blob: 5b659c9bd331433f3cabd544630f08a8bc4f59b4 [file] [log] [blame]
William Lallemand03c331c2020-05-13 10:10:01 +02001/*
2 *
3 * Copyright (C) 2020 HAProxy Technologies, William Lallemand <wlallemand@haproxy.com>
4 *
5 * This program is free software; you can redistribute it and/or
6 * modify it under the terms of the GNU General Public License
7 * as published by the Free Software Foundation; either version
8 * 2 of the License, or (at your option) any later version.
9 *
10 */
11
12#define _GNU_SOURCE
13#include <ctype.h>
14#include <errno.h>
15#include <fcntl.h>
16#include <stdio.h>
17#include <stdlib.h>
18#include <string.h>
Willy Tarreauaeed4a82020-06-04 22:01:04 +020019#include <syslog.h>
William Lallemand03c331c2020-05-13 10:10:01 +020020#include <unistd.h>
21
22#include <sys/stat.h>
23#include <sys/types.h>
24
Willy Tarreaub2551052020-06-09 09:07:15 +020025#include <import/ebsttree.h>
26
Willy Tarreau8d366972020-05-27 16:10:29 +020027#include <haproxy/base64.h>
Willy Tarreauf1d32c42020-06-04 21:07:02 +020028#include <haproxy/channel.h>
Willy Tarreau83487a82020-06-04 20:19:54 +020029#include <haproxy/cli.h>
Willy Tarreau8d366972020-05-27 16:10:29 +020030#include <haproxy/errors.h>
Willy Tarreau47d7f902020-06-04 14:25:47 +020031#include <haproxy/ssl_ckch.h>
Willy Tarreau209108d2020-06-04 20:30:20 +020032#include <haproxy/ssl_sock.h>
Willy Tarreaub2bd8652020-06-04 14:21:22 +020033#include <haproxy/ssl_utils.h>
Willy Tarreau5e539c92020-06-04 20:45:39 +020034#include <haproxy/stream_interface.h>
Willy Tarreau48fbcae2020-06-03 18:09:46 +020035#include <haproxy/tools.h>
William Lallemand03c331c2020-05-13 10:10:01 +020036
William Lallemandda8584c2020-05-14 10:14:37 +020037/* Uncommitted CKCH transaction */
38
39static struct {
40 struct ckch_store *new_ckchs;
41 struct ckch_store *old_ckchs;
42 char *path;
43} ckchs_transaction;
44
Remi Tricot-Le Bretona32a68b2021-02-24 17:35:43 +010045/* Uncommitted CA file transaction */
46
47static struct {
48 struct cafile_entry *old_cafile_entry;
49 struct cafile_entry *new_cafile_entry;
50 char *path;
51} cafile_transaction;
William Lallemandda8584c2020-05-14 10:14:37 +020052
William Lallemand03c331c2020-05-13 10:10:01 +020053
Remi Tricot-Le Bretona32a68b2021-02-24 17:35:43 +010054
William Lallemand03c331c2020-05-13 10:10:01 +020055/******************** cert_key_and_chain functions *************************
56 * These are the functions that fills a cert_key_and_chain structure. For the
57 * functions filling a SSL_CTX from a cert_key_and_chain, see ssl_sock.c
58 */
59
60/*
61 * Try to parse Signed Certificate Timestamp List structure. This function
62 * makes only basic test if the data seems like SCTL. No signature validation
63 * is performed.
64 */
65static int ssl_sock_parse_sctl(struct buffer *sctl)
66{
67 int ret = 1;
68 int len, pos, sct_len;
69 unsigned char *data;
70
71 if (sctl->data < 2)
72 goto out;
73
74 data = (unsigned char *) sctl->area;
75 len = (data[0] << 8) | data[1];
76
77 if (len + 2 != sctl->data)
78 goto out;
79
80 data = data + 2;
81 pos = 0;
82 while (pos < len) {
83 if (len - pos < 2)
84 goto out;
85
86 sct_len = (data[pos] << 8) | data[pos + 1];
87 if (pos + sct_len + 2 > len)
88 goto out;
89
90 pos += sct_len + 2;
91 }
92
93 ret = 0;
94
95out:
96 return ret;
97}
98
99/* Try to load a sctl from a buffer <buf> if not NULL, or read the file <sctl_path>
100 * It fills the ckch->sctl buffer
101 * return 0 on success or != 0 on failure */
102int ssl_sock_load_sctl_from_file(const char *sctl_path, char *buf, struct cert_key_and_chain *ckch, char **err)
103{
104 int fd = -1;
105 int r = 0;
106 int ret = 1;
107 struct buffer tmp;
108 struct buffer *src;
109 struct buffer *sctl;
110
111 if (buf) {
William Lallemand8d673942021-01-27 14:58:51 +0100112 chunk_initstr(&tmp, buf);
William Lallemand03c331c2020-05-13 10:10:01 +0200113 src = &tmp;
114 } else {
115 fd = open(sctl_path, O_RDONLY);
116 if (fd == -1)
117 goto end;
118
119 trash.data = 0;
120 while (trash.data < trash.size) {
121 r = read(fd, trash.area + trash.data, trash.size - trash.data);
122 if (r < 0) {
123 if (errno == EINTR)
124 continue;
125 goto end;
126 }
127 else if (r == 0) {
128 break;
129 }
130 trash.data += r;
131 }
132 src = &trash;
133 }
134
135 ret = ssl_sock_parse_sctl(src);
136 if (ret)
137 goto end;
138
139 sctl = calloc(1, sizeof(*sctl));
140 if (!chunk_dup(sctl, src)) {
Willy Tarreau61cfdf42021-02-20 10:46:51 +0100141 ha_free(&sctl);
William Lallemand03c331c2020-05-13 10:10:01 +0200142 goto end;
143 }
144 /* no error, fill ckch with new context, old context must be free */
145 if (ckch->sctl) {
Willy Tarreau61cfdf42021-02-20 10:46:51 +0100146 ha_free(&ckch->sctl->area);
William Lallemand03c331c2020-05-13 10:10:01 +0200147 free(ckch->sctl);
148 }
149 ckch->sctl = sctl;
150 ret = 0;
151end:
152 if (fd != -1)
153 close(fd);
154
155 return ret;
156}
157
158#if ((defined SSL_CTRL_SET_TLSEXT_STATUS_REQ_CB && !defined OPENSSL_NO_OCSP) || defined OPENSSL_IS_BORINGSSL)
159/*
Ilya Shipitsin46a030c2020-07-05 16:36:08 +0500160 * This function load the OCSP Response in DER format contained in file at
William Lallemand03c331c2020-05-13 10:10:01 +0200161 * path 'ocsp_path' or base64 in a buffer <buf>
162 *
163 * Returns 0 on success, 1 in error case.
164 */
165int ssl_sock_load_ocsp_response_from_file(const char *ocsp_path, char *buf, struct cert_key_and_chain *ckch, char **err)
166{
167 int fd = -1;
168 int r = 0;
169 int ret = 1;
170 struct buffer *ocsp_response;
171 struct buffer *src = NULL;
172
173 if (buf) {
174 int i, j;
175 /* if it's from a buffer it will be base64 */
176
177 /* remove \r and \n from the payload */
178 for (i = 0, j = 0; buf[i]; i++) {
179 if (buf[i] == '\r' || buf[i] == '\n')
180 continue;
181 buf[j++] = buf[i];
182 }
183 buf[j] = 0;
184
185 ret = base64dec(buf, j, trash.area, trash.size);
186 if (ret < 0) {
187 memprintf(err, "Error reading OCSP response in base64 format");
188 goto end;
189 }
190 trash.data = ret;
191 src = &trash;
192 } else {
193 fd = open(ocsp_path, O_RDONLY);
194 if (fd == -1) {
195 memprintf(err, "Error opening OCSP response file");
196 goto end;
197 }
198
199 trash.data = 0;
200 while (trash.data < trash.size) {
201 r = read(fd, trash.area + trash.data, trash.size - trash.data);
202 if (r < 0) {
203 if (errno == EINTR)
204 continue;
205
206 memprintf(err, "Error reading OCSP response from file");
207 goto end;
208 }
209 else if (r == 0) {
210 break;
211 }
212 trash.data += r;
213 }
214 close(fd);
215 fd = -1;
216 src = &trash;
217 }
218
219 ocsp_response = calloc(1, sizeof(*ocsp_response));
220 if (!chunk_dup(ocsp_response, src)) {
Willy Tarreau61cfdf42021-02-20 10:46:51 +0100221 ha_free(&ocsp_response);
William Lallemand03c331c2020-05-13 10:10:01 +0200222 goto end;
223 }
224 /* no error, fill ckch with new context, old context must be free */
225 if (ckch->ocsp_response) {
Willy Tarreau61cfdf42021-02-20 10:46:51 +0100226 ha_free(&ckch->ocsp_response->area);
William Lallemand03c331c2020-05-13 10:10:01 +0200227 free(ckch->ocsp_response);
228 }
229 ckch->ocsp_response = ocsp_response;
230 ret = 0;
231end:
232 if (fd != -1)
233 close(fd);
234
235 return ret;
236}
237#endif
238
239/*
240 * Try to load in a ckch every files related to a ckch.
241 * (PEM, sctl, ocsp, issuer etc.)
242 *
243 * This function is only used to load files during the configuration parsing,
244 * it is not used with the CLI.
245 *
246 * This allows us to carry the contents of the file without having to read the
247 * file multiple times. The caller must call
248 * ssl_sock_free_cert_key_and_chain_contents.
249 *
250 * returns:
251 * 0 on Success
252 * 1 on SSL Failure
253 */
254int ssl_sock_load_files_into_ckch(const char *path, struct cert_key_and_chain *ckch, char **err)
255{
William Lallemand8e8581e2020-10-20 17:36:46 +0200256 struct buffer *fp = NULL;
William Lallemand03c331c2020-05-13 10:10:01 +0200257 int ret = 1;
258
259 /* try to load the PEM */
260 if (ssl_sock_load_pem_into_ckch(path, NULL, ckch , err) != 0) {
261 goto end;
262 }
263
William Lallemand8e8581e2020-10-20 17:36:46 +0200264 fp = alloc_trash_chunk();
265 if (!fp) {
266 memprintf(err, "%sCan't allocate memory\n", err && *err ? *err : "");
267 goto end;
268 }
269
270 if (!chunk_strcpy(fp, path) || (b_data(fp) > MAXPATHLEN)) {
271 memprintf(err, "%s '%s' filename too long'.\n",
272 err && *err ? *err : "", fp->area);
273 ret = 1;
274 goto end;
275 }
276
William Lallemand089c1382020-10-23 17:35:12 +0200277 /* remove the ".crt" extension */
William Lallemand8e8581e2020-10-20 17:36:46 +0200278 if (global_ssl.extra_files_noext) {
279 char *ext;
280
281 /* look for the extension */
282 if ((ext = strrchr(fp->area, '.'))) {
William Lallemand8e8581e2020-10-20 17:36:46 +0200283
Tim Duesterhuse5ff1412021-01-02 22:31:53 +0100284 if (strcmp(ext, ".crt") == 0) {
William Lallemand8e8581e2020-10-20 17:36:46 +0200285 *ext = '\0';
William Lallemand089c1382020-10-23 17:35:12 +0200286 fp->data = strlen(fp->area);
287 }
William Lallemand8e8581e2020-10-20 17:36:46 +0200288 }
289
290 }
291
William Lallemand03c331c2020-05-13 10:10:01 +0200292 /* try to load an external private key if it wasn't in the PEM */
293 if ((ckch->key == NULL) && (global_ssl.extra_files & SSL_GF_KEY)) {
William Lallemand03c331c2020-05-13 10:10:01 +0200294 struct stat st;
295
William Lallemand8e8581e2020-10-20 17:36:46 +0200296
297 if (!chunk_strcat(fp, ".key") || (b_data(fp) > MAXPATHLEN)) {
298 memprintf(err, "%s '%s' filename too long'.\n",
299 err && *err ? *err : "", fp->area);
300 ret = 1;
301 goto end;
302 }
303
304 if (stat(fp->area, &st) == 0) {
305 if (ssl_sock_load_key_into_ckch(fp->area, NULL, ckch, err)) {
William Lallemand03c331c2020-05-13 10:10:01 +0200306 memprintf(err, "%s '%s' is present but cannot be read or parsed'.\n",
William Lallemand8e8581e2020-10-20 17:36:46 +0200307 err && *err ? *err : "", fp->area);
William Lallemand03c331c2020-05-13 10:10:01 +0200308 goto end;
309 }
310 }
William Lallemand03c331c2020-05-13 10:10:01 +0200311
William Lallemand8e8581e2020-10-20 17:36:46 +0200312 if (ckch->key == NULL) {
313 memprintf(err, "%sNo Private Key found in '%s'.\n", err && *err ? *err : "", fp->area);
314 goto end;
315 }
316 /* remove the added extension */
317 *(fp->area + fp->data - strlen(".key")) = '\0';
318 b_sub(fp, strlen(".key"));
William Lallemand03c331c2020-05-13 10:10:01 +0200319 }
320
321 if (!X509_check_private_key(ckch->cert, ckch->key)) {
322 memprintf(err, "%sinconsistencies between private key and certificate loaded '%s'.\n",
323 err && *err ? *err : "", path);
324 goto end;
325 }
326
Ilya Shipitsinc47d6762021-02-13 11:45:33 +0500327#ifdef HAVE_SSL_SCTL
William Lallemand03c331c2020-05-13 10:10:01 +0200328 /* try to load the sctl file */
329 if (global_ssl.extra_files & SSL_GF_SCTL) {
William Lallemand03c331c2020-05-13 10:10:01 +0200330 struct stat st;
331
William Lallemand8e8581e2020-10-20 17:36:46 +0200332 if (!chunk_strcat(fp, ".sctl") || b_data(fp) > MAXPATHLEN) {
333 memprintf(err, "%s '%s' filename too long'.\n",
334 err && *err ? *err : "", fp->area);
335 ret = 1;
336 goto end;
337 }
338
339 if (stat(fp->area, &st) == 0) {
340 if (ssl_sock_load_sctl_from_file(fp->area, NULL, ckch, err)) {
William Lallemand03c331c2020-05-13 10:10:01 +0200341 memprintf(err, "%s '%s.sctl' is present but cannot be read or parsed'.\n",
William Lallemand8e8581e2020-10-20 17:36:46 +0200342 err && *err ? *err : "", fp->area);
William Lallemand03c331c2020-05-13 10:10:01 +0200343 ret = 1;
344 goto end;
345 }
346 }
William Lallemand8e8581e2020-10-20 17:36:46 +0200347 /* remove the added extension */
348 *(fp->area + fp->data - strlen(".sctl")) = '\0';
349 b_sub(fp, strlen(".sctl"));
William Lallemand03c331c2020-05-13 10:10:01 +0200350 }
351#endif
352
353 /* try to load an ocsp response file */
354 if (global_ssl.extra_files & SSL_GF_OCSP) {
William Lallemand03c331c2020-05-13 10:10:01 +0200355 struct stat st;
356
William Lallemand8e8581e2020-10-20 17:36:46 +0200357 if (!chunk_strcat(fp, ".ocsp") || b_data(fp) > MAXPATHLEN) {
358 memprintf(err, "%s '%s' filename too long'.\n",
359 err && *err ? *err : "", fp->area);
360 ret = 1;
361 goto end;
362 }
363
364 if (stat(fp->area, &st) == 0) {
365 if (ssl_sock_load_ocsp_response_from_file(fp->area, NULL, ckch, err)) {
William Lallemand03c331c2020-05-13 10:10:01 +0200366 ret = 1;
367 goto end;
368 }
369 }
William Lallemand8e8581e2020-10-20 17:36:46 +0200370 /* remove the added extension */
371 *(fp->area + fp->data - strlen(".ocsp")) = '\0';
372 b_sub(fp, strlen(".ocsp"));
William Lallemand03c331c2020-05-13 10:10:01 +0200373 }
374
375#ifndef OPENSSL_IS_BORINGSSL /* Useless for BoringSSL */
376 if (ckch->ocsp_response && (global_ssl.extra_files & SSL_GF_OCSP_ISSUER)) {
377 /* if no issuer was found, try to load an issuer from the .issuer */
378 if (!ckch->ocsp_issuer) {
379 struct stat st;
William Lallemand8e8581e2020-10-20 17:36:46 +0200380
381 if (!chunk_strcat(fp, ".issuer") || b_data(fp) > MAXPATHLEN) {
382 memprintf(err, "%s '%s' filename too long'.\n",
383 err && *err ? *err : "", fp->area);
384 ret = 1;
385 goto end;
386 }
William Lallemand03c331c2020-05-13 10:10:01 +0200387
William Lallemand8e8581e2020-10-20 17:36:46 +0200388 if (stat(fp->area, &st) == 0) {
389 if (ssl_sock_load_issuer_file_into_ckch(fp->area, NULL, ckch, err)) {
William Lallemand03c331c2020-05-13 10:10:01 +0200390 ret = 1;
391 goto end;
392 }
393
394 if (X509_check_issued(ckch->ocsp_issuer, ckch->cert) != X509_V_OK) {
395 memprintf(err, "%s '%s' is not an issuer'.\n",
William Lallemand8e8581e2020-10-20 17:36:46 +0200396 err && *err ? *err : "", fp->area);
William Lallemand03c331c2020-05-13 10:10:01 +0200397 ret = 1;
398 goto end;
399 }
400 }
William Lallemand8e8581e2020-10-20 17:36:46 +0200401 /* remove the added extension */
402 *(fp->area + fp->data - strlen(".issuer")) = '\0';
403 b_sub(fp, strlen(".issuer"));
William Lallemand03c331c2020-05-13 10:10:01 +0200404 }
405 }
406#endif
407
408 ret = 0;
409
410end:
411
412 ERR_clear_error();
413
414 /* Something went wrong in one of the reads */
415 if (ret != 0)
416 ssl_sock_free_cert_key_and_chain_contents(ckch);
417
William Lallemand8e8581e2020-10-20 17:36:46 +0200418 free_trash_chunk(fp);
419
William Lallemand03c331c2020-05-13 10:10:01 +0200420 return ret;
421}
422
423/*
424 * Try to load a private key file from a <path> or a buffer <buf>
425 *
426 * If it failed you should not attempt to use the ckch but free it.
427 *
428 * Return 0 on success or != 0 on failure
429 */
430int ssl_sock_load_key_into_ckch(const char *path, char *buf, struct cert_key_and_chain *ckch , char **err)
431{
432 BIO *in = NULL;
433 int ret = 1;
434 EVP_PKEY *key = NULL;
435
436 if (buf) {
437 /* reading from a buffer */
438 in = BIO_new_mem_buf(buf, -1);
439 if (in == NULL) {
440 memprintf(err, "%sCan't allocate memory\n", err && *err ? *err : "");
441 goto end;
442 }
443
444 } else {
445 /* reading from a file */
446 in = BIO_new(BIO_s_file());
447 if (in == NULL)
448 goto end;
449
450 if (BIO_read_filename(in, path) <= 0)
451 goto end;
452 }
453
454 /* Read Private Key */
455 key = PEM_read_bio_PrivateKey(in, NULL, NULL, NULL);
456 if (key == NULL) {
457 memprintf(err, "%sunable to load private key from file '%s'.\n",
458 err && *err ? *err : "", path);
459 goto end;
460 }
461
462 ret = 0;
463
464 SWAP(ckch->key, key);
465
466end:
467
468 ERR_clear_error();
469 if (in)
470 BIO_free(in);
471 if (key)
472 EVP_PKEY_free(key);
473
474 return ret;
475}
476
477/*
478 * Try to load a PEM file from a <path> or a buffer <buf>
479 * The PEM must contain at least a Certificate,
480 * It could contain a DH, a certificate chain and a PrivateKey.
481 *
482 * If it failed you should not attempt to use the ckch but free it.
483 *
484 * Return 0 on success or != 0 on failure
485 */
486int ssl_sock_load_pem_into_ckch(const char *path, char *buf, struct cert_key_and_chain *ckch , char **err)
487{
488 BIO *in = NULL;
489 int ret = 1;
490 X509 *ca;
491 X509 *cert = NULL;
492 EVP_PKEY *key = NULL;
493 DH *dh = NULL;
494 STACK_OF(X509) *chain = NULL;
495
496 if (buf) {
497 /* reading from a buffer */
498 in = BIO_new_mem_buf(buf, -1);
499 if (in == NULL) {
500 memprintf(err, "%sCan't allocate memory\n", err && *err ? *err : "");
501 goto end;
502 }
503
504 } else {
505 /* reading from a file */
506 in = BIO_new(BIO_s_file());
507 if (in == NULL) {
508 memprintf(err, "%sCan't allocate memory\n", err && *err ? *err : "");
509 goto end;
510 }
511
512 if (BIO_read_filename(in, path) <= 0) {
513 memprintf(err, "%scannot open the file '%s'.\n",
514 err && *err ? *err : "", path);
515 goto end;
516 }
517 }
518
519 /* Read Private Key */
520 key = PEM_read_bio_PrivateKey(in, NULL, NULL, NULL);
521 /* no need to check for errors here, because the private key could be loaded later */
522
523#ifndef OPENSSL_NO_DH
524 /* Seek back to beginning of file */
525 if (BIO_reset(in) == -1) {
526 memprintf(err, "%san error occurred while reading the file '%s'.\n",
527 err && *err ? *err : "", path);
528 goto end;
529 }
530
531 dh = PEM_read_bio_DHparams(in, NULL, NULL, NULL);
532 /* no need to return an error there, dh is not mandatory */
533#endif
534
535 /* Seek back to beginning of file */
536 if (BIO_reset(in) == -1) {
537 memprintf(err, "%san error occurred while reading the file '%s'.\n",
538 err && *err ? *err : "", path);
539 goto end;
540 }
541
542 /* Read Certificate */
543 cert = PEM_read_bio_X509_AUX(in, NULL, NULL, NULL);
544 if (cert == NULL) {
545 memprintf(err, "%sunable to load certificate from file '%s'.\n",
546 err && *err ? *err : "", path);
547 goto end;
548 }
549
550 /* Look for a Certificate Chain */
551 while ((ca = PEM_read_bio_X509(in, NULL, NULL, NULL))) {
552 if (chain == NULL)
553 chain = sk_X509_new_null();
554 if (!sk_X509_push(chain, ca)) {
555 X509_free(ca);
556 goto end;
557 }
558 }
559
560 ret = ERR_get_error();
561 if (ret && (ERR_GET_LIB(ret) != ERR_LIB_PEM && ERR_GET_REASON(ret) != PEM_R_NO_START_LINE)) {
562 memprintf(err, "%sunable to load certificate chain from file '%s'.\n",
563 err && *err ? *err : "", path);
564 goto end;
565 }
566
567 /* once it loaded the PEM, it should remove everything else in the ckch */
568 if (ckch->ocsp_response) {
Willy Tarreau61cfdf42021-02-20 10:46:51 +0100569 ha_free(&ckch->ocsp_response->area);
570 ha_free(&ckch->ocsp_response);
William Lallemand03c331c2020-05-13 10:10:01 +0200571 }
572
573 if (ckch->sctl) {
Willy Tarreau61cfdf42021-02-20 10:46:51 +0100574 ha_free(&ckch->sctl->area);
575 ha_free(&ckch->sctl);
William Lallemand03c331c2020-05-13 10:10:01 +0200576 }
577
578 if (ckch->ocsp_issuer) {
579 X509_free(ckch->ocsp_issuer);
580 ckch->ocsp_issuer = NULL;
581 }
582
583 /* no error, fill ckch with new context, old context will be free at end: */
584 SWAP(ckch->key, key);
585 SWAP(ckch->dh, dh);
586 SWAP(ckch->cert, cert);
587 SWAP(ckch->chain, chain);
588
589 ret = 0;
590
591end:
592
593 ERR_clear_error();
594 if (in)
595 BIO_free(in);
596 if (key)
597 EVP_PKEY_free(key);
598 if (dh)
599 DH_free(dh);
600 if (cert)
601 X509_free(cert);
602 if (chain)
603 sk_X509_pop_free(chain, X509_free);
604
605 return ret;
606}
607
608/* Frees the contents of a cert_key_and_chain
609 */
610void ssl_sock_free_cert_key_and_chain_contents(struct cert_key_and_chain *ckch)
611{
612 if (!ckch)
613 return;
614
615 /* Free the certificate and set pointer to NULL */
616 if (ckch->cert)
617 X509_free(ckch->cert);
618 ckch->cert = NULL;
619
620 /* Free the key and set pointer to NULL */
621 if (ckch->key)
622 EVP_PKEY_free(ckch->key);
623 ckch->key = NULL;
624
625 /* Free each certificate in the chain */
626 if (ckch->chain)
627 sk_X509_pop_free(ckch->chain, X509_free);
628 ckch->chain = NULL;
629
630 if (ckch->dh)
631 DH_free(ckch->dh);
632 ckch->dh = NULL;
633
634 if (ckch->sctl) {
Willy Tarreau61cfdf42021-02-20 10:46:51 +0100635 ha_free(&ckch->sctl->area);
636 ha_free(&ckch->sctl);
William Lallemand03c331c2020-05-13 10:10:01 +0200637 }
638
639 if (ckch->ocsp_response) {
Willy Tarreau61cfdf42021-02-20 10:46:51 +0100640 ha_free(&ckch->ocsp_response->area);
641 ha_free(&ckch->ocsp_response);
William Lallemand03c331c2020-05-13 10:10:01 +0200642 }
643
644 if (ckch->ocsp_issuer)
645 X509_free(ckch->ocsp_issuer);
646 ckch->ocsp_issuer = NULL;
647}
648
649/*
650 *
651 * This function copy a cert_key_and_chain in memory
652 *
653 * It's used to try to apply changes on a ckch before committing them, because
654 * most of the time it's not possible to revert those changes
655 *
656 * Return a the dst or NULL
657 */
658struct cert_key_and_chain *ssl_sock_copy_cert_key_and_chain(struct cert_key_and_chain *src,
659 struct cert_key_and_chain *dst)
660{
William Lallemand6c096142021-02-23 14:45:45 +0100661 if (!src || !dst)
662 return NULL;
663
William Lallemand03c331c2020-05-13 10:10:01 +0200664 if (src->cert) {
665 dst->cert = src->cert;
666 X509_up_ref(src->cert);
667 }
668
669 if (src->key) {
670 dst->key = src->key;
671 EVP_PKEY_up_ref(src->key);
672 }
673
674 if (src->chain) {
675 dst->chain = X509_chain_up_ref(src->chain);
676 }
677
678 if (src->dh) {
679 DH_up_ref(src->dh);
680 dst->dh = src->dh;
681 }
682
683 if (src->sctl) {
684 struct buffer *sctl;
685
686 sctl = calloc(1, sizeof(*sctl));
687 if (!chunk_dup(sctl, src->sctl)) {
Willy Tarreau61cfdf42021-02-20 10:46:51 +0100688 ha_free(&sctl);
William Lallemand03c331c2020-05-13 10:10:01 +0200689 goto error;
690 }
691 dst->sctl = sctl;
692 }
693
694 if (src->ocsp_response) {
695 struct buffer *ocsp_response;
696
697 ocsp_response = calloc(1, sizeof(*ocsp_response));
698 if (!chunk_dup(ocsp_response, src->ocsp_response)) {
Willy Tarreau61cfdf42021-02-20 10:46:51 +0100699 ha_free(&ocsp_response);
William Lallemand03c331c2020-05-13 10:10:01 +0200700 goto error;
701 }
702 dst->ocsp_response = ocsp_response;
703 }
704
705 if (src->ocsp_issuer) {
706 X509_up_ref(src->ocsp_issuer);
707 dst->ocsp_issuer = src->ocsp_issuer;
708 }
709
710 return dst;
711
712error:
713
714 /* free everything */
715 ssl_sock_free_cert_key_and_chain_contents(dst);
716
717 return NULL;
718}
719
720/*
721 * return 0 on success or != 0 on failure
722 */
723int ssl_sock_load_issuer_file_into_ckch(const char *path, char *buf, struct cert_key_and_chain *ckch, char **err)
724{
725 int ret = 1;
726 BIO *in = NULL;
727 X509 *issuer;
728
729 if (buf) {
730 /* reading from a buffer */
731 in = BIO_new_mem_buf(buf, -1);
732 if (in == NULL) {
733 memprintf(err, "%sCan't allocate memory\n", err && *err ? *err : "");
734 goto end;
735 }
736
737 } else {
738 /* reading from a file */
739 in = BIO_new(BIO_s_file());
740 if (in == NULL)
741 goto end;
742
743 if (BIO_read_filename(in, path) <= 0)
744 goto end;
745 }
746
747 issuer = PEM_read_bio_X509_AUX(in, NULL, NULL, NULL);
748 if (!issuer) {
749 memprintf(err, "%s'%s' cannot be read or parsed'.\n",
750 err && *err ? *err : "", path);
751 goto end;
752 }
753 /* no error, fill ckch with new context, old context must be free */
754 if (ckch->ocsp_issuer)
755 X509_free(ckch->ocsp_issuer);
756 ckch->ocsp_issuer = issuer;
757 ret = 0;
758
759end:
760
761 ERR_clear_error();
762 if (in)
763 BIO_free(in);
764
765 return ret;
766}
767
768/******************** ckch_store functions ***********************************
769 * The ckch_store is a structure used to cache and index the SSL files used in
770 * configuration
771 */
772
773/*
774 * Free a ckch_store, its ckch, its instances and remove it from the ebtree
775 */
776void ckch_store_free(struct ckch_store *store)
777{
778 struct ckch_inst *inst, *inst_s;
779
780 if (!store)
781 return;
782
William Lallemandbd8e6ed2020-09-16 16:08:08 +0200783 ssl_sock_free_cert_key_and_chain_contents(store->ckch);
William Lallemand03c331c2020-05-13 10:10:01 +0200784
Willy Tarreau61cfdf42021-02-20 10:46:51 +0100785 ha_free(&store->ckch);
William Lallemand03c331c2020-05-13 10:10:01 +0200786
787 list_for_each_entry_safe(inst, inst_s, &store->ckch_inst, by_ckchs) {
788 ckch_inst_free(inst);
789 }
790 ebmb_delete(&store->node);
791 free(store);
792}
793
794/*
795 * create and initialize a ckch_store
796 * <path> is the key name
797 * <nmemb> is the number of store->ckch objects to allocate
798 *
799 * Return a ckch_store or NULL upon failure.
800 */
William Lallemandbd8e6ed2020-09-16 16:08:08 +0200801struct ckch_store *ckch_store_new(const char *filename)
William Lallemand03c331c2020-05-13 10:10:01 +0200802{
803 struct ckch_store *store;
804 int pathlen;
805
806 pathlen = strlen(filename);
807 store = calloc(1, sizeof(*store) + pathlen + 1);
808 if (!store)
809 return NULL;
810
William Lallemand03c331c2020-05-13 10:10:01 +0200811 memcpy(store->path, filename, pathlen + 1);
812
813 LIST_INIT(&store->ckch_inst);
814 LIST_INIT(&store->crtlist_entry);
815
William Lallemandbd8e6ed2020-09-16 16:08:08 +0200816 store->ckch = calloc(1, sizeof(*store->ckch));
William Lallemand03c331c2020-05-13 10:10:01 +0200817 if (!store->ckch)
818 goto error;
819
820 return store;
821error:
822 ckch_store_free(store);
823 return NULL;
824}
825
826/* allocate and duplicate a ckch_store
827 * Return a new ckch_store or NULL */
828struct ckch_store *ckchs_dup(const struct ckch_store *src)
829{
830 struct ckch_store *dst;
831
William Lallemand6c096142021-02-23 14:45:45 +0100832 if (!src)
833 return NULL;
834
William Lallemandbd8e6ed2020-09-16 16:08:08 +0200835 dst = ckch_store_new(src->path);
Eric Salama6ac61e32021-02-23 16:50:57 +0100836 if (!dst)
837 return NULL;
William Lallemand03c331c2020-05-13 10:10:01 +0200838
William Lallemandbd8e6ed2020-09-16 16:08:08 +0200839 if (!ssl_sock_copy_cert_key_and_chain(src->ckch, dst->ckch))
840 goto error;
William Lallemand03c331c2020-05-13 10:10:01 +0200841
842 return dst;
843
844error:
845 ckch_store_free(dst);
846
847 return NULL;
848}
849
850/*
851 * lookup a path into the ckchs tree.
852 */
853struct ckch_store *ckchs_lookup(char *path)
854{
855 struct ebmb_node *eb;
856
857 eb = ebst_lookup(&ckchs_tree, path);
858 if (!eb)
859 return NULL;
860
861 return ebmb_entry(eb, struct ckch_store, node);
862}
863
864/*
865 * This function allocate a ckch_store and populate it with certificates from files.
866 */
William Lallemandbd8e6ed2020-09-16 16:08:08 +0200867struct ckch_store *ckchs_load_cert_file(char *path, char **err)
William Lallemand03c331c2020-05-13 10:10:01 +0200868{
869 struct ckch_store *ckchs;
870
William Lallemandbd8e6ed2020-09-16 16:08:08 +0200871 ckchs = ckch_store_new(path);
William Lallemand03c331c2020-05-13 10:10:01 +0200872 if (!ckchs) {
873 memprintf(err, "%sunable to allocate memory.\n", err && *err ? *err : "");
874 goto end;
875 }
William Lallemand03c331c2020-05-13 10:10:01 +0200876
William Lallemandbd8e6ed2020-09-16 16:08:08 +0200877 if (ssl_sock_load_files_into_ckch(path, ckchs->ckch, err) == 1)
878 goto end;
William Lallemand03c331c2020-05-13 10:10:01 +0200879
William Lallemandbd8e6ed2020-09-16 16:08:08 +0200880 /* insert into the ckchs tree */
881 memcpy(ckchs->path, path, strlen(path) + 1);
882 ebst_insert(&ckchs_tree, &ckchs->node);
William Lallemand03c331c2020-05-13 10:10:01 +0200883 return ckchs;
884
885end:
886 ckch_store_free(ckchs);
887
888 return NULL;
889}
890
William Lallemandfa1d8b42020-05-13 15:46:10 +0200891
892/******************** ckch_inst functions ******************************/
893
894/* unlink a ckch_inst, free all SNIs, free the ckch_inst */
895/* The caller must use the lock of the bind_conf if used with inserted SNIs */
896void ckch_inst_free(struct ckch_inst *inst)
897{
898 struct sni_ctx *sni, *sni_s;
Remi Tricot-Le Breton4458b972021-02-19 17:41:55 +0100899 struct ckch_inst_link_ref *link_ref, *link_ref_s;
William Lallemandfa1d8b42020-05-13 15:46:10 +0200900
901 if (inst == NULL)
902 return;
903
904 list_for_each_entry_safe(sni, sni_s, &inst->sni_ctx, by_ckch_inst) {
905 SSL_CTX_free(sni->ctx);
Willy Tarreau2b718102021-04-21 07:32:39 +0200906 LIST_DELETE(&sni->by_ckch_inst);
William Lallemandfa1d8b42020-05-13 15:46:10 +0200907 ebmb_delete(&sni->name);
908 free(sni);
909 }
Remi Tricot-Le Bretonf3eedfe2021-01-25 17:19:44 +0100910 SSL_CTX_free(inst->ctx);
911 inst->ctx = NULL;
Willy Tarreau2b718102021-04-21 07:32:39 +0200912 LIST_DELETE(&inst->by_ckchs);
913 LIST_DELETE(&inst->by_crtlist_entry);
Remi Tricot-Le Breton4458b972021-02-19 17:41:55 +0100914
915 list_for_each_entry_safe(link_ref, link_ref_s, &inst->cafile_link_refs, list) {
916 LIST_DELETE(&link_ref->link->list);
917 LIST_DELETE(&link_ref->list);
918 free(link_ref);
919 }
920
William Lallemandfa1d8b42020-05-13 15:46:10 +0200921 free(inst);
922}
923
924/* Alloc and init a ckch_inst */
925struct ckch_inst *ckch_inst_new()
926{
927 struct ckch_inst *ckch_inst;
928
929 ckch_inst = calloc(1, sizeof *ckch_inst);
930 if (!ckch_inst)
931 return NULL;
932
933 LIST_INIT(&ckch_inst->sni_ctx);
934 LIST_INIT(&ckch_inst->by_ckchs);
935 LIST_INIT(&ckch_inst->by_crtlist_entry);
Remi Tricot-Le Breton4458b972021-02-19 17:41:55 +0100936 LIST_INIT(&ckch_inst->cafile_link_refs);
William Lallemandfa1d8b42020-05-13 15:46:10 +0200937
938 return ckch_inst;
939}
940
Remi Tricot-Le Bretonaf8820a2021-04-13 10:10:37 +0200941
942/******************** ssl_store functions ******************************/
Remi Tricot-Le Breton9f0c9362021-02-19 15:06:28 +0100943struct eb_root cafile_tree = EB_ROOT;
Remi Tricot-Le Bretonaf8820a2021-04-13 10:10:37 +0200944
Remi Tricot-Le Breton9f0c9362021-02-19 15:06:28 +0100945/*
946 * Returns the cafile_entry found in the cafile_tree indexed by the path 'path'.
947 * If 'oldest_entry' is 1, returns the "original" cafile_entry (since
948 * during a set cafile/commit cafile cycle there might be two entries for any
949 * given path, the original one and the new one set via the CLI but not
950 * committed yet).
951 */
Remi Tricot-Le Breton4458b972021-02-19 17:41:55 +0100952struct cafile_entry *ssl_store_get_cafile_entry(char *path, int oldest_entry)
Remi Tricot-Le Bretonaf8820a2021-04-13 10:10:37 +0200953{
Remi Tricot-Le Breton9f0c9362021-02-19 15:06:28 +0100954 struct cafile_entry *ca_e = NULL;
Remi Tricot-Le Bretonaf8820a2021-04-13 10:10:37 +0200955 struct ebmb_node *eb;
956
957 eb = ebst_lookup(&cafile_tree, path);
Remi Tricot-Le Breton9f0c9362021-02-19 15:06:28 +0100958 while (eb) {
Remi Tricot-Le Bretonaf8820a2021-04-13 10:10:37 +0200959 ca_e = ebmb_entry(eb, struct cafile_entry, node);
Remi Tricot-Le Breton9f0c9362021-02-19 15:06:28 +0100960 /* The ebst_lookup in a tree that has duplicates returns the
961 * oldest entry first. If we want the latest entry, we need to
962 * iterate over all the duplicates until we find the last one
963 * (in our case there should never be more than two entries for
964 * any given path). */
965 if (oldest_entry)
966 return ca_e;
967 eb = ebmb_next_dup(eb);
Remi Tricot-Le Bretonaf8820a2021-04-13 10:10:37 +0200968 }
Remi Tricot-Le Breton9f0c9362021-02-19 15:06:28 +0100969 return ca_e;
970}
971
Remi Tricot-Le Breton38c999b2021-02-23 16:28:43 +0100972int ssl_store_add_uncommitted_cafile_entry(struct cafile_entry *entry)
973{
974 return (ebst_insert(&cafile_tree, &entry->node) != &entry->node);
975}
976
Remi Tricot-Le Breton9f0c9362021-02-19 15:06:28 +0100977X509_STORE* ssl_store_get0_locations_file(char *path)
978{
979 struct cafile_entry *ca_e = ssl_store_get_cafile_entry(path, 0);
980
981 if (ca_e)
982 return ca_e->ca_store;
983
Remi Tricot-Le Bretonaf8820a2021-04-13 10:10:37 +0200984 return NULL;
985}
986
Remi Tricot-Le Breton5daff3c2021-02-22 15:54:55 +0100987/* Create a cafile_entry object, without adding it to the cafile_tree. */
988struct cafile_entry *ssl_store_create_cafile_entry(char *path, X509_STORE *store)
989{
990 struct cafile_entry *ca_e;
991 int pathlen;
992
993 pathlen = strlen(path);
994
995 ca_e = calloc(1, sizeof(*ca_e) + pathlen + 1);
996 if (ca_e) {
997 memcpy(ca_e->path, path, pathlen + 1);
998 ca_e->ca_store = store;
999 LIST_INIT(&ca_e->ckch_inst_link);
1000 }
1001 return ca_e;
1002}
1003
1004/* Delete a cafile_entry. The caller is responsible from removing this entry
1005 * from the cafile_tree first if is was previously added into it. */
1006void ssl_store_delete_cafile_entry(struct cafile_entry *ca_e)
1007{
1008 struct ckch_inst_link *link, *link_s;
1009 if (!ca_e)
1010 return;
1011
1012 X509_STORE_free(ca_e->ca_store);
1013
1014 list_for_each_entry_safe(link, link_s, &ca_e->ckch_inst_link, list) {
1015 struct ckch_inst *inst = link->ckch_inst;
1016 struct ckch_inst_link_ref *link_ref, *link_ref_s;
1017 list_for_each_entry_safe(link_ref, link_ref_s, &inst->cafile_link_refs, list) {
1018 if (link_ref->link == link) {
1019 LIST_DELETE(&link_ref->list);
1020 free(link_ref);
1021 break;
1022 }
1023 }
1024 LIST_DELETE(&link->list);
1025 free(link);
1026 }
1027
1028 free(ca_e);
1029}
1030
Remi Tricot-Le Breton383fb142021-02-22 18:26:14 +01001031/*
1032 * Build a cafile_entry out of a buffer instead of out of a file.
1033 * This function is used when the "commit ssl ca-file" cli command is used.
1034 * It can parse CERTIFICATE sections as well as CRL ones.
1035 * Returns 0 in case of success, 1 otherwise.
1036 */
1037int ssl_store_load_ca_from_buf(struct cafile_entry *ca_e, char *cert_buf)
1038{
1039 int retval = 0;
1040
1041 if (!ca_e)
1042 return 1;
1043
1044 if (!ca_e->ca_store) {
1045 ca_e->ca_store = X509_STORE_new();
1046 if (ca_e->ca_store) {
1047 BIO *bio = BIO_new_mem_buf(cert_buf, strlen(cert_buf));
1048 if (bio) {
1049 X509_INFO *info;
1050 int i;
1051 STACK_OF(X509_INFO) *infos = PEM_X509_INFO_read_bio(bio, NULL, NULL, NULL);
1052 if (!infos)
1053 {
1054 BIO_free(bio);
1055 return 1;
1056 }
1057
1058 for (i = 0; i < sk_X509_INFO_num(infos) && !retval; i++) {
1059 info = sk_X509_INFO_value(infos, i);
1060 /* X509_STORE_add_cert and X509_STORE_add_crl return 1 on success */
1061 if (info->x509) {
1062 retval = !X509_STORE_add_cert(ca_e->ca_store, info->x509);
1063 }
1064 if (!retval && info->crl) {
1065 retval = !X509_STORE_add_crl(ca_e->ca_store, info->crl);
1066 }
1067 }
1068 retval = retval || (i != sk_X509_INFO_num(infos));
1069
1070 /* Cleanup */
1071 sk_X509_INFO_pop_free(infos, X509_INFO_free);
1072 BIO_free(bio);
1073 }
1074 }
1075 }
1076
1077 return retval;
1078}
1079
Remi Tricot-Le Bretonaf8820a2021-04-13 10:10:37 +02001080int ssl_store_load_locations_file(char *path, int create_if_none)
1081{
1082 X509_STORE *store = ssl_store_get0_locations_file(path);
1083
1084 /* If this function is called by the CLI, we should not call the
1085 * X509_STORE_load_locations function because it performs forbidden disk
1086 * accesses. */
1087 if (!store && create_if_none) {
1088 struct cafile_entry *ca_e;
1089 store = X509_STORE_new();
1090 if (X509_STORE_load_locations(store, path, NULL)) {
Remi Tricot-Le Breton5daff3c2021-02-22 15:54:55 +01001091 ca_e = ssl_store_create_cafile_entry(path, store);
Remi Tricot-Le Bretonaf8820a2021-04-13 10:10:37 +02001092 if (ca_e) {
Remi Tricot-Le Bretonaf8820a2021-04-13 10:10:37 +02001093 ebst_insert(&cafile_tree, &ca_e->node);
1094 }
1095 } else {
1096 X509_STORE_free(store);
1097 store = NULL;
1098 }
1099 }
1100 return (store != NULL);
1101}
1102
1103
William Lallemandda8584c2020-05-14 10:14:37 +02001104/*************************** CLI commands ***********************/
1105
1106/* Type of SSL payloads that can be updated over the CLI */
1107
1108enum {
1109 CERT_TYPE_PEM = 0,
1110 CERT_TYPE_KEY,
1111#if ((defined SSL_CTRL_SET_TLSEXT_STATUS_REQ_CB && !defined OPENSSL_NO_OCSP) || defined OPENSSL_IS_BORINGSSL)
1112 CERT_TYPE_OCSP,
1113#endif
1114 CERT_TYPE_ISSUER,
Ilya Shipitsinc47d6762021-02-13 11:45:33 +05001115#ifdef HAVE_SSL_SCTL
William Lallemandda8584c2020-05-14 10:14:37 +02001116 CERT_TYPE_SCTL,
1117#endif
1118 CERT_TYPE_MAX,
1119};
1120
1121struct {
1122 const char *ext;
1123 int type;
1124 int (*load)(const char *path, char *payload, struct cert_key_and_chain *ckch, char **err);
1125 /* add a parsing callback */
1126} cert_exts[CERT_TYPE_MAX+1] = {
1127 [CERT_TYPE_PEM] = { "", CERT_TYPE_PEM, &ssl_sock_load_pem_into_ckch }, /* default mode, no extensions */
1128 [CERT_TYPE_KEY] = { "key", CERT_TYPE_KEY, &ssl_sock_load_key_into_ckch },
1129#if ((defined SSL_CTRL_SET_TLSEXT_STATUS_REQ_CB && !defined OPENSSL_NO_OCSP) || defined OPENSSL_IS_BORINGSSL)
1130 [CERT_TYPE_OCSP] = { "ocsp", CERT_TYPE_OCSP, &ssl_sock_load_ocsp_response_from_file },
1131#endif
Ilya Shipitsinc47d6762021-02-13 11:45:33 +05001132#ifdef HAVE_SSL_SCTL
William Lallemandda8584c2020-05-14 10:14:37 +02001133 [CERT_TYPE_SCTL] = { "sctl", CERT_TYPE_SCTL, &ssl_sock_load_sctl_from_file },
1134#endif
1135 [CERT_TYPE_ISSUER] = { "issuer", CERT_TYPE_ISSUER, &ssl_sock_load_issuer_file_into_ckch },
1136 [CERT_TYPE_MAX] = { NULL, CERT_TYPE_MAX, NULL },
1137};
1138
1139
1140/* release function of the `show ssl cert' command */
1141static void cli_release_show_cert(struct appctx *appctx)
1142{
1143 HA_SPIN_UNLOCK(CKCH_LOCK, &ckch_lock);
1144}
1145
1146/* IO handler of "show ssl cert <filename>" */
1147static int cli_io_handler_show_cert(struct appctx *appctx)
1148{
1149 struct buffer *trash = alloc_trash_chunk();
1150 struct ebmb_node *node;
1151 struct stream_interface *si = appctx->owner;
1152 struct ckch_store *ckchs;
1153
1154 if (trash == NULL)
1155 return 1;
1156
1157 if (!appctx->ctx.ssl.old_ckchs) {
1158 if (ckchs_transaction.old_ckchs) {
1159 ckchs = ckchs_transaction.old_ckchs;
1160 chunk_appendf(trash, "# transaction\n");
William Lallemand5685ccf2020-09-16 16:12:25 +02001161 chunk_appendf(trash, "*%s\n", ckchs->path);
William Lallemandda8584c2020-05-14 10:14:37 +02001162 }
1163 }
1164
1165 if (!appctx->ctx.cli.p0) {
1166 chunk_appendf(trash, "# filename\n");
1167 node = ebmb_first(&ckchs_tree);
1168 } else {
1169 node = &((struct ckch_store *)appctx->ctx.cli.p0)->node;
1170 }
1171 while (node) {
1172 ckchs = ebmb_entry(node, struct ckch_store, node);
William Lallemand5685ccf2020-09-16 16:12:25 +02001173 chunk_appendf(trash, "%s\n", ckchs->path);
William Lallemandda8584c2020-05-14 10:14:37 +02001174
1175 node = ebmb_next(node);
1176 if (ci_putchk(si_ic(si), trash) == -1) {
1177 si_rx_room_blk(si);
1178 goto yield;
1179 }
1180 }
1181
1182 appctx->ctx.cli.p0 = NULL;
1183 free_trash_chunk(trash);
1184 return 1;
1185yield:
1186
1187 free_trash_chunk(trash);
1188 appctx->ctx.cli.p0 = ckchs;
1189 return 0; /* should come back */
1190}
1191
1192/*
1193 * Extract and format the DNS SAN extensions and copy result into a chuink
1194 * Return 0;
1195 */
1196#ifdef SSL_CTRL_SET_TLSEXT_HOSTNAME
1197static int ssl_sock_get_san_oneline(X509 *cert, struct buffer *out)
1198{
1199 int i;
1200 char *str;
1201 STACK_OF(GENERAL_NAME) *names = NULL;
1202
1203 names = X509_get_ext_d2i(cert, NID_subject_alt_name, NULL, NULL);
1204 if (names) {
1205 for (i = 0; i < sk_GENERAL_NAME_num(names); i++) {
1206 GENERAL_NAME *name = sk_GENERAL_NAME_value(names, i);
1207 if (i > 0)
1208 chunk_appendf(out, ", ");
1209 if (name->type == GEN_DNS) {
1210 if (ASN1_STRING_to_UTF8((unsigned char **)&str, name->d.dNSName) >= 0) {
1211 chunk_appendf(out, "DNS:%s", str);
1212 OPENSSL_free(str);
1213 }
1214 }
1215 }
1216 sk_GENERAL_NAME_pop_free(names, GENERAL_NAME_free);
1217 }
1218 return 0;
1219}
1220#endif
1221
Remi Tricot-Le Breton4458b972021-02-19 17:41:55 +01001222/*
1223 * Build the ckch_inst_link that will be chained in the CA file entry and the
1224 * corresponding ckch_inst_link_ref that will be chained in the ckch instance.
1225 * Return 0 in case of success.
1226 */
1227static int do_chain_inst_and_cafile(struct cafile_entry *cafile_entry, struct ckch_inst *ckch_inst)
1228{
1229 struct ckch_inst_link *new_link;
1230 if (!LIST_ISEMPTY(&cafile_entry->ckch_inst_link)) {
1231 struct ckch_inst_link *link = LIST_ELEM(cafile_entry->ckch_inst_link.n,
1232 typeof(link), list);
1233 /* Do not add multiple references to the same
1234 * instance in a cafile_entry */
1235 if (link->ckch_inst == ckch_inst) {
1236 return 1;
1237 }
1238 }
1239
1240 new_link = calloc(1, sizeof(*new_link));
1241 if (new_link) {
1242 struct ckch_inst_link_ref *new_link_ref = calloc(1, sizeof(*new_link_ref));
1243 if (!new_link_ref) {
1244 free(new_link);
1245 return 1;
1246 }
1247
1248 new_link->ckch_inst = ckch_inst;
1249 new_link_ref->link = new_link;
1250 LIST_INIT(&new_link->list);
1251 LIST_INIT(&new_link_ref->list);
1252
1253 LIST_APPEND(&cafile_entry->ckch_inst_link, &new_link->list);
1254 LIST_APPEND(&ckch_inst->cafile_link_refs, &new_link_ref->list);
1255 }
1256
1257 return 0;
1258}
1259
1260
1261/*
1262 * Link a CA file tree entry to the ckch instance that uses it.
1263 * To determine if and which CA file tree entries need to be linked to the
1264 * instance, we follow the same logic performed in ssl_sock_prepare_ctx when
1265 * processing the verify option.
1266 * This function works for a frontend as well as for a backend, depending on the
1267 * configuration parameters given (bind_conf or server).
1268 */
1269void ckch_inst_add_cafile_link(struct ckch_inst *ckch_inst, struct bind_conf *bind_conf,
1270 struct ssl_bind_conf *ssl_conf, const struct server *srv)
1271{
1272 int verify = SSL_VERIFY_NONE;
1273
1274 if (srv) {
1275
1276 if (global.ssl_server_verify == SSL_SERVER_VERIFY_REQUIRED)
1277 verify = SSL_VERIFY_PEER;
1278 switch (srv->ssl_ctx.verify) {
1279 case SSL_SOCK_VERIFY_NONE:
1280 verify = SSL_VERIFY_NONE;
1281 break;
1282 case SSL_SOCK_VERIFY_REQUIRED:
1283 verify = SSL_VERIFY_PEER;
1284 break;
1285 }
1286 }
1287 else {
1288 switch ((ssl_conf && ssl_conf->verify) ? ssl_conf->verify : bind_conf->ssl_conf.verify) {
1289 case SSL_SOCK_VERIFY_NONE:
1290 verify = SSL_VERIFY_NONE;
1291 break;
1292 case SSL_SOCK_VERIFY_OPTIONAL:
1293 verify = SSL_VERIFY_PEER;
1294 break;
1295 case SSL_SOCK_VERIFY_REQUIRED:
1296 verify = SSL_VERIFY_PEER|SSL_VERIFY_FAIL_IF_NO_PEER_CERT;
1297 break;
1298 }
1299 }
1300
1301 if (verify & SSL_VERIFY_PEER) {
1302 struct cafile_entry *ca_file_entry = NULL;
1303 struct cafile_entry *ca_verify_file_entry = NULL;
1304 if (srv) {
1305 if (srv->ssl_ctx.ca_file) {
1306 ca_file_entry = ssl_store_get_cafile_entry(srv->ssl_ctx.ca_file, 0);
1307
1308 }
1309 }
1310 else {
1311 char *ca_file = (ssl_conf && ssl_conf->ca_file) ? ssl_conf->ca_file : bind_conf->ssl_conf.ca_file;
1312 char *ca_verify_file = (ssl_conf && ssl_conf->ca_verify_file) ? ssl_conf->ca_verify_file : bind_conf->ssl_conf.ca_verify_file;
1313
1314 if (ca_file)
1315 ca_file_entry = ssl_store_get_cafile_entry(ca_file, 0);
1316 if (ca_verify_file)
1317 ca_verify_file_entry = ssl_store_get_cafile_entry(ca_verify_file, 0);
1318 }
1319
1320 if (ca_file_entry) {
1321 /* If we have a ckch instance that is not already in the
1322 * cafile_entry's list, add it to it. */
1323 if (do_chain_inst_and_cafile(ca_file_entry, ckch_inst))
1324 return;
1325
1326 }
1327 if (ca_verify_file_entry && (ca_file_entry != ca_verify_file_entry)) {
1328 /* If we have a ckch instance that is not already in the
1329 * cafile_entry's list, add it to it. */
1330 if (do_chain_inst_and_cafile(ca_verify_file_entry, ckch_inst))
1331 return;
1332 }
1333 }
1334}
1335
William Lallemandda8584c2020-05-14 10:14:37 +02001336
1337
1338
1339/* IO handler of the details "show ssl cert <filename>" */
1340static int cli_io_handler_show_cert_detail(struct appctx *appctx)
1341{
1342 struct stream_interface *si = appctx->owner;
1343 struct ckch_store *ckchs = appctx->ctx.cli.p0;
1344 struct buffer *out = alloc_trash_chunk();
1345 struct buffer *tmp = alloc_trash_chunk();
1346 X509_NAME *name = NULL;
1347 STACK_OF(X509) *chain;
1348 unsigned int len = 0;
1349 int write = -1;
1350 BIO *bio = NULL;
1351 int i;
1352
1353 if (!tmp || !out)
1354 goto end_no_putchk;
1355
William Lallemand5685ccf2020-09-16 16:12:25 +02001356 chunk_appendf(out, "Filename: ");
1357 if (ckchs == ckchs_transaction.new_ckchs)
1358 chunk_appendf(out, "*");
1359 chunk_appendf(out, "%s\n", ckchs->path);
William Lallemandda8584c2020-05-14 10:14:37 +02001360
William Lallemand5685ccf2020-09-16 16:12:25 +02001361 chunk_appendf(out, "Status: ");
1362 if (ckchs->ckch->cert == NULL)
1363 chunk_appendf(out, "Empty\n");
1364 else if (LIST_ISEMPTY(&ckchs->ckch_inst))
1365 chunk_appendf(out, "Unused\n");
1366 else
1367 chunk_appendf(out, "Used\n");
William Lallemandda8584c2020-05-14 10:14:37 +02001368
William Lallemand5685ccf2020-09-16 16:12:25 +02001369 if (ckchs->ckch->cert == NULL)
1370 goto end;
William Lallemandda8584c2020-05-14 10:14:37 +02001371
William Lallemand5685ccf2020-09-16 16:12:25 +02001372 chain = ckchs->ckch->chain;
1373 if (chain == NULL) {
1374 struct issuer_chain *issuer;
1375 issuer = ssl_get0_issuer_chain(ckchs->ckch->cert);
1376 if (issuer) {
1377 chain = issuer->chain;
1378 chunk_appendf(out, "Chain Filename: ");
1379 chunk_appendf(out, "%s\n", issuer->path);
William Lallemandda8584c2020-05-14 10:14:37 +02001380 }
William Lallemand5685ccf2020-09-16 16:12:25 +02001381 }
1382 chunk_appendf(out, "Serial: ");
1383 if (ssl_sock_get_serial(ckchs->ckch->cert, tmp) == -1)
1384 goto end;
1385 dump_binary(out, tmp->area, tmp->data);
1386 chunk_appendf(out, "\n");
William Lallemandda8584c2020-05-14 10:14:37 +02001387
William Lallemand5685ccf2020-09-16 16:12:25 +02001388 chunk_appendf(out, "notBefore: ");
1389 chunk_reset(tmp);
1390 if ((bio = BIO_new(BIO_s_mem())) == NULL)
1391 goto end;
1392 if (ASN1_TIME_print(bio, X509_getm_notBefore(ckchs->ckch->cert)) == 0)
1393 goto end;
1394 write = BIO_read(bio, tmp->area, tmp->size-1);
1395 tmp->area[write] = '\0';
1396 BIO_free(bio);
1397 bio = NULL;
1398 chunk_appendf(out, "%s\n", tmp->area);
William Lallemandda8584c2020-05-14 10:14:37 +02001399
William Lallemand5685ccf2020-09-16 16:12:25 +02001400 chunk_appendf(out, "notAfter: ");
1401 chunk_reset(tmp);
1402 if ((bio = BIO_new(BIO_s_mem())) == NULL)
1403 goto end;
1404 if (ASN1_TIME_print(bio, X509_getm_notAfter(ckchs->ckch->cert)) == 0)
1405 goto end;
1406 if ((write = BIO_read(bio, tmp->area, tmp->size-1)) <= 0)
1407 goto end;
1408 tmp->area[write] = '\0';
1409 BIO_free(bio);
1410 bio = NULL;
1411 chunk_appendf(out, "%s\n", tmp->area);
William Lallemandda8584c2020-05-14 10:14:37 +02001412
1413#ifdef SSL_CTRL_SET_TLSEXT_HOSTNAME
William Lallemand5685ccf2020-09-16 16:12:25 +02001414 chunk_appendf(out, "Subject Alternative Name: ");
1415 if (ssl_sock_get_san_oneline(ckchs->ckch->cert, out) == -1)
1416 goto end;
1417 *(out->area + out->data) = '\0';
1418 chunk_appendf(out, "\n");
William Lallemandda8584c2020-05-14 10:14:37 +02001419#endif
William Lallemand5685ccf2020-09-16 16:12:25 +02001420 chunk_reset(tmp);
1421 chunk_appendf(out, "Algorithm: ");
1422 if (cert_get_pkey_algo(ckchs->ckch->cert, tmp) == 0)
1423 goto end;
1424 chunk_appendf(out, "%s\n", tmp->area);
William Lallemandda8584c2020-05-14 10:14:37 +02001425
William Lallemand5685ccf2020-09-16 16:12:25 +02001426 chunk_reset(tmp);
1427 chunk_appendf(out, "SHA1 FingerPrint: ");
1428 if (X509_digest(ckchs->ckch->cert, EVP_sha1(), (unsigned char *) tmp->area, &len) == 0)
1429 goto end;
1430 tmp->data = len;
1431 dump_binary(out, tmp->area, tmp->data);
1432 chunk_appendf(out, "\n");
William Lallemandda8584c2020-05-14 10:14:37 +02001433
William Lallemand5685ccf2020-09-16 16:12:25 +02001434 chunk_appendf(out, "Subject: ");
1435 if ((name = X509_get_subject_name(ckchs->ckch->cert)) == NULL)
1436 goto end;
1437 if ((ssl_sock_get_dn_oneline(name, tmp)) == -1)
1438 goto end;
1439 *(tmp->area + tmp->data) = '\0';
1440 chunk_appendf(out, "%s\n", tmp->area);
1441
1442 chunk_appendf(out, "Issuer: ");
1443 if ((name = X509_get_issuer_name(ckchs->ckch->cert)) == NULL)
1444 goto end;
1445 if ((ssl_sock_get_dn_oneline(name, tmp)) == -1)
1446 goto end;
1447 *(tmp->area + tmp->data) = '\0';
1448 chunk_appendf(out, "%s\n", tmp->area);
1449
1450 /* Displays subject of each certificate in the chain */
1451 for (i = 0; i < sk_X509_num(chain); i++) {
1452 X509 *ca = sk_X509_value(chain, i);
1453
1454 chunk_appendf(out, "Chain Subject: ");
1455 if ((name = X509_get_subject_name(ca)) == NULL)
William Lallemandda8584c2020-05-14 10:14:37 +02001456 goto end;
1457 if ((ssl_sock_get_dn_oneline(name, tmp)) == -1)
1458 goto end;
1459 *(tmp->area + tmp->data) = '\0';
1460 chunk_appendf(out, "%s\n", tmp->area);
1461
William Lallemand5685ccf2020-09-16 16:12:25 +02001462 chunk_appendf(out, "Chain Issuer: ");
1463 if ((name = X509_get_issuer_name(ca)) == NULL)
William Lallemandda8584c2020-05-14 10:14:37 +02001464 goto end;
1465 if ((ssl_sock_get_dn_oneline(name, tmp)) == -1)
1466 goto end;
1467 *(tmp->area + tmp->data) = '\0';
1468 chunk_appendf(out, "%s\n", tmp->area);
William Lallemandda8584c2020-05-14 10:14:37 +02001469 }
1470
1471end:
1472 if (ci_putchk(si_ic(si), out) == -1) {
1473 si_rx_room_blk(si);
1474 goto yield;
1475 }
1476
1477end_no_putchk:
1478 if (bio)
1479 BIO_free(bio);
1480 free_trash_chunk(tmp);
1481 free_trash_chunk(out);
1482 return 1;
1483yield:
1484 free_trash_chunk(tmp);
1485 free_trash_chunk(out);
1486 return 0; /* should come back */
1487}
1488
1489/* parsing function for 'show ssl cert [certfile]' */
1490static int cli_parse_show_cert(char **args, char *payload, struct appctx *appctx, void *private)
1491{
1492 struct ckch_store *ckchs;
1493
1494 if (!cli_has_level(appctx, ACCESS_LVL_OPER))
1495 return cli_err(appctx, "Can't allocate memory!\n");
1496
1497 /* The operations on the CKCH architecture are locked so we can
1498 * manipulate ckch_store and ckch_inst */
1499 if (HA_SPIN_TRYLOCK(CKCH_LOCK, &ckch_lock))
1500 return cli_err(appctx, "Can't show!\nOperations on certificates are currently locked!\n");
1501
1502 /* check if there is a certificate to lookup */
1503 if (*args[3]) {
1504 if (*args[3] == '*') {
1505 if (!ckchs_transaction.new_ckchs)
1506 goto error;
1507
1508 ckchs = ckchs_transaction.new_ckchs;
1509
Tim Duesterhuse5ff1412021-01-02 22:31:53 +01001510 if (strcmp(args[3] + 1, ckchs->path) != 0)
William Lallemandda8584c2020-05-14 10:14:37 +02001511 goto error;
1512
1513 } else {
1514 if ((ckchs = ckchs_lookup(args[3])) == NULL)
1515 goto error;
1516
1517 }
1518
William Lallemandda8584c2020-05-14 10:14:37 +02001519 appctx->ctx.cli.p0 = ckchs;
1520 /* use the IO handler that shows details */
1521 appctx->io_handler = cli_io_handler_show_cert_detail;
1522 }
1523
1524 return 0;
1525
1526error:
1527 HA_SPIN_UNLOCK(CKCH_LOCK, &ckch_lock);
1528 return cli_err(appctx, "Can't display the certificate: Not found or the certificate is a bundle!\n");
1529}
1530
1531/* release function of the `set ssl cert' command, free things and unlock the spinlock */
1532static void cli_release_commit_cert(struct appctx *appctx)
1533{
1534 struct ckch_store *new_ckchs;
1535
1536 HA_SPIN_UNLOCK(CKCH_LOCK, &ckch_lock);
1537
1538 if (appctx->st2 != SETCERT_ST_FIN) {
1539 /* free every new sni_ctx and the new store, which are not in the trees so no spinlock there */
1540 new_ckchs = appctx->ctx.ssl.new_ckchs;
1541
1542 /* if the allocation failed, we need to free everything from the temporary list */
1543 ckch_store_free(new_ckchs);
1544 }
1545}
1546
Remi Tricot-Le Bretonbfadc022021-02-24 12:20:48 +01001547
1548/*
1549 * Rebuild a new instance 'new_inst' based on an old instance 'ckchi' and a
1550 * specific ckch_store.
1551 * Returns 0 in case of success, 1 otherwise.
1552 */
1553static int ckch_inst_rebuild(struct ckch_store *ckch_store, struct ckch_inst *ckchi,
1554 struct ckch_inst **new_inst, char **err)
1555{
1556 int retval = 0;
1557 int errcode = 0;
1558 struct sni_ctx *sc0, *sc0s;
1559 char **sni_filter = NULL;
1560 int fcount = 0;
1561
1562 if (ckchi->crtlist_entry) {
1563 sni_filter = ckchi->crtlist_entry->filters;
1564 fcount = ckchi->crtlist_entry->fcount;
1565 }
1566
1567 if (ckchi->is_server_instance)
1568 errcode |= ckch_inst_new_load_srv_store(ckch_store->path, ckch_store, new_inst, err);
1569 else
1570 errcode |= ckch_inst_new_load_store(ckch_store->path, ckch_store, ckchi->bind_conf, ckchi->ssl_conf, sni_filter, fcount, new_inst, err);
1571
1572 if (errcode & ERR_CODE)
1573 return 1;
1574
1575 /* if the previous ckchi was used as the default */
1576 if (ckchi->is_default)
1577 (*new_inst)->is_default = 1;
1578
1579 (*new_inst)->is_server_instance = ckchi->is_server_instance;
1580 (*new_inst)->server = ckchi->server;
1581 /* Create a new SSL_CTX and link it to the new instance. */
1582 if ((*new_inst)->is_server_instance) {
1583 retval = ssl_sock_prep_srv_ctx_and_inst(ckchi->server, (*new_inst)->ctx, (*new_inst));
1584 if (retval)
1585 return 1;
1586 }
1587
1588 /* create the link to the crtlist_entry */
1589 (*new_inst)->crtlist_entry = ckchi->crtlist_entry;
1590
1591 /* we need to initialize the SSL_CTX generated */
1592 /* this iterate on the newly generated SNIs in the new instance to prepare their SSL_CTX */
1593 list_for_each_entry_safe(sc0, sc0s, &(*new_inst)->sni_ctx, by_ckch_inst) {
1594 if (!sc0->order) { /* we initialized only the first SSL_CTX because it's the same in the other sni_ctx's */
1595 errcode |= ssl_sock_prep_ctx_and_inst(ckchi->bind_conf, ckchi->ssl_conf, sc0->ctx, *new_inst, err);
1596 if (errcode & ERR_CODE)
1597 return 1;
1598 }
1599 }
1600
1601 return 0;
1602}
1603
1604/*
1605 * Load all the new SNIs of a newly built ckch instance in the trees, or replace
1606 * a server's main ckch instance.
1607 */
1608static void __ssl_sock_load_new_ckch_instance(struct ckch_inst *ckchi)
1609{
1610 /* The bind_conf will be null on server ckch_instances. */
1611 if (ckchi->is_server_instance) {
1612 int i;
1613 /* a lock is needed here since we have to free the SSL cache */
1614 HA_RWLOCK_WRLOCK(SSL_SERVER_LOCK, &ckchi->server->ssl_ctx.lock);
1615 /* free the server current SSL_CTX */
1616 SSL_CTX_free(ckchi->server->ssl_ctx.ctx);
1617 /* Actual ssl context update */
1618 SSL_CTX_up_ref(ckchi->ctx);
1619 ckchi->server->ssl_ctx.ctx = ckchi->ctx;
1620 ckchi->server->ssl_ctx.inst = ckchi;
1621
1622 /* flush the session cache of the server */
1623 for (i = 0; i < global.nbthread; i++) {
1624 ha_free(&ckchi->server->ssl_ctx.reused_sess[i].ptr);
1625 }
1626 HA_RWLOCK_WRUNLOCK(SSL_SERVER_LOCK, &ckchi->server->ssl_ctx.lock);
1627
1628 } else {
1629 HA_RWLOCK_WRLOCK(SNI_LOCK, &ckchi->bind_conf->sni_lock);
1630 ssl_sock_load_cert_sni(ckchi, ckchi->bind_conf);
1631 HA_RWLOCK_WRUNLOCK(SNI_LOCK, &ckchi->bind_conf->sni_lock);
1632 }
1633}
1634
1635/*
1636 * Delete a ckch instance that was replaced after a CLI command.
1637 */
1638static void __ckch_inst_free_locked(struct ckch_inst *ckchi)
1639{
1640 if (ckchi->is_server_instance) {
1641 /* no lock for servers */
1642 ckch_inst_free(ckchi);
1643 } else {
1644 struct bind_conf __maybe_unused *bind_conf = ckchi->bind_conf;
1645
1646 HA_RWLOCK_WRLOCK(SNI_LOCK, &bind_conf->sni_lock);
1647 ckch_inst_free(ckchi);
1648 HA_RWLOCK_WRUNLOCK(SNI_LOCK, &bind_conf->sni_lock);
1649 }
1650}
1651
1652
William Lallemandda8584c2020-05-14 10:14:37 +02001653/*
1654 * This function tries to create the new ckch_inst and their SNIs
1655 */
1656static int cli_io_handler_commit_cert(struct appctx *appctx)
1657{
1658 struct stream_interface *si = appctx->owner;
1659 int y = 0;
1660 char *err = NULL;
1661 int errcode = 0;
1662 struct ckch_store *old_ckchs, *new_ckchs = NULL;
1663 struct ckch_inst *ckchi, *ckchis;
1664 struct buffer *trash = alloc_trash_chunk();
William Lallemandda8584c2020-05-14 10:14:37 +02001665 struct crtlist_entry *entry;
1666
1667 if (trash == NULL)
1668 goto error;
1669
1670 if (unlikely(si_ic(si)->flags & (CF_WRITE_ERROR|CF_SHUTW)))
1671 goto error;
1672
1673 while (1) {
1674 switch (appctx->st2) {
1675 case SETCERT_ST_INIT:
1676 /* This state just print the update message */
1677 chunk_printf(trash, "Committing %s", ckchs_transaction.path);
1678 if (ci_putchk(si_ic(si), trash) == -1) {
1679 si_rx_room_blk(si);
1680 goto yield;
1681 }
1682 appctx->st2 = SETCERT_ST_GEN;
1683 /* fallthrough */
1684 case SETCERT_ST_GEN:
1685 /*
1686 * This state generates the ckch instances with their
1687 * sni_ctxs and SSL_CTX.
1688 *
1689 * Since the SSL_CTX generation can be CPU consumer, we
1690 * yield every 10 instances.
1691 */
1692
1693 old_ckchs = appctx->ctx.ssl.old_ckchs;
1694 new_ckchs = appctx->ctx.ssl.new_ckchs;
1695
1696 if (!new_ckchs)
1697 continue;
1698
1699 /* get the next ckchi to regenerate */
1700 ckchi = appctx->ctx.ssl.next_ckchi;
1701 /* we didn't start yet, set it to the first elem */
1702 if (ckchi == NULL)
1703 ckchi = LIST_ELEM(old_ckchs->ckch_inst.n, typeof(ckchi), by_ckchs);
1704
1705 /* walk through the old ckch_inst and creates new ckch_inst using the updated ckchs */
1706 list_for_each_entry_from(ckchi, &old_ckchs->ckch_inst, by_ckchs) {
1707 struct ckch_inst *new_inst;
William Lallemandda8584c2020-05-14 10:14:37 +02001708
1709 /* it takes a lot of CPU to creates SSL_CTXs, so we yield every 10 CKCH instances */
1710 if (y >= 10) {
1711 /* save the next ckchi to compute */
1712 appctx->ctx.ssl.next_ckchi = ckchi;
1713 goto yield;
1714 }
1715
Remi Tricot-Le Bretonbfadc022021-02-24 12:20:48 +01001716 if (ckch_inst_rebuild(new_ckchs, ckchi, &new_inst, &err))
William Lallemandda8584c2020-05-14 10:14:37 +02001717 goto error;
1718
William Lallemandda8584c2020-05-14 10:14:37 +02001719 /* display one dot per new instance */
1720 chunk_appendf(trash, ".");
1721 /* link the new ckch_inst to the duplicate */
Willy Tarreau2b718102021-04-21 07:32:39 +02001722 LIST_APPEND(&new_ckchs->ckch_inst, &new_inst->by_ckchs);
William Lallemandda8584c2020-05-14 10:14:37 +02001723 y++;
1724 }
1725 appctx->st2 = SETCERT_ST_INSERT;
1726 /* fallthrough */
1727 case SETCERT_ST_INSERT:
1728 /* The generation is finished, we can insert everything */
1729
1730 old_ckchs = appctx->ctx.ssl.old_ckchs;
1731 new_ckchs = appctx->ctx.ssl.new_ckchs;
1732
1733 if (!new_ckchs)
1734 continue;
1735
1736 /* get the list of crtlist_entry in the old store, and update the pointers to the store */
1737 LIST_SPLICE(&new_ckchs->crtlist_entry, &old_ckchs->crtlist_entry);
1738 list_for_each_entry(entry, &new_ckchs->crtlist_entry, by_ckch_store) {
1739 ebpt_delete(&entry->node);
1740 /* change the ptr and reinsert the node */
1741 entry->node.key = new_ckchs;
1742 ebpt_insert(&entry->crtlist->entries, &entry->node);
1743 }
1744
William Lallemanda55685b2020-12-15 14:57:46 +01001745 /* insert the new ckch_insts in the crtlist_entry */
1746 list_for_each_entry(ckchi, &new_ckchs->ckch_inst, by_ckchs) {
1747 if (ckchi->crtlist_entry)
Willy Tarreau2b718102021-04-21 07:32:39 +02001748 LIST_INSERT(&ckchi->crtlist_entry->ckch_inst, &ckchi->by_crtlist_entry);
William Lallemanda55685b2020-12-15 14:57:46 +01001749 }
1750
William Lallemandda8584c2020-05-14 10:14:37 +02001751 /* First, we insert every new SNIs in the trees, also replace the default_ctx */
1752 list_for_each_entry_safe(ckchi, ckchis, &new_ckchs->ckch_inst, by_ckchs) {
Remi Tricot-Le Bretonbfadc022021-02-24 12:20:48 +01001753 __ssl_sock_load_new_ckch_instance(ckchi);
William Lallemandda8584c2020-05-14 10:14:37 +02001754 }
1755
1756 /* delete the old sni_ctx, the old ckch_insts and the ckch_store */
1757 list_for_each_entry_safe(ckchi, ckchis, &old_ckchs->ckch_inst, by_ckchs) {
Remi Tricot-Le Bretonbfadc022021-02-24 12:20:48 +01001758 __ckch_inst_free_locked(ckchi);
William Lallemandda8584c2020-05-14 10:14:37 +02001759 }
1760
1761 /* Replace the old ckchs by the new one */
1762 ckch_store_free(old_ckchs);
1763 ebst_insert(&ckchs_tree, &new_ckchs->node);
1764 appctx->st2 = SETCERT_ST_FIN;
1765 /* fallthrough */
1766 case SETCERT_ST_FIN:
1767 /* we achieved the transaction, we can set everything to NULL */
Willy Tarreau61cfdf42021-02-20 10:46:51 +01001768 ha_free(&ckchs_transaction.path);
William Lallemandda8584c2020-05-14 10:14:37 +02001769 ckchs_transaction.new_ckchs = NULL;
1770 ckchs_transaction.old_ckchs = NULL;
1771 goto end;
1772 }
1773 }
1774end:
1775
1776 chunk_appendf(trash, "\n");
1777 if (errcode & ERR_WARN)
1778 chunk_appendf(trash, "%s", err);
1779 chunk_appendf(trash, "Success!\n");
1780 if (ci_putchk(si_ic(si), trash) == -1)
1781 si_rx_room_blk(si);
1782 free_trash_chunk(trash);
1783 /* success: call the release function and don't come back */
1784 return 1;
1785yield:
1786 /* store the state */
1787 if (ci_putchk(si_ic(si), trash) == -1)
1788 si_rx_room_blk(si);
1789 free_trash_chunk(trash);
1790 si_rx_endp_more(si); /* let's come back later */
1791 return 0; /* should come back */
1792
1793error:
1794 /* spin unlock and free are done in the release function */
1795 if (trash) {
1796 chunk_appendf(trash, "\n%sFailed!\n", err);
1797 if (ci_putchk(si_ic(si), trash) == -1)
1798 si_rx_room_blk(si);
1799 free_trash_chunk(trash);
1800 }
1801 /* error: call the release function and don't come back */
1802 return 1;
1803}
1804
1805/*
1806 * Parsing function of 'commit ssl cert'
1807 */
1808static int cli_parse_commit_cert(char **args, char *payload, struct appctx *appctx, void *private)
1809{
1810 char *err = NULL;
1811
1812 if (!cli_has_level(appctx, ACCESS_LVL_ADMIN))
1813 return 1;
1814
1815 if (!*args[3])
1816 return cli_err(appctx, "'commit ssl cert expects a filename\n");
1817
1818 /* The operations on the CKCH architecture are locked so we can
1819 * manipulate ckch_store and ckch_inst */
1820 if (HA_SPIN_TRYLOCK(CKCH_LOCK, &ckch_lock))
1821 return cli_err(appctx, "Can't commit the certificate!\nOperations on certificates are currently locked!\n");
1822
1823 if (!ckchs_transaction.path) {
1824 memprintf(&err, "No ongoing transaction! !\n");
1825 goto error;
1826 }
1827
1828 if (strcmp(ckchs_transaction.path, args[3]) != 0) {
1829 memprintf(&err, "The ongoing transaction is about '%s' but you are trying to set '%s'\n", ckchs_transaction.path, args[3]);
1830 goto error;
1831 }
1832
William Lallemand5685ccf2020-09-16 16:12:25 +02001833 /* if a certificate is here, a private key must be here too */
1834 if (ckchs_transaction.new_ckchs->ckch->cert && !ckchs_transaction.new_ckchs->ckch->key) {
1835 memprintf(&err, "The transaction must contain at least a certificate and a private key!\n");
1836 goto error;
1837 }
William Lallemanda9419522020-06-24 16:26:41 +02001838
William Lallemand5685ccf2020-09-16 16:12:25 +02001839 if (!X509_check_private_key(ckchs_transaction.new_ckchs->ckch->cert, ckchs_transaction.new_ckchs->ckch->key)) {
1840 memprintf(&err, "inconsistencies between private key and certificate loaded '%s'.\n", ckchs_transaction.path);
1841 goto error;
William Lallemandda8584c2020-05-14 10:14:37 +02001842 }
1843
1844 /* init the appctx structure */
1845 appctx->st2 = SETCERT_ST_INIT;
1846 appctx->ctx.ssl.next_ckchi = NULL;
1847 appctx->ctx.ssl.new_ckchs = ckchs_transaction.new_ckchs;
1848 appctx->ctx.ssl.old_ckchs = ckchs_transaction.old_ckchs;
1849
1850 /* we don't unlock there, it will be unlock after the IO handler, in the release handler */
1851 return 0;
1852
1853error:
1854
1855 HA_SPIN_UNLOCK(CKCH_LOCK, &ckch_lock);
1856 err = memprintf(&err, "%sCan't commit %s!\n", err ? err : "", args[3]);
1857
1858 return cli_dynerr(appctx, err);
1859}
1860
1861
1862
1863
1864/*
1865 * Parsing function of `set ssl cert`, it updates or creates a temporary ckch.
1866 */
1867static int cli_parse_set_cert(char **args, char *payload, struct appctx *appctx, void *private)
1868{
1869 struct ckch_store *new_ckchs = NULL;
1870 struct ckch_store *old_ckchs = NULL;
1871 char *err = NULL;
1872 int i;
William Lallemandda8584c2020-05-14 10:14:37 +02001873 int errcode = 0;
1874 char *end;
1875 int type = CERT_TYPE_PEM;
1876 struct cert_key_and_chain *ckch;
1877 struct buffer *buf;
1878
1879 if (!cli_has_level(appctx, ACCESS_LVL_ADMIN))
1880 return 1;
1881
William Lallemandda8584c2020-05-14 10:14:37 +02001882 if (!*args[3] || !payload)
1883 return cli_err(appctx, "'set ssl cert expects a filename and a certificate as a payload\n");
1884
1885 /* The operations on the CKCH architecture are locked so we can
1886 * manipulate ckch_store and ckch_inst */
1887 if (HA_SPIN_TRYLOCK(CKCH_LOCK, &ckch_lock))
1888 return cli_err(appctx, "Can't update the certificate!\nOperations on certificates are currently locked!\n");
1889
William Lallemand5ba80d62021-05-04 16:17:27 +02001890 if ((buf = alloc_trash_chunk()) == NULL) {
1891 memprintf(&err, "%sCan't allocate memory\n", err ? err : "");
1892 errcode |= ERR_ALERT | ERR_FATAL;
1893 goto end;
1894 }
William Lallemande5ff4ad2020-06-08 09:40:37 +02001895
William Lallemandda8584c2020-05-14 10:14:37 +02001896 if (!chunk_strcpy(buf, args[3])) {
1897 memprintf(&err, "%sCan't allocate memory\n", err ? err : "");
1898 errcode |= ERR_ALERT | ERR_FATAL;
1899 goto end;
1900 }
1901
1902 /* check which type of file we want to update */
1903 for (i = 0; cert_exts[i].type < CERT_TYPE_MAX; i++) {
1904 end = strrchr(buf->area, '.');
Tim Duesterhuse5ff1412021-01-02 22:31:53 +01001905 if (end && *cert_exts[i].ext && (strcmp(end + 1, cert_exts[i].ext) == 0)) {
William Lallemandda8584c2020-05-14 10:14:37 +02001906 *end = '\0';
William Lallemand089c1382020-10-23 17:35:12 +02001907 buf->data = strlen(buf->area);
William Lallemandda8584c2020-05-14 10:14:37 +02001908 type = cert_exts[i].type;
1909 break;
1910 }
1911 }
1912
1913 appctx->ctx.ssl.old_ckchs = NULL;
1914 appctx->ctx.ssl.new_ckchs = NULL;
1915
1916 /* if there is an ongoing transaction */
1917 if (ckchs_transaction.path) {
William Lallemandda8584c2020-05-14 10:14:37 +02001918 /* if there is an ongoing transaction, check if this is the same file */
1919 if (strcmp(ckchs_transaction.path, buf->area) != 0) {
William Lallemand089c1382020-10-23 17:35:12 +02001920 /* we didn't find the transaction, must try more cases below */
1921
1922 /* if the del-ext option is activated we should try to take a look at a ".crt" too. */
1923 if (type != CERT_TYPE_PEM && global_ssl.extra_files_noext) {
1924 if (!chunk_strcat(buf, ".crt")) {
1925 memprintf(&err, "%sCan't allocate memory\n", err ? err : "");
1926 errcode |= ERR_ALERT | ERR_FATAL;
1927 goto end;
1928 }
1929
1930 if (strcmp(ckchs_transaction.path, buf->area) != 0) {
1931 /* remove .crt of the error message */
1932 *(b_orig(buf) + b_data(buf) + strlen(".crt")) = '\0';
1933 b_sub(buf, strlen(".crt"));
1934
1935 memprintf(&err, "The ongoing transaction is about '%s' but you are trying to set '%s'\n", ckchs_transaction.path, buf->area);
1936 errcode |= ERR_ALERT | ERR_FATAL;
1937 goto end;
1938 }
1939 }
William Lallemandda8584c2020-05-14 10:14:37 +02001940 }
1941
1942 appctx->ctx.ssl.old_ckchs = ckchs_transaction.new_ckchs;
1943
1944 } else {
William Lallemandda8584c2020-05-14 10:14:37 +02001945
William Lallemand95fefa12020-09-09 12:01:33 +02001946 /* lookup for the certificate in the tree */
1947 appctx->ctx.ssl.old_ckchs = ckchs_lookup(buf->area);
William Lallemand089c1382020-10-23 17:35:12 +02001948
1949 if (!appctx->ctx.ssl.old_ckchs) {
1950 /* if the del-ext option is activated we should try to take a look at a ".crt" too. */
1951 if (type != CERT_TYPE_PEM && global_ssl.extra_files_noext) {
1952 if (!chunk_strcat(buf, ".crt")) {
1953 memprintf(&err, "%sCan't allocate memory\n", err ? err : "");
1954 errcode |= ERR_ALERT | ERR_FATAL;
1955 goto end;
1956 }
1957 appctx->ctx.ssl.old_ckchs = ckchs_lookup(buf->area);
1958 }
1959 }
William Lallemandda8584c2020-05-14 10:14:37 +02001960 }
1961
1962 if (!appctx->ctx.ssl.old_ckchs) {
1963 memprintf(&err, "%sCan't replace a certificate which is not referenced by the configuration!\n",
1964 err ? err : "");
1965 errcode |= ERR_ALERT | ERR_FATAL;
1966 goto end;
1967 }
1968
1969 if (!appctx->ctx.ssl.path) {
1970 /* this is a new transaction, set the path of the transaction */
1971 appctx->ctx.ssl.path = strdup(appctx->ctx.ssl.old_ckchs->path);
1972 if (!appctx->ctx.ssl.path) {
1973 memprintf(&err, "%sCan't allocate memory\n", err ? err : "");
1974 errcode |= ERR_ALERT | ERR_FATAL;
1975 goto end;
1976 }
1977 }
1978
1979 old_ckchs = appctx->ctx.ssl.old_ckchs;
1980
1981 /* duplicate the ckch store */
1982 new_ckchs = ckchs_dup(old_ckchs);
1983 if (!new_ckchs) {
1984 memprintf(&err, "%sCannot allocate memory!\n",
1985 err ? err : "");
1986 errcode |= ERR_ALERT | ERR_FATAL;
1987 goto end;
1988 }
1989
William Lallemand95fefa12020-09-09 12:01:33 +02001990 ckch = new_ckchs->ckch;
William Lallemandda8584c2020-05-14 10:14:37 +02001991
1992 /* appply the change on the duplicate */
1993 if (cert_exts[type].load(buf->area, payload, ckch, &err) != 0) {
1994 memprintf(&err, "%sCan't load the payload\n", err ? err : "");
1995 errcode |= ERR_ALERT | ERR_FATAL;
1996 goto end;
1997 }
1998
1999 appctx->ctx.ssl.new_ckchs = new_ckchs;
2000
2001 /* we succeed, we can save the ckchs in the transaction */
2002
2003 /* if there wasn't a transaction, update the old ckchs */
2004 if (!ckchs_transaction.old_ckchs) {
2005 ckchs_transaction.old_ckchs = appctx->ctx.ssl.old_ckchs;
2006 ckchs_transaction.path = appctx->ctx.ssl.path;
2007 err = memprintf(&err, "Transaction created for certificate %s!\n", ckchs_transaction.path);
2008 } else {
2009 err = memprintf(&err, "Transaction updated for certificate %s!\n", ckchs_transaction.path);
2010
2011 }
2012
2013 /* free the previous ckchs if there was a transaction */
2014 ckch_store_free(ckchs_transaction.new_ckchs);
2015
2016 ckchs_transaction.new_ckchs = appctx->ctx.ssl.new_ckchs;
2017
2018
2019 /* creates the SNI ctxs later in the IO handler */
2020
2021end:
2022 free_trash_chunk(buf);
2023
2024 if (errcode & ERR_CODE) {
2025
2026 ckch_store_free(appctx->ctx.ssl.new_ckchs);
2027 appctx->ctx.ssl.new_ckchs = NULL;
2028
2029 appctx->ctx.ssl.old_ckchs = NULL;
2030
Willy Tarreau61cfdf42021-02-20 10:46:51 +01002031 ha_free(&appctx->ctx.ssl.path);
William Lallemandda8584c2020-05-14 10:14:37 +02002032
2033 HA_SPIN_UNLOCK(CKCH_LOCK, &ckch_lock);
2034 return cli_dynerr(appctx, memprintf(&err, "%sCan't update %s!\n", err ? err : "", args[3]));
2035 } else {
2036
2037 HA_SPIN_UNLOCK(CKCH_LOCK, &ckch_lock);
2038 return cli_dynmsg(appctx, LOG_NOTICE, err);
2039 }
2040 /* TODO: handle the ERR_WARN which are not handled because of the io_handler */
2041}
2042
2043/* parsing function of 'abort ssl cert' */
2044static int cli_parse_abort_cert(char **args, char *payload, struct appctx *appctx, void *private)
2045{
2046 char *err = NULL;
2047
2048 if (!cli_has_level(appctx, ACCESS_LVL_ADMIN))
2049 return 1;
2050
2051 if (!*args[3])
2052 return cli_err(appctx, "'abort ssl cert' expects a filename\n");
2053
2054 /* The operations on the CKCH architecture are locked so we can
2055 * manipulate ckch_store and ckch_inst */
2056 if (HA_SPIN_TRYLOCK(CKCH_LOCK, &ckch_lock))
2057 return cli_err(appctx, "Can't abort!\nOperations on certificates are currently locked!\n");
2058
2059 if (!ckchs_transaction.path) {
2060 memprintf(&err, "No ongoing transaction!\n");
2061 goto error;
2062 }
2063
2064 if (strcmp(ckchs_transaction.path, args[3]) != 0) {
2065 memprintf(&err, "The ongoing transaction is about '%s' but you are trying to abort a transaction for '%s'\n", ckchs_transaction.path, args[3]);
2066 goto error;
2067 }
2068
2069 /* Only free the ckchs there, because the SNI and instances were not generated yet */
2070 ckch_store_free(ckchs_transaction.new_ckchs);
2071 ckchs_transaction.new_ckchs = NULL;
William Lallemandda8584c2020-05-14 10:14:37 +02002072 ckchs_transaction.old_ckchs = NULL;
Willy Tarreau61cfdf42021-02-20 10:46:51 +01002073 ha_free(&ckchs_transaction.path);
William Lallemandda8584c2020-05-14 10:14:37 +02002074
2075 HA_SPIN_UNLOCK(CKCH_LOCK, &ckch_lock);
2076
2077 err = memprintf(&err, "Transaction aborted for certificate '%s'!\n", args[3]);
2078 return cli_dynmsg(appctx, LOG_NOTICE, err);
2079
2080error:
2081 HA_SPIN_UNLOCK(CKCH_LOCK, &ckch_lock);
2082
2083 return cli_dynerr(appctx, err);
2084}
2085
2086/* parsing function of 'new ssl cert' */
2087static int cli_parse_new_cert(char **args, char *payload, struct appctx *appctx, void *private)
2088{
2089 struct ckch_store *store;
2090 char *err = NULL;
2091 char *path;
2092
2093 if (!cli_has_level(appctx, ACCESS_LVL_ADMIN))
2094 return 1;
2095
2096 if (!*args[3])
2097 return cli_err(appctx, "'new ssl cert' expects a filename\n");
2098
2099 path = args[3];
2100
2101 /* The operations on the CKCH architecture are locked so we can
2102 * manipulate ckch_store and ckch_inst */
2103 if (HA_SPIN_TRYLOCK(CKCH_LOCK, &ckch_lock))
2104 return cli_err(appctx, "Can't create a certificate!\nOperations on certificates are currently locked!\n");
2105
2106 store = ckchs_lookup(path);
2107 if (store != NULL) {
2108 memprintf(&err, "Certificate '%s' already exists!\n", path);
2109 store = NULL; /* we don't want to free it */
2110 goto error;
2111 }
2112 /* we won't support multi-certificate bundle here */
William Lallemandbd8e6ed2020-09-16 16:08:08 +02002113 store = ckch_store_new(path);
William Lallemandda8584c2020-05-14 10:14:37 +02002114 if (!store) {
2115 memprintf(&err, "unable to allocate memory.\n");
2116 goto error;
2117 }
2118
2119 /* insert into the ckchs tree */
2120 ebst_insert(&ckchs_tree, &store->node);
2121 memprintf(&err, "New empty certificate store '%s'!\n", args[3]);
2122
2123 HA_SPIN_UNLOCK(CKCH_LOCK, &ckch_lock);
2124 return cli_dynmsg(appctx, LOG_NOTICE, err);
2125error:
2126 free(store);
2127 HA_SPIN_UNLOCK(CKCH_LOCK, &ckch_lock);
2128 return cli_dynerr(appctx, err);
2129}
2130
2131/* parsing function of 'del ssl cert' */
2132static int cli_parse_del_cert(char **args, char *payload, struct appctx *appctx, void *private)
2133{
2134 struct ckch_store *store;
2135 char *err = NULL;
2136 char *filename;
2137
2138 if (!cli_has_level(appctx, ACCESS_LVL_ADMIN))
2139 return 1;
2140
2141 if (!*args[3])
2142 return cli_err(appctx, "'del ssl cert' expects a certificate name\n");
2143
2144 if (HA_SPIN_TRYLOCK(CKCH_LOCK, &ckch_lock))
2145 return cli_err(appctx, "Can't delete the certificate!\nOperations on certificates are currently locked!\n");
2146
2147 filename = args[3];
2148
2149 store = ckchs_lookup(filename);
2150 if (store == NULL) {
2151 memprintf(&err, "certificate '%s' doesn't exist!\n", filename);
2152 goto error;
2153 }
2154 if (!LIST_ISEMPTY(&store->ckch_inst)) {
2155 memprintf(&err, "certificate '%s' in use, can't be deleted!\n", filename);
2156 goto error;
2157 }
2158
2159 ebmb_delete(&store->node);
2160 ckch_store_free(store);
2161
2162 memprintf(&err, "Certificate '%s' deleted!\n", filename);
2163
2164 HA_SPIN_UNLOCK(CKCH_LOCK, &ckch_lock);
2165 return cli_dynmsg(appctx, LOG_NOTICE, err);
2166
2167error:
2168 memprintf(&err, "Can't remove the certificate: %s\n", err ? err : "");
2169 HA_SPIN_UNLOCK(CKCH_LOCK, &ckch_lock);
2170 return cli_dynerr(appctx, err);
2171}
2172
Remi Tricot-Le Bretona32a68b2021-02-24 17:35:43 +01002173
2174/*
2175 * Parsing function of `set ssl ca-file`
2176 */
2177static int cli_parse_set_cafile(char **args, char *payload, struct appctx *appctx, void *private)
2178{
2179 char *err = NULL;
2180 int errcode = 0;
2181 struct buffer *buf;
2182
2183 if (!cli_has_level(appctx, ACCESS_LVL_ADMIN))
2184 return 1;
2185
2186 if (!*args[3] || !payload)
2187 return cli_err(appctx, "'set ssl ca-file expects a filename and CAs as a payload\n");
2188
2189 /* The operations on the CKCH architecture are locked so we can
2190 * manipulate ckch_store and ckch_inst */
2191 if (HA_SPIN_TRYLOCK(CKCH_LOCK, &ckch_lock))
2192 return cli_err(appctx, "Can't update the CA file!\nOperations on certificates are currently locked!\n");
2193
2194 if ((buf = alloc_trash_chunk()) == NULL) {
2195 memprintf(&err, "%sCan't allocate memory\n", err ? err : "");
2196 errcode |= ERR_ALERT | ERR_FATAL;
2197 goto end;
2198 }
2199
2200 if (!chunk_strcpy(buf, args[3])) {
2201 memprintf(&err, "%sCan't allocate memory\n", err ? err : "");
2202 errcode |= ERR_ALERT | ERR_FATAL;
2203 goto end;
2204 }
2205
2206 appctx->ctx.ssl.old_cafile_entry = NULL;
2207 appctx->ctx.ssl.new_cafile_entry = NULL;
2208
2209 /* if there is an ongoing transaction */
2210 if (cafile_transaction.path) {
2211 /* if there is an ongoing transaction, check if this is the same file */
2212 if (strcmp(cafile_transaction.path, buf->area) != 0) {
2213 memprintf(&err, "The ongoing transaction is about '%s' but you are trying to set '%s'\n", cafile_transaction.path, buf->area);
2214 errcode |= ERR_ALERT | ERR_FATAL;
2215 goto end;
2216 }
2217 appctx->ctx.ssl.old_cafile_entry = cafile_transaction.old_cafile_entry;
2218 }
2219 else {
2220 /* lookup for the certificate in the tree */
2221 appctx->ctx.ssl.old_cafile_entry = ssl_store_get_cafile_entry(buf->area, 0);
2222 }
2223
2224 if (!appctx->ctx.ssl.old_cafile_entry) {
2225 memprintf(&err, "%sCan't replace a CA file which is not referenced by the configuration!\n",
2226 err ? err : "");
2227 errcode |= ERR_ALERT | ERR_FATAL;
2228 goto end;
2229 }
2230
2231 if (!appctx->ctx.ssl.path) {
2232 /* this is a new transaction, set the path of the transaction */
2233 appctx->ctx.ssl.path = strdup(appctx->ctx.ssl.old_cafile_entry->path);
2234 if (!appctx->ctx.ssl.path) {
2235 memprintf(&err, "%sCan't allocate memory\n", err ? err : "");
2236 errcode |= ERR_ALERT | ERR_FATAL;
2237 goto end;
2238 }
2239 }
2240
2241 if (appctx->ctx.ssl.new_cafile_entry)
2242 ssl_store_delete_cafile_entry(appctx->ctx.ssl.new_cafile_entry);
2243
2244 /* Create a new cafile_entry without adding it to the cafile tree. */
2245 appctx->ctx.ssl.new_cafile_entry = ssl_store_create_cafile_entry(appctx->ctx.ssl.path, NULL);
2246 if (!appctx->ctx.ssl.new_cafile_entry) {
2247 memprintf(&err, "%sCannot allocate memory!\n",
2248 err ? err : "");
2249 errcode |= ERR_ALERT | ERR_FATAL;
2250 goto end;
2251 }
2252
2253 /* Fill the new entry with the new CAs. */
2254 if (ssl_store_load_ca_from_buf(appctx->ctx.ssl.new_cafile_entry, payload)) {
2255 memprintf(&err, "%sInvalid payload\n", err ? err : "");
2256 errcode |= ERR_ALERT | ERR_FATAL;
2257 goto end;
2258 }
2259
2260 /* we succeed, we can save the ca in the transaction */
2261
2262 /* if there wasn't a transaction, update the old CA */
2263 if (!cafile_transaction.old_cafile_entry) {
2264 cafile_transaction.old_cafile_entry = appctx->ctx.ssl.old_cafile_entry;
2265 cafile_transaction.path = appctx->ctx.ssl.path;
2266 err = memprintf(&err, "transaction created for CA %s!\n", cafile_transaction.path);
2267 } else {
2268 err = memprintf(&err, "transaction updated for CA %s!\n", cafile_transaction.path);
2269 }
2270
2271 /* free the previous CA if there was a transaction */
2272 ssl_store_delete_cafile_entry(cafile_transaction.new_cafile_entry);
2273
2274 cafile_transaction.new_cafile_entry = appctx->ctx.ssl.new_cafile_entry;
2275
2276 /* creates the SNI ctxs later in the IO handler */
2277
2278end:
2279 free_trash_chunk(buf);
2280
2281 if (errcode & ERR_CODE) {
2282 ssl_store_delete_cafile_entry(appctx->ctx.ssl.new_cafile_entry);
2283 appctx->ctx.ssl.new_cafile_entry = NULL;
2284 appctx->ctx.ssl.old_cafile_entry = NULL;
2285
2286 free(appctx->ctx.ssl.path);
2287 appctx->ctx.ssl.path = NULL;
2288
2289 HA_SPIN_UNLOCK(CKCH_LOCK, &ckch_lock);
2290 return cli_dynerr(appctx, memprintf(&err, "%sCan't update %s!\n", err ? err : "", args[3]));
2291 } else {
2292
2293 HA_SPIN_UNLOCK(CKCH_LOCK, &ckch_lock);
2294 return cli_dynmsg(appctx, LOG_NOTICE, err);
2295 }
2296}
2297
2298
2299/*
2300 * Parsing function of 'commit ssl ca-file'
2301 */
2302static int cli_parse_commit_cafile(char **args, char *payload, struct appctx *appctx, void *private)
2303{
2304 char *err = NULL;
2305
2306 if (!cli_has_level(appctx, ACCESS_LVL_ADMIN))
2307 return 1;
2308
2309 if (!*args[3])
2310 return cli_err(appctx, "'commit ssl ca-file expects a filename\n");
2311
2312 /* The operations on the CKCH architecture are locked so we can
2313 * manipulate ckch_store and ckch_inst */
2314 if (HA_SPIN_TRYLOCK(CKCH_LOCK, &ckch_lock))
2315 return cli_err(appctx, "Can't commit the CA file!\nOperations on certificates are currently locked!\n");
2316
2317 if (!cafile_transaction.path) {
2318 memprintf(&err, "No ongoing transaction! !\n");
2319 goto error;
2320 }
2321
2322 if (strcmp(cafile_transaction.path, args[3]) != 0) {
2323 memprintf(&err, "The ongoing transaction is about '%s' but you are trying to set '%s'\n", cafile_transaction.path, args[3]);
2324 goto error;
2325 }
2326 /* init the appctx structure */
2327 appctx->st2 = SETCERT_ST_INIT;
2328 appctx->ctx.ssl.next_ckchi_link = NULL;
2329 appctx->ctx.ssl.old_cafile_entry = cafile_transaction.old_cafile_entry;
2330 appctx->ctx.ssl.new_cafile_entry = cafile_transaction.new_cafile_entry;
2331
2332 return 0;
2333
2334error:
2335
2336 HA_SPIN_UNLOCK(CKCH_LOCK, &ckch_lock);
2337 err = memprintf(&err, "%sCan't commit %s!\n", err ? err : "", args[3]);
2338
2339 return cli_dynerr(appctx, err);
2340}
2341
2342enum {
2343 CREATE_NEW_INST_OK = 0,
2344 CREATE_NEW_INST_YIELD = -1,
2345 CREATE_NEW_INST_ERR = -2
2346};
2347
2348static inline int __create_new_instance(struct appctx *appctx, struct ckch_inst *ckchi, int *count,
2349 struct buffer *trash, char *err)
2350{
2351 struct ckch_inst *new_inst;
2352
2353 /* it takes a lot of CPU to creates SSL_CTXs, so we yield every 10 CKCH instances */
2354 if (*count >= 10) {
2355 /* save the next ckchi to compute */
2356 appctx->ctx.ssl.next_ckchi = ckchi;
2357 return CREATE_NEW_INST_YIELD;
2358 }
2359
2360 /* Rebuild a new ckch instance that uses the same ckch_store
2361 * than a reference ckchi instance but will use a new CA file. */
2362 if (ckch_inst_rebuild(ckchi->ckch_store, ckchi, &new_inst, &err))
2363 return CREATE_NEW_INST_ERR;
2364
2365 /* display one dot per new instance */
2366 chunk_appendf(trash, ".");
2367 ++(*count);
2368
2369 return CREATE_NEW_INST_OK;
2370}
2371
2372/*
2373 * This function tries to create new ckch instances and their SNIs using a newly
2374 * set certificate authority (CA file)
2375 */
2376static int cli_io_handler_commit_cafile(struct appctx *appctx)
2377{
2378 struct stream_interface *si = appctx->owner;
2379 int y = 0;
2380 char *err = NULL;
2381 int errcode = 0;
2382 struct cafile_entry *old_cafile_entry, *new_cafile_entry;
2383 struct ckch_inst_link *ckchi_link;
2384 struct buffer *trash = alloc_trash_chunk();
2385
2386 if (trash == NULL)
2387 goto error;
2388
2389 if (unlikely(si_ic(si)->flags & (CF_WRITE_ERROR|CF_SHUTW)))
2390 goto error;
2391
2392 while (1) {
2393 switch (appctx->st2) {
2394 case SETCERT_ST_INIT:
2395 /* This state just print the update message */
2396 chunk_printf(trash, "Committing %s", cafile_transaction.path);
2397 if (ci_putchk(si_ic(si), trash) == -1) {
2398 si_rx_room_blk(si);
2399 goto yield;
2400 }
2401 appctx->st2 = SETCERT_ST_GEN;
2402 /* fallthrough */
2403 case SETCERT_ST_GEN:
2404 /*
2405 * This state generates the ckch instances with their
2406 * sni_ctxs and SSL_CTX.
2407 *
2408 * Since the SSL_CTX generation can be CPU consumer, we
2409 * yield every 10 instances.
2410 */
2411 old_cafile_entry = appctx->ctx.ssl.old_cafile_entry;
2412 new_cafile_entry = appctx->ctx.ssl.new_cafile_entry;
2413
2414 if (!new_cafile_entry)
2415 continue;
2416
2417 /* get the next ckchi to regenerate */
2418 ckchi_link = appctx->ctx.ssl.next_ckchi_link;
2419 /* we didn't start yet, set it to the first elem */
2420 if (ckchi_link == NULL) {
2421 ckchi_link = LIST_ELEM(old_cafile_entry->ckch_inst_link.n, typeof(ckchi_link), list);
2422 /* Add the newly created cafile_entry to the tree so that
2423 * any new ckch instance created from now can use it. */
2424 if (ssl_store_add_uncommitted_cafile_entry(new_cafile_entry))
2425 goto error;
2426 }
2427
2428 list_for_each_entry_from(ckchi_link, &old_cafile_entry->ckch_inst_link, list) {
2429 switch (__create_new_instance(appctx, ckchi_link->ckch_inst, &y, trash, err)) {
2430 case CREATE_NEW_INST_YIELD:
2431 appctx->ctx.ssl.next_ckchi_link = ckchi_link;
2432 goto yield;
2433 case CREATE_NEW_INST_ERR:
2434 goto error;
2435 default: break;
2436 }
2437 }
2438
2439 appctx->st2 = SETCERT_ST_INSERT;
2440 /* fallthrough */
2441 case SETCERT_ST_INSERT:
2442 /* The generation is finished, we can insert everything */
2443
2444 old_cafile_entry = appctx->ctx.ssl.old_cafile_entry;
2445 new_cafile_entry = appctx->ctx.ssl.new_cafile_entry;
2446
2447 if (!new_cafile_entry)
2448 continue;
2449
2450 /* insert the new ckch_insts in the crtlist_entry */
2451 list_for_each_entry(ckchi_link, &new_cafile_entry->ckch_inst_link, list) {
2452 if (ckchi_link->ckch_inst->crtlist_entry)
2453 LIST_INSERT(&ckchi_link->ckch_inst->crtlist_entry->ckch_inst,
2454 &ckchi_link->ckch_inst->by_crtlist_entry);
2455 }
2456
2457 /* First, we insert every new SNIs in the trees, also replace the default_ctx */
2458 list_for_each_entry(ckchi_link, &new_cafile_entry->ckch_inst_link, list) {
2459 __ssl_sock_load_new_ckch_instance(ckchi_link->ckch_inst);
2460 }
2461
2462 /* delete the old sni_ctx, the old ckch_insts and the ckch_store */
2463 list_for_each_entry(ckchi_link, &old_cafile_entry->ckch_inst_link, list) {
2464 __ckch_inst_free_locked(ckchi_link->ckch_inst);
2465 }
2466
2467
2468 /* Remove the old cafile entry from the tree */
2469 ebmb_delete(&old_cafile_entry->node);
2470 ssl_store_delete_cafile_entry(old_cafile_entry);
2471
2472 appctx->st2 = SETCERT_ST_FIN;
2473 /* fallthrough */
2474 case SETCERT_ST_FIN:
2475 /* we achieved the transaction, we can set everything to NULL */
2476 ha_free(&cafile_transaction.path);
2477 cafile_transaction.old_cafile_entry = NULL;
2478 cafile_transaction.new_cafile_entry = NULL;
2479 goto end;
2480 }
2481 }
2482end:
2483
2484 chunk_appendf(trash, "\n");
2485 if (errcode & ERR_WARN)
2486 chunk_appendf(trash, "%s", err);
2487 chunk_appendf(trash, "Success!\n");
2488 if (ci_putchk(si_ic(si), trash) == -1)
2489 si_rx_room_blk(si);
2490 free_trash_chunk(trash);
2491 /* success: call the release function and don't come back */
2492 return 1;
2493yield:
2494 /* store the state */
2495 if (ci_putchk(si_ic(si), trash) == -1)
2496 si_rx_room_blk(si);
2497 free_trash_chunk(trash);
2498 si_rx_endp_more(si); /* let's come back later */
2499 return 0; /* should come back */
2500
2501error:
2502 /* spin unlock and free are done in the release function */
2503 if (trash) {
2504 chunk_appendf(trash, "\n%sFailed!\n", err);
2505 if (ci_putchk(si_ic(si), trash) == -1)
2506 si_rx_room_blk(si);
2507 free_trash_chunk(trash);
2508 }
2509 /* error: call the release function and don't come back */
2510 return 1;
2511}
2512
2513/* release function of the `commit ssl ca-file' command, free things and unlock the spinlock */
2514static void cli_release_commit_cafile(struct appctx *appctx)
2515{
2516 if (appctx->st2 != SETCERT_ST_FIN) {
2517 struct cafile_entry *new_cafile_entry = appctx->ctx.ssl.new_cafile_entry;
2518
2519 /* Remove the uncommitted cafile_entry from the tree. */
2520 ebmb_delete(&new_cafile_entry->node);
2521 ssl_store_delete_cafile_entry(new_cafile_entry);
2522 }
2523 HA_SPIN_UNLOCK(CKCH_LOCK, &ckch_lock);
2524}
2525
2526
William Lallemandee8530c2020-06-23 18:19:42 +02002527void ckch_deinit()
2528{
2529 struct eb_node *node, *next;
2530 struct ckch_store *store;
2531
2532 node = eb_first(&ckchs_tree);
2533 while (node) {
2534 next = eb_next(node);
2535 store = ebmb_entry(node, struct ckch_store, node);
2536 ckch_store_free(store);
2537 node = next;
2538 }
2539}
William Lallemandda8584c2020-05-14 10:14:37 +02002540
2541/* register cli keywords */
2542static struct cli_kw_list cli_kws = {{ },{
Remi Tricot-Le Bretona32a68b2021-02-24 17:35:43 +01002543 { { "new", "ssl", "cert", NULL }, "new ssl cert <certfile> : create a new certificate file to be used in a crt-list or a directory", cli_parse_new_cert, NULL, NULL },
2544 { { "set", "ssl", "cert", NULL }, "set ssl cert <certfile> <payload> : replace a certificate file", cli_parse_set_cert, NULL, NULL },
2545 { { "commit", "ssl", "cert", NULL }, "commit ssl cert <certfile> : commit a certificate file", cli_parse_commit_cert, cli_io_handler_commit_cert, cli_release_commit_cert },
2546 { { "abort", "ssl", "cert", NULL }, "abort ssl cert <certfile> : abort a transaction for a certificate file", cli_parse_abort_cert, NULL, NULL },
2547 { { "del", "ssl", "cert", NULL }, "del ssl cert <certfile> : delete an unused certificate file", cli_parse_del_cert, NULL, NULL },
2548 { { "show", "ssl", "cert", NULL }, "show ssl cert [<certfile>] : display the SSL certificates used in memory, or the details of a file", cli_parse_show_cert, cli_io_handler_show_cert, cli_release_show_cert },
2549
2550 { { "set", "ssl", "ca-file", NULL }, "set ssl ca-file <cafile> <payload> : replace a CA file", cli_parse_set_cafile, NULL, NULL },
2551 { { "commit", "ssl", "ca-file", NULL }, "commit ssl ca-file <cafile> : commit a CA file", cli_parse_commit_cafile, cli_io_handler_commit_cafile, cli_release_commit_cafile },
William Lallemandda8584c2020-05-14 10:14:37 +02002552 { { NULL }, NULL, NULL, NULL }
2553}};
2554
2555INITCALL1(STG_REGISTER, cli_register_kw, &cli_kws);
2556