src/core/sipe-cert-crypto-openssl.c

   1 /**
   2  * @file sipe-cert-crypto-openssl.c
   3  *
   4  * pidgin-sipe
   5  *
   6  * Copyright (C) 2013-2017 SIPE Project <http://sipe.sourceforge.net/>
   7  *
   8  * This program is free software; you can redistribute it and/or modify
   9  * it under the terms of the GNU General Public License as published by
  10  * the Free Software Foundation; either version 2 of the License, or
  11  * (at your option) any later version.
  12  *
  13  * This program is distributed in the hope that it will be useful,
  14  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  15  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16  * GNU General Public License for more details.
  17  *
  18  * You should have received a copy of the GNU General Public License
  19  * along with this program; if not, write to the Free Software
  20  * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
  21  */
  22
  23 /**
  24  * Certificate routines implementation based on OpenSSL.
  25  */
  26
  27 #include <openssl/bn.h>
  28 #include <openssl/evp.h>
  29 #include <openssl/rsa.h>
  30 #include <openssl/x509.h>
  31
  32 #include <time.h>
  33
  34 #include <glib.h>
  35
  36 #include "sipe-backend.h"
  37 #include "sipe-cert-crypto.h"
  38
  39 struct sipe_cert_crypto {
  40         RSA *key;
  41 };
  42
  43 /*
  44  * This data structure is used in two different modes
  45  *
  46  *  a) certificate generated by the server from our Certificate Request
  47  *
  48  *     key              - reference to client RSA key, don't free!
  49  *     decoded          - certificate as OpenSSL data structure, must be freed
  50  *     raw              - certificate as DER encoded binary, must be freed
  51  *     length           - length of DER binary
  52  *
  53  *  b) server certificate
  54  *
  55  *     key              - reference to server public key, must be freed
  56  *     decoded          - certificate as OpenSSL data structure, must be freed
  57  *     raw              - NULL
  58  *     length           - modulus length of server public key
  59  */
  60 struct certificate_openssl {
  61         RSA *key;
  62         EVP_PKEY *public;
  63         X509 *decoded;
  64         guchar *raw;
  65         gsize length;
  66 };
  67
  68 struct sipe_cert_crypto *sipe_cert_crypto_init(void)
  69 {
  70         struct sipe_cert_crypto *scc = g_new0(struct sipe_cert_crypto, 1);
  71
  72         /* allocate memory for RSA key */
  73         scc->key = RSA_new();
  74         if (scc->key) {
  75                 BIGNUM *e = BN_new();
  76
  77                 if (e) {
  78                         /* RSA parameters - should those be configurable? */
  79                         if (BN_set_word(e, RSA_F4)) {
  80                                 SIPE_DEBUG_INFO_NOFORMAT("sipe_cert_crypto_init: generate key pair, this might take a while...");
  81                                 if (RSA_generate_key_ex(scc->key, 2048, e, NULL)) {
  82                                         SIPE_DEBUG_INFO_NOFORMAT("sipe_cert_crypto_init: key pair generated");
  83                                         BN_free(e);
  84                                         return(scc);
  85
  86                                 } else
  87                                         SIPE_DEBUG_ERROR_NOFORMAT("sipe_cert_crypto_init: key generation failed");
  88
  89                         } else
  90                                 SIPE_DEBUG_ERROR_NOFORMAT("sipe_cert_crypto_init: big number initialization failed");
  91
  92                         BN_free(e);
  93                 } else
  94                         SIPE_DEBUG_ERROR_NOFORMAT("sipe_cert_crypto_init: memory allocation for big number failed");
  95
  96         } else
  97                 SIPE_DEBUG_ERROR_NOFORMAT("sipe_cert_crypto_init: memory allocation for RSA key failed");
  98
  99         sipe_cert_crypto_free(scc);
 100         return(NULL);
 101 }
 102
 103 void sipe_cert_crypto_free(struct sipe_cert_crypto *scc)
 104 {
 105         if (scc) {
 106                 if (scc->key)
 107                         RSA_free(scc->key);
 108                 g_free(scc);
 109         }
 110 }
 111
 112
 113 gchar *sipe_cert_crypto_request(struct sipe_cert_crypto *scc,
 114                                 const gchar *subject)
 115 {
 116         gchar *base64 = NULL;
 117         EVP_PKEY *pkey;
 118
 119         if (!scc || !subject)
 120                 return(NULL);
 121
 122         if ((pkey = EVP_PKEY_new()) != NULL) {
 123                 X509_REQ *x509_req;
 124
 125                 if ((x509_req = X509_REQ_new()) != NULL) {
 126                         X509_NAME *name;
 127
 128                         EVP_PKEY_set1_RSA(pkey, scc->key);
 129
 130                         X509_REQ_set_version(x509_req, 2);
 131                         X509_REQ_set_pubkey(x509_req, pkey);
 132
 133                         name = X509_REQ_get_subject_name(x509_req);
 134                         X509_NAME_add_entry_by_txt(name,
 135                                                    "CN",
 136                                                    MBSTRING_ASC,
 137                                                    (guchar *) subject,
 138                                                    -1, -1, 0);
 139
 140                         if (X509_REQ_sign(x509_req, pkey, EVP_sha1())) {
 141                                 gsize length;
 142                                 guchar *buf, *tmp;
 143
 144                                 /*
 145                                  * Encode into DER format
 146                                  *
 147                                  * NOTE: i2d_X509(a, b) autoincrements b!
 148                                  */
 149                                 length = i2d_X509_REQ(x509_req, NULL);
 150                                 tmp = buf = g_malloc(length);
 151                                 i2d_X509_REQ(x509_req, &tmp);
 152
 153                                 base64 = g_base64_encode(buf, length);
 154                                 g_free(buf);
 155
 156                         } else {
 157                                 SIPE_DEBUG_ERROR_NOFORMAT("sipe_cert_crypto_request: can't sign certificate request");
 158                         }
 159
 160                         X509_REQ_free(x509_req);
 161                 } else {
 162                         SIPE_DEBUG_ERROR_NOFORMAT("sipe_cert_crypto_request: can't create x509 request data structure");
 163                 }
 164
 165                 EVP_PKEY_free(pkey);
 166         } else {
 167                 SIPE_DEBUG_ERROR_NOFORMAT("sipe_cert_crypto_request: can't create private key data structure");
 168         }
 169
 170         return(base64);
 171 }
 172
 173 void sipe_cert_crypto_destroy(gpointer certificate)
 174 {
 175         struct certificate_openssl *co = certificate;
 176
 177         if (co) {
 178                 /* imported server certificate - mode (b) */
 179                 if (!co->raw && co->key)
 180                         RSA_free(co->key);
 181                 if (co->decoded)
 182                         X509_free(co->decoded);
 183                 g_free(co->raw);
 184                 g_free(co);
 185         }
 186 }
 187
 188 /* generates certificate_openssl in mode (a) */
 189 gpointer sipe_cert_crypto_decode(struct sipe_cert_crypto *scc,
 190                                  const gchar *base64)
 191 {
 192         struct certificate_openssl *co = g_new0(struct certificate_openssl, 1);
 193         const guchar *tmp;
 194
 195         /* NOTE: d2i_X509(NULL, &in, len) autoincrements "in" */
 196         tmp = co->raw = g_base64_decode(base64, &co->length);
 197         co->decoded = d2i_X509(NULL, &tmp, co->length);
 198
 199         if (!co->decoded) {
 200                 sipe_cert_crypto_destroy(co);
 201                 return(NULL);
 202         }
 203
 204         co->key = scc->key;
 205
 206         return(co);
 207 }
 208
 209 /* generates certificate_openssl in mode (b) */
 210 gpointer sipe_cert_crypto_import(const guchar *raw,
 211                                  gsize length)
 212 {
 213         struct certificate_openssl *co = g_new0(struct certificate_openssl, 1);
 214         EVP_PKEY *pkey;
 215
 216         /* co->raw not needed as this is a server certificate */
 217         /* NOTE: d2i_X509(NULL, in, len) autoincrements "in" */
 218         co->decoded = d2i_X509(NULL, &raw, length);
 219
 220         if (!co->decoded) {
 221                 sipe_cert_crypto_destroy(co);
 222                 return(NULL);
 223         }
 224
 225         pkey = X509_get_pubkey(co->decoded);
 226
 227         if (!pkey) {
 228                 sipe_cert_crypto_destroy(co);
 229                 return(NULL);
 230         }
 231
 232         co->key    = EVP_PKEY_get1_RSA(pkey);
 233         co->length = EVP_PKEY_size(pkey);
 234         EVP_PKEY_free(pkey);
 235
 236         if (!co->key) {
 237                 sipe_cert_crypto_destroy(co);
 238                 return(NULL);
 239         }
 240
 241         return(co);
 242 }
 243
 244 gboolean sipe_cert_crypto_valid(gpointer certificate,
 245                                 guint offset)
 246 {
 247         struct certificate_openssl *co = certificate;
 248         time_t compare = time(NULL) + offset;
 249
 250         return(co &&
 251                (X509_cmp_time(X509_get_notAfter(co->decoded),
 252                               &compare) > 0));
 253 }
 254
 255 guint sipe_cert_crypto_expires(gpointer certificate)
 256 {
 257         struct certificate_openssl *co = certificate;
 258         guint min;
 259         guint max;
 260
 261         /* make sure certificate hasn't expired already */
 262         if (!sipe_cert_crypto_valid(co, 0))
 263                 return(0);
 264
 265         /*
 266          * I can't believe this, but it's true...
 267          *
 268          * OpenSSL doesn't have a public API to convert an ASN1_TIME
 269          * to seconds since epoch :-(
 270          *
 271          * @TODO: latest OpenSSL API has ASN1_TIME_diff()
 272          *
 273          * <30000 seconds (~8 hours) seems to be the most common expiration
 274          * value. Run a bisect to determine the real expiration value.
 275          */
 276         min = 0;
 277         max = 30000;
 278         while (1) {
 279                 guint offset = (max - min) / 2 + min;
 280
 281                 if (offset == min) {
 282                         break;
 283                 } else if (sipe_cert_crypto_valid(co, offset)) {
 284                         min = offset;
 285                 } else {
 286                         max = offset;
 287                 }
 288         }
 289
 290         return(min);
 291 }
 292
 293 gsize sipe_cert_crypto_raw_length(gpointer certificate)
 294 {
 295         return(((struct certificate_openssl *) certificate)->length);
 296 }
 297
 298 const guchar *sipe_cert_crypto_raw(gpointer certificate)
 299 {
 300         return(((struct certificate_openssl *) certificate)->raw);
 301 }
 302
 303 gpointer sipe_cert_crypto_public_key(gpointer certificate)
 304 {
 305         return(((struct certificate_openssl *) certificate)->key);
 306 }
 307
 308 gsize sipe_cert_crypto_modulus_length(gpointer certificate)
 309 {
 310         return(((struct certificate_openssl *) certificate)->length);
 311 }
 312
 313 gpointer sipe_cert_crypto_private_key(gpointer certificate)
 314 {
 315         return(((struct certificate_openssl *) certificate)->key);
 316 }
 317
 318 /* Create test certificate for internal key pair (ONLY USE FOR TEST CODE!!!) */
 319 gpointer sipe_cert_crypto_test_certificate(struct sipe_cert_crypto *scc)
 320 {
 321         struct certificate_openssl *co = NULL;
 322         EVP_PKEY *pkey;
 323
 324         if ((pkey = EVP_PKEY_new()) != NULL) {
 325                 X509 *x509;
 326
 327                 if ((x509 = X509_new()) != NULL) {
 328                         X509_NAME *name;
 329
 330                         EVP_PKEY_set1_RSA(pkey, scc->key);
 331
 332                         X509_set_version(x509, 2);
 333                         ASN1_INTEGER_set(X509_get_serialNumber(x509), 0);
 334                         X509_gmtime_adj(X509_get_notBefore(x509), 0);
 335                         X509_gmtime_adj(X509_get_notAfter(x509),  (long) 60*60*24);
 336                         X509_set_pubkey(x509, pkey);
 337
 338                         name = X509_get_subject_name(x509);
 339                         X509_NAME_add_entry_by_txt(name,
 340                                                    "CN",
 341                                                    MBSTRING_ASC,
 342                                                    (guchar *) "test@test.com",
 343                                                    -1, -1, 0);
 344                         X509_set_issuer_name(x509, name);
 345
 346                         if (X509_sign(x509, pkey, EVP_sha1())) {
 347                                 guchar *buf;
 348
 349                                 co = g_new0(struct certificate_openssl, 1);
 350                                 co->decoded = x509;
 351                                 co->key     = scc->key;
 352
 353                                 /*
 354                                  * Encode into DER format
 355                                  *
 356                                  * NOTE: i2d_X509(a, b) autoincrements b!
 357                                  */
 358                                 co->length = i2d_X509(x509, NULL);
 359                                 co->raw = buf = g_malloc(co->length);
 360                                 i2d_X509(x509, &buf);
 361
 362                         } else {
 363                                 SIPE_DEBUG_ERROR_NOFORMAT("sipe_cert_crypto_test_certificate: can't sign certificate");
 364                                 X509_free(x509);
 365                         }
 366                 } else {
 367                         SIPE_DEBUG_ERROR_NOFORMAT("sipe_cert_crypto_test_certificate: can't create x509 data structure");
 368                 }
 369
 370                 EVP_PKEY_free(pkey);
 371         } else {
 372                 SIPE_DEBUG_ERROR_NOFORMAT("sipe_cert_crypto_test_certificate: can't create private key data structure");
 373         }
 374
 375         return(co);
 376 }
 377
 378 /*
 379   Local Variables:
 380   mode: c
 381   c-file-style: "bsd"
 382   indent-tabs-mode: t
 383   tab-width: 8
 384   End:
 385 */