 284 RAND_load_file("/dev/urandom", 1024); 285 #endif 286 } 287 288 inline void ensureOpensslKeyPresentAndValid(const std::string& filepath) 289 { 290 bool pemFileValid = false; 291 292 pemFileValid = verifyOpensslKeyCert(filepath); 293 294 if (!pemFileValid) 295 { 296 std::cerr << "Error in verifying signature, regenerating\n"; 297 generateSslCertificate(filepath); 298 } 299 } 300 301 inline std::shared_ptr<boost::asio::ssl::context> 302 getSslContext(const std::string& ssl_pem_file) 303 { 304 std::shared_ptr<boost::asio::ssl::context> mSslContext = 305 std::make_shared<boost::asio::ssl::context>( 306 boost::asio::ssl::context::tls_server); 307 mSslContext->set_options(boost::asio::ssl::context::default_workarounds | 308 boost::asio::ssl::context::no_sslv2 | 309 boost::asio::ssl::context::no_sslv3 | 310 boost::asio::ssl::context::single_dh_use | 311 boost::asio::ssl::context::no_tlsv1 | 312 boost::asio::ssl::context::no_tlsv1_1); 313 314 // BIG WARNING: This needs to stay disabled, as there will always be 315 // unauthenticated endpoints 316 // mSslContext->set_verify_mode(boost::asio::ssl::verify_peer); 317 318 SSL_CTX_set_options(mSslContext->native_handle(), SSL_OP_NO_RENEGOTIATION); 319 320 BMCWEB_LOG_DEBUG << "Using default TrustStore location: " << trustStorePath; 321 mSslContext->add_verify_path(trustStorePath); 322 323 mSslContext->use_certificate_file(ssl_pem_file, 324 boost::asio::ssl::context::pem); 325 mSslContext->use_private_key_file(ssl_pem_file, 326 boost::asio::ssl::context::pem); 327 328 // Set up EC curves to auto (boost asio doesn't have a method for this) 329 // There is a pull request to add this. Once this is included in an asio 330 // drop, use the right way 331 // http://stackoverflow.com/questions/18929049/boost-asio-with-ecdsa-certificate-issue 332 if (SSL_CTX_set_ecdh_auto(mSslContext->native_handle(), 1) != 1) 333 { 334 BMCWEB_LOG_ERROR << "Error setting tmp ecdh list\n"; 335 } 336 337 std::string mozillaModern = "ECDHE-ECDSA-AES256-GCM-SHA384:" 338 "ECDHE-RSA-AES256-GCM-SHA384:" 339 "ECDHE-ECDSA-CHACHA20-POLY1305:" 340 "ECDHE-RSA-CHACHA20-POLY1305:" 341 "ECDHE-ECDSA-AES128-GCM-SHA256:" 342 "ECDHE-RSA-AES128-GCM-SHA256:" 343 "ECDHE-ECDSA-AES256-SHA384:" 344 "ECDHE-RSA-AES256-SHA384:" 345 "ECDHE-ECDSA-AES128-SHA256:" 346 "ECDHE-RSA-AES128-SHA256"; 347 348 if (SSL_CTX_set_cipher_list(mSslContext->native_handle(), 349 mozillaModern.c_str()) != 1) 350 { 351 BMCWEB_LOG_ERROR << "Error setting cipher list\n"; 352 } 353 return mSslContext; 354 } 355 } // namespace ensuressl 356 357 #endif 358