1 #pragma once 2 #ifdef BMCWEB_ENABLE_SSL 3 4 #include <openssl/bio.h> 5 #include <openssl/dh.h> 6 #include <openssl/dsa.h> 7 #include <openssl/err.h> 8 #include <openssl/evp.h> 9 #include <openssl/pem.h> 10 #include <openssl/rand.h> 11 #include <openssl/rsa.h> 12 #include <openssl/ssl.h> 13 14 #include <boost/asio/ssl/context.hpp> 15 #include <random> 16 17 namespace ensuressl 18 { 19 static void initOpenssl(); 20 static EVP_PKEY *createEcKey(); 21 22 // Trust chain related errors.` 23 inline bool isTrustChainError(int errnum) 24 { 25 if ((errnum == X509_V_ERR_DEPTH_ZERO_SELF_SIGNED_CERT) || 26 (errnum == X509_V_ERR_SELF_SIGNED_CERT_IN_CHAIN) || 27 (errnum == X509_V_ERR_UNABLE_TO_GET_ISSUER_CERT_LOCALLY) || 28 (errnum == X509_V_ERR_CERT_UNTRUSTED) || 29 (errnum == X509_V_ERR_UNABLE_TO_VERIFY_LEAF_SIGNATURE)) 30 { 31 return true; 32 } 33 else 34 { 35 return false; 36 } 37 } 38 39 inline bool validateCertificate(X509 *const cert) 40 { 41 // Create an empty X509_STORE structure for certificate validation. 42 X509_STORE *x509Store = X509_STORE_new(); 43 if (!x509Store) 44 { 45 BMCWEB_LOG_ERROR << "Error occured during X509_STORE_new call"; 46 return false; 47 } 48 49 // Load Certificate file into the X509 structure. 50 X509_STORE_CTX *storeCtx = X509_STORE_CTX_new(); 51 if (!storeCtx) 52 { 53 BMCWEB_LOG_ERROR << "Error occured during X509_STORE_CTX_new call"; 54 X509_STORE_free(x509Store); 55 return false; 56 } 57 58 int errCode = X509_STORE_CTX_init(storeCtx, x509Store, cert, NULL); 59 if (errCode != 1) 60 { 61 BMCWEB_LOG_ERROR << "Error occured during X509_STORE_CTX_init call"; 62 X509_STORE_CTX_free(storeCtx); 63 X509_STORE_free(x509Store); 64 return false; 65 } 66 67 errCode = X509_verify_cert(storeCtx); 68 if (errCode == 1) 69 { 70 BMCWEB_LOG_INFO << "Certificate verification is success"; 71 X509_STORE_CTX_free(storeCtx); 72 X509_STORE_free(x509Store); 73 return true; 74 } 75 if (errCode == 0) 76 { 77 errCode = X509_STORE_CTX_get_error(storeCtx); 78 X509_STORE_CTX_free(storeCtx); 79 X509_STORE_free(x509Store); 80 if (isTrustChainError(errCode)) 81 { 82 BMCWEB_LOG_DEBUG << "Ignoring Trust Chain error. Reason: " 83 << X509_verify_cert_error_string(errCode); 84 return true; 85 } 86 else 87 { 88 BMCWEB_LOG_ERROR << "Certificate verification failed. Reason: " 89 << X509_verify_cert_error_string(errCode); 90 return false; 91 } 92 } 93 94 BMCWEB_LOG_ERROR 95 << "Error occured during X509_verify_cert call. ErrorCode: " << errCode; 96 X509_STORE_CTX_free(storeCtx); 97 X509_STORE_free(x509Store); 98 return false; 99 } 100 101 inline bool verifyOpensslKeyCert(const std::string &filepath) 102 { 103 bool privateKeyValid = false; 104 bool certValid = false; 105 106 std::cout << "Checking certs in file " << filepath << "\n"; 107 108 FILE *file = fopen(filepath.c_str(), "r"); 109 if (file != NULL) 110 { 111 EVP_PKEY *pkey = PEM_read_PrivateKey(file, NULL, NULL, NULL); 112 if (pkey != nullptr) 113 { 114 RSA *rsa = EVP_PKEY_get1_RSA(pkey); 115 if (rsa != nullptr) 116 { 117 std::cout << "Found an RSA key\n"; 118 if (RSA_check_key(rsa) == 1) 119 { 120 privateKeyValid = true; 121 } 122 else 123 { 124 std::cerr << "Key not valid error number " 125 << ERR_get_error() << "\n"; 126 } 127 RSA_free(rsa); 128 } 129 else 130 { 131 EC_KEY *ec = EVP_PKEY_get1_EC_KEY(pkey); 132 if (ec != nullptr) 133 { 134 std::cout << "Found an EC key\n"; 135 if (EC_KEY_check_key(ec) == 1) 136 { 137 privateKeyValid = true; 138 } 139 else 140 { 141 std::cerr << "Key not valid error number " 142 << ERR_get_error() << "\n"; 143 } 144 EC_KEY_free(ec); 145 } 146 } 147 148 if (privateKeyValid) 149 { 150 // If the order is certificate followed by key in input file 151 // then, certificate read will fail. So, setting the file 152 // pointer to point beginning of file to avoid certificate and 153 // key order issue. 154 fseek(file, 0, SEEK_SET); 155 156 X509 *x509 = PEM_read_X509(file, NULL, NULL, NULL); 157 if (x509 == nullptr) 158 { 159 std::cout << "error getting x509 cert " << ERR_get_error() 160 << "\n"; 161 } 162 else 163 { 164 certValid = validateCertificate(x509); 165 X509_free(x509); 166 } 167 } 168 169 EVP_PKEY_free(pkey); 170 } 171 fclose(file); 172 } 173 return certValid; 174 } 175 176 inline void generateSslCertificate(const std::string &filepath) 177 { 178 FILE *pFile = NULL; 179 std::cout << "Generating new keys\n"; 180 initOpenssl(); 181 182 // std::cerr << "Generating RSA key"; 183 // EVP_PKEY *pRsaPrivKey = create_rsa_key(); 184 185 std::cerr << "Generating EC key\n"; 186 EVP_PKEY *pRsaPrivKey = createEcKey(); 187 if (pRsaPrivKey != nullptr) 188 { 189 std::cerr << "Generating x509 Certificate\n"; 190 // Use this code to directly generate a certificate 191 X509 *x509; 192 x509 = X509_new(); 193 if (x509 != nullptr) 194 { 195 // get a random number from the RNG for the certificate serial 196 // number If this is not random, regenerating certs throws broswer 197 // errors 198 std::random_device rd; 199 int serial = static_cast<int>(rd()); 200 201 ASN1_INTEGER_set(X509_get_serialNumber(x509), serial); 202 203 // not before this moment 204 X509_gmtime_adj(X509_get_notBefore(x509), 0); 205 // Cert is valid for 10 years 206 X509_gmtime_adj(X509_get_notAfter(x509), 207 60L * 60L * 24L * 365L * 10L); 208 209 // set the public key to the key we just generated 210 X509_set_pubkey(x509, pRsaPrivKey); 211 212 // get the subject name 213 X509_NAME *name; 214 name = X509_get_subject_name(x509); 215 216 X509_NAME_add_entry_by_txt( 217 name, "C", MBSTRING_ASC, 218 reinterpret_cast<const unsigned char *>("US"), -1, -1, 0); 219 X509_NAME_add_entry_by_txt( 220 name, "O", MBSTRING_ASC, 221 reinterpret_cast<const unsigned char *>("OpenBMC"), -1, -1, 0); 222 X509_NAME_add_entry_by_txt( 223 name, "CN", MBSTRING_ASC, 224 reinterpret_cast<const unsigned char *>("testhost"), -1, -1, 0); 225 // set the CSR options 226 X509_set_issuer_name(x509, name); 227 228 // Sign the certificate with our private key 229 X509_sign(x509, pRsaPrivKey, EVP_sha256()); 230 231 pFile = fopen(filepath.c_str(), "wt"); 232 233 if (pFile != nullptr) 234 { 235 PEM_write_PrivateKey(pFile, pRsaPrivKey, NULL, NULL, 0, 0, 236 NULL); 237 238 PEM_write_X509(pFile, x509); 239 fclose(pFile); 240 pFile = NULL; 241 } 242 243 X509_free(x509); 244 } 245 246 EVP_PKEY_free(pRsaPrivKey); 247 pRsaPrivKey = NULL; 248 } 249 250 // cleanup_openssl(); 251 } 252 253 EVP_PKEY *createEcKey() 254 { 255 EVP_PKEY *pKey = NULL; 256 int eccgrp = 0; 257 eccgrp = OBJ_txt2nid("prime256v1"); 258 259 EC_KEY *myecc = EC_KEY_new_by_curve_name(eccgrp); 260 if (myecc != nullptr) 261 { 262 EC_KEY_set_asn1_flag(myecc, OPENSSL_EC_NAMED_CURVE); 263 EC_KEY_generate_key(myecc); 264 pKey = EVP_PKEY_new(); 265 if (pKey != nullptr) 266 { 267 if (EVP_PKEY_assign_EC_KEY(pKey, myecc)) 268 { 269 /* pKey owns pRSA from now */ 270 if (EC_KEY_check_key(myecc) <= 0) 271 { 272 fprintf(stderr, "EC_check_key failed.\n"); 273 } 274 } 275 } 276 } 277 return pKey; 278 } 279 280 void initOpenssl() 281 { 282 #if OPENSSL_VERSION_NUMBER < 0x10100000L 283 SSL_load_error_strings(); 284 OpenSSL_add_all_algorithms(); 285 RAND_load_file("/dev/urandom", 1024); 286 #endif 287 } 288 289 inline void ensureOpensslKeyPresentAndValid(const std::string &filepath) 290 { 291 bool pemFileValid = false; 292 293 pemFileValid = verifyOpensslKeyCert(filepath); 294 295 if (!pemFileValid) 296 { 297 std::cerr << "Error in verifying signature, regenerating\n"; 298 generateSslCertificate(filepath); 299 } 300 } 301 302 inline std::shared_ptr<boost::asio::ssl::context> 303 getSslContext(const std::string &ssl_pem_file) 304 { 305 std::shared_ptr<boost::asio::ssl::context> mSslContext = 306 std::make_shared<boost::asio::ssl::context>( 307 boost::asio::ssl::context::tls_server); 308 mSslContext->set_options(boost::asio::ssl::context::default_workarounds | 309 boost::asio::ssl::context::no_sslv2 | 310 boost::asio::ssl::context::no_sslv3 | 311 boost::asio::ssl::context::single_dh_use | 312 boost::asio::ssl::context::no_tlsv1 | 313 boost::asio::ssl::context::no_tlsv1_1); 314 315 // m_ssl_context.set_verify_mode(boost::asio::ssl::verify_peer); 316 mSslContext->use_certificate_file(ssl_pem_file, 317 boost::asio::ssl::context::pem); 318 mSslContext->use_private_key_file(ssl_pem_file, 319 boost::asio::ssl::context::pem); 320 321 // Set up EC curves to auto (boost asio doesn't have a method for this) 322 // There is a pull request to add this. Once this is included in an asio 323 // drop, use the right way 324 // http://stackoverflow.com/questions/18929049/boost-asio-with-ecdsa-certificate-issue 325 if (SSL_CTX_set_ecdh_auto(mSslContext->native_handle(), 1) != 1) 326 { 327 BMCWEB_LOG_ERROR << "Error setting tmp ecdh list\n"; 328 } 329 330 std::string mozillaModern = "ECDHE-ECDSA-AES256-GCM-SHA384:" 331 "ECDHE-RSA-AES256-GCM-SHA384:" 332 "ECDHE-ECDSA-CHACHA20-POLY1305:" 333 "ECDHE-RSA-CHACHA20-POLY1305:" 334 "ECDHE-ECDSA-AES128-GCM-SHA256:" 335 "ECDHE-RSA-AES128-GCM-SHA256:" 336 "ECDHE-ECDSA-AES256-SHA384:" 337 "ECDHE-RSA-AES256-SHA384:" 338 "ECDHE-ECDSA-AES128-SHA256:" 339 "ECDHE-RSA-AES128-SHA256"; 340 341 if (SSL_CTX_set_cipher_list(mSslContext->native_handle(), 342 mozillaModern.c_str()) != 1) 343 { 344 BMCWEB_LOG_ERROR << "Error setting cipher list\n"; 345 } 346 return mSslContext; 347 } 348 } // namespace ensuressl 349 350 #endif 351