stir_shaken.c

Go to the documentation of this file.

/*
 * Asterisk -- An open source telephony toolkit.
 *
 * Copyright (C) 2020, Sangoma Technologies Corporation
 *
 * Kevin Harwell <[email protected]>
 *
 * See http://www.asterisk.org for more information about
 * the Asterisk project. Please do not directly contact
 * any of the maintainers of this project for assistance;
 * the project provides a web site, mailing lists and IRC
 * channels for your use.
 *
 * This program is free software, distributed under the terms of
 * the GNU General Public License Version 2. See the LICENSE file
 * at the top of the source tree.
 */

/*! \file
 *
 * \brief Internal stir/shaken utilities
 */

#include "asterisk.h"

#include <openssl/evp.h>
#include <openssl/pem.h>

#include "asterisk/cli.h"
#include "asterisk/sorcery.h"

#include "stir_shaken.h"
#include "asterisk/res_stir_shaken.h"

int stir_shaken_cli_show(void *obj, void *arg, int flags)
{
   struct ast_cli_args *a = arg;
   struct ast_variable *options;
   struct ast_variable *i;

   if (!obj) {
      ast_cli(a->fd, "No stir/shaken configuration found\n");
      return 0;
   }

   options = ast_variable_list_sort(ast_sorcery_objectset_create2(
      ast_stir_shaken_sorcery(), obj, AST_HANDLER_ONLY_STRING));
   if (!options) {
      return 0;
   }

   ast_cli(a->fd, "%s: %s\n", ast_sorcery_object_get_type(obj),
      ast_sorcery_object_get_id(obj));

   for (i = options; i; i = i->next) {
      ast_cli(a->fd, "\t%s: %s\n", i->name, i->value);
   }

   ast_cli(a->fd, "\n");

   ast_variables_destroy(options);

   return 0;
}

char *stir_shaken_tab_complete_name(const char *word, struct ao2_container *container)
{
   void *obj;
   struct ao2_iterator it;
   int wordlen = strlen(word);
   int ret;

   it = ao2_iterator_init(container, 0);
   while ((obj = ao2_iterator_next(&it))) {
      if (!strncasecmp(word, ast_sorcery_object_get_id(obj), wordlen)) {
         ret = ast_cli_completion_add(ast_strdup(ast_sorcery_object_get_id(obj)));
         if (ret) {
            ao2_ref(obj, -1);
            break;
         }
      }
      ao2_ref(obj, -1);
   }
   ao2_iterator_destroy(&it);

   return NULL;
}

EVP_PKEY *stir_shaken_read_key(const char *path, int priv)
{
   EVP_PKEY *key = NULL;
   FILE *fp;
   X509 *cert = NULL;

   fp = fopen(path, "r");
   if (!fp) {
      ast_log(LOG_ERROR, "Failed to read %s key file '%s'\n", priv ? "private" : "public", path);
      return NULL;
   }

   /* If this is to get the private key, the file will be ECDSA or RSA, with the former eventually
    * replacing the latter. For the public key, the file will be X.509.
    */
   if (priv) {
      key = PEM_read_PrivateKey(fp, NULL, NULL, NULL);
   } else {
      cert = PEM_read_X509(fp, NULL, NULL, NULL);
      if (!cert) {
         ast_log(LOG_ERROR, "Failed to read X.509 cert from file '%s'\n", path);
         fclose(fp);
         return NULL;
      }
      key = X509_get_pubkey(cert);
      /* It's fine to free the cert after we get the key because they are 2
       * independent objects; you don't need a X509 object to be in memory
       * in order to have an EVP_PKEY, and it doesn't rely on it being there.
       */
      X509_free(cert);
   }

   if (!key) {
      ast_log(LOG_ERROR, "Failed to read %s key from file '%s'\n", priv ? "private" : "public", path);
      fclose(fp);
      return NULL;
   }

   if (EVP_PKEY_id(key) != EVP_PKEY_EC && EVP_PKEY_id(key) != EVP_PKEY_RSA) {
      ast_log(LOG_ERROR, "%s key from '%s' must be of type EVP_PKEY_EC or EVP_PKEY_RSA\n",
         priv ? "Private" : "Public", path);
      fclose(fp);
      EVP_PKEY_free(key);
      return NULL;
   }

   fclose(fp);

   return key;
}

char *stir_shaken_get_serial_number_x509(const char *path)
{
   FILE *fp;
   X509 *cert;
   ASN1_INTEGER *serial;
   BIGNUM *bignum;
   char *serial_hex;
   char *ret;

   fp = fopen(path, "r");
   if (!fp) {
      ast_log(LOG_ERROR, "Failed to open file %s\n", path);
      return NULL;
   }

   cert = PEM_read_X509(fp, NULL, NULL, NULL);
   if (!cert) {
      ast_log(LOG_ERROR, "Failed to read X.509 cert from file %s\n", path);
      fclose(fp);
      return NULL;
   }

   serial = X509_get_serialNumber(cert);
   if (!serial) {
      ast_log(LOG_ERROR, "Failed to get serial number from certificate %s\n", path);
      X509_free(cert);
      fclose(fp);
      return NULL;
   }

   bignum = ASN1_INTEGER_to_BN(serial, NULL);
   if (bignum == NULL) {
      ast_log(LOG_ERROR, "Failed to convert serial to bignum for certificate %s\n", path);
      X509_free(cert);
      fclose(fp);
      return NULL;
   }

   /* This will return a string with memory allocated. After we get the string,
    * we don't need the cert, file, or bignum references anymore, so free them
    * and return the string, if BN_bn2hex was a success.
    */
   serial_hex = BN_bn2hex(bignum);
   X509_free(cert);
   fclose(fp);
   BN_free(bignum);

   if (!serial_hex) {
      ast_log(LOG_ERROR, "Failed to convert bignum to hex for certificate %s\n", path);
      return NULL;
   }

   ret = ast_strdup(serial_hex);
   OPENSSL_free(serial_hex);
   if (!ret) {
      ast_log(LOG_ERROR, "Failed to dup serial from openssl for certificate %s\n", path);
      return NULL;
   }

   return ret;
}