xref: /dragonfly/crypto/libressl/tls/tls_config.c (revision 304ca408) 
1 /* $OpenBSD: tls_config.c,v 1.21 2016/07/07 14:09:03 jsing Exp $ */
2 /*
3  * Copyright (c) 2014 Joel Sing <jsing@openbsd.org>
4  *
5  * Permission to use, copy, modify, and distribute this software for any
6  * purpose with or without fee is hereby granted, provided that the above
7  * copyright notice and this permission notice appear in all copies.
8  *
9  * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
10  * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
11  * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
12  * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
13  * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
14  * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
15  * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
16  */
17 
18 #include <ctype.h>
19 #include <errno.h>
20 #include <stdlib.h>
21 
22 #include <tls.h>
23 #include "tls_internal.h"
24 
25 static int
26 set_string(const char **dest, const char *src)
27 {
28 	free((char *)*dest);
29 	*dest = NULL;
30 	if (src != NULL)
31 		if ((*dest = strdup(src)) == NULL)
32 			return -1;
33 	return 0;
34 }
35 
36 static void *
37 memdup(const void *in, size_t len)
38 {
39 	void *out;
40 
41 	if ((out = malloc(len)) == NULL)
42 		return NULL;
43 	memcpy(out, in, len);
44 	return out;
45 }
46 
47 static int
48 set_mem(char **dest, size_t *destlen, const void *src, size_t srclen)
49 {
50 	free(*dest);
51 	*dest = NULL;
52 	*destlen = 0;
53 	if (src != NULL)
54 		if ((*dest = memdup(src, srclen)) == NULL)
55 			return -1;
56 	*destlen = srclen;
57 	return 0;
58 }
59 
60 static struct tls_keypair *
61 tls_keypair_new()
62 {
63 	return calloc(1, sizeof(struct tls_keypair));
64 }
65 
66 static int
67 tls_keypair_set_cert_file(struct tls_keypair *keypair, const char *cert_file)
68 {
69 	return set_string(&keypair->cert_file, cert_file);
70 }
71 
72 static int
73 tls_keypair_set_cert_mem(struct tls_keypair *keypair, const uint8_t *cert,
74     size_t len)
75 {
76 	return set_mem(&keypair->cert_mem, &keypair->cert_len, cert, len);
77 }
78 
79 static int
80 tls_keypair_set_key_file(struct tls_keypair *keypair, const char *key_file)
81 {
82 	return set_string(&keypair->key_file, key_file);
83 }
84 
85 static int
86 tls_keypair_set_key_mem(struct tls_keypair *keypair, const uint8_t *key,
87     size_t len)
88 {
89 	if (keypair->key_mem != NULL)
90 		explicit_bzero(keypair->key_mem, keypair->key_len);
91 	return set_mem(&keypair->key_mem, &keypair->key_len, key, len);
92 }
93 
94 static void
95 tls_keypair_clear(struct tls_keypair *keypair)
96 {
97 	tls_keypair_set_cert_mem(keypair, NULL, 0);
98 	tls_keypair_set_key_mem(keypair, NULL, 0);
99 }
100 
101 static void
102 tls_keypair_free(struct tls_keypair *keypair)
103 {
104 	if (keypair == NULL)
105 		return;
106 
107 	tls_keypair_clear(keypair);
108 
109 	free((char *)keypair->cert_file);
110 	free(keypair->cert_mem);
111 	free((char *)keypair->key_file);
112 	free(keypair->key_mem);
113 
114 	free(keypair);
115 }
116 
117 struct tls_config *
118 tls_config_new(void)
119 {
120 	struct tls_config *config;
121 
122 	if ((config = calloc(1, sizeof(*config))) == NULL)
123 		return (NULL);
124 
125 	if ((config->keypair = tls_keypair_new()) == NULL)
126 		goto err;
127 
128 	/*
129 	 * Default configuration.
130 	 */
131 	if (tls_config_set_ca_file(config, _PATH_SSL_CA_FILE) != 0)
132 		goto err;
133 	if (tls_config_set_dheparams(config, "none") != 0)
134 		goto err;
135 	if (tls_config_set_ecdhecurve(config, "auto") != 0)
136 		goto err;
137 	if (tls_config_set_ciphers(config, "secure") != 0)
138 		goto err;
139 
140 	tls_config_set_protocols(config, TLS_PROTOCOLS_DEFAULT);
141 	tls_config_set_verify_depth(config, 6);
142 
143 	tls_config_prefer_ciphers_server(config);
144 
145 	tls_config_verify(config);
146 
147 	return (config);
148 
149  err:
150 	tls_config_free(config);
151 	return (NULL);
152 }
153 
154 void
155 tls_config_free(struct tls_config *config)
156 {
157 	struct tls_keypair *kp, *nkp;
158 
159 	if (config == NULL)
160 		return;
161 
162 	for (kp = config->keypair; kp != NULL; kp = nkp) {
163 		nkp = kp->next;
164 		tls_keypair_free(kp);
165 	}
166 
167 	free(config->error.msg);
168 
169 	free((char *)config->ca_file);
170 	free((char *)config->ca_mem);
171 	free((char *)config->ca_path);
172 	free((char *)config->ciphers);
173 
174 	free(config);
175 }
176 
177 const char *
178 tls_config_error(struct tls_config *config)
179 {
180 	return config->error.msg;
181 }
182 
183 void
184 tls_config_clear_keys(struct tls_config *config)
185 {
186 	struct tls_keypair *kp;
187 
188 	for (kp = config->keypair; kp != NULL; kp = kp->next)
189 		tls_keypair_clear(kp);
190 
191 	tls_config_set_ca_mem(config, NULL, 0);
192 }
193 
194 int
195 tls_config_parse_protocols(uint32_t *protocols, const char *protostr)
196 {
197 	uint32_t proto, protos = 0;
198 	char *s, *p, *q;
199 	int negate;
200 
201 	if ((s = strdup(protostr)) == NULL)
202 		return (-1);
203 
204 	q = s;
205 	while ((p = strsep(&q, ",:")) != NULL) {
206 		while (*p == ' ' || *p == '\t')
207 			p++;
208 
209 		negate = 0;
210 		if (*p == '!') {
211 			negate = 1;
212 			p++;
213 		}
214 
215 		if (negate && protos == 0)
216 			protos = TLS_PROTOCOLS_ALL;
217 
218 		proto = 0;
219 		if (strcasecmp(p, "all") == 0 ||
220 		    strcasecmp(p, "legacy") == 0)
221 			proto = TLS_PROTOCOLS_ALL;
222 		else if (strcasecmp(p, "default") == 0 ||
223 		    strcasecmp(p, "secure") == 0)
224 			proto = TLS_PROTOCOLS_DEFAULT;
225 		if (strcasecmp(p, "tlsv1") == 0)
226 			proto = TLS_PROTOCOL_TLSv1;
227 		else if (strcasecmp(p, "tlsv1.0") == 0)
228 			proto = TLS_PROTOCOL_TLSv1_0;
229 		else if (strcasecmp(p, "tlsv1.1") == 0)
230 			proto = TLS_PROTOCOL_TLSv1_1;
231 		else if (strcasecmp(p, "tlsv1.2") == 0)
232 			proto = TLS_PROTOCOL_TLSv1_2;
233 
234 		if (proto == 0) {
235 			free(s);
236 			return (-1);
237 		}
238 
239 		if (negate)
240 			protos &= ~proto;
241 		else
242 			protos |= proto;
243 	}
244 
245 	*protocols = protos;
246 
247 	free(s);
248 
249 	return (0);
250 }
251 
252 int
253 tls_config_set_ca_file(struct tls_config *config, const char *ca_file)
254 {
255 	return set_string(&config->ca_file, ca_file);
256 }
257 
258 int
259 tls_config_set_ca_path(struct tls_config *config, const char *ca_path)
260 {
261 	return set_string(&config->ca_path, ca_path);
262 }
263 
264 int
265 tls_config_set_ca_mem(struct tls_config *config, const uint8_t *ca, size_t len)
266 {
267 	return set_mem(&config->ca_mem, &config->ca_len, ca, len);
268 }
269 
270 int
271 tls_config_set_cert_file(struct tls_config *config, const char *cert_file)
272 {
273 	return tls_keypair_set_cert_file(config->keypair, cert_file);
274 }
275 
276 int
277 tls_config_set_cert_mem(struct tls_config *config, const uint8_t *cert,
278     size_t len)
279 {
280 	return tls_keypair_set_cert_mem(config->keypair, cert, len);
281 }
282 
283 int
284 tls_config_set_ciphers(struct tls_config *config, const char *ciphers)
285 {
286 	SSL_CTX *ssl_ctx = NULL;
287 
288 	if (ciphers == NULL ||
289 	    strcasecmp(ciphers, "default") == 0 ||
290 	    strcasecmp(ciphers, "secure") == 0)
291 		ciphers = TLS_CIPHERS_DEFAULT;
292 	else if (strcasecmp(ciphers, "compat") == 0)
293 		ciphers = TLS_CIPHERS_COMPAT;
294 	else if (strcasecmp(ciphers, "legacy") == 0)
295 		ciphers = TLS_CIPHERS_LEGACY;
296 	else if (strcasecmp(ciphers, "all") == 0 ||
297 	    strcasecmp(ciphers, "insecure") == 0)
298 		ciphers = TLS_CIPHERS_ALL;
299 
300 	if ((ssl_ctx = SSL_CTX_new(SSLv23_method())) == NULL) {
301 		tls_config_set_errorx(config, "out of memory");
302 		goto fail;
303 	}
304 	if (SSL_CTX_set_cipher_list(ssl_ctx, ciphers) != 1) {
305 		tls_config_set_errorx(config, "no ciphers for '%s'", ciphers);
306 		goto fail;
307 	}
308 
309 	SSL_CTX_free(ssl_ctx);
310 	return set_string(&config->ciphers, ciphers);
311 
312  fail:
313 	SSL_CTX_free(ssl_ctx);
314 	return -1;
315 }
316 
317 int
318 tls_config_set_dheparams(struct tls_config *config, const char *params)
319 {
320 	int keylen;
321 
322 	if (params == NULL || strcasecmp(params, "none") == 0)
323 		keylen = 0;
324 	else if (strcasecmp(params, "auto") == 0)
325 		keylen = -1;
326 	else if (strcasecmp(params, "legacy") == 0)
327 		keylen = 1024;
328 	else {
329 		tls_config_set_errorx(config, "invalid dhe param '%s'", params);
330 		return (-1);
331 	}
332 
333 	config->dheparams = keylen;
334 
335 	return (0);
336 }
337 
338 int
339 tls_config_set_ecdhecurve(struct tls_config *config, const char *name)
340 {
341 	int nid;
342 
343 	if (name == NULL || strcasecmp(name, "none") == 0)
344 		nid = NID_undef;
345 	else if (strcasecmp(name, "auto") == 0)
346 		nid = -1;
347 	else if ((nid = OBJ_txt2nid(name)) == NID_undef) {
348 		tls_config_set_errorx(config, "invalid ecdhe curve '%s'", name);
349 		return (-1);
350 	}
351 
352 	config->ecdhecurve = nid;
353 
354 	return (0);
355 }
356 
357 int
358 tls_config_set_key_file(struct tls_config *config, const char *key_file)
359 {
360 	return tls_keypair_set_key_file(config->keypair, key_file);
361 }
362 
363 int
364 tls_config_set_key_mem(struct tls_config *config, const uint8_t *key,
365     size_t len)
366 {
367 	return tls_keypair_set_key_mem(config->keypair, key, len);
368 }
369 
370 int
371 tls_config_set_keypair_file(struct tls_config *config,
372     const char *cert_file, const char *key_file)
373 {
374 	if (tls_config_set_cert_file(config, cert_file) != 0)
375 		return (-1);
376 	if (tls_config_set_key_file(config, key_file) != 0)
377 		return (-1);
378 
379 	return (0);
380 }
381 
382 int
383 tls_config_set_keypair_mem(struct tls_config *config, const uint8_t *cert,
384     size_t cert_len, const uint8_t *key, size_t key_len)
385 {
386 	if (tls_config_set_cert_mem(config, cert, cert_len) != 0)
387 		return (-1);
388 	if (tls_config_set_key_mem(config, key, key_len) != 0)
389 		return (-1);
390 
391 	return (0);
392 }
393 
394 void
395 tls_config_set_protocols(struct tls_config *config, uint32_t protocols)
396 {
397 	config->protocols = protocols;
398 }
399 
400 void
401 tls_config_set_verify_depth(struct tls_config *config, int verify_depth)
402 {
403 	config->verify_depth = verify_depth;
404 }
405 
406 void
407 tls_config_prefer_ciphers_client(struct tls_config *config)
408 {
409 	config->ciphers_server = 0;
410 }
411 
412 void
413 tls_config_prefer_ciphers_server(struct tls_config *config)
414 {
415 	config->ciphers_server = 1;
416 }
417 
418 void
419 tls_config_insecure_noverifycert(struct tls_config *config)
420 {
421 	config->verify_cert = 0;
422 }
423 
424 void
425 tls_config_insecure_noverifyname(struct tls_config *config)
426 {
427 	config->verify_name = 0;
428 }
429 
430 void
431 tls_config_insecure_noverifytime(struct tls_config *config)
432 {
433 	config->verify_time = 0;
434 }
435 
436 void
437 tls_config_verify(struct tls_config *config)
438 {
439 	config->verify_cert = 1;
440 	config->verify_name = 1;
441 	config->verify_time = 1;
442 }
443 
444 void
445 tls_config_verify_client(struct tls_config *config)
446 {
447 	config->verify_client = 1;
448 }
449 
450 void
451 tls_config_verify_client_optional(struct tls_config *config)
452 {
453 	config->verify_client = 2;
454 }
455