I now start the listener in the main.c file rather than proxy given that
I didn't feel proxy was the right place if a normal (non-proxied)
request came in. webserver.{c,h} and proxy.{c,h} had some changes
relating to this.
The config changed slightly - we now create a folder in ~/.config/
called yaip. This is where certificates and so on will be stored along
with the user configuration
I created a helper function to get files inside this directory (it
changes based on xdg_config_home) and updated relevant tests.
In ssl.{c,h} I have started work. If they don't exist, the tool now
creates and stores a key and certificate for the CA that this tool will
need to pretend to be. I still need to write tests for this.
master
Jonathan Hodgson
3 years ago
parent
6eaad263be
commit
bb62ed3b1f
14 changed files with 371 additions and 105 deletions
@ -0,0 +1,6 @@ |
|||||||
|
# Certificate Authority |
||||||
|
|
||||||
|
At some point, it would be nice if yaip does this automatically, but for now, |
||||||
|
you need to create a certificate authority for yaip to sign requests with. |
||||||
|
|
||||||
|
; |
||||||
@ -0,0 +1,180 @@ |
|||||||
|
#include "ssl.h" |
||||||
|
|
||||||
|
|
||||||
|
SSL_CTX* InitServerCTX(Config *config) { |
||||||
|
const SSL_METHOD *method; |
||||||
|
SSL_CTX *ctx; |
||||||
|
OpenSSL_add_all_algorithms(); /* load & register all cryptos, etc. */ |
||||||
|
SSL_load_error_strings(); /* load all error messages */ |
||||||
|
method = TLS_server_method(); /* create new server-method instance */ |
||||||
|
ctx = SSL_CTX_new(method); /* create new context from method */ |
||||||
|
if ( ctx == NULL ) { |
||||||
|
ERR_print_errors_fp(stderr); |
||||||
|
abort(); |
||||||
|
} |
||||||
|
|
||||||
|
//set the local certificate from CertFile
|
||||||
|
if ( SSL_CTX_use_certificate_file(ctx, config->certfile, SSL_FILETYPE_PEM) <= 0 ){ |
||||||
|
ERR_print_errors_fp(stderr); |
||||||
|
abort(); |
||||||
|
} |
||||||
|
|
||||||
|
//set the private key from KeyFile (may be the same as CertFile)
|
||||||
|
if ( SSL_CTX_use_PrivateKey_file(ctx, config->keyfile, SSL_FILETYPE_PEM) <= 0 ){ |
||||||
|
ERR_print_errors_fp(stderr); |
||||||
|
abort(); |
||||||
|
} |
||||||
|
//verify private key
|
||||||
|
if ( !SSL_CTX_check_private_key(ctx) ) |
||||||
|
{ |
||||||
|
fprintf(stderr, "Private key does not match the public certificate\n"); |
||||||
|
abort(); |
||||||
|
} |
||||||
|
|
||||||
|
return ctx; |
||||||
|
} |
||||||
|
|
||||||
|
|
||||||
|
// Generates a 2048-bit RSA key.
|
||||||
|
// Largely stolen from here: https://gist.github.com/nathan-osman/5041136
|
||||||
|
EVP_PKEY* generate_ca_key() { |
||||||
|
// Allocate memory for the EVP_PKEY structure.
|
||||||
|
EVP_PKEY *pkey = EVP_PKEY_new(); |
||||||
|
if(!pkey) { |
||||||
|
perror("Unable to create EVP_PKEY structure.\n"); |
||||||
|
return NULL; |
||||||
|
} |
||||||
|
|
||||||
|
// Generate the RSA key and assign it to pkey.
|
||||||
|
RSA *rsa = RSA_new(); |
||||||
|
BIGNUM *bn = BN_new(); |
||||||
|
BN_set_word(bn, RSA_F4); |
||||||
|
RSA_generate_key_ex(rsa, 2048, bn, NULL ); |
||||||
|
if(!EVP_PKEY_assign_RSA(pkey, rsa)) { |
||||||
|
perror("Unable to generate 2048-bit RSA key.\n"); |
||||||
|
EVP_PKEY_free(pkey); |
||||||
|
return NULL; |
||||||
|
} |
||||||
|
|
||||||
|
// The key has been generated, return it.
|
||||||
|
return pkey; |
||||||
|
} |
||||||
|
|
||||||
|
|
||||||
|
// Generates a self-signed x509 certificate.
|
||||||
|
// Largely stolen from here: https://gist.github.com/nathan-osman/5041136
|
||||||
|
X509* generate_ca_cert(EVP_PKEY * pkey) { |
||||||
|
// Allocate memory for the X509 structure.
|
||||||
|
X509 *x509 = X509_new(); |
||||||
|
if(!x509) { |
||||||
|
perror( "Unable to create X509 structure.\n"); |
||||||
|
return NULL; |
||||||
|
} |
||||||
|
|
||||||
|
// Set the serial number.
|
||||||
|
ASN1_INTEGER_set(X509_get_serialNumber(x509), 1); |
||||||
|
|
||||||
|
// This certificate is valid from now until exactly one year from now.
|
||||||
|
X509_gmtime_adj(X509_get_notBefore(x509), 0); |
||||||
|
X509_gmtime_adj(X509_get_notAfter(x509), 31536000L); |
||||||
|
|
||||||
|
// Set the public key for our certificate.
|
||||||
|
X509_set_pubkey(x509, pkey); |
||||||
|
|
||||||
|
// We want to copy the subject name to the issuer name.
|
||||||
|
X509_NAME *name = X509_get_subject_name(x509); |
||||||
|
|
||||||
|
// Set the country code and common name.
|
||||||
|
X509_NAME_add_entry_by_txt(name, "C", MBSTRING_ASC, (unsigned char *)"UK", -1, -1, 0); |
||||||
|
X509_NAME_add_entry_by_txt(name, "O", MBSTRING_ASC, (unsigned char *)"Yet Another Intercepting Proxy", -1, -1, 0); |
||||||
|
X509_NAME_add_entry_by_txt(name, "CN", MBSTRING_ASC, (unsigned char *)"jn.hn", -1, -1, 0); |
||||||
|
|
||||||
|
// Now set the issuer name.
|
||||||
|
X509_set_issuer_name(x509, name); |
||||||
|
|
||||||
|
|
||||||
|
// TODO: mitmproxy adds some extensions. I don' tknow if I need those
|
||||||
|
// https://github.com/mitmproxy/mitmproxy/blob/3cb89069b9f70c198cc89337bd5a9b1bbf3a69d0/mitmproxy/certs.py#L190-L204
|
||||||
|
|
||||||
|
|
||||||
|
// Actually sign the certificate with our key.
|
||||||
|
if(!X509_sign(x509, pkey, EVP_sha1())) |
||||||
|
{ |
||||||
|
perror( "Error signing certificate.\n"); |
||||||
|
X509_free(x509); |
||||||
|
return NULL; |
||||||
|
} |
||||||
|
|
||||||
|
|
||||||
|
|
||||||
|
return x509; |
||||||
|
} |
||||||
|
|
||||||
|
bool create_and_save_key(char keyfile[]) { |
||||||
|
// Generate the key
|
||||||
|
EVP_PKEY *pkey = generate_ca_key(); |
||||||
|
if ( pkey == NULL ){ |
||||||
|
fprintf(stderr, "Unable to open generate key\n"); |
||||||
|
return false; |
||||||
|
} |
||||||
|
|
||||||
|
// Open the PEM file for writing the key to disk.
|
||||||
|
FILE * pkey_file = fopen(keyfile, "wb"); |
||||||
|
if(!pkey_file) { |
||||||
|
fprintf(stderr, "Unable to open \"%s\" for writing.\n", keyfile); |
||||||
|
return false; |
||||||
|
} |
||||||
|
// Write the key to disk.
|
||||||
|
bool ret = PEM_write_PrivateKey(pkey_file, pkey, NULL, NULL, 0, NULL, NULL); |
||||||
|
fclose(pkey_file); |
||||||
|
|
||||||
|
if(!ret) { |
||||||
|
perror("Unable to write private key to disk.\n"); |
||||||
|
return false; |
||||||
|
} |
||||||
|
return true; |
||||||
|
} |
||||||
|
|
||||||
|
EVP_PKEY* read_private_key(char keyfile[]){ |
||||||
|
|
||||||
|
FILE *fp; |
||||||
|
EVP_PKEY *pkey; |
||||||
|
|
||||||
|
if (! (fp = fopen(keyfile, "r"))){ |
||||||
|
perror("Error cant open certificate private key file.\n"); |
||||||
|
return NULL; |
||||||
|
} |
||||||
|
|
||||||
|
pkey = PEM_read_PrivateKey( fp, NULL, NULL, NULL ); |
||||||
|
|
||||||
|
if ( pkey == NULL ){ |
||||||
|
perror("Error cant read certificate private key file.\n"); |
||||||
|
} |
||||||
|
|
||||||
|
return pkey; |
||||||
|
} |
||||||
|
|
||||||
|
bool create_and_save_cert(char certfile[], EVP_PKEY *pkey) { |
||||||
|
// Open the PEM file for writing the certificate to disk.
|
||||||
|
FILE * x509_file = fopen(certfile, "wb"); |
||||||
|
if(!x509_file) { |
||||||
|
fprintf(stderr, "Unable to open \"%s\" for writing.\n", certfile); |
||||||
|
return false; |
||||||
|
} |
||||||
|
|
||||||
|
X509 *x509 = generate_ca_cert(pkey); |
||||||
|
if ( x509 == NULL ){ |
||||||
|
fprintf(stderr, "Unable to open generate cert\n"); |
||||||
|
return false; |
||||||
|
} |
||||||
|
|
||||||
|
// Write the certificate to disk.
|
||||||
|
int ret = PEM_write_X509(x509_file, x509); |
||||||
|
fclose(x509_file); |
||||||
|
|
||||||
|
if(!ret) { |
||||||
|
perror("Unable to write certificate to disk.\n"); |
||||||
|
return false; |
||||||
|
} |
||||||
|
return true; |
||||||
|
} |
||||||
@ -0,0 +1,19 @@ |
|||||||
|
#ifndef SSL_H |
||||||
|
#define SSL_H |
||||||
|
|
||||||
|
#include <openssl/ssl.h> |
||||||
|
#include <openssl/err.h> |
||||||
|
#include <openssl/x509.h> |
||||||
|
#include <openssl/pem.h> |
||||||
|
|
||||||
|
#include "config.h" |
||||||
|
|
||||||
|
SSL_CTX* InitServerCTX(Config *config); |
||||||
|
|
||||||
|
EVP_PKEY* generate_ca_key(); |
||||||
|
X509* generate_ca_cert(EVP_PKEY * pkey); |
||||||
|
bool create_and_save_key(char keyfile[]); |
||||||
|
bool create_and_save_cert(char keyfile[], EVP_PKEY *pkey); |
||||||
|
EVP_PKEY* read_private_key(char keyfile[]); |
||||||
|
|
||||||
|
#endif /* ifndef SSL_ */ |
||||||
Loading…
Reference in new issue