1 /* $Id: revokeproc.c,v 1.15 2019/06/16 19:49:13 florian Exp $ */ 2 /* 3 * Copyright (c) 2016 Kristaps Dzonsons <kristaps@bsd.lv> 4 * 5 * Permission to use, copy, modify, and distribute this software for any 6 * purpose with or without fee is hereby granted, provided that the above 7 * copyright notice and this permission notice appear in all copies. 8 * 9 * THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHORS DISCLAIM ALL WARRANTIES 10 * WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF 11 * MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHORS BE LIABLE FOR 12 * ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES 13 * WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 14 * ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 15 * OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 16 */ 17 18 #include <assert.h> 19 #include <ctype.h> 20 #include <err.h> 21 #include <errno.h> 22 #include <stdio.h> 23 #include <stdlib.h> 24 #include <string.h> 25 #include <unistd.h> 26 27 #include <openssl/pem.h> 28 #include <openssl/x509.h> 29 #include <openssl/x509v3.h> 30 #include <openssl/err.h> 31 32 #include "extern.h" 33 34 #define RENEW_ALLOW (30 * 24 * 60 * 60) 35 36 /* 37 * Convert the X509's expiration time (which is in ASN1_TIME format) 38 * into a time_t value. 39 * There are lots of suggestions on the Internet on how to do this and 40 * they're really, really unsafe. 41 * Adapt those poor solutions to a safe one. 42 */ 43 static time_t 44 X509expires(X509 *x) 45 { 46 ASN1_TIME *atim; 47 struct tm t; 48 unsigned char *str; 49 size_t i = 0; 50 51 atim = X509_get_notAfter(x); 52 str = atim->data; 53 memset(&t, 0, sizeof(t)); 54 55 /* Account for 2 and 4-digit time. */ 56 57 if (atim->type == V_ASN1_UTCTIME) { 58 if (atim->length <= 2) { 59 warnx("invalid ASN1_TIME"); 60 return (time_t)-1; 61 } 62 t.tm_year = (str[0] - '0') * 10 + (str[1] - '0'); 63 if (t.tm_year < 70) 64 t.tm_year += 100; 65 i = 2; 66 } else if (atim->type == V_ASN1_GENERALIZEDTIME) { 67 if (atim->length <= 4) { 68 warnx("invalid ASN1_TIME"); 69 return (time_t)-1; 70 } 71 t.tm_year = (str[0] - '0') * 1000 + (str[1] - '0') * 100 + 72 (str[2] - '0') * 10 + (str[3] - '0'); 73 t.tm_year -= 1900; 74 i = 4; 75 } 76 77 /* Now the post-year parts. */ 78 79 if (atim->length <= (int)i + 10) { 80 warnx("invalid ASN1_TIME"); 81 return (time_t)-1; 82 } 83 84 t.tm_mon = ((str[i + 0] - '0') * 10 + (str[i + 1] - '0')) - 1; 85 t.tm_mday = (str[i + 2] - '0') * 10 + (str[i + 3] - '0'); 86 t.tm_hour = (str[i + 4] - '0') * 10 + (str[i + 5] - '0'); 87 t.tm_min = (str[i + 6] - '0') * 10 + (str[i + 7] - '0'); 88 t.tm_sec = (str[i + 8] - '0') * 10 + (str[i + 9] - '0'); 89 90 return mktime(&t); 91 } 92 93 int 94 revokeproc(int fd, const char *certfile, int force, 95 int revocate, const char *const *alts, size_t altsz) 96 { 97 char *der = NULL, *dercp, *der64 = NULL; 98 char *san = NULL, *str, *tok; 99 int rc = 0, cc, i, extsz, ssz, len; 100 size_t *found = NULL; 101 BIO *bio = NULL; 102 FILE *f = NULL; 103 X509 *x = NULL; 104 long lval; 105 enum revokeop op, rop; 106 time_t t; 107 X509_EXTENSION *ex; 108 ASN1_OBJECT *obj; 109 size_t j; 110 111 /* 112 * First try to open the certificate before we drop privileges 113 * and jail ourselves. 114 * We allow "f" to be NULL IFF the cert doesn't exist yet. 115 */ 116 117 if ((f = fopen(certfile, "r")) == NULL && errno != ENOENT) { 118 warn("%s", certfile); 119 goto out; 120 } 121 122 /* File-system and sandbox jailing. */ 123 124 ERR_load_crypto_strings(); 125 126 if (pledge("stdio", NULL) == -1) { 127 warn("pledge"); 128 goto out; 129 } 130 131 /* 132 * If we couldn't open the certificate, it doesn't exist so we 133 * haven't submitted it yet, so obviously we can mark that it 134 * has expired and we should renew it. 135 * If we're revoking, however, then that's an error! 136 * Ignore if the reader isn't reading in either case. 137 */ 138 139 if (f == NULL && revocate) { 140 warnx("%s: no certificate found", certfile); 141 (void)writeop(fd, COMM_REVOKE_RESP, REVOKE_OK); 142 goto out; 143 } else if (f == NULL && !revocate) { 144 if (writeop(fd, COMM_REVOKE_RESP, REVOKE_EXP) >= 0) 145 rc = 1; 146 goto out; 147 } 148 149 if ((x = PEM_read_X509(f, NULL, NULL, NULL)) == NULL) { 150 warnx("PEM_read_X509"); 151 goto out; 152 } 153 154 /* Read out the expiration date. */ 155 156 if ((t = X509expires(x)) == (time_t)-1) { 157 warnx("X509expires"); 158 goto out; 159 } 160 161 /* 162 * Next, the long process to make sure that the SAN entries 163 * listed with the certificate fully cover those passed on the 164 * command line. 165 */ 166 167 extsz = x->cert_info->extensions != NULL ? 168 sk_X509_EXTENSION_num(x->cert_info->extensions) : 0; 169 170 /* Scan til we find the SAN NID. */ 171 172 for (i = 0; i < extsz; i++) { 173 ex = sk_X509_EXTENSION_value(x->cert_info->extensions, i); 174 assert(ex != NULL); 175 obj = X509_EXTENSION_get_object(ex); 176 assert(obj != NULL); 177 if (NID_subject_alt_name != OBJ_obj2nid(obj)) 178 continue; 179 180 if (san != NULL) { 181 warnx("%s: two SAN entries", certfile); 182 goto out; 183 } 184 185 bio = BIO_new(BIO_s_mem()); 186 if (bio == NULL) { 187 warnx("BIO_new"); 188 goto out; 189 } else if (!X509V3_EXT_print(bio, ex, 0, 0)) { 190 warnx("X509V3_EXT_print"); 191 goto out; 192 } else if ((san = calloc(1, bio->num_write + 1)) == NULL) { 193 warn("calloc"); 194 goto out; 195 } 196 ssz = BIO_read(bio, san, bio->num_write); 197 if (ssz < 0 || (unsigned)ssz != bio->num_write) { 198 warnx("BIO_read"); 199 goto out; 200 } 201 } 202 203 if (san == NULL) { 204 warnx("%s: does not have a SAN entry", certfile); 205 goto out; 206 } 207 208 /* An array of buckets: the number of entries found. */ 209 210 if ((found = calloc(altsz, sizeof(size_t))) == NULL) { 211 warn("calloc"); 212 goto out; 213 } 214 215 /* 216 * Parse the SAN line. 217 * Make sure that all of the domains are represented only once. 218 */ 219 220 str = san; 221 while ((tok = strsep(&str, ",")) != NULL) { 222 if (*tok == '\0') 223 continue; 224 while (isspace((int)*tok)) 225 tok++; 226 if (strncmp(tok, "DNS:", 4)) 227 continue; 228 tok += 4; 229 for (j = 0; j < altsz; j++) 230 if (strcmp(tok, alts[j]) == 0) 231 break; 232 if (j == altsz) { 233 warnx("%s: unknown SAN entry: %s", certfile, tok); 234 goto out; 235 } 236 if (found[j]++) { 237 warnx("%s: duplicate SAN entry: %s", certfile, tok); 238 goto out; 239 } 240 } 241 242 for (j = 0; j < altsz; j++) { 243 if (found[j]) 244 continue; 245 warnx("%s: domain not listed: %s", certfile, alts[j]); 246 goto out; 247 } 248 249 /* 250 * If we're going to revoke, write the certificate to the 251 * netproc in DER and base64-encoded format. 252 * Then exit: we have nothing left to do. 253 */ 254 255 if (revocate) { 256 dodbg("%s: revocation", certfile); 257 258 /* 259 * First, tell netproc we're online. 260 * If they're down, then just exit without warning. 261 */ 262 263 cc = writeop(fd, COMM_REVOKE_RESP, REVOKE_EXP); 264 if (cc == 0) 265 rc = 1; 266 if (cc <= 0) 267 goto out; 268 269 if ((len = i2d_X509(x, NULL)) < 0) { 270 warnx("i2d_X509"); 271 goto out; 272 } else if ((der = dercp = malloc(len)) == NULL) { 273 warn("malloc"); 274 goto out; 275 } else if (len != i2d_X509(x, (u_char **)&dercp)) { 276 warnx("i2d_X509"); 277 goto out; 278 } else if ((der64 = base64buf_url(der, len)) == NULL) { 279 warnx("base64buf_url"); 280 goto out; 281 } else if (writestr(fd, COMM_CSR, der64) >= 0) 282 rc = 1; 283 284 goto out; 285 } 286 287 rop = time(NULL) >= (t - RENEW_ALLOW) ? REVOKE_EXP : REVOKE_OK; 288 289 if (rop == REVOKE_EXP) 290 dodbg("%s: certificate renewable: %lld days left", 291 certfile, (long long)(t - time(NULL)) / 24 / 60 / 60); 292 else 293 dodbg("%s: certificate valid: %lld days left", 294 certfile, (long long)(t - time(NULL)) / 24 / 60 / 60); 295 296 if (rop == REVOKE_OK && force) { 297 warnx("%s: forcing renewal", certfile); 298 rop = REVOKE_EXP; 299 } 300 301 /* 302 * We can re-submit it given RENEW_ALLOW time before. 303 * If netproc is down, just exit. 304 */ 305 306 if ((cc = writeop(fd, COMM_REVOKE_RESP, rop)) == 0) 307 rc = 1; 308 if (cc <= 0) 309 goto out; 310 311 op = REVOKE__MAX; 312 if ((lval = readop(fd, COMM_REVOKE_OP)) == 0) 313 op = REVOKE_STOP; 314 else if (lval == REVOKE_CHECK) 315 op = lval; 316 317 if (op == REVOKE__MAX) { 318 warnx("unknown operation from netproc"); 319 goto out; 320 } else if (op == REVOKE_STOP) { 321 rc = 1; 322 goto out; 323 } 324 325 rc = 1; 326 out: 327 close(fd); 328 if (f != NULL) 329 fclose(f); 330 X509_free(x); 331 BIO_free(bio); 332 free(san); 333 free(der); 334 free(found); 335 free(der64); 336 ERR_print_errors_fp(stderr); 337 ERR_free_strings(); 338 return rc; 339 } 340