1 /* $Id: revokeproc.c,v 1.17 2021/01/02 19:04:21 sthen Exp $ */ 2 /* 3 * Copyright (c) 2016 Kristaps Dzonsons <kristaps@bsd.lv> 4 * 5 * Permission to use, copy, modify, and distribute this software for any 6 * purpose with or without fee is hereby granted, provided that the above 7 * copyright notice and this permission notice appear in all copies. 8 * 9 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHORS DISCLAIM ALL WARRANTIES 10 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 11 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR 12 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 13 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 14 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 15 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 16 */ 17 18 #include <assert.h> 19 #include <ctype.h> 20 #include <err.h> 21 #include <errno.h> 22 #include <stdio.h> 23 #include <stdlib.h> 24 #include <string.h> 25 #include <unistd.h> 26 27 #include <openssl/pem.h> 28 #include <openssl/x509.h> 29 #include <openssl/x509v3.h> 30 #include <openssl/err.h> 31 32 #include "extern.h" 33 34 #define RENEW_ALLOW (30 * 24 * 60 * 60) 35 36 /* 37 * Convert the X509's expiration time (which is in ASN1_TIME format) 38 * into a time_t value. 39 * There are lots of suggestions on the Internet on how to do this and 40 * they're really, really unsafe. 41 * Adapt those poor solutions to a safe one. 42 */ 43 static time_t 44 X509expires(X509 *x) 45 { 46 ASN1_TIME *atim; 47 struct tm t; 48 unsigned char *str; 49 size_t i = 0; 50 51 atim = X509_get_notAfter(x); 52 str = atim->data; 53 memset(&t, 0, sizeof(t)); 54 55 /* Account for 2 and 4-digit time. */ 56 57 if (atim->type == V_ASN1_UTCTIME) { 58 if (atim->length <= 2) { 59 warnx("invalid ASN1_TIME"); 60 return (time_t)-1; 61 } 62 t.tm_year = (str[0] - '0') * 10 + (str[1] - '0'); 63 if (t.tm_year < 70) 64 t.tm_year += 100; 65 i = 2; 66 } else if (atim->type == V_ASN1_GENERALIZEDTIME) { 67 if (atim->length <= 4) { 68 warnx("invalid ASN1_TIME"); 69 return (time_t)-1; 70 } 71 t.tm_year = (str[0] - '0') * 1000 + (str[1] - '0') * 100 + 72 (str[2] - '0') * 10 + (str[3] - '0'); 73 t.tm_year -= 1900; 74 i = 4; 75 } 76 77 /* Now the post-year parts. */ 78 79 if (atim->length <= (int)i + 10) { 80 warnx("invalid ASN1_TIME"); 81 return (time_t)-1; 82 } 83 84 t.tm_mon = ((str[i + 0] - '0') * 10 + (str[i + 1] - '0')) - 1; 85 t.tm_mday = (str[i + 2] - '0') * 10 + (str[i + 3] - '0'); 86 t.tm_hour = (str[i + 4] - '0') * 10 + (str[i + 5] - '0'); 87 t.tm_min = (str[i + 6] - '0') * 10 + (str[i + 7] - '0'); 88 t.tm_sec = (str[i + 8] - '0') * 10 + (str[i + 9] - '0'); 89 90 return mktime(&t); 91 } 92 93 int 94 revokeproc(int fd, const char *certfile, int force, 95 int revocate, const char *const *alts, size_t altsz) 96 { 97 char *der = NULL, *dercp, *der64 = NULL; 98 char *san = NULL, *str, *tok; 99 int rc = 0, cc, i, extsz, ssz, len; 100 size_t *found = NULL; 101 BIO *bio = NULL; 102 FILE *f = NULL; 103 X509 *x = NULL; 104 long lval; 105 enum revokeop op, rop; 106 time_t t; 107 X509_EXTENSION *ex; 108 ASN1_OBJECT *obj; 109 size_t j; 110 111 /* 112 * First try to open the certificate before we drop privileges 113 * and jail ourselves. 114 * We allow "f" to be NULL IFF the cert doesn't exist yet. 115 */ 116 117 if ((f = fopen(certfile, "r")) == NULL && errno != ENOENT) { 118 warn("%s", certfile); 119 goto out; 120 } 121 122 /* File-system and sandbox jailing. */ 123 124 ERR_load_crypto_strings(); 125 126 if (pledge("stdio", NULL) == -1) { 127 warn("pledge"); 128 goto out; 129 } 130 131 /* 132 * If we couldn't open the certificate, it doesn't exist so we 133 * haven't submitted it yet, so obviously we can mark that it 134 * has expired and we should renew it. 135 * If we're revoking, however, then that's an error! 136 * Ignore if the reader isn't reading in either case. 137 */ 138 139 if (f == NULL && revocate) { 140 warnx("%s: no certificate found", certfile); 141 (void)writeop(fd, COMM_REVOKE_RESP, REVOKE_OK); 142 goto out; 143 } else if (f == NULL && !revocate) { 144 if (writeop(fd, COMM_REVOKE_RESP, REVOKE_EXP) >= 0) 145 rc = 1; 146 goto out; 147 } 148 149 if ((x = PEM_read_X509(f, NULL, NULL, NULL)) == NULL) { 150 warnx("PEM_read_X509"); 151 goto out; 152 } 153 154 /* Read out the expiration date. */ 155 156 if ((t = X509expires(x)) == (time_t)-1) { 157 warnx("X509expires"); 158 goto out; 159 } 160 161 /* 162 * Next, the long process to make sure that the SAN entries 163 * listed with the certificate fully cover those passed on the 164 * command line. 165 */ 166 167 extsz = x->cert_info->extensions != NULL ? 168 sk_X509_EXTENSION_num(x->cert_info->extensions) : 0; 169 170 /* Scan til we find the SAN NID. */ 171 172 for (i = 0; i < extsz; i++) { 173 ex = sk_X509_EXTENSION_value(x->cert_info->extensions, i); 174 assert(ex != NULL); 175 obj = X509_EXTENSION_get_object(ex); 176 assert(obj != NULL); 177 if (NID_subject_alt_name != OBJ_obj2nid(obj)) 178 continue; 179 180 if (san != NULL) { 181 warnx("%s: two SAN entries", certfile); 182 goto out; 183 } 184 185 bio = BIO_new(BIO_s_mem()); 186 if (bio == NULL) { 187 warnx("BIO_new"); 188 goto out; 189 } else if (!X509V3_EXT_print(bio, ex, 0, 0)) { 190 warnx("X509V3_EXT_print"); 191 goto out; 192 } else if ((san = calloc(1, bio->num_write + 1)) == NULL) { 193 warn("calloc"); 194 goto out; 195 } 196 ssz = BIO_read(bio, san, bio->num_write); 197 if (ssz < 0 || (unsigned)ssz != bio->num_write) { 198 warnx("BIO_read"); 199 goto out; 200 } 201 } 202 203 if (san == NULL) { 204 warnx("%s: does not have a SAN entry", certfile); 205 if (revocate) 206 goto out; 207 force = 2; 208 } 209 210 /* An array of buckets: the number of entries found. */ 211 212 if ((found = calloc(altsz, sizeof(size_t))) == NULL) { 213 warn("calloc"); 214 goto out; 215 } 216 217 /* 218 * Parse the SAN line. 219 * Make sure that all of the domains are represented only once. 220 */ 221 222 str = san; 223 while ((tok = strsep(&str, ",")) != NULL) { 224 if (*tok == '\0') 225 continue; 226 while (isspace((int)*tok)) 227 tok++; 228 if (strncmp(tok, "DNS:", 4)) 229 continue; 230 tok += 4; 231 for (j = 0; j < altsz; j++) 232 if (strcmp(tok, alts[j]) == 0) 233 break; 234 if (j == altsz) { 235 if (revocate) { 236 warnx("%s: unknown SAN entry: %s", certfile, tok); 237 goto out; 238 } 239 force = 2; 240 } 241 if (found[j]++) { 242 if (revocate) { 243 warnx("%s: duplicate SAN entry: %s", certfile, tok); 244 goto out; 245 } 246 force = 2; 247 } 248 } 249 250 for (j = 0; j < altsz; j++) { 251 if (found[j]) 252 continue; 253 if (revocate) { 254 warnx("%s: domain not listed: %s", certfile, alts[j]); 255 goto out; 256 } 257 force = 2; 258 } 259 260 /* 261 * If we're going to revoke, write the certificate to the 262 * netproc in DER and base64-encoded format. 263 * Then exit: we have nothing left to do. 264 */ 265 266 if (revocate) { 267 dodbg("%s: revocation", certfile); 268 269 /* 270 * First, tell netproc we're online. 271 * If they're down, then just exit without warning. 272 */ 273 274 cc = writeop(fd, COMM_REVOKE_RESP, REVOKE_EXP); 275 if (cc == 0) 276 rc = 1; 277 if (cc <= 0) 278 goto out; 279 280 if ((len = i2d_X509(x, NULL)) < 0) { 281 warnx("i2d_X509"); 282 goto out; 283 } else if ((der = dercp = malloc(len)) == NULL) { 284 warn("malloc"); 285 goto out; 286 } else if (len != i2d_X509(x, (u_char **)&dercp)) { 287 warnx("i2d_X509"); 288 goto out; 289 } else if ((der64 = base64buf_url(der, len)) == NULL) { 290 warnx("base64buf_url"); 291 goto out; 292 } else if (writestr(fd, COMM_CSR, der64) >= 0) 293 rc = 1; 294 295 goto out; 296 } 297 298 rop = time(NULL) >= (t - RENEW_ALLOW) ? REVOKE_EXP : REVOKE_OK; 299 300 if (rop == REVOKE_EXP) 301 dodbg("%s: certificate renewable: %lld days left", 302 certfile, (long long)(t - time(NULL)) / 24 / 60 / 60); 303 else 304 dodbg("%s: certificate valid: %lld days left", 305 certfile, (long long)(t - time(NULL)) / 24 / 60 / 60); 306 307 if (rop == REVOKE_OK && force) { 308 warnx("%s: %sforcing renewal", certfile, 309 force == 2 ? "domain list changed, " : ""); 310 rop = REVOKE_EXP; 311 } 312 313 /* 314 * We can re-submit it given RENEW_ALLOW time before. 315 * If netproc is down, just exit. 316 */ 317 318 if ((cc = writeop(fd, COMM_REVOKE_RESP, rop)) == 0) 319 rc = 1; 320 if (cc <= 0) 321 goto out; 322 323 op = REVOKE__MAX; 324 if ((lval = readop(fd, COMM_REVOKE_OP)) == 0) 325 op = REVOKE_STOP; 326 else if (lval == REVOKE_CHECK) 327 op = lval; 328 329 if (op == REVOKE__MAX) { 330 warnx("unknown operation from netproc"); 331 goto out; 332 } else if (op == REVOKE_STOP) { 333 rc = 1; 334 goto out; 335 } 336 337 rc = 1; 338 out: 339 close(fd); 340 if (f != NULL) 341 fclose(f); 342 X509_free(x); 343 BIO_free(bio); 344 free(san); 345 free(der); 346 free(found); 347 free(der64); 348 ERR_print_errors_fp(stderr); 349 ERR_free_strings(); 350 return rc; 351 } 352