Add support for MbedTLS

2 files changed, 279 insertions, 41 deletions

diff --git a/common/userpref.c b/common/userpref.c
index a5aa7cb..0c6050f 100644
--- a/common/userpref.c
+++ b/common/userpref.c
@@ -2,6 +2,7 @@
  * userpref.c
  * contains methods to access user specific certificates IDs and more.
  *
+ * Copyright (c) 2013-2021 Nikias Bassen, All Rights Reserved.
  * Copyright (c) 2013-2014 Martin Szulecki All Rights Reserved.
  * Copyright (c) 2008 Jonathan Beck All Rights Reserved.
  *
@@ -36,7 +37,7 @@
 #endif
 #include <unistd.h>
 #include <usbmuxd.h>
-#ifdef HAVE_OPENSSL
+#if defined(HAVE_OPENSSL)
 #include <openssl/bn.h>
 #include <openssl/pem.h>
 #include <openssl/rsa.h>
@@ -47,12 +48,20 @@
 #define X509_set1_notBefore X509_set_notBefore
 #define X509_set1_notAfter X509_set_notAfter
 #endif
-#else
+#elif defined(HAVE_GNUTLS)
 #include <gnutls/gnutls.h>
 #include <gnutls/crypto.h>
 #include <gnutls/x509.h>
 #include <gcrypt.h>
 #include <libtasn1.h>
+#elif defined(HAVE_MBEDTLS)
+#include <mbedtls/ssl.h>
+#include <mbedtls/entropy.h>
+#include <mbedtls/ctr_drbg.h>
+#include <mbedtls/asn1write.h>
+#include <mbedtls/oid.h>
+#else
+#error No supported TLS/SSL library enabled
 #endif
 
 #include <dirent.h>
@@ -68,7 +77,7 @@
 #include "debug.h"
 #include "utils.h"
 
-#ifndef HAVE_OPENSSL
+#if defined(HAVE_GNUTLS)
 const ASN1_ARRAY_TYPE pkcs1_asn1_tab[] = {
         {"PKCS1", 536872976, 0},
         {0, 1073741836, 0},
@@ -343,7 +352,7 @@ userpref_error_t userpref_delete_pair_record(const char *udid)
         return res == 0 ? USERPREF_E_SUCCESS: USERPREF_E_UNKNOWN_ERROR;
 }
 
-#ifdef HAVE_OPENSSL
+#if defined(HAVE_OPENSSL)
 static int X509_add_ext_helper(X509 *cert, int nid, char *value)
 {
         X509_EXTENSION *ex;
@@ -364,6 +373,31 @@ static int X509_add_ext_helper(X509 *cert, int nid, char *value)
 
         return 1;
 }
+#elif defined(HAVE_MBEDTLS)
+static int _mbedtls_x509write_crt_set_basic_constraints_critical(mbedtls_x509write_cert *ctx, int is_ca, int max_pathlen)
+{
+        int ret;
+        unsigned char buf[9];
+        unsigned char *c = buf + sizeof(buf);
+        size_t len = 0;
+
+        memset( buf, 0, sizeof(buf) );
+
+        if (is_ca && max_pathlen > 127)
+                return( MBEDTLS_ERR_X509_BAD_INPUT_DATA );
+
+        if (is_ca) {
+                if (max_pathlen >= 0) {
+                        MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_int( &c, buf, max_pathlen ) );
+                }
+                MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_bool( &c, buf, 1 ) );
+        }
+
+        MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_len( &c, buf, len ) );
+        MBEDTLS_ASN1_CHK_ADD( len, mbedtls_asn1_write_tag( &c, buf, MBEDTLS_ASN1_CONSTRUCTED | MBEDTLS_ASN1_SEQUENCE ) );
+
+        return mbedtls_x509write_crt_set_extension( ctx, MBEDTLS_OID_BASIC_CONSTRAINTS, MBEDTLS_OID_SIZE( MBEDTLS_OID_BASIC_CONSTRAINTS ), 1, buf + sizeof(buf) - len, len );
+}
 #endif
 
 /**
@@ -390,7 +424,7 @@ userpref_error_t pair_record_generate_keys_and_certs(plist_t pair_record, key_da
 
         debug_info("Generating keys and certificates...");
 
-#ifdef HAVE_OPENSSL
+#if defined(HAVE_OPENSSL)
         BIGNUM *e = BN_new();
         RSA* root_keypair = RSA_new();
         RSA* host_keypair = RSA_new();
@@ -579,7 +613,7 @@ userpref_error_t pair_record_generate_keys_and_certs(plist_t pair_record, key_da
 
         X509_free(host_cert);
         X509_free(root_cert);
-#else
+#elif defined(HAVE_GNUTLS)
         gnutls_x509_privkey_t root_privkey;
         gnutls_x509_crt_t root_cert;
         gnutls_x509_privkey_t host_privkey;
@@ -749,6 +783,211 @@ userpref_error_t pair_record_generate_keys_and_certs(plist_t pair_record, key_da
         gnutls_free(exponent.data);
 
         gnutls_free(der_pub_key.data);
+#elif defined(HAVE_MBEDTLS)
+        time_t now = time(NULL);
+        struct tm* timestamp = gmtime(&now);
+        char notbefore[16];
+        strftime(notbefore, sizeof(notbefore), "%Y%m%d%H%M%S", timestamp);
+        time_t then = now + 60 * 60 * 24 * 365 * 10;
+        char notafter[16];
+        timestamp = gmtime(&then);
+        strftime(notafter, sizeof(notafter), "%Y%m%d%H%M%S", timestamp);
+
+        mbedtls_mpi sn;
+        mbedtls_mpi_init(&sn);
+        mbedtls_mpi_lset(&sn, 1); /* 0 doesn't work, so we have to use 1 (like GnuTLS) */
+
+        mbedtls_ctr_drbg_context ctr_drbg;
+        mbedtls_ctr_drbg_init(&ctr_drbg);
+
+        mbedtls_pk_context root_pkey;
+        mbedtls_pk_init(&root_pkey);
+
+        mbedtls_pk_context host_pkey;
+        mbedtls_pk_init(&host_pkey);
+
+        mbedtls_pk_context dev_public_key;
+        mbedtls_pk_init(&dev_public_key);
+
+        mbedtls_entropy_context entropy;
+        mbedtls_entropy_init(&entropy);
+
+        mbedtls_ctr_drbg_seed(&ctr_drbg, mbedtls_entropy_func, &entropy, (const unsigned char *)"limd", 4);
+
+        /* ----- root key & cert ----- */
+        ret = mbedtls_pk_setup(&root_pkey, mbedtls_pk_info_from_type(MBEDTLS_PK_RSA));
+        if (ret != 0) {
+                debug_info("mbedtls_pk_setup returned -0x%04x", -ret);
+                goto cleanup;
+        }
+
+        ret = mbedtls_rsa_gen_key(mbedtls_pk_rsa(root_pkey), mbedtls_ctr_drbg_random, &ctr_drbg, 2048, 65537);
+        if (ret != 0) {
+                debug_info("mbedtls_rsa_gen_key returned -0x%04x", -ret);
+                goto cleanup;
+        }
+
+        mbedtls_x509write_cert cert;
+        mbedtls_x509write_crt_init(&cert);
+
+        /* set serial number */
+        mbedtls_x509write_crt_set_serial(&cert, &sn);
+
+        /* set version */
+        mbedtls_x509write_crt_set_version(&cert, 2);
+
+        /* set x509v3 basic constraints */
+        _mbedtls_x509write_crt_set_basic_constraints_critical(&cert, 1, -1);
+
+        /* use root public key for root cert */
+        mbedtls_x509write_crt_set_subject_key(&cert, &root_pkey);
+
+        /* set x509v3 subject key identifier */
+        mbedtls_x509write_crt_set_subject_key_identifier(&cert);
+
+        /* set key validity */
+        mbedtls_x509write_crt_set_validity(&cert, notbefore, notafter);
+
+        /* sign root cert with root private key */
+        mbedtls_x509write_crt_set_issuer_key(&cert, &root_pkey);
+        mbedtls_x509write_crt_set_md_alg(&cert, MBEDTLS_MD_SHA1);
+
+        unsigned char outbuf[16384];
+
+        /* write root private key */
+        mbedtls_pk_write_key_pem(&root_pkey, outbuf, sizeof(outbuf));
+        root_key_pem.size = strlen((const char*)outbuf);
+        root_key_pem.data = malloc(root_key_pem.size+1);
+        memcpy(root_key_pem.data, outbuf, root_key_pem.size);
+        root_key_pem.data[root_key_pem.size] = '\0';
+
+        /* write root certificate */
+        mbedtls_x509write_crt_pem(&cert, outbuf, sizeof(outbuf), mbedtls_ctr_drbg_random, &ctr_drbg);
+        root_cert_pem.size = strlen((const char*)outbuf);
+        root_cert_pem.data = malloc(root_cert_pem.size+1);
+        memcpy(root_cert_pem.data, outbuf, root_cert_pem.size);
+        root_cert_pem.data[root_cert_pem.size] = '\0';
+
+        mbedtls_x509write_crt_free(&cert);
+
+
+        /* ----- host key & cert ----- */
+        ret = mbedtls_pk_setup(&host_pkey, mbedtls_pk_info_from_type(MBEDTLS_PK_RSA));
+        if (ret != 0) {
+                debug_info("mbedtls_pk_setup returned -0x%04x", -ret);
+                goto cleanup;
+        }
+
+        ret = mbedtls_rsa_gen_key(mbedtls_pk_rsa(host_pkey), mbedtls_ctr_drbg_random, &ctr_drbg, 2048, 65537);
+        if (ret != 0) {
+                debug_info("mbedtls_rsa_gen_key returned -0x%04x", -ret);
+                goto cleanup;
+        }
+
+        mbedtls_x509write_crt_init(&cert);
+
+        /* set serial number */
+        mbedtls_x509write_crt_set_serial(&cert, &sn);
+
+        /* set version */
+        mbedtls_x509write_crt_set_version(&cert, 2);
+
+        /* set x509v3 basic constraints */
+        _mbedtls_x509write_crt_set_basic_constraints_critical(&cert, 0, -1);
+
+        /* use host public key for host cert */
+        mbedtls_x509write_crt_set_subject_key(&cert, &host_pkey);
+
+        /* set x509v3 subject key identifier */
+        mbedtls_x509write_crt_set_subject_key_identifier(&cert);
+
+        /* set x509v3 key usage */
+        mbedtls_x509write_crt_set_key_usage(&cert, MBEDTLS_X509_KU_DIGITAL_SIGNATURE | MBEDTLS_X509_KU_KEY_ENCIPHERMENT);
+
+        /* set key validity */
+        mbedtls_x509write_crt_set_validity(&cert, notbefore, notafter);
+
+        /* sign host cert with root private key */
+        mbedtls_x509write_crt_set_issuer_key(&cert, &root_pkey);
+        mbedtls_x509write_crt_set_md_alg(&cert, MBEDTLS_MD_SHA1);
+
+        /* write host private key */
+        mbedtls_pk_write_key_pem(&host_pkey, outbuf, sizeof(outbuf));
+        host_key_pem.size = strlen((const char*)outbuf);
+        host_key_pem.data = malloc(host_key_pem.size+1);
+        memcpy(host_key_pem.data, outbuf, host_key_pem.size);
+        host_key_pem.data[host_key_pem.size] = '\0';
+
+        /* write host certificate */
+        mbedtls_x509write_crt_pem(&cert, outbuf, sizeof(outbuf), mbedtls_ctr_drbg_random, &ctr_drbg);
+        host_cert_pem.size = strlen((const char*)outbuf);
+        host_cert_pem.data = malloc(host_cert_pem.size+1);
+        memcpy(host_cert_pem.data, outbuf, host_cert_pem.size);
+        host_cert_pem.data[host_cert_pem.size] = '\0';
+
+        mbedtls_x509write_crt_free(&cert);
+
+
+        /* ----- device certificate ----- */
+        unsigned char* pubkey_data = malloc(public_key.size+1);
+        if (!pubkey_data) {
+                debug_info("malloc() failed\n");
+                goto cleanup;
+        }
+        memcpy(pubkey_data, public_key.data, public_key.size);
+        pubkey_data[public_key.size] = '\0';
+
+        int pr = mbedtls_pk_parse_public_key(&dev_public_key, pubkey_data, public_key.size+1);
+        free(pubkey_data);
+        if (pr != 0) {
+                debug_info("Failed to read device public key: -0x%x\n", -pr);
+                goto cleanup;
+        }
+
+        mbedtls_x509write_crt_init(&cert);
+
+        /* set serial number */
+        mbedtls_x509write_crt_set_serial(&cert, &sn);
+
+        /* set version */
+        mbedtls_x509write_crt_set_version(&cert, 2);
+
+        /* set x509v3 basic constraints */
+        _mbedtls_x509write_crt_set_basic_constraints_critical(&cert, 0, -1);
+
+        /* use root public key for dev cert subject key */
+        mbedtls_x509write_crt_set_subject_key(&cert, &dev_public_key);
+
+        /* set x509v3 subject key identifier */
+        mbedtls_x509write_crt_set_subject_key_identifier(&cert);
+
+        /* set x509v3 key usage */
+        mbedtls_x509write_crt_set_key_usage(&cert, MBEDTLS_X509_KU_DIGITAL_SIGNATURE | MBEDTLS_X509_KU_KEY_ENCIPHERMENT);
+
+        /* set key validity */
+        mbedtls_x509write_crt_set_validity(&cert, notbefore, notafter);
+
+        /* sign device certificate with root private key */
+        mbedtls_x509write_crt_set_issuer_key(&cert, &root_pkey);
+        mbedtls_x509write_crt_set_md_alg(&cert, MBEDTLS_MD_SHA1);
+
+        /* write device certificate */
+        mbedtls_x509write_crt_pem(&cert, outbuf, sizeof(outbuf), mbedtls_ctr_drbg_random, &ctr_drbg);
+        dev_cert_pem.size = strlen((const char*)outbuf);
+        dev_cert_pem.data = malloc(dev_cert_pem.size+1);
+        memcpy(dev_cert_pem.data, outbuf, dev_cert_pem.size);
+        dev_cert_pem.data[dev_cert_pem.size] = '\0';
+
+        mbedtls_x509write_crt_free(&cert);
+
+        /* cleanup */
+cleanup:
+        mbedtls_mpi_free(&sn);
+        mbedtls_pk_free(&dev_public_key);
+        mbedtls_entropy_free(&entropy);
+        mbedtls_pk_free(&host_pkey);
+        mbedtls_pk_free(&root_pkey);
+        mbedtls_ctr_drbg_free(&ctr_drbg);
 #endif
 
         /* make sure that we have all we need */
@@ -783,32 +1022,31 @@ userpref_error_t pair_record_generate_keys_and_certs(plist_t pair_record, key_da
  *
  * @return 1 if the key was successfully imported.
  */
-#ifdef HAVE_OPENSSL
+#if defined(HAVE_OPENSSL) || defined(HAVE_MBEDTLS)
 userpref_error_t pair_record_import_key_with_name(plist_t pair_record, const char* name, key_data_t* key)
-#else
+#elif defined(HAVE_GNUTLS)
 userpref_error_t pair_record_import_key_with_name(plist_t pair_record, const char* name, gnutls_x509_privkey_t key)
 #endif
 {
-#ifdef HAVE_OPENSSL
+#if defined(HAVE_OPENSSL) || defined(HAVE_MBEDTLS)
         if (!key)
                 return USERPREF_E_SUCCESS;
 #endif
         userpref_error_t ret = USERPREF_E_INVALID_CONF;
 
-#ifdef HAVE_OPENSSL
-                ret = pair_record_get_item_as_key_data(pair_record, name, key);
-#else
-                key_data_t pem = { NULL, 0 };
-                ret = pair_record_get_item_as_key_data(pair_record, name, &pem);
-                if (ret == USERPREF_E_SUCCESS && GNUTLS_E_SUCCESS == gnutls_x509_privkey_import(key, &pem, GNUTLS_X509_FMT_PEM))
-                        ret = USERPREF_E_SUCCESS;
-                else
-                        ret = USERPREF_E_SSL_ERROR;
-
-                if (pem.data)
-                        free(pem.data);
-#endif
+#if defined(HAVE_OPENSSL) || defined(HAVE_MBEDTLS)
+        ret = pair_record_get_item_as_key_data(pair_record, name, key);
+#elif defined(HAVE_GNUTLS)
+        key_data_t pem = { NULL, 0 };
+        ret = pair_record_get_item_as_key_data(pair_record, name, &pem);
+        if (ret == USERPREF_E_SUCCESS && GNUTLS_E_SUCCESS == gnutls_x509_privkey_import(key, &pem, GNUTLS_X509_FMT_PEM))
+                ret = USERPREF_E_SUCCESS;
+        else
+                ret = USERPREF_E_SSL_ERROR;
 
+        if (pem.data)
+                free(pem.data);
+#endif
         return ret;
 }
 
@@ -820,32 +1058,31 @@ userpref_error_t pair_record_import_key_with_name(plist_t pair_record, const cha
  *
  * @return IDEVICE_E_SUCCESS if the certificate was successfully imported.
  */
-#ifdef HAVE_OPENSSL
+#if defined(HAVE_OPENSSL) || defined(HAVE_MBEDTLS)
 userpref_error_t pair_record_import_crt_with_name(plist_t pair_record, const char* name, key_data_t* cert)
 #else
 userpref_error_t pair_record_import_crt_with_name(plist_t pair_record, const char* name, gnutls_x509_crt_t cert)
 #endif
 {
-#ifdef HAVE_OPENSSL
+#if defined(HAVE_OPENSSL) || defined(HAVE_MBEDTLS)
         if (!cert)
                 return USERPREF_E_SUCCESS;
 #endif
         userpref_error_t ret = USERPREF_E_INVALID_CONF;
 
-#ifdef HAVE_OPENSSL
-                ret = pair_record_get_item_as_key_data(pair_record, name, cert);
-#else
-                key_data_t pem = { NULL, 0 };
-                ret = pair_record_get_item_as_key_data(pair_record, name, &pem);
-                if (ret == USERPREF_E_SUCCESS && GNUTLS_E_SUCCESS == gnutls_x509_crt_import(cert, &pem, GNUTLS_X509_FMT_PEM))
-                        ret = USERPREF_E_SUCCESS;
-                else
-                        ret = USERPREF_E_SSL_ERROR;
-
-                if (pem.data)
-                        free(pem.data);
-#endif
+#if defined(HAVE_OPENSSL) || defined(HAVE_MBEDTLS)
+        ret = pair_record_get_item_as_key_data(pair_record, name, cert);
+#elif defined(HAVE_GNUTLS)
+        key_data_t pem = { NULL, 0 };
+        ret = pair_record_get_item_as_key_data(pair_record, name, &pem);
+        if (ret == USERPREF_E_SUCCESS && GNUTLS_E_SUCCESS == gnutls_x509_crt_import(cert, &pem, GNUTLS_X509_FMT_PEM))
+                ret = USERPREF_E_SUCCESS;
+        else
+                ret = USERPREF_E_SSL_ERROR;
 
+        if (pem.data)
+                free(pem.data);
+#endif
         return ret;
 }
 
@@ -880,9 +1117,10 @@ userpref_error_t pair_record_get_item_as_key_data(plist_t pair_record, const cha
 
         if (node && plist_get_node_type(node) == PLIST_DATA) {
                 plist_get_data_val(node, &buffer, &length);
-                value->data = (unsigned char*)malloc(length);
+                value->data = (unsigned char*)malloc(length+1);
                 memcpy(value->data, buffer, length);
-                value->size = length;
+                value->data[length] = '\0';
+                value->size = length+1;
                 free(buffer);
                 buffer = NULL;
         } else {
diff --git a/common/userpref.h b/common/userpref.h
index 4ea630f..072721a 100644
--- a/common/userpref.h
+++ b/common/userpref.h
@@ -27,7 +27,7 @@
 #include <config.h>
 #endif
 
-#ifdef HAVE_OPENSSL
+#if defined(HAVE_OPENSSL) || defined(HAVE_MBEDTLS)
 typedef struct {
         unsigned char *data;
         unsigned int size;
@@ -68,7 +68,7 @@ userpref_error_t userpref_save_pair_record(const char *udid, uint32_t device_id,
 userpref_error_t userpref_delete_pair_record(const char *udid);
 
 userpref_error_t pair_record_generate_keys_and_certs(plist_t pair_record, key_data_t public_key);
-#ifdef HAVE_OPENSSL
+#if  defined(HAVE_OPENSSL) || defined(HAVE_MBEDTLS)
 userpref_error_t pair_record_import_key_with_name(plist_t pair_record, const char* name, key_data_t* key);
 userpref_error_t pair_record_import_crt_with_name(plist_t pair_record, const char* name, key_data_t* cert);
 #else