1 /* 2 * Copyright 2015-2024 The OpenSSL Project Authors. All Rights Reserved. 3 * 4 * Licensed under the Apache License 2.0 (the "License"). You may not use 5 * this file except in compliance with the License. You can obtain a copy 6 * in the file LICENSE in the source distribution or at 7 * https://www.openssl.org/source/license.html 8 */ 9 10 #include <stdio.h> 11 #include <openssl/conf.h> 12 #include <openssl/ssl.h> 13 #include "ssl_local.h" 14 #include "internal/sslconf.h" 15 16 /* SSL library configuration module. */ 17 18 void SSL_add_ssl_module(void) 19 { 20 /* Do nothing. This will be added automatically by libcrypto */ 21 } 22 23 static int ssl_do_config(SSL *s, SSL_CTX *ctx, const char *name, int system) 24 { 25 SSL_CONF_CTX *cctx = NULL; 26 size_t i, idx, cmd_count; 27 int err = 1; 28 unsigned int flags; 29 unsigned int conf_diagnostics = 0; 30 const SSL_METHOD *meth; 31 const SSL_CONF_CMD *cmds; 32 OSSL_LIB_CTX *prev_libctx = NULL; 33 OSSL_LIB_CTX *libctx = NULL; 34 35 if (s == NULL && ctx == NULL) { 36 ERR_raise(ERR_LIB_SSL, ERR_R_PASSED_NULL_PARAMETER); 37 goto err; 38 } 39 40 if (name == NULL && system) 41 name = "system_default"; 42 if (!conf_ssl_name_find(name, &idx)) { 43 if (!system) 44 ERR_raise_data(ERR_LIB_SSL, SSL_R_INVALID_CONFIGURATION_NAME, 45 "name=%s", name); 46 goto err; 47 } 48 cmds = conf_ssl_get(idx, &name, &cmd_count); 49 cctx = SSL_CONF_CTX_new(); 50 if (cctx == NULL) { 51 /* this is a fatal error, always report */ 52 system = 0; 53 goto err; 54 } 55 flags = SSL_CONF_FLAG_FILE; 56 if (!system) 57 flags |= SSL_CONF_FLAG_CERTIFICATE | SSL_CONF_FLAG_REQUIRE_PRIVATE; 58 if (s != NULL) { 59 meth = s->method; 60 SSL_CONF_CTX_set_ssl(cctx, s); 61 libctx = s->ctx->libctx; 62 } else { 63 meth = ctx->method; 64 SSL_CONF_CTX_set_ssl_ctx(cctx, ctx); 65 libctx = ctx->libctx; 66 } 67 conf_diagnostics = OSSL_LIB_CTX_get_conf_diagnostics(libctx); 68 if (conf_diagnostics) 69 flags |= SSL_CONF_FLAG_SHOW_ERRORS; 70 if (meth->ssl_accept != ssl_undefined_function) 71 flags |= SSL_CONF_FLAG_SERVER; 72 if (meth->ssl_connect != ssl_undefined_function) 73 flags |= SSL_CONF_FLAG_CLIENT; 74 SSL_CONF_CTX_set_flags(cctx, flags); 75 prev_libctx = OSSL_LIB_CTX_set0_default(libctx); 76 err = 0; 77 for (i = 0; i < cmd_count; i++) { 78 char *cmdstr, *arg; 79 int rv; 80 81 conf_ssl_get_cmd(cmds, i, &cmdstr, &arg); 82 rv = SSL_CONF_cmd(cctx, cmdstr, arg); 83 if (rv <= 0) 84 ++err; 85 } 86 if (!SSL_CONF_CTX_finish(cctx)) 87 ++err; 88 err: 89 OSSL_LIB_CTX_set0_default(prev_libctx); 90 SSL_CONF_CTX_free(cctx); 91 return err == 0 || (system && !conf_diagnostics); 92 } 93 94 int SSL_config(SSL *s, const char *name) 95 { 96 return ssl_do_config(s, NULL, name, 0); 97 } 98 99 int SSL_CTX_config(SSL_CTX *ctx, const char *name) 100 { 101 return ssl_do_config(NULL, ctx, name, 0); 102 } 103 104 int ssl_ctx_system_config(SSL_CTX *ctx) 105 { 106 return ssl_do_config(NULL, ctx, NULL, 1); 107 } 108