2 * Copyright (c) 2021, 2023 Omar Polo <op@omarpolo.com>
3 * Copyright (c) 2008 Pierre-Yves Ritschard <pyr@openbsd.org>
4 * Copyright (c) 2008 Reyk Floeter <reyk@openbsd.org>
6 * Permission to use, copy, modify, and distribute this software for any
7 * purpose with or without fee is hereby granted, provided that the above
8 * copyright notice and this permission notice appear in all copies.
10 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
24 #include <openssl/bn.h>
25 #include <openssl/err.h>
26 #include <openssl/pem.h>
27 #include <openssl/x509_vfy.h>
28 #include <openssl/x509v3.h>
33 strip_path(const char *path, int strip)
38 if ((t = strchr(path, '/')) == NULL) {
39 path = strchr(path, '\0');
50 starts_with(const char *str, const char *prefix)
57 for (i = 0; prefix[i] != '\0'; ++i)
58 if (str[i] != prefix[i])
64 ends_with(const char *str, const char *sufx)
75 for (j = 0; str[i] != '\0'; i++, j++)
76 if (str[i] != sufx[j])
82 absolutify_path(const char *path)
87 if ((r = strdup(path)) == NULL)
93 if (asprintf(&r, "%s/%s", wd, path) == -1)
100 xstrdup(const char *s)
104 if ((d = strdup(s)) == NULL)
110 xcalloc(size_t nmemb, size_t size)
114 if ((d = calloc(nmemb, size)) == NULL)
120 gen_certificate(const char *hostname, const char *certpath, const char *keypath)
128 const unsigned char *host = (const unsigned char*)hostname;
130 log_info("generating new certificate for %s (it could take a while)",
133 if ((pkey = EVP_PKEY_new()) == NULL)
134 fatalx("couldn't create a new private key");
136 if ((rsa = RSA_new()) == NULL)
137 fatalx("couldn't generate rsa");
139 if ((e = BN_new()) == NULL)
140 fatalx("couldn't allocate a bignum");
142 BN_set_word(e, RSA_F4);
143 if (!RSA_generate_key_ex(rsa, 4096, e, NULL))
144 fatalx("couldn't generate a rsa key");
146 if (!EVP_PKEY_assign_RSA(pkey, rsa))
147 fatalx("couldn't assign the key");
149 if ((x509 = X509_new()) == NULL)
150 fatalx("couldn't generate the X509 certificate");
152 ASN1_INTEGER_set(X509_get_serialNumber(x509), 0);
153 X509_gmtime_adj(X509_get_notBefore(x509), 0);
154 X509_gmtime_adj(X509_get_notAfter(x509), 315360000L); /* 10 years */
155 X509_set_version(x509, 3);
157 if (!X509_set_pubkey(x509, pkey))
158 fatalx("couldn't set the public key");
160 name = X509_get_subject_name(x509);
161 if (!X509_NAME_add_entry_by_txt(name, "CN", MBSTRING_ASC, host, -1, -1, 0))
162 fatalx("couldn't add CN to cert");
163 X509_set_issuer_name(x509, name);
165 if (!X509_sign(x509, pkey, EVP_sha256()))
166 fatalx("couldn't sign the certificate");
168 if ((f = fopen(keypath, "w")) == NULL)
169 fatal("can't open %s", keypath);
170 if (!PEM_write_PrivateKey(f, pkey, NULL, NULL, 0, NULL, NULL))
171 fatalx("couldn't write private key");
174 if ((f = fopen(certpath, "w")) == NULL)
175 fatal("can't open %s", certpath);
176 if (!PEM_write_X509(f, x509))
177 fatalx("couldn't write cert");
184 log_info("certificate successfully generated");
188 load_ca(uint8_t *d, size_t len)
194 if ((store = X509_STORE_new()) == NULL) {
195 log_warnx("%s: X509_STORE_new failed", __func__);
199 if ((in = BIO_new_mem_buf(d, len)) == NULL) {
200 log_warnx("%s: BIO_new_mem_buf failed", __func__);
204 if ((x = PEM_read_bio_X509(in, NULL, NULL, NULL)) == NULL) {
205 log_warnx("%s: PEM_read_bio_X509 failed", __func__);
206 ssl_error("PEM_read_bio_X509");
210 if (X509_check_ca(x) == 0) {
211 ssl_error("X509_check_ca");
215 if (!X509_STORE_add_cert(store, x)) {
216 ssl_error("X509_STORE_add_cert");
225 X509_STORE_free(store);
234 validate_against_ca(X509_STORE *ca, const uint8_t *chain, size_t len)
238 X509_STORE_CTX *ctx = NULL;
241 if ((m = BIO_new_mem_buf(chain, len)) == NULL)
244 if ((client = PEM_read_bio_X509(m, NULL, NULL, NULL)) == NULL)
247 if ((ctx = X509_STORE_CTX_new()) == NULL)
250 if (!X509_STORE_CTX_init(ctx, ca, client, NULL))
253 ret = X509_verify_cert(ctx);
260 X509_STORE_CTX_free(ctx);
265 ssl_error(const char *where)
270 while ((code = ERR_get_error()) != 0) {
271 ERR_error_string_n(code, errbuf, sizeof(errbuf));
272 log_debug("debug: SSL library error: %s: %s", where, errbuf);
277 ssl_pubkey_hash(const uint8_t *buf, size_t len)
279 static const char hex[] = "0123456789abcdef";
284 unsigned char digest[EVP_MAX_MD_SIZE];
285 unsigned int dlen, i;
287 if ((in = BIO_new_mem_buf(buf, len)) == NULL) {
288 log_warnx("%s: BIO_new_mem_buf failed", __func__);
292 if ((x509 = PEM_read_bio_X509(in, NULL, NULL, NULL)) == NULL) {
293 log_warnx("%s: PEM_read_bio_X509 failed", __func__);
294 ssl_error("PEM_read_bio_X509");
298 if ((hash = malloc(TLS_CERT_HASH_SIZE)) == NULL) {
299 log_warn("%s: malloc", __func__);
303 if (X509_pubkey_digest(x509, EVP_sha256(), digest, &dlen) != 1) {
304 log_warnx("%s: X509_pubkey_digest failed", __func__);
305 ssl_error("X509_pubkey_digest");
311 if (TLS_CERT_HASH_SIZE < 2 * dlen + sizeof("SHA256:"))
312 fatalx("%s: hash buffer too small", __func__);
314 off = strlcpy(hash, "SHA256:", TLS_CERT_HASH_SIZE);
315 for (i = 0; i < dlen; ++i) {
316 hash[off++] = hex[(digest[i] >> 4) & 0xf];
317 hash[off++] = hex[digest[i] & 0xf];
329 ssl_load_pkey(const uint8_t *buf, size_t len)
334 if ((in = BIO_new_mem_buf(buf, len)) == NULL) {
335 log_warnx("%s: BIO_new_mem_buf failed", __func__);
339 if ((pkey = PEM_read_bio_PrivateKey(in, NULL, NULL, NULL)) == NULL) {
340 log_warnx("%s: PEM_read_bio_PrivateKey failed", __func__);
341 ssl_error("PEM_read_bio_PrivateKey");
353 h = xcalloc(1, sizeof(*h));
354 TAILQ_INIT(&h->addrs);
355 TAILQ_INIT(&h->locations);
356 TAILQ_INIT(&h->aliases);
357 TAILQ_INIT(&h->proxies);
366 l = xcalloc(1, sizeof(*l));
369 TAILQ_INIT(&l->params);
378 p = xcalloc(1, sizeof(*p));
379 p->protocols = TLS_PROTOCOLS_DEFAULT;