blob: 62e7b4475b733c978391823966d43db75d79abf8 [file] [log] [blame]
William Lallemand03c331c2020-05-13 10:10:01 +02001/*
2 *
3 * Copyright (C) 2020 HAProxy Technologies, William Lallemand <wlallemand@haproxy.com>
4 *
5 * This program is free software; you can redistribute it and/or
6 * modify it under the terms of the GNU General Public License
7 * as published by the Free Software Foundation; either version
8 * 2 of the License, or (at your option) any later version.
9 *
10 */
11
12#define _GNU_SOURCE
13#include <ctype.h>
14#include <errno.h>
15#include <fcntl.h>
16#include <stdio.h>
17#include <stdlib.h>
18#include <string.h>
Willy Tarreauaeed4a82020-06-04 22:01:04 +020019#include <syslog.h>
William Lallemand03c331c2020-05-13 10:10:01 +020020#include <unistd.h>
21
22#include <sys/stat.h>
23#include <sys/types.h>
24
Willy Tarreaub2551052020-06-09 09:07:15 +020025#include <import/ebsttree.h>
26
Willy Tarreau8d366972020-05-27 16:10:29 +020027#include <haproxy/base64.h>
Willy Tarreauf1d32c42020-06-04 21:07:02 +020028#include <haproxy/channel.h>
Willy Tarreau83487a82020-06-04 20:19:54 +020029#include <haproxy/cli.h>
Willy Tarreau8d366972020-05-27 16:10:29 +020030#include <haproxy/errors.h>
Willy Tarreau47d7f902020-06-04 14:25:47 +020031#include <haproxy/ssl_ckch.h>
Willy Tarreau209108d2020-06-04 20:30:20 +020032#include <haproxy/ssl_sock.h>
Willy Tarreaub2bd8652020-06-04 14:21:22 +020033#include <haproxy/ssl_utils.h>
Willy Tarreau5e539c92020-06-04 20:45:39 +020034#include <haproxy/stream_interface.h>
Willy Tarreau48fbcae2020-06-03 18:09:46 +020035#include <haproxy/tools.h>
William Lallemand03c331c2020-05-13 10:10:01 +020036
William Lallemandda8584c2020-05-14 10:14:37 +020037/* Uncommitted CKCH transaction */
38
39static struct {
40 struct ckch_store *new_ckchs;
41 struct ckch_store *old_ckchs;
42 char *path;
43} ckchs_transaction;
44
45
William Lallemand03c331c2020-05-13 10:10:01 +020046
47/******************** cert_key_and_chain functions *************************
48 * These are the functions that fills a cert_key_and_chain structure. For the
49 * functions filling a SSL_CTX from a cert_key_and_chain, see ssl_sock.c
50 */
51
52/*
53 * Try to parse Signed Certificate Timestamp List structure. This function
54 * makes only basic test if the data seems like SCTL. No signature validation
55 * is performed.
56 */
57static int ssl_sock_parse_sctl(struct buffer *sctl)
58{
59 int ret = 1;
60 int len, pos, sct_len;
61 unsigned char *data;
62
63 if (sctl->data < 2)
64 goto out;
65
66 data = (unsigned char *) sctl->area;
67 len = (data[0] << 8) | data[1];
68
69 if (len + 2 != sctl->data)
70 goto out;
71
72 data = data + 2;
73 pos = 0;
74 while (pos < len) {
75 if (len - pos < 2)
76 goto out;
77
78 sct_len = (data[pos] << 8) | data[pos + 1];
79 if (pos + sct_len + 2 > len)
80 goto out;
81
82 pos += sct_len + 2;
83 }
84
85 ret = 0;
86
87out:
88 return ret;
89}
90
91/* Try to load a sctl from a buffer <buf> if not NULL, or read the file <sctl_path>
92 * It fills the ckch->sctl buffer
93 * return 0 on success or != 0 on failure */
94int ssl_sock_load_sctl_from_file(const char *sctl_path, char *buf, struct cert_key_and_chain *ckch, char **err)
95{
96 int fd = -1;
97 int r = 0;
98 int ret = 1;
99 struct buffer tmp;
100 struct buffer *src;
101 struct buffer *sctl;
102
103 if (buf) {
William Lallemand8d673942021-01-27 14:58:51 +0100104 chunk_initstr(&tmp, buf);
William Lallemand03c331c2020-05-13 10:10:01 +0200105 src = &tmp;
106 } else {
107 fd = open(sctl_path, O_RDONLY);
108 if (fd == -1)
109 goto end;
110
111 trash.data = 0;
112 while (trash.data < trash.size) {
113 r = read(fd, trash.area + trash.data, trash.size - trash.data);
114 if (r < 0) {
115 if (errno == EINTR)
116 continue;
117 goto end;
118 }
119 else if (r == 0) {
120 break;
121 }
122 trash.data += r;
123 }
124 src = &trash;
125 }
126
127 ret = ssl_sock_parse_sctl(src);
128 if (ret)
129 goto end;
130
131 sctl = calloc(1, sizeof(*sctl));
132 if (!chunk_dup(sctl, src)) {
133 free(sctl);
134 sctl = NULL;
135 goto end;
136 }
137 /* no error, fill ckch with new context, old context must be free */
138 if (ckch->sctl) {
139 free(ckch->sctl->area);
140 ckch->sctl->area = NULL;
141 free(ckch->sctl);
142 }
143 ckch->sctl = sctl;
144 ret = 0;
145end:
146 if (fd != -1)
147 close(fd);
148
149 return ret;
150}
151
152#if ((defined SSL_CTRL_SET_TLSEXT_STATUS_REQ_CB && !defined OPENSSL_NO_OCSP) || defined OPENSSL_IS_BORINGSSL)
153/*
Ilya Shipitsin46a030c2020-07-05 16:36:08 +0500154 * This function load the OCSP Response in DER format contained in file at
William Lallemand03c331c2020-05-13 10:10:01 +0200155 * path 'ocsp_path' or base64 in a buffer <buf>
156 *
157 * Returns 0 on success, 1 in error case.
158 */
159int ssl_sock_load_ocsp_response_from_file(const char *ocsp_path, char *buf, struct cert_key_and_chain *ckch, char **err)
160{
161 int fd = -1;
162 int r = 0;
163 int ret = 1;
164 struct buffer *ocsp_response;
165 struct buffer *src = NULL;
166
167 if (buf) {
168 int i, j;
169 /* if it's from a buffer it will be base64 */
170
171 /* remove \r and \n from the payload */
172 for (i = 0, j = 0; buf[i]; i++) {
173 if (buf[i] == '\r' || buf[i] == '\n')
174 continue;
175 buf[j++] = buf[i];
176 }
177 buf[j] = 0;
178
179 ret = base64dec(buf, j, trash.area, trash.size);
180 if (ret < 0) {
181 memprintf(err, "Error reading OCSP response in base64 format");
182 goto end;
183 }
184 trash.data = ret;
185 src = &trash;
186 } else {
187 fd = open(ocsp_path, O_RDONLY);
188 if (fd == -1) {
189 memprintf(err, "Error opening OCSP response file");
190 goto end;
191 }
192
193 trash.data = 0;
194 while (trash.data < trash.size) {
195 r = read(fd, trash.area + trash.data, trash.size - trash.data);
196 if (r < 0) {
197 if (errno == EINTR)
198 continue;
199
200 memprintf(err, "Error reading OCSP response from file");
201 goto end;
202 }
203 else if (r == 0) {
204 break;
205 }
206 trash.data += r;
207 }
208 close(fd);
209 fd = -1;
210 src = &trash;
211 }
212
213 ocsp_response = calloc(1, sizeof(*ocsp_response));
214 if (!chunk_dup(ocsp_response, src)) {
215 free(ocsp_response);
216 ocsp_response = NULL;
217 goto end;
218 }
219 /* no error, fill ckch with new context, old context must be free */
220 if (ckch->ocsp_response) {
221 free(ckch->ocsp_response->area);
222 ckch->ocsp_response->area = NULL;
223 free(ckch->ocsp_response);
224 }
225 ckch->ocsp_response = ocsp_response;
226 ret = 0;
227end:
228 if (fd != -1)
229 close(fd);
230
231 return ret;
232}
233#endif
234
235/*
236 * Try to load in a ckch every files related to a ckch.
237 * (PEM, sctl, ocsp, issuer etc.)
238 *
239 * This function is only used to load files during the configuration parsing,
240 * it is not used with the CLI.
241 *
242 * This allows us to carry the contents of the file without having to read the
243 * file multiple times. The caller must call
244 * ssl_sock_free_cert_key_and_chain_contents.
245 *
246 * returns:
247 * 0 on Success
248 * 1 on SSL Failure
249 */
250int ssl_sock_load_files_into_ckch(const char *path, struct cert_key_and_chain *ckch, char **err)
251{
William Lallemand8e8581e2020-10-20 17:36:46 +0200252 struct buffer *fp = NULL;
William Lallemand03c331c2020-05-13 10:10:01 +0200253 int ret = 1;
254
255 /* try to load the PEM */
256 if (ssl_sock_load_pem_into_ckch(path, NULL, ckch , err) != 0) {
257 goto end;
258 }
259
William Lallemand8e8581e2020-10-20 17:36:46 +0200260 fp = alloc_trash_chunk();
261 if (!fp) {
262 memprintf(err, "%sCan't allocate memory\n", err && *err ? *err : "");
263 goto end;
264 }
265
266 if (!chunk_strcpy(fp, path) || (b_data(fp) > MAXPATHLEN)) {
267 memprintf(err, "%s '%s' filename too long'.\n",
268 err && *err ? *err : "", fp->area);
269 ret = 1;
270 goto end;
271 }
272
William Lallemand089c1382020-10-23 17:35:12 +0200273 /* remove the ".crt" extension */
William Lallemand8e8581e2020-10-20 17:36:46 +0200274 if (global_ssl.extra_files_noext) {
275 char *ext;
276
277 /* look for the extension */
278 if ((ext = strrchr(fp->area, '.'))) {
William Lallemand8e8581e2020-10-20 17:36:46 +0200279
Tim Duesterhuse5ff1412021-01-02 22:31:53 +0100280 if (strcmp(ext, ".crt") == 0) {
William Lallemand8e8581e2020-10-20 17:36:46 +0200281 *ext = '\0';
William Lallemand089c1382020-10-23 17:35:12 +0200282 fp->data = strlen(fp->area);
283 }
William Lallemand8e8581e2020-10-20 17:36:46 +0200284 }
285
286 }
287
William Lallemand03c331c2020-05-13 10:10:01 +0200288 /* try to load an external private key if it wasn't in the PEM */
289 if ((ckch->key == NULL) && (global_ssl.extra_files & SSL_GF_KEY)) {
William Lallemand03c331c2020-05-13 10:10:01 +0200290 struct stat st;
291
William Lallemand8e8581e2020-10-20 17:36:46 +0200292
293 if (!chunk_strcat(fp, ".key") || (b_data(fp) > MAXPATHLEN)) {
294 memprintf(err, "%s '%s' filename too long'.\n",
295 err && *err ? *err : "", fp->area);
296 ret = 1;
297 goto end;
298 }
299
300 if (stat(fp->area, &st) == 0) {
301 if (ssl_sock_load_key_into_ckch(fp->area, NULL, ckch, err)) {
William Lallemand03c331c2020-05-13 10:10:01 +0200302 memprintf(err, "%s '%s' is present but cannot be read or parsed'.\n",
William Lallemand8e8581e2020-10-20 17:36:46 +0200303 err && *err ? *err : "", fp->area);
William Lallemand03c331c2020-05-13 10:10:01 +0200304 goto end;
305 }
306 }
William Lallemand03c331c2020-05-13 10:10:01 +0200307
William Lallemand8e8581e2020-10-20 17:36:46 +0200308 if (ckch->key == NULL) {
309 memprintf(err, "%sNo Private Key found in '%s'.\n", err && *err ? *err : "", fp->area);
310 goto end;
311 }
312 /* remove the added extension */
313 *(fp->area + fp->data - strlen(".key")) = '\0';
314 b_sub(fp, strlen(".key"));
William Lallemand03c331c2020-05-13 10:10:01 +0200315 }
316
317 if (!X509_check_private_key(ckch->cert, ckch->key)) {
318 memprintf(err, "%sinconsistencies between private key and certificate loaded '%s'.\n",
319 err && *err ? *err : "", path);
320 goto end;
321 }
322
323#if (HA_OPENSSL_VERSION_NUMBER >= 0x1000200fL && !defined OPENSSL_NO_TLSEXT && !defined OPENSSL_IS_BORINGSSL)
324 /* try to load the sctl file */
325 if (global_ssl.extra_files & SSL_GF_SCTL) {
William Lallemand03c331c2020-05-13 10:10:01 +0200326 struct stat st;
327
William Lallemand8e8581e2020-10-20 17:36:46 +0200328 if (!chunk_strcat(fp, ".sctl") || b_data(fp) > MAXPATHLEN) {
329 memprintf(err, "%s '%s' filename too long'.\n",
330 err && *err ? *err : "", fp->area);
331 ret = 1;
332 goto end;
333 }
334
335 if (stat(fp->area, &st) == 0) {
336 if (ssl_sock_load_sctl_from_file(fp->area, NULL, ckch, err)) {
William Lallemand03c331c2020-05-13 10:10:01 +0200337 memprintf(err, "%s '%s.sctl' is present but cannot be read or parsed'.\n",
William Lallemand8e8581e2020-10-20 17:36:46 +0200338 err && *err ? *err : "", fp->area);
William Lallemand03c331c2020-05-13 10:10:01 +0200339 ret = 1;
340 goto end;
341 }
342 }
William Lallemand8e8581e2020-10-20 17:36:46 +0200343 /* remove the added extension */
344 *(fp->area + fp->data - strlen(".sctl")) = '\0';
345 b_sub(fp, strlen(".sctl"));
William Lallemand03c331c2020-05-13 10:10:01 +0200346 }
347#endif
348
349 /* try to load an ocsp response file */
350 if (global_ssl.extra_files & SSL_GF_OCSP) {
William Lallemand03c331c2020-05-13 10:10:01 +0200351 struct stat st;
352
William Lallemand8e8581e2020-10-20 17:36:46 +0200353 if (!chunk_strcat(fp, ".ocsp") || b_data(fp) > MAXPATHLEN) {
354 memprintf(err, "%s '%s' filename too long'.\n",
355 err && *err ? *err : "", fp->area);
356 ret = 1;
357 goto end;
358 }
359
360 if (stat(fp->area, &st) == 0) {
361 if (ssl_sock_load_ocsp_response_from_file(fp->area, NULL, ckch, err)) {
William Lallemand03c331c2020-05-13 10:10:01 +0200362 ret = 1;
363 goto end;
364 }
365 }
William Lallemand8e8581e2020-10-20 17:36:46 +0200366 /* remove the added extension */
367 *(fp->area + fp->data - strlen(".ocsp")) = '\0';
368 b_sub(fp, strlen(".ocsp"));
William Lallemand03c331c2020-05-13 10:10:01 +0200369 }
370
371#ifndef OPENSSL_IS_BORINGSSL /* Useless for BoringSSL */
372 if (ckch->ocsp_response && (global_ssl.extra_files & SSL_GF_OCSP_ISSUER)) {
373 /* if no issuer was found, try to load an issuer from the .issuer */
374 if (!ckch->ocsp_issuer) {
375 struct stat st;
William Lallemand8e8581e2020-10-20 17:36:46 +0200376
377 if (!chunk_strcat(fp, ".issuer") || b_data(fp) > MAXPATHLEN) {
378 memprintf(err, "%s '%s' filename too long'.\n",
379 err && *err ? *err : "", fp->area);
380 ret = 1;
381 goto end;
382 }
William Lallemand03c331c2020-05-13 10:10:01 +0200383
William Lallemand8e8581e2020-10-20 17:36:46 +0200384 if (stat(fp->area, &st) == 0) {
385 if (ssl_sock_load_issuer_file_into_ckch(fp->area, NULL, ckch, err)) {
William Lallemand03c331c2020-05-13 10:10:01 +0200386 ret = 1;
387 goto end;
388 }
389
390 if (X509_check_issued(ckch->ocsp_issuer, ckch->cert) != X509_V_OK) {
391 memprintf(err, "%s '%s' is not an issuer'.\n",
William Lallemand8e8581e2020-10-20 17:36:46 +0200392 err && *err ? *err : "", fp->area);
William Lallemand03c331c2020-05-13 10:10:01 +0200393 ret = 1;
394 goto end;
395 }
396 }
William Lallemand8e8581e2020-10-20 17:36:46 +0200397 /* remove the added extension */
398 *(fp->area + fp->data - strlen(".issuer")) = '\0';
399 b_sub(fp, strlen(".issuer"));
William Lallemand03c331c2020-05-13 10:10:01 +0200400 }
401 }
402#endif
403
404 ret = 0;
405
406end:
407
408 ERR_clear_error();
409
410 /* Something went wrong in one of the reads */
411 if (ret != 0)
412 ssl_sock_free_cert_key_and_chain_contents(ckch);
413
William Lallemand8e8581e2020-10-20 17:36:46 +0200414 free_trash_chunk(fp);
415
William Lallemand03c331c2020-05-13 10:10:01 +0200416 return ret;
417}
418
419/*
420 * Try to load a private key file from a <path> or a buffer <buf>
421 *
422 * If it failed you should not attempt to use the ckch but free it.
423 *
424 * Return 0 on success or != 0 on failure
425 */
426int ssl_sock_load_key_into_ckch(const char *path, char *buf, struct cert_key_and_chain *ckch , char **err)
427{
428 BIO *in = NULL;
429 int ret = 1;
430 EVP_PKEY *key = NULL;
431
432 if (buf) {
433 /* reading from a buffer */
434 in = BIO_new_mem_buf(buf, -1);
435 if (in == NULL) {
436 memprintf(err, "%sCan't allocate memory\n", err && *err ? *err : "");
437 goto end;
438 }
439
440 } else {
441 /* reading from a file */
442 in = BIO_new(BIO_s_file());
443 if (in == NULL)
444 goto end;
445
446 if (BIO_read_filename(in, path) <= 0)
447 goto end;
448 }
449
450 /* Read Private Key */
451 key = PEM_read_bio_PrivateKey(in, NULL, NULL, NULL);
452 if (key == NULL) {
453 memprintf(err, "%sunable to load private key from file '%s'.\n",
454 err && *err ? *err : "", path);
455 goto end;
456 }
457
458 ret = 0;
459
460 SWAP(ckch->key, key);
461
462end:
463
464 ERR_clear_error();
465 if (in)
466 BIO_free(in);
467 if (key)
468 EVP_PKEY_free(key);
469
470 return ret;
471}
472
473/*
474 * Try to load a PEM file from a <path> or a buffer <buf>
475 * The PEM must contain at least a Certificate,
476 * It could contain a DH, a certificate chain and a PrivateKey.
477 *
478 * If it failed you should not attempt to use the ckch but free it.
479 *
480 * Return 0 on success or != 0 on failure
481 */
482int ssl_sock_load_pem_into_ckch(const char *path, char *buf, struct cert_key_and_chain *ckch , char **err)
483{
484 BIO *in = NULL;
485 int ret = 1;
486 X509 *ca;
487 X509 *cert = NULL;
488 EVP_PKEY *key = NULL;
489 DH *dh = NULL;
490 STACK_OF(X509) *chain = NULL;
491
492 if (buf) {
493 /* reading from a buffer */
494 in = BIO_new_mem_buf(buf, -1);
495 if (in == NULL) {
496 memprintf(err, "%sCan't allocate memory\n", err && *err ? *err : "");
497 goto end;
498 }
499
500 } else {
501 /* reading from a file */
502 in = BIO_new(BIO_s_file());
503 if (in == NULL) {
504 memprintf(err, "%sCan't allocate memory\n", err && *err ? *err : "");
505 goto end;
506 }
507
508 if (BIO_read_filename(in, path) <= 0) {
509 memprintf(err, "%scannot open the file '%s'.\n",
510 err && *err ? *err : "", path);
511 goto end;
512 }
513 }
514
515 /* Read Private Key */
516 key = PEM_read_bio_PrivateKey(in, NULL, NULL, NULL);
517 /* no need to check for errors here, because the private key could be loaded later */
518
519#ifndef OPENSSL_NO_DH
520 /* Seek back to beginning of file */
521 if (BIO_reset(in) == -1) {
522 memprintf(err, "%san error occurred while reading the file '%s'.\n",
523 err && *err ? *err : "", path);
524 goto end;
525 }
526
527 dh = PEM_read_bio_DHparams(in, NULL, NULL, NULL);
528 /* no need to return an error there, dh is not mandatory */
529#endif
530
531 /* Seek back to beginning of file */
532 if (BIO_reset(in) == -1) {
533 memprintf(err, "%san error occurred while reading the file '%s'.\n",
534 err && *err ? *err : "", path);
535 goto end;
536 }
537
538 /* Read Certificate */
539 cert = PEM_read_bio_X509_AUX(in, NULL, NULL, NULL);
540 if (cert == NULL) {
541 memprintf(err, "%sunable to load certificate from file '%s'.\n",
542 err && *err ? *err : "", path);
543 goto end;
544 }
545
546 /* Look for a Certificate Chain */
547 while ((ca = PEM_read_bio_X509(in, NULL, NULL, NULL))) {
548 if (chain == NULL)
549 chain = sk_X509_new_null();
550 if (!sk_X509_push(chain, ca)) {
551 X509_free(ca);
552 goto end;
553 }
554 }
555
556 ret = ERR_get_error();
557 if (ret && (ERR_GET_LIB(ret) != ERR_LIB_PEM && ERR_GET_REASON(ret) != PEM_R_NO_START_LINE)) {
558 memprintf(err, "%sunable to load certificate chain from file '%s'.\n",
559 err && *err ? *err : "", path);
560 goto end;
561 }
562
563 /* once it loaded the PEM, it should remove everything else in the ckch */
564 if (ckch->ocsp_response) {
565 free(ckch->ocsp_response->area);
566 ckch->ocsp_response->area = NULL;
567 free(ckch->ocsp_response);
568 ckch->ocsp_response = NULL;
569 }
570
571 if (ckch->sctl) {
572 free(ckch->sctl->area);
573 ckch->sctl->area = NULL;
574 free(ckch->sctl);
575 ckch->sctl = NULL;
576 }
577
578 if (ckch->ocsp_issuer) {
579 X509_free(ckch->ocsp_issuer);
580 ckch->ocsp_issuer = NULL;
581 }
582
583 /* no error, fill ckch with new context, old context will be free at end: */
584 SWAP(ckch->key, key);
585 SWAP(ckch->dh, dh);
586 SWAP(ckch->cert, cert);
587 SWAP(ckch->chain, chain);
588
589 ret = 0;
590
591end:
592
593 ERR_clear_error();
594 if (in)
595 BIO_free(in);
596 if (key)
597 EVP_PKEY_free(key);
598 if (dh)
599 DH_free(dh);
600 if (cert)
601 X509_free(cert);
602 if (chain)
603 sk_X509_pop_free(chain, X509_free);
604
605 return ret;
606}
607
608/* Frees the contents of a cert_key_and_chain
609 */
610void ssl_sock_free_cert_key_and_chain_contents(struct cert_key_and_chain *ckch)
611{
612 if (!ckch)
613 return;
614
615 /* Free the certificate and set pointer to NULL */
616 if (ckch->cert)
617 X509_free(ckch->cert);
618 ckch->cert = NULL;
619
620 /* Free the key and set pointer to NULL */
621 if (ckch->key)
622 EVP_PKEY_free(ckch->key);
623 ckch->key = NULL;
624
625 /* Free each certificate in the chain */
626 if (ckch->chain)
627 sk_X509_pop_free(ckch->chain, X509_free);
628 ckch->chain = NULL;
629
630 if (ckch->dh)
631 DH_free(ckch->dh);
632 ckch->dh = NULL;
633
634 if (ckch->sctl) {
635 free(ckch->sctl->area);
636 ckch->sctl->area = NULL;
637 free(ckch->sctl);
638 ckch->sctl = NULL;
639 }
640
641 if (ckch->ocsp_response) {
642 free(ckch->ocsp_response->area);
643 ckch->ocsp_response->area = NULL;
644 free(ckch->ocsp_response);
645 ckch->ocsp_response = NULL;
646 }
647
648 if (ckch->ocsp_issuer)
649 X509_free(ckch->ocsp_issuer);
650 ckch->ocsp_issuer = NULL;
651}
652
653/*
654 *
655 * This function copy a cert_key_and_chain in memory
656 *
657 * It's used to try to apply changes on a ckch before committing them, because
658 * most of the time it's not possible to revert those changes
659 *
660 * Return a the dst or NULL
661 */
662struct cert_key_and_chain *ssl_sock_copy_cert_key_and_chain(struct cert_key_and_chain *src,
663 struct cert_key_and_chain *dst)
664{
665 if (src->cert) {
666 dst->cert = src->cert;
667 X509_up_ref(src->cert);
668 }
669
670 if (src->key) {
671 dst->key = src->key;
672 EVP_PKEY_up_ref(src->key);
673 }
674
675 if (src->chain) {
676 dst->chain = X509_chain_up_ref(src->chain);
677 }
678
679 if (src->dh) {
680 DH_up_ref(src->dh);
681 dst->dh = src->dh;
682 }
683
684 if (src->sctl) {
685 struct buffer *sctl;
686
687 sctl = calloc(1, sizeof(*sctl));
688 if (!chunk_dup(sctl, src->sctl)) {
689 free(sctl);
690 sctl = NULL;
691 goto error;
692 }
693 dst->sctl = sctl;
694 }
695
696 if (src->ocsp_response) {
697 struct buffer *ocsp_response;
698
699 ocsp_response = calloc(1, sizeof(*ocsp_response));
700 if (!chunk_dup(ocsp_response, src->ocsp_response)) {
701 free(ocsp_response);
702 ocsp_response = NULL;
703 goto error;
704 }
705 dst->ocsp_response = ocsp_response;
706 }
707
708 if (src->ocsp_issuer) {
709 X509_up_ref(src->ocsp_issuer);
710 dst->ocsp_issuer = src->ocsp_issuer;
711 }
712
713 return dst;
714
715error:
716
717 /* free everything */
718 ssl_sock_free_cert_key_and_chain_contents(dst);
719
720 return NULL;
721}
722
723/*
724 * return 0 on success or != 0 on failure
725 */
726int ssl_sock_load_issuer_file_into_ckch(const char *path, char *buf, struct cert_key_and_chain *ckch, char **err)
727{
728 int ret = 1;
729 BIO *in = NULL;
730 X509 *issuer;
731
732 if (buf) {
733 /* reading from a buffer */
734 in = BIO_new_mem_buf(buf, -1);
735 if (in == NULL) {
736 memprintf(err, "%sCan't allocate memory\n", err && *err ? *err : "");
737 goto end;
738 }
739
740 } else {
741 /* reading from a file */
742 in = BIO_new(BIO_s_file());
743 if (in == NULL)
744 goto end;
745
746 if (BIO_read_filename(in, path) <= 0)
747 goto end;
748 }
749
750 issuer = PEM_read_bio_X509_AUX(in, NULL, NULL, NULL);
751 if (!issuer) {
752 memprintf(err, "%s'%s' cannot be read or parsed'.\n",
753 err && *err ? *err : "", path);
754 goto end;
755 }
756 /* no error, fill ckch with new context, old context must be free */
757 if (ckch->ocsp_issuer)
758 X509_free(ckch->ocsp_issuer);
759 ckch->ocsp_issuer = issuer;
760 ret = 0;
761
762end:
763
764 ERR_clear_error();
765 if (in)
766 BIO_free(in);
767
768 return ret;
769}
770
771/******************** ckch_store functions ***********************************
772 * The ckch_store is a structure used to cache and index the SSL files used in
773 * configuration
774 */
775
776/*
777 * Free a ckch_store, its ckch, its instances and remove it from the ebtree
778 */
779void ckch_store_free(struct ckch_store *store)
780{
781 struct ckch_inst *inst, *inst_s;
782
783 if (!store)
784 return;
785
William Lallemandbd8e6ed2020-09-16 16:08:08 +0200786 ssl_sock_free_cert_key_and_chain_contents(store->ckch);
William Lallemand03c331c2020-05-13 10:10:01 +0200787
788 free(store->ckch);
789 store->ckch = NULL;
790
791 list_for_each_entry_safe(inst, inst_s, &store->ckch_inst, by_ckchs) {
792 ckch_inst_free(inst);
793 }
794 ebmb_delete(&store->node);
795 free(store);
796}
797
798/*
799 * create and initialize a ckch_store
800 * <path> is the key name
801 * <nmemb> is the number of store->ckch objects to allocate
802 *
803 * Return a ckch_store or NULL upon failure.
804 */
William Lallemandbd8e6ed2020-09-16 16:08:08 +0200805struct ckch_store *ckch_store_new(const char *filename)
William Lallemand03c331c2020-05-13 10:10:01 +0200806{
807 struct ckch_store *store;
808 int pathlen;
809
810 pathlen = strlen(filename);
811 store = calloc(1, sizeof(*store) + pathlen + 1);
812 if (!store)
813 return NULL;
814
William Lallemand03c331c2020-05-13 10:10:01 +0200815 memcpy(store->path, filename, pathlen + 1);
816
817 LIST_INIT(&store->ckch_inst);
818 LIST_INIT(&store->crtlist_entry);
819
William Lallemandbd8e6ed2020-09-16 16:08:08 +0200820 store->ckch = calloc(1, sizeof(*store->ckch));
William Lallemand03c331c2020-05-13 10:10:01 +0200821 if (!store->ckch)
822 goto error;
823
824 return store;
825error:
826 ckch_store_free(store);
827 return NULL;
828}
829
830/* allocate and duplicate a ckch_store
831 * Return a new ckch_store or NULL */
832struct ckch_store *ckchs_dup(const struct ckch_store *src)
833{
834 struct ckch_store *dst;
835
William Lallemandbd8e6ed2020-09-16 16:08:08 +0200836 dst = ckch_store_new(src->path);
William Lallemand03c331c2020-05-13 10:10:01 +0200837
William Lallemandbd8e6ed2020-09-16 16:08:08 +0200838 if (!ssl_sock_copy_cert_key_and_chain(src->ckch, dst->ckch))
839 goto error;
William Lallemand03c331c2020-05-13 10:10:01 +0200840
841 return dst;
842
843error:
844 ckch_store_free(dst);
845
846 return NULL;
847}
848
849/*
850 * lookup a path into the ckchs tree.
851 */
852struct ckch_store *ckchs_lookup(char *path)
853{
854 struct ebmb_node *eb;
855
856 eb = ebst_lookup(&ckchs_tree, path);
857 if (!eb)
858 return NULL;
859
860 return ebmb_entry(eb, struct ckch_store, node);
861}
862
863/*
864 * This function allocate a ckch_store and populate it with certificates from files.
865 */
William Lallemandbd8e6ed2020-09-16 16:08:08 +0200866struct ckch_store *ckchs_load_cert_file(char *path, char **err)
William Lallemand03c331c2020-05-13 10:10:01 +0200867{
868 struct ckch_store *ckchs;
869
William Lallemandbd8e6ed2020-09-16 16:08:08 +0200870 ckchs = ckch_store_new(path);
William Lallemand03c331c2020-05-13 10:10:01 +0200871 if (!ckchs) {
872 memprintf(err, "%sunable to allocate memory.\n", err && *err ? *err : "");
873 goto end;
874 }
William Lallemand03c331c2020-05-13 10:10:01 +0200875
William Lallemandbd8e6ed2020-09-16 16:08:08 +0200876 if (ssl_sock_load_files_into_ckch(path, ckchs->ckch, err) == 1)
877 goto end;
William Lallemand03c331c2020-05-13 10:10:01 +0200878
William Lallemandbd8e6ed2020-09-16 16:08:08 +0200879 /* insert into the ckchs tree */
880 memcpy(ckchs->path, path, strlen(path) + 1);
881 ebst_insert(&ckchs_tree, &ckchs->node);
William Lallemand03c331c2020-05-13 10:10:01 +0200882 return ckchs;
883
884end:
885 ckch_store_free(ckchs);
886
887 return NULL;
888}
889
William Lallemandfa1d8b42020-05-13 15:46:10 +0200890
891/******************** ckch_inst functions ******************************/
892
893/* unlink a ckch_inst, free all SNIs, free the ckch_inst */
894/* The caller must use the lock of the bind_conf if used with inserted SNIs */
895void ckch_inst_free(struct ckch_inst *inst)
896{
897 struct sni_ctx *sni, *sni_s;
898
899 if (inst == NULL)
900 return;
901
902 list_for_each_entry_safe(sni, sni_s, &inst->sni_ctx, by_ckch_inst) {
903 SSL_CTX_free(sni->ctx);
904 LIST_DEL(&sni->by_ckch_inst);
905 ebmb_delete(&sni->name);
906 free(sni);
907 }
Remi Tricot-Le Bretonf3eedfe2021-01-25 17:19:44 +0100908 SSL_CTX_free(inst->ctx);
909 inst->ctx = NULL;
William Lallemandfa1d8b42020-05-13 15:46:10 +0200910 LIST_DEL(&inst->by_ckchs);
911 LIST_DEL(&inst->by_crtlist_entry);
912 free(inst);
913}
914
915/* Alloc and init a ckch_inst */
916struct ckch_inst *ckch_inst_new()
917{
918 struct ckch_inst *ckch_inst;
919
920 ckch_inst = calloc(1, sizeof *ckch_inst);
921 if (!ckch_inst)
922 return NULL;
923
924 LIST_INIT(&ckch_inst->sni_ctx);
925 LIST_INIT(&ckch_inst->by_ckchs);
926 LIST_INIT(&ckch_inst->by_crtlist_entry);
927
928 return ckch_inst;
929}
930
William Lallemandda8584c2020-05-14 10:14:37 +0200931/*************************** CLI commands ***********************/
932
933/* Type of SSL payloads that can be updated over the CLI */
934
935enum {
936 CERT_TYPE_PEM = 0,
937 CERT_TYPE_KEY,
938#if ((defined SSL_CTRL_SET_TLSEXT_STATUS_REQ_CB && !defined OPENSSL_NO_OCSP) || defined OPENSSL_IS_BORINGSSL)
939 CERT_TYPE_OCSP,
940#endif
941 CERT_TYPE_ISSUER,
942#if (HA_OPENSSL_VERSION_NUMBER >= 0x1000200fL && !defined OPENSSL_NO_TLSEXT && !defined OPENSSL_IS_BORINGSSL)
943 CERT_TYPE_SCTL,
944#endif
945 CERT_TYPE_MAX,
946};
947
948struct {
949 const char *ext;
950 int type;
951 int (*load)(const char *path, char *payload, struct cert_key_and_chain *ckch, char **err);
952 /* add a parsing callback */
953} cert_exts[CERT_TYPE_MAX+1] = {
954 [CERT_TYPE_PEM] = { "", CERT_TYPE_PEM, &ssl_sock_load_pem_into_ckch }, /* default mode, no extensions */
955 [CERT_TYPE_KEY] = { "key", CERT_TYPE_KEY, &ssl_sock_load_key_into_ckch },
956#if ((defined SSL_CTRL_SET_TLSEXT_STATUS_REQ_CB && !defined OPENSSL_NO_OCSP) || defined OPENSSL_IS_BORINGSSL)
957 [CERT_TYPE_OCSP] = { "ocsp", CERT_TYPE_OCSP, &ssl_sock_load_ocsp_response_from_file },
958#endif
959#if (HA_OPENSSL_VERSION_NUMBER >= 0x1000200fL && !defined OPENSSL_NO_TLSEXT && !defined OPENSSL_IS_BORINGSSL)
960 [CERT_TYPE_SCTL] = { "sctl", CERT_TYPE_SCTL, &ssl_sock_load_sctl_from_file },
961#endif
962 [CERT_TYPE_ISSUER] = { "issuer", CERT_TYPE_ISSUER, &ssl_sock_load_issuer_file_into_ckch },
963 [CERT_TYPE_MAX] = { NULL, CERT_TYPE_MAX, NULL },
964};
965
966
967/* release function of the `show ssl cert' command */
968static void cli_release_show_cert(struct appctx *appctx)
969{
970 HA_SPIN_UNLOCK(CKCH_LOCK, &ckch_lock);
971}
972
973/* IO handler of "show ssl cert <filename>" */
974static int cli_io_handler_show_cert(struct appctx *appctx)
975{
976 struct buffer *trash = alloc_trash_chunk();
977 struct ebmb_node *node;
978 struct stream_interface *si = appctx->owner;
979 struct ckch_store *ckchs;
980
981 if (trash == NULL)
982 return 1;
983
984 if (!appctx->ctx.ssl.old_ckchs) {
985 if (ckchs_transaction.old_ckchs) {
986 ckchs = ckchs_transaction.old_ckchs;
987 chunk_appendf(trash, "# transaction\n");
William Lallemand5685ccf2020-09-16 16:12:25 +0200988 chunk_appendf(trash, "*%s\n", ckchs->path);
William Lallemandda8584c2020-05-14 10:14:37 +0200989 }
990 }
991
992 if (!appctx->ctx.cli.p0) {
993 chunk_appendf(trash, "# filename\n");
994 node = ebmb_first(&ckchs_tree);
995 } else {
996 node = &((struct ckch_store *)appctx->ctx.cli.p0)->node;
997 }
998 while (node) {
999 ckchs = ebmb_entry(node, struct ckch_store, node);
William Lallemand5685ccf2020-09-16 16:12:25 +02001000 chunk_appendf(trash, "%s\n", ckchs->path);
William Lallemandda8584c2020-05-14 10:14:37 +02001001
1002 node = ebmb_next(node);
1003 if (ci_putchk(si_ic(si), trash) == -1) {
1004 si_rx_room_blk(si);
1005 goto yield;
1006 }
1007 }
1008
1009 appctx->ctx.cli.p0 = NULL;
1010 free_trash_chunk(trash);
1011 return 1;
1012yield:
1013
1014 free_trash_chunk(trash);
1015 appctx->ctx.cli.p0 = ckchs;
1016 return 0; /* should come back */
1017}
1018
1019/*
1020 * Extract and format the DNS SAN extensions and copy result into a chuink
1021 * Return 0;
1022 */
1023#ifdef SSL_CTRL_SET_TLSEXT_HOSTNAME
1024static int ssl_sock_get_san_oneline(X509 *cert, struct buffer *out)
1025{
1026 int i;
1027 char *str;
1028 STACK_OF(GENERAL_NAME) *names = NULL;
1029
1030 names = X509_get_ext_d2i(cert, NID_subject_alt_name, NULL, NULL);
1031 if (names) {
1032 for (i = 0; i < sk_GENERAL_NAME_num(names); i++) {
1033 GENERAL_NAME *name = sk_GENERAL_NAME_value(names, i);
1034 if (i > 0)
1035 chunk_appendf(out, ", ");
1036 if (name->type == GEN_DNS) {
1037 if (ASN1_STRING_to_UTF8((unsigned char **)&str, name->d.dNSName) >= 0) {
1038 chunk_appendf(out, "DNS:%s", str);
1039 OPENSSL_free(str);
1040 }
1041 }
1042 }
1043 sk_GENERAL_NAME_pop_free(names, GENERAL_NAME_free);
1044 }
1045 return 0;
1046}
1047#endif
1048
1049
1050
1051
1052/* IO handler of the details "show ssl cert <filename>" */
1053static int cli_io_handler_show_cert_detail(struct appctx *appctx)
1054{
1055 struct stream_interface *si = appctx->owner;
1056 struct ckch_store *ckchs = appctx->ctx.cli.p0;
1057 struct buffer *out = alloc_trash_chunk();
1058 struct buffer *tmp = alloc_trash_chunk();
1059 X509_NAME *name = NULL;
1060 STACK_OF(X509) *chain;
1061 unsigned int len = 0;
1062 int write = -1;
1063 BIO *bio = NULL;
1064 int i;
1065
1066 if (!tmp || !out)
1067 goto end_no_putchk;
1068
William Lallemand5685ccf2020-09-16 16:12:25 +02001069 chunk_appendf(out, "Filename: ");
1070 if (ckchs == ckchs_transaction.new_ckchs)
1071 chunk_appendf(out, "*");
1072 chunk_appendf(out, "%s\n", ckchs->path);
William Lallemandda8584c2020-05-14 10:14:37 +02001073
William Lallemand5685ccf2020-09-16 16:12:25 +02001074 chunk_appendf(out, "Status: ");
1075 if (ckchs->ckch->cert == NULL)
1076 chunk_appendf(out, "Empty\n");
1077 else if (LIST_ISEMPTY(&ckchs->ckch_inst))
1078 chunk_appendf(out, "Unused\n");
1079 else
1080 chunk_appendf(out, "Used\n");
William Lallemandda8584c2020-05-14 10:14:37 +02001081
William Lallemand5685ccf2020-09-16 16:12:25 +02001082 if (ckchs->ckch->cert == NULL)
1083 goto end;
William Lallemandda8584c2020-05-14 10:14:37 +02001084
William Lallemand5685ccf2020-09-16 16:12:25 +02001085 chain = ckchs->ckch->chain;
1086 if (chain == NULL) {
1087 struct issuer_chain *issuer;
1088 issuer = ssl_get0_issuer_chain(ckchs->ckch->cert);
1089 if (issuer) {
1090 chain = issuer->chain;
1091 chunk_appendf(out, "Chain Filename: ");
1092 chunk_appendf(out, "%s\n", issuer->path);
William Lallemandda8584c2020-05-14 10:14:37 +02001093 }
William Lallemand5685ccf2020-09-16 16:12:25 +02001094 }
1095 chunk_appendf(out, "Serial: ");
1096 if (ssl_sock_get_serial(ckchs->ckch->cert, tmp) == -1)
1097 goto end;
1098 dump_binary(out, tmp->area, tmp->data);
1099 chunk_appendf(out, "\n");
William Lallemandda8584c2020-05-14 10:14:37 +02001100
William Lallemand5685ccf2020-09-16 16:12:25 +02001101 chunk_appendf(out, "notBefore: ");
1102 chunk_reset(tmp);
1103 if ((bio = BIO_new(BIO_s_mem())) == NULL)
1104 goto end;
1105 if (ASN1_TIME_print(bio, X509_getm_notBefore(ckchs->ckch->cert)) == 0)
1106 goto end;
1107 write = BIO_read(bio, tmp->area, tmp->size-1);
1108 tmp->area[write] = '\0';
1109 BIO_free(bio);
1110 bio = NULL;
1111 chunk_appendf(out, "%s\n", tmp->area);
William Lallemandda8584c2020-05-14 10:14:37 +02001112
William Lallemand5685ccf2020-09-16 16:12:25 +02001113 chunk_appendf(out, "notAfter: ");
1114 chunk_reset(tmp);
1115 if ((bio = BIO_new(BIO_s_mem())) == NULL)
1116 goto end;
1117 if (ASN1_TIME_print(bio, X509_getm_notAfter(ckchs->ckch->cert)) == 0)
1118 goto end;
1119 if ((write = BIO_read(bio, tmp->area, tmp->size-1)) <= 0)
1120 goto end;
1121 tmp->area[write] = '\0';
1122 BIO_free(bio);
1123 bio = NULL;
1124 chunk_appendf(out, "%s\n", tmp->area);
William Lallemandda8584c2020-05-14 10:14:37 +02001125
1126#ifdef SSL_CTRL_SET_TLSEXT_HOSTNAME
William Lallemand5685ccf2020-09-16 16:12:25 +02001127 chunk_appendf(out, "Subject Alternative Name: ");
1128 if (ssl_sock_get_san_oneline(ckchs->ckch->cert, out) == -1)
1129 goto end;
1130 *(out->area + out->data) = '\0';
1131 chunk_appendf(out, "\n");
William Lallemandda8584c2020-05-14 10:14:37 +02001132#endif
William Lallemand5685ccf2020-09-16 16:12:25 +02001133 chunk_reset(tmp);
1134 chunk_appendf(out, "Algorithm: ");
1135 if (cert_get_pkey_algo(ckchs->ckch->cert, tmp) == 0)
1136 goto end;
1137 chunk_appendf(out, "%s\n", tmp->area);
William Lallemandda8584c2020-05-14 10:14:37 +02001138
William Lallemand5685ccf2020-09-16 16:12:25 +02001139 chunk_reset(tmp);
1140 chunk_appendf(out, "SHA1 FingerPrint: ");
1141 if (X509_digest(ckchs->ckch->cert, EVP_sha1(), (unsigned char *) tmp->area, &len) == 0)
1142 goto end;
1143 tmp->data = len;
1144 dump_binary(out, tmp->area, tmp->data);
1145 chunk_appendf(out, "\n");
William Lallemandda8584c2020-05-14 10:14:37 +02001146
William Lallemand5685ccf2020-09-16 16:12:25 +02001147 chunk_appendf(out, "Subject: ");
1148 if ((name = X509_get_subject_name(ckchs->ckch->cert)) == NULL)
1149 goto end;
1150 if ((ssl_sock_get_dn_oneline(name, tmp)) == -1)
1151 goto end;
1152 *(tmp->area + tmp->data) = '\0';
1153 chunk_appendf(out, "%s\n", tmp->area);
1154
1155 chunk_appendf(out, "Issuer: ");
1156 if ((name = X509_get_issuer_name(ckchs->ckch->cert)) == NULL)
1157 goto end;
1158 if ((ssl_sock_get_dn_oneline(name, tmp)) == -1)
1159 goto end;
1160 *(tmp->area + tmp->data) = '\0';
1161 chunk_appendf(out, "%s\n", tmp->area);
1162
1163 /* Displays subject of each certificate in the chain */
1164 for (i = 0; i < sk_X509_num(chain); i++) {
1165 X509 *ca = sk_X509_value(chain, i);
1166
1167 chunk_appendf(out, "Chain Subject: ");
1168 if ((name = X509_get_subject_name(ca)) == NULL)
William Lallemandda8584c2020-05-14 10:14:37 +02001169 goto end;
1170 if ((ssl_sock_get_dn_oneline(name, tmp)) == -1)
1171 goto end;
1172 *(tmp->area + tmp->data) = '\0';
1173 chunk_appendf(out, "%s\n", tmp->area);
1174
William Lallemand5685ccf2020-09-16 16:12:25 +02001175 chunk_appendf(out, "Chain Issuer: ");
1176 if ((name = X509_get_issuer_name(ca)) == NULL)
William Lallemandda8584c2020-05-14 10:14:37 +02001177 goto end;
1178 if ((ssl_sock_get_dn_oneline(name, tmp)) == -1)
1179 goto end;
1180 *(tmp->area + tmp->data) = '\0';
1181 chunk_appendf(out, "%s\n", tmp->area);
William Lallemandda8584c2020-05-14 10:14:37 +02001182 }
1183
1184end:
1185 if (ci_putchk(si_ic(si), out) == -1) {
1186 si_rx_room_blk(si);
1187 goto yield;
1188 }
1189
1190end_no_putchk:
1191 if (bio)
1192 BIO_free(bio);
1193 free_trash_chunk(tmp);
1194 free_trash_chunk(out);
1195 return 1;
1196yield:
1197 free_trash_chunk(tmp);
1198 free_trash_chunk(out);
1199 return 0; /* should come back */
1200}
1201
1202/* parsing function for 'show ssl cert [certfile]' */
1203static int cli_parse_show_cert(char **args, char *payload, struct appctx *appctx, void *private)
1204{
1205 struct ckch_store *ckchs;
1206
1207 if (!cli_has_level(appctx, ACCESS_LVL_OPER))
1208 return cli_err(appctx, "Can't allocate memory!\n");
1209
1210 /* The operations on the CKCH architecture are locked so we can
1211 * manipulate ckch_store and ckch_inst */
1212 if (HA_SPIN_TRYLOCK(CKCH_LOCK, &ckch_lock))
1213 return cli_err(appctx, "Can't show!\nOperations on certificates are currently locked!\n");
1214
1215 /* check if there is a certificate to lookup */
1216 if (*args[3]) {
1217 if (*args[3] == '*') {
1218 if (!ckchs_transaction.new_ckchs)
1219 goto error;
1220
1221 ckchs = ckchs_transaction.new_ckchs;
1222
Tim Duesterhuse5ff1412021-01-02 22:31:53 +01001223 if (strcmp(args[3] + 1, ckchs->path) != 0)
William Lallemandda8584c2020-05-14 10:14:37 +02001224 goto error;
1225
1226 } else {
1227 if ((ckchs = ckchs_lookup(args[3])) == NULL)
1228 goto error;
1229
1230 }
1231
William Lallemandda8584c2020-05-14 10:14:37 +02001232 appctx->ctx.cli.p0 = ckchs;
1233 /* use the IO handler that shows details */
1234 appctx->io_handler = cli_io_handler_show_cert_detail;
1235 }
1236
1237 return 0;
1238
1239error:
1240 HA_SPIN_UNLOCK(CKCH_LOCK, &ckch_lock);
1241 return cli_err(appctx, "Can't display the certificate: Not found or the certificate is a bundle!\n");
1242}
1243
1244/* release function of the `set ssl cert' command, free things and unlock the spinlock */
1245static void cli_release_commit_cert(struct appctx *appctx)
1246{
1247 struct ckch_store *new_ckchs;
1248
1249 HA_SPIN_UNLOCK(CKCH_LOCK, &ckch_lock);
1250
1251 if (appctx->st2 != SETCERT_ST_FIN) {
1252 /* free every new sni_ctx and the new store, which are not in the trees so no spinlock there */
1253 new_ckchs = appctx->ctx.ssl.new_ckchs;
1254
1255 /* if the allocation failed, we need to free everything from the temporary list */
1256 ckch_store_free(new_ckchs);
1257 }
1258}
1259
1260/*
1261 * This function tries to create the new ckch_inst and their SNIs
1262 */
1263static int cli_io_handler_commit_cert(struct appctx *appctx)
1264{
1265 struct stream_interface *si = appctx->owner;
1266 int y = 0;
1267 char *err = NULL;
1268 int errcode = 0;
1269 struct ckch_store *old_ckchs, *new_ckchs = NULL;
1270 struct ckch_inst *ckchi, *ckchis;
1271 struct buffer *trash = alloc_trash_chunk();
1272 struct sni_ctx *sc0, *sc0s;
1273 struct crtlist_entry *entry;
1274
1275 if (trash == NULL)
1276 goto error;
1277
1278 if (unlikely(si_ic(si)->flags & (CF_WRITE_ERROR|CF_SHUTW)))
1279 goto error;
1280
1281 while (1) {
1282 switch (appctx->st2) {
1283 case SETCERT_ST_INIT:
1284 /* This state just print the update message */
1285 chunk_printf(trash, "Committing %s", ckchs_transaction.path);
1286 if (ci_putchk(si_ic(si), trash) == -1) {
1287 si_rx_room_blk(si);
1288 goto yield;
1289 }
1290 appctx->st2 = SETCERT_ST_GEN;
1291 /* fallthrough */
1292 case SETCERT_ST_GEN:
1293 /*
1294 * This state generates the ckch instances with their
1295 * sni_ctxs and SSL_CTX.
1296 *
1297 * Since the SSL_CTX generation can be CPU consumer, we
1298 * yield every 10 instances.
1299 */
1300
1301 old_ckchs = appctx->ctx.ssl.old_ckchs;
1302 new_ckchs = appctx->ctx.ssl.new_ckchs;
1303
1304 if (!new_ckchs)
1305 continue;
1306
1307 /* get the next ckchi to regenerate */
1308 ckchi = appctx->ctx.ssl.next_ckchi;
1309 /* we didn't start yet, set it to the first elem */
1310 if (ckchi == NULL)
1311 ckchi = LIST_ELEM(old_ckchs->ckch_inst.n, typeof(ckchi), by_ckchs);
1312
1313 /* walk through the old ckch_inst and creates new ckch_inst using the updated ckchs */
1314 list_for_each_entry_from(ckchi, &old_ckchs->ckch_inst, by_ckchs) {
1315 struct ckch_inst *new_inst;
1316 char **sni_filter = NULL;
1317 int fcount = 0;
1318
1319 /* it takes a lot of CPU to creates SSL_CTXs, so we yield every 10 CKCH instances */
1320 if (y >= 10) {
1321 /* save the next ckchi to compute */
1322 appctx->ctx.ssl.next_ckchi = ckchi;
1323 goto yield;
1324 }
1325
1326 if (ckchi->crtlist_entry) {
1327 sni_filter = ckchi->crtlist_entry->filters;
1328 fcount = ckchi->crtlist_entry->fcount;
1329 }
1330
Remi Tricot-Le Bretond817dc72021-01-25 17:19:43 +01001331 if (ckchi->is_server_instance)
William Lallemand795bd9b2021-01-26 11:27:42 +01001332 errcode |= ckch_inst_new_load_srv_store(new_ckchs->path, new_ckchs, &new_inst, &err);
Remi Tricot-Le Bretonf3eedfe2021-01-25 17:19:44 +01001333 else
1334 errcode |= ckch_inst_new_load_store(new_ckchs->path, new_ckchs, ckchi->bind_conf, ckchi->ssl_conf, sni_filter, fcount, &new_inst, &err);
William Lallemandda8584c2020-05-14 10:14:37 +02001335
1336 if (errcode & ERR_CODE)
1337 goto error;
1338
1339 /* if the previous ckchi was used as the default */
1340 if (ckchi->is_default)
1341 new_inst->is_default = 1;
1342
Remi Tricot-Le Bretonf3eedfe2021-01-25 17:19:44 +01001343 new_inst->is_server_instance = ckchi->is_server_instance;
1344 new_inst->server = ckchi->server;
1345 /* Create a new SSL_CTX and link it to the new instance. */
1346 if (new_inst->is_server_instance) {
William Lallemand795bd9b2021-01-26 11:27:42 +01001347 errcode |= ssl_sock_prepare_srv_ssl_ctx(ckchi->server, new_inst->ctx);
Remi Tricot-Le Bretonf3eedfe2021-01-25 17:19:44 +01001348 if (errcode & ERR_CODE)
1349 goto error;
Remi Tricot-Le Bretonf3eedfe2021-01-25 17:19:44 +01001350 }
1351
William Lallemanda55685b2020-12-15 14:57:46 +01001352 /* create the link to the crtlist_entry */
1353 new_inst->crtlist_entry = ckchi->crtlist_entry;
1354
William Lallemandda8584c2020-05-14 10:14:37 +02001355 /* we need to initialize the SSL_CTX generated */
1356 /* this iterate on the newly generated SNIs in the new instance to prepare their SSL_CTX */
1357 list_for_each_entry_safe(sc0, sc0s, &new_inst->sni_ctx, by_ckch_inst) {
1358 if (!sc0->order) { /* we initialized only the first SSL_CTX because it's the same in the other sni_ctx's */
1359 errcode |= ssl_sock_prepare_ctx(ckchi->bind_conf, ckchi->ssl_conf, sc0->ctx, &err);
1360 if (errcode & ERR_CODE)
1361 goto error;
1362 }
1363 }
1364
1365
1366 /* display one dot per new instance */
1367 chunk_appendf(trash, ".");
1368 /* link the new ckch_inst to the duplicate */
1369 LIST_ADDQ(&new_ckchs->ckch_inst, &new_inst->by_ckchs);
1370 y++;
1371 }
1372 appctx->st2 = SETCERT_ST_INSERT;
1373 /* fallthrough */
1374 case SETCERT_ST_INSERT:
1375 /* The generation is finished, we can insert everything */
1376
1377 old_ckchs = appctx->ctx.ssl.old_ckchs;
1378 new_ckchs = appctx->ctx.ssl.new_ckchs;
1379
1380 if (!new_ckchs)
1381 continue;
1382
1383 /* get the list of crtlist_entry in the old store, and update the pointers to the store */
1384 LIST_SPLICE(&new_ckchs->crtlist_entry, &old_ckchs->crtlist_entry);
1385 list_for_each_entry(entry, &new_ckchs->crtlist_entry, by_ckch_store) {
1386 ebpt_delete(&entry->node);
1387 /* change the ptr and reinsert the node */
1388 entry->node.key = new_ckchs;
1389 ebpt_insert(&entry->crtlist->entries, &entry->node);
1390 }
1391
William Lallemanda55685b2020-12-15 14:57:46 +01001392 /* insert the new ckch_insts in the crtlist_entry */
1393 list_for_each_entry(ckchi, &new_ckchs->ckch_inst, by_ckchs) {
1394 if (ckchi->crtlist_entry)
1395 LIST_ADD(&ckchi->crtlist_entry->ckch_inst, &ckchi->by_crtlist_entry);
1396 }
1397
William Lallemandda8584c2020-05-14 10:14:37 +02001398 /* First, we insert every new SNIs in the trees, also replace the default_ctx */
1399 list_for_each_entry_safe(ckchi, ckchis, &new_ckchs->ckch_inst, by_ckchs) {
Remi Tricot-Le Bretonf3eedfe2021-01-25 17:19:44 +01001400 /* The bind_conf will be null on server ckch_instances. */
1401 if (ckchi->is_server_instance) {
Remi Tricot-Le Bretonf3eedfe2021-01-25 17:19:44 +01001402 /* The certificate update on the server side (backend)
1403 * can be done by rewritting a single pointer so no
1404 * locks are needed here. */
William Lallemand1dedb0a2021-01-26 10:18:57 +01001405 /* free the server current SSL_CTX */
1406 SSL_CTX_free(ckchi->server->ssl_ctx.ctx);
Remi Tricot-Le Bretonf3eedfe2021-01-25 17:19:44 +01001407 /* Actual ssl context update */
William Lallemand1dedb0a2021-01-26 10:18:57 +01001408 SSL_CTX_up_ref(ckchi->ctx);
Remi Tricot-Le Bretonf3eedfe2021-01-25 17:19:44 +01001409 ckchi->server->ssl_ctx.ctx = ckchi->ctx;
Remi Tricot-Le Bretonf3eedfe2021-01-25 17:19:44 +01001410 __ha_barrier_store();
William Lallemand1dedb0a2021-01-26 10:18:57 +01001411 ckchi->server->ssl_ctx.inst = ckchi;
Remi Tricot-Le Bretonf3eedfe2021-01-25 17:19:44 +01001412
William Lallemand1dedb0a2021-01-26 10:18:57 +01001413 } else {
Remi Tricot-Le Bretonf3eedfe2021-01-25 17:19:44 +01001414 HA_RWLOCK_WRLOCK(SNI_LOCK, &ckchi->bind_conf->sni_lock);
1415 ssl_sock_load_cert_sni(ckchi, ckchi->bind_conf);
1416 HA_RWLOCK_WRUNLOCK(SNI_LOCK, &ckchi->bind_conf->sni_lock);
1417 }
William Lallemandda8584c2020-05-14 10:14:37 +02001418 }
1419
1420 /* delete the old sni_ctx, the old ckch_insts and the ckch_store */
1421 list_for_each_entry_safe(ckchi, ckchis, &old_ckchs->ckch_inst, by_ckchs) {
William Lallemandda8584c2020-05-14 10:14:37 +02001422
William Lallemand1dedb0a2021-01-26 10:18:57 +01001423 if (ckchi->is_server_instance) {
1424 /* no lock for servers */
1425 ckch_inst_free(ckchi);
1426 } else {
1427 struct bind_conf __maybe_unused *bind_conf = ckchi->bind_conf;
1428
1429 HA_RWLOCK_WRLOCK(SNI_LOCK, &bind_conf->sni_lock);
1430 ckch_inst_free(ckchi);
1431 HA_RWLOCK_WRUNLOCK(SNI_LOCK, &bind_conf->sni_lock);
1432 }
William Lallemandda8584c2020-05-14 10:14:37 +02001433 }
1434
1435 /* Replace the old ckchs by the new one */
1436 ckch_store_free(old_ckchs);
1437 ebst_insert(&ckchs_tree, &new_ckchs->node);
1438 appctx->st2 = SETCERT_ST_FIN;
1439 /* fallthrough */
1440 case SETCERT_ST_FIN:
1441 /* we achieved the transaction, we can set everything to NULL */
1442 free(ckchs_transaction.path);
1443 ckchs_transaction.path = NULL;
1444 ckchs_transaction.new_ckchs = NULL;
1445 ckchs_transaction.old_ckchs = NULL;
1446 goto end;
1447 }
1448 }
1449end:
1450
1451 chunk_appendf(trash, "\n");
1452 if (errcode & ERR_WARN)
1453 chunk_appendf(trash, "%s", err);
1454 chunk_appendf(trash, "Success!\n");
1455 if (ci_putchk(si_ic(si), trash) == -1)
1456 si_rx_room_blk(si);
1457 free_trash_chunk(trash);
1458 /* success: call the release function and don't come back */
1459 return 1;
1460yield:
1461 /* store the state */
1462 if (ci_putchk(si_ic(si), trash) == -1)
1463 si_rx_room_blk(si);
1464 free_trash_chunk(trash);
1465 si_rx_endp_more(si); /* let's come back later */
1466 return 0; /* should come back */
1467
1468error:
1469 /* spin unlock and free are done in the release function */
1470 if (trash) {
1471 chunk_appendf(trash, "\n%sFailed!\n", err);
1472 if (ci_putchk(si_ic(si), trash) == -1)
1473 si_rx_room_blk(si);
1474 free_trash_chunk(trash);
1475 }
1476 /* error: call the release function and don't come back */
1477 return 1;
1478}
1479
1480/*
1481 * Parsing function of 'commit ssl cert'
1482 */
1483static int cli_parse_commit_cert(char **args, char *payload, struct appctx *appctx, void *private)
1484{
1485 char *err = NULL;
1486
1487 if (!cli_has_level(appctx, ACCESS_LVL_ADMIN))
1488 return 1;
1489
1490 if (!*args[3])
1491 return cli_err(appctx, "'commit ssl cert expects a filename\n");
1492
1493 /* The operations on the CKCH architecture are locked so we can
1494 * manipulate ckch_store and ckch_inst */
1495 if (HA_SPIN_TRYLOCK(CKCH_LOCK, &ckch_lock))
1496 return cli_err(appctx, "Can't commit the certificate!\nOperations on certificates are currently locked!\n");
1497
1498 if (!ckchs_transaction.path) {
1499 memprintf(&err, "No ongoing transaction! !\n");
1500 goto error;
1501 }
1502
1503 if (strcmp(ckchs_transaction.path, args[3]) != 0) {
1504 memprintf(&err, "The ongoing transaction is about '%s' but you are trying to set '%s'\n", ckchs_transaction.path, args[3]);
1505 goto error;
1506 }
1507
William Lallemand5685ccf2020-09-16 16:12:25 +02001508 /* if a certificate is here, a private key must be here too */
1509 if (ckchs_transaction.new_ckchs->ckch->cert && !ckchs_transaction.new_ckchs->ckch->key) {
1510 memprintf(&err, "The transaction must contain at least a certificate and a private key!\n");
1511 goto error;
1512 }
William Lallemanda9419522020-06-24 16:26:41 +02001513
William Lallemand5685ccf2020-09-16 16:12:25 +02001514 if (!X509_check_private_key(ckchs_transaction.new_ckchs->ckch->cert, ckchs_transaction.new_ckchs->ckch->key)) {
1515 memprintf(&err, "inconsistencies between private key and certificate loaded '%s'.\n", ckchs_transaction.path);
1516 goto error;
William Lallemandda8584c2020-05-14 10:14:37 +02001517 }
1518
1519 /* init the appctx structure */
1520 appctx->st2 = SETCERT_ST_INIT;
1521 appctx->ctx.ssl.next_ckchi = NULL;
1522 appctx->ctx.ssl.new_ckchs = ckchs_transaction.new_ckchs;
1523 appctx->ctx.ssl.old_ckchs = ckchs_transaction.old_ckchs;
1524
1525 /* we don't unlock there, it will be unlock after the IO handler, in the release handler */
1526 return 0;
1527
1528error:
1529
1530 HA_SPIN_UNLOCK(CKCH_LOCK, &ckch_lock);
1531 err = memprintf(&err, "%sCan't commit %s!\n", err ? err : "", args[3]);
1532
1533 return cli_dynerr(appctx, err);
1534}
1535
1536
1537
1538
1539/*
1540 * Parsing function of `set ssl cert`, it updates or creates a temporary ckch.
1541 */
1542static int cli_parse_set_cert(char **args, char *payload, struct appctx *appctx, void *private)
1543{
1544 struct ckch_store *new_ckchs = NULL;
1545 struct ckch_store *old_ckchs = NULL;
1546 char *err = NULL;
1547 int i;
William Lallemandda8584c2020-05-14 10:14:37 +02001548 int errcode = 0;
1549 char *end;
1550 int type = CERT_TYPE_PEM;
1551 struct cert_key_and_chain *ckch;
1552 struct buffer *buf;
1553
1554 if (!cli_has_level(appctx, ACCESS_LVL_ADMIN))
1555 return 1;
1556
William Lallemandda8584c2020-05-14 10:14:37 +02001557 if (!*args[3] || !payload)
1558 return cli_err(appctx, "'set ssl cert expects a filename and a certificate as a payload\n");
1559
1560 /* The operations on the CKCH architecture are locked so we can
1561 * manipulate ckch_store and ckch_inst */
1562 if (HA_SPIN_TRYLOCK(CKCH_LOCK, &ckch_lock))
1563 return cli_err(appctx, "Can't update the certificate!\nOperations on certificates are currently locked!\n");
1564
William Lallemande5ff4ad2020-06-08 09:40:37 +02001565 if ((buf = alloc_trash_chunk()) == NULL)
1566 return cli_err(appctx, "Can't allocate memory\n");
1567
William Lallemandda8584c2020-05-14 10:14:37 +02001568 if (!chunk_strcpy(buf, args[3])) {
1569 memprintf(&err, "%sCan't allocate memory\n", err ? err : "");
1570 errcode |= ERR_ALERT | ERR_FATAL;
1571 goto end;
1572 }
1573
1574 /* check which type of file we want to update */
1575 for (i = 0; cert_exts[i].type < CERT_TYPE_MAX; i++) {
1576 end = strrchr(buf->area, '.');
Tim Duesterhuse5ff1412021-01-02 22:31:53 +01001577 if (end && *cert_exts[i].ext && (strcmp(end + 1, cert_exts[i].ext) == 0)) {
William Lallemandda8584c2020-05-14 10:14:37 +02001578 *end = '\0';
William Lallemand089c1382020-10-23 17:35:12 +02001579 buf->data = strlen(buf->area);
William Lallemandda8584c2020-05-14 10:14:37 +02001580 type = cert_exts[i].type;
1581 break;
1582 }
1583 }
1584
1585 appctx->ctx.ssl.old_ckchs = NULL;
1586 appctx->ctx.ssl.new_ckchs = NULL;
1587
1588 /* if there is an ongoing transaction */
1589 if (ckchs_transaction.path) {
William Lallemandda8584c2020-05-14 10:14:37 +02001590 /* if there is an ongoing transaction, check if this is the same file */
1591 if (strcmp(ckchs_transaction.path, buf->area) != 0) {
William Lallemand089c1382020-10-23 17:35:12 +02001592 /* we didn't find the transaction, must try more cases below */
1593
1594 /* if the del-ext option is activated we should try to take a look at a ".crt" too. */
1595 if (type != CERT_TYPE_PEM && global_ssl.extra_files_noext) {
1596 if (!chunk_strcat(buf, ".crt")) {
1597 memprintf(&err, "%sCan't allocate memory\n", err ? err : "");
1598 errcode |= ERR_ALERT | ERR_FATAL;
1599 goto end;
1600 }
1601
1602 if (strcmp(ckchs_transaction.path, buf->area) != 0) {
1603 /* remove .crt of the error message */
1604 *(b_orig(buf) + b_data(buf) + strlen(".crt")) = '\0';
1605 b_sub(buf, strlen(".crt"));
1606
1607 memprintf(&err, "The ongoing transaction is about '%s' but you are trying to set '%s'\n", ckchs_transaction.path, buf->area);
1608 errcode |= ERR_ALERT | ERR_FATAL;
1609 goto end;
1610 }
1611 }
William Lallemandda8584c2020-05-14 10:14:37 +02001612 }
1613
1614 appctx->ctx.ssl.old_ckchs = ckchs_transaction.new_ckchs;
1615
1616 } else {
William Lallemandda8584c2020-05-14 10:14:37 +02001617
William Lallemand95fefa12020-09-09 12:01:33 +02001618 /* lookup for the certificate in the tree */
1619 appctx->ctx.ssl.old_ckchs = ckchs_lookup(buf->area);
William Lallemand089c1382020-10-23 17:35:12 +02001620
1621 if (!appctx->ctx.ssl.old_ckchs) {
1622 /* if the del-ext option is activated we should try to take a look at a ".crt" too. */
1623 if (type != CERT_TYPE_PEM && global_ssl.extra_files_noext) {
1624 if (!chunk_strcat(buf, ".crt")) {
1625 memprintf(&err, "%sCan't allocate memory\n", err ? err : "");
1626 errcode |= ERR_ALERT | ERR_FATAL;
1627 goto end;
1628 }
1629 appctx->ctx.ssl.old_ckchs = ckchs_lookup(buf->area);
1630 }
1631 }
William Lallemandda8584c2020-05-14 10:14:37 +02001632 }
1633
1634 if (!appctx->ctx.ssl.old_ckchs) {
1635 memprintf(&err, "%sCan't replace a certificate which is not referenced by the configuration!\n",
1636 err ? err : "");
1637 errcode |= ERR_ALERT | ERR_FATAL;
1638 goto end;
1639 }
1640
1641 if (!appctx->ctx.ssl.path) {
1642 /* this is a new transaction, set the path of the transaction */
1643 appctx->ctx.ssl.path = strdup(appctx->ctx.ssl.old_ckchs->path);
1644 if (!appctx->ctx.ssl.path) {
1645 memprintf(&err, "%sCan't allocate memory\n", err ? err : "");
1646 errcode |= ERR_ALERT | ERR_FATAL;
1647 goto end;
1648 }
1649 }
1650
1651 old_ckchs = appctx->ctx.ssl.old_ckchs;
1652
1653 /* duplicate the ckch store */
1654 new_ckchs = ckchs_dup(old_ckchs);
1655 if (!new_ckchs) {
1656 memprintf(&err, "%sCannot allocate memory!\n",
1657 err ? err : "");
1658 errcode |= ERR_ALERT | ERR_FATAL;
1659 goto end;
1660 }
1661
William Lallemand95fefa12020-09-09 12:01:33 +02001662 ckch = new_ckchs->ckch;
William Lallemandda8584c2020-05-14 10:14:37 +02001663
1664 /* appply the change on the duplicate */
1665 if (cert_exts[type].load(buf->area, payload, ckch, &err) != 0) {
1666 memprintf(&err, "%sCan't load the payload\n", err ? err : "");
1667 errcode |= ERR_ALERT | ERR_FATAL;
1668 goto end;
1669 }
1670
1671 appctx->ctx.ssl.new_ckchs = new_ckchs;
1672
1673 /* we succeed, we can save the ckchs in the transaction */
1674
1675 /* if there wasn't a transaction, update the old ckchs */
1676 if (!ckchs_transaction.old_ckchs) {
1677 ckchs_transaction.old_ckchs = appctx->ctx.ssl.old_ckchs;
1678 ckchs_transaction.path = appctx->ctx.ssl.path;
1679 err = memprintf(&err, "Transaction created for certificate %s!\n", ckchs_transaction.path);
1680 } else {
1681 err = memprintf(&err, "Transaction updated for certificate %s!\n", ckchs_transaction.path);
1682
1683 }
1684
1685 /* free the previous ckchs if there was a transaction */
1686 ckch_store_free(ckchs_transaction.new_ckchs);
1687
1688 ckchs_transaction.new_ckchs = appctx->ctx.ssl.new_ckchs;
1689
1690
1691 /* creates the SNI ctxs later in the IO handler */
1692
1693end:
1694 free_trash_chunk(buf);
1695
1696 if (errcode & ERR_CODE) {
1697
1698 ckch_store_free(appctx->ctx.ssl.new_ckchs);
1699 appctx->ctx.ssl.new_ckchs = NULL;
1700
1701 appctx->ctx.ssl.old_ckchs = NULL;
1702
1703 free(appctx->ctx.ssl.path);
1704 appctx->ctx.ssl.path = NULL;
1705
1706 HA_SPIN_UNLOCK(CKCH_LOCK, &ckch_lock);
1707 return cli_dynerr(appctx, memprintf(&err, "%sCan't update %s!\n", err ? err : "", args[3]));
1708 } else {
1709
1710 HA_SPIN_UNLOCK(CKCH_LOCK, &ckch_lock);
1711 return cli_dynmsg(appctx, LOG_NOTICE, err);
1712 }
1713 /* TODO: handle the ERR_WARN which are not handled because of the io_handler */
1714}
1715
1716/* parsing function of 'abort ssl cert' */
1717static int cli_parse_abort_cert(char **args, char *payload, struct appctx *appctx, void *private)
1718{
1719 char *err = NULL;
1720
1721 if (!cli_has_level(appctx, ACCESS_LVL_ADMIN))
1722 return 1;
1723
1724 if (!*args[3])
1725 return cli_err(appctx, "'abort ssl cert' expects a filename\n");
1726
1727 /* The operations on the CKCH architecture are locked so we can
1728 * manipulate ckch_store and ckch_inst */
1729 if (HA_SPIN_TRYLOCK(CKCH_LOCK, &ckch_lock))
1730 return cli_err(appctx, "Can't abort!\nOperations on certificates are currently locked!\n");
1731
1732 if (!ckchs_transaction.path) {
1733 memprintf(&err, "No ongoing transaction!\n");
1734 goto error;
1735 }
1736
1737 if (strcmp(ckchs_transaction.path, args[3]) != 0) {
1738 memprintf(&err, "The ongoing transaction is about '%s' but you are trying to abort a transaction for '%s'\n", ckchs_transaction.path, args[3]);
1739 goto error;
1740 }
1741
1742 /* Only free the ckchs there, because the SNI and instances were not generated yet */
1743 ckch_store_free(ckchs_transaction.new_ckchs);
1744 ckchs_transaction.new_ckchs = NULL;
1745 ckch_store_free(ckchs_transaction.old_ckchs);
1746 ckchs_transaction.old_ckchs = NULL;
1747 free(ckchs_transaction.path);
1748 ckchs_transaction.path = NULL;
1749
1750 HA_SPIN_UNLOCK(CKCH_LOCK, &ckch_lock);
1751
1752 err = memprintf(&err, "Transaction aborted for certificate '%s'!\n", args[3]);
1753 return cli_dynmsg(appctx, LOG_NOTICE, err);
1754
1755error:
1756 HA_SPIN_UNLOCK(CKCH_LOCK, &ckch_lock);
1757
1758 return cli_dynerr(appctx, err);
1759}
1760
1761/* parsing function of 'new ssl cert' */
1762static int cli_parse_new_cert(char **args, char *payload, struct appctx *appctx, void *private)
1763{
1764 struct ckch_store *store;
1765 char *err = NULL;
1766 char *path;
1767
1768 if (!cli_has_level(appctx, ACCESS_LVL_ADMIN))
1769 return 1;
1770
1771 if (!*args[3])
1772 return cli_err(appctx, "'new ssl cert' expects a filename\n");
1773
1774 path = args[3];
1775
1776 /* The operations on the CKCH architecture are locked so we can
1777 * manipulate ckch_store and ckch_inst */
1778 if (HA_SPIN_TRYLOCK(CKCH_LOCK, &ckch_lock))
1779 return cli_err(appctx, "Can't create a certificate!\nOperations on certificates are currently locked!\n");
1780
1781 store = ckchs_lookup(path);
1782 if (store != NULL) {
1783 memprintf(&err, "Certificate '%s' already exists!\n", path);
1784 store = NULL; /* we don't want to free it */
1785 goto error;
1786 }
1787 /* we won't support multi-certificate bundle here */
William Lallemandbd8e6ed2020-09-16 16:08:08 +02001788 store = ckch_store_new(path);
William Lallemandda8584c2020-05-14 10:14:37 +02001789 if (!store) {
1790 memprintf(&err, "unable to allocate memory.\n");
1791 goto error;
1792 }
1793
1794 /* insert into the ckchs tree */
1795 ebst_insert(&ckchs_tree, &store->node);
1796 memprintf(&err, "New empty certificate store '%s'!\n", args[3]);
1797
1798 HA_SPIN_UNLOCK(CKCH_LOCK, &ckch_lock);
1799 return cli_dynmsg(appctx, LOG_NOTICE, err);
1800error:
1801 free(store);
1802 HA_SPIN_UNLOCK(CKCH_LOCK, &ckch_lock);
1803 return cli_dynerr(appctx, err);
1804}
1805
1806/* parsing function of 'del ssl cert' */
1807static int cli_parse_del_cert(char **args, char *payload, struct appctx *appctx, void *private)
1808{
1809 struct ckch_store *store;
1810 char *err = NULL;
1811 char *filename;
1812
1813 if (!cli_has_level(appctx, ACCESS_LVL_ADMIN))
1814 return 1;
1815
1816 if (!*args[3])
1817 return cli_err(appctx, "'del ssl cert' expects a certificate name\n");
1818
1819 if (HA_SPIN_TRYLOCK(CKCH_LOCK, &ckch_lock))
1820 return cli_err(appctx, "Can't delete the certificate!\nOperations on certificates are currently locked!\n");
1821
1822 filename = args[3];
1823
1824 store = ckchs_lookup(filename);
1825 if (store == NULL) {
1826 memprintf(&err, "certificate '%s' doesn't exist!\n", filename);
1827 goto error;
1828 }
1829 if (!LIST_ISEMPTY(&store->ckch_inst)) {
1830 memprintf(&err, "certificate '%s' in use, can't be deleted!\n", filename);
1831 goto error;
1832 }
1833
1834 ebmb_delete(&store->node);
1835 ckch_store_free(store);
1836
1837 memprintf(&err, "Certificate '%s' deleted!\n", filename);
1838
1839 HA_SPIN_UNLOCK(CKCH_LOCK, &ckch_lock);
1840 return cli_dynmsg(appctx, LOG_NOTICE, err);
1841
1842error:
1843 memprintf(&err, "Can't remove the certificate: %s\n", err ? err : "");
1844 HA_SPIN_UNLOCK(CKCH_LOCK, &ckch_lock);
1845 return cli_dynerr(appctx, err);
1846}
1847
William Lallemandee8530c2020-06-23 18:19:42 +02001848void ckch_deinit()
1849{
1850 struct eb_node *node, *next;
1851 struct ckch_store *store;
1852
1853 node = eb_first(&ckchs_tree);
1854 while (node) {
1855 next = eb_next(node);
1856 store = ebmb_entry(node, struct ckch_store, node);
1857 ckch_store_free(store);
1858 node = next;
1859 }
1860}
William Lallemandda8584c2020-05-14 10:14:37 +02001861
1862/* register cli keywords */
1863static struct cli_kw_list cli_kws = {{ },{
1864 { { "new", "ssl", "cert", NULL }, "new ssl cert <certfile> : create a new certificate file to be used in a crt-list or a directory", cli_parse_new_cert, NULL, NULL },
1865 { { "set", "ssl", "cert", NULL }, "set ssl cert <certfile> <payload> : replace a certificate file", cli_parse_set_cert, NULL, NULL },
1866 { { "commit", "ssl", "cert", NULL }, "commit ssl cert <certfile> : commit a certificate file", cli_parse_commit_cert, cli_io_handler_commit_cert, cli_release_commit_cert },
1867 { { "abort", "ssl", "cert", NULL }, "abort ssl cert <certfile> : abort a transaction for a certificate file", cli_parse_abort_cert, NULL, NULL },
1868 { { "del", "ssl", "cert", NULL }, "del ssl cert <certfile> : delete an unused certificate file", cli_parse_del_cert, NULL, NULL },
1869 { { "show", "ssl", "cert", NULL }, "show ssl cert [<certfile>] : display the SSL certificates used in memory, or the details of a <certfile>", cli_parse_show_cert, cli_io_handler_show_cert, cli_release_show_cert },
1870 { { NULL }, NULL, NULL, NULL }
1871}};
1872
1873INITCALL1(STG_REGISTER, cli_register_kw, &cli_kws);
1874