X-Git-Url: https://code.citadel.org/?a=blobdiff_plain;f=webcit-ng%2Fssl.c;h=abc1e0ec7e7bd2345c5578a250eea0e34e5df5e4;hb=fd396aeb6d3e10be928dd899ae228147b1728fb3;hp=81764a2526653574781964116a7cc06afaf9fbfe;hpb=1de34ae393d0f8bf9c1fb9131765ee50449f4806;p=citadel.git diff --git a/webcit-ng/ssl.c b/webcit-ng/ssl.c index 81764a252..abc1e0ec7 100644 --- a/webcit-ng/ssl.c +++ b/webcit-ng/ssl.c @@ -1,17 +1,18 @@ -/* - * Functions in this module handle SSL encryption when WebCit is running - * as an HTTPS server. - * - * Copyright (c) 1996-2016 by the citadel.org team - * - * This program is open source software. You can redistribute it and/or - * modify it under the terms of the GNU General Public License, version 3. - * - * This program is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the - * GNU General Public License for more details. - */ +// +// Functions in this module handle SSL encryption when WebCit is running +// as an HTTPS server. +// +// Copyright (c) 1996-2018 by the citadel.org team +// +// This program is open source software. It runs great on the +// Linux operating system (and probably elsewhere). You can use, +// copy, and run it under the terms of the GNU General Public +// License version 3. +// +// This program is distributed in the hope that it will be useful, +// but WITHOUT ANY WARRANTY; without even the implied warranty of +// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the +// GNU General Public License for more details. #include "webcit.h" @@ -39,20 +40,73 @@ void ssl_lock(int mode, int n, const char *file, int line) { if (mode & CRYPTO_LOCK) { pthread_mutex_lock(SSLCritters[n]); - } - else { + } else { pthread_mutex_unlock(SSLCritters[n]); } } +/* + * Generate a private key for SSL + */ +void generate_key(char *keyfilename) +{ + int ret = 0; + RSA *rsa = NULL; + BIGNUM *bne = NULL; + int bits = 2048; + unsigned long e = RSA_F4; + FILE *fp; + + if (access(keyfilename, R_OK) == 0) { + return; + } + + syslog(LOG_INFO, "crypto: generating RSA key pair"); + + // generate rsa key + bne = BN_new(); + ret = BN_set_word(bne, e); + if (ret != 1) { + goto free_all; + } + + rsa = RSA_new(); + ret = RSA_generate_key_ex(rsa, bits, bne, NULL); + if (ret != 1) { + goto free_all; + } + // write the key file + fp = fopen(keyfilename, "w"); + if (fp != NULL) { + chmod(keyfilename, 0600); + if (PEM_write_RSAPrivateKey(fp, /* the file */ + rsa, /* the key */ + NULL, /* no enc */ + NULL, /* no passphr */ + 0, /* no passphr */ + NULL, /* no callbk */ + NULL /* no callbk */ + ) != 1) { + syslog(LOG_ERR, "crypto: cannot write key: %s", ERR_reason_error_string(ERR_get_error())); + unlink(keyfilename); + } + fclose(fp); + } + // 4. free + free_all: + RSA_free(rsa); + BN_free(bne); +} + + /* * Initialize ssl engine, load certs and initialize openssl internals */ void init_ssl(void) { const SSL_METHOD *ssl_method; - RSA *rsa=NULL; + RSA *rsa = NULL; X509_REQ *req = NULL; X509 *cer = NULL; EVP_PKEY *pk = NULL; @@ -62,22 +116,12 @@ void init_ssl(void) char buf[SIZ]; int rv = 0; - if (!access("/var/run/egd-pool", F_OK)) { - RAND_egd("/var/run/egd-pool"); - } - - if (!RAND_status()) { - syslog(LOG_WARNING, "PRNG not adequately seeded, won't do SSL/TLS"); - return; - } - SSLCritters = malloc(CRYPTO_num_locks() * sizeof(pthread_mutex_t *)); if (!SSLCritters) { syslog(LOG_ERR, "citserver: can't allocate memory!!"); exit(1); } else { int a; - for (a = 0; a < CRYPTO_num_locks(); a++) { SSLCritters[a] = malloc(sizeof(pthread_mutex_t)); if (!SSLCritters[a]) { @@ -117,47 +161,14 @@ void init_ssl(void) /* * If we still don't have a private key, generate one. */ - if (access(CTDL_KEY_PATH, R_OK) != 0) { - syslog(LOG_INFO, "Generating RSA key pair.\n"); - rsa = RSA_generate_key(2048, /* modulus size */ - 65537, /* exponent */ - NULL, /* no callback */ - NULL /* no callback */ - ); - if (rsa == NULL) { - syslog(LOG_WARNING, "Key generation failed: %s", ERR_reason_error_string(ERR_get_error())); - } - if (rsa != NULL) { - fp = fopen(CTDL_KEY_PATH, "w"); - if (fp != NULL) { - chmod(CTDL_KEY_PATH, 0600); - if (PEM_write_RSAPrivateKey(fp, /* the file */ - rsa, /* the key */ - NULL, /* no enc */ - NULL, /* no passphr */ - 0, /* no passphr */ - NULL, /* no callbk */ - NULL /* no callbk */ - ) != 1) { - syslog(LOG_WARNING, "Cannot write key: %s", ERR_reason_error_string(ERR_get_error())); - unlink(CTDL_KEY_PATH); - } - fclose(fp); - } - else { - syslog(LOG_WARNING, "Cannot write key: %s", CTDL_KEY_PATH); - exit(1); - } - RSA_free(rsa); - } - } + generate_key(CTDL_KEY_PATH); /* * If there is no certificate file on disk, we will be generating a self-signed certificate * in the next step. Therefore, if we have neither a CSR nor a certificate, generate * the CSR in this step so that the next step may commence. */ - if ( (access(CTDL_CER_PATH, R_OK) != 0) && (access(CTDL_CSR_PATH, R_OK) != 0) ) { + if ((access(CTDL_CER_PATH, R_OK) != 0) && (access(CTDL_CSR_PATH, R_OK) != 0)) { syslog(LOG_INFO, "Generating a certificate signing request."); /* @@ -173,9 +184,8 @@ void init_ssl(void) } if (rsa) { - /* Create a public key from the private key */ - if (pk=EVP_PKEY_new(), pk != NULL) { + if (pk = EVP_PKEY_new(), pk != NULL) { EVP_PKEY_assign_RSA(pk, rsa); if (req = X509_REQ_new(), req != NULL) { const char *env; @@ -183,56 +193,39 @@ void init_ssl(void) X509_REQ_set_pubkey(req, pk); X509_REQ_set_version(req, 0L); name = X509_REQ_get_subject_name(req); - X509_NAME_add_entry_by_txt( - name, "O", MBSTRING_ASC, - (unsigned char*)"Citadel Server", - -1, -1, 0 - ); - X509_NAME_add_entry_by_txt( - name, "OU", MBSTRING_ASC, - (unsigned char*)"Default Certificate PLEASE CHANGE", - -1, -1, 0 - ); - X509_NAME_add_entry_by_txt( - name, "CN", - MBSTRING_ASC, - (unsigned char*)"*", - -1, -1, 0 - ); - + X509_NAME_add_entry_by_txt(name, "O", MBSTRING_ASC, + (unsigned char *) "Citadel Server", -1, -1, 0); + X509_NAME_add_entry_by_txt(name, "OU", MBSTRING_ASC, + (unsigned char *) "Default Certificate PLEASE CHANGE", + -1, -1, 0); + X509_NAME_add_entry_by_txt(name, "CN", MBSTRING_ASC, (unsigned char *) "*", -1, -1, 0); + X509_REQ_set_subject_name(req, name); /* Sign the CSR */ if (!X509_REQ_sign(req, pk, EVP_md5())) { syslog(LOG_WARNING, "X509_REQ_sign(): error"); - } - else { - /* Write it to disk. */ + } else { + /* Write it to disk. */ fp = fopen(CTDL_CSR_PATH, "w"); if (fp != NULL) { chmod(CTDL_CSR_PATH, 0600); PEM_write_X509_REQ(fp, req); fclose(fp); - } - else { + } else { syslog(LOG_WARNING, "Cannot write key: %s", CTDL_CSR_PATH); exit(1); } } - X509_REQ_free(req); } } - RSA_free(rsa); - } - - else { + } else { syslog(LOG_WARNING, "Unable to read private key."); } } - /* * Generate a self-signed certificate if we don't have one. */ @@ -253,7 +246,7 @@ void init_ssl(void) cer = NULL; pk = NULL; if (rsa) { - if (pk=EVP_PKEY_new(), pk != NULL) { + if (pk = EVP_PKEY_new(), pk != NULL) { EVP_PKEY_assign_RSA(pk, rsa); } @@ -265,30 +258,26 @@ void init_ssl(void) if (req) { if (cer = X509_new(), cer != NULL) { - ASN1_INTEGER_set(X509_get_serialNumber(cer), 0); - X509_set_issuer_name(cer, req->req_info->subject); - X509_set_subject_name(cer, req->req_info->subject); + X509_set_issuer_name(cer, X509_REQ_get_subject_name(req)); + X509_set_subject_name(cer, X509_REQ_get_subject_name(req)); X509_gmtime_adj(X509_get_notBefore(cer), 0); - X509_gmtime_adj(X509_get_notAfter(cer),(long)60*60*24*SIGN_DAYS); + X509_gmtime_adj(X509_get_notAfter(cer), (long) 60 * 60 * 24 * SIGN_DAYS); req_pkey = X509_REQ_get_pubkey(req); X509_set_pubkey(cer, req_pkey); EVP_PKEY_free(req_pkey); - + /* Sign the cert */ if (!X509_sign(cer, pk, EVP_md5())) { syslog(LOG_WARNING, "X509_sign(): error"); - } - else { - /* Write it to disk. */ + } else { /* Write it to disk. */ fp = fopen(CTDL_CER_PATH, "w"); if (fp != NULL) { chmod(CTDL_CER_PATH, 0600); PEM_write_X509(fp, cer); fclose(fp); - } - else { + } else { syslog(LOG_WARNING, "Cannot write key: %s", CTDL_CER_PATH); exit(1); } @@ -296,7 +285,6 @@ void init_ssl(void) X509_free(cer); } } - RSA_free(rsa); } } @@ -308,17 +296,18 @@ void init_ssl(void) */ SSL_CTX_use_certificate_chain_file(ssl_ctx, CTDL_CER_PATH); SSL_CTX_use_PrivateKey_file(ssl_ctx, CTDL_KEY_PATH, SSL_FILETYPE_PEM); - if ( !SSL_CTX_check_private_key(ssl_ctx) ) { + if (!SSL_CTX_check_private_key(ssl_ctx)) { syslog(LOG_WARNING, "Cannot install certificate: %s", ERR_reason_error_string(ERR_get_error())); } - + } /* * starts SSL/TLS encryption for the current session. */ -void starttls(struct client_handle *ch) { +void starttls(struct client_handle *ch) +{ int retval, bits, alg_bits; if (!ssl_ctx) { @@ -342,8 +331,7 @@ void starttls(struct client_handle *ch) { ssl_error_reason = ERR_reason_error_string(ERR_get_error()); if (ssl_error_reason == NULL) { syslog(LOG_WARNING, "SSL_accept failed: errval=%ld, retval=%d %s", errval, retval, strerror(errval)); - } - else { + } else { syslog(LOG_WARNING, "SSL_accept failed: %s\n", ssl_error_reason); } sleep(1); @@ -357,23 +345,19 @@ void starttls(struct client_handle *ch) { ssl_error_reason = ERR_reason_error_string(ERR_get_error()); if (ssl_error_reason == NULL) { syslog(LOG_WARNING, "SSL_accept failed: errval=%ld, retval=%d (%s)", errval, retval, strerror(errval)); - } - else { + } else { syslog(LOG_WARNING, "SSL_accept failed: %s", ssl_error_reason); } SSL_free(ch->ssl_handle); ch->ssl_handle = NULL; return; - } - else { + } else { syslog(LOG_INFO, "SSL_accept success"); } - BIO_set_close(ch->ssl_handle->rbio, BIO_NOCLOSE); bits = SSL_CIPHER_get_bits(SSL_get_current_cipher(ch->ssl_handle), &alg_bits); syslog(LOG_INFO, "SSL/TLS using %s on %s (%d of %d bits)", - SSL_CIPHER_get_name(SSL_get_current_cipher(ch->ssl_handle)), - SSL_CIPHER_get_version(SSL_get_current_cipher(ch->ssl_handle)), - bits, alg_bits); + SSL_CIPHER_get_name(SSL_get_current_cipher(ch->ssl_handle)), + SSL_CIPHER_get_version(SSL_get_current_cipher(ch->ssl_handle)), bits, alg_bits); syslog(LOG_INFO, "SSL started"); } @@ -403,7 +387,8 @@ int client_write_ssl(struct client_handle *ch, char *buf, int nbytes) int nremain; char junk[1]; - if (ch->ssl_handle == NULL) return(-1); + if (ch->ssl_handle == NULL) + return (-1); nremain = nbytes; while (nremain > 0) { @@ -443,7 +428,8 @@ int client_read_ssl(struct client_handle *ch, char *buf, int nbytes) int rlen = 0; char junk[1]; - if (ch->ssl_handle == NULL) return(-1); + if (ch->ssl_handle == NULL) + return (-1); while (bytes_read < nbytes) { if (SSL_want_read(ch->ssl_handle)) { @@ -451,10 +437,9 @@ int client_read_ssl(struct client_handle *ch, char *buf, int nbytes) syslog(LOG_WARNING, "SSL_write in client_read"); } } - rlen = SSL_read(ch->ssl_handle, &buf[bytes_read], nbytes-bytes_read); + rlen = SSL_read(ch->ssl_handle, &buf[bytes_read], nbytes - bytes_read); if (rlen < 1) { long errval; - errval = SSL_get_error(ch->ssl_handle, rlen); if (errval == SSL_ERROR_WANT_READ || errval == SSL_ERROR_WANT_WRITE) { sleep(1); @@ -466,5 +451,5 @@ int client_read_ssl(struct client_handle *ch, char *buf, int nbytes) } bytes_read += rlen; } - return(bytes_read); + return (bytes_read); }