crypto_utils.c

Go to the documentation of this file.

/*
 * Asterisk -- An open source telephony toolkit.
 *
 * Copyright (C) 2023, Sangoma Technologies Corporation
 *
 * George Joseph <gjoseph@sangoma.com>
 *
 * See http://www.asterisk.org for more information about
 * the Asterisk project. Please do not directly contact
 * any of the maintainers of this project for assistance;
 * the project provides a web site, mailing lists and IRC
 * channels for your use.
 *
 * This program is free software, distributed under the terms of
 * the GNU General Public License Version 2. See the LICENSE file
 * at the top of the source tree.
 */
 
#include <openssl/err.h>
#include <openssl/ssl.h>
#include <openssl/evp.h>
#include <openssl/md5.h>
#include <openssl/sha.h>
#include <openssl/bio.h>
#include <openssl/obj_mac.h>
#include <openssl/x509.h>
#include <openssl/x509v3.h>
#include <openssl/x509_vfy.h>
 
#include "crypto_utils.h"
 
#include "asterisk.h"
#include "asterisk/logger.h"
#include "asterisk/module.h"
#include "asterisk/stringfields.h"
#include "asterisk/utils.h"
#include "asterisk/vector.h"
#include "asterisk/cli.h"
 
void __attribute__((format(printf, 5, 6)))
crypto_log_openssl(int level, char *file, int line, const char *function,
    const char *fmt, ...)
{
    FILE *fp;
    char *buffer;
    size_t length;
    va_list ap;
    char *tmp_fmt;
 
    fp = open_memstream(&buffer, &length);
    if (!fp) {
        return;
    }
 
    va_start(ap, fmt);
    if (!ast_strlen_zero(fmt)) {
        size_t fmt_len = strlen(fmt);
        if (fmt[fmt_len - 1] == '\n') {
            tmp_fmt = ast_strdupa(fmt);
            tmp_fmt[fmt_len - 1] = '\0';
            fmt = tmp_fmt;
        }
    }
    vfprintf(fp, fmt, ap);
    fputs(": ", fp);
    ERR_print_errors_fp(fp);
    fclose(fp);
 
    if (length) {
        ast_log(level, file, line, function, "%s\n", buffer);
    }
 
    ast_std_free(buffer);
}
 
int crypto_register_x509_extension(const char *oid, const char *short_name,
    const char *long_name)
{
    int nid = 0;
 
    if (ast_strlen_zero(oid) || ast_strlen_zero(short_name) ||
        ast_strlen_zero(long_name)) {
        ast_log(LOG_ERROR, "One or more of oid, short_name or long_name are NULL or empty\n");
        return -1;
    }
 
    nid = OBJ_sn2nid(short_name);
    if (nid != NID_undef) {
        ast_log(LOG_NOTICE, "NID %d, object %s already registered\n", nid, short_name);
        return nid;
    }
 
    nid = OBJ_create(oid, short_name, long_name);
    if (nid == NID_undef) {
        crypto_log_openssl(LOG_ERROR, "Couldn't register %s X509 extension\n", short_name);
        return -1;
    }
    ast_log(LOG_NOTICE, "Registered object %s as NID %d\n", short_name, nid);
 
    return nid;
}
 
ASN1_OCTET_STRING *crypto_get_cert_extension_data(X509 *cert,
    int nid, const char *short_name)
{
    int ex_idx;
    X509_EXTENSION *ex;
 
    if (nid <= 0) {
        nid = OBJ_sn2nid(short_name);
        if (nid == NID_undef) {
            ast_log(LOG_ERROR, "Extension object for %s not found\n", short_name);
            return NULL;
        }
    } else {
        const char *tmp = OBJ_nid2sn(nid);
        if (!tmp) {
            ast_log(LOG_ERROR, "Extension object for NID %d not found\n", nid);
            return NULL;
        }
    }
 
    ex_idx = X509_get_ext_by_NID(cert, nid, -1);
    if (ex_idx < 0) {
        ast_log(LOG_ERROR, "Extension index not found in certificate\n");
        return NULL;
    }
    ex = X509_get_ext(cert, ex_idx);
    if (!ex) {
        ast_log(LOG_ERROR, "Extension not found in certificate\n");
        return NULL;
    }
 
    return X509_EXTENSION_get_data(ex);
}
 
EVP_PKEY *crypto_load_privkey_from_file(const char *filename)
{
    EVP_PKEY *key = NULL;
    FILE *fp;
 
    if (ast_strlen_zero(filename)) {
        ast_log(LOG_ERROR, "filename was null or empty\n");
        return NULL;
    }
 
    fp = fopen(filename, "r");
    if (!fp) {
        ast_log(LOG_ERROR, "Failed to open %s: %s\n", filename, strerror(errno));
        return NULL;
    }
 
    key = PEM_read_PrivateKey(fp, NULL, NULL, NULL);
    fclose(fp);
    if (!key) {
        crypto_log_openssl(LOG_ERROR, "Failed to load private key from %s\n", filename);
    }
    return key;
}
 
X509 *crypto_load_cert_from_file(const char *filename)
{
    FILE *fp;
    X509 *cert = NULL;
 
    if (ast_strlen_zero(filename)) {
        ast_log(LOG_ERROR, "filename was null or empty\n");
        return NULL;
    }
 
    fp = fopen(filename, "r");
    if (!fp) {
        ast_log(LOG_ERROR, "Failed to open %s: %s\n", filename, strerror(errno));
        return NULL;
    }
 
    cert = PEM_read_X509(fp, &cert, NULL, NULL);
    fclose(fp);
    if (!cert) {
        crypto_log_openssl(LOG_ERROR, "Failed to create cert from %s\n", filename);
    }
    return cert;
}
 
X509 *crypto_load_cert_from_memory(const char *buffer, size_t size)
{
    RAII_VAR(BIO *, bio, NULL, BIO_free_all);
    X509 *cert = NULL;
 
    if (ast_strlen_zero(buffer) || size <= 0) {
        ast_log(LOG_ERROR, "buffer was null or empty\n");
        return NULL;
    }
 
    bio = BIO_new_mem_buf(buffer, size);
    if (!bio) {
        crypto_log_openssl(LOG_ERROR, "Unable to create memory BIO\n");
        return NULL;
    }
 
    cert = PEM_read_bio_X509(bio, NULL, NULL, NULL);
    if (!cert) {
        crypto_log_openssl(LOG_ERROR, "Failed to create cert from BIO\n");
    }
    return cert;
}
 
static EVP_PKEY *load_private_key_from_memory(const char *buffer, size_t size)
{
    RAII_VAR(BIO *, bio, NULL, BIO_free_all);
    EVP_PKEY *key = NULL;
 
    if (ast_strlen_zero(buffer) || size <= 0) {
        ast_log(LOG_ERROR, "buffer was null or empty\n");
        return NULL;
    }
 
    bio = BIO_new_mem_buf(buffer, size);
    if (!bio) {
        crypto_log_openssl(LOG_ERROR, "Unable to create memory BIO\n");
        return NULL;
    }
 
    key = PEM_read_bio_PrivateKey(bio, NULL, NULL, NULL);
 
    return key;
}
 
EVP_PKEY *crypto_load_private_key_from_memory(const char *buffer, size_t size)
{
    EVP_PKEY *key = load_private_key_from_memory(buffer, size);
    if (!key) {
        crypto_log_openssl(LOG_ERROR, "Unable to load private key from memory\n");
    }
    return key;
}
 
int crypto_has_private_key_from_memory(const char *buffer, size_t size)
{
    RAII_VAR(EVP_PKEY *, key, load_private_key_from_memory(buffer, size), EVP_PKEY_free);
 
    return key ? 1 : 0;
}
 
static int dump_mem_bio(BIO *bio, unsigned char **buffer)
{
    char *temp_ptr;
    int raw_key_len;
 
    raw_key_len = BIO_get_mem_data(bio, &temp_ptr);
    if (raw_key_len <= 0) {
        crypto_log_openssl(LOG_ERROR, "Unable to extract raw public key\n");
        return -1;
    }
    *buffer = ast_malloc(raw_key_len);
    if (!*buffer) {
        ast_log(LOG_ERROR, "Unable to allocate memory for raw public key\n");
        return -1;
    }
    memcpy(*buffer, temp_ptr, raw_key_len);
 
    return raw_key_len;
}
 
int crypto_extract_raw_pubkey(EVP_PKEY *key, unsigned char **buffer)
{
    RAII_VAR(BIO *, bio, NULL, BIO_free_all);
 
    bio = BIO_new(BIO_s_mem());
 
    if (!bio || (PEM_write_bio_PUBKEY(bio, key) <= 0)) {
        crypto_log_openssl(LOG_ERROR, "Unable to write pubkey to BIO\n");
        return -1;
    }
 
    return dump_mem_bio(bio, buffer);
}
 
int crypto_get_raw_pubkey_from_cert(X509 *cert,
    unsigned char **buffer)
{
    RAII_VAR(EVP_PKEY *, public_key, X509_get_pubkey(cert), EVP_PKEY_free);
 
    if (!public_key) {
        crypto_log_openssl(LOG_ERROR, "Unable to retrieve pubkey from cert\n");
        return -1;
    }
 
    return crypto_extract_raw_pubkey(public_key, buffer);
}
 
int crypto_extract_raw_privkey(EVP_PKEY *key, unsigned char **buffer)
{
    RAII_VAR(BIO *, bio, NULL, BIO_free_all);
 
    bio = BIO_new(BIO_s_mem());
 
    if (!bio || (PEM_write_bio_PrivateKey(bio, key, NULL, NULL, 0, NULL, NULL) <= 0)) {
        crypto_log_openssl(LOG_ERROR, "Unable to write privkey to BIO\n");
        return -1;
    }
 
    return dump_mem_bio(bio, buffer);
}
 
static void crypto_cert_store_destructor(void *obj)
{
    struct crypto_cert_store *store = obj;
 
    if (store->store) {
        X509_STORE_free(store->store);
    }
}
 
struct crypto_cert_store *crypto_create_cert_store(void)
{
    struct crypto_cert_store *store = ao2_alloc(sizeof(*store), crypto_cert_store_destructor);
    if (!store) {
        ast_log(LOG_ERROR, "Failed to create crypto_cert_store\n");
        return NULL;
    }
    store->store = X509_STORE_new();
 
    if (!store->store) {
        crypto_log_openssl(LOG_ERROR, "Failed to create X509_STORE\n");
        ao2_ref(store, -1);
        return NULL;
    }
 
    return store;
}
 
int crypto_load_cert_store(struct crypto_cert_store *store, const char *file,
    const char *path)
{
    if (ast_strlen_zero(file) && ast_strlen_zero(path)) {
        ast_log(LOG_ERROR, "Both file and path can't be NULL");
        return -1;
    }
 
    if (!store || !store->store) {
        ast_log(LOG_ERROR, "store is NULL");
        return -1;
    }
 
    /*
     * If the file or path are empty strings, we need to pass NULL
     * so openssl ignores it otherwise it'll try to open a file or
     * path named ''.
     */
    if (!X509_STORE_load_locations(store->store, S_OR(file, NULL), S_OR(path, NULL))) {
        crypto_log_openssl(LOG_ERROR, "Failed to load store from file '%s' or path '%s'\n",
            S_OR(file, "N/A"), S_OR(path, "N/A"));
        return -1;
    }
 
    return 0;
}
 
int crypto_show_cli_store(struct crypto_cert_store *store, int fd)
{
#if (OPENSSL_VERSION_NUMBER >= 0x10100000L)
    STACK_OF(X509_OBJECT) *certs = NULL;
    int count = 0;
    int i = 0;
    char subj[1024];
 
    certs = X509_STORE_get0_objects(store->store);
    count = sk_X509_OBJECT_num(certs);
    for (i = 0; i < count ; i++) {
        X509_OBJECT *o = sk_X509_OBJECT_value(certs, i);
        X509 *c = X509_OBJECT_get0_X509(o);
        X509_NAME_oneline(X509_get_subject_name(c), subj, 1024);
        ast_cli(fd, "%s\n", subj);
    }
    return count;
#else
    ast_cli(fd, "This command is not supported until OpenSSL 1.1.0\n");
    return 0;
#endif
}
 
int crypto_is_cert_time_valid(X509*cert, time_t reftime)
{
    ASN1_STRING *notbefore;
    ASN1_STRING *notafter;
 
    if (!reftime) {
        reftime = time(NULL);
    }
    notbefore = X509_get_notBefore(cert);
    notafter = X509_get_notAfter(cert);
    if (!notbefore || !notafter) {
        ast_log(LOG_ERROR, "Either notbefore or notafter were not present in the cert\n");
        return 0;
    }
 
    return (X509_cmp_time(notbefore, &reftime) < 0 &&
        X509_cmp_time(notafter, &reftime) > 0);
}
 
int crypto_is_cert_trusted(struct crypto_cert_store *store, X509 *cert, const char **err_msg)
{
    X509_STORE_CTX *verify_ctx = NULL;
    int rc = 0;
 
    if (!(verify_ctx = X509_STORE_CTX_new())) {
        crypto_log_openssl(LOG_ERROR, "Unable to create verify_ctx\n");
        return 0;
    }
 
    if (X509_STORE_CTX_init(verify_ctx, store->store, cert, NULL) != 1) {
        X509_STORE_CTX_cleanup(verify_ctx);
        X509_STORE_CTX_free(verify_ctx);
        crypto_log_openssl(LOG_ERROR, "Unable to initialize verify_ctx\n");
        return 0;
    }
 
    rc = X509_verify_cert(verify_ctx);
    if (rc != 1 && err_msg != NULL) {
        int err = X509_STORE_CTX_get_error(verify_ctx);
        *err_msg = X509_verify_cert_error_string(err);
    }
    X509_STORE_CTX_cleanup(verify_ctx);
    X509_STORE_CTX_free(verify_ctx);
 
    return rc;
}
 
#define SECS_PER_DAY 86400
time_t crypto_asn_time_as_time_t(ASN1_TIME *at)
{
    int pday;
    int psec;
    time_t rt = time(NULL);
 
    if (!ASN1_TIME_diff(&pday, &psec, NULL, at)) {
        crypto_log_openssl(LOG_ERROR, "Unable to calculate time diff\n");
        return 0;
    }
 
    rt += ((pday * SECS_PER_DAY) + psec);
 
    return rt;
}
#undef SECS_PER_DAY
 
char *crypto_get_cert_subject(X509 *cert, const char *short_name)
{
    size_t len = 0;
    RAII_VAR(char *, buffer, NULL, ast_std_free);
    char *search_buff = NULL;
    char *search = NULL;
    size_t search_len = 0;
    char *rtn = NULL;
    char *line = NULL;
    /*
     * If short_name was supplied, we want a multiline subject
     * with each component on a separate line.  This makes it easier
     * to iterate over the components to find the one we want.
     * Otherwise, we just want the whole subject on one line.
     */
    unsigned long flags =
        short_name ? XN_FLAG_FN_SN | XN_FLAG_SEP_MULTILINE : XN_FLAG_ONELINE;
    FILE *fp = open_memstream(&buffer, &len);
    BIO *bio = fp ? BIO_new_fp(fp, BIO_CLOSE) : NULL;
    X509_NAME *subject = X509_get_subject_name(cert);
    int rc = 0;
 
    if (!fp || !bio || !subject) {
        return NULL;
    }
 
    rc = X509_NAME_print_ex(bio, subject, 0, flags);
    BIO_free(bio);
    if (rc < 0) {
        return NULL;
    }
 
    if (!short_name) {
        rtn = ast_malloc(len + 1);
        if (rtn) {
            strcpy(rtn, buffer); /* Safe */
        }
        return rtn;
    }
 
    search_len = strlen(short_name) + 1;
    rc = ast_asprintf(&search, "%s=", short_name);
    if (rc != search_len) {
        return NULL;
    }
 
    search_buff = buffer;
    while((line = ast_read_line_from_buffer(&search_buff))) {
        if (ast_begins_with(line, search)) {
            rtn = ast_malloc(strlen(line) - search_len + 1);
            if (rtn) {
                strcpy(rtn, line + search_len); /* Safe */
            }
            break;
        }
    }
 
    ast_std_free(search);
    return rtn;
}
 
int crypto_load(void)
{
    return AST_MODULE_LOAD_SUCCESS;
}
 
int crypto_unload(void)
{
    return 0;
}