ssl_engine_pphrase.c revision 1cde33c7e2019830f8fb3224e01649305583916e
/* _ _
** _ __ ___ ___ __| | ___ ___| | mod_ssl
** | '_ ` _ \ / _ \ / _` | / __/ __| | Apache Interface to OpenSSL
** | | | | | | (_) | (_| | \__ \__ \ | www.modssl.org
** |_| |_| |_|\___/ \__,_|___|___/___/_| ftp.modssl.org
** |_____|
** Pass Phrase Dialog
*/
/* ====================================================================
* The Apache Software License, Version 1.1
*
* Copyright (c) 2000-2002 The Apache Software Foundation. All rights
* reserved.
*
* Redistribution and use in source and binary forms, with or without
* modification, are permitted provided that the following conditions
* are met:
*
* 1. Redistributions of source code must retain the above copyright
* notice, this list of conditions and the following disclaimer.
*
* 2. Redistributions in binary form must reproduce the above copyright
* notice, this list of conditions and the following disclaimer in
* distribution.
*
* 3. The end-user documentation included with the redistribution,
* if any, must include the following acknowledgment:
* "This product includes software developed by the
* Apache Software Foundation (http://www.apache.org/)."
* Alternately, this acknowledgment may appear in the software itself,
* if and wherever such third-party acknowledgments normally appear.
*
* 4. The names "Apache" and "Apache Software Foundation" must
* not be used to endorse or promote products derived from this
* software without prior written permission. For written
* permission, please contact apache@apache.org.
*
* 5. Products derived from this software may not be called "Apache",
* nor may "Apache" appear in their name, without prior written
* permission of the Apache Software Foundation.
*
* THIS SOFTWARE IS PROVIDED ``AS IS'' AND ANY EXPRESSED OR IMPLIED
* WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
* OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
* DISCLAIMED. IN NO EVENT SHALL THE APACHE SOFTWARE FOUNDATION OR
* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
* LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF
* USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
* ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
* OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT
* OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
* SUCH DAMAGE.
* ====================================================================
*/
/* ``Treat your password like your
toothbrush. Don't let anybody
else use it, and get a new one
every six months.''
-- Clifford Stoll */
#include "mod_ssl.h"
/*
* Return true if the named file exists and is readable
*/
{
apr_file_t *fd;
return stat;
return APR_EGENERAL;
return stat;
if (mtime) {
}
return APR_SUCCESS;
}
/*
* reuse vhost keys for asn1 tables where keys are allocated out
* of s->process->pool to prevent "leaking" each time we format
* a vhost key. since the key is stored in a table with lifetime
* of s->process->pool, the key needs to have the same lifetime.
*
* XXX: probably seems silly to use a hash table with keys and values
* being the same, but it is easier than doing a linear search
* and will make it easier to remove keys if needed in the future.
* also have the problem with apr_array_header_t that if we
* underestimate the number of vhost keys when we apr_array_make(),
* the array will get resized when we push past the initial number
* of elts. this resizing in the s->process->pool means "leaking"
* since apr_array_push() will apr_alloc arr->nalloc * 2 elts,
* leaving the original arr->elts to waste.
*/
{
/* 'p' pool used here is cleared on restarts (or sooner) */
if (!keyptr) {
/* make a copy out of s->process->pool */
}
return (char *)keyptr;
}
/* _________________________________________________________________
**
** Pass Phrase and Private Key Handling
** _________________________________________________________________
*/
#define BUILTIN_DIALOG_BACKOFF 2
#define BUILTIN_DIALOG_RETRIES 5
/*
* sslc has a nasty flaw where its
* PEM_read_bio_PrivateKey does not take a callback arg.
*/
int ssl_pphrase_Handle_CB(char *, int, int, void *);
{
return NULL;
}
}
{
}
}
{
char *cpVHostID;
char szPath[MAX_STRING_LEN];
unsigned char *ucp;
long int length;
int nPassPhrase;
int nPassPhraseCur;
char *cpPassPhraseCur;
int nPassPhraseRetry;
int nPassPhraseDialog;
int nPassPhraseDialogCur;
char **cpp;
int i, j;
char *an;
char *cp;
apr_time_t pkey_mtime = 0;
int isterm = 1;
/*
* Start with a fresh pass phrase array
*/
nPassPhrase = 0;
nPassPhraseDialog = 0;
/*
* Walk through all configured servers
*/
continue;
"Loading certificate & private key of SSL-aware server");
/*
* Read in server certificate(s): This is the easy part
* because this file isn't encrypted in any way.
*/
"Server should be SSL-aware but has no certificate "
"configured [Hint: SSLCertificateFile]");
ssl_die();
}
"Init: Can't open server certificate file %s",
szPath);
ssl_die();
}
"Init: Unable to read server certificate from file %s", szPath);
ssl_die();
}
/*
* check algorithm type of certificate and make
* sure only one certificate per type is used.
*/
"Init: Multiple %s server certificates not "
"allowed", an);
ssl_die();
}
/*
* Insert the certificate into global module configuration to let it
* survive the processing between the 1st Apache API init round (where
* we operate here) and the 2nd Apache init round (where the
* certificate is actually used to configure mod_ssl's per-server
* configuration structures).
*/
/*
* Free the X509 structure
*/
/*
* Read in the private key: This is the non-trivial part, because the
* key is typically encrypted, so a pass phrase dialog has to be used
* to request it from the user (or it has to be alternatively gathered
* from a dialog program). The important point here is that ISPs
* usually have hundrets of virtual servers configured and a lot of
* them use SSL, so really we have to minimize the pass phrase
* dialogs.
*
* The idea is this: When N virtual hosts are configured and all of
* them use encrypted private keys with different pass phrases, we
* have no chance and have to pop up N pass phrase dialogs. But
* usually the admin is clever enough and uses the same pass phrase
* for more private key files (typically he even uses one single pass
* phrase for all). When this is the case we can minimize the dialogs
*/
/*
* Try to read the private key file with the help of
* the callback function which serves the pass
* phrases to OpenSSL
*/
nPassPhraseCur = 0;
nPassPhraseRetry = 0;
nPassPhraseDialogCur = 0;
pPrivateKey = NULL;
for (;;) {
/*
* Try to read the private key file with the help of
* the callback function which serves the pass
* phrases to OpenSSL
*/
&pkey_mtime)) != APR_SUCCESS ) {
"Init: Can't open server private key file "
"%s",szPath);
ssl_die();
}
/*
* if the private key is encrypted and SSLPassPhraseDialog
* is configured to "builtin" it isn't possible to prompt for
* a password after httpd has detached from the tty.
* in this case if we already have a private key and the
* we also reuse existing private keys that were encrypted for
* exec: and pipe: dialogs to minimize chances to snoop the
* password. that and pipe: dialogs might prompt the user
* for password, which on win32 for example could happen 4
* times at startup. twice for each child and twice within
* each since apache "restarts itself" on startup.
* of course this will not work for the builtin dialog if
* the server was started without LoadModule ssl_module
* configured, then restarted with it configured.
* but we fall through with a chance of success if the key
* is not encrypted or can be handled via exec or pipe dialog.
* and in the case of fallthrough, pkey_mtime and isatty()
* are used to give a better idea as to what failed.
*/
if (pkey_mtime) {
int i;
for (i=0; i < SSL_AIDX_MAX; i++) {
const char *key_id =
ssl_asn1_table_keyfmt(p, cpVHostID, i);
ssl_asn1_t *asn1 =
0, pServ,
"%s reusing existing "
"%s private key on restart",
cpVHostID, ssl_asn1_keystr(i));
return;
}
}
}
ssl_pphrase_server_rec = s; /* to make up for sslc flaw */
/*
* when the private key file now was readable,
* it's fine and we go out of the loop
*/
if (bReadable)
break;
/*
* when we have more remembered pass phrases
* try to reuse these first.
*/
if (nPassPhraseCur < nPassPhrase) {
continue;
}
/*
* else it's not readable and we have no more
* remembered pass phrases. Then this has to mean
* that the callback function popped up the dialog
* but a wrong pass phrase was entered. We give the
* user (but not the dialog program) a few more
* chances...
*/
#ifndef WIN32
#else
#endif
&& cpPassPhraseCur != NULL
&& nPassPhraseRetry < BUILTIN_DIALOG_RETRIES ) {
"(%d more retr%s permitted).\n",
* 5 * APR_USEC_PER_SEC);
continue;
}
#ifdef WIN32
"Init: PassPhraseDialog BuiltIn not "
"supported in server private key from file "
"%s", szPath);
ssl_die();
}
#endif /* WIN32 */
/*
* Ok, anything else now means a fatal error.
*/
if (cpPassPhraseCur == NULL) {
if (nPassPhraseDialogCur && pkey_mtime &&
{
"Init: Unable to read pass phrase "
"[Hint: key introduced or changed "
"before restart?]");
}
else {
pServ, "Init: Private key not found");
}
}
}
else {
pServ, "Init: Pass phrase incorrect");
}
}
ssl_die();
}
if (pPrivateKey == NULL) {
"Init: Unable to read server private key from "
"file %s [Hint: Perhaps it is in a separate file? "
" See SSLCertificateKeyFile]", szPath);
ssl_die();
}
/*
* check algorithm type of private key and make
* sure only one private key per type is used.
*/
"Init: Multiple %s server private keys not "
"allowed", an);
ssl_die();
}
/*
* Log the type of reading
*/
if (nPassPhraseDialogCur == 0) {
"unencrypted %s private key - pass phrase not "
"required", an);
}
else {
if (cpPassPhraseCur != NULL) {
"encrypted %s private key - pass phrase "
"requested", an);
}
else {
"encrypted %s private key - pass phrase"
" reused", an);
}
}
/*
* Ok, when we have one more pass phrase store it
*/
if (cpPassPhraseCur != NULL) {
*cpp = cpPassPhraseCur;
nPassPhrase++;
}
/*
* Insert private key into the global module configuration
* (we convert it to a stand-alone DER byte sequence
* because the SSL library uses static variables inside a
* RSA structure which do not survive DSO reloads!)
*/
if (nPassPhraseDialogCur != 0) {
/* remember mtime of encrypted keys */
}
/*
* Free the private key structure
*/
}
}
/*
* Let the user know when we're successful.
*/
if (nPassPhraseDialog > 0) {
sc = mySrvConfig(s);
}
}
/*
* Wipe out the used memory from the
* pass phrase array and then deallocate it
*/
if (aPassPhrase->nelts) {
"Init: Wiped out the queried pass phrases from memory");
}
/* Close the pipes if they were opened
*/
if (readtty) {
}
return;
}
{
/* Child process code for 'ErrorLog "|..."';
* may want a common framework for this, since I expect it will
* be common for other foo-loggers to want this sort of thing...
*/
APR_NO_PIPE)) == APR_SUCCESS)) {
char **args;
const char *pname;
if (rc == APR_SUCCESS) {
/* XXX: not sure if we aught to...
* apr_pool_note_subprocess(p, procnew, APR_KILL_AFTER_TIMEOUT);
*/
}
}
return rc;
}
{
char *p;
buf[0]='\0';
return 1; /* failure */
}
*p = '\0';
}
#ifdef WIN32
/* XXX: apr_sometest */
*p = '\0';
}
#endif
return 0;
}
{
server_rec *s;
apr_pool_t *p;
int *pnPassPhraseCur;
char **cppPassPhraseCur;
char *cpVHostID;
char *cpAlgoType;
int *pnPassPhraseDialog;
int *pnPassPhraseDialogCur;
char *cpp;
int len = -1;
#ifndef OPENSSL_VERSION_NUMBER
/* make up for sslc flaw */
#endif
/*
* Reconnect to the context of ssl_phrase_Handle()
*/
sc = mySrvConfig(s);
(*pnPassPhraseDialog)++;
(*pnPassPhraseDialogCur)++;
/*
* When remembered pass phrases are available use them...
*/
return len;
}
/*
* Builtin or Pipe dialog
*/
char *prompt;
int i;
if (!readtty) {
"Init: Creating pass phrase dialog pipe child "
!= APR_SUCCESS) {
"Init: Failed to create pass phrase pipe '%s'",
return (-1);
}
}
"Init: Requesting pass phrase via piped dialog");
}
else { /* sc->server->pphrase_dialog_type == SSL_PPTYPE_BUILTIN */
#ifdef WIN32
return (-1);
#else
/*
* stderr has already been redirected to the error_log.
* rather than attempting to temporarily rehook it to the terminal,
* we print the prompt to stdout before EVP_read_pw_string turns
* off tty echo
*/
apr_file_open_stdout(&writetty, p);
"Init: Requesting pass phrase via builtin terminal "
"dialog");
#endif
}
/*
* The first time display a header to inform the user about what
* program he actually speaks to, which module is responsible for
* this terminal dialog and why to the hell he has to enter
* something...
*/
if (*pnPassPhraseDialog == 1) {
}
if (*pbPassPhraseDialogOnce) {
}
/*
* Emulate the OpenSSL internal pass phrase dialog
*/
prompt = "Enter pass phrase:";
for (;;) {
}
else { /* sc->server->pphrase_dialog_type == SSL_PPTYPE_BUILTIN */
}
if (i != 0) {
return (-1);
}
if (len < 1)
apr_file_printf(writetty, "Apache:mod_ssl:Error: Pass phrase empty (needs to be at least 1 character).\n");
else
break;
}
}
/*
* Filter program
*/
char *result;
"Init: Requesting pass phrase from dialog filter "
"program (%s)", cmd);
}
/*
* Ok, we now have the pass phrase, so give it back
*/
/*
* And return it's length to OpenSSL...
*/
return (len);
}