ustream-openssl.c

   1 /*
   2  * ustream-ssl - library for SSL over ustream
   3  *
   4  * Copyright (C) 2012 Felix Fietkau <nbd@openwrt.org>
   5  *
   6  * Permission to use, copy, modify, and/or distribute this software for any
   7  * purpose with or without fee is hereby granted, provided that the above
   8  * copyright notice and this permission notice appear in all copies.
   9  *
  10  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
  11  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
  12  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
  13  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
  14  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  15  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  16  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  17  */
  18
  19 #include <string.h>
  20 #include <ctype.h>
  21 #include <openssl/x509v3.h>
  22 #include "ustream-ssl.h"
  23 #include "ustream-internal.h"
  24
  25 __hidden struct ustream_ssl_ctx *
  26 __ustream_ssl_context_new(bool server)
  27 {
  28         static bool _init = false;
  29         const void *m;
  30         SSL_CTX *c;
  31
  32         if (!_init) {
  33                 SSL_load_error_strings();
  34                 SSL_library_init();
  35                 _init = true;
  36         }
  37
  38 #ifdef CYASSL_OPENSSL_H_
  39         if (server)
  40                 m = SSLv23_server_method();
  41         else
  42                 m = SSLv23_client_method();
  43 #else
  44         if (server)
  45                 m = TLSv1_server_method();
  46         else
  47                 m = TLSv1_client_method();
  48 #endif
  49
  50         c = SSL_CTX_new((void *) m);
  51         if (!c)
  52                 return NULL;
  53
  54         SSL_CTX_set_verify(c, SSL_VERIFY_NONE, NULL);
  55
  56         return (void *) c;
  57 }
  58
  59 __hidden int __ustream_ssl_add_ca_crt_file(struct ustream_ssl_ctx *ctx, const char *file)
  60 {
  61         int ret;
  62
  63         ret = SSL_CTX_load_verify_locations((void *) ctx, file, NULL);
  64         if (ret < 1)
  65                 return -1;
  66
  67         return 0;
  68 }
  69
  70 __hidden int __ustream_ssl_set_crt_file(struct ustream_ssl_ctx *ctx, const char *file)
  71 {
  72         int ret;
  73
  74         ret = SSL_CTX_use_certificate_chain_file((void *) ctx, file);
  75         if (ret < 1)
  76                 ret = SSL_CTX_use_certificate_file((void *) ctx, file, SSL_FILETYPE_ASN1);
  77
  78         if (ret < 1)
  79                 return -1;
  80
  81         return 0;
  82 }
  83
  84 __hidden int __ustream_ssl_set_key_file(struct ustream_ssl_ctx *ctx, const char *file)
  85 {
  86         int ret;
  87
  88         ret = SSL_CTX_use_PrivateKey_file((void *) ctx, file, SSL_FILETYPE_PEM);
  89         if (ret < 1)
  90                 ret = SSL_CTX_use_PrivateKey_file((void *) ctx, file, SSL_FILETYPE_ASN1);
  91
  92         if (ret < 1)
  93                 return -1;
  94
  95         return 0;
  96 }
  97
  98 __hidden void __ustream_ssl_context_free(struct ustream_ssl_ctx *ctx)
  99 {
 100         SSL_CTX_free((void *) ctx);
 101 }
 102
 103 void __ustream_ssl_session_free(void *ssl)
 104 {
 105         SSL_shutdown(ssl);
 106         SSL_free(ssl);
 107 }
 108
 109 static void ustream_ssl_error(struct ustream_ssl *us, int ret)
 110 {
 111         us->error = ret;
 112         uloop_timeout_set(&us->error_timer, 0);
 113 }
 114
 115 #ifndef CYASSL_OPENSSL_H_
 116
 117 static bool host_pattern_match(const unsigned char *pattern, const char *cn)
 118 {
 119         char c;
 120
 121         for (; (c = tolower(*pattern++)) != 0; cn++) {
 122                 if (c != '*') {
 123                         if (c != *cn)
 124                                 return false;
 125                         continue;
 126                 }
 127
 128                 do {
 129                         c = tolower(*pattern++);
 130                 } while (c == '*');
 131
 132                 while (*cn) {
 133                         if (c == tolower(*cn) &&
 134                             host_pattern_match(pattern, cn))
 135                                 return true;
 136                         if (*cn == '.')
 137                                 return false;
 138                         cn++;
 139                 }
 140
 141                 return !c;
 142         }
 143         return !*cn;
 144 }
 145
 146 static bool host_pattern_match_asn1(ASN1_STRING *asn1, const char *cn)
 147 {
 148         unsigned char *pattern;
 149         bool ret = false;
 150
 151         if (ASN1_STRING_to_UTF8(&pattern, asn1) < 0)
 152                 return false;
 153
 154         if (!pattern)
 155                 return false;
 156
 157         if (strlen((char *) pattern) == ASN1_STRING_length(asn1))
 158                 ret = host_pattern_match(pattern, cn);
 159
 160         OPENSSL_free(pattern);
 161
 162         return ret;
 163 }
 164
 165 static bool ustream_ssl_verify_cn_alt(struct ustream_ssl *us, X509 *cert)
 166 {
 167         GENERAL_NAMES *alt_names;
 168         int i, n_alt;
 169         bool ret = false;
 170
 171         alt_names = X509_get_ext_d2i (cert, NID_subject_alt_name, NULL, NULL);
 172         if (!alt_names)
 173                 return false;
 174
 175         n_alt = sk_GENERAL_NAME_num(alt_names);
 176         for (i = 0; i < n_alt; i++) {
 177                 const GENERAL_NAME *name = sk_GENERAL_NAME_value(alt_names, i);
 178
 179                 if (!name)
 180                         continue;
 181
 182                 if (name->type != GEN_DNS)
 183                         continue;
 184
 185                 if (host_pattern_match_asn1(name->d.dNSName, us->peer_cn)) {
 186                         ret = true;
 187                         break;
 188                 }
 189         }
 190
 191         sk_GENERAL_NAME_free(alt_names);
 192         return ret;
 193 }
 194
 195 static bool ustream_ssl_verify_cn(struct ustream_ssl *us, X509 *cert)
 196 {
 197         ASN1_STRING *astr;
 198         X509_NAME *xname;
 199         int i, last;
 200
 201         if (!us->peer_cn)
 202                 return false;
 203
 204         if (ustream_ssl_verify_cn_alt(us, cert))
 205                 return true;
 206
 207         xname = X509_get_subject_name(cert);
 208
 209         last = -1;
 210         while (1) {
 211                 i = X509_NAME_get_index_by_NID(xname, NID_commonName, last);
 212                 if (i < 0)
 213                         break;
 214
 215                 last = i;
 216         }
 217
 218         if (last < 0)
 219                 return false;
 220
 221         astr = X509_NAME_ENTRY_get_data(X509_NAME_get_entry(xname, last));
 222
 223         return host_pattern_match_asn1(astr, us->peer_cn);
 224 }
 225
 226
 227 static void ustream_ssl_verify_cert(struct ustream_ssl *us)
 228 {
 229         void *ssl = us->ssl;
 230         X509 *cert;
 231         int res;
 232
 233         res = SSL_get_verify_result(ssl);
 234         if (res != X509_V_OK) {
 235                 if (us->notify_verify_error)
 236                         us->notify_verify_error(us, res, X509_verify_cert_error_string(res));
 237                 return;
 238         }
 239
 240         cert = SSL_get_peer_certificate(ssl);
 241         if (!cert)
 242                 return;
 243
 244         us->valid_cert = true;
 245         us->valid_cn = ustream_ssl_verify_cn(us, cert);
 246         X509_free(cert);
 247 }
 248
 249 #endif
 250
 251 __hidden enum ssl_conn_status __ustream_ssl_connect(struct ustream_ssl *us)
 252 {
 253         void *ssl = us->ssl;
 254         int r;
 255
 256         if (us->server)
 257                 r = SSL_accept(ssl);
 258         else
 259                 r = SSL_connect(ssl);
 260
 261         if (r == 1) {
 262 #ifndef CYASSL_OPENSSL_H_
 263                 ustream_ssl_verify_cert(us);
 264 #endif
 265                 return U_SSL_OK;
 266         }
 267
 268         r = SSL_get_error(ssl, r);
 269         if (r == SSL_ERROR_WANT_READ || r == SSL_ERROR_WANT_WRITE)
 270                 return U_SSL_PENDING;
 271
 272         ustream_ssl_error(us, r);
 273         return U_SSL_ERROR;
 274 }
 275
 276 __hidden int __ustream_ssl_write(struct ustream_ssl *us, const char *buf, int len)
 277 {
 278         void *ssl = us->ssl;
 279         int ret = SSL_write(ssl, buf, len);
 280
 281         if (ret < 0) {
 282                 int err = SSL_get_error(ssl, ret);
 283                 if (err == SSL_ERROR_WANT_WRITE)
 284                         return 0;
 285
 286                 ustream_ssl_error(us, err);
 287                 return -1;
 288         }
 289
 290         return ret;
 291 }
 292
 293 __hidden int __ustream_ssl_read(struct ustream_ssl *us, char *buf, int len)
 294 {
 295         int ret = SSL_read(us->ssl, buf, len);
 296
 297         if (ret < 0) {
 298                 ret = SSL_get_error(us->ssl, ret);
 299                 if (ret == SSL_ERROR_WANT_READ)
 300                         return U_SSL_PENDING;
 301
 302                 ustream_ssl_error(us, ret);
 303                 return U_SSL_ERROR;
 304         }
 305
 306         return ret;
 307 }
 308