]>
Commit | Line | Data |
---|---|---|
59b1696c | 1 | /* |
b0edda11 | 2 | * Copyright 2015-2018 The OpenSSL Project Authors. All Rights Reserved. |
59b1696c | 3 | * |
846e33c7 RS |
4 | * Licensed under the OpenSSL license (the "License"). You may not use |
5 | * this file except in compliance with the License. You can obtain a copy | |
6 | * in the file LICENSE in the source distribution or at | |
7 | * https://www.openssl.org/source/license.html | |
59b1696c DSH |
8 | */ |
9 | ||
10 | #include <stdio.h> | |
11 | #include <openssl/conf.h> | |
12 | #include <openssl/ssl.h> | |
13 | #include "ssl_locl.h" | |
14 | ||
15 | /* SSL library configuration module. */ | |
16 | ||
17 | struct ssl_conf_name { | |
18 | /* Name of this set of commands */ | |
19 | char *name; | |
20 | /* List of commands */ | |
21 | struct ssl_conf_cmd *cmds; | |
22 | /* Number of commands */ | |
23 | size_t cmd_count; | |
24 | }; | |
25 | ||
26 | struct ssl_conf_cmd { | |
27 | /* Command */ | |
28 | char *cmd; | |
29 | /* Argument */ | |
30 | char *arg; | |
31 | }; | |
32 | ||
33 | static struct ssl_conf_name *ssl_names; | |
34 | static size_t ssl_names_count; | |
35 | ||
e6578078 | 36 | static void ssl_module_free(CONF_IMODULE *md) |
59b1696c DSH |
37 | { |
38 | size_t i, j; | |
39 | if (ssl_names == NULL) | |
40 | return; | |
41 | for (i = 0; i < ssl_names_count; i++) { | |
42 | struct ssl_conf_name *tname = ssl_names + i; | |
43 | OPENSSL_free(tname->name); | |
44 | for (j = 0; j < tname->cmd_count; j++) { | |
45 | OPENSSL_free(tname->cmds[j].cmd); | |
46 | OPENSSL_free(tname->cmds[j].arg); | |
47 | } | |
48 | OPENSSL_free(tname->cmds); | |
49 | } | |
50 | OPENSSL_free(ssl_names); | |
51 | ssl_names = NULL; | |
52 | ssl_names_count = 0; | |
53 | } | |
54 | ||
55 | static int ssl_module_init(CONF_IMODULE *md, const CONF *cnf) | |
56 | { | |
57 | size_t i, j, cnt; | |
58 | int rv = 0; | |
59 | const char *ssl_conf_section; | |
60 | STACK_OF(CONF_VALUE) *cmd_lists; | |
61 | ssl_conf_section = CONF_imodule_get_value(md); | |
62 | cmd_lists = NCONF_get_section(cnf, ssl_conf_section); | |
0485d540 | 63 | if (sk_CONF_VALUE_num(cmd_lists) <= 0) { |
59b1696c DSH |
64 | if (cmd_lists == NULL) |
65 | SSLerr(SSL_F_SSL_MODULE_INIT, SSL_R_SSL_SECTION_NOT_FOUND); | |
66 | else | |
67 | SSLerr(SSL_F_SSL_MODULE_INIT, SSL_R_SSL_SECTION_EMPTY); | |
68 | ERR_add_error_data(2, "section=", ssl_conf_section); | |
69 | goto err; | |
70 | } | |
71 | cnt = sk_CONF_VALUE_num(cmd_lists); | |
72 | ssl_names = OPENSSL_zalloc(sizeof(*ssl_names) * cnt); | |
73 | ssl_names_count = cnt; | |
74 | for (i = 0; i < ssl_names_count; i++) { | |
75 | struct ssl_conf_name *ssl_name = ssl_names + i; | |
348240c6 | 76 | CONF_VALUE *sect = sk_CONF_VALUE_value(cmd_lists, (int)i); |
59b1696c DSH |
77 | STACK_OF(CONF_VALUE) *cmds = NCONF_get_section(cnf, sect->value); |
78 | if (sk_CONF_VALUE_num(cmds) <= 0) { | |
79 | if (cmds == NULL) | |
a230b26e EK |
80 | SSLerr(SSL_F_SSL_MODULE_INIT, |
81 | SSL_R_SSL_COMMAND_SECTION_NOT_FOUND); | |
59b1696c DSH |
82 | else |
83 | SSLerr(SSL_F_SSL_MODULE_INIT, SSL_R_SSL_COMMAND_SECTION_EMPTY); | |
84 | ERR_add_error_data(4, "name=", sect->name, ", value=", sect->value); | |
85 | goto err; | |
86 | } | |
87 | ssl_name->name = BUF_strdup(sect->name); | |
88 | if (ssl_name->name == NULL) | |
89 | goto err; | |
90 | cnt = sk_CONF_VALUE_num(cmds); | |
91 | ssl_name->cmds = OPENSSL_zalloc(cnt * sizeof(struct ssl_conf_cmd)); | |
92 | if (ssl_name->cmds == NULL) | |
93 | goto err; | |
94 | ssl_name->cmd_count = cnt; | |
95 | for (j = 0; j < cnt; j++) { | |
96 | const char *name; | |
348240c6 | 97 | CONF_VALUE *cmd_conf = sk_CONF_VALUE_value(cmds, (int)j); |
59b1696c DSH |
98 | struct ssl_conf_cmd *cmd = ssl_name->cmds + j; |
99 | /* Skip any initial dot in name */ | |
100 | name = strchr(cmd_conf->name, '.'); | |
101 | if (name != NULL) | |
102 | name++; | |
103 | else | |
104 | name = cmd_conf->name; | |
105 | cmd->cmd = BUF_strdup(name); | |
106 | cmd->arg = BUF_strdup(cmd_conf->value); | |
107 | if (cmd->cmd == NULL || cmd->arg == NULL) | |
108 | goto err; | |
109 | } | |
110 | ||
111 | } | |
112 | rv = 1; | |
a230b26e | 113 | err: |
59b1696c | 114 | if (rv == 0) |
e6578078 | 115 | ssl_module_free(md); |
59b1696c DSH |
116 | return rv; |
117 | } | |
118 | ||
119 | void SSL_add_ssl_module(void) | |
120 | { | |
121 | CONF_module_add("ssl_conf", ssl_module_init, ssl_module_free); | |
122 | } | |
123 | ||
124 | static const struct ssl_conf_name *ssl_name_find(const char *name) | |
125 | { | |
126 | size_t i; | |
127 | const struct ssl_conf_name *nm; | |
8a5ed9dc | 128 | |
59b1696c DSH |
129 | if (name == NULL) |
130 | return NULL; | |
131 | for (i = 0, nm = ssl_names; i < ssl_names_count; i++, nm++) { | |
132 | if (strcmp(nm->name, name) == 0) | |
133 | return nm; | |
134 | } | |
135 | return NULL; | |
136 | } | |
137 | ||
8a5ed9dc | 138 | static int ssl_do_config(SSL *s, SSL_CTX *ctx, const char *name, int system) |
59b1696c DSH |
139 | { |
140 | SSL_CONF_CTX *cctx = NULL; | |
141 | size_t i; | |
142 | int rv = 0; | |
143 | unsigned int flags; | |
144 | const SSL_METHOD *meth; | |
145 | const struct ssl_conf_name *nm; | |
146 | struct ssl_conf_cmd *cmd; | |
8a5ed9dc | 147 | |
59b1696c DSH |
148 | if (s == NULL && ctx == NULL) { |
149 | SSLerr(SSL_F_SSL_DO_CONFIG, ERR_R_PASSED_NULL_PARAMETER); | |
150 | goto err; | |
151 | } | |
8a5ed9dc TM |
152 | |
153 | if (name == NULL && system) | |
154 | name = "system_default"; | |
59b1696c DSH |
155 | nm = ssl_name_find(name); |
156 | if (nm == NULL) { | |
8a5ed9dc TM |
157 | if (!system) { |
158 | SSLerr(SSL_F_SSL_DO_CONFIG, SSL_R_INVALID_CONFIGURATION_NAME); | |
159 | ERR_add_error_data(2, "name=", name); | |
160 | } | |
59b1696c DSH |
161 | goto err; |
162 | } | |
163 | cctx = SSL_CONF_CTX_new(); | |
164 | if (cctx == NULL) | |
165 | goto err; | |
166 | flags = SSL_CONF_FLAG_FILE; | |
8a5ed9dc TM |
167 | if (!system) |
168 | flags |= SSL_CONF_FLAG_CERTIFICATE | SSL_CONF_FLAG_REQUIRE_PRIVATE; | |
59b1696c DSH |
169 | if (s != NULL) { |
170 | meth = s->method; | |
171 | SSL_CONF_CTX_set_ssl(cctx, s); | |
172 | } else { | |
173 | meth = ctx->method; | |
174 | SSL_CONF_CTX_set_ssl_ctx(cctx, ctx); | |
175 | } | |
176 | if (meth->ssl_accept != ssl_undefined_function) | |
a230b26e | 177 | flags |= SSL_CONF_FLAG_SERVER; |
59b1696c | 178 | if (meth->ssl_connect != ssl_undefined_function) |
a230b26e | 179 | flags |= SSL_CONF_FLAG_CLIENT; |
59b1696c DSH |
180 | SSL_CONF_CTX_set_flags(cctx, flags); |
181 | for (i = 0, cmd = nm->cmds; i < nm->cmd_count; i++, cmd++) { | |
182 | rv = SSL_CONF_cmd(cctx, cmd->cmd, cmd->arg); | |
183 | if (rv <= 0) { | |
184 | if (rv == -2) | |
185 | SSLerr(SSL_F_SSL_DO_CONFIG, SSL_R_UNKNOWN_COMMAND); | |
0485d540 | 186 | else |
59b1696c DSH |
187 | SSLerr(SSL_F_SSL_DO_CONFIG, SSL_R_BAD_VALUE); |
188 | ERR_add_error_data(6, "section=", name, ", cmd=", cmd->cmd, | |
a230b26e | 189 | ", arg=", cmd->arg); |
59b1696c DSH |
190 | goto err; |
191 | } | |
192 | } | |
193 | rv = SSL_CONF_CTX_finish(cctx); | |
a230b26e | 194 | err: |
59b1696c DSH |
195 | SSL_CONF_CTX_free(cctx); |
196 | return rv <= 0 ? 0 : 1; | |
197 | } | |
198 | ||
199 | int SSL_config(SSL *s, const char *name) | |
200 | { | |
8a5ed9dc | 201 | return ssl_do_config(s, NULL, name, 0); |
59b1696c DSH |
202 | } |
203 | ||
204 | int SSL_CTX_config(SSL_CTX *ctx, const char *name) | |
205 | { | |
8a5ed9dc TM |
206 | return ssl_do_config(NULL, ctx, name, 0); |
207 | } | |
208 | ||
209 | void ssl_ctx_system_config(SSL_CTX *ctx) | |
210 | { | |
211 | ssl_do_config(NULL, ctx, NULL, 1); | |
59b1696c | 212 | } |