1 /*
2  * Copyright (c) 2021 Omar Polo <op@omarpolo.com>
3  *
4  * Permission to use, copy, modify, and distribute this software for any
5  * purpose with or without fee is hereby granted, provided that the above
6  * copyright notice and this permission notice appear in all copies.
7  *
8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15  */
16 
17 #include "gmid.h"
18 
19 #include <errno.h>
20 #include <string.h>
21 
22 #include <openssl/bn.h>
23 #include <openssl/pem.h>
24 #include <openssl/x509_vfy.h>
25 #include <openssl/x509v3.h>
26 
27 static sigset_t set;
28 
29 void
30 block_signals(void)
31 {
32 	sigset_t new;
33 
34 	sigemptyset(&new);
35 	sigaddset(&new, SIGHUP);
36 	sigprocmask(SIG_BLOCK, &new, &set);
37 }
38 
39 void
40 unblock_signals(void)
41 {
42 	sigprocmask(SIG_SETMASK, &set, NULL);
43 }
44 
45 int
46 starts_with(const char *str, const char *prefix)
47 {
48 	size_t i;
49 
50 	if (prefix == NULL)
51 		return 0;
52 
53 	for (i = 0; prefix[i] != '\0'; ++i)
54 		if (str[i] != prefix[i])
55 			return 0;
56 	return 1;
57 }
58 
59 int
60 ends_with(const char *str, const char *sufx)
61 {
62 	size_t i, j;
63 
64 	i = strlen(str);
65 	j = strlen(sufx);
66 
67 	if (j > i)
68 		return 0;
69 
70 	i -= j;
71 	for (j = 0; str[i] != '\0'; i++, j++)
72 		if (str[i] != sufx[j])
73 			return 0;
74 	return 1;
75 }
76 
77 ssize_t
78 filesize(int fd)
79 {
80 	ssize_t len;
81 
82 	if ((len = lseek(fd, 0, SEEK_END)) == -1)
83 		return -1;
84 	if (lseek(fd, 0, SEEK_SET) == -1)
85 		return -1;
86 	return len;
87 }
88 
89 char *
90 absolutify_path(const char *path)
91 {
92 	char *wd, *r;
93 
94 	if (*path == '/') {
95 		if ((r = strdup(path)) == NULL)
96 			err(1, "strdup");
97 		return r;
98 	}
99 
100 	wd = getcwd(NULL, 0);
101 	if (asprintf(&r, "%s/%s", wd, path) == -1)
102 		err(1, "asprintf");
103 	free(wd);
104 	return r;
105 }
106 
107 char *
108 xstrdup(const char *s)
109 {
110 	char *d;
111 
112 	if ((d = strdup(s)) == NULL)
113 		err(1, "strdup");
114 	return d;
115 }
116 
117 void
118 gen_certificate(const char *hostname, const char *certpath, const char *keypath)
119 {
120 	BIGNUM		*e;
121 	EVP_PKEY	*pkey;
122 	RSA		*rsa;
123 	X509		*x509;
124 	X509_NAME	*name;
125 	FILE		*f;
126 	const unsigned char *org = (const unsigned char*)"gmid";
127 	const unsigned char *host = (const unsigned char*)hostname;
128 
129 	log_notice(NULL,
130 	    "generating new certificate for %s (it could take a while)",
131 	    host);
132 
133 	if ((pkey = EVP_PKEY_new()) == NULL)
134                 fatal("couldn't create a new private key");
135 
136 	if ((rsa = RSA_new()) == NULL)
137 		fatal("couldn't generate rsa");
138 
139 	if ((e = BN_new()) == NULL)
140 		fatal("couldn't allocate a bignum");
141 
142 	BN_set_word(e, 17);
143 	if (!RSA_generate_key_ex(rsa, 4096, e, NULL))
144 		fatal("couldn't generate a rsa key");
145 
146 	if (!EVP_PKEY_assign_RSA(pkey, rsa))
147 		fatal("couldn't assign the key");
148 
149 	if ((x509 = X509_new()) == NULL)
150 		fatal("couldn't generate the X509 certificate");
151 
152 	ASN1_INTEGER_set(X509_get_serialNumber(x509), 1);
153 	X509_gmtime_adj(X509_get_notBefore(x509), 0);
154 	X509_gmtime_adj(X509_get_notAfter(x509), 315360000L); /* 10 years */
155 
156 	if (!X509_set_pubkey(x509, pkey))
157 		fatal("couldn't set the public key");
158 
159 	name = X509_get_subject_name(x509);
160 	if (!X509_NAME_add_entry_by_txt(name, "O", MBSTRING_ASC, org, -1, -1, 0))
161 		fatal("couldn't add N to cert");
162 	if (!X509_NAME_add_entry_by_txt(name, "CN", MBSTRING_ASC, host, -1, -1, 0))
163 		fatal("couldn't add CN to cert");
164 	X509_set_issuer_name(x509, name);
165 
166 	if (!X509_sign(x509, pkey, EVP_sha256()))
167                 fatal("couldn't sign the certificate");
168 
169 	if ((f = fopen(keypath, "w")) == NULL)
170 		fatal("fopen(%s): %s", keypath, strerror(errno));
171 	if (!PEM_write_PrivateKey(f, pkey, NULL, NULL, 0, NULL, NULL))
172 		fatal("couldn't write private key");
173 	fclose(f);
174 
175 	if ((f = fopen(certpath, "w")) == NULL)
176 		fatal("fopen(%s): %s", certpath, strerror(errno));
177 	if (!PEM_write_X509(f, x509))
178 		fatal("couldn't write cert");
179 	fclose(f);
180 
181 	BN_free(e);
182 	X509_free(x509);
183 	RSA_free(rsa);
184 }
185 
186 X509_STORE *
187 load_ca(const char *path)
188 {
189 	FILE		*f = NULL;
190 	X509		*x = NULL;
191 	X509_STORE	*store;
192 
193 	if ((store = X509_STORE_new()) == NULL)
194 		return NULL;
195 
196 	if ((f = fopen(path, "r")) == NULL)
197 		goto err;
198 
199 	if ((x = PEM_read_X509(f, NULL, NULL, NULL)) == NULL)
200 		goto err;
201 
202 	if (X509_check_ca(x) == 0)
203 		goto err;
204 
205 	if (!X509_STORE_add_cert(store, x))
206 		goto err;
207 
208 	X509_free(x);
209 	fclose(f);
210 	return store;
211 
212 err:
213 	X509_STORE_free(store);
214 	if (x != NULL)
215 		X509_free(x);
216 	if (f != NULL)
217 		fclose(f);
218 	return NULL;
219 }
220 
221 int
222 validate_against_ca(X509_STORE *ca, const uint8_t *chain, size_t len)
223 {
224 	X509		*client;
225 	BIO		*m;
226 	X509_STORE_CTX	*ctx = NULL;
227 	int		 ret = 0;
228 
229 	if ((m = BIO_new_mem_buf(chain, len)) == NULL)
230 		return 0;
231 
232 	if ((client = PEM_read_bio_X509(m, NULL, NULL, NULL)) == NULL)
233 		goto end;
234 
235 	if ((ctx = X509_STORE_CTX_new()) == NULL)
236 		goto end;
237 
238 	if (!X509_STORE_CTX_init(ctx, ca, client, NULL))
239 		goto end;
240 
241 	ret = X509_verify_cert(ctx);
242 	fprintf(stderr, "openssl x509_verify_cert: %d\n", ret);
243 
244 end:
245 	BIO_free(m);
246 	if (client != NULL)
247 		X509_free(client);
248 	if (ctx != NULL)
249 		X509_STORE_CTX_free(ctx);
250 	return ret;
251 }