rsyslog/runtime/lmcry_ossl.c

/* lmcry_ossl.c
 *
 * An implementation of the cryprov interface for openssl.
 *
 * Copyright 2013-2017 Rainer Gerhards and Adiscon GmbH.
 *
 * This file is part of the rsyslog runtime library.
 *
 * Licensed under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License.
 * You may obtain a copy of the License at
 *
 *       http://www.apache.org/licenses/LICENSE-2.0
 *       -or-
 *       see COPYING.ASL20 in the source distribution
 *
 * Unless required by applicable law or agreed to in writing, software
 * distributed under the License is distributed on an "AS IS" BASIS,
 * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 * See the License for the specific language governing permissions and
 * limitations under the License.
 */
#include "config.h"

#include "rsyslog.h"
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <errno.h>

#include "module-template.h"
#include "glbl.h"
#include "errmsg.h"
#include "cryprov.h"
#include "parserif.h"
#include "libossl.h"
#include "lmcry_ossl.h"

MODULE_TYPE_LIB
MODULE_TYPE_NOKEEP;

/* static data */
DEFobjStaticHelpers;
DEFobjCurrIf(glbl)

    /* tables for interfacing with the v6 config system */
    static struct cnfparamdescr cnfpdescrRegular[] = {{"cry.key", eCmdHdlrGetWord, 0},
                                                      {"cry.keyfile", eCmdHdlrGetWord, 0},
                                                      {"cry.mode", eCmdHdlrGetWord, 0},
                                                      {"cry.algo", eCmdHdlrGetWord, 0}};
static struct cnfparamblk pblkRegular = {CNFPARAMBLK_VERSION, sizeof(cnfpdescrRegular) / sizeof(struct cnfparamdescr),
                                         cnfpdescrRegular};

static struct cnfparamdescr cnfpdescrQueue[] = {{"queue.cry.key", eCmdHdlrGetWord, 0},
                                                {"queue.cry.keyfile", eCmdHdlrGetWord, 0},
                                                {"queue.cry.mode", eCmdHdlrGetWord, 0},
                                                {"queue.cry.algo", eCmdHdlrGetWord, 0}};
static struct cnfparamblk pblkQueue = {CNFPARAMBLK_VERSION, sizeof(cnfpdescrQueue) / sizeof(struct cnfparamdescr),
                                       cnfpdescrQueue};


/* Standard-Constructor
 */
BEGINobjConstruct(lmcry_ossl)
    CHKmalloc(pThis->ctx = osslCtxNew());
finalize_it:
ENDobjConstruct(lmcry_ossl)


/* destructor for the lmcry_ossl object */
BEGINobjDestruct(lmcry_ossl) /* be sure to specify the object type also in END and CODESTART macros! */
    CODESTARTobjDestruct(lmcry_ossl);
    rsosslCtxDel(pThis->ctx);
ENDobjDestruct(lmcry_ossl)


/* apply all params from param block to us. This must be called
 * after construction, but before the OnFileOpen() entry point.
 * Defaults are expected to have been set during construction.
 */
static rsRetVal SetCnfParam(void *pT, struct nvlst *lst, int paramType) {
    lmcry_ossl_t *pThis = (lmcry_ossl_t *)pT;
    int i, r;
    unsigned keylen = 0;
    uchar *key = NULL;
    uchar *keyfile = NULL;
    uchar *algomode = NULL;
    int nKeys; /* number of keys (actually methods) specified */
    struct cnfparamvals *pvals;
    struct cnfparamblk *pblk;
    DEFiRet;

    pblk = (paramType == CRYPROV_PARAMTYPE_REGULAR) ? &pblkRegular : &pblkQueue;
    nKeys = 0;
    pvals = nvlstGetParams(lst, pblk, NULL);
    if (pvals == NULL) {
        parser_errmsg("error crypto provider ossl config parameters");
        ABORT_FINALIZE(RS_RET_MISSING_CNFPARAMS);
    }
    if (Debug) {
        dbgprintf("param blk in lmcry_ossl:\n");
        cnfparamsPrint(pblk, pvals);
    }

    for (i = 0; i < pblk->nParams; ++i) {
        if (!pvals[i].bUsed) continue;
        if (!strcmp(pblk->descr[i].name, "cry.key") || !strcmp(pblk->descr[i].name, "queue.cry.key")) {
            key = (uchar *)es_str2cstr(pvals[i].val.d.estr, NULL);
            ++nKeys;
        } else if (!strcmp(pblk->descr[i].name, "cry.keyfile") || !strcmp(pblk->descr[i].name, "queue.cry.keyfile")) {
            keyfile = (uchar *)es_str2cstr(pvals[i].val.d.estr, NULL);
            ++nKeys;
        } else if (!strcmp(pblk->descr[i].name, "cry.algo") || !strcmp(pblk->descr[i].name, "queue.cry.algo")) {
            algomode = (uchar *)es_str2cstr(pvals[i].val.d.estr, NULL);
        } else {
            DBGPRINTF(
                "lmcry_ossl: program error, non-handled "
                "param '%s'\n",
                pblk->descr[i].name);
        }
    }
    if (algomode != NULL) {
        iRet = rsosslSetAlgoMode(pThis->ctx, algomode);
        if (iRet != RS_RET_OK) {
            LogError(0, iRet, "cry.algo '%s' is not know/supported", algomode);
            FINALIZE;
        }
    }

    /* note: key must be set AFTER algo/mode is set (as it depends on them) */
    if (nKeys != 1) {
        LogError(0, RS_RET_INVALID_PARAMS,
                 "excactly one of the following "
                 "parameters can be specified: cry.key, cry.keyfile\n");
        ABORT_FINALIZE(RS_RET_INVALID_PARAMS);
    }

    if (key != NULL) {
        LogError(0, RS_RET_ERR,
                 "Note: specifying an actual key directly from the "
                 "config file is highly insecure - DO NOT USE FOR PRODUCTION");
        keylen = strlen((char *)key);
    }
    if (keyfile != NULL) {
        r = osslGetKeyFromFile((char *)keyfile, (char **)&key, &keylen);
        if (r != 0) {
            LogError(errno, RS_RET_ERR, "error reading keyfile %s", keyfile);
            ABORT_FINALIZE(RS_RET_INVALID_PARAMS);
        }
    }

    /* if we reach this point, we have a valid key */
    r = rsosslSetKey(pThis->ctx, key, keylen);
    if (r > 0) {
        LogError(0, RS_RET_INVALID_PARAMS,
                 "Key length %d expected, but "
                 "key of length %d given",
                 r, keylen);
        ABORT_FINALIZE(RS_RET_INVALID_PARAMS);
    }

finalize_it:
    free(key);
    free(keyfile);
    free(algomode);
    if (pvals != NULL) cnfparamvalsDestruct(pvals, pblk);
    RETiRet;
}

static void SetDeleteOnClose(void *pF, int val) {
    osslfileSetDeleteOnClose(pF, val);
}

static rsRetVal GetBytesLeftInBlock(void *pF, ssize_t *left) {
    return osslfileGetBytesLeftInBlock((osslfile)pF, left);
}

static rsRetVal DeleteStateFiles(uchar *logfn) {
    return osslfileDeleteState(logfn);
}

static rsRetVal OnFileOpen(void *pT, uchar *fn, void *pGF, char openMode) {
    lmcry_ossl_t *pThis = (lmcry_ossl_t *)pT;
    osslfile *pgf = (osslfile *)pGF;
    DEFiRet;
    DBGPRINTF("lmcry_ossl: open file '%s', mode '%c'\n", fn, openMode);

    iRet = rsosslInitCrypt(pThis->ctx, pgf, fn, openMode);
    if (iRet != RS_RET_OK) {
        LogError(0, iRet,
                 "Encryption Provider"
                 "Error: cannot open .encinfo file - disabling log file");
    }
    RETiRet;
}

static rsRetVal Decrypt(void *pF, uchar *rec, size_t *lenRec) {
    DEFiRet;
    iRet = rsosslDecrypt(pF, rec, lenRec);
    RETiRet;
}


static rsRetVal Encrypt(void *pF, uchar *rec, size_t *lenRec) {
    DEFiRet;
    iRet = rsosslEncrypt(pF, rec, lenRec);
    RETiRet;
}

static rsRetVal OnFileClose(void *pF, off64_t offsLogfile) {
    DEFiRet;
    osslfileDestruct(pF, offsLogfile);
    RETiRet;
}

BEGINobjQueryInterface(lmcry_ossl)
    CODESTARTobjQueryInterface(lmcry_ossl);
    if (pIf->ifVersion != cryprovCURR_IF_VERSION) { /* check for current version, increment on each change */
        ABORT_FINALIZE(RS_RET_INTERFACE_NOT_SUPPORTED);
    }
    pIf->Construct = (rsRetVal(*)(void *))lmcry_osslConstruct;
    pIf->SetCnfParam = SetCnfParam;
    pIf->SetDeleteOnClose = SetDeleteOnClose;
    pIf->Destruct = (rsRetVal(*)(void *))lmcry_osslDestruct;
    pIf->OnFileOpen = OnFileOpen;
    pIf->Encrypt = Encrypt;
    pIf->Decrypt = Decrypt;
    pIf->OnFileClose = OnFileClose;
    pIf->DeleteStateFiles = DeleteStateFiles;
    pIf->GetBytesLeftInBlock = GetBytesLeftInBlock;
finalize_it:
ENDobjQueryInterface(lmcry_ossl)


BEGINObjClassExit(lmcry_ossl, OBJ_IS_LOADABLE_MODULE) /* CHANGE class also in END MACRO! */
    CODESTARTObjClassExit(lmcry_ossl);
    /* release objects we no longer need */
    objRelease(glbl, CORE_COMPONENT);
    rsosslExit();
ENDObjClassExit(lmcry_ossl)


BEGINObjClassInit(lmcry_ossl, 1, OBJ_IS_LOADABLE_MODULE) /* class, version */
    /* request objects we use */
    CHKiRet(objUse(glbl, CORE_COMPONENT));
    if (rsosslInit() != 0) {
        LogError(0, RS_RET_CRYPROV_ERR,
                 "error initializing "
                 "ossl crypto provider - cannot encrypt");
        ABORT_FINALIZE(RS_RET_CRYPROV_ERR);
    }
ENDObjClassInit(lmcry_ossl)


/* --------------- here now comes the plumbing that makes as a library module --------------- */


BEGINmodExit
    CODESTARTmodExit;
    lmcry_osslClassExit();
ENDmodExit


BEGINqueryEtryPt
    CODESTARTqueryEtryPt;
    CODEqueryEtryPt_STD_LIB_QUERIES;
ENDqueryEtryPt


BEGINmodInit()
    CODESTARTmodInit;
    *ipIFVersProvided = CURR_MOD_IF_VERSION; /* we only support the current interface specification */
    /* Initialize all classes that are in our module - this includes ourselfs */
    CHKiRet(lmcry_osslClassInit(pModInfo)); /* must be done after tcps_sess, as we use it */
ENDmodInit