2 eac9287d 2023-06-24 op * Copyright (c) 2021, 2023 Omar Polo <op@omarpolo.com>
3 86693a33 2023-06-11 op * Copyright (c) 2008 Pierre-Yves Ritschard <pyr@openbsd.org>
4 86693a33 2023-06-11 op * Copyright (c) 2008 Reyk Floeter <reyk@openbsd.org>
6 44ee1bac 2021-01-27 op * Permission to use, copy, modify, and distribute this software for any
7 44ee1bac 2021-01-27 op * purpose with or without fee is hereby granted, provided that the above
8 44ee1bac 2021-01-27 op * copyright notice and this permission notice appear in all copies.
10 44ee1bac 2021-01-27 op * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11 44ee1bac 2021-01-27 op * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12 44ee1bac 2021-01-27 op * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13 44ee1bac 2021-01-27 op * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14 44ee1bac 2021-01-27 op * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15 44ee1bac 2021-01-27 op * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16 44ee1bac 2021-01-27 op * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19 52418c8d 2021-02-12 op #include "gmid.h"
21 44ee1bac 2021-01-27 op #include <errno.h>
22 44ee1bac 2021-01-27 op #include <string.h>
24 4283d65f 2021-02-10 op #include <openssl/bn.h>
25 86693a33 2023-06-11 op #include <openssl/err.h>
26 3abf91b0 2021-02-07 op #include <openssl/pem.h>
27 02be96c6 2021-02-09 op #include <openssl/x509_vfy.h>
28 02be96c6 2021-02-09 op #include <openssl/x509v3.h>
30 eae52ad4 2023-06-06 op #include "log.h"
33 d98ef734 2023-08-08 op strip_path(const char *path, int strip)
37 d98ef734 2023-08-08 op while (strip > 0) {
38 d98ef734 2023-08-08 op if ((t = strchr(path, '/')) == NULL) {
39 d98ef734 2023-08-08 op path = strchr(path, '\0');
50 44ee1bac 2021-01-27 op starts_with(const char *str, const char *prefix)
54 44ee1bac 2021-01-27 op if (prefix == NULL)
57 44ee1bac 2021-01-27 op for (i = 0; prefix[i] != '\0'; ++i)
58 44ee1bac 2021-01-27 op if (str[i] != prefix[i])
64 44ee1bac 2021-01-27 op ends_with(const char *str, const char *sufx)
68 44ee1bac 2021-01-27 op i = strlen(str);
69 44ee1bac 2021-01-27 op j = strlen(sufx);
75 44ee1bac 2021-01-27 op for (j = 0; str[i] != '\0'; i++, j++)
76 44ee1bac 2021-01-27 op if (str[i] != sufx[j])
82 44ee1bac 2021-01-27 op filesize(int fd)
86 44ee1bac 2021-01-27 op if ((len = lseek(fd, 0, SEEK_END)) == -1)
88 44ee1bac 2021-01-27 op if (lseek(fd, 0, SEEK_SET) == -1)
94 bcf5d929 2021-02-01 op absolutify_path(const char *path)
98 bcf5d929 2021-02-01 op if (*path == '/') {
99 bcf5d929 2021-02-01 op if ((r = strdup(path)) == NULL)
100 792f302a 2023-06-09 op fatal("strdup");
104 bcf5d929 2021-02-01 op wd = getcwd(NULL, 0);
105 bcf5d929 2021-02-01 op if (asprintf(&r, "%s/%s", wd, path) == -1)
106 792f302a 2023-06-09 op fatal("asprintf");
112 ca21e100 2021-02-04 op xstrdup(const char *s)
116 ca21e100 2021-02-04 op if ((d = strdup(s)) == NULL)
117 792f302a 2023-06-09 op fatal("strdup");
122 b8e64ccd 2021-03-31 op xcalloc(size_t nmemb, size_t size)
126 b8e64ccd 2021-03-31 op if ((d = calloc(nmemb, size)) == NULL)
127 792f302a 2023-06-09 op fatal("calloc");
132 52418c8d 2021-02-12 op gen_certificate(const char *hostname, const char *certpath, const char *keypath)
135 3abf91b0 2021-02-07 op EVP_PKEY *pkey;
138 3abf91b0 2021-02-07 op X509_NAME *name;
140 52418c8d 2021-02-12 op const unsigned char *host = (const unsigned char*)hostname;
142 eae52ad4 2023-06-06 op log_info("generating new certificate for %s (it could take a while)",
145 3abf91b0 2021-02-07 op if ((pkey = EVP_PKEY_new()) == NULL)
146 df5058c9 2023-06-05 op fatalx("couldn't create a new private key");
148 3abf91b0 2021-02-07 op if ((rsa = RSA_new()) == NULL)
149 df5058c9 2023-06-05 op fatalx("couldn't generate rsa");
151 4283d65f 2021-02-10 op if ((e = BN_new()) == NULL)
152 df5058c9 2023-06-05 op fatalx("couldn't allocate a bignum");
154 1eb3631d 2021-05-12 op BN_set_word(e, RSA_F4);
155 4283d65f 2021-02-10 op if (!RSA_generate_key_ex(rsa, 4096, e, NULL))
156 df5058c9 2023-06-05 op fatalx("couldn't generate a rsa key");
158 3abf91b0 2021-02-07 op if (!EVP_PKEY_assign_RSA(pkey, rsa))
159 df5058c9 2023-06-05 op fatalx("couldn't assign the key");
161 3abf91b0 2021-02-07 op if ((x509 = X509_new()) == NULL)
162 df5058c9 2023-06-05 op fatalx("couldn't generate the X509 certificate");
164 1eb3631d 2021-05-12 op ASN1_INTEGER_set(X509_get_serialNumber(x509), 0);
165 3abf91b0 2021-02-07 op X509_gmtime_adj(X509_get_notBefore(x509), 0);
166 3abf91b0 2021-02-07 op X509_gmtime_adj(X509_get_notAfter(x509), 315360000L); /* 10 years */
167 1eb3631d 2021-05-12 op X509_set_version(x509, 3);
169 3abf91b0 2021-02-07 op if (!X509_set_pubkey(x509, pkey))
170 df5058c9 2023-06-05 op fatalx("couldn't set the public key");
172 3abf91b0 2021-02-07 op name = X509_get_subject_name(x509);
173 3abf91b0 2021-02-07 op if (!X509_NAME_add_entry_by_txt(name, "CN", MBSTRING_ASC, host, -1, -1, 0))
174 df5058c9 2023-06-05 op fatalx("couldn't add CN to cert");
175 3abf91b0 2021-02-07 op X509_set_issuer_name(x509, name);
177 3abf91b0 2021-02-07 op if (!X509_sign(x509, pkey, EVP_sha256()))
178 df5058c9 2023-06-05 op fatalx("couldn't sign the certificate");
180 3abf91b0 2021-02-07 op if ((f = fopen(keypath, "w")) == NULL)
181 df5058c9 2023-06-05 op fatal("can't open %s", keypath);
182 3abf91b0 2021-02-07 op if (!PEM_write_PrivateKey(f, pkey, NULL, NULL, 0, NULL, NULL))
183 df5058c9 2023-06-05 op fatalx("couldn't write private key");
186 3abf91b0 2021-02-07 op if ((f = fopen(certpath, "w")) == NULL)
187 df5058c9 2023-06-05 op fatal("can't open %s", certpath);
188 3abf91b0 2021-02-07 op if (!PEM_write_X509(f, x509))
189 df5058c9 2023-06-05 op fatalx("couldn't write cert");
193 3abf91b0 2021-02-07 op X509_free(x509);
194 3abf91b0 2021-02-07 op RSA_free(rsa);
196 eae52ad4 2023-06-06 op log_info("certificate successfully generated");
200 2cef5cf4 2023-06-12 op load_ca(uint8_t *d, size_t len)
203 02be96c6 2021-02-09 op X509 *x = NULL;
204 02be96c6 2021-02-09 op X509_STORE *store;
206 deadd9e1 2023-06-09 op if ((store = X509_STORE_new()) == NULL) {
207 2cef5cf4 2023-06-12 op log_warnx("%s: X509_STORE_new failed", __func__);
211 2cef5cf4 2023-06-12 op if ((in = BIO_new_mem_buf(d, len)) == NULL) {
212 2cef5cf4 2023-06-12 op log_warnx("%s: BIO_new_mem_buf failed", __func__);
216 2cef5cf4 2023-06-12 op if ((x = PEM_read_bio_X509(in, NULL, NULL, NULL)) == NULL) {
217 2cef5cf4 2023-06-12 op log_warnx("%s: PEM_read_bio_X509 failed", __func__);
218 2cef5cf4 2023-06-12 op ssl_error("PEM_read_bio_X509");
222 2cef5cf4 2023-06-12 op if (X509_check_ca(x) == 0) {
223 2cef5cf4 2023-06-12 op ssl_error("X509_check_ca");
227 2cef5cf4 2023-06-12 op if (!X509_STORE_add_cert(store, x)) {
228 2cef5cf4 2023-06-12 op ssl_error("X509_STORE_add_cert");
232 02be96c6 2021-02-09 op X509_free(x);
233 2cef5cf4 2023-06-12 op BIO_free(in);
234 02be96c6 2021-02-09 op return store;
237 02be96c6 2021-02-09 op X509_STORE_free(store);
238 02be96c6 2021-02-09 op if (x != NULL)
239 02be96c6 2021-02-09 op X509_free(x);
240 2cef5cf4 2023-06-12 op if (in != NULL)
241 2cef5cf4 2023-06-12 op BIO_free(in);
246 02be96c6 2021-02-09 op validate_against_ca(X509_STORE *ca, const uint8_t *chain, size_t len)
248 02be96c6 2021-02-09 op X509 *client;
250 02be96c6 2021-02-09 op X509_STORE_CTX *ctx = NULL;
253 02be96c6 2021-02-09 op if ((m = BIO_new_mem_buf(chain, len)) == NULL)
256 02be96c6 2021-02-09 op if ((client = PEM_read_bio_X509(m, NULL, NULL, NULL)) == NULL)
259 02be96c6 2021-02-09 op if ((ctx = X509_STORE_CTX_new()) == NULL)
262 02be96c6 2021-02-09 op if (!X509_STORE_CTX_init(ctx, ca, client, NULL))
265 02be96c6 2021-02-09 op ret = X509_verify_cert(ctx);
269 02be96c6 2021-02-09 op if (client != NULL)
270 02be96c6 2021-02-09 op X509_free(client);
271 02be96c6 2021-02-09 op if (ctx != NULL)
272 02be96c6 2021-02-09 op X509_STORE_CTX_free(ctx);
277 86693a33 2023-06-11 op ssl_error(const char *where)
279 86693a33 2023-06-11 op unsigned long code;
280 86693a33 2023-06-11 op char errbuf[128];
282 86693a33 2023-06-11 op while ((code = ERR_get_error()) != 0) {
283 86693a33 2023-06-11 op ERR_error_string_n(code, errbuf, sizeof(errbuf));
284 86693a33 2023-06-11 op log_debug("debug: SSL library error: %s: %s", where, errbuf);
289 b8d68fc8 2023-06-11 op ssl_pubkey_hash(const uint8_t *buf, size_t len)
291 86693a33 2023-06-11 op static const char hex[] = "0123456789abcdef";
293 86693a33 2023-06-11 op X509 *x509 = NULL;
294 86693a33 2023-06-11 op char *hash = NULL;
296 b8d68fc8 2023-06-11 op unsigned char digest[EVP_MAX_MD_SIZE];
297 b8d68fc8 2023-06-11 op unsigned int dlen, i;
299 86693a33 2023-06-11 op if ((in = BIO_new_mem_buf(buf, len)) == NULL) {
300 86693a33 2023-06-11 op log_warnx("%s: BIO_new_mem_buf failed", __func__);
304 86693a33 2023-06-11 op if ((x509 = PEM_read_bio_X509(in, NULL, NULL, NULL)) == NULL) {
305 86693a33 2023-06-11 op log_warnx("%s: PEM_read_bio_X509 failed", __func__);
306 86693a33 2023-06-11 op ssl_error("PEM_read_bio_X509");
310 86693a33 2023-06-11 op if ((hash = malloc(TLS_CERT_HASH_SIZE)) == NULL) {
311 86693a33 2023-06-11 op log_warn("%s: malloc", __func__);
315 86693a33 2023-06-11 op if (X509_pubkey_digest(x509, EVP_sha256(), digest, &dlen) != 1) {
316 86693a33 2023-06-11 op log_warnx("%s: X509_pubkey_digest failed", __func__);
317 86693a33 2023-06-11 op ssl_error("X509_pubkey_digest");
323 86693a33 2023-06-11 op if (TLS_CERT_HASH_SIZE < 2 * dlen + sizeof("SHA256:"))
324 86693a33 2023-06-11 op fatalx("%s: hash buffer too small", __func__);
326 86693a33 2023-06-11 op off = strlcpy(hash, "SHA256:", TLS_CERT_HASH_SIZE);
327 86693a33 2023-06-11 op for (i = 0; i < dlen; ++i) {
328 86693a33 2023-06-11 op hash[off++] = hex[(digest[i] >> 4) & 0xf];
329 86693a33 2023-06-11 op hash[off++] = hex[digest[i] & 0xf];
331 86693a33 2023-06-11 op hash[off] = '\0';
334 86693a33 2023-06-11 op BIO_free(in);
336 86693a33 2023-06-11 op X509_free(x509);
341 b8d68fc8 2023-06-11 op ssl_load_pkey(const uint8_t *buf, size_t len)
344 86693a33 2023-06-11 op EVP_PKEY *pkey;
346 86693a33 2023-06-11 op if ((in = BIO_new_mem_buf(buf, len)) == NULL) {
347 86693a33 2023-06-11 op log_warnx("%s: BIO_new_mem_buf failed", __func__);
351 86693a33 2023-06-11 op if ((pkey = PEM_read_bio_PrivateKey(in, NULL, NULL, NULL)) == NULL) {
352 86693a33 2023-06-11 op log_warnx("%s: PEM_read_bio_PrivateKey failed", __func__);
353 86693a33 2023-06-11 op ssl_error("PEM_read_bio_PrivateKey");
356 86693a33 2023-06-11 op BIO_free(in);
360 fc9cc497 2023-06-08 op struct vhost *
361 fc9cc497 2023-06-08 op new_vhost(void)
363 fc9cc497 2023-06-08 op struct vhost *h;
365 fc9cc497 2023-06-08 op h = xcalloc(1, sizeof(*h));
366 509d0509 2023-06-23 op TAILQ_INIT(&h->addrs);
367 fc9cc497 2023-06-08 op TAILQ_INIT(&h->locations);
368 fc9cc497 2023-06-08 op TAILQ_INIT(&h->aliases);
369 fc9cc497 2023-06-08 op TAILQ_INIT(&h->proxies);
373 fc9cc497 2023-06-08 op struct location *
374 fc9cc497 2023-06-08 op new_location(void)
376 fc9cc497 2023-06-08 op struct location *l;
378 fc9cc497 2023-06-08 op l = xcalloc(1, sizeof(*l));
379 fc9cc497 2023-06-08 op l->dirfd = -1;
380 fc9cc497 2023-06-08 op l->fcgi = -1;
381 a1ba9650 2023-07-23 op TAILQ_INIT(&l->params);
385 fc9cc497 2023-06-08 op struct proxy *
386 fc9cc497 2023-06-08 op new_proxy(void)
388 fc9cc497 2023-06-08 op struct proxy *p;
390 fc9cc497 2023-06-08 op p = xcalloc(1, sizeof(*p));
391 fc9cc497 2023-06-08 op p->protocols = TLS_PROTOCOLS_DEFAULT;