mirror of
https://github.com/openssl/openssl.git
synced 2024-12-13 03:53:44 +08:00
e65780782a
Reviewed-by: Tim Hudson <tjh@openssl.org>
249 lines
8.2 KiB
C
249 lines
8.2 KiB
C
/* ssl_mcnf.c */
|
|
/*
|
|
* Written by Stephen Henson (steve@openssl.org) for the OpenSSL project
|
|
* 2015.
|
|
*/
|
|
/* ====================================================================
|
|
* Copyright (c) 2015 The OpenSSL Project. All rights reserved.
|
|
*
|
|
* Redistribution and use in source and binary forms, with or without
|
|
* modification, are permitted provided that the following conditions
|
|
* are met:
|
|
*
|
|
* 1. Redistributions of source code must retain the above copyright
|
|
* notice, this list of conditions and the following disclaimer.
|
|
*
|
|
* 2. Redistributions in binary form must reproduce the above copyright
|
|
* notice, this list of conditions and the following disclaimer in
|
|
* the documentation and/or other materials provided with the
|
|
* distribution.
|
|
*
|
|
* 3. All advertising materials mentioning features or use of this
|
|
* software must display the following acknowledgment:
|
|
* "This product includes software developed by the OpenSSL Project
|
|
* for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"
|
|
*
|
|
* 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to
|
|
* endorse or promote products derived from this software without
|
|
* prior written permission. For written permission, please contact
|
|
* licensing@OpenSSL.org.
|
|
*
|
|
* 5. Products derived from this software may not be called "OpenSSL"
|
|
* nor may "OpenSSL" appear in their names without prior written
|
|
* permission of the OpenSSL Project.
|
|
*
|
|
* 6. Redistributions of any form whatsoever must retain the following
|
|
* acknowledgment:
|
|
* "This product includes software developed by the OpenSSL Project
|
|
* for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"
|
|
*
|
|
* THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY
|
|
* EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
|
|
* IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
|
|
* PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR
|
|
* ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
|
|
* SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
|
|
* NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
|
|
* LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
|
|
* HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
|
|
* STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
|
|
* ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
|
|
* OF THE POSSIBILITY OF SUCH DAMAGE.
|
|
* ====================================================================
|
|
*
|
|
* This product includes cryptographic software written by Eric Young
|
|
* (eay@cryptsoft.com). This product includes software written by Tim
|
|
* Hudson (tjh@cryptsoft.com).
|
|
*
|
|
*/
|
|
|
|
#include <stdio.h>
|
|
#include <openssl/conf.h>
|
|
#include <openssl/ssl.h>
|
|
#include "ssl_locl.h"
|
|
|
|
/* SSL library configuration module. */
|
|
|
|
struct ssl_conf_name {
|
|
/* Name of this set of commands */
|
|
char *name;
|
|
/* List of commands */
|
|
struct ssl_conf_cmd *cmds;
|
|
/* Number of commands */
|
|
size_t cmd_count;
|
|
};
|
|
|
|
struct ssl_conf_cmd {
|
|
/* Command */
|
|
char *cmd;
|
|
/* Argument */
|
|
char *arg;
|
|
};
|
|
|
|
static struct ssl_conf_name *ssl_names;
|
|
static size_t ssl_names_count;
|
|
|
|
static void ssl_module_free(CONF_IMODULE *md)
|
|
{
|
|
size_t i, j;
|
|
if (ssl_names == NULL)
|
|
return;
|
|
for (i = 0; i < ssl_names_count; i++) {
|
|
struct ssl_conf_name *tname = ssl_names + i;
|
|
OPENSSL_free(tname->name);
|
|
for (j = 0; j < tname->cmd_count; j++) {
|
|
OPENSSL_free(tname->cmds[j].cmd);
|
|
OPENSSL_free(tname->cmds[j].arg);
|
|
}
|
|
OPENSSL_free(tname->cmds);
|
|
}
|
|
OPENSSL_free(ssl_names);
|
|
ssl_names = NULL;
|
|
ssl_names_count = 0;
|
|
}
|
|
|
|
static int ssl_module_init(CONF_IMODULE *md, const CONF *cnf)
|
|
{
|
|
size_t i, j, cnt;
|
|
int rv = 0;
|
|
const char *ssl_conf_section;
|
|
STACK_OF(CONF_VALUE) *cmd_lists;
|
|
ssl_conf_section = CONF_imodule_get_value(md);
|
|
cmd_lists = NCONF_get_section(cnf, ssl_conf_section);
|
|
if (sk_CONF_VALUE_num(cmd_lists) <= 0){
|
|
if (cmd_lists == NULL)
|
|
SSLerr(SSL_F_SSL_MODULE_INIT, SSL_R_SSL_SECTION_NOT_FOUND);
|
|
else
|
|
SSLerr(SSL_F_SSL_MODULE_INIT, SSL_R_SSL_SECTION_EMPTY);
|
|
ERR_add_error_data(2, "section=", ssl_conf_section);
|
|
goto err;
|
|
}
|
|
cnt = sk_CONF_VALUE_num(cmd_lists);
|
|
ssl_names = OPENSSL_zalloc(sizeof(*ssl_names) * cnt);
|
|
ssl_names_count = cnt;
|
|
for (i = 0; i < ssl_names_count; i++) {
|
|
struct ssl_conf_name *ssl_name = ssl_names + i;
|
|
CONF_VALUE *sect = sk_CONF_VALUE_value(cmd_lists, i);
|
|
STACK_OF(CONF_VALUE) *cmds = NCONF_get_section(cnf, sect->value);
|
|
if (sk_CONF_VALUE_num(cmds) <= 0) {
|
|
if (cmds == NULL)
|
|
SSLerr(SSL_F_SSL_MODULE_INIT, SSL_R_SSL_COMMAND_SECTION_NOT_FOUND);
|
|
else
|
|
SSLerr(SSL_F_SSL_MODULE_INIT, SSL_R_SSL_COMMAND_SECTION_EMPTY);
|
|
ERR_add_error_data(4, "name=", sect->name, ", value=", sect->value);
|
|
goto err;
|
|
}
|
|
ssl_name->name = BUF_strdup(sect->name);
|
|
if (ssl_name->name == NULL)
|
|
goto err;
|
|
cnt = sk_CONF_VALUE_num(cmds);
|
|
ssl_name->cmds = OPENSSL_zalloc(cnt * sizeof(struct ssl_conf_cmd));
|
|
if (ssl_name->cmds == NULL)
|
|
goto err;
|
|
ssl_name->cmd_count = cnt;
|
|
for (j = 0; j < cnt; j++) {
|
|
const char *name;
|
|
CONF_VALUE *cmd_conf = sk_CONF_VALUE_value(cmds, j);
|
|
struct ssl_conf_cmd *cmd = ssl_name->cmds + j;
|
|
/* Skip any initial dot in name */
|
|
name = strchr(cmd_conf->name, '.');
|
|
if (name != NULL)
|
|
name++;
|
|
else
|
|
name = cmd_conf->name;
|
|
cmd->cmd = BUF_strdup(name);
|
|
cmd->arg = BUF_strdup(cmd_conf->value);
|
|
if (cmd->cmd == NULL || cmd->arg == NULL)
|
|
goto err;
|
|
}
|
|
|
|
}
|
|
rv = 1;
|
|
err:
|
|
if (rv == 0)
|
|
ssl_module_free(md);
|
|
return rv;
|
|
}
|
|
|
|
void SSL_add_ssl_module(void)
|
|
{
|
|
CONF_module_add("ssl_conf", ssl_module_init, ssl_module_free);
|
|
}
|
|
|
|
static const struct ssl_conf_name *ssl_name_find(const char *name)
|
|
{
|
|
size_t i;
|
|
const struct ssl_conf_name *nm;
|
|
if (name == NULL)
|
|
return NULL;
|
|
for (i = 0, nm = ssl_names; i < ssl_names_count; i++, nm++) {
|
|
if (strcmp(nm->name, name) == 0)
|
|
return nm;
|
|
}
|
|
return NULL;
|
|
}
|
|
|
|
static int ssl_do_config(SSL *s, SSL_CTX *ctx, const char *name)
|
|
{
|
|
SSL_CONF_CTX *cctx = NULL;
|
|
size_t i;
|
|
int rv = 0;
|
|
unsigned int flags;
|
|
const SSL_METHOD *meth;
|
|
const struct ssl_conf_name *nm;
|
|
struct ssl_conf_cmd *cmd;
|
|
if (s == NULL && ctx == NULL) {
|
|
SSLerr(SSL_F_SSL_DO_CONFIG, ERR_R_PASSED_NULL_PARAMETER);
|
|
goto err;
|
|
}
|
|
nm = ssl_name_find(name);
|
|
if (nm == NULL) {
|
|
SSLerr(SSL_F_SSL_DO_CONFIG, SSL_R_INVALID_CONFIGURATION_NAME);
|
|
ERR_add_error_data(2, "name=", name);
|
|
goto err;
|
|
}
|
|
cctx = SSL_CONF_CTX_new();
|
|
if (cctx == NULL)
|
|
goto err;
|
|
flags = SSL_CONF_FLAG_FILE;
|
|
flags |= SSL_CONF_FLAG_CERTIFICATE | SSL_CONF_FLAG_REQUIRE_PRIVATE;
|
|
if (s != NULL) {
|
|
meth = s->method;
|
|
SSL_CONF_CTX_set_ssl(cctx, s);
|
|
} else {
|
|
meth = ctx->method;
|
|
SSL_CONF_CTX_set_ssl_ctx(cctx, ctx);
|
|
}
|
|
if (meth->ssl_accept != ssl_undefined_function)
|
|
flags |= SSL_CONF_FLAG_SERVER;
|
|
if (meth->ssl_connect != ssl_undefined_function)
|
|
flags |= SSL_CONF_FLAG_CLIENT;
|
|
SSL_CONF_CTX_set_flags(cctx, flags);
|
|
for (i = 0, cmd = nm->cmds; i < nm->cmd_count; i++, cmd++) {
|
|
rv = SSL_CONF_cmd(cctx, cmd->cmd, cmd->arg);
|
|
if (rv <= 0) {
|
|
if (rv == -2)
|
|
SSLerr(SSL_F_SSL_DO_CONFIG, SSL_R_UNKNOWN_COMMAND);
|
|
else
|
|
SSLerr(SSL_F_SSL_DO_CONFIG, SSL_R_BAD_VALUE);
|
|
ERR_add_error_data(6, "section=", name, ", cmd=", cmd->cmd,
|
|
", arg=", cmd->arg);
|
|
goto err;
|
|
}
|
|
}
|
|
rv = SSL_CONF_CTX_finish(cctx);
|
|
err:
|
|
SSL_CONF_CTX_free(cctx);
|
|
return rv <= 0 ? 0 : 1;
|
|
}
|
|
|
|
int SSL_config(SSL *s, const char *name)
|
|
{
|
|
return ssl_do_config(s, NULL, name);
|
|
}
|
|
|
|
int SSL_CTX_config(SSL_CTX *ctx, const char *name)
|
|
{
|
|
return ssl_do_config(NULL, ctx, name);
|
|
}
|