2 * Copyright (c) 2021 Omar Polo <op@omarpolo.com>
4 * Permission to use, copy, modify, and distribute this software for any
5 * purpose with or without fee is hereby granted, provided that the above
6 * copyright notice and this permission notice appear in all copies.
8 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
22 #include <openssl/bn.h>
23 #include <openssl/pem.h>
24 #include <openssl/x509_vfy.h>
25 #include <openssl/x509v3.h>
35 sigaddset(&new, SIGHUP);
36 sigprocmask(SIG_BLOCK, &new, &set);
42 sigprocmask(SIG_SETMASK, &set, NULL);
46 starts_with(const char *str, const char *prefix)
53 for (i = 0; prefix[i] != '\0'; ++i)
54 if (str[i] != prefix[i])
60 ends_with(const char *str, const char *sufx)
71 for (j = 0; str[i] != '\0'; i++, j++)
72 if (str[i] != sufx[j])
82 if ((len = lseek(fd, 0, SEEK_END)) == -1)
84 if (lseek(fd, 0, SEEK_SET) == -1)
90 absolutify_path(const char *path)
95 if ((r = strdup(path)) == NULL)
100 wd = getcwd(NULL, 0);
101 if (asprintf(&r, "%s/%s", wd, path) == -1)
108 xstrdup(const char *s)
112 if ((d = strdup(s)) == NULL)
118 gen_certificate(const char *hostname, const char *certpath, const char *keypath)
126 const unsigned char *org = (const unsigned char*)"gmid";
127 const unsigned char *host = (const unsigned char*)hostname;
130 "generating new certificate for %s (it could take a while)",
133 if ((pkey = EVP_PKEY_new()) == NULL)
134 fatal("couldn't create a new private key");
136 if ((rsa = RSA_new()) == NULL)
137 fatal("couldn't generate rsa");
139 if ((e = BN_new()) == NULL)
140 fatal("couldn't allocate a bignum");
143 if (!RSA_generate_key_ex(rsa, 4096, e, NULL))
144 fatal("couldn't generate a rsa key");
146 if (!EVP_PKEY_assign_RSA(pkey, rsa))
147 fatal("couldn't assign the key");
149 if ((x509 = X509_new()) == NULL)
150 fatal("couldn't generate the X509 certificate");
152 ASN1_INTEGER_set(X509_get_serialNumber(x509), 1);
153 X509_gmtime_adj(X509_get_notBefore(x509), 0);
154 X509_gmtime_adj(X509_get_notAfter(x509), 315360000L); /* 10 years */
156 if (!X509_set_pubkey(x509, pkey))
157 fatal("couldn't set the public key");
159 name = X509_get_subject_name(x509);
160 if (!X509_NAME_add_entry_by_txt(name, "O", MBSTRING_ASC, org, -1, -1, 0))
161 fatal("couldn't add N to cert");
162 if (!X509_NAME_add_entry_by_txt(name, "CN", MBSTRING_ASC, host, -1, -1, 0))
163 fatal("couldn't add CN to cert");
164 X509_set_issuer_name(x509, name);
166 if (!X509_sign(x509, pkey, EVP_sha256()))
167 fatal("couldn't sign the certificate");
169 if ((f = fopen(keypath, "w")) == NULL)
170 fatal("fopen(%s): %s", keypath, strerror(errno));
171 if (!PEM_write_PrivateKey(f, pkey, NULL, NULL, 0, NULL, NULL))
172 fatal("couldn't write private key");
175 if ((f = fopen(certpath, "w")) == NULL)
176 fatal("fopen(%s): %s", certpath, strerror(errno));
177 if (!PEM_write_X509(f, x509))
178 fatal("couldn't write cert");
187 load_ca(const char *path)
193 if ((store = X509_STORE_new()) == NULL)
196 if ((f = fopen(path, "r")) == NULL)
199 if ((x = PEM_read_X509(f, NULL, NULL, NULL)) == NULL)
202 if (X509_check_ca(x) == 0)
205 if (!X509_STORE_add_cert(store, x))
213 X509_STORE_free(store);
222 validate_against_ca(X509_STORE *ca, const uint8_t *chain, size_t len)
226 X509_STORE_CTX *ctx = NULL;
229 if ((m = BIO_new_mem_buf(chain, len)) == NULL)
232 if ((client = PEM_read_bio_X509(m, NULL, NULL, NULL)) == NULL)
235 if ((ctx = X509_STORE_CTX_new()) == NULL)
238 if (!X509_STORE_CTX_init(ctx, ca, client, NULL))
241 ret = X509_verify_cert(ctx);
248 X509_STORE_CTX_free(ctx);