From 2003ef349df0e34850c9c5163ae98a8fe63d2898 Mon Sep 17 00:00:00 2001 From: Art Cancro Date: Mon, 1 Jan 2018 16:41:50 -0500 Subject: [PATCH] More work on using the OpenSSL 1.1 API --- citadel/configure.ac | 11 -- citadel/modules/crypto/serv_crypto.c | 165 +++++++++++++++------------ citadel/server.h | 1 + 3 files changed, 91 insertions(+), 86 deletions(-) diff --git a/citadel/configure.ac b/citadel/configure.ac index edf6a3c90..7e8135b97 100644 --- a/citadel/configure.ac +++ b/citadel/configure.ac @@ -136,17 +136,6 @@ AC_ARG_WITH(rundir, ) -dnl Checks for the Pseudo Random Generator sockets TODO: this keeps being default. -AC_DEFINE_UNQUOTED(EGD_POOL, "/var/run/egd-pool", [place to keep our pseudo random generator file]) -AC_ARG_WITH(egdpool, - [ --with-egdpool the socket from Pseudo Random Generator, defaults to /var/run/egd-pool], - [ if test "x$withval" != "xno" ; then - AC_DEFINE_UNQUOTED(EGD_POOL, "$withval", [the socket from Pseudo Random Generator]) - fi - ] -) - - AC_ARG_WITH(docdir, [ --with-docdir where to install the documentation. default: /usr/local/citadel/], [ if test "x$withval" != "xno" ; then diff --git a/citadel/modules/crypto/serv_crypto.c b/citadel/modules/crypto/serv_crypto.c index 37bcecba8..5830da909 100644 --- a/citadel/modules/crypto/serv_crypto.c +++ b/citadel/modules/crypto/serv_crypto.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 1987-2017 by the citadel.org team + * Copyright (c) 1987-2018 by the citadel.org team * * This program is open source software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 3. @@ -69,10 +69,66 @@ void destruct_ssl(void) free (SSLCritters); } + +void generate_key(char *keyfilename) +{ + int ret = 0; + RSA *rsa = NULL; + BIGNUM *bne = NULL; + int bits = 2048; + unsigned long e = RSA_F4; + FILE *fp; + + if (access(file_crpt_file_key, R_OK) == 0) { + return; + } + + syslog(LOG_INFO, "crypto: generating RSA key pair"); + + // generate rsa key + bne = BN_new(); + ret = BN_set_word(bne,e); + if (ret != 1) { + goto free_all; + } + + rsa = RSA_new(); + ret = RSA_generate_key_ex(rsa, bits, bne, NULL); + if (ret != 1) { + goto free_all; + } + + // write the key file + fp = fopen(keyfilename, "w"); + if (fp != NULL) { + chmod(file_crpt_file_key, 0600); + if (PEM_write_RSAPrivateKey(fp, /* the file */ + rsa, /* the key */ + NULL, /* no enc */ + NULL, /* no passphr */ + 0, /* no passphr */ + NULL, /* no callbk */ + NULL /* no callbk */ + ) != 1) { + syslog(LOG_ERR, "crypto: cannot write key: %s", ERR_reason_error_string(ERR_get_error())); + unlink(file_crpt_file_key); + } + fclose(fp); + } + + // 4. free +free_all: + RSA_free(rsa); + BN_free(bne); +} + + + + void init_ssl(void) { const SSL_METHOD *ssl_method; - RSA *rsa=NULL; + RSA *rsa = NULL; X509_REQ *req = NULL; X509 *cer = NULL; EVP_PKEY *pk = NULL; @@ -80,27 +136,18 @@ void init_ssl(void) X509_NAME *name = NULL; FILE *fp; - if (!access(EGD_POOL, F_OK)) - RAND_egd(EGD_POOL); - - if (!RAND_status()) { - syslog(LOG_ERR, "PRNG not adequately seeded, won't do SSL/TLS"); - return; - } SSLCritters = malloc(CRYPTO_num_locks() * sizeof(pthread_mutex_t *)); if (!SSLCritters) { - syslog(LOG_ERR, "citserver: can't allocate memory!!"); - /* Nothing's been initialized, just die */ - exit(1); + syslog(LOG_ERR, "crypto: can't allocate memory!"); + exit(CTDLEXIT_CRYPTO); } else { int a; for (a = 0; a < CRYPTO_num_locks(); a++) { SSLCritters[a] = malloc(sizeof(pthread_mutex_t)); if (!SSLCritters[a]) { - syslog(LOG_EMERG, "citserver: can't allocate memory!!"); - /* Nothing's been initialized, just die */ - exit(1); + syslog(LOG_ERR, "crypto: can't allocate memory!!"); + exit(CTDLEXIT_CRYPTO); } pthread_mutex_init(SSLCritters[a], NULL); } @@ -113,11 +160,11 @@ void init_ssl(void) SSL_load_error_strings(); ssl_method = SSLv23_server_method(); if (!(ssl_ctx = SSL_CTX_new(ssl_method))) { - syslog(LOG_ERR, "SSL_CTX_new failed: %s", ERR_reason_error_string(ERR_get_error())); + syslog(LOG_ERR, "crypto: SSL_CTX_new failed: %s", ERR_reason_error_string(ERR_get_error())); return; } if (!(SSL_CTX_set_cipher_list(ssl_ctx, CIT_CIPHERS))) { - syslog(LOG_ERR, "SSL: No ciphers available"); + syslog(LOG_ERR, "crypto: No ciphers available"); SSL_CTX_free(ssl_ctx); ssl_ctx = NULL; return; @@ -126,43 +173,8 @@ void init_ssl(void) CRYPTO_set_locking_callback(ssl_lock); CRYPTO_set_id_callback(id_callback); - /* Get our certificates in order. - * First, create the key/cert directory if it's not there already... - */ - mkdir(ctdl_key_dir, 0700); - - /* - * Generate a key pair if we don't have one. - */ - if (access(file_crpt_file_key, R_OK) != 0) { - syslog(LOG_INFO, "Generating RSA key pair."); - rsa = RSA_generate_key(1024, /* modulus size */ - 65537, /* exponent */ - NULL, /* no callback */ - NULL); /* no callback */ - if (rsa == NULL) { - syslog(LOG_ERR, "Key generation failed: %s", ERR_reason_error_string(ERR_get_error())); - } - if (rsa != NULL) { - fp = fopen(file_crpt_file_key, "w"); - if (fp != NULL) { - chmod(file_crpt_file_key, 0600); - if (PEM_write_RSAPrivateKey(fp, /* the file */ - rsa, /* the key */ - NULL, /* no enc */ - NULL, /* no passphr */ - 0, /* no passphr */ - NULL, /* no callbk */ - NULL /* no callbk */ - ) != 1) { - syslog(LOG_ERR, "Cannot write key: %s", ERR_reason_error_string(ERR_get_error())); - unlink(file_crpt_file_key); - } - fclose(fp); - } - RSA_free(rsa); - } - } + mkdir(ctdl_key_dir, 0700); // If the keys directory does not exist, create it + generate_key(file_crpt_file_key); // If a private key does not exist, create it /* * If there is no certificate file on disk, we will be generating a self-signed certificate @@ -170,7 +182,7 @@ void init_ssl(void) * the CSR in this step so that the next step may commence. */ if ( (access(file_crpt_file_cer, R_OK) != 0) && (access(file_crpt_file_csr, R_OK) != 0) ) { - syslog(LOG_INFO, "Generating a generic certificate signing request."); + syslog(LOG_INFO, "crypto: generating a generic certificate signing request."); /* * Read our key from the file. No, we don't just keep this @@ -208,7 +220,7 @@ void init_ssl(void) /* Sign the CSR */ if (!X509_REQ_sign(req, pk, EVP_md5())) { - syslog(LOG_ERR, "X509_REQ_sign(): error"); + syslog(LOG_ERR, "crypto: X509_REQ_sign(): error"); } else { /* Write it to disk. */ @@ -228,7 +240,7 @@ void init_ssl(void) } else { - syslog(LOG_ERR, "Unable to read private key."); + syslog(LOG_ERR, "crypto: unable to read private key."); } } @@ -237,7 +249,7 @@ void init_ssl(void) * Generate a self-signed certificate if we don't have one. */ if (access(file_crpt_file_cer, R_OK) != 0) { - syslog(LOG_INFO, "Generating a generic self-signed certificate."); + syslog(LOG_INFO, "crypto: generating a generic self-signed certificate."); /* Same deal as before: always read the key from disk because * it may or may not have just been generated. @@ -277,7 +289,7 @@ void init_ssl(void) /* Sign the cert */ if (!X509_sign(cer, pk, EVP_md5())) { - syslog(LOG_ERR, "X509_sign(): error"); + syslog(LOG_ERR, "crypto: X509_sign() error"); } else { /* Write it to disk. */ @@ -303,7 +315,7 @@ void init_ssl(void) SSL_CTX_use_certificate_chain_file(ssl_ctx, file_crpt_file_cer); SSL_CTX_use_PrivateKey_file(ssl_ctx, file_crpt_file_key, SSL_FILETYPE_PEM); if ( !SSL_CTX_check_private_key(ssl_ctx) ) { - syslog(LOG_ERR, "Cannot install certificate: %s", ERR_reason_error_string(ERR_get_error())); + syslog(LOG_ERR, "crypto: cannot install certificate: %s", ERR_reason_error_string(ERR_get_error())); } /* Finally let the server know we're here */ @@ -327,7 +339,7 @@ void client_write_ssl(const char *buf, int nbytes) while (nremain > 0) { if (SSL_want_write(CC->ssl)) { if ((SSL_read(CC->ssl, junk, 0)) < 1) { - syslog(LOG_DEBUG, "SSL_read in client_write: %s", ERR_reason_error_string(ERR_get_error())); + syslog(LOG_DEBUG, "crypto: SSL_read in client_write: %s", ERR_reason_error_string(ERR_get_error())); } } retval = @@ -341,9 +353,10 @@ void client_write_ssl(const char *buf, int nbytes) sleep(1); continue; } - syslog(LOG_DEBUG, "SSL_write got error %ld, ret %d", errval, retval); - if (retval == -1) - syslog(LOG_DEBUG, "errno is %d", errno); + syslog(LOG_DEBUG, "crypto: SSL_write got error %ld, ret %d", errval, retval); + if (retval == -1) { + syslog(LOG_DEBUG, "crypto: errno is %d", errno); + } endtls(); client_write(&buf[nbytes - nremain], nremain); return; @@ -368,7 +381,7 @@ int client_read_sslbuffer(StrBuf *buf, int timeout) while (1) { if (SSL_want_read(pssl)) { if ((SSL_write(pssl, junk, 0)) < 1) { - syslog(LOG_DEBUG, "SSL_write in client_read"); + syslog(LOG_DEBUG, "crypto: SSL_write in client_read"); } } rlen = SSL_read(pssl, sbuf, sizeof(sbuf)); @@ -380,7 +393,7 @@ int client_read_sslbuffer(StrBuf *buf, int timeout) sleep(1); continue; } - syslog(LOG_DEBUG, "SSL_read got error %ld", errval); + syslog(LOG_DEBUG, "crypto: SSL_read got error %ld", errval); endtls(); return (-1); } @@ -553,18 +566,19 @@ void CtdlStartTLS(char *ok_response, char *nosup_response, char *error_response) int retval, bits, alg_bits; if (!ssl_ctx) { - syslog(LOG_ERR, "SSL failed: no ssl_ctx exists?"); + syslog(LOG_ERR, "crypto: SSL failed: no ssl_ctx exists?"); if (nosup_response != NULL) cprintf("%s", nosup_response); return; } if (!(CC->ssl = SSL_new(ssl_ctx))) { - syslog(LOG_ERR, "SSL_new failed: %s", - ERR_reason_error_string(ERR_get_error())); - if (error_response != NULL) cprintf("%s", error_response); + syslog(LOG_ERR, "crypto: SSL_new failed: %s", ERR_reason_error_string(ERR_get_error())); + if (error_response != NULL) { + cprintf("%s", error_response); + } return; } if (!(SSL_set_fd(CC->ssl, CC->client_socket))) { - syslog(LOG_ERR, "SSL_set_fd failed: %s", ERR_reason_error_string(ERR_get_error())); + syslog(LOG_ERR, "crypto: SSL_set_fd failed: %s", ERR_reason_error_string(ERR_get_error())); SSL_free(CC->ssl); CC->ssl = NULL; if (error_response != NULL) cprintf("%s", error_response); @@ -582,7 +596,7 @@ void CtdlStartTLS(char *ok_response, char *nosup_response, char *error_response) char error_string[128]; errval = SSL_get_error(CC->ssl, retval); - syslog(LOG_ERR, "SSL_accept failed: retval=%d, errval=%ld, err=%s", + syslog(LOG_ERR, "crypto: SSL_accept failed: retval=%d, errval=%ld, err=%s", retval, errval, ERR_error_string(errval, error_string) @@ -593,10 +607,11 @@ void CtdlStartTLS(char *ok_response, char *nosup_response, char *error_response) } BIO_set_close(CC->ssl->rbio, BIO_NOCLOSE); bits = SSL_CIPHER_get_bits(SSL_get_current_cipher(CC->ssl), &alg_bits); - syslog(LOG_INFO, "SSL/TLS using %s on %s (%d of %d bits)", + syslog(LOG_INFO, "crypto: SSL/TLS using %s on %s (%d of %d bits)", SSL_CIPHER_get_name(SSL_get_current_cipher(CC->ssl)), SSL_CIPHER_get_version(SSL_get_current_cipher(CC->ssl)), - bits, alg_bits); + bits, alg_bits + ); CC->redirect_ssl = 1; } @@ -654,7 +669,7 @@ void endtls(void) return; } - syslog(LOG_INFO, "Ending SSL/TLS"); + syslog(LOG_INFO, "crypto: ending SSL/TLS"); SSL_shutdown(CC->ssl); SSL_free(CC->ssl); CC->ssl = NULL; diff --git a/citadel/server.h b/citadel/server.h index bfb5a2954..97be8d1b1 100644 --- a/citadel/server.h +++ b/citadel/server.h @@ -81,6 +81,7 @@ typedef struct __recptypes { #define CTDLEXIT_LIBCITADEL 106 /* Incorrect version of libcitadel */ #define CTDL_EXIT_UNSUP_AUTH 107 /* Unsupported auth mode configured */ #define CTDLEXIT_UNUSER 108 /* Could not determine uid to run as */ +#define CTDLEXIT_CRYPTO 109 /* Problem initializing SSL or TLS */ /* * Reasons why a session would be terminated (set CC->kill_me to these values) -- 2.30.2