Added TLS support for API and many other TLS related changes.
This commit is contained in:
XMRig
parent
92a258f142
commit
5b610e4dfe
38 changed files with 1601 additions and 178 deletions
103
src/base/net/tls/ServerTls.cpp
Normal file
103
src/base/net/tls/ServerTls.cpp
Normal file
|
|
@ -0,0 +1,103 @@
|
|||
/* XMRig
|
||||
* Copyright 2018-2020 SChernykh <https://github.com/SChernykh>
|
||||
* Copyright 2016-2020 XMRig <https://github.com/xmrig>, <support@xmrig.com>
|
||||
*
|
||||
* This program is free software: you can redistribute it and/or modify
|
||||
* it under the terms of the GNU General Public License as published by
|
||||
* the Free Software Foundation, either version 3 of the License, or
|
||||
* (at your option) any later version.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
*/
|
||||
|
||||
|
||||
#include "base/net/tls/ServerTls.h"
|
||||
|
||||
|
||||
#include <cassert>
|
||||
#include <cstring>
|
||||
#include <openssl/ssl.h>
|
||||
|
||||
|
||||
xmrig::ServerTls::ServerTls(SSL_CTX *ctx) :
|
||||
m_ctx(ctx)
|
||||
{
|
||||
}
|
||||
|
||||
|
||||
xmrig::ServerTls::~ServerTls()
|
||||
{
|
||||
if (m_ssl) {
|
||||
SSL_free(m_ssl);
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
bool xmrig::ServerTls::isTLS(const char *data, size_t size)
|
||||
{
|
||||
static const uint8_t test[3] = { 0x16, 0x03, 0x01 };
|
||||
|
||||
return size >= sizeof(test) && memcmp(data, test, sizeof(test)) == 0;
|
||||
}
|
||||
|
||||
|
||||
bool xmrig::ServerTls::send(const char *data, size_t size)
|
||||
{
|
||||
SSL_write(m_ssl, data, size);
|
||||
|
||||
return write(m_write);
|
||||
}
|
||||
|
||||
|
||||
void xmrig::ServerTls::read(const char *data, size_t size)
|
||||
{
|
||||
if (!m_ssl) {
|
||||
m_ssl = SSL_new(m_ctx);
|
||||
|
||||
m_write = BIO_new(BIO_s_mem());
|
||||
m_read = BIO_new(BIO_s_mem());
|
||||
|
||||
SSL_set_accept_state(m_ssl);
|
||||
SSL_set_bio(m_ssl, m_read, m_write);
|
||||
}
|
||||
|
||||
|
||||
BIO_write(m_read, data, size);
|
||||
|
||||
if (!SSL_is_init_finished(m_ssl)) {
|
||||
const int rc = SSL_do_handshake(m_ssl);
|
||||
|
||||
if (rc < 0 && SSL_get_error(m_ssl, rc) == SSL_ERROR_WANT_READ) {
|
||||
write(m_write);
|
||||
} else if (rc == 1) {
|
||||
write(m_write);
|
||||
|
||||
m_ready = true;
|
||||
read();
|
||||
}
|
||||
else {
|
||||
shutdown();
|
||||
}
|
||||
|
||||
return;
|
||||
}
|
||||
|
||||
read();
|
||||
}
|
||||
|
||||
|
||||
void xmrig::ServerTls::read()
|
||||
{
|
||||
static char buf[16384]{};
|
||||
|
||||
int bytes_read = 0;
|
||||
while ((bytes_read = SSL_read(m_ssl, buf, sizeof(buf))) > 0) {
|
||||
parse(buf, bytes_read);
|
||||
}
|
||||
}
|
||||
68
src/base/net/tls/ServerTls.h
Normal file
68
src/base/net/tls/ServerTls.h
Normal file
|
|
@ -0,0 +1,68 @@
|
|||
/* XMRig
|
||||
* Copyright 2018-2020 SChernykh <https://github.com/SChernykh>
|
||||
* Copyright 2016-2020 XMRig <https://github.com/xmrig>, <support@xmrig.com>
|
||||
*
|
||||
* This program is free software: you can redistribute it and/or modify
|
||||
* it under the terms of the GNU General Public License as published by
|
||||
* the Free Software Foundation, either version 3 of the License, or
|
||||
* (at your option) any later version.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
*/
|
||||
|
||||
|
||||
#ifndef XMRIG_SERVERTLS_H
|
||||
#define XMRIG_SERVERTLS_H
|
||||
|
||||
|
||||
using BIO = struct bio_st;
|
||||
using SSL = struct ssl_st;
|
||||
using SSL_CTX = struct ssl_ctx_st;
|
||||
|
||||
|
||||
|
||||
#include "base/tools/Object.h"
|
||||
|
||||
|
||||
namespace xmrig {
|
||||
|
||||
|
||||
class ServerTls
|
||||
{
|
||||
public:
|
||||
XMRIG_DISABLE_COPY_MOVE_DEFAULT(ServerTls)
|
||||
|
||||
ServerTls(SSL_CTX *ctx);
|
||||
virtual ~ServerTls();
|
||||
|
||||
static bool isTLS(const char *data, size_t size);
|
||||
|
||||
bool send(const char *data, size_t size);
|
||||
void read(const char *data, size_t size);
|
||||
|
||||
protected:
|
||||
virtual bool write(BIO *bio) = 0;
|
||||
virtual void parse(char *data, size_t size) = 0;
|
||||
virtual void shutdown() = 0;
|
||||
|
||||
private:
|
||||
void read();
|
||||
|
||||
BIO *m_read = nullptr;
|
||||
BIO *m_write = nullptr;
|
||||
bool m_ready = false;
|
||||
SSL *m_ssl = nullptr;
|
||||
SSL_CTX *m_ctx;
|
||||
};
|
||||
|
||||
|
||||
} // namespace xmrig
|
||||
|
||||
|
||||
#endif /* XMRIG_SERVERTLS_H */
|
||||
200
src/base/net/tls/TlsConfig.cpp
Normal file
200
src/base/net/tls/TlsConfig.cpp
Normal file
|
|
@ -0,0 +1,200 @@
|
|||
/* XMRig
|
||||
* Copyright 2010 Jeff Garzik <jgarzik@pobox.com>
|
||||
* Copyright 2012-2014 pooler <pooler@litecoinpool.org>
|
||||
* Copyright 2014 Lucas Jones <https://github.com/lucasjones>
|
||||
* Copyright 2014-2016 Wolf9466 <https://github.com/OhGodAPet>
|
||||
* Copyright 2016 Jay D Dee <jayddee246@gmail.com>
|
||||
* Copyright 2017-2018 XMR-Stak <https://github.com/fireice-uk>, <https://github.com/psychocrypt>
|
||||
* Copyright 2018 Lee Clagett <https://github.com/vtnerd>
|
||||
* Copyright 2018-2020 SChernykh <https://github.com/SChernykh>
|
||||
* Copyright 2016-2020 XMRig <https://github.com/xmrig>, <support@xmrig.com>
|
||||
*
|
||||
* This program is free software: you can redistribute it and/or modify
|
||||
* it under the terms of the GNU General Public License as published by
|
||||
* the Free Software Foundation, either version 3 of the License, or
|
||||
* (at your option) any later version.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
*/
|
||||
|
||||
|
||||
#include "base/net/tls/TlsConfig.h"
|
||||
#include "base/io/json/Json.h"
|
||||
#include "base/io/log/Log.h"
|
||||
#include "base/net/tls/TlsGen.h"
|
||||
#include "rapidjson/document.h"
|
||||
|
||||
|
||||
namespace xmrig {
|
||||
|
||||
|
||||
const char *TlsConfig::kCert = "cert";
|
||||
const char *TlsConfig::kEnabled = "enabled";
|
||||
const char *TlsConfig::kCertKey = "cert_key";
|
||||
const char *TlsConfig::kCiphers = "ciphers";
|
||||
const char *TlsConfig::kCipherSuites = "ciphersuites";
|
||||
const char *TlsConfig::kDhparam = "dhparam";
|
||||
const char *TlsConfig::kGen = "gen";
|
||||
const char *TlsConfig::kProtocols = "protocols";
|
||||
|
||||
static const char *kTLSv1 = "TLSv1";
|
||||
static const char *kTLSv1_1 = "TLSv1.1";
|
||||
static const char *kTLSv1_2 = "TLSv1.2";
|
||||
static const char *kTLSv1_3 = "TLSv1.3";
|
||||
|
||||
|
||||
} // namespace xmrig
|
||||
|
||||
|
||||
/**
|
||||
* "cert" load TLS certificate chain from file.
|
||||
* "cert_key" load TLS private key from file.
|
||||
* "ciphers" set list of available ciphers (TLSv1.2 and below).
|
||||
* "ciphersuites" set list of available TLSv1.3 ciphersuites.
|
||||
* "dhparam" load DH parameters for DHE ciphers from file.
|
||||
*/
|
||||
xmrig::TlsConfig::TlsConfig(const rapidjson::Value &value)
|
||||
{
|
||||
if (value.IsObject()) {
|
||||
m_enabled = Json::getBool(value, kEnabled, m_enabled);
|
||||
|
||||
setProtocols(Json::getString(value, kProtocols));
|
||||
setCert(Json::getString(value, kCert));
|
||||
setKey(Json::getString(value, kCertKey));
|
||||
setCiphers(Json::getString(value, kCiphers));
|
||||
setCipherSuites(Json::getString(value, kCipherSuites));
|
||||
setDH(Json::getString(value, kDhparam));
|
||||
|
||||
if (m_key.isNull()) {
|
||||
setKey(Json::getString(value, "cert-key"));
|
||||
}
|
||||
|
||||
if (m_enabled && !isValid()) {
|
||||
generate(Json::getString(value, kGen));
|
||||
}
|
||||
}
|
||||
else if (value.IsBool()) {
|
||||
m_enabled = value.GetBool();
|
||||
|
||||
if (m_enabled) {
|
||||
generate();
|
||||
}
|
||||
}
|
||||
# ifdef XMRIG_PROXY_PROJECT
|
||||
else if (value.IsNull()) {
|
||||
generate();
|
||||
}
|
||||
# endif
|
||||
else if (value.IsString()) {
|
||||
generate(value.GetString());
|
||||
}
|
||||
else {
|
||||
m_enabled = false;
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
bool xmrig::TlsConfig::generate(const char *commonName)
|
||||
{
|
||||
TlsGen gen;
|
||||
|
||||
try {
|
||||
gen.generate(commonName);
|
||||
}
|
||||
catch (std::exception &ex) {
|
||||
LOG_ERR("%s", ex.what());
|
||||
|
||||
return false;
|
||||
}
|
||||
|
||||
setCert(gen.cert());
|
||||
setKey(gen.certKey());
|
||||
|
||||
m_enabled = true;
|
||||
|
||||
return true;
|
||||
}
|
||||
|
||||
|
||||
rapidjson::Value xmrig::TlsConfig::toJSON(rapidjson::Document &doc) const
|
||||
{
|
||||
using namespace rapidjson;
|
||||
|
||||
auto &allocator = doc.GetAllocator();
|
||||
Value obj(kObjectType);
|
||||
obj.AddMember(StringRef(kEnabled), m_enabled, allocator);
|
||||
|
||||
if (m_protocols > 0) {
|
||||
std::vector<String> protocols;
|
||||
|
||||
if (m_protocols & TLSv1) {
|
||||
protocols.emplace_back(kTLSv1);
|
||||
}
|
||||
|
||||
if (m_protocols & TLSv1_1) {
|
||||
protocols.emplace_back(kTLSv1_1);
|
||||
}
|
||||
|
||||
if (m_protocols & TLSv1_2) {
|
||||
protocols.emplace_back(kTLSv1_2);
|
||||
}
|
||||
|
||||
if (m_protocols & TLSv1_3) {
|
||||
protocols.emplace_back(kTLSv1_3);
|
||||
}
|
||||
|
||||
obj.AddMember(StringRef(kProtocols), String::join(protocols, ' ').toJSON(doc), allocator);
|
||||
}
|
||||
else {
|
||||
obj.AddMember(StringRef(kProtocols), kNullType, allocator);
|
||||
}
|
||||
|
||||
obj.AddMember(StringRef(kCert), m_cert.toJSON(), allocator);
|
||||
obj.AddMember(StringRef(kCertKey), m_key.toJSON(), allocator);
|
||||
obj.AddMember(StringRef(kCiphers), m_ciphers.toJSON(), allocator);
|
||||
obj.AddMember(StringRef(kCipherSuites), m_cipherSuites.toJSON(), allocator);
|
||||
obj.AddMember(StringRef(kDhparam), m_dhparam.toJSON(), allocator);
|
||||
|
||||
return obj;
|
||||
}
|
||||
|
||||
|
||||
void xmrig::TlsConfig::setProtocols(const char *protocols)
|
||||
{
|
||||
const std::vector<String> vec = String(protocols).split(' ');
|
||||
|
||||
for (const String &value : vec) {
|
||||
if (value == kTLSv1) {
|
||||
m_protocols |= TLSv1;
|
||||
}
|
||||
else if (value == kTLSv1_1) {
|
||||
m_protocols |= TLSv1_1;
|
||||
}
|
||||
else if (value == kTLSv1_2) {
|
||||
m_protocols |= TLSv1_2;
|
||||
}
|
||||
else if (value == kTLSv1_3) {
|
||||
m_protocols |= TLSv1_3;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
void xmrig::TlsConfig::setProtocols(const rapidjson::Value &protocols)
|
||||
{
|
||||
m_protocols = 0;
|
||||
|
||||
if (protocols.IsUint()) {
|
||||
return setProtocols(protocols.GetUint());
|
||||
}
|
||||
|
||||
if (protocols.IsString()) {
|
||||
return setProtocols(protocols.GetString());
|
||||
}
|
||||
}
|
||||
92
src/base/net/tls/TlsConfig.h
Normal file
92
src/base/net/tls/TlsConfig.h
Normal file
|
|
@ -0,0 +1,92 @@
|
|||
/* XMRig
|
||||
* Copyright 2010 Jeff Garzik <jgarzik@pobox.com>
|
||||
* Copyright 2012-2014 pooler <pooler@litecoinpool.org>
|
||||
* Copyright 2014 Lucas Jones <https://github.com/lucasjones>
|
||||
* Copyright 2014-2016 Wolf9466 <https://github.com/OhGodAPet>
|
||||
* Copyright 2016 Jay D Dee <jayddee246@gmail.com>
|
||||
* Copyright 2017-2018 XMR-Stak <https://github.com/fireice-uk>, <https://github.com/psychocrypt>
|
||||
* Copyright 2018 Lee Clagett <https://github.com/vtnerd>
|
||||
* Copyright 2018-2020 SChernykh <https://github.com/SChernykh>
|
||||
* Copyright 2016-2020 XMRig <https://github.com/xmrig>, <support@xmrig.com>
|
||||
*
|
||||
* This program is free software: you can redistribute it and/or modify
|
||||
* it under the terms of the GNU General Public License as published by
|
||||
* the Free Software Foundation, either version 3 of the License, or
|
||||
* (at your option) any later version.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
*/
|
||||
|
||||
#ifndef XMRIG_TLSCONFIG_H
|
||||
#define XMRIG_TLSCONFIG_H
|
||||
|
||||
|
||||
#include "base/tools/String.h"
|
||||
#include "rapidjson/fwd.h"
|
||||
|
||||
|
||||
namespace xmrig {
|
||||
|
||||
|
||||
class TlsConfig
|
||||
{
|
||||
public:
|
||||
static const char *kCert;
|
||||
static const char *kCertKey;
|
||||
static const char *kCiphers;
|
||||
static const char *kCipherSuites;
|
||||
static const char *kDhparam;
|
||||
static const char *kEnabled;
|
||||
static const char *kGen;
|
||||
static const char *kProtocols;
|
||||
|
||||
enum Versions {
|
||||
TLSv1 = 1,
|
||||
TLSv1_1 = 2,
|
||||
TLSv1_2 = 4,
|
||||
TLSv1_3 = 8
|
||||
};
|
||||
|
||||
TlsConfig() = default;
|
||||
TlsConfig(const rapidjson::Value &object);
|
||||
|
||||
inline bool isEnabled() const { return m_enabled && isValid(); }
|
||||
inline bool isValid() const { return !m_cert.isEmpty() && !m_key.isEmpty(); }
|
||||
inline const char *cert() const { return m_cert.data(); }
|
||||
inline const char *ciphers() const { return m_ciphers.isEmpty() ? nullptr : m_ciphers.data(); }
|
||||
inline const char *cipherSuites() const { return m_cipherSuites.isEmpty() ? nullptr : m_cipherSuites.data(); }
|
||||
inline const char *dhparam() const { return m_dhparam.isEmpty() ? nullptr : m_dhparam.data(); }
|
||||
inline const char *key() const { return m_key.data(); }
|
||||
inline uint32_t protocols() const { return m_protocols; }
|
||||
inline void setCert(const char *cert) { m_cert = cert; }
|
||||
inline void setCiphers(const char *ciphers) { m_ciphers = ciphers; }
|
||||
inline void setCipherSuites(const char *ciphers) { m_cipherSuites = ciphers; }
|
||||
inline void setDH(const char *dhparam) { m_dhparam = dhparam; }
|
||||
inline void setKey(const char *key) { m_key = key; }
|
||||
inline void setProtocols(uint32_t protocols) { m_protocols = protocols; }
|
||||
|
||||
bool generate(const char *commonName = nullptr);
|
||||
rapidjson::Value toJSON(rapidjson::Document &doc) const;
|
||||
void setProtocols(const char *protocols);
|
||||
void setProtocols(const rapidjson::Value &protocols);
|
||||
|
||||
private:
|
||||
bool m_enabled = true;
|
||||
uint32_t m_protocols = 0;
|
||||
String m_cert;
|
||||
String m_ciphers;
|
||||
String m_cipherSuites;
|
||||
String m_dhparam;
|
||||
String m_key;
|
||||
};
|
||||
|
||||
|
||||
} /* namespace xmrig */
|
||||
|
||||
#endif /* XMRIG_TLSCONFIG_H */
|
||||
256
src/base/net/tls/TlsContext.cpp
Normal file
256
src/base/net/tls/TlsContext.cpp
Normal file
|
|
@ -0,0 +1,256 @@
|
|||
/* XMRig
|
||||
* Copyright 2010 Jeff Garzik <jgarzik@pobox.com>
|
||||
* Copyright 2012-2014 pooler <pooler@litecoinpool.org>
|
||||
* Copyright 2014 Lucas Jones <https://github.com/lucasjones>
|
||||
* Copyright 2014-2016 Wolf9466 <https://github.com/OhGodAPet>
|
||||
* Copyright 2016 Jay D Dee <jayddee246@gmail.com>
|
||||
* Copyright 2017-2018 XMR-Stak <https://github.com/fireice-uk>, <https://github.com/psychocrypt>
|
||||
* Copyright 2018 Lee Clagett <https://github.com/vtnerd>
|
||||
* Copyright 2018-2020 SChernykh <https://github.com/SChernykh>
|
||||
* Copyright 2016-2020 XMRig <https://github.com/xmrig>, <support@xmrig.com>
|
||||
*
|
||||
* This program is free software: you can redistribute it and/or modify
|
||||
* it under the terms of the GNU General Public License as published by
|
||||
* the Free Software Foundation, either version 3 of the License, or
|
||||
* (at your option) any later version.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
*/
|
||||
|
||||
|
||||
#include "base/net/tls/TlsContext.h"
|
||||
#include "base/io/log/Log.h"
|
||||
#include "base/kernel/Env.h"
|
||||
#include "base/net/tls/TlsConfig.h"
|
||||
|
||||
|
||||
#include <openssl/ssl.h>
|
||||
#include <openssl/err.h>
|
||||
|
||||
|
||||
namespace xmrig {
|
||||
|
||||
|
||||
// https://wiki.openssl.org/index.php/Diffie-Hellman_parameters
|
||||
static DH *get_dh2048()
|
||||
{
|
||||
static unsigned char dhp_2048[] = {
|
||||
0xB2, 0x91, 0xA7, 0x05, 0x31, 0xCE, 0x12, 0x9D, 0x03, 0x43,
|
||||
0xAF, 0x13, 0xAF, 0x4B, 0x8E, 0x4C, 0x04, 0x13, 0x4F, 0x72,
|
||||
0x00, 0x73, 0x2C, 0x67, 0xC3, 0xE0, 0x50, 0xBF, 0x72, 0x5E,
|
||||
0xBE, 0x45, 0x89, 0x4C, 0x01, 0x45, 0xA6, 0x5E, 0xA7, 0xA8,
|
||||
0xDC, 0x2F, 0x1D, 0x91, 0x2D, 0x58, 0x0D, 0x71, 0x97, 0x3D,
|
||||
0xAE, 0xFE, 0x86, 0x29, 0x37, 0x5F, 0x5E, 0x6D, 0x81, 0x56,
|
||||
0x07, 0x83, 0xF2, 0xF8, 0xEC, 0x4E, 0xF8, 0x7A, 0xEC, 0xEA,
|
||||
0xD9, 0xEA, 0x61, 0x3C, 0xAF, 0x51, 0x30, 0xB7, 0xA7, 0x67,
|
||||
0x3F, 0x59, 0xAD, 0x2E, 0x23, 0x57, 0x64, 0xA2, 0x99, 0x15,
|
||||
0xBD, 0xD9, 0x8D, 0xBA, 0xE6, 0x8F, 0xFB, 0xB3, 0x77, 0x3B,
|
||||
0xE6, 0x5C, 0xC1, 0x03, 0xCF, 0x38, 0xD4, 0xF6, 0x2E, 0x0B,
|
||||
0xF3, 0x20, 0xBE, 0xF0, 0xFC, 0x85, 0xEF, 0x5F, 0xCE, 0x0E,
|
||||
0x42, 0x17, 0x3B, 0x72, 0x43, 0x4C, 0x3A, 0xF5, 0xC8, 0xB4,
|
||||
0x40, 0x52, 0x03, 0x72, 0x9A, 0x2C, 0xA4, 0x23, 0x2A, 0xA2,
|
||||
0x52, 0xA3, 0xC2, 0x76, 0x08, 0x1C, 0x2E, 0x60, 0x44, 0xE4,
|
||||
0x12, 0x5D, 0x80, 0x47, 0x6C, 0x7A, 0x5A, 0x8E, 0x18, 0xC9,
|
||||
0x8C, 0x22, 0xC8, 0x07, 0x75, 0xE2, 0x77, 0x3A, 0x90, 0x2E,
|
||||
0x79, 0xC3, 0xF5, 0x4E, 0x4E, 0xDE, 0x14, 0x29, 0xA4, 0x5B,
|
||||
0x32, 0xCC, 0xE5, 0x05, 0x09, 0x2A, 0xC9, 0x1C, 0xB4, 0x8E,
|
||||
0x99, 0xCF, 0x57, 0xF2, 0x1B, 0x5F, 0x18, 0x89, 0x29, 0xF2,
|
||||
0xB0, 0xF3, 0xAC, 0x67, 0x16, 0x90, 0x4A, 0x1D, 0xD6, 0xF5,
|
||||
0x84, 0x71, 0x1D, 0x0E, 0x61, 0x5F, 0xE2, 0x2D, 0x52, 0x87,
|
||||
0x0D, 0x8F, 0x84, 0xCB, 0xFC, 0xF0, 0x5D, 0x4C, 0x9F, 0x59,
|
||||
0xA9, 0xD6, 0x83, 0x70, 0x4B, 0x98, 0x6A, 0xCA, 0x78, 0x53,
|
||||
0x27, 0x32, 0x59, 0x35, 0x0A, 0xB8, 0x29, 0x18, 0xAF, 0x58,
|
||||
0x45, 0x63, 0xEB, 0x43, 0x28, 0x7B
|
||||
};
|
||||
|
||||
static unsigned char dhg_2048[] = { 0x02 };
|
||||
|
||||
auto dh = DH_new();
|
||||
if (dh == nullptr) {
|
||||
return nullptr;
|
||||
}
|
||||
|
||||
auto p = BN_bin2bn(dhp_2048, sizeof(dhp_2048), nullptr);
|
||||
auto g = BN_bin2bn(dhg_2048, sizeof(dhg_2048), nullptr);
|
||||
|
||||
if (p == nullptr || g == nullptr || !DH_set0_pqg(dh, p, nullptr, g)) {
|
||||
DH_free(dh);
|
||||
BN_free(p);
|
||||
BN_free(g);
|
||||
|
||||
return nullptr;
|
||||
}
|
||||
|
||||
return dh;
|
||||
}
|
||||
|
||||
} // namespace xmrig
|
||||
|
||||
|
||||
xmrig::TlsContext::~TlsContext()
|
||||
{
|
||||
SSL_CTX_free(m_ctx);
|
||||
}
|
||||
|
||||
|
||||
xmrig::TlsContext *xmrig::TlsContext::create(const TlsConfig &config)
|
||||
{
|
||||
if (!config.isEnabled()) {
|
||||
return nullptr;
|
||||
}
|
||||
|
||||
auto tls = new TlsContext();
|
||||
if (!tls->load(config)) {
|
||||
delete tls;
|
||||
|
||||
return nullptr;
|
||||
}
|
||||
|
||||
return tls;
|
||||
}
|
||||
|
||||
|
||||
bool xmrig::TlsContext::load(const TlsConfig &config)
|
||||
{
|
||||
m_ctx = SSL_CTX_new(SSLv23_server_method());
|
||||
if (m_ctx == nullptr) {
|
||||
LOG_ERR("Unable to create SSL context");
|
||||
|
||||
return false;
|
||||
}
|
||||
|
||||
const auto cert = Env::expand(config.cert());
|
||||
if (SSL_CTX_use_certificate_chain_file(m_ctx, cert) <= 0) {
|
||||
LOG_ERR("SSL_CTX_use_certificate_chain_file(\"%s\") failed.", config.cert());
|
||||
|
||||
return false;
|
||||
}
|
||||
|
||||
const auto key = Env::expand(config.key());
|
||||
if (SSL_CTX_use_PrivateKey_file(m_ctx, key, SSL_FILETYPE_PEM) <= 0) {
|
||||
LOG_ERR("SSL_CTX_use_PrivateKey_file(\"%s\") failed.", config.key());
|
||||
|
||||
return false;
|
||||
}
|
||||
|
||||
SSL_CTX_set_options(m_ctx, SSL_OP_NO_SSLv2 | SSL_OP_NO_SSLv3);
|
||||
SSL_CTX_set_options(m_ctx, SSL_OP_CIPHER_SERVER_PREFERENCE);
|
||||
|
||||
# if OPENSSL_VERSION_NUMBER >= 0x1010100fL
|
||||
SSL_CTX_set_max_early_data(m_ctx, 0);
|
||||
# endif
|
||||
|
||||
setProtocols(config.protocols());
|
||||
|
||||
return setCiphers(config.ciphers()) && setCipherSuites(config.cipherSuites()) && setDH(config.dhparam());
|
||||
}
|
||||
|
||||
|
||||
bool xmrig::TlsContext::setCiphers(const char *ciphers)
|
||||
{
|
||||
if (ciphers == nullptr || SSL_CTX_set_cipher_list(m_ctx, ciphers) == 1) {
|
||||
return true;
|
||||
}
|
||||
|
||||
LOG_ERR("SSL_CTX_set_cipher_list(\"%s\") failed.", ciphers);
|
||||
|
||||
return true;
|
||||
}
|
||||
|
||||
|
||||
bool xmrig::TlsContext::setCipherSuites(const char *ciphersuites)
|
||||
{
|
||||
if (ciphersuites == nullptr) {
|
||||
return true;
|
||||
}
|
||||
|
||||
# if OPENSSL_VERSION_NUMBER >= 0x1010100fL
|
||||
if (SSL_CTX_set_ciphersuites(m_ctx, ciphersuites) == 1) {
|
||||
return true;
|
||||
}
|
||||
# endif
|
||||
|
||||
LOG_ERR("SSL_CTX_set_ciphersuites(\"%s\") failed.", ciphersuites);
|
||||
|
||||
return false;
|
||||
}
|
||||
|
||||
|
||||
bool xmrig::TlsContext::setDH(const char *dhparam)
|
||||
{
|
||||
DH *dh = nullptr;
|
||||
|
||||
if (dhparam != nullptr) {
|
||||
BIO *bio = BIO_new_file(Env::expand(dhparam), "r");
|
||||
if (bio == nullptr) {
|
||||
LOG_ERR("BIO_new_file(\"%s\") failed.", dhparam);
|
||||
|
||||
return false;
|
||||
}
|
||||
|
||||
dh = PEM_read_bio_DHparams(bio, nullptr, nullptr, nullptr);
|
||||
if (dh == nullptr) {
|
||||
LOG_ERR("PEM_read_bio_DHparams(\"%s\") failed.", dhparam);
|
||||
|
||||
BIO_free(bio);
|
||||
|
||||
return false;
|
||||
}
|
||||
|
||||
BIO_free(bio);
|
||||
}
|
||||
else {
|
||||
dh = get_dh2048();
|
||||
}
|
||||
|
||||
const int rc = SSL_CTX_set_tmp_dh(m_ctx, dh);
|
||||
|
||||
DH_free(dh);
|
||||
|
||||
if (rc == 0) {
|
||||
LOG_ERR("SSL_CTX_set_tmp_dh(\"%s\") failed.", dhparam);
|
||||
|
||||
return false;
|
||||
}
|
||||
|
||||
return true;
|
||||
}
|
||||
|
||||
|
||||
void xmrig::TlsContext::setProtocols(uint32_t protocols)
|
||||
{
|
||||
if (protocols == 0) {
|
||||
return;
|
||||
}
|
||||
|
||||
if (!(protocols & TlsConfig::TLSv1)) {
|
||||
SSL_CTX_set_options(m_ctx, SSL_OP_NO_TLSv1);
|
||||
}
|
||||
|
||||
# ifdef SSL_OP_NO_TLSv1_1
|
||||
SSL_CTX_clear_options(m_ctx, SSL_OP_NO_TLSv1_1);
|
||||
if (!(protocols & TlsConfig::TLSv1_1)) {
|
||||
SSL_CTX_set_options(m_ctx, SSL_OP_NO_TLSv1_1);
|
||||
}
|
||||
# endif
|
||||
|
||||
# ifdef SSL_OP_NO_TLSv1_2
|
||||
SSL_CTX_clear_options(m_ctx, SSL_OP_NO_TLSv1_2);
|
||||
if (!(protocols & TlsConfig::TLSv1_2)) {
|
||||
SSL_CTX_set_options(m_ctx, SSL_OP_NO_TLSv1_2);
|
||||
}
|
||||
# endif
|
||||
|
||||
# ifdef SSL_OP_NO_TLSv1_3
|
||||
SSL_CTX_clear_options(m_ctx, SSL_OP_NO_TLSv1_3);
|
||||
if (!(protocols & TlsConfig::TLSv1_3)) {
|
||||
SSL_CTX_set_options(m_ctx, SSL_OP_NO_TLSv1_3);
|
||||
}
|
||||
# endif
|
||||
}
|
||||
71
src/base/net/tls/TlsContext.h
Normal file
71
src/base/net/tls/TlsContext.h
Normal file
|
|
@ -0,0 +1,71 @@
|
|||
/* XMRig
|
||||
* Copyright 2010 Jeff Garzik <jgarzik@pobox.com>
|
||||
* Copyright 2012-2014 pooler <pooler@litecoinpool.org>
|
||||
* Copyright 2014 Lucas Jones <https://github.com/lucasjones>
|
||||
* Copyright 2014-2016 Wolf9466 <https://github.com/OhGodAPet>
|
||||
* Copyright 2016 Jay D Dee <jayddee246@gmail.com>
|
||||
* Copyright 2017-2018 XMR-Stak <https://github.com/fireice-uk>, <https://github.com/psychocrypt>
|
||||
* Copyright 2018 Lee Clagett <https://github.com/vtnerd>
|
||||
* Copyright 2018-2020 SChernykh <https://github.com/SChernykh>
|
||||
* Copyright 2016-2020 XMRig <https://github.com/xmrig>, <support@xmrig.com>
|
||||
*
|
||||
* This program is free software: you can redistribute it and/or modify
|
||||
* it under the terms of the GNU General Public License as published by
|
||||
* the Free Software Foundation, either version 3 of the License, or
|
||||
* (at your option) any later version.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
*/
|
||||
|
||||
#ifndef XMRIG_TLSCONTEXT_H
|
||||
#define XMRIG_TLSCONTEXT_H
|
||||
|
||||
|
||||
#include "base/tools/Object.h"
|
||||
|
||||
|
||||
#include <cstdint>
|
||||
|
||||
|
||||
using SSL_CTX = struct ssl_ctx_st;
|
||||
|
||||
|
||||
namespace xmrig {
|
||||
|
||||
|
||||
class TlsConfig;
|
||||
|
||||
|
||||
class TlsContext
|
||||
{
|
||||
public:
|
||||
XMRIG_DISABLE_COPY_MOVE(TlsContext)
|
||||
|
||||
~TlsContext();
|
||||
|
||||
static TlsContext *create(const TlsConfig &config);
|
||||
|
||||
inline SSL_CTX *ctx() const { return m_ctx; }
|
||||
|
||||
private:
|
||||
TlsContext() = default;
|
||||
|
||||
bool load(const TlsConfig &config);
|
||||
bool setCiphers(const char *ciphers);
|
||||
bool setCipherSuites(const char *ciphersuites);
|
||||
bool setDH(const char *dhparam);
|
||||
void setProtocols(uint32_t protocols);
|
||||
|
||||
SSL_CTX *m_ctx = nullptr;
|
||||
};
|
||||
|
||||
|
||||
} /* namespace xmrig */
|
||||
|
||||
#endif /* XMRIG_TLSCONTEXT_H */
|
||||
144
src/base/net/tls/TlsGen.cpp
Normal file
144
src/base/net/tls/TlsGen.cpp
Normal file
|
|
@ -0,0 +1,144 @@
|
|||
/* XMRig
|
||||
* Copyright 2018-2020 SChernykh <https://github.com/SChernykh>
|
||||
* Copyright 2016-2020 XMRig <https://github.com/xmrig>, <support@xmrig.com>
|
||||
*
|
||||
* This program is free software: you can redistribute it and/or modify
|
||||
* it under the terms of the GNU General Public License as published by
|
||||
* the Free Software Foundation, either version 3 of the License, or
|
||||
* (at your option) any later version.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
*/
|
||||
|
||||
|
||||
#include "base/net/tls/TlsGen.h"
|
||||
|
||||
|
||||
#include <openssl/ssl.h>
|
||||
#include <openssl/err.h>
|
||||
#include <stdexcept>
|
||||
#include <fstream>
|
||||
|
||||
|
||||
namespace xmrig {
|
||||
|
||||
|
||||
static const char *kLocalhost = "localhost";
|
||||
|
||||
|
||||
static EVP_PKEY *generate_pkey()
|
||||
{
|
||||
auto pkey = EVP_PKEY_new();
|
||||
if (!pkey) {
|
||||
return nullptr;
|
||||
}
|
||||
|
||||
auto exponent = BN_new();
|
||||
auto rsa = RSA_new();
|
||||
if (!exponent || !rsa || !BN_set_word(exponent, RSA_F4) || !RSA_generate_key_ex(rsa, 2048, exponent, nullptr) || !EVP_PKEY_assign_RSA(pkey, rsa)) {
|
||||
EVP_PKEY_free(pkey);
|
||||
BN_free(exponent);
|
||||
RSA_free(rsa);
|
||||
|
||||
return nullptr;
|
||||
}
|
||||
|
||||
BN_free(exponent);
|
||||
|
||||
return pkey;
|
||||
}
|
||||
|
||||
|
||||
bool isFileExist(const char *fileName)
|
||||
{
|
||||
std::ifstream in(fileName);
|
||||
|
||||
return in.good();
|
||||
}
|
||||
|
||||
|
||||
} // namespace xmrig
|
||||
|
||||
|
||||
xmrig::TlsGen::~TlsGen()
|
||||
{
|
||||
EVP_PKEY_free(m_pkey);
|
||||
X509_free(m_x509);
|
||||
}
|
||||
|
||||
|
||||
void xmrig::TlsGen::generate(const char *commonName)
|
||||
{
|
||||
if (isFileExist(m_cert) && isFileExist(m_certKey)) {
|
||||
return;
|
||||
}
|
||||
|
||||
m_pkey = generate_pkey();
|
||||
if (!m_pkey) {
|
||||
throw std::runtime_error("RSA key generation failed.");
|
||||
}
|
||||
|
||||
if (!generate_x509(commonName == nullptr || strlen(commonName) == 0 ? kLocalhost : commonName)) {
|
||||
throw std::runtime_error("x509 certificate generation failed.");
|
||||
}
|
||||
|
||||
if (!write()) {
|
||||
throw std::runtime_error("unable to write certificate to disk.");
|
||||
}
|
||||
}
|
||||
|
||||
|
||||
bool xmrig::TlsGen::generate_x509(const char *commonName)
|
||||
{
|
||||
m_x509 = X509_new();
|
||||
if (!m_x509) {
|
||||
return false;
|
||||
}
|
||||
|
||||
if (!X509_set_pubkey(m_x509, m_pkey)) {
|
||||
return false;
|
||||
}
|
||||
|
||||
ASN1_INTEGER_set(X509_get_serialNumber(m_x509), 1);
|
||||
X509_gmtime_adj(X509_get_notBefore(m_x509), 0);
|
||||
X509_gmtime_adj(X509_get_notAfter(m_x509), 315360000L);
|
||||
|
||||
auto name = X509_get_subject_name(m_x509);
|
||||
X509_NAME_add_entry_by_NID(name, NID_commonName, MBSTRING_ASC, reinterpret_cast<const uint8_t *>(commonName), -1, -1, 0);
|
||||
|
||||
X509_set_issuer_name(m_x509, name);
|
||||
|
||||
return X509_sign(m_x509, m_pkey, EVP_sha256());
|
||||
}
|
||||
|
||||
|
||||
bool xmrig::TlsGen::write()
|
||||
{
|
||||
auto pkey_file = fopen(m_certKey, "wb");
|
||||
if (!pkey_file) {
|
||||
return false;
|
||||
}
|
||||
|
||||
bool ret = PEM_write_PrivateKey(pkey_file, m_pkey, nullptr, nullptr, 0, nullptr, nullptr);
|
||||
fclose(pkey_file);
|
||||
|
||||
if (!ret) {
|
||||
return false;
|
||||
}
|
||||
|
||||
auto x509_file = fopen(m_cert, "wb");
|
||||
if (!x509_file) {
|
||||
return false;
|
||||
}
|
||||
|
||||
ret = PEM_write_X509(x509_file, m_x509);
|
||||
fclose(x509_file);
|
||||
|
||||
return ret;
|
||||
}
|
||||
61
src/base/net/tls/TlsGen.h
Normal file
61
src/base/net/tls/TlsGen.h
Normal file
|
|
@ -0,0 +1,61 @@
|
|||
/* XMRig
|
||||
* Copyright 2018-2020 SChernykh <https://github.com/SChernykh>
|
||||
* Copyright 2016-2020 XMRig <https://github.com/xmrig>, <support@xmrig.com>
|
||||
*
|
||||
* This program is free software: you can redistribute it and/or modify
|
||||
* it under the terms of the GNU General Public License as published by
|
||||
* the Free Software Foundation, either version 3 of the License, or
|
||||
* (at your option) any later version.
|
||||
*
|
||||
* This program is distributed in the hope that it will be useful,
|
||||
* but WITHOUT ANY WARRANTY; without even the implied warranty of
|
||||
* MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
|
||||
* GNU General Public License for more details.
|
||||
*
|
||||
* You should have received a copy of the GNU General Public License
|
||||
* along with this program. If not, see <http://www.gnu.org/licenses/>.
|
||||
*/
|
||||
|
||||
#ifndef XMRIG_TLSGEN_H
|
||||
#define XMRIG_TLSGEN_H
|
||||
|
||||
|
||||
#include "base/tools/Object.h"
|
||||
#include "base/tools/String.h"
|
||||
|
||||
|
||||
using EVP_PKEY = struct evp_pkey_st;
|
||||
using X509 = struct x509_st;
|
||||
|
||||
|
||||
namespace xmrig {
|
||||
|
||||
|
||||
class TlsGen
|
||||
{
|
||||
public:
|
||||
XMRIG_DISABLE_COPY_MOVE(TlsGen)
|
||||
|
||||
TlsGen() : m_cert("cert.pem"), m_certKey("cert_key.pem") {}
|
||||
~TlsGen();
|
||||
|
||||
inline const String &cert() const { return m_cert; }
|
||||
inline const String &certKey() const { return m_certKey; }
|
||||
|
||||
void generate(const char *commonName = nullptr);
|
||||
|
||||
private:
|
||||
bool generate_x509(const char *commonName);
|
||||
bool write();
|
||||
|
||||
const String m_cert;
|
||||
const String m_certKey;
|
||||
EVP_PKEY *m_pkey = nullptr;
|
||||
X509 *m_x509 = nullptr;
|
||||
};
|
||||
|
||||
|
||||
} /* namespace xmrig */
|
||||
|
||||
|
||||
#endif /* XMRIG_TLSGEN_H */
|
||||
Loading…
Add table
Add a link
Reference in a new issue