void nano::rpc_secure::load_certs (boost::asio::ssl::context & context_a)
{
// This is called if the key is password protected
context_a.set_password_callback (
[this](std::size_t,
boost::asio::ssl::context_base::password_purpose) {
return config.secure.server_key_passphrase;
});
// The following two options disables the session cache and enables stateless session resumption.
// This is necessary because of the way the RPC server abruptly terminate connections.
SSL_CTX_set_session_cache_mode (context_a.native_handle (), SSL_SESS_CACHE_OFF);
SSL_CTX_set_options (context_a.native_handle (), SSL_OP_NO_TICKET);
context_a.set_options (
boost::asio::ssl::context::default_workarounds | boost::asio::ssl::context::no_sslv2 | boost::asio::ssl::context::no_sslv3 | boost::asio::ssl::context::single_dh_use);
context_a.use_certificate_chain_file (config.secure.server_cert_path);
context_a.use_private_key_file (config.secure.server_key_path, boost::asio::ssl::context::pem);
context_a.use_tmp_dh_file (config.secure.server_dh_path);
// Verify client certificates?
if (config.secure.client_certs_path.size () > 0)
{
context_a.set_verify_mode (boost::asio::ssl::verify_fail_if_no_peer_cert | boost::asio::ssl::verify_peer);
context_a.add_verify_path (config.secure.client_certs_path);
context_a.set_verify_callback ([this](auto preverified, auto & ctx) {
return this->on_verify_certificate (preverified, ctx);
});
}
}
void BaseClient::ssl_prepare(boost::asio::ssl::context &ssl_context) const
{
ssl_context.set_password_callback(boost::bind(&BaseClient::get_password,this));
ssl_context.set_verify_mode(boost::asio::ssl::context::verify_peer|boost::asio::ssl::context::verify_fail_if_no_peer_cert);
ssl_context.load_verify_file(my_certs_name);
ssl_context.use_certificate_chain_file(my_public_cert_name);
ssl_context.use_private_key_file(my_private_key_name, boost::asio::ssl::context::pem);
}
// Does common initialization for all but the bare context type.
void initCommon ()
{
m_context.set_options (
boost::asio::ssl::context::default_workarounds |
boost::asio::ssl::context::no_sslv2 |
boost::asio::ssl::context::single_dh_use);
SSL_CTX_set_tmp_dh_callback (
m_context.native_handle (),
tmp_dh_handler);
}
void
SslContextInitializer::SetCipherList_(boost::asio::ssl::context& context)
{
AnsiString cipher_list = Configuration::Instance()->GetSslCipherList();
cipher_list.Replace("\r", "");
cipher_list.Replace("\n", "");
cipher_list.Replace(" ", "");
if (cipher_list.Trim().IsEmpty())
return;
// Asio does not expose cipher list. Access underlaying layer (OpenSSL) directly.
SSL_CTX* ssl = context.native_handle();
int result = SSL_CTX_set_cipher_list(ssl, cipher_list.c_str());
if (result == 0)
{
// Unable to set the SSL cipher list. Collect the error code from OpenSSL so that
// we can include that in the error message we log.
int errorCode = ERR_get_error();
const int bufferSize = 150;
AnsiString message;
ERR_error_string_n(errorCode, message.GetBuffer(bufferSize), bufferSize);
ErrorManager::Instance()->ReportError(ErrorManager::Medium, 5511, "SslContextInitializer::SetCipherList_", Formatter::Format("Failed to set SSL ciphers. Message: {0}", message));
}
}
void initAnonymous (std::string const& cipherList)
{
initCommon ();
int const result = SSL_CTX_set_cipher_list (
m_context.native_handle (),
cipherList.c_str ());
if (result != 1)
beast::FatalError ("invalid cipher list", __FILE__, __LINE__);
}
void
SslContextInitializer::EnableEllipticCurveCrypto_(boost::asio::ssl::context& context)
{
SSL_CTX* ssl = context.native_handle();
EC_KEY *ecdh = EC_KEY_new_by_curve_name(NID_X9_62_prime256v1);
if (!ecdh)
{
ErrorManager::Instance()->ReportError(ErrorManager::Medium, 5511, "SslContextInitializer::SetCipherList_", "Failed to enable TLS EC");
return;
}
int set_tmp_ecdhResult = SSL_CTX_set_tmp_ecdh(ssl, ecdh);
if (set_tmp_ecdhResult != 1)
{
ErrorManager::Instance()->ReportError(ErrorManager::Medium, 5511, "SslContextInitializer::SetCipherList_", Formatter::Format("Failed to enable TLS EC. SSL_CTX_set_tmp_ecdh returend {0}", set_tmp_ecdhResult));
}
EC_KEY_free(ecdh);
}
bool
SslContextInitializer::InitClient(boost::asio::ssl::context& context)
{
boost::system::error_code errorCode;
context.set_options(boost::asio::ssl::context::default_workarounds |
boost::asio::ssl::context::no_sslv2);
if (errorCode.value() != 0)
{
String errorMessage;
errorMessage.Format(_T("Failed to set default workarounds."));
ErrorManager::Instance()->ReportError(ErrorManager::Medium, 5144, "SslContextInitializer::InitClient", errorMessage, errorCode);
return false;
}
SetCipherList_(context);
return true;
}
void
SslContextInitializer::SetContextOptions_(boost::asio::ssl::context& context)
{
bool sslv30 = Configuration::Instance()->GetSslVersionEnabled(SslVersion30);
bool tlsv10 = Configuration::Instance()->GetSslVersionEnabled(TlsVersion10);
bool tlsv11 = Configuration::Instance()->GetSslVersionEnabled(TlsVersion11);
bool tlsv12 = Configuration::Instance()->GetSslVersionEnabled(TlsVersion12);
int options = SSL_OP_ALL | SSL_OP_SINGLE_DH_USE | SSL_OP_NO_SSLv2 | SSL_OP_SINGLE_ECDH_USE;
if (!sslv30)
options = options | SSL_OP_NO_SSLv3;
if (!tlsv10)
options = options | SSL_OP_NO_TLSv1;
if (!tlsv11)
options = options | SSL_OP_NO_TLSv1_1;
if (!tlsv12)
options = options | SSL_OP_NO_TLSv1_2;
SSL_CTX* ssl = context.native_handle();
SSL_CTX_set_options(ssl, options);
}
void
SslContextInitializer::SetCipherList_(boost::asio::ssl::context& context)
{
AnsiString cipher_list = Configuration::Instance()->GetSslCipherList();
cipher_list.Replace("\r", "");
cipher_list.Replace("\n", "");
cipher_list.Replace(" ", "");
if (cipher_list.Trim().IsEmpty())
return;
// Asio does not expose cipher list. Access underlaying layer (OpenSSL) directly.
SSL_CTX* ssl = context.native_handle();
int result = SSL_CTX_set_cipher_list(ssl, cipher_list.c_str());
if (result == 0)
{
ErrorManager::Instance()->ReportError(ErrorManager::Medium, 5511,"SslContextInitializer::SetCipherList_", "Failed to set SSL ciphers");
}
}
void
load_root_certificates(ssl::context& ctx, boost::system::error_code& ec)
{
std::string const cert =
/* This is the DigiCert root certificate.
CN = DigiCert High Assurance EV Root CA
OU = www.digicert.com
O = DigiCert Inc
C = US
Valid to: Sunday, ?November ?9, ?2031 5:00:00 PM
Thumbprint(sha1):
5f b7 ee 06 33 e2 59 db ad 0c 4c 9a e6 d3 8f 1a 61 c7 dc 25
*/
"-----BEGIN CERTIFICATE-----\n"
"MIIDxTCCAq2gAwIBAgIQAqxcJmoLQJuPC3nyrkYldzANBgkqhkiG9w0BAQUFADBs\n"
"MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3\n"
"d3cuZGlnaWNlcnQuY29tMSswKQYDVQQDEyJEaWdpQ2VydCBIaWdoIEFzc3VyYW5j\n"
"ZSBFViBSb290IENBMB4XDTA2MTExMDAwMDAwMFoXDTMxMTExMDAwMDAwMFowbDEL\n"
"MAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3\n"
"LmRpZ2ljZXJ0LmNvbTErMCkGA1UEAxMiRGlnaUNlcnQgSGlnaCBBc3N1cmFuY2Ug\n"
"RVYgUm9vdCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMbM5XPm\n"
"+9S75S0tMqbf5YE/yc0lSbZxKsPVlDRnogocsF9ppkCxxLeyj9CYpKlBWTrT3JTW\n"
"PNt0OKRKzE0lgvdKpVMSOO7zSW1xkX5jtqumX8OkhPhPYlG++MXs2ziS4wblCJEM\n"
"xChBVfvLWokVfnHoNb9Ncgk9vjo4UFt3MRuNs8ckRZqnrG0AFFoEt7oT61EKmEFB\n"
"Ik5lYYeBQVCmeVyJ3hlKV9Uu5l0cUyx+mM0aBhakaHPQNAQTXKFx01p8VdteZOE3\n"
"hzBWBOURtCmAEvF5OYiiAhF8J2a3iLd48soKqDirCmTCv2ZdlYTBoSUeh10aUAsg\n"
"EsxBu24LUTi4S8sCAwEAAaNjMGEwDgYDVR0PAQH/BAQDAgGGMA8GA1UdEwEB/wQF\n"
"MAMBAf8wHQYDVR0OBBYEFLE+w2kD+L9HAdSYJhoIAu9jZCvDMB8GA1UdIwQYMBaA\n"
"FLE+w2kD+L9HAdSYJhoIAu9jZCvDMA0GCSqGSIb3DQEBBQUAA4IBAQAcGgaX3Nec\n"
"nzyIZgYIVyHbIUf4KmeqvxgydkAQV8GK83rZEWWONfqe/EW1ntlMMUu4kehDLI6z\n"
"eM7b41N5cdblIZQB2lWHmiRk9opmzN6cN82oNLFpmyPInngiK3BD41VHMWEZ71jF\n"
"hS9OMPagMRYjyOfiZRYzy78aG6A9+MpeizGLYAiJLQwGXFK3xPkKmNEVX58Svnw2\n"
"Yzi9RKR/5CYrCsSXaQ3pjOLAEFe4yHYSkVXySGnYvCoCWw9E1CAx2/S6cCZdkGCe\n"
"vEsXCS+0yx5DaMkHJ8HSXPfqIbloEpw8nL+e/IBcm2PN7EeqJSdnoDfzAIJ9VNep\n"
"+OkuE6N36B9K\n"
"-----END CERTIFICATE-----\n"
/* This is the GeoTrust root certificate.
CN = GeoTrust Global CA
O = GeoTrust Inc.
C = US
Valid to: Friday, May 20, 2022 9:00:00 PM
Thumbprint(sha1):
de 28 f4 a4 ff e5 b9 2f a3 c5 03 d1 a3 49 a7 f9 96 2a 82 12
*/
"-----BEGIN CERTIFICATE-----\n"
"MIIDxTCCAq2gAwIBAgIQAqxcJmoLQJuPC3nyrkYldzANBgkqhkiG9w0BAQUFADBs\n"
"MQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3\n"
"d3cuZGlnaWNlcnQuY29tMSswKQYDVQQDEyJEaWdpQ2VydCBIaWdoIEFzc3VyYW5j\n"
"ZSBFViBSb290IENBMB4XDTA2MTExMDAwMDAwMFoXDTMxMTExMDAwMDAwMFowbDEL\n"
"MAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEZMBcGA1UECxMQd3d3\n"
"LmRpZ2ljZXJ0LmNvbTErMCkGA1UEAxMiRGlnaUNlcnQgSGlnaCBBc3N1cmFuY2Ug\n"
"RVYgUm9vdCBDQTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAMbM5XPm\n"
"+9S75S0tMqbf5YE/yc0lSbZxKsPVlDRnogocsF9ppkCxxLeyj9CYpKlBWTrT3JTW\n"
"PNt0OKRKzE0lgvdKpVMSOO7zSW1xkX5jtqumX8OkhPhPYlG++MXs2ziS4wblCJEM\n"
"xChBVfvLWokVfnHoNb9Ncgk9vjo4UFt3MRuNs8ckRZqnrG0AFFoEt7oT61EKmEFB\n"
"Ik5lYYeBQVCmeVyJ3hlKV9Uu5l0cUyx+mM0aBhakaHPQNAQTXKFx01p8VdteZOE3\n"
"hzBWBOURtCmAEvF5OYiiAhF8J2a3iLd48soKqDirCmTCv2ZdlYTBoSUeh10aUAsg\n"
"EsxBu24LUTi4S8sCAwEAAaNjMGEwDgYDVR0PAQH/BAQDAgGGMA8GA1UdEwEB/wQF\n"
"MAMBAf8wHQYDVR0OBBYEFLE+w2kD+L9HAdSYJhoIAu9jZCvDMB8GA1UdIwQYMBaA\n"
"FLE+w2kD+L9HAdSYJhoIAu9jZCvDMA0GCSqGSIb3DQEBBQUAA4IBAQAcGgaX3Nec\n"
"nzyIZgYIVyHbIUf4KmeqvxgydkAQV8GK83rZEWWONfqe/EW1ntlMMUu4kehDLI6z\n"
"eM7b41N5cdblIZQB2lWHmiRk9opmzN6cN82oNLFpmyPInngiK3BD41VHMWEZ71jF\n"
"hS9OMPagMRYjyOfiZRYzy78aG6A9+MpeizGLYAiJLQwGXFK3xPkKmNEVX58Svnw2\n"
"Yzi9RKR/5CYrCsSXaQ3pjOLAEFe4yHYSkVXySGnYvCoCWw9E1CAx2/S6cCZdkGCe\n"
"vEsXCS+0yx5DaMkHJ8HSXPfqIbloEpw8nL+e/IBcm2PN7EeqJSdnoDfzAIJ9VNep\n"
"+OkuE6N36B9K\n"
"-----END CERTIFICATE-----\n"
;
ctx.add_certificate_authority(
boost::asio::buffer(cert.data(), cert.size()), ec);
if(ec)
return;
}
bool
SslContextInitializer::InitServer(boost::asio::ssl::context& context, std::shared_ptr<SSLCertificate> certificate, String ip_address, int port)
{
if (!certificate)
{
String errorMessage = Formatter::Format("Error initializing SSL. Certificate not set. Address: {0}, Port: {1}", ip_address, port);
ErrorManager::Instance()->ReportError(ErrorManager::High, 5113, "SslContextInitializer::InitServer", errorMessage);
return false;
}
SetContextOptions_(context);
EnableEllipticCurveCrypto_(context);
if (!SetCipherList_(context))
return false;
try
{
String bin_directory = Utilities::GetBinDirectory();
String dh2048_file = FileUtilities::Combine(bin_directory, "dh2048.pem");
if (FileUtilities::Exists(dh2048_file))
{
context.use_tmp_dh_file(AnsiString(dh2048_file));
}
else
{
ErrorManager::Instance()->ReportError(ErrorManager::Critical, 5603, "SslContextInitializer::InitServer", Formatter::Format("Unable to enable Diffie - Hellman key agreement.The required file {0} does not exist.", dh2048_file));
}
}
catch (boost::system::system_error ec)
{
String asioError = ec.what();
String errorMessage;
errorMessage.Format(_T("Failed to set SSL context options. Address: %s, Port: %i, Error: %s"),
String(ip_address).c_str(), port, asioError.c_str());
ErrorManager::Instance()->ReportError(ErrorManager::High, 5113, "SslContextInitializer::InitServer", errorMessage);
return false;
}
AnsiString certificateFile = certificate->GetCertificateFile();
AnsiString privateKeyFile = certificate->GetPrivateKeyFile();
try
{
context.use_certificate_file(certificateFile, boost::asio::ssl::context::pem);
}
catch (boost::system::system_error ec)
{
String asioError = ec.what();
String errorMessage;
errorMessage.Format(_T("Failed to load certificate file. Path: %s, Address: %s, Port: %i, Error: %s"),
String(certificateFile).c_str(), ip_address.c_str(), port, asioError.c_str());
ErrorManager::Instance()->ReportError(ErrorManager::High, 5113, "SslContextInitializer::InitServer", errorMessage);
return false;
}
try
{
context.use_certificate_chain_file(certificateFile);
}
catch (boost::system::system_error ec)
{
String asioError = ec.what();
String errorMessage;
errorMessage.Format(_T("Failed to load certificate chain from certificate file. Path: %s, Address: %s, Port: %i, Error: %s"),
String(certificateFile), ip_address.c_str(), port, asioError.c_str());
ErrorManager::Instance()->ReportError(ErrorManager::High, 5113, "SslContextInitializer::InitServer", errorMessage);
return false;
}
try
{
context.set_password_callback(std::bind(&SslContextInitializer::GetPassword_));
context.use_private_key_file(privateKeyFile, boost::asio::ssl::context::pem);
}
catch (boost::system::system_error ec)
{
String asioError = ec.what();
String errorMessage;
errorMessage.Format(_T("Failed to load private key file. Path: %s, Address: %s, Port: %i, Error: %s"),
String(privateKeyFile), ip_address.c_str(), port, asioError.c_str());
ErrorManager::Instance()->ReportError(ErrorManager::High, 5113, "SslContextInitializer::InitServer", errorMessage);
return false;
}
catch (...)
{
String errorMessage = "Error initializing SSL";
ErrorManager::Instance()->ReportError(ErrorManager::High, 5113, "SslContextInitializer::InitServer", errorMessage);
return false;
}
return true;
}
void initAuthenticated (
std::string key_file, std::string cert_file, std::string chain_file)
{
initCommon ();
SSL_CTX* const ssl = m_context.native_handle ();
bool cert_set = false;
if (! cert_file.empty ())
{
boost::system::error_code error;
m_context.use_certificate_file (
cert_file, boost::asio::ssl::context::pem, error);
if (error)
{
beast::FatalError ("Problem with SSL certificate file.",
__FILE__, __LINE__);
}
cert_set = true;
}
if (! chain_file.empty ())
{
// VFALCO Replace fopen() with RAII
FILE* f = fopen (chain_file.c_str (), "r");
if (!f)
{
beast::FatalError ("Problem opening SSL chain file.",
__FILE__, __LINE__);
}
try
{
for (;;)
{
X509* const x = PEM_read_X509 (f, NULL, NULL, NULL);
if (x == nullptr)
break;
if (! cert_set)
{
if (SSL_CTX_use_certificate (ssl, x) != 1)
beast::FatalError ("Problem retrieving SSL certificate from chain file.",
__FILE__, __LINE__);
cert_set = true;
}
else if (SSL_CTX_add_extra_chain_cert (ssl, x) != 1)
{
X509_free (x);
beast::FatalError ("Problem adding SSL chain certificate.",
__FILE__, __LINE__);
}
}
fclose (f);
}
catch (...)
{
fclose (f);
beast::FatalError ("Reading the SSL chain file generated an exception.",
__FILE__, __LINE__);
}
}
if (! key_file.empty ())
{
boost::system::error_code error;
m_context.use_private_key_file (key_file,
boost::asio::ssl::context::pem, error);
if (error)
{
beast::FatalError ("Problem using the SSL private key file.",
__FILE__, __LINE__);
}
}
if (SSL_CTX_check_private_key (ssl) != 1)
{
beast::FatalError ("Invalid key in SSL private key file.",
__FILE__, __LINE__);
}
}
SecureSession::SecureSession(boost::asio::io_service& ioService,
boost::asio::ssl::context& context)
: socket(ioService, context) {
context.set_options(context_ops);
}
bool
SslContextInitializer::InitServer(boost::asio::ssl::context& context, std::shared_ptr<SSLCertificate> certificate, String ip_address, int port)
{
if (!certificate)
{
String errorMessage = Formatter::Format("Error initializing SSL. Certificate not set. Address: {0}, Port: {1}", ip_address, port);
ErrorManager::Instance()->ReportError(ErrorManager::High, 5113, "SslContextInitializer::InitServer", errorMessage);
return false;
}
try
{
context.set_options(boost::asio::ssl::context::default_workarounds |
boost::asio::ssl::context::no_sslv2);
}
catch (boost::system::system_error ec)
{
String asioError = ec.what();
String errorMessage;
errorMessage.Format(_T("Failed to set SSL context options. Address: %s, Port: %i, Error: %s"),
String(ip_address).c_str(), port, asioError.c_str());
ErrorManager::Instance()->ReportError(ErrorManager::High, 5113, "SslContextInitializer::InitServer", errorMessage);
return false;
}
AnsiString certificateFile = certificate->GetCertificateFile();
AnsiString privateKeyFile = certificate->GetPrivateKeyFile();
try
{
context.use_certificate_file(certificateFile, boost::asio::ssl::context::pem);
}
catch (boost::system::system_error ec)
{
String asioError = ec.what();
String errorMessage;
errorMessage.Format(_T("Failed to load certificate file. Path: %s, Address: %s, Port: %i, Error: %s"),
String(certificateFile).c_str(), ip_address.c_str(), port, asioError.c_str());
ErrorManager::Instance()->ReportError(ErrorManager::High, 5113, "SslContextInitializer::InitServer", errorMessage);
return false;
}
try
{
context.use_certificate_chain_file(certificateFile);
}
catch (boost::system::system_error ec)
{
String asioError = ec.what();
String errorMessage;
errorMessage.Format(_T("Failed to load certificate chain from certificate file. Path: %s, Address: %s, Port: %i, Error: %s"),
String(certificateFile), ip_address.c_str(), port, asioError.c_str());
ErrorManager::Instance()->ReportError(ErrorManager::High, 5113, "SslContextInitializer::InitServer", errorMessage);
return false;
}
try
{
context.set_password_callback(std::bind(&SslContextInitializer::GetPassword_));
context.use_private_key_file(privateKeyFile, boost::asio::ssl::context::pem);
}
catch (boost::system::system_error ec)
{
String asioError = ec.what();
String errorMessage;
errorMessage.Format(_T("Failed to load private key file. Path: %s, Address: %s, Port: %i, Error: %s"),
String(privateKeyFile), ip_address.c_str(), port, asioError.c_str());
ErrorManager::Instance()->ReportError(ErrorManager::High, 5113, "SslContextInitializer::InitServer", errorMessage);
return false;
}
catch (...)
{
String errorMessage = "Error initializing SSL";
ErrorManager::Instance()->ReportError(ErrorManager::High, 5113, "SslContextInitializer::InitServer", errorMessage);
return false;
}
SetCipherList_(context);
return true;
}
void ssl_authentication_t::use_ssl_certificate(boost::asio::ssl::context &ssl_context) const
{
ssl_context.use_private_key_file(private_key_path, boost::asio::ssl::context::pem);
ssl_context.use_certificate_chain_file(certificate_path);
}
