| /** |
| * @file config_new_tls.c |
| * @author Roman Janota <janota@cesnet.cz> |
| * @brief libnetconf2 TLS server new configuration creation functions |
| * |
| * @copyright |
| * Copyright (c) 2023 CESNET, z.s.p.o. |
| * |
| * This source code is licensed under BSD 3-Clause License (the "License"). |
| * You may not use this file except in compliance with the License. |
| * You may obtain a copy of the License at |
| * |
| * https://opensource.org/licenses/BSD-3-Clause |
| */ |
| |
| #define _GNU_SOURCE |
| |
| #include <stdarg.h> |
| #include <stdint.h> |
| #include <stdio.h> |
| #include <stdlib.h> |
| #include <string.h> |
| |
| #include <libyang/libyang.h> |
| |
| #include "compat.h" |
| #include "config.h" |
| #include "config_new.h" |
| #include "log_p.h" |
| #include "server_config.h" |
| #include "session.h" |
| #include "session_p.h" |
| |
| API int |
| nc_server_config_new_tls_server_certificate(const struct ly_ctx *ctx, const char *endpt_name, const char *pubkey_path, |
| const char *privkey_path, const char *certificate_path, struct lyd_node **config) |
| { |
| int ret = 0; |
| char *tree_path = NULL, *privkey = NULL, *pubkey = NULL, *pubkey_stripped = NULL, *privkey_stripped, *cert = NULL; |
| struct lyd_node *new_tree; |
| NC_PRIVKEY_FORMAT privkey_type; |
| NC_PUBKEY_FORMAT pubkey_type; |
| const char *privkey_identity; |
| |
| NC_CHECK_ARG_RET(NULL, ctx, endpt_name, privkey_path, certificate_path, 1); |
| NC_CHECK_ARG_RET(NULL, config, 1); |
| |
| /* get the keys as a string from the given files */ |
| ret = nc_server_config_new_get_keys(privkey_path, pubkey_path, &privkey, &pubkey, &privkey_type, &pubkey_type); |
| if (ret) { |
| ERR(NULL, "Getting keys from file(s) failed."); |
| goto cleanup; |
| } |
| |
| ret = nc_server_config_new_read_certificate(certificate_path, &cert); |
| if (ret) { |
| ERR(NULL, "Getting certificate from file \"%s\" failed.", certificate_path); |
| goto cleanup; |
| } |
| |
| /* prepare path for instertion of leaves later */ |
| asprintf(&tree_path, "/ietf-netconf-server:netconf-server/listen/endpoint[name='%s']/tls/tls-server-parameters/server-identity/certificate/inline-definition", endpt_name); |
| if (!tree_path) { |
| ERRMEM; |
| ret = 1; |
| goto cleanup; |
| } |
| |
| /* create all the nodes in the path */ |
| ret = lyd_new_path(*config, ctx, tree_path, NULL, LYD_NEW_PATH_UPDATE, &new_tree); |
| if (ret) { |
| goto cleanup; |
| } |
| if (!*config) { |
| *config = new_tree; |
| } |
| |
| if (!new_tree) { |
| /* no new nodes were created */ |
| ret = lyd_find_path(*config, tree_path, 0, &new_tree); |
| } else { |
| /* config was NULL */ |
| ret = lyd_find_path(new_tree, tree_path, 0, &new_tree); |
| } |
| if (ret) { |
| ERR(NULL, "Unable to find inline-definition container."); |
| goto cleanup; |
| } |
| |
| /* insert pubkey format */ |
| if (pubkey_type == NC_PUBKEY_FORMAT_X509) { |
| ret = lyd_new_term(new_tree, NULL, "public-key-format", "ietf-crypto-types:public-key-info-format", 0, NULL); |
| } else { |
| ret = lyd_new_term(new_tree, NULL, "public-key-format", "ietf-crypto-types:ssh-public-key-format", 0, NULL); |
| } |
| if (ret) { |
| goto cleanup; |
| } |
| |
| /* strip pubkey's header and footer only if it's generated from pkcs8 key (using OpenSSL), |
| * otherwise it's already stripped |
| */ |
| if (!pubkey_path && (privkey_type == NC_PRIVKEY_FORMAT_X509)) { |
| pubkey_stripped = pubkey + strlen("-----BEGIN PUBLIC KEY-----") + 1; |
| pubkey_stripped[strlen(pubkey_stripped) - strlen("-----END PUBLIC KEY-----") - 2] = '\0'; |
| } else { |
| pubkey_stripped = pubkey; |
| } |
| |
| /* insert pubkey b64 */ |
| ret = lyd_new_term(new_tree, NULL, "public-key", pubkey_stripped, 0, NULL); |
| if (ret) { |
| goto cleanup; |
| } |
| |
| /* get privkey identityref value */ |
| privkey_identity = nc_config_new_privkey_format_to_identityref(privkey_type); |
| if (!privkey_identity) { |
| ret = 1; |
| goto cleanup; |
| } |
| |
| /* insert private key format */ |
| ret = lyd_new_term(new_tree, NULL, "private-key-format", privkey_identity, 0, NULL); |
| if (ret) { |
| goto cleanup; |
| } |
| |
| if (privkey_type == NC_PRIVKEY_FORMAT_OPENSSH) { |
| /* only OpenSSH private keys have different header and footer after processing */ |
| privkey_stripped = privkey + strlen(NC_OPENSSH_PRIVKEY_HEADER); |
| privkey_stripped[strlen(privkey_stripped) - strlen(NC_OPENSSH_PRIVKEY_FOOTER)] = '\0'; |
| } else { |
| /* the rest share the same header and footer */ |
| privkey_stripped = privkey + strlen(NC_PKCS8_PRIVKEY_HEADER); |
| privkey_stripped[strlen(privkey_stripped) - strlen(NC_PKCS8_PRIVKEY_FOOTER)] = '\0'; |
| } |
| |
| ret = lyd_new_term(new_tree, NULL, "cleartext-private-key", privkey_stripped, 0, NULL); |
| if (ret) { |
| goto cleanup; |
| } |
| |
| ret = lyd_new_term(new_tree, NULL, "cert-data", cert, 0, NULL); |
| if (ret) { |
| goto cleanup; |
| } |
| |
| /* check if top-level container has operation and if not, add it */ |
| ret = nc_config_new_check_add_operation(ctx, *config); |
| if (ret) { |
| goto cleanup; |
| } |
| |
| /* Add all default nodes */ |
| ret = lyd_new_implicit_tree(*config, LYD_IMPLICIT_NO_STATE, NULL); |
| if (ret) { |
| goto cleanup; |
| } |
| |
| cleanup: |
| free(privkey); |
| free(pubkey); |
| free(cert); |
| free(tree_path); |
| return ret; |
| } |
| |
| API int |
| nc_server_config_new_tls_client_certificate(const struct ly_ctx *ctx, const char *endpt_name, const char *cert_name, |
| const char *cert_path, struct lyd_node **config) |
| { |
| int ret = 0; |
| struct lyd_node *new_tree; |
| char *tree_path = NULL, *cert = NULL; |
| |
| NC_CHECK_ARG_RET(NULL, ctx, endpt_name, cert_name, cert_path, config, 1); |
| |
| ret = nc_server_config_new_read_certificate(cert_path, &cert); |
| if (ret) { |
| ERR(NULL, "Getting certificate from file \"%s\" failed.", cert_path); |
| goto cleanup; |
| } |
| |
| /* prepare path for instertion of leaves later */ |
| asprintf(&tree_path, "/ietf-netconf-server:netconf-server/listen/endpoint[name='%s']/tls/tls-server-parameters/" |
| "client-authentication/ee-certs/inline-definition/certificate[name='%s']", endpt_name, cert_name); |
| if (!tree_path) { |
| ERRMEM; |
| ret = 1; |
| goto cleanup; |
| } |
| |
| /* create all the nodes in the path */ |
| ret = lyd_new_path(*config, ctx, tree_path, NULL, LYD_NEW_PATH_UPDATE, &new_tree); |
| if (ret) { |
| goto cleanup; |
| } |
| if (!*config) { |
| *config = new_tree; |
| } |
| |
| if (!new_tree) { |
| /* no new nodes were created */ |
| ret = lyd_find_path(*config, tree_path, 0, &new_tree); |
| } else { |
| /* config was NULL */ |
| ret = lyd_find_path(new_tree, tree_path, 0, &new_tree); |
| } |
| if (ret) { |
| goto cleanup; |
| } |
| |
| /* insert cert-data */ |
| ret = lyd_new_term(new_tree, NULL, "cert-data", cert, 0, NULL); |
| if (ret) { |
| goto cleanup; |
| } |
| |
| /* check if top-level container has operation and if not, add it */ |
| ret = nc_config_new_check_add_operation(ctx, *config); |
| if (ret) { |
| goto cleanup; |
| } |
| |
| /* Add all default nodes */ |
| ret = lyd_new_implicit_tree(*config, LYD_IMPLICIT_NO_STATE, NULL); |
| if (ret) { |
| goto cleanup; |
| } |
| |
| cleanup: |
| free(cert); |
| free(tree_path); |
| return ret; |
| } |
| |
| API int |
| nc_server_config_new_tls_client_ca(const struct ly_ctx *ctx, const char *endpt_name, const char *cert_name, |
| const char *cert_path, struct lyd_node **config) |
| { |
| int ret = 0; |
| struct lyd_node *new_tree; |
| char *tree_path = NULL, *cert = NULL; |
| |
| NC_CHECK_ARG_RET(NULL, ctx, endpt_name, cert_name, cert_path, config, 1); |
| |
| ret = nc_server_config_new_read_certificate(cert_path, &cert); |
| if (ret) { |
| ERR(NULL, "Getting certificate from file \"%s\" failed.", cert_path); |
| goto cleanup; |
| } |
| |
| /* prepare path for instertion of leaves later */ |
| asprintf(&tree_path, "/ietf-netconf-server:netconf-server/listen/endpoint[name='%s']/tls/tls-server-parameters/" |
| "client-authentication/ca-certs/inline-definition/certificate[name='%s']", endpt_name, cert_name); |
| if (!tree_path) { |
| ERRMEM; |
| ret = 1; |
| goto cleanup; |
| } |
| |
| /* create all the nodes in the path */ |
| ret = lyd_new_path(*config, ctx, tree_path, NULL, LYD_NEW_PATH_UPDATE, &new_tree); |
| if (ret) { |
| goto cleanup; |
| } |
| if (!*config) { |
| *config = new_tree; |
| } |
| |
| if (!new_tree) { |
| /* no new nodes were created */ |
| ret = lyd_find_path(*config, tree_path, 0, &new_tree); |
| } else { |
| /* config was NULL */ |
| ret = lyd_find_path(new_tree, tree_path, 0, &new_tree); |
| } |
| if (ret) { |
| goto cleanup; |
| } |
| |
| /* insert cert-data */ |
| ret = lyd_new_term(new_tree, NULL, "cert-data", cert, 0, NULL); |
| if (ret) { |
| goto cleanup; |
| } |
| |
| /* check if top-level container has operation and if not, add it */ |
| ret = nc_config_new_check_add_operation(ctx, *config); |
| if (ret) { |
| goto cleanup; |
| } |
| |
| /* Add all default nodes */ |
| ret = lyd_new_implicit_tree(*config, LYD_IMPLICIT_NO_STATE, NULL); |
| if (ret) { |
| goto cleanup; |
| } |
| |
| cleanup: |
| free(cert); |
| free(tree_path); |
| return ret; |
| } |
| |
| API int |
| nc_server_config_new_tls_ctn(const struct ly_ctx *ctx, const char *endpt_name, uint32_t id, const char *fingerprint, |
| NC_TLS_CTN_MAPTYPE map_type, const char *name, struct lyd_node **config) |
| { |
| int ret = 0; |
| char *tree_path = NULL; |
| struct lyd_node *new_tree; |
| |
| NC_CHECK_ARG_RET(NULL, ctx, endpt_name, id, map_type, name, 1); |
| NC_CHECK_ARG_RET(NULL, config, 1); |
| |
| /* prepare path for instertion of leaves later */ |
| asprintf(&tree_path, "/ietf-netconf-server:netconf-server/listen/endpoint[name='%s']/tls/" |
| "netconf-server-parameters/client-identity-mappings/cert-to-name[id='%d']", endpt_name, id); |
| if (!tree_path) { |
| ERRMEM; |
| ret = 1; |
| goto cleanup; |
| } |
| |
| /* create all the nodes in the path */ |
| ret = lyd_new_path(*config, ctx, tree_path, NULL, LYD_NEW_PATH_UPDATE, &new_tree); |
| if (ret) { |
| goto cleanup; |
| } |
| if (!*config) { |
| *config = new_tree; |
| } |
| |
| if (!new_tree) { |
| /* no new nodes were created */ |
| ret = lyd_find_path(*config, tree_path, 0, &new_tree); |
| } else { |
| /* config was NULL */ |
| ret = lyd_find_path(new_tree, tree_path, 0, &new_tree); |
| } |
| if (ret) { |
| ERR(NULL, "Unable to find netconf-server-parameters container."); |
| goto cleanup; |
| } |
| |
| /* not mandatory */ |
| if (fingerprint) { |
| ret = lyd_new_term(new_tree, NULL, "fingerprint", fingerprint, 0, NULL); |
| if (ret) { |
| goto cleanup; |
| } |
| } |
| |
| /* insert map-type */ |
| switch (map_type) { |
| case NC_TLS_CTN_SPECIFIED: |
| ret = lyd_new_term(new_tree, NULL, "map-type", "ietf-x509-cert-to-name:specified", 0, NULL); |
| break; |
| case NC_TLS_CTN_SAN_RFC822_NAME: |
| ret = lyd_new_term(new_tree, NULL, "map-type", "ietf-x509-cert-to-name:san-rfc822-name", 0, NULL); |
| break; |
| case NC_TLS_CTN_SAN_DNS_NAME: |
| ret = lyd_new_term(new_tree, NULL, "map-type", "ietf-x509-cert-to-name:san-dns-name", 0, NULL); |
| break; |
| case NC_TLS_CTN_SAN_IP_ADDRESS: |
| ret = lyd_new_term(new_tree, NULL, "map-type", "ietf-x509-cert-to-name:san-ip-address", 0, NULL); |
| break; |
| case NC_TLS_CTN_SAN_ANY: |
| ret = lyd_new_term(new_tree, NULL, "map-type", "ietf-x509-cert-to-name:san-any", 0, NULL); |
| break; |
| case NC_TLS_CTN_COMMON_NAME: |
| ret = lyd_new_term(new_tree, NULL, "map-type", "ietf-x509-cert-to-name:common-name", 0, NULL); |
| break; |
| case NC_TLS_CTN_UNKNOWN: |
| default: |
| ERR(NULL, "Unknown map_type."); |
| ret = 1; |
| break; |
| } |
| if (ret) { |
| goto cleanup; |
| } |
| |
| /* insert name */ |
| ret = lyd_new_term(new_tree, NULL, "name", name, 0, NULL); |
| if (ret) { |
| goto cleanup; |
| } |
| |
| /* check if top-level container has operation and if not, add it */ |
| ret = nc_config_new_check_add_operation(ctx, *config); |
| if (ret) { |
| goto cleanup; |
| } |
| |
| /* Add all default nodes */ |
| ret = lyd_new_implicit_tree(*config, LYD_IMPLICIT_NO_STATE, NULL); |
| if (ret) { |
| goto cleanup; |
| } |
| |
| cleanup: |
| free(tree_path); |
| return ret; |
| } |
| |
| API int |
| nc_server_config_new_tls_version(const struct ly_ctx *ctx, const char *endpt_name, |
| NC_TLS_VERSION tls_version, struct lyd_node **config) |
| { |
| int ret = 0; |
| struct lyd_node *new_tree; |
| char *tree_path = NULL; |
| |
| NC_CHECK_ARG_RET(NULL, ctx, endpt_name, config, 1); |
| |
| /* prepare path for instertion of leaves later */ |
| asprintf(&tree_path, "/ietf-netconf-server:netconf-server/listen/endpoint[name='%s']/tls/tls-server-parameters/" |
| "hello-params/tls-versions", endpt_name); |
| if (!tree_path) { |
| ERRMEM; |
| ret = 1; |
| goto cleanup; |
| } |
| |
| /* create all the nodes in the path */ |
| ret = lyd_new_path(*config, ctx, tree_path, NULL, LYD_NEW_PATH_UPDATE, &new_tree); |
| if (ret) { |
| goto cleanup; |
| } |
| if (!*config) { |
| *config = new_tree; |
| } |
| |
| if (!new_tree) { |
| /* no new nodes were created */ |
| ret = lyd_find_path(*config, tree_path, 0, &new_tree); |
| } else { |
| /* config was NULL */ |
| ret = lyd_find_path(new_tree, tree_path, 0, &new_tree); |
| } |
| if (ret) { |
| goto cleanup; |
| } |
| |
| switch (tls_version) { |
| case NC_TLS_VERSION_10: |
| ret = lyd_new_term(new_tree, NULL, "tls-version", "ietf-tls-common:tls10", 0, NULL); |
| break; |
| case NC_TLS_VERSION_11: |
| ret = lyd_new_term(new_tree, NULL, "tls-version", "ietf-tls-common:tls11", 0, NULL); |
| break; |
| case NC_TLS_VERSION_12: |
| ret = lyd_new_term(new_tree, NULL, "tls-version", "ietf-tls-common:tls12", 0, NULL); |
| break; |
| case NC_TLS_VERSION_13: |
| ret = lyd_new_term(new_tree, NULL, "tls-version", "ietf-tls-common:tls13", 0, NULL); |
| break; |
| default: |
| ERR(NULL, "Unknown TLS version."); |
| ret = 1; |
| break; |
| } |
| if (ret) { |
| ERR(NULL, "Creating new tls-version node failed."); |
| goto cleanup; |
| } |
| |
| /* check if top-level container has operation and if not, add it */ |
| ret = nc_config_new_check_add_operation(ctx, *config); |
| if (ret) { |
| goto cleanup; |
| } |
| |
| /* Add all default nodes */ |
| ret = lyd_new_implicit_tree(*config, LYD_IMPLICIT_NO_STATE, NULL); |
| if (ret) { |
| goto cleanup; |
| } |
| |
| cleanup: |
| free(tree_path); |
| return ret; |
| } |
| |
| API int |
| nc_server_config_new_tls_ciphers(const struct ly_ctx *ctx, const char *endpt_name, struct lyd_node **config, |
| uint16_t cipher_count, ...) |
| { |
| int ret = 0; |
| struct lyd_node *new_tree = NULL, *old = NULL; |
| va_list ap; |
| char *tree_path = NULL, *cipher = NULL, *cipher_ident = NULL; |
| uint16_t i; |
| |
| NC_CHECK_ARG_RET(NULL, ctx, endpt_name, config, 1); |
| |
| /* prepare path */ |
| asprintf(&tree_path, "/ietf-netconf-server:netconf-server/listen/endpoint[name='%s']/" |
| "tls/tls-server-parameters/hello-params", endpt_name); |
| if (!tree_path) { |
| ERRMEM; |
| ret = 1; |
| goto cleanup; |
| } |
| |
| /* create all the nodes in the path */ |
| ret = lyd_new_path(*config, ctx, tree_path, NULL, LYD_NEW_PATH_UPDATE, &new_tree); |
| if (ret) { |
| goto cleanup; |
| } |
| if (!*config) { |
| *config = new_tree; |
| } |
| |
| if (!new_tree) { |
| /* no new nodes were created */ |
| ret = lyd_find_path(*config, tree_path, 0, &new_tree); |
| } else { |
| /* config was NULL */ |
| ret = lyd_find_path(new_tree, tree_path, 0, &new_tree); |
| } |
| if (ret) { |
| goto cleanup; |
| } |
| |
| /* delete all older algorithms (if any) se they can be replaced by the new ones */ |
| lyd_find_path(new_tree, "cipher-suites", 0, &old); |
| if (old) { |
| lyd_free_tree(old); |
| } |
| |
| va_start(ap, cipher_count); |
| for (i = 0; i < cipher_count; i++) { |
| cipher = va_arg(ap, char *); |
| |
| asprintf(&cipher_ident, "iana-tls-cipher-suite-algs:%s", cipher); |
| if (!cipher_ident) { |
| ERRMEM; |
| ret = 1; |
| goto cleanup; |
| } |
| |
| /* create the leaf list */ |
| ret = lyd_new_path(new_tree, ctx, "cipher-suites/cipher-suite", cipher_ident, 0, NULL); |
| free(cipher_ident); |
| |
| if (ret) { |
| ERR(NULL, "Creating new cipher-suites leaf-list failed."); |
| goto cleanup; |
| } |
| } |
| |
| /* check if top-level container has operation and if not, add it */ |
| ret = nc_config_new_check_add_operation(ctx, *config); |
| if (ret) { |
| goto cleanup; |
| } |
| |
| /* Add all default nodes */ |
| ret = lyd_new_implicit_tree(*config, LYD_IMPLICIT_NO_STATE, NULL); |
| if (ret) { |
| goto cleanup; |
| } |
| |
| cleanup: |
| va_end(ap); |
| free(tree_path); |
| return ret; |
| } |