xref: /openbsd-src/lib/libtls/tls_config.c (revision f2da64fbbbf1b03f09f390ab01267c93dfd77c4c) 
1 /* $OpenBSD: tls_config.c,v 1.28 2016/08/22 14:55:59 jsing Exp $ */
2 /*
3  * Copyright (c) 2014 Joel Sing <jsing@openbsd.org>
4  *
5  * Permission to use, copy, modify, and distribute this software for any
6  * purpose with or without fee is hereby granted, provided that the above
7  * copyright notice and this permission notice appear in all copies.
8  *
9  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16  */
17 
18 #include <sys/stat.h>
19 
20 #include <ctype.h>
21 #include <errno.h>
22 #include <fcntl.h>
23 #include <stdlib.h>
24 #include <unistd.h>
25 
26 #include <tls.h>
27 #include "tls_internal.h"
28 
29 static int
30 set_string(const char **dest, const char *src)
31 {
32 	free((char *)*dest);
33 	*dest = NULL;
34 	if (src != NULL)
35 		if ((*dest = strdup(src)) == NULL)
36 			return -1;
37 	return 0;
38 }
39 
40 static void *
41 memdup(const void *in, size_t len)
42 {
43 	void *out;
44 
45 	if ((out = malloc(len)) == NULL)
46 		return NULL;
47 	memcpy(out, in, len);
48 	return out;
49 }
50 
51 static int
52 set_mem(char **dest, size_t *destlen, const void *src, size_t srclen)
53 {
54 	free(*dest);
55 	*dest = NULL;
56 	*destlen = 0;
57 	if (src != NULL)
58 		if ((*dest = memdup(src, srclen)) == NULL)
59 			return -1;
60 	*destlen = srclen;
61 	return 0;
62 }
63 
64 static struct tls_keypair *
65 tls_keypair_new()
66 {
67 	return calloc(1, sizeof(struct tls_keypair));
68 }
69 
70 static int
71 tls_keypair_set_cert_file(struct tls_keypair *keypair, struct tls_error *error,
72     const char *cert_file)
73 {
74 	return tls_config_load_file(error, "certificate", cert_file,
75 	    &keypair->cert_mem, &keypair->cert_len);
76 }
77 
78 static int
79 tls_keypair_set_cert_mem(struct tls_keypair *keypair, const uint8_t *cert,
80     size_t len)
81 {
82 	return set_mem(&keypair->cert_mem, &keypair->cert_len, cert, len);
83 }
84 
85 static int
86 tls_keypair_set_key_file(struct tls_keypair *keypair, struct tls_error *error,
87     const char *key_file)
88 {
89 	if (keypair->key_mem != NULL)
90 		explicit_bzero(keypair->key_mem, keypair->key_len);
91 	return tls_config_load_file(error, "key", key_file,
92 	    &keypair->key_mem, &keypair->key_len);
93 }
94 
95 static int
96 tls_keypair_set_key_mem(struct tls_keypair *keypair, const uint8_t *key,
97     size_t len)
98 {
99 	if (keypair->key_mem != NULL)
100 		explicit_bzero(keypair->key_mem, keypair->key_len);
101 	return set_mem(&keypair->key_mem, &keypair->key_len, key, len);
102 }
103 
104 static void
105 tls_keypair_clear(struct tls_keypair *keypair)
106 {
107 	tls_keypair_set_cert_mem(keypair, NULL, 0);
108 	tls_keypair_set_key_mem(keypair, NULL, 0);
109 }
110 
111 static void
112 tls_keypair_free(struct tls_keypair *keypair)
113 {
114 	if (keypair == NULL)
115 		return;
116 
117 	tls_keypair_clear(keypair);
118 
119 	free(keypair->cert_mem);
120 	free(keypair->key_mem);
121 
122 	free(keypair);
123 }
124 
125 int
126 tls_config_load_file(struct tls_error *error, const char *filetype,
127     const char *filename, char **buf, size_t *len)
128 {
129 	struct stat st;
130 	int fd = -1;
131 
132 	free(*buf);
133 	*buf = NULL;
134 	*len = 0;
135 
136 	if ((fd = open(filename, O_RDONLY)) == -1) {
137 		tls_error_set(error, "failed to open %s file '%s'",
138 		    filetype, filename);
139 		goto fail;
140 	}
141 	if (fstat(fd, &st) != 0) {
142 		tls_error_set(error, "failed to stat %s file '%s'",
143 		    filetype, filename);
144 		goto fail;
145 	}
146 	*len = (size_t)st.st_size;
147 	if ((*buf = malloc(*len)) == NULL) {
148 		tls_error_set(error, "failed to allocate buffer for "
149 		    "%s file", filetype);
150 		goto fail;
151 	}
152 	if (read(fd, *buf, *len) != *len) {
153 		tls_error_set(error, "failed to read %s file '%s'",
154 		    filetype, filename);
155 		goto fail;
156 	}
157 	close(fd);
158 	return 0;
159 
160  fail:
161 	if (fd != -1)
162 		close(fd);
163 	if (*buf != NULL)
164 		explicit_bzero(*buf, *len);
165 	free(*buf);
166 	*buf = NULL;
167 	*len = 0;
168 
169 	return -1;
170 }
171 
172 struct tls_config *
173 tls_config_new(void)
174 {
175 	struct tls_config *config;
176 
177 	if ((config = calloc(1, sizeof(*config))) == NULL)
178 		return (NULL);
179 
180 	if ((config->keypair = tls_keypair_new()) == NULL)
181 		goto err;
182 
183 	/*
184 	 * Default configuration.
185 	 */
186 	if (tls_config_set_dheparams(config, "none") != 0)
187 		goto err;
188 	if (tls_config_set_ecdhecurve(config, "auto") != 0)
189 		goto err;
190 	if (tls_config_set_ciphers(config, "secure") != 0)
191 		goto err;
192 
193 	tls_config_set_protocols(config, TLS_PROTOCOLS_DEFAULT);
194 	tls_config_set_verify_depth(config, 6);
195 
196 	tls_config_prefer_ciphers_server(config);
197 
198 	tls_config_verify(config);
199 
200 	return (config);
201 
202  err:
203 	tls_config_free(config);
204 	return (NULL);
205 }
206 
207 void
208 tls_config_free(struct tls_config *config)
209 {
210 	struct tls_keypair *kp, *nkp;
211 
212 	if (config == NULL)
213 		return;
214 
215 	for (kp = config->keypair; kp != NULL; kp = nkp) {
216 		nkp = kp->next;
217 		tls_keypair_free(kp);
218 	}
219 
220 	free(config->error.msg);
221 
222 	free(config->alpn);
223 	free((char *)config->ca_mem);
224 	free((char *)config->ca_path);
225 	free((char *)config->ciphers);
226 
227 	free(config);
228 }
229 
230 static void
231 tls_config_keypair_add(struct tls_config *config, struct tls_keypair *keypair)
232 {
233 	struct tls_keypair *kp;
234 
235 	kp = config->keypair;
236 	while (kp->next != NULL)
237 		kp = kp->next;
238 
239 	kp->next = keypair;
240 }
241 
242 const char *
243 tls_config_error(struct tls_config *config)
244 {
245 	return config->error.msg;
246 }
247 
248 void
249 tls_config_clear_keys(struct tls_config *config)
250 {
251 	struct tls_keypair *kp;
252 
253 	for (kp = config->keypair; kp != NULL; kp = kp->next)
254 		tls_keypair_clear(kp);
255 
256 	tls_config_set_ca_mem(config, NULL, 0);
257 }
258 
259 int
260 tls_config_parse_protocols(uint32_t *protocols, const char *protostr)
261 {
262 	uint32_t proto, protos = 0;
263 	char *s, *p, *q;
264 	int negate;
265 
266 	if ((s = strdup(protostr)) == NULL)
267 		return (-1);
268 
269 	q = s;
270 	while ((p = strsep(&q, ",:")) != NULL) {
271 		while (*p == ' ' || *p == '\t')
272 			p++;
273 
274 		negate = 0;
275 		if (*p == '!') {
276 			negate = 1;
277 			p++;
278 		}
279 
280 		if (negate && protos == 0)
281 			protos = TLS_PROTOCOLS_ALL;
282 
283 		proto = 0;
284 		if (strcasecmp(p, "all") == 0 ||
285 		    strcasecmp(p, "legacy") == 0)
286 			proto = TLS_PROTOCOLS_ALL;
287 		else if (strcasecmp(p, "default") == 0 ||
288 		    strcasecmp(p, "secure") == 0)
289 			proto = TLS_PROTOCOLS_DEFAULT;
290 		if (strcasecmp(p, "tlsv1") == 0)
291 			proto = TLS_PROTOCOL_TLSv1;
292 		else if (strcasecmp(p, "tlsv1.0") == 0)
293 			proto = TLS_PROTOCOL_TLSv1_0;
294 		else if (strcasecmp(p, "tlsv1.1") == 0)
295 			proto = TLS_PROTOCOL_TLSv1_1;
296 		else if (strcasecmp(p, "tlsv1.2") == 0)
297 			proto = TLS_PROTOCOL_TLSv1_2;
298 
299 		if (proto == 0) {
300 			free(s);
301 			return (-1);
302 		}
303 
304 		if (negate)
305 			protos &= ~proto;
306 		else
307 			protos |= proto;
308 	}
309 
310 	*protocols = protos;
311 
312 	free(s);
313 
314 	return (0);
315 }
316 
317 static int
318 tls_config_parse_alpn(struct tls_config *config, const char *alpn,
319     char **alpn_data, size_t *alpn_len)
320 {
321 	size_t buf_len, i, len;
322 	char *buf = NULL;
323 	char *s = NULL;
324 	char *p, *q;
325 
326 	free(*alpn_data);
327 	*alpn_data = NULL;
328 	*alpn_len = 0;
329 
330 	if ((buf_len = strlen(alpn) + 1) > 65535) {
331 		tls_config_set_errorx(config, "alpn too large");
332 		goto err;
333 	}
334 
335 	if ((buf = malloc(buf_len)) == NULL) {
336 		tls_config_set_errorx(config, "out of memory");
337 		goto err;
338 	}
339 
340 	if ((s = strdup(alpn)) == NULL) {
341 		tls_config_set_errorx(config, "out of memory");
342 		goto err;
343 	}
344 
345 	i = 0;
346 	q = s;
347 	while ((p = strsep(&q, ",")) != NULL) {
348 		if ((len = strlen(p)) == 0) {
349 			tls_config_set_errorx(config,
350 			    "alpn protocol with zero length");
351 			goto err;
352 		}
353 		if (len > 255) {
354 			tls_config_set_errorx(config,
355 			    "alpn protocol too long");
356 			goto err;
357 		}
358 		buf[i++] = len & 0xff;
359 		memcpy(&buf[i], p, len);
360 		i += len;
361 	}
362 
363 	free(s);
364 
365 	*alpn_data = buf;
366 	*alpn_len = buf_len;
367 
368 	return (0);
369 
370  err:
371 	free(buf);
372 	free(s);
373 
374 	return (-1);
375 }
376 
377 int
378 tls_config_set_alpn(struct tls_config *config, const char *alpn)
379 {
380 	return tls_config_parse_alpn(config, alpn, &config->alpn,
381 	    &config->alpn_len);
382 }
383 
384 int
385 tls_config_add_keypair_file(struct tls_config *config,
386     const char *cert_file, const char *key_file)
387 {
388 	struct tls_keypair *keypair;
389 
390 	if ((keypair = tls_keypair_new()) == NULL)
391 		return (-1);
392 	if (tls_keypair_set_cert_file(keypair, &config->error, cert_file) != 0)
393 		goto err;
394 	if (tls_keypair_set_key_file(keypair, &config->error, key_file) != 0)
395 		goto err;
396 
397 	tls_config_keypair_add(config, keypair);
398 
399 	return (0);
400 
401  err:
402 	tls_keypair_free(keypair);
403 	return (-1);
404 }
405 
406 int
407 tls_config_add_keypair_mem(struct tls_config *config, const uint8_t *cert,
408     size_t cert_len, const uint8_t *key, size_t key_len)
409 {
410 	struct tls_keypair *keypair;
411 
412 	if ((keypair = tls_keypair_new()) == NULL)
413 		return (-1);
414 	if (tls_keypair_set_cert_mem(keypair, cert, cert_len) != 0)
415 		goto err;
416 	if (tls_keypair_set_key_mem(keypair, key, key_len) != 0)
417 		goto err;
418 
419 	tls_config_keypair_add(config, keypair);
420 
421 	return (0);
422 
423  err:
424 	tls_keypair_free(keypair);
425 	return (-1);
426 }
427 
428 int
429 tls_config_set_ca_file(struct tls_config *config, const char *ca_file)
430 {
431 	return tls_config_load_file(&config->error, "CA", ca_file,
432 	    &config->ca_mem, &config->ca_len);
433 }
434 
435 int
436 tls_config_set_ca_path(struct tls_config *config, const char *ca_path)
437 {
438 	return set_string(&config->ca_path, ca_path);
439 }
440 
441 int
442 tls_config_set_ca_mem(struct tls_config *config, const uint8_t *ca, size_t len)
443 {
444 	return set_mem(&config->ca_mem, &config->ca_len, ca, len);
445 }
446 
447 int
448 tls_config_set_cert_file(struct tls_config *config, const char *cert_file)
449 {
450 	return tls_keypair_set_cert_file(config->keypair, &config->error,
451 	    cert_file);
452 }
453 
454 int
455 tls_config_set_cert_mem(struct tls_config *config, const uint8_t *cert,
456     size_t len)
457 {
458 	return tls_keypair_set_cert_mem(config->keypair, cert, len);
459 }
460 
461 int
462 tls_config_set_ciphers(struct tls_config *config, const char *ciphers)
463 {
464 	SSL_CTX *ssl_ctx = NULL;
465 
466 	if (ciphers == NULL ||
467 	    strcasecmp(ciphers, "default") == 0 ||
468 	    strcasecmp(ciphers, "secure") == 0)
469 		ciphers = TLS_CIPHERS_DEFAULT;
470 	else if (strcasecmp(ciphers, "compat") == 0)
471 		ciphers = TLS_CIPHERS_COMPAT;
472 	else if (strcasecmp(ciphers, "legacy") == 0)
473 		ciphers = TLS_CIPHERS_LEGACY;
474 	else if (strcasecmp(ciphers, "all") == 0 ||
475 	    strcasecmp(ciphers, "insecure") == 0)
476 		ciphers = TLS_CIPHERS_ALL;
477 
478 	if ((ssl_ctx = SSL_CTX_new(SSLv23_method())) == NULL) {
479 		tls_config_set_errorx(config, "out of memory");
480 		goto fail;
481 	}
482 	if (SSL_CTX_set_cipher_list(ssl_ctx, ciphers) != 1) {
483 		tls_config_set_errorx(config, "no ciphers for '%s'", ciphers);
484 		goto fail;
485 	}
486 
487 	SSL_CTX_free(ssl_ctx);
488 	return set_string(&config->ciphers, ciphers);
489 
490  fail:
491 	SSL_CTX_free(ssl_ctx);
492 	return -1;
493 }
494 
495 int
496 tls_config_set_dheparams(struct tls_config *config, const char *params)
497 {
498 	int keylen;
499 
500 	if (params == NULL || strcasecmp(params, "none") == 0)
501 		keylen = 0;
502 	else if (strcasecmp(params, "auto") == 0)
503 		keylen = -1;
504 	else if (strcasecmp(params, "legacy") == 0)
505 		keylen = 1024;
506 	else {
507 		tls_config_set_errorx(config, "invalid dhe param '%s'", params);
508 		return (-1);
509 	}
510 
511 	config->dheparams = keylen;
512 
513 	return (0);
514 }
515 
516 int
517 tls_config_set_ecdhecurve(struct tls_config *config, const char *name)
518 {
519 	int nid;
520 
521 	if (name == NULL || strcasecmp(name, "none") == 0)
522 		nid = NID_undef;
523 	else if (strcasecmp(name, "auto") == 0)
524 		nid = -1;
525 	else if ((nid = OBJ_txt2nid(name)) == NID_undef) {
526 		tls_config_set_errorx(config, "invalid ecdhe curve '%s'", name);
527 		return (-1);
528 	}
529 
530 	config->ecdhecurve = nid;
531 
532 	return (0);
533 }
534 
535 int
536 tls_config_set_key_file(struct tls_config *config, const char *key_file)
537 {
538 	return tls_keypair_set_key_file(config->keypair, &config->error,
539 	    key_file);
540 }
541 
542 int
543 tls_config_set_key_mem(struct tls_config *config, const uint8_t *key,
544     size_t len)
545 {
546 	return tls_keypair_set_key_mem(config->keypair, key, len);
547 }
548 
549 int
550 tls_config_set_keypair_file(struct tls_config *config,
551     const char *cert_file, const char *key_file)
552 {
553 	if (tls_config_set_cert_file(config, cert_file) != 0)
554 		return (-1);
555 	if (tls_config_set_key_file(config, key_file) != 0)
556 		return (-1);
557 
558 	return (0);
559 }
560 
561 int
562 tls_config_set_keypair_mem(struct tls_config *config, const uint8_t *cert,
563     size_t cert_len, const uint8_t *key, size_t key_len)
564 {
565 	if (tls_config_set_cert_mem(config, cert, cert_len) != 0)
566 		return (-1);
567 	if (tls_config_set_key_mem(config, key, key_len) != 0)
568 		return (-1);
569 
570 	return (0);
571 }
572 
573 void
574 tls_config_set_protocols(struct tls_config *config, uint32_t protocols)
575 {
576 	config->protocols = protocols;
577 }
578 
579 void
580 tls_config_set_verify_depth(struct tls_config *config, int verify_depth)
581 {
582 	config->verify_depth = verify_depth;
583 }
584 
585 void
586 tls_config_prefer_ciphers_client(struct tls_config *config)
587 {
588 	config->ciphers_server = 0;
589 }
590 
591 void
592 tls_config_prefer_ciphers_server(struct tls_config *config)
593 {
594 	config->ciphers_server = 1;
595 }
596 
597 void
598 tls_config_insecure_noverifycert(struct tls_config *config)
599 {
600 	config->verify_cert = 0;
601 }
602 
603 void
604 tls_config_insecure_noverifyname(struct tls_config *config)
605 {
606 	config->verify_name = 0;
607 }
608 
609 void
610 tls_config_insecure_noverifytime(struct tls_config *config)
611 {
612 	config->verify_time = 0;
613 }
614 
615 void
616 tls_config_verify(struct tls_config *config)
617 {
618 	config->verify_cert = 1;
619 	config->verify_name = 1;
620 	config->verify_time = 1;
621 }
622 
623 void
624 tls_config_verify_client(struct tls_config *config)
625 {
626 	config->verify_client = 1;
627 }
628 
629 void
630 tls_config_verify_client_optional(struct tls_config *config)
631 {
632 	config->verify_client = 2;
633 }
634