]>
Commit | Line | Data |
---|---|---|
59b1696c | 1 | /* |
846e33c7 | 2 | * Copyright 2015-2016 The OpenSSL Project Authors. All Rights Reserved. |
59b1696c | 3 | * |
846e33c7 RS |
4 | * Licensed under the OpenSSL license (the "License"). You may not use |
5 | * this file except in compliance with the License. You can obtain a copy | |
6 | * in the file LICENSE in the source distribution or at | |
7 | * https://www.openssl.org/source/license.html | |
59b1696c DSH |
8 | */ |
9 | ||
10 | #include <stdio.h> | |
11 | #include <openssl/conf.h> | |
12 | #include <openssl/ssl.h> | |
13 | #include "ssl_locl.h" | |
14 | ||
15 | /* SSL library configuration module. */ | |
16 | ||
17 | struct ssl_conf_name { | |
18 | /* Name of this set of commands */ | |
19 | char *name; | |
20 | /* List of commands */ | |
21 | struct ssl_conf_cmd *cmds; | |
22 | /* Number of commands */ | |
23 | size_t cmd_count; | |
24 | }; | |
25 | ||
26 | struct ssl_conf_cmd { | |
27 | /* Command */ | |
28 | char *cmd; | |
29 | /* Argument */ | |
30 | char *arg; | |
31 | }; | |
32 | ||
33 | static struct ssl_conf_name *ssl_names; | |
34 | static size_t ssl_names_count; | |
35 | ||
e6578078 | 36 | static void ssl_module_free(CONF_IMODULE *md) |
59b1696c DSH |
37 | { |
38 | size_t i, j; | |
39 | if (ssl_names == NULL) | |
40 | return; | |
41 | for (i = 0; i < ssl_names_count; i++) { | |
42 | struct ssl_conf_name *tname = ssl_names + i; | |
43 | OPENSSL_free(tname->name); | |
44 | for (j = 0; j < tname->cmd_count; j++) { | |
45 | OPENSSL_free(tname->cmds[j].cmd); | |
46 | OPENSSL_free(tname->cmds[j].arg); | |
47 | } | |
48 | OPENSSL_free(tname->cmds); | |
49 | } | |
50 | OPENSSL_free(ssl_names); | |
51 | ssl_names = NULL; | |
52 | ssl_names_count = 0; | |
53 | } | |
54 | ||
55 | static int ssl_module_init(CONF_IMODULE *md, const CONF *cnf) | |
56 | { | |
57 | size_t i, j, cnt; | |
58 | int rv = 0; | |
59 | const char *ssl_conf_section; | |
60 | STACK_OF(CONF_VALUE) *cmd_lists; | |
61 | ssl_conf_section = CONF_imodule_get_value(md); | |
62 | cmd_lists = NCONF_get_section(cnf, ssl_conf_section); | |
0485d540 | 63 | if (sk_CONF_VALUE_num(cmd_lists) <= 0) { |
59b1696c DSH |
64 | if (cmd_lists == NULL) |
65 | SSLerr(SSL_F_SSL_MODULE_INIT, SSL_R_SSL_SECTION_NOT_FOUND); | |
66 | else | |
67 | SSLerr(SSL_F_SSL_MODULE_INIT, SSL_R_SSL_SECTION_EMPTY); | |
68 | ERR_add_error_data(2, "section=", ssl_conf_section); | |
69 | goto err; | |
70 | } | |
71 | cnt = sk_CONF_VALUE_num(cmd_lists); | |
72 | ssl_names = OPENSSL_zalloc(sizeof(*ssl_names) * cnt); | |
73 | ssl_names_count = cnt; | |
74 | for (i = 0; i < ssl_names_count; i++) { | |
75 | struct ssl_conf_name *ssl_name = ssl_names + i; | |
76 | CONF_VALUE *sect = sk_CONF_VALUE_value(cmd_lists, i); | |
77 | STACK_OF(CONF_VALUE) *cmds = NCONF_get_section(cnf, sect->value); | |
78 | if (sk_CONF_VALUE_num(cmds) <= 0) { | |
79 | if (cmds == NULL) | |
80 | SSLerr(SSL_F_SSL_MODULE_INIT, SSL_R_SSL_COMMAND_SECTION_NOT_FOUND); | |
81 | else | |
82 | SSLerr(SSL_F_SSL_MODULE_INIT, SSL_R_SSL_COMMAND_SECTION_EMPTY); | |
83 | ERR_add_error_data(4, "name=", sect->name, ", value=", sect->value); | |
84 | goto err; | |
85 | } | |
86 | ssl_name->name = BUF_strdup(sect->name); | |
87 | if (ssl_name->name == NULL) | |
88 | goto err; | |
89 | cnt = sk_CONF_VALUE_num(cmds); | |
90 | ssl_name->cmds = OPENSSL_zalloc(cnt * sizeof(struct ssl_conf_cmd)); | |
91 | if (ssl_name->cmds == NULL) | |
92 | goto err; | |
93 | ssl_name->cmd_count = cnt; | |
94 | for (j = 0; j < cnt; j++) { | |
95 | const char *name; | |
96 | CONF_VALUE *cmd_conf = sk_CONF_VALUE_value(cmds, j); | |
97 | struct ssl_conf_cmd *cmd = ssl_name->cmds + j; | |
98 | /* Skip any initial dot in name */ | |
99 | name = strchr(cmd_conf->name, '.'); | |
100 | if (name != NULL) | |
101 | name++; | |
102 | else | |
103 | name = cmd_conf->name; | |
104 | cmd->cmd = BUF_strdup(name); | |
105 | cmd->arg = BUF_strdup(cmd_conf->value); | |
106 | if (cmd->cmd == NULL || cmd->arg == NULL) | |
107 | goto err; | |
108 | } | |
109 | ||
110 | } | |
111 | rv = 1; | |
112 | err: | |
113 | if (rv == 0) | |
e6578078 | 114 | ssl_module_free(md); |
59b1696c DSH |
115 | return rv; |
116 | } | |
117 | ||
118 | void SSL_add_ssl_module(void) | |
119 | { | |
120 | CONF_module_add("ssl_conf", ssl_module_init, ssl_module_free); | |
121 | } | |
122 | ||
123 | static const struct ssl_conf_name *ssl_name_find(const char *name) | |
124 | { | |
125 | size_t i; | |
126 | const struct ssl_conf_name *nm; | |
127 | if (name == NULL) | |
128 | return NULL; | |
129 | for (i = 0, nm = ssl_names; i < ssl_names_count; i++, nm++) { | |
130 | if (strcmp(nm->name, name) == 0) | |
131 | return nm; | |
132 | } | |
133 | return NULL; | |
134 | } | |
135 | ||
136 | static int ssl_do_config(SSL *s, SSL_CTX *ctx, const char *name) | |
137 | { | |
138 | SSL_CONF_CTX *cctx = NULL; | |
139 | size_t i; | |
140 | int rv = 0; | |
141 | unsigned int flags; | |
142 | const SSL_METHOD *meth; | |
143 | const struct ssl_conf_name *nm; | |
144 | struct ssl_conf_cmd *cmd; | |
145 | if (s == NULL && ctx == NULL) { | |
146 | SSLerr(SSL_F_SSL_DO_CONFIG, ERR_R_PASSED_NULL_PARAMETER); | |
147 | goto err; | |
148 | } | |
149 | nm = ssl_name_find(name); | |
150 | if (nm == NULL) { | |
151 | SSLerr(SSL_F_SSL_DO_CONFIG, SSL_R_INVALID_CONFIGURATION_NAME); | |
152 | ERR_add_error_data(2, "name=", name); | |
153 | goto err; | |
154 | } | |
155 | cctx = SSL_CONF_CTX_new(); | |
156 | if (cctx == NULL) | |
157 | goto err; | |
158 | flags = SSL_CONF_FLAG_FILE; | |
159 | flags |= SSL_CONF_FLAG_CERTIFICATE | SSL_CONF_FLAG_REQUIRE_PRIVATE; | |
160 | if (s != NULL) { | |
161 | meth = s->method; | |
162 | SSL_CONF_CTX_set_ssl(cctx, s); | |
163 | } else { | |
164 | meth = ctx->method; | |
165 | SSL_CONF_CTX_set_ssl_ctx(cctx, ctx); | |
166 | } | |
167 | if (meth->ssl_accept != ssl_undefined_function) | |
168 | flags |= SSL_CONF_FLAG_SERVER; | |
169 | if (meth->ssl_connect != ssl_undefined_function) | |
170 | flags |= SSL_CONF_FLAG_CLIENT; | |
171 | SSL_CONF_CTX_set_flags(cctx, flags); | |
172 | for (i = 0, cmd = nm->cmds; i < nm->cmd_count; i++, cmd++) { | |
173 | rv = SSL_CONF_cmd(cctx, cmd->cmd, cmd->arg); | |
174 | if (rv <= 0) { | |
175 | if (rv == -2) | |
176 | SSLerr(SSL_F_SSL_DO_CONFIG, SSL_R_UNKNOWN_COMMAND); | |
0485d540 | 177 | else |
59b1696c DSH |
178 | SSLerr(SSL_F_SSL_DO_CONFIG, SSL_R_BAD_VALUE); |
179 | ERR_add_error_data(6, "section=", name, ", cmd=", cmd->cmd, | |
180 | ", arg=", cmd->arg); | |
181 | goto err; | |
182 | } | |
183 | } | |
184 | rv = SSL_CONF_CTX_finish(cctx); | |
185 | err: | |
186 | SSL_CONF_CTX_free(cctx); | |
187 | return rv <= 0 ? 0 : 1; | |
188 | } | |
189 | ||
190 | int SSL_config(SSL *s, const char *name) | |
191 | { | |
192 | return ssl_do_config(s, NULL, name); | |
193 | } | |
194 | ||
195 | int SSL_CTX_config(SSL_CTX *ctx, const char *name) | |
196 | { | |
197 | return ssl_do_config(NULL, ctx, name); | |
198 | } |