qtlsbackend_openssl.cpp

Go to the documentation of this file.

// Copyright (C) 2021 The Qt Company Ltd.
// SPDX-License-Identifier: LicenseRef-Qt-Commercial OR LGPL-3.0-only OR GPL-2.0-only OR GPL-3.0-only
// Qt-Security score:significant reason:default
 
#include "qsslsocket_openssl_symbols_p.h"
#include "qtlsbackend_openssl_p.h"
#include "qtlskey_openssl_p.h"
#include "qx509_openssl_p.h"
#include "qtls_openssl_p.h"
 
#if QT_CONFIG(dtls)
#include "qdtls_openssl_p.h"
#endif // QT_CONFIG(dtls)
 
#include <QtNetwork/private/qsslcipher_p.h>
 
#include <QtNetwork/qsslcipher.h>
#include <QtNetwork/qssl.h>
 
#include <QtCore/qdir.h>
#include <QtCore/qdirlisting.h>
#include <QtCore/qlist.h>
#include <QtCore/qmutex.h>
#include <QtCore/qscopeguard.h>
#include <QtCore/qset.h>
 
#include "qopenssl_p.h"
 
#include <algorithm>
 
QT_BEGIN_NAMESPACE
 
using namespace Qt::StringLiterals;
 
#if defined(Q_OS_WIN) || defined(Q_OS_MACOS)
constexpr auto DefaultWarningLevel = QtCriticalMsg;
#else
constexpr auto DefaultWarningLevel = QtDebugMsg;
#endif
 
Q_LOGGING_CATEGORY(lcTlsBackend, "qt.tlsbackend.ossl", DefaultWarningLevel);
 
static void q_loadCiphersForConnection(SSL *connection, QList<QSslCipher> &ciphers,
                                       QList<QSslCipher> &defaultCiphers)
{
    Q_ASSERT(connection);
 
    STACK_OF(SSL_CIPHER) *supportedCiphers = q_SSL_get_ciphers(connection);
    for (int i = 0; i < q_sk_SSL_CIPHER_num(supportedCiphers); ++i) {
        if (SSL_CIPHER *cipher = q_sk_SSL_CIPHER_value(supportedCiphers, i)) {
            const auto ciph = QTlsBackendOpenSSL::qt_OpenSSL_cipher_to_QSslCipher(cipher);
            if (!ciph.isNull()) {
                // Unconditionally exclude ADH and AECDH ciphers since they offer no MITM protection
                if (!ciph.name().toLower().startsWith("adh"_L1) &&
                    !ciph.name().toLower().startsWith("exp-adh"_L1) &&
                    !ciph.name().toLower().startsWith("aecdh"_L1)) {
                    ciphers << ciph;
 
                    if (ciph.usedBits() >= 128)
                        defaultCiphers << ciph;
                }
            }
        }
    }
}
 
int QTlsBackendOpenSSL::s_indexForSSLExtraData = -1;
 
QString QTlsBackendOpenSSL::getErrorsFromOpenSsl()
{
    QString errorString;
    char buf[256] = {}; // OpenSSL docs claim both 120 and 256; use the larger.
    unsigned long errNum;
    while ((errNum = q_ERR_get_error())) {
        if (!errorString.isEmpty())
            errorString.append(", "_L1);
        q_ERR_error_string_n(errNum, buf, sizeof buf);
        errorString.append(QLatin1StringView(buf)); // error is ascii according to man ERR_error_string
    }
    return errorString;
}
 
void QTlsBackendOpenSSL::logAndClearErrorQueue()
{
    const auto errors = getErrorsFromOpenSsl();
    if (errors.size())
        qCWarning(lcTlsBackend) << "Discarding errors:" << errors;
}
 
void QTlsBackendOpenSSL::clearErrorQueue()
{
    while (q_ERR_get_error())
        ;
}
 
bool QTlsBackendOpenSSL::ensureLibraryLoaded()
{
    static bool libraryLoaded = []() {
        if (!q_resolveOpenSslSymbols())
            return false;
 
        // Initialize OpenSSL.
        if (q_OPENSSL_init_ssl(0, nullptr) != 1)
            return false;
 
        if (q_OpenSSL_version_num() < 0x10101000L) {
            qCWarning(lcTlsBackend, "QSslSocket: OpenSSL >= 1.1.1 is required; %s was found instead", q_OpenSSL_version(OPENSSL_VERSION));
            return false;
        }
 
        q_SSL_load_error_strings();
        q_OpenSSL_add_all_algorithms();
 
        s_indexForSSLExtraData = q_CRYPTO_get_ex_new_index(CRYPTO_EX_INDEX_SSL, 0L, nullptr, nullptr,
                                                           nullptr, nullptr);
 
        // If QCryptographicHash (openssl_hash feature) was used before this
        // point, it may have loaded and then unloaded the default OpenSSL
        // provider, draining its activation count to zero. With no providers
        // active, RAND_status() returns 0 even though seeding would succeed
        // with a loaded provider. Hold a permanent activation reference to
        // prevent that. Skip in FIPS mode: the FIPS provider supplies its own
        // RAND, and loading the non-FIPS default would violate the user's
        // security policy.
#if defined(OPENSSL_VERSION_MAJOR) && OPENSSL_VERSION_MAJOR >= 3
        if (!q_EVP_default_properties_is_fips_enabled(nullptr)) {
            static OSSL_PROVIDER *s_defaultProvider = q_OSSL_PROVIDER_load(nullptr, "default");
            (void)s_defaultProvider;
        }
#endif
 
        // Initialize OpenSSL's random seed.
        if (!q_RAND_status()) {
            qWarning("Random number generator not seeded, disabling SSL support");
            return false;
        }
 
        return true;
    }();
 
    return libraryLoaded;
}
 
QString QTlsBackendOpenSSL::backendName() const
{
    return builtinBackendNames[nameIndexOpenSSL];
}
 
bool QTlsBackendOpenSSL::isValid() const
{
    return ensureLibraryLoaded();
}
 
long QTlsBackendOpenSSL::tlsLibraryVersionNumber() const
{
    return q_OpenSSL_version_num();
}
 
QString QTlsBackendOpenSSL::tlsLibraryVersionString() const
{
    const char *versionString = q_OpenSSL_version(OPENSSL_VERSION);
    if (!versionString)
        return QString();
 
    return QString::fromLatin1(versionString);
}
 
long QTlsBackendOpenSSL::tlsLibraryBuildVersionNumber() const
{
    return OPENSSL_VERSION_NUMBER;
}
 
QString QTlsBackendOpenSSL::tlsLibraryBuildVersionString() const
{
    // Using QStringLiteral to store the version string as unicode and
    // avoid false positives from Google searching the playstore for old
    // SSL versions. See QTBUG-46265
    return QStringLiteral(OPENSSL_VERSION_TEXT);
}
 
void QTlsBackendOpenSSL::ensureInitialized() const
{
    // Old qsslsocket_openssl calls supportsSsl() (which means
    // library found and symbols resolved, this already assured
    // by the fact we end up in this function (isValid() returned
    // true for the backend, see its code). The qsslsocket_openssl
    // proceedes with loading certificate, ciphers and elliptic
    // curves.
    ensureCiphersAndCertsLoaded();
}
 
void QTlsBackendOpenSSL::ensureCiphersAndCertsLoaded() const
{
    Q_CONSTINIT static bool initializationStarted = false;
    Q_CONSTINIT static QAtomicInt initialized = Q_BASIC_ATOMIC_INITIALIZER(0);
    Q_CONSTINIT static QRecursiveMutex initMutex;
 
    if (initialized.loadAcquire())
        return;
 
    const QMutexLocker locker(&initMutex);
 
    if (initializationStarted || initialized.loadAcquire())
        return;
 
    // Indicate that the initialization has already started in the current
    // thread in case of recursive calls. The atomic variable cannot be used
    // for this because it is checked without holding the init mutex.
    initializationStarted = true;
 
    auto guard = qScopeGuard([] { initialized.storeRelease(1); });
 
    resetDefaultCiphers();
    resetDefaultEllipticCurves();
 
#if QT_CONFIG(library)
    //load symbols needed to receive certificates from system store
#if defined(Q_OS_QNX)
    QSslSocketPrivate::setRootCertOnDemandLoadingSupported(true);
#elif defined(Q_OS_UNIX) && !defined(Q_OS_DARWIN)
    // check whether we can enable on-demand root-cert loading (i.e. check whether the sym links are there)
    const QList<QByteArray> dirs = QSslSocketPrivate::unixRootCertDirectories();
    const QStringList symLinkFilter{
        u"[0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f].[0-9]"_s};
    for (const auto &dir : dirs) {
        QDirListing dirList(QString::fromLatin1(dir), symLinkFilter,
                            QDirListing::IteratorFlag::FilesOnly);
        if (dirList.cbegin() != dirList.cend()) { // Not empty
            QSslSocketPrivate::setRootCertOnDemandLoadingSupported(true);
            break;
        }
    }
#endif
#endif // QT_CONFIG(library)
    // if on-demand loading was not enabled, load the certs now
    if (!QSslSocketPrivate::rootCertOnDemandLoadingSupported())
        setDefaultCaCertificates(systemCaCertificates());
#ifdef Q_OS_WIN
    //Enabled for fetching additional root certs from windows update on windows.
    //This flag is set false by setDefaultCaCertificates() indicating the app uses
    //its own cert bundle rather than the system one.
    //Same logic that disables the unix on demand cert loading.
    //Unlike unix, we do preload the certificates from the cert store.
    QSslSocketPrivate::setRootCertOnDemandLoadingSupported(true);
#endif
}
 
void QTlsBackendOpenSSL::resetDefaultCiphers()
{
    SSL_CTX *myCtx = q_SSL_CTX_new(q_TLS_client_method());
    // Note, we assert, not just silently return/bail out early:
    // this should never happen and problems with OpenSSL's initialization
    // must be caught before this (see supportsSsl()).
    Q_ASSERT(myCtx);
    SSL *mySsl = q_SSL_new(myCtx);
    Q_ASSERT(mySsl);
 
    QList<QSslCipher> ciphers;
    QList<QSslCipher> defaultCiphers;
 
    q_loadCiphersForConnection(mySsl, ciphers, defaultCiphers);
 
    q_SSL_CTX_free(myCtx);
    q_SSL_free(mySsl);
 
    setDefaultSupportedCiphers(ciphers);
    setDefaultCiphers(defaultCiphers);
 
#if QT_CONFIG(dtls)
    ciphers.clear();
    defaultCiphers.clear();
    myCtx = q_SSL_CTX_new(q_DTLS_client_method());
    if (myCtx) {
        mySsl = q_SSL_new(myCtx);
        if (mySsl) {
            q_loadCiphersForConnection(mySsl, ciphers, defaultCiphers);
            setDefaultDtlsCiphers(defaultCiphers);
            q_SSL_free(mySsl);
        }
        q_SSL_CTX_free(myCtx);
    }
#endif // dtls
}
 
QList<QSsl::SslProtocol> QTlsBackendOpenSSL::supportedProtocols() const
{
    QList<QSsl::SslProtocol> protocols;
 
    protocols << QSsl::AnyProtocol;
    protocols << QSsl::SecureProtocols;
QT_WARNING_PUSH
QT_WARNING_DISABLE_DEPRECATED
    protocols << QSsl::TlsV1_0;
    protocols << QSsl::TlsV1_0OrLater;
    protocols << QSsl::TlsV1_1;
    protocols << QSsl::TlsV1_1OrLater;
QT_WARNING_POP
    protocols << QSsl::TlsV1_2;
    protocols << QSsl::TlsV1_2OrLater;
 
#ifdef TLS1_3_VERSION
    protocols << QSsl::TlsV1_3;
    protocols << QSsl::TlsV1_3OrLater;
#endif // TLS1_3_VERSION
 
#if QT_CONFIG(dtls)
QT_WARNING_PUSH
QT_WARNING_DISABLE_DEPRECATED
    protocols << QSsl::DtlsV1_0;
    protocols << QSsl::DtlsV1_0OrLater;
QT_WARNING_POP
    protocols << QSsl::DtlsV1_2;
    protocols << QSsl::DtlsV1_2OrLater;
#endif // dtls
 
    return protocols;
}
 
QList<QSsl::SupportedFeature> QTlsBackendOpenSSL::supportedFeatures() const
{
    QList<QSsl::SupportedFeature> features;
 
    features << QSsl::SupportedFeature::CertificateVerification;
 
#if !defined(OPENSSL_NO_TLSEXT)
    features << QSsl::SupportedFeature::ClientSideAlpn;
    features << QSsl::SupportedFeature::ServerSideAlpn;
#endif // !OPENSSL_NO_TLSEXT
 
    features << QSsl::SupportedFeature::Ocsp;
    features << QSsl::SupportedFeature::Psk;
    features << QSsl::SupportedFeature::SessionTicket;
    features << QSsl::SupportedFeature::Alerts;
 
    return features;
}
 
QList<QSsl::ImplementedClass> QTlsBackendOpenSSL::implementedClasses() const
{
    QList<QSsl::ImplementedClass> classes;
 
    classes << QSsl::ImplementedClass::Key;
    classes << QSsl::ImplementedClass::Certificate;
    classes << QSsl::ImplementedClass::Socket;
#if QT_CONFIG(dtls)
    classes << QSsl::ImplementedClass::Dtls;
    classes << QSsl::ImplementedClass::DtlsCookie;
#endif
    classes << QSsl::ImplementedClass::EllipticCurve;
    classes << QSsl::ImplementedClass::DiffieHellman;
 
    return classes;
}
 
QTlsPrivate::TlsKey *QTlsBackendOpenSSL::createKey() const
{
    return new QTlsPrivate::TlsKeyOpenSSL;
}
 
QTlsPrivate::X509Certificate *QTlsBackendOpenSSL::createCertificate() const
{
    return new QTlsPrivate::X509CertificateOpenSSL;
}
 
namespace QTlsPrivate {
 
#ifdef Q_OS_ANDROID
QList<QByteArray> fetchSslCertificateData();
#endif
 
QList<QSslCertificate> systemCaCertificates();
 
#ifndef Q_OS_DARWIN
QList<QSslCertificate> systemCaCertificates()
{
#ifdef QSSLSOCKET_DEBUG
    QElapsedTimer timer;
    timer.start();
#endif
    QList<QSslCertificate> systemCerts;
#if defined(Q_OS_WIN)
    HCERTSTORE hSystemStore;
    hSystemStore =
            CertOpenStore(CERT_STORE_PROV_SYSTEM, 0, 0,
                          CERT_STORE_READONLY_FLAG | CERT_SYSTEM_STORE_CURRENT_USER, L"ROOT");
    if (hSystemStore) {
        PCCERT_CONTEXT pc = nullptr;
        while (1) {
            pc = CertFindCertificateInStore(hSystemStore, X509_ASN_ENCODING, 0, CERT_FIND_ANY, nullptr, pc);
            if (!pc)
                break;
            QByteArray der(reinterpret_cast<const char *>(pc->pbCertEncoded),
                            static_cast<int>(pc->cbCertEncoded));
            QSslCertificate cert(der, QSsl::Der);
            systemCerts.append(cert);
        }
        CertCloseStore(hSystemStore, 0);
    }
#elif defined(Q_OS_ANDROID)
    const QList<QByteArray> certData = fetchSslCertificateData();
    for (auto certDatum : certData)
        systemCerts.append(QSslCertificate::fromData(certDatum, QSsl::Der));
#elif defined(Q_OS_UNIX)
    {
        const QList<QByteArray> directories = QSslSocketPrivate::unixRootCertDirectories();
        QSet<QString> certFiles = {
            QStringLiteral("/etc/pki/ca-trust/extracted/pem/tls-ca-bundle.pem"), // Red Hat 2013+
            QStringLiteral("/etc/pki/tls/certs/ca-bundle.crt"), // Red Hat older, Mandriva
            QStringLiteral("/usr/local/share/certs/ca-root-nss.crt") // FreeBSD's ca_root_nss
        };
 
        static const size_t extLen = strlen(".pem"); // or strlen(".crt")
        auto hasMatchingExtension = [](const QString &fileName) {
            if (size_t(fileName.size()) < extLen + 1)
                return false;
            auto ext = QStringView{fileName}.last(extLen);
            return ext == ".pem"_L1 || ext == ".crt"_L1;
        };
 
        using F = QDirListing::IteratorFlag;
        constexpr auto flags = F::FilesOnly | F::ResolveSymlinks; // Files and symlinks to files
        for (const QByteArray &directory : directories) {
            for (const auto &dirEntry : QDirListing(QFile::decodeName(directory), flags)) {
                // use canonical path here to not load the same certificate twice if symlinked
                if (hasMatchingExtension(dirEntry.fileName())) {
                    QString canonicalPath = dirEntry.canonicalFilePath();
                    // skip broken symlinks to not end up adding "" to the list which will then
                    // just be rejected by `QSslCertificate::fromFile`
                    if (!canonicalPath.isEmpty())
                        certFiles.insert(canonicalPath);
                }
            }
        }
        for (const QString& file : std::as_const(certFiles))
            systemCerts.append(QSslCertificate::fromFile(file, QSsl::Pem));
    }
#endif // platform
#ifdef QSSLSOCKET_DEBUG
    qCDebug(lcTlsBackend) << "systemCaCertificates retrieval time " << timer.elapsed() << "ms";
    qCDebug(lcTlsBackend) << "imported " << systemCerts.count() << " certificates";
#endif
 
    return systemCerts;
}
#endif // !Q_OS_DARWIN
} // namespace QTlsPrivate
 
QList<QSslCertificate> QTlsBackendOpenSSL::systemCaCertificates() const
{
    return QTlsPrivate::systemCaCertificates();
}
 
QTlsPrivate::DtlsCookieVerifier *QTlsBackendOpenSSL::createDtlsCookieVerifier() const
{
#if QT_CONFIG(dtls)
    return new QDtlsClientVerifierOpenSSL;
#else
    qCWarning(lcTlsBackend, "Feature 'dtls' is disabled, cannot verify DTLS cookies");
    return nullptr;
#endif // QT_CONFIG(dtls)
}
 
QTlsPrivate::TlsCryptograph *QTlsBackendOpenSSL::createTlsCryptograph() const
{
    return new QTlsPrivate::TlsCryptographOpenSSL;
}
 
QTlsPrivate::DtlsCryptograph *QTlsBackendOpenSSL::createDtlsCryptograph(QDtls *q, int mode) const
{
#if QT_CONFIG(dtls)
    return new QDtlsPrivateOpenSSL(q, QSslSocket::SslMode(mode));
#else
    Q_UNUSED(q);
    Q_UNUSED(mode);
    qCWarning(lcTlsBackend, "Feature 'dtls' is disabled, cannot encrypt UDP datagrams");
    return nullptr;
#endif // QT_CONFIG(dtls)
}
 
QTlsPrivate::X509ChainVerifyPtr QTlsBackendOpenSSL::X509Verifier() const
{
    return QTlsPrivate::X509CertificateOpenSSL::verify;
}
 
QTlsPrivate::X509PemReaderPtr QTlsBackendOpenSSL::X509PemReader() const
{
    return QTlsPrivate::X509CertificateOpenSSL::certificatesFromPem;
}
 
QTlsPrivate::X509DerReaderPtr QTlsBackendOpenSSL::X509DerReader() const
{
    return QTlsPrivate::X509CertificateOpenSSL::certificatesFromDer;
}
 
QTlsPrivate::X509Pkcs12ReaderPtr QTlsBackendOpenSSL::X509Pkcs12Reader() const
{
    return QTlsPrivate::X509CertificateOpenSSL::importPkcs12;
}
 
QList<int> QTlsBackendOpenSSL::ellipticCurvesIds() const
{
    QList<int> ids;
 
#ifndef OPENSSL_NO_EC
    const size_t curveCount = q_EC_get_builtin_curves(nullptr, 0);
    QVarLengthArray<EC_builtin_curve> builtinCurves(static_cast<int>(curveCount));
 
    if (q_EC_get_builtin_curves(builtinCurves.data(), curveCount) == curveCount) {
        ids.reserve(curveCount);
        for (const auto &ec : builtinCurves)
            ids.push_back(ec.nid);
    }
#endif // OPENSSL_NO_EC
 
    return ids;
}
 
 int QTlsBackendOpenSSL::curveIdFromShortName(const QString &name) const
 {
     int nid = 0;
     if (name.isEmpty())
         return nid;
 
     ensureInitialized(); // TLSTODO: check if it's needed!
#ifndef OPENSSL_NO_EC
     const QByteArray curveNameLatin1 = name.toLatin1();
     nid = q_OBJ_sn2nid(curveNameLatin1.data());
 
     if (nid == 0)
         nid = q_EC_curve_nist2nid(curveNameLatin1.data());
#endif // !OPENSSL_NO_EC
 
     return nid;
 }
 
 int QTlsBackendOpenSSL::curveIdFromLongName(const QString &name) const
 {
     int nid = 0;
     if (name.isEmpty())
         return nid;
 
     ensureInitialized();
 
#ifndef OPENSSL_NO_EC
     const QByteArray curveNameLatin1 = name.toLatin1();
     nid = q_OBJ_ln2nid(curveNameLatin1.data());
#endif
 
     return nid;
 }
 
 QString QTlsBackendOpenSSL::shortNameForId(int id) const
 {
     QString result;
 
#ifndef OPENSSL_NO_EC
     if (id != 0)
         result = QString::fromLatin1(q_OBJ_nid2sn(id));
#endif
 
     return result;
 }
 
QString QTlsBackendOpenSSL::longNameForId(int id) const
{
    QString result;
 
#ifndef OPENSSL_NO_EC
    if (id != 0)
        result = QString::fromLatin1(q_OBJ_nid2ln(id));
#endif
 
    return result;
}
 
// NIDs of named curves allowed in TLS as per RFCs 4492 and 7027,
// see also https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml#tls-parameters-8
static const int tlsNamedCurveNIDs[] = {
    // RFC 4492
    NID_sect163k1,
    NID_sect163r1,
    NID_sect163r2,
    NID_sect193r1,
    NID_sect193r2,
    NID_sect233k1,
    NID_sect233r1,
    NID_sect239k1,
    NID_sect283k1,
    NID_sect283r1,
    NID_sect409k1,
    NID_sect409r1,
    NID_sect571k1,
    NID_sect571r1,
 
    NID_secp160k1,
    NID_secp160r1,
    NID_secp160r2,
    NID_secp192k1,
    NID_X9_62_prime192v1, // secp192r1
    NID_secp224k1,
    NID_secp224r1,
    NID_secp256k1,
    NID_X9_62_prime256v1, // secp256r1
    NID_secp384r1,
    NID_secp521r1,
 
    // RFC 7027
    NID_brainpoolP256r1,
    NID_brainpoolP384r1,
    NID_brainpoolP512r1
};
 
const size_t tlsNamedCurveNIDCount = sizeof(tlsNamedCurveNIDs) / sizeof(tlsNamedCurveNIDs[0]);
 
bool QTlsBackendOpenSSL::isTlsNamedCurve(int id) const
{
    const int *const tlsNamedCurveNIDsEnd = tlsNamedCurveNIDs + tlsNamedCurveNIDCount;
    return std::find(tlsNamedCurveNIDs, tlsNamedCurveNIDsEnd, id) != tlsNamedCurveNIDsEnd;
}
 
QString QTlsBackendOpenSSL::msgErrorsDuringHandshake()
{
    return QSslSocket::tr("Error during SSL handshake: %1").arg(getErrorsFromOpenSsl());
}
 
QSslCipher QTlsBackendOpenSSL::qt_OpenSSL_cipher_to_QSslCipher(const SSL_CIPHER *cipher)
{
    Q_ASSERT(cipher);
    char buf [256] = {};
    const QString desc = QString::fromLatin1(q_SSL_CIPHER_description(cipher, buf, sizeof(buf)));
    int supportedBits = 0;
    const int bits = q_SSL_CIPHER_get_bits(cipher, &supportedBits);
    return createCiphersuite(desc, bits, supportedBits);
}
 
void QTlsBackendOpenSSL::forceAutotestSecurityLevel()
{
    QSslContext::forceAutoTestSecurityLevel();
}
 
QT_END_NAMESPACE
 
#include "moc_qtlsbackend_openssl_p.cpp"