1 /*
2 * Copyright 2015-2021 The OpenSSL Project Authors. All Rights Reserved.
3 *
4 * Licensed under the Apache License 2.0 (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
8 */
9
10 #include <stdio.h>
11 #include <string.h>
12 #include <openssl/conf.h>
13 #include <openssl/err.h>
14 #include "internal/sslconf.h"
15 #include "conf_local.h"
16
17 /*
18 * SSL library configuration module placeholder. We load it here but defer
19 * all decisions about its contents to libssl.
20 */
21
22 struct ssl_conf_name_st {
23 /* Name of this set of commands */
24 char *name;
25 /* List of commands */
26 SSL_CONF_CMD *cmds;
27 /* Number of commands */
28 size_t cmd_count;
29 };
30
31 struct ssl_conf_cmd_st {
32 /* Command */
33 char *cmd;
34 /* Argument */
35 char *arg;
36 };
37
38 static struct ssl_conf_name_st *ssl_names;
39 static size_t ssl_names_count;
40
ssl_module_free(CONF_IMODULE * md)41 static void ssl_module_free(CONF_IMODULE *md)
42 {
43 size_t i, j;
44 if (ssl_names == NULL)
45 return;
46 for (i = 0; i < ssl_names_count; i++) {
47 struct ssl_conf_name_st *tname = ssl_names + i;
48
49 OPENSSL_free(tname->name);
50 for (j = 0; j < tname->cmd_count; j++) {
51 OPENSSL_free(tname->cmds[j].cmd);
52 OPENSSL_free(tname->cmds[j].arg);
53 }
54 OPENSSL_free(tname->cmds);
55 }
56 OPENSSL_free(ssl_names);
57 ssl_names = NULL;
58 ssl_names_count = 0;
59 }
60
ssl_module_init(CONF_IMODULE * md,const CONF * cnf)61 static int ssl_module_init(CONF_IMODULE *md, const CONF *cnf)
62 {
63 size_t i, j, cnt;
64 int rv = 0;
65 const char *ssl_conf_section;
66 STACK_OF(CONF_VALUE) *cmd_lists;
67
68 ssl_conf_section = CONF_imodule_get_value(md);
69 cmd_lists = NCONF_get_section(cnf, ssl_conf_section);
70 if (sk_CONF_VALUE_num(cmd_lists) <= 0) {
71 int rcode = cmd_lists == NULL
72 ? CONF_R_SSL_SECTION_NOT_FOUND
73 : CONF_R_SSL_SECTION_EMPTY;
74
75 ERR_raise_data(ERR_LIB_CONF, rcode, "section=%s", ssl_conf_section);
76 goto err;
77 }
78 cnt = sk_CONF_VALUE_num(cmd_lists);
79 ssl_module_free(md);
80 ssl_names = OPENSSL_zalloc(sizeof(*ssl_names) * cnt);
81 if (ssl_names == NULL)
82 goto err;
83 ssl_names_count = cnt;
84 for (i = 0; i < ssl_names_count; i++) {
85 struct ssl_conf_name_st *ssl_name = ssl_names + i;
86 CONF_VALUE *sect = sk_CONF_VALUE_value(cmd_lists, (int)i);
87 STACK_OF(CONF_VALUE) *cmds = NCONF_get_section(cnf, sect->value);
88
89 if (sk_CONF_VALUE_num(cmds) <= 0) {
90 int rcode = cmds == NULL
91 ? CONF_R_SSL_COMMAND_SECTION_NOT_FOUND
92 : CONF_R_SSL_COMMAND_SECTION_EMPTY;
93
94 ERR_raise_data(ERR_LIB_CONF, rcode,
95 "name=%s, value=%s", sect->name, sect->value);
96 goto err;
97 }
98 ssl_name->name = OPENSSL_strdup(sect->name);
99 if (ssl_name->name == NULL)
100 goto err;
101 cnt = sk_CONF_VALUE_num(cmds);
102 ssl_name->cmds = OPENSSL_zalloc(cnt * sizeof(struct ssl_conf_cmd_st));
103 if (ssl_name->cmds == NULL)
104 goto err;
105 ssl_name->cmd_count = cnt;
106 for (j = 0; j < cnt; j++) {
107 const char *name;
108 CONF_VALUE *cmd_conf = sk_CONF_VALUE_value(cmds, (int)j);
109 struct ssl_conf_cmd_st *cmd = ssl_name->cmds + j;
110
111 /* Skip any initial dot in name */
112 name = strchr(cmd_conf->name, '.');
113 if (name != NULL)
114 name++;
115 else
116 name = cmd_conf->name;
117 cmd->cmd = OPENSSL_strdup(name);
118 cmd->arg = OPENSSL_strdup(cmd_conf->value);
119 if (cmd->cmd == NULL || cmd->arg == NULL)
120 goto err;
121 }
122 }
123 rv = 1;
124 err:
125 if (rv == 0)
126 ssl_module_free(md);
127 return rv;
128 }
129
130 /*
131 * Returns the set of commands with index |idx| previously searched for via
132 * conf_ssl_name_find. Also stores the name of the set of commands in |*name|
133 * and the number of commands in the set in |*cnt|.
134 */
conf_ssl_get(size_t idx,const char ** name,size_t * cnt)135 const SSL_CONF_CMD *conf_ssl_get(size_t idx, const char **name, size_t *cnt)
136 {
137 *name = ssl_names[idx].name;
138 *cnt = ssl_names[idx].cmd_count;
139 return ssl_names[idx].cmds;
140 }
141
142 /*
143 * Search for the named set of commands given in |name|. On success return the
144 * index for the command set in |*idx|.
145 * Returns 1 on success or 0 on failure.
146 */
conf_ssl_name_find(const char * name,size_t * idx)147 int conf_ssl_name_find(const char *name, size_t *idx)
148 {
149 size_t i;
150 const struct ssl_conf_name_st *nm;
151
152 if (name == NULL)
153 return 0;
154 for (i = 0, nm = ssl_names; i < ssl_names_count; i++, nm++) {
155 if (strcmp(nm->name, name) == 0) {
156 *idx = i;
157 return 1;
158 }
159 }
160 return 0;
161 }
162
163 /*
164 * Given a command set |cmd|, return details on the command at index |idx| which
165 * must be less than the number of commands in the set (as returned by
166 * conf_ssl_get). The name of the command will be returned in |*cmdstr| and the
167 * argument is returned in |*arg|.
168 */
conf_ssl_get_cmd(const SSL_CONF_CMD * cmd,size_t idx,char ** cmdstr,char ** arg)169 void conf_ssl_get_cmd(const SSL_CONF_CMD *cmd, size_t idx, char **cmdstr,
170 char **arg)
171 {
172 *cmdstr = cmd[idx].cmd;
173 *arg = cmd[idx].arg;
174 }
175
ossl_config_add_ssl_module(void)176 void ossl_config_add_ssl_module(void)
177 {
178 CONF_module_add("ssl_conf", ssl_module_init, ssl_module_free);
179 }
180