1 /*
2  * Copyright (c) 2021, 2023 Omar Polo <op@omarpolo.com>
3  * Copyright (c) 2008 Pierre-Yves Ritschard <pyr@openbsd.org>
4  * Copyright (c) 2008 Reyk Floeter <reyk@openbsd.org>
5  *
6  * Permission to use, copy, modify, and distribute this software for any
7  * purpose with or without fee is hereby granted, provided that the above
8  * copyright notice and this permission notice appear in all copies.
9  *
10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
17  */
18 
19 #include "gmid.h"
20 
21 #include <errno.h>
22 #include <string.h>
23 
24 #include <openssl/bn.h>
25 #include <openssl/err.h>
26 #include <openssl/pem.h>
27 #include <openssl/x509_vfy.h>
28 #include <openssl/x509v3.h>
29 
30 #include "log.h"
31 
32 const char *
33 strip_path(const char *path, int strip)
34 {
35 	char *t;
36 
37 	while (strip > 0) {
38 		if ((t = strchr(path, '/')) == NULL) {
39 			path = strchr(path, '\0');
40 			break;
41 		}
42 		path = t;
43 		strip--;
44 	}
45 
46 	return path;
47 }
48 
49 int
50 ends_with(const char *str, const char *sufx)
51 {
52 	size_t i, j;
53 
54 	i = strlen(str);
55 	j = strlen(sufx);
56 
57 	if (j > i)
58 		return 0;
59 
60 	i -= j;
61 	for (j = 0; str[i] != '\0'; i++, j++)
62 		if (str[i] != sufx[j])
63 			return 0;
64 	return 1;
65 }
66 
67 char *
68 absolutify_path(const char *path)
69 {
70 	char *wd, *r;
71 
72 	if (*path == '/') {
73 		if ((r = strdup(path)) == NULL)
74 			fatal("strdup");
75 		return r;
76 	}
77 
78 	wd = getcwd(NULL, 0);
79 	if (asprintf(&r, "%s/%s", wd, path) == -1)
80 		fatal("asprintf");
81 	free(wd);
82 	return r;
83 }
84 
85 char *
86 xstrdup(const char *s)
87 {
88 	char *d;
89 
90 	if ((d = strdup(s)) == NULL)
91 		fatal("strdup");
92 	return d;
93 }
94 
95 void *
96 xcalloc(size_t nmemb, size_t size)
97 {
98 	void *d;
99 
100 	if ((d = calloc(nmemb, size)) == NULL)
101 		fatal("calloc");
102 	return d;
103 }
104 
105 void
106 gen_certificate(const char *hostname, const char *certpath, const char *keypath)
107 {
108 	BIGNUM		*e;
109 	EVP_PKEY	*pkey;
110 	RSA		*rsa;
111 	X509		*x509;
112 	X509_NAME	*name;
113 	FILE		*f;
114 	const unsigned char *host = (const unsigned char*)hostname;
115 
116 	log_info("generating new certificate for %s (it could take a while)",
117 	    host);
118 
119 	if ((pkey = EVP_PKEY_new()) == NULL)
120 		fatalx("couldn't create a new private key");
121 
122 	if ((rsa = RSA_new()) == NULL)
123 		fatalx("couldn't generate rsa");
124 
125 	if ((e = BN_new()) == NULL)
126 		fatalx("couldn't allocate a bignum");
127 
128 	BN_set_word(e, RSA_F4);
129 	if (!RSA_generate_key_ex(rsa, 4096, e, NULL))
130 		fatalx("couldn't generate a rsa key");
131 
132 	if (!EVP_PKEY_assign_RSA(pkey, rsa))
133 		fatalx("couldn't assign the key");
134 
135 	if ((x509 = X509_new()) == NULL)
136 		fatalx("couldn't generate the X509 certificate");
137 
138 	ASN1_INTEGER_set(X509_get_serialNumber(x509), 0);
139 	X509_gmtime_adj(X509_get_notBefore(x509), 0);
140 	X509_gmtime_adj(X509_get_notAfter(x509), 315360000L); /* 10 years */
141 	X509_set_version(x509, 3);
142 
143 	if (!X509_set_pubkey(x509, pkey))
144 		fatalx("couldn't set the public key");
145 
146 	name = X509_get_subject_name(x509);
147 	if (!X509_NAME_add_entry_by_txt(name, "CN", MBSTRING_ASC, host, -1, -1, 0))
148 		fatalx("couldn't add CN to cert");
149 	X509_set_issuer_name(x509, name);
150 
151 	if (!X509_sign(x509, pkey, EVP_sha256()))
152 		fatalx("couldn't sign the certificate");
153 
154 	if ((f = fopen(keypath, "w")) == NULL)
155 		fatal("can't open %s", keypath);
156 	if (!PEM_write_PrivateKey(f, pkey, NULL, NULL, 0, NULL, NULL))
157 		fatalx("couldn't write private key");
158 	fclose(f);
159 
160 	if ((f = fopen(certpath, "w")) == NULL)
161 		fatal("can't open %s", certpath);
162 	if (!PEM_write_X509(f, x509))
163 		fatalx("couldn't write cert");
164 	fclose(f);
165 
166 	BN_free(e);
167 	X509_free(x509);
168 	RSA_free(rsa);
169 
170 	log_info("certificate successfully generated");
171 }
172 
173 X509_STORE *
174 load_ca(uint8_t *d, size_t len)
175 {
176 	BIO		*in;
177 	X509		*x = NULL;
178 	X509_STORE	*store;
179 
180 	if ((store = X509_STORE_new()) == NULL) {
181 		log_warnx("%s: X509_STORE_new failed", __func__);
182 		return NULL;
183 	}
184 
185 	if ((in = BIO_new_mem_buf(d, len)) == NULL) {
186 		log_warnx("%s: BIO_new_mem_buf failed", __func__);
187 		goto err;
188 	}
189 
190 	if ((x = PEM_read_bio_X509(in, NULL, NULL, NULL)) == NULL) {
191 		log_warnx("%s: PEM_read_bio_X509 failed", __func__);
192 		ssl_error("PEM_read_bio_X509");
193 		goto err;
194 	}
195 
196 	if (X509_check_ca(x) == 0) {
197 		ssl_error("X509_check_ca");
198 		goto err;
199 	}
200 
201 	if (!X509_STORE_add_cert(store, x)) {
202 		ssl_error("X509_STORE_add_cert");
203 		goto err;
204 	}
205 
206 	X509_free(x);
207 	BIO_free(in);
208 	return store;
209 
210 err:
211 	X509_STORE_free(store);
212 	if (x != NULL)
213 		X509_free(x);
214 	if (in != NULL)
215 		BIO_free(in);
216 	return NULL;
217 }
218 
219 int
220 validate_against_ca(X509_STORE *ca, const uint8_t *chain, size_t len)
221 {
222 	X509		*client;
223 	BIO		*m;
224 	X509_STORE_CTX	*ctx = NULL;
225 	int		 ret = 0;
226 
227 	if ((m = BIO_new_mem_buf(chain, len)) == NULL)
228 		return 0;
229 
230 	if ((client = PEM_read_bio_X509(m, NULL, NULL, NULL)) == NULL)
231 		goto end;
232 
233 	if ((ctx = X509_STORE_CTX_new()) == NULL)
234 		goto end;
235 
236 	if (!X509_STORE_CTX_init(ctx, ca, client, NULL))
237 		goto end;
238 
239 	ret = X509_verify_cert(ctx);
240 
241 end:
242 	BIO_free(m);
243 	if (client != NULL)
244 		X509_free(client);
245 	if (ctx != NULL)
246 		X509_STORE_CTX_free(ctx);
247 	return ret;
248 }
249 
250 void
251 ssl_error(const char *where)
252 {
253 	unsigned long	 code;
254 	char		 errbuf[128];
255 
256 	while ((code = ERR_get_error()) != 0) {
257 		ERR_error_string_n(code, errbuf, sizeof(errbuf));
258 		log_debug("debug: SSL library error: %s: %s", where, errbuf);
259 	}
260 }
261 
262 char *
263 ssl_pubkey_hash(const uint8_t *buf, size_t len)
264 {
265 	static const char hex[] = "0123456789abcdef";
266 	BIO		*in;
267 	X509		*x509 = NULL;
268 	char		*hash = NULL;
269 	size_t		 off;
270 	unsigned char	 digest[EVP_MAX_MD_SIZE];
271 	unsigned int	 dlen, i;
272 
273 	if ((in = BIO_new_mem_buf(buf, len)) == NULL) {
274 		log_warnx("%s: BIO_new_mem_buf failed", __func__);
275 		return NULL;
276 	}
277 
278 	if ((x509 = PEM_read_bio_X509(in, NULL, NULL, NULL)) == NULL) {
279 		log_warnx("%s: PEM_read_bio_X509 failed", __func__);
280 		ssl_error("PEM_read_bio_X509");
281 		goto fail;
282 	}
283 
284 	if ((hash = malloc(TLS_CERT_HASH_SIZE)) == NULL) {
285 		log_warn("%s: malloc", __func__);
286 		goto fail;
287 	}
288 
289 	if (X509_pubkey_digest(x509, EVP_sha256(), digest, &dlen) != 1) {
290 		log_warnx("%s: X509_pubkey_digest failed", __func__);
291 		ssl_error("X509_pubkey_digest");
292 		free(hash);
293 		hash = NULL;
294 		goto fail;
295 	}
296 
297 	if (TLS_CERT_HASH_SIZE < 2 * dlen + sizeof("SHA256:"))
298 		fatalx("%s: hash buffer too small", __func__);
299 
300 	off = strlcpy(hash, "SHA256:", TLS_CERT_HASH_SIZE);
301 	for (i = 0; i < dlen; ++i) {
302 		hash[off++] = hex[(digest[i] >> 4) & 0xf];
303 		hash[off++] = hex[digest[i] & 0xf];
304 	}
305 	hash[off] = '\0';
306 
307  fail:
308 	BIO_free(in);
309 	if (x509)
310 		X509_free(x509);
311 	return hash;
312 }
313 
314 EVP_PKEY *
315 ssl_load_pkey(const uint8_t *buf, size_t len)
316 {
317 	BIO		*in;
318 	EVP_PKEY	*pkey;
319 
320 	if ((in = BIO_new_mem_buf(buf, len)) == NULL) {
321 		log_warnx("%s: BIO_new_mem_buf failed", __func__);
322 		return NULL;
323 	}
324 
325 	if ((pkey = PEM_read_bio_PrivateKey(in, NULL, NULL, NULL)) == NULL) {
326 		log_warnx("%s: PEM_read_bio_PrivateKey failed", __func__);
327 		ssl_error("PEM_read_bio_PrivateKey");
328 	}
329 
330 	BIO_free(in);
331 	return pkey;
332 }
333 
334 struct vhost *
335 new_vhost(void)
336 {
337 	struct vhost *h;
338 
339 	h = xcalloc(1, sizeof(*h));
340 	TAILQ_INIT(&h->addrs);
341 	TAILQ_INIT(&h->locations);
342 	TAILQ_INIT(&h->aliases);
343 	TAILQ_INIT(&h->proxies);
344 	return h;
345 }
346 
347 struct location *
348 new_location(void)
349 {
350 	struct location *l;
351 
352 	l = xcalloc(1, sizeof(*l));
353 	l->dirfd = -1;
354 	l->fcgi = -1;
355 	TAILQ_INIT(&l->params);
356 	return l;
357 }
358 
359 struct proxy *
360 new_proxy(void)
361 {
362 	struct proxy *p;
363 
364 	p = xcalloc(1, sizeof(*p));
365 	p->protocols = TLS_PROTOCOLS_DEFAULT;
366 	return p;
367 }