1 /*
2  * Copyright (c) 2021 Omar Polo <op@omarpolo.com>
3  *
4  * Permission to use, copy, modify, and distribute this software for any
5  * purpose with or without fee is hereby granted, provided that the above
6  * copyright notice and this permission notice appear in all copies.
7  *
8  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
9  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
10  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
11  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
12  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
13  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
14  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
15  */
16 
17 #include "gmid.h"
18 
19 #include <errno.h>
20 #include <string.h>
21 
22 #include <openssl/bn.h>
23 #include <openssl/pem.h>
24 #include <openssl/x509_vfy.h>
25 #include <openssl/x509v3.h>
26 
27 #include "log.h"
28 
29 int
30 starts_with(const char *str, const char *prefix)
31 {
32 	size_t i;
33 
34 	if (prefix == NULL)
35 		return 0;
36 
37 	for (i = 0; prefix[i] != '\0'; ++i)
38 		if (str[i] != prefix[i])
39 			return 0;
40 	return 1;
41 }
42 
43 int
44 ends_with(const char *str, const char *sufx)
45 {
46 	size_t i, j;
47 
48 	i = strlen(str);
49 	j = strlen(sufx);
50 
51 	if (j > i)
52 		return 0;
53 
54 	i -= j;
55 	for (j = 0; str[i] != '\0'; i++, j++)
56 		if (str[i] != sufx[j])
57 			return 0;
58 	return 1;
59 }
60 
61 ssize_t
62 filesize(int fd)
63 {
64 	ssize_t len;
65 
66 	if ((len = lseek(fd, 0, SEEK_END)) == -1)
67 		return -1;
68 	if (lseek(fd, 0, SEEK_SET) == -1)
69 		return -1;
70 	return len;
71 }
72 
73 char *
74 absolutify_path(const char *path)
75 {
76 	char *wd, *r;
77 
78 	if (*path == '/') {
79 		if ((r = strdup(path)) == NULL)
80 			err(1, "strdup");
81 		return r;
82 	}
83 
84 	wd = getcwd(NULL, 0);
85 	if (asprintf(&r, "%s/%s", wd, path) == -1)
86 		err(1, "asprintf");
87 	free(wd);
88 	return r;
89 }
90 
91 char *
92 xstrdup(const char *s)
93 {
94 	char *d;
95 
96 	if ((d = strdup(s)) == NULL)
97 		err(1, "strdup");
98 	return d;
99 }
100 
101 void *
102 xcalloc(size_t nmemb, size_t size)
103 {
104 	void *d;
105 
106 	if ((d = calloc(nmemb, size)) == NULL)
107 		err(1, "calloc");
108 	return d;
109 }
110 
111 void
112 gen_certificate(const char *hostname, const char *certpath, const char *keypath)
113 {
114 	BIGNUM		*e;
115 	EVP_PKEY	*pkey;
116 	RSA		*rsa;
117 	X509		*x509;
118 	X509_NAME	*name;
119 	FILE		*f;
120 	const unsigned char *host = (const unsigned char*)hostname;
121 
122 	log_notice(NULL,
123 	    "generating new certificate for %s (it could take a while)",
124 	    host);
125 
126 	if ((pkey = EVP_PKEY_new()) == NULL)
127 		fatalx("couldn't create a new private key");
128 
129 	if ((rsa = RSA_new()) == NULL)
130 		fatalx("couldn't generate rsa");
131 
132 	if ((e = BN_new()) == NULL)
133 		fatalx("couldn't allocate a bignum");
134 
135 	BN_set_word(e, RSA_F4);
136 	if (!RSA_generate_key_ex(rsa, 4096, e, NULL))
137 		fatalx("couldn't generate a rsa key");
138 
139 	if (!EVP_PKEY_assign_RSA(pkey, rsa))
140 		fatalx("couldn't assign the key");
141 
142 	if ((x509 = X509_new()) == NULL)
143 		fatalx("couldn't generate the X509 certificate");
144 
145 	ASN1_INTEGER_set(X509_get_serialNumber(x509), 0);
146 	X509_gmtime_adj(X509_get_notBefore(x509), 0);
147 	X509_gmtime_adj(X509_get_notAfter(x509), 315360000L); /* 10 years */
148 	X509_set_version(x509, 3);
149 
150 	if (!X509_set_pubkey(x509, pkey))
151 		fatalx("couldn't set the public key");
152 
153 	name = X509_get_subject_name(x509);
154 	if (!X509_NAME_add_entry_by_txt(name, "CN", MBSTRING_ASC, host, -1, -1, 0))
155 		fatalx("couldn't add CN to cert");
156 	X509_set_issuer_name(x509, name);
157 
158 	if (!X509_sign(x509, pkey, EVP_sha256()))
159 		fatalx("couldn't sign the certificate");
160 
161 	if ((f = fopen(keypath, "w")) == NULL)
162 		fatal("can't open %s", keypath);
163 	if (!PEM_write_PrivateKey(f, pkey, NULL, NULL, 0, NULL, NULL))
164 		fatalx("couldn't write private key");
165 	fclose(f);
166 
167 	if ((f = fopen(certpath, "w")) == NULL)
168 		fatal("can't open %s", certpath);
169 	if (!PEM_write_X509(f, x509))
170 		fatalx("couldn't write cert");
171 	fclose(f);
172 
173 	BN_free(e);
174 	X509_free(x509);
175 	RSA_free(rsa);
176 
177 	log_notice(NULL, "certificate successfully generated");
178 }
179 
180 X509_STORE *
181 load_ca(const char *path)
182 {
183 	FILE		*f = NULL;
184 	X509		*x = NULL;
185 	X509_STORE	*store;
186 
187 	if ((store = X509_STORE_new()) == NULL)
188 		return NULL;
189 
190 	if ((f = fopen(path, "r")) == NULL)
191 		goto err;
192 
193 	if ((x = PEM_read_X509(f, NULL, NULL, NULL)) == NULL)
194 		goto err;
195 
196 	if (X509_check_ca(x) == 0)
197 		goto err;
198 
199 	if (!X509_STORE_add_cert(store, x))
200 		goto err;
201 
202 	X509_free(x);
203 	fclose(f);
204 	return store;
205 
206 err:
207 	X509_STORE_free(store);
208 	if (x != NULL)
209 		X509_free(x);
210 	if (f != NULL)
211 		fclose(f);
212 	return NULL;
213 }
214 
215 int
216 validate_against_ca(X509_STORE *ca, const uint8_t *chain, size_t len)
217 {
218 	X509		*client;
219 	BIO		*m;
220 	X509_STORE_CTX	*ctx = NULL;
221 	int		 ret = 0;
222 
223 	if ((m = BIO_new_mem_buf(chain, len)) == NULL)
224 		return 0;
225 
226 	if ((client = PEM_read_bio_X509(m, NULL, NULL, NULL)) == NULL)
227 		goto end;
228 
229 	if ((ctx = X509_STORE_CTX_new()) == NULL)
230 		goto end;
231 
232 	if (!X509_STORE_CTX_init(ctx, ca, client, NULL))
233 		goto end;
234 
235 	ret = X509_verify_cert(ctx);
236 
237 end:
238 	BIO_free(m);
239 	if (client != NULL)
240 		X509_free(client);
241 	if (ctx != NULL)
242 		X509_STORE_CTX_free(ctx);
243 	return ret;
244 }
245 
246 void
247 dispatch_imsg(struct imsgbuf *ibuf, imsg_handlerfn **handlers, size_t size)
248 {
249 	struct imsg	imsg;
250 	size_t		datalen, i;
251 	ssize_t		n;
252 
253 	if ((n = imsg_read(ibuf)) == -1) {
254 		if (errno == EAGAIN || errno == EWOULDBLOCK)
255 			return;
256 		_exit(1);
257 	}
258 
259 	if (n == 0)
260 		_exit(1);
261 
262 	for (;;) {
263 		if ((n = imsg_get(ibuf, &imsg)) == -1)
264 			_exit(1);
265 		if (n == 0)
266 			return;
267 		datalen = imsg.hdr.len - IMSG_HEADER_SIZE;
268 		i = imsg.hdr.type;
269 		if (i > (size / sizeof(imsg_handlerfn*)) || handlers[i] == NULL)
270 			abort();
271 		handlers[i](ibuf, &imsg, datalen);
272 		imsg_free(&imsg);
273 	}
274 }