2021-01-27 16:35:09 +01:00
|
|
|
/*
|
2023-06-24 12:07:17 +02:00
|
|
|
* Copyright (c) 2021, 2023 Omar Polo <op@omarpolo.com>
|
2023-06-11 13:03:59 +02:00
|
|
|
* Copyright (c) 2008 Pierre-Yves Ritschard <pyr@openbsd.org>
|
|
|
|
* Copyright (c) 2008 Reyk Floeter <reyk@openbsd.org>
|
2021-01-27 16:35:09 +01:00
|
|
|
*
|
|
|
|
* Permission to use, copy, modify, and distribute this software for any
|
|
|
|
* purpose with or without fee is hereby granted, provided that the above
|
|
|
|
* copyright notice and this permission notice appear in all copies.
|
|
|
|
*
|
|
|
|
* THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
|
|
|
|
* WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
|
|
|
|
* MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
|
|
|
|
* ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
|
|
|
|
* WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
|
|
|
|
* ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
|
|
|
|
* OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
|
|
|
|
*/
|
|
|
|
|
2021-02-12 13:47:20 +01:00
|
|
|
#include "gmid.h"
|
|
|
|
|
2021-01-27 16:35:09 +01:00
|
|
|
#include <errno.h>
|
|
|
|
#include <string.h>
|
|
|
|
|
2021-02-10 15:25:39 +01:00
|
|
|
#include <openssl/bn.h>
|
2023-06-11 13:03:59 +02:00
|
|
|
#include <openssl/err.h>
|
2021-02-07 16:30:28 +01:00
|
|
|
#include <openssl/pem.h>
|
2021-02-09 23:30:04 +01:00
|
|
|
#include <openssl/x509_vfy.h>
|
|
|
|
#include <openssl/x509v3.h>
|
2021-02-07 16:30:28 +01:00
|
|
|
|
2023-06-06 13:46:40 +02:00
|
|
|
#include "log.h"
|
2023-06-05 19:07:52 +02:00
|
|
|
|
2023-08-08 17:56:27 +02:00
|
|
|
const char *
|
|
|
|
strip_path(const char *path, int strip)
|
|
|
|
{
|
|
|
|
char *t;
|
|
|
|
|
|
|
|
while (strip > 0) {
|
|
|
|
if ((t = strchr(path, '/')) == NULL) {
|
|
|
|
path = strchr(path, '\0');
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
path = t;
|
|
|
|
strip--;
|
|
|
|
}
|
|
|
|
|
|
|
|
return path;
|
|
|
|
}
|
|
|
|
|
2021-01-27 16:35:09 +01:00
|
|
|
int
|
|
|
|
ends_with(const char *str, const char *sufx)
|
|
|
|
{
|
|
|
|
size_t i, j;
|
|
|
|
|
|
|
|
i = strlen(str);
|
|
|
|
j = strlen(sufx);
|
|
|
|
|
|
|
|
if (j > i)
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
i -= j;
|
|
|
|
for (j = 0; str[i] != '\0'; i++, j++)
|
|
|
|
if (str[i] != sufx[j])
|
|
|
|
return 0;
|
|
|
|
return 1;
|
|
|
|
}
|
|
|
|
|
2021-02-01 12:07:57 +01:00
|
|
|
char *
|
|
|
|
absolutify_path(const char *path)
|
|
|
|
{
|
2023-08-11 12:40:58 +02:00
|
|
|
char wd[PATH_MAX], *r;
|
2021-02-01 12:07:57 +01:00
|
|
|
|
|
|
|
if (*path == '/') {
|
|
|
|
if ((r = strdup(path)) == NULL)
|
2023-06-09 19:27:41 +02:00
|
|
|
fatal("strdup");
|
2021-02-01 12:07:57 +01:00
|
|
|
return r;
|
|
|
|
}
|
|
|
|
|
2023-08-11 12:40:58 +02:00
|
|
|
if (getcwd(wd, sizeof(wd)) == NULL)
|
|
|
|
fatal("getcwd");
|
2021-02-01 12:07:57 +01:00
|
|
|
if (asprintf(&r, "%s/%s", wd, path) == -1)
|
2023-06-09 19:27:41 +02:00
|
|
|
fatal("asprintf");
|
2021-02-01 12:07:57 +01:00
|
|
|
return r;
|
|
|
|
}
|
2021-02-04 14:23:15 +01:00
|
|
|
|
|
|
|
char *
|
|
|
|
xstrdup(const char *s)
|
|
|
|
{
|
|
|
|
char *d;
|
|
|
|
|
|
|
|
if ((d = strdup(s)) == NULL)
|
2023-06-09 19:27:41 +02:00
|
|
|
fatal("strdup");
|
2021-02-04 14:23:15 +01:00
|
|
|
return d;
|
|
|
|
}
|
2021-02-07 16:30:28 +01:00
|
|
|
|
2021-03-31 18:32:18 +02:00
|
|
|
void *
|
|
|
|
xcalloc(size_t nmemb, size_t size)
|
|
|
|
{
|
|
|
|
void *d;
|
|
|
|
|
|
|
|
if ((d = calloc(nmemb, size)) == NULL)
|
2023-06-09 19:27:41 +02:00
|
|
|
fatal("calloc");
|
2021-03-31 18:32:18 +02:00
|
|
|
return d;
|
|
|
|
}
|
|
|
|
|
2021-02-07 16:30:28 +01:00
|
|
|
void
|
2021-02-12 13:47:20 +01:00
|
|
|
gen_certificate(const char *hostname, const char *certpath, const char *keypath)
|
2021-02-07 16:30:28 +01:00
|
|
|
{
|
2021-02-10 15:25:39 +01:00
|
|
|
BIGNUM *e;
|
2021-02-07 16:30:28 +01:00
|
|
|
EVP_PKEY *pkey;
|
|
|
|
RSA *rsa;
|
|
|
|
X509 *x509;
|
|
|
|
X509_NAME *name;
|
|
|
|
FILE *f;
|
2021-02-12 13:47:20 +01:00
|
|
|
const unsigned char *host = (const unsigned char*)hostname;
|
2021-02-07 16:30:28 +01:00
|
|
|
|
2023-06-06 13:46:40 +02:00
|
|
|
log_info("generating new certificate for %s (it could take a while)",
|
2021-02-07 16:30:28 +01:00
|
|
|
host);
|
|
|
|
|
|
|
|
if ((pkey = EVP_PKEY_new()) == NULL)
|
2023-06-05 19:07:52 +02:00
|
|
|
fatalx("couldn't create a new private key");
|
2021-02-07 16:30:28 +01:00
|
|
|
|
|
|
|
if ((rsa = RSA_new()) == NULL)
|
2023-06-05 19:07:52 +02:00
|
|
|
fatalx("couldn't generate rsa");
|
2021-02-07 16:30:28 +01:00
|
|
|
|
2021-02-10 15:25:39 +01:00
|
|
|
if ((e = BN_new()) == NULL)
|
2023-06-05 19:07:52 +02:00
|
|
|
fatalx("couldn't allocate a bignum");
|
2021-02-10 15:25:39 +01:00
|
|
|
|
2021-05-12 19:37:22 +02:00
|
|
|
BN_set_word(e, RSA_F4);
|
2021-02-10 15:25:39 +01:00
|
|
|
if (!RSA_generate_key_ex(rsa, 4096, e, NULL))
|
2023-06-05 19:07:52 +02:00
|
|
|
fatalx("couldn't generate a rsa key");
|
2021-02-07 16:30:28 +01:00
|
|
|
|
|
|
|
if (!EVP_PKEY_assign_RSA(pkey, rsa))
|
2023-06-05 19:07:52 +02:00
|
|
|
fatalx("couldn't assign the key");
|
2021-02-07 16:30:28 +01:00
|
|
|
|
|
|
|
if ((x509 = X509_new()) == NULL)
|
2023-06-05 19:07:52 +02:00
|
|
|
fatalx("couldn't generate the X509 certificate");
|
2021-02-07 16:30:28 +01:00
|
|
|
|
2021-05-12 19:37:22 +02:00
|
|
|
ASN1_INTEGER_set(X509_get_serialNumber(x509), 0);
|
2021-02-07 16:30:28 +01:00
|
|
|
X509_gmtime_adj(X509_get_notBefore(x509), 0);
|
|
|
|
X509_gmtime_adj(X509_get_notAfter(x509), 315360000L); /* 10 years */
|
2021-05-12 19:37:22 +02:00
|
|
|
X509_set_version(x509, 3);
|
2021-02-07 16:30:28 +01:00
|
|
|
|
|
|
|
if (!X509_set_pubkey(x509, pkey))
|
2023-06-05 19:07:52 +02:00
|
|
|
fatalx("couldn't set the public key");
|
2021-02-07 16:30:28 +01:00
|
|
|
|
|
|
|
name = X509_get_subject_name(x509);
|
|
|
|
if (!X509_NAME_add_entry_by_txt(name, "CN", MBSTRING_ASC, host, -1, -1, 0))
|
2023-06-05 19:07:52 +02:00
|
|
|
fatalx("couldn't add CN to cert");
|
2021-02-07 16:30:28 +01:00
|
|
|
X509_set_issuer_name(x509, name);
|
|
|
|
|
|
|
|
if (!X509_sign(x509, pkey, EVP_sha256()))
|
2023-06-05 19:07:52 +02:00
|
|
|
fatalx("couldn't sign the certificate");
|
2021-02-07 16:30:28 +01:00
|
|
|
|
|
|
|
if ((f = fopen(keypath, "w")) == NULL)
|
2023-06-05 19:07:52 +02:00
|
|
|
fatal("can't open %s", keypath);
|
2021-02-07 16:30:28 +01:00
|
|
|
if (!PEM_write_PrivateKey(f, pkey, NULL, NULL, 0, NULL, NULL))
|
2023-06-05 19:07:52 +02:00
|
|
|
fatalx("couldn't write private key");
|
2021-02-07 16:30:28 +01:00
|
|
|
fclose(f);
|
|
|
|
|
|
|
|
if ((f = fopen(certpath, "w")) == NULL)
|
2023-06-05 19:07:52 +02:00
|
|
|
fatal("can't open %s", certpath);
|
2021-02-07 16:30:28 +01:00
|
|
|
if (!PEM_write_X509(f, x509))
|
2023-06-05 19:07:52 +02:00
|
|
|
fatalx("couldn't write cert");
|
2021-02-07 16:30:28 +01:00
|
|
|
fclose(f);
|
|
|
|
|
2021-02-10 15:25:39 +01:00
|
|
|
BN_free(e);
|
2021-02-07 16:30:28 +01:00
|
|
|
X509_free(x509);
|
|
|
|
RSA_free(rsa);
|
2022-04-12 19:40:58 +02:00
|
|
|
|
2023-06-06 13:46:40 +02:00
|
|
|
log_info("certificate successfully generated");
|
2021-02-07 16:30:28 +01:00
|
|
|
}
|
2021-02-09 23:30:04 +01:00
|
|
|
|
|
|
|
X509_STORE *
|
2023-06-12 23:27:24 +02:00
|
|
|
load_ca(uint8_t *d, size_t len)
|
2021-02-09 23:30:04 +01:00
|
|
|
{
|
2023-06-12 23:27:24 +02:00
|
|
|
BIO *in;
|
2021-02-09 23:30:04 +01:00
|
|
|
X509 *x = NULL;
|
|
|
|
X509_STORE *store;
|
|
|
|
|
2023-06-09 11:28:26 +02:00
|
|
|
if ((store = X509_STORE_new()) == NULL) {
|
2023-06-12 23:27:24 +02:00
|
|
|
log_warnx("%s: X509_STORE_new failed", __func__);
|
2021-02-09 23:30:04 +01:00
|
|
|
return NULL;
|
2023-06-09 11:28:26 +02:00
|
|
|
}
|
2021-02-09 23:30:04 +01:00
|
|
|
|
2023-06-12 23:27:24 +02:00
|
|
|
if ((in = BIO_new_mem_buf(d, len)) == NULL) {
|
|
|
|
log_warnx("%s: BIO_new_mem_buf failed", __func__);
|
2021-02-09 23:30:04 +01:00
|
|
|
goto err;
|
2023-06-09 11:28:26 +02:00
|
|
|
}
|
2021-02-09 23:30:04 +01:00
|
|
|
|
2023-06-12 23:27:24 +02:00
|
|
|
if ((x = PEM_read_bio_X509(in, NULL, NULL, NULL)) == NULL) {
|
|
|
|
log_warnx("%s: PEM_read_bio_X509 failed", __func__);
|
|
|
|
ssl_error("PEM_read_bio_X509");
|
2021-02-09 23:30:04 +01:00
|
|
|
goto err;
|
2023-06-12 23:27:24 +02:00
|
|
|
}
|
2021-02-09 23:30:04 +01:00
|
|
|
|
2023-06-12 23:27:24 +02:00
|
|
|
if (X509_check_ca(x) == 0) {
|
|
|
|
ssl_error("X509_check_ca");
|
2021-02-09 23:30:04 +01:00
|
|
|
goto err;
|
2023-06-12 23:27:24 +02:00
|
|
|
}
|
2021-02-09 23:30:04 +01:00
|
|
|
|
2023-06-12 23:27:24 +02:00
|
|
|
if (!X509_STORE_add_cert(store, x)) {
|
|
|
|
ssl_error("X509_STORE_add_cert");
|
2021-02-09 23:30:04 +01:00
|
|
|
goto err;
|
2023-06-12 23:27:24 +02:00
|
|
|
}
|
2021-02-09 23:30:04 +01:00
|
|
|
|
|
|
|
X509_free(x);
|
2023-06-12 23:27:24 +02:00
|
|
|
BIO_free(in);
|
2021-02-09 23:30:04 +01:00
|
|
|
return store;
|
|
|
|
|
|
|
|
err:
|
|
|
|
X509_STORE_free(store);
|
|
|
|
if (x != NULL)
|
|
|
|
X509_free(x);
|
2023-06-12 23:27:24 +02:00
|
|
|
if (in != NULL)
|
|
|
|
BIO_free(in);
|
2021-02-09 23:30:04 +01:00
|
|
|
return NULL;
|
|
|
|
}
|
|
|
|
|
|
|
|
int
|
|
|
|
validate_against_ca(X509_STORE *ca, const uint8_t *chain, size_t len)
|
|
|
|
{
|
|
|
|
X509 *client;
|
|
|
|
BIO *m;
|
|
|
|
X509_STORE_CTX *ctx = NULL;
|
|
|
|
int ret = 0;
|
|
|
|
|
|
|
|
if ((m = BIO_new_mem_buf(chain, len)) == NULL)
|
|
|
|
return 0;
|
|
|
|
|
|
|
|
if ((client = PEM_read_bio_X509(m, NULL, NULL, NULL)) == NULL)
|
|
|
|
goto end;
|
|
|
|
|
|
|
|
if ((ctx = X509_STORE_CTX_new()) == NULL)
|
|
|
|
goto end;
|
|
|
|
|
|
|
|
if (!X509_STORE_CTX_init(ctx, ca, client, NULL))
|
|
|
|
goto end;
|
|
|
|
|
|
|
|
ret = X509_verify_cert(ctx);
|
|
|
|
|
|
|
|
end:
|
|
|
|
BIO_free(m);
|
|
|
|
if (client != NULL)
|
|
|
|
X509_free(client);
|
|
|
|
if (ctx != NULL)
|
|
|
|
X509_STORE_CTX_free(ctx);
|
|
|
|
return ret;
|
|
|
|
}
|
2023-06-08 17:59:53 +02:00
|
|
|
|
2023-06-11 13:03:59 +02:00
|
|
|
void
|
|
|
|
ssl_error(const char *where)
|
|
|
|
{
|
|
|
|
unsigned long code;
|
|
|
|
char errbuf[128];
|
|
|
|
|
|
|
|
while ((code = ERR_get_error()) != 0) {
|
|
|
|
ERR_error_string_n(code, errbuf, sizeof(errbuf));
|
|
|
|
log_debug("debug: SSL library error: %s: %s", where, errbuf);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
char *
|
2023-06-11 13:31:22 +02:00
|
|
|
ssl_pubkey_hash(const uint8_t *buf, size_t len)
|
2023-06-11 13:03:59 +02:00
|
|
|
{
|
|
|
|
static const char hex[] = "0123456789abcdef";
|
|
|
|
BIO *in;
|
|
|
|
X509 *x509 = NULL;
|
|
|
|
char *hash = NULL;
|
|
|
|
size_t off;
|
2023-06-11 13:31:22 +02:00
|
|
|
unsigned char digest[EVP_MAX_MD_SIZE];
|
|
|
|
unsigned int dlen, i;
|
2023-06-11 13:03:59 +02:00
|
|
|
|
|
|
|
if ((in = BIO_new_mem_buf(buf, len)) == NULL) {
|
|
|
|
log_warnx("%s: BIO_new_mem_buf failed", __func__);
|
|
|
|
return NULL;
|
|
|
|
}
|
|
|
|
|
|
|
|
if ((x509 = PEM_read_bio_X509(in, NULL, NULL, NULL)) == NULL) {
|
|
|
|
log_warnx("%s: PEM_read_bio_X509 failed", __func__);
|
|
|
|
ssl_error("PEM_read_bio_X509");
|
|
|
|
goto fail;
|
|
|
|
}
|
|
|
|
|
|
|
|
if ((hash = malloc(TLS_CERT_HASH_SIZE)) == NULL) {
|
|
|
|
log_warn("%s: malloc", __func__);
|
|
|
|
goto fail;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (X509_pubkey_digest(x509, EVP_sha256(), digest, &dlen) != 1) {
|
|
|
|
log_warnx("%s: X509_pubkey_digest failed", __func__);
|
|
|
|
ssl_error("X509_pubkey_digest");
|
|
|
|
free(hash);
|
|
|
|
hash = NULL;
|
|
|
|
goto fail;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (TLS_CERT_HASH_SIZE < 2 * dlen + sizeof("SHA256:"))
|
|
|
|
fatalx("%s: hash buffer too small", __func__);
|
|
|
|
|
|
|
|
off = strlcpy(hash, "SHA256:", TLS_CERT_HASH_SIZE);
|
|
|
|
for (i = 0; i < dlen; ++i) {
|
|
|
|
hash[off++] = hex[(digest[i] >> 4) & 0xf];
|
|
|
|
hash[off++] = hex[digest[i] & 0xf];
|
|
|
|
}
|
|
|
|
hash[off] = '\0';
|
|
|
|
|
|
|
|
fail:
|
|
|
|
BIO_free(in);
|
|
|
|
if (x509)
|
|
|
|
X509_free(x509);
|
|
|
|
return hash;
|
|
|
|
}
|
|
|
|
|
|
|
|
EVP_PKEY *
|
2023-06-11 13:31:22 +02:00
|
|
|
ssl_load_pkey(const uint8_t *buf, size_t len)
|
2023-06-11 13:03:59 +02:00
|
|
|
{
|
|
|
|
BIO *in;
|
|
|
|
EVP_PKEY *pkey;
|
|
|
|
|
|
|
|
if ((in = BIO_new_mem_buf(buf, len)) == NULL) {
|
|
|
|
log_warnx("%s: BIO_new_mem_buf failed", __func__);
|
|
|
|
return NULL;
|
|
|
|
}
|
|
|
|
|
|
|
|
if ((pkey = PEM_read_bio_PrivateKey(in, NULL, NULL, NULL)) == NULL) {
|
|
|
|
log_warnx("%s: PEM_read_bio_PrivateKey failed", __func__);
|
|
|
|
ssl_error("PEM_read_bio_PrivateKey");
|
|
|
|
}
|
|
|
|
|
|
|
|
BIO_free(in);
|
|
|
|
return pkey;
|
|
|
|
}
|
|
|
|
|
2023-06-08 17:59:53 +02:00
|
|
|
struct vhost *
|
|
|
|
new_vhost(void)
|
|
|
|
{
|
|
|
|
struct vhost *h;
|
|
|
|
|
|
|
|
h = xcalloc(1, sizeof(*h));
|
2023-06-23 23:03:29 +02:00
|
|
|
TAILQ_INIT(&h->addrs);
|
2023-06-08 17:59:53 +02:00
|
|
|
TAILQ_INIT(&h->locations);
|
|
|
|
TAILQ_INIT(&h->aliases);
|
|
|
|
TAILQ_INIT(&h->proxies);
|
|
|
|
return h;
|
|
|
|
}
|
|
|
|
|
|
|
|
struct location *
|
|
|
|
new_location(void)
|
|
|
|
{
|
|
|
|
struct location *l;
|
|
|
|
|
|
|
|
l = xcalloc(1, sizeof(*l));
|
|
|
|
l->dirfd = -1;
|
|
|
|
l->fcgi = -1;
|
2023-07-23 20:45:05 +02:00
|
|
|
TAILQ_INIT(&l->params);
|
2023-06-08 17:59:53 +02:00
|
|
|
return l;
|
|
|
|
}
|
|
|
|
|
|
|
|
struct proxy *
|
|
|
|
new_proxy(void)
|
|
|
|
{
|
|
|
|
struct proxy *p;
|
|
|
|
|
|
|
|
p = xcalloc(1, sizeof(*p));
|
|
|
|
p->protocols = TLS_PROTOCOLS_DEFAULT;
|
|
|
|
return p;
|
|
|
|
}
|