1 /*
2  * Copyright (c) 2021 Omar Polo <op@omarpolo.com>
3  *
4  * Permission to use, copy, modify, and distribute this software for any
5  * purpose with or without fee is hereby granted, provided that the above
6  * copyright notice and this permission notice appear in all copies.
7  *
8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15  */
16 
17 #include <errno.h>
18 #include <string.h>
19 
20 #include <openssl/pem.h>
21 #include <openssl/x509_vfy.h>
22 #include <openssl/x509v3.h>
23 
24 #include "gmid.h"
25 
26 static sigset_t set;
27 
28 void
29 block_signals(void)
30 {
31 	sigset_t new;
32 
33 	sigemptyset(&new);
34 	sigaddset(&new, SIGHUP);
35 	sigprocmask(SIG_BLOCK, &new, &set);
36 }
37 
38 void
39 unblock_signals(void)
40 {
41 	sigprocmask(SIG_SETMASK, &set, NULL);
42 }
43 
44 int
45 starts_with(const char *str, const char *prefix)
46 {
47 	size_t i;
48 
49 	if (prefix == NULL)
50 		return 0;
51 
52 	for (i = 0; prefix[i] != '\0'; ++i)
53 		if (str[i] != prefix[i])
54 			return 0;
55 	return 1;
56 }
57 
58 int
59 ends_with(const char *str, const char *sufx)
60 {
61 	size_t i, j;
62 
63 	i = strlen(str);
64 	j = strlen(sufx);
65 
66 	if (j > i)
67 		return 0;
68 
69 	i -= j;
70 	for (j = 0; str[i] != '\0'; i++, j++)
71 		if (str[i] != sufx[j])
72 			return 0;
73 	return 1;
74 }
75 
76 ssize_t
77 filesize(int fd)
78 {
79 	ssize_t len;
80 
81 	if ((len = lseek(fd, 0, SEEK_END)) == -1)
82 		return -1;
83 	if (lseek(fd, 0, SEEK_SET) == -1)
84 		return -1;
85 	return len;
86 }
87 
88 char *
89 absolutify_path(const char *path)
90 {
91 	char *wd, *r;
92 
93 	if (*path == '/') {
94 		if ((r = strdup(path)) == NULL)
95 			err(1, "strdup");
96 		return r;
97 	}
98 
99 	wd = getcwd(NULL, 0);
100 	if (asprintf(&r, "%s/%s", wd, path) == -1)
101 		err(1, "asprintf");
102 	free(wd);
103 	return r;
104 }
105 
106 char *
107 xstrdup(const char *s)
108 {
109 	char *d;
110 
111 	if ((d = strdup(s)) == NULL)
112 		err(1, "strdup");
113 	return d;
114 }
115 
116 void
117 gen_certificate(const char *host, const char *certpath, const char *keypath)
118 {
119 	BIGNUM		e;
120 	EVP_PKEY	*pkey;
121 	RSA		*rsa;
122 	X509		*x509;
123 	X509_NAME	*name;
124 	FILE		*f;
125 	const char	*org = "gmid";
126 
127 	log_notice(NULL,
128 	    "generating new certificate for %s (it could take a while)",
129 	    host);
130 
131 	if ((pkey = EVP_PKEY_new()) == NULL)
132                 fatal("couldn't create a new private key");
133 
134 	if ((rsa = RSA_new()) == NULL)
135 		fatal("could'nt generate rsa");
136 
137 	BN_init(&e);
138 	BN_set_word(&e, 17);
139 	if (!RSA_generate_key_ex(rsa, 4096, &e, NULL))
140 		fatal("couldn't generate a rsa key");
141 
142 	if (!EVP_PKEY_assign_RSA(pkey, rsa))
143 		fatal("couldn't assign the key");
144 
145 	if ((x509 = X509_new()) == NULL)
146 		fatal("couldn't generate the X509 certificate");
147 
148 	ASN1_INTEGER_set(X509_get_serialNumber(x509), 1);
149 	X509_gmtime_adj(X509_get_notBefore(x509), 0);
150 	X509_gmtime_adj(X509_get_notAfter(x509), 315360000L); /* 10 years */
151 
152 	if (!X509_set_pubkey(x509, pkey))
153 		fatal("couldn't set the public key");
154 
155 	name = X509_get_subject_name(x509);
156 	if (!X509_NAME_add_entry_by_txt(name, "O", MBSTRING_ASC, org, -1, -1, 0))
157 		fatal("couldn't add N to cert");
158 	if (!X509_NAME_add_entry_by_txt(name, "CN", MBSTRING_ASC, host, -1, -1, 0))
159 		fatal("couldn't add CN to cert");
160 	X509_set_issuer_name(x509, name);
161 
162 	if (!X509_sign(x509, pkey, EVP_sha256()))
163                 fatal("couldn't sign the certificate");
164 
165 	if ((f = fopen(keypath, "w")) == NULL)
166 		fatal("fopen(%s): %s", keypath, strerror(errno));
167 	if (!PEM_write_PrivateKey(f, pkey, NULL, NULL, 0, NULL, NULL))
168 		fatal("couldn't write private key");
169 	fclose(f);
170 
171 	if ((f = fopen(certpath, "w")) == NULL)
172 		fatal("fopen(%s): %s", certpath, strerror(errno));
173 	if (!PEM_write_X509(f, x509))
174 		fatal("couldn't write cert");
175 	fclose(f);
176 
177 	X509_free(x509);
178 	RSA_free(rsa);
179 }
180 
181 X509_STORE *
182 load_ca(const char *path)
183 {
184 	FILE		*f = NULL;
185 	X509		*x = NULL;
186 	X509_STORE	*store;
187 
188 	if ((store = X509_STORE_new()) == NULL)
189 		return NULL;
190 
191 	if ((f = fopen(path, "r")) == NULL)
192 		goto err;
193 
194 	if ((x = PEM_read_X509(f, NULL, NULL, NULL)) == NULL)
195 		goto err;
196 
197 	if (X509_check_ca(x) == 0)
198 		goto err;
199 
200 	if (!X509_STORE_add_cert(store, x))
201 		goto err;
202 
203 	X509_free(x);
204 	fclose(f);
205 	return store;
206 
207 err:
208 	X509_STORE_free(store);
209 	if (x != NULL)
210 		X509_free(x);
211 	if (f != NULL)
212 		fclose(f);
213 	return NULL;
214 }
215 
216 int
217 validate_against_ca(X509_STORE *ca, const uint8_t *chain, size_t len)
218 {
219 	X509		*client;
220 	BIO		*m;
221 	X509_STORE_CTX	*ctx = NULL;
222 	int		 ret = 0;
223 
224 	if ((m = BIO_new_mem_buf(chain, len)) == NULL)
225 		return 0;
226 
227 	if ((client = PEM_read_bio_X509(m, NULL, NULL, NULL)) == NULL)
228 		goto end;
229 
230 	if ((ctx = X509_STORE_CTX_new()) == NULL)
231 		goto end;
232 
233 	if (!X509_STORE_CTX_init(ctx, ca, client, NULL))
234 		goto end;
235 
236 	ret = X509_verify_cert(ctx);
237 	fprintf(stderr, "openssl x509_verify_cert: %d\n", ret);
238 
239 end:
240 	BIO_free(m);
241 	if (client != NULL)
242 		X509_free(client);
243 	if (ctx != NULL)
244 		X509_STORE_CTX_free(ctx);
245 	return ret;
246 }