ETM-Schurig/powersync-core
Archived
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Make SSL certificate loading and generating more robust

Browse Source
This commit is contained in:
Michael Zanetti 2022-01-10 13:50:20 +01:00
parent 28d2f53261
commit 2ec72b21b8
3 changed files with 52 additions and 25 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

57
libnymea-core/certificategenerator.cpp
View File

@ -34,9 +34,13 @@
#include <QRegExp> #include <QRegExp>
#include <QFileInfo> #include <QFileInfo>
#include <QSaveFile>
#include <QDir> #include <QDir>
#include <QUuid> #include <QUuid>
#include <QDebug> #include <QDebug>
#include <QLoggingCategory>
Q_DECLARE_LOGGING_CATEGORY(dcServerManager)
namespace nymeaserver { namespace nymeaserver {
@ -48,8 +52,24 @@ void CertificateGenerator::generate(const QString &certificateFilename, const QS
X509 * x509 = nullptr; X509 * x509 = nullptr;
X509_NAME * name = nullptr; X509_NAME * name = nullptr;
BIO * bp_public = nullptr, * bp_private = nullptr; BIO * bp_public = nullptr, * bp_private = nullptr;
const char * buffer = nullptr; const char * keyBuffer = nullptr;
long size; const char * certBuffer = nullptr;
QFileInfo certFi(certificateFilename);
QFileInfo keyFi(keyFilename);
QDir dir;
if (!dir.mkpath(certFi.absolutePath()) || !dir.mkpath(keyFi.absolutePath())) {
qCWarning(dcServerManager) << "Error creating SSL certificate destination folder";
return;
}
QSaveFile certfile(certificateFilename);
QSaveFile keyFile(keyFilename);
if (!certfile.open(QFile::WriteOnly | QFile::Truncate | QFile::Unbuffered) || !keyFile.open(QFile::WriteOnly | QFile::Truncate | QFile::Unbuffered)) {
qCWarning(dcServerManager()) << "Error opening SSL certificate files";
return;
}
bne = BN_new(); bne = BN_new();
BN_set_word(bne, RSA_F4); BN_set_word(bne, RSA_F4);
@ -90,7 +110,7 @@ void CertificateGenerator::generate(const QString &certificateFilename, const QS
EVP_PKEY_free(pkey); EVP_PKEY_free(pkey);
X509_free(x509); X509_free(x509);
BIO_free_all(bp_private); BIO_free_all(bp_private);
qFatal("PEM_write_bio_PrivateKey"); qCCritical(dcServerManager) << "PEM_write_bio_PrivateKey";
return; return;
} }
bp_public = BIO_new(BIO_s_mem()); bp_public = BIO_new(BIO_s_mem());
@ -103,26 +123,23 @@ void CertificateGenerator::generate(const QString &certificateFilename, const QS
X509_free(x509); X509_free(x509);
BIO_free_all(bp_public); BIO_free_all(bp_public);
BIO_free_all(bp_private); BIO_free_all(bp_private);
qFatal("PEM_write_bio_X509"); qCCritical(dcServerManager) << "PEM_write_bio_X509";
} }
size = BIO_get_mem_data(bp_public, &buffer); long pubSize = BIO_get_mem_data(bp_public, &certBuffer);
q_check_ptr(buffer); q_check_ptr(certBuffer);
QFileInfo certFi(certificateFilename);
QDir dir;
QFile certfile(certificateFilename);
if (!dir.mkpath(certFi.absolutePath()) || !certfile.open(QFile::WriteOnly | QFile::Truncate) || certfile.write(buffer, size) != size) {
qWarning() << "Error writing certificate file" << certificateFilename;
}
certfile.close();
size = BIO_get_mem_data(bp_private, &buffer); long privSize = BIO_get_mem_data(bp_private, &keyBuffer);
q_check_ptr(buffer); q_check_ptr(keyBuffer);
QFileInfo keyFi(keyFilename);
QFile keyFile(keyFilename); if (certfile.write(certBuffer, pubSize) == pubSize && keyFile.write(keyBuffer, privSize) == privSize) {
if (!dir.mkpath(keyFi.absolutePath()) || !keyFile.open(QFile::WriteOnly | QFile::Truncate) || keyFile.write(buffer, size) != size) { certfile.commit();
qWarning() << "Error writing key file" << keyFilename; keyFile.commit();
qCDebug(dcServerManager()) << "Generated new SSL certificate";
} else {
qCWarning(dcServerManager()) << "Error writing SSL certificate files" << certificateFilename << keyFilename;
certfile.cancelWriting();
keyFile.cancelWriting();
} }
keyFile.close();
BN_free(bne); BN_free(bne);
EVP_PKEY_free(pkey); // this will also free the rsa key EVP_PKEY_free(pkey); // this will also free the rsa key

18
libnymea-core/servermanager.cpp
View File

@ -377,8 +377,13 @@ bool ServerManager::loadCertificate(const QString &certificateKeyFileName, const
return false; return false;
} }
m_certificateKey = QSslKey(certificateKeyFile.readAll(), QSsl::Rsa); m_certificateKey = QSslKey(&certificateKeyFile, QSsl::Rsa);
qCDebug(dcServerManager()) << "Loaded private certificate key " << certificateKeyFileName; if (m_certificateKey.isNull()) {
qCWarning(dcServerManager()) << "SSL certificate key" << certificateFileName << "is not valid.";
return false;
}
qCDebug(dcServerManager()) << "Loaded private certificate key" << certificateKeyFileName;
certificateKeyFile.close(); certificateKeyFile.close();
QFile certificateFile(certificateFileName); QFile certificateFile(certificateFileName);
@ -392,8 +397,13 @@ bool ServerManager::loadCertificate(const QString &certificateKeyFileName, const
return false; return false;
} }
m_certificate = QSslCertificate(certificateFile.readAll()); m_certificate = QSslCertificate(&certificateFile);
qCDebug(dcServerManager()) << "Loaded certificate file " << certificateFileName; if (m_certificate.isNull()) {
qCWarning(dcServerManager()) << "SSL certificate" << certificateFileName << "is not valid.";;
return false;
}
qCDebug(dcServerManager()) << "Loaded certificate file" << certificateFileName;
certificateFile.close(); certificateFile.close();
return true; return true;

2
tests/auto/configurations/testconfigurations.cpp
View File

@ -72,7 +72,7 @@ void TestConfigurations::initTestCase()
f.close(); f.close();
} }
NymeaTestBase::initTestCase(); NymeaTestBase::initTestCase("*.debug=false\nApplication.debug=true\nTests.debug=true\nServerManager.debug=true");
} }
void TestConfigurations::getConfigurations() void TestConfigurations::getConfigurations()