1 /*
2 * Copyright 2002-2022 The OpenSSL Project Authors. All Rights Reserved.
3 *
4 * Licensed under the Apache License 2.0 (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
8 */
9
10 /* We need to use some engine deprecated APIs */
11 #define OPENSSL_SUPPRESS_DEPRECATED
12
13 #include "internal/cryptlib.h"
14 #include <stdio.h>
15 #include <ctype.h>
16 #include <openssl/crypto.h>
17 #include "internal/conf.h"
18 #include <openssl/conf_api.h>
19 #include "internal/dso.h"
20 #include "internal/thread_once.h"
21 #include <openssl/x509.h>
22 #include <openssl/trace.h>
23 #include <openssl/engine.h>
24 #include "conf_local.h"
25
26 DEFINE_STACK_OF(CONF_MODULE)
27 DEFINE_STACK_OF(CONF_IMODULE)
28
29 #define DSO_mod_init_name "OPENSSL_init"
30 #define DSO_mod_finish_name "OPENSSL_finish"
31
32 /*
33 * This structure contains a data about supported modules. entries in this
34 * table correspond to either dynamic or static modules.
35 */
36
37 struct conf_module_st {
38 /* DSO of this module or NULL if static */
39 DSO *dso;
40 /* Name of the module */
41 char *name;
42 /* Init function */
43 conf_init_func *init;
44 /* Finish function */
45 conf_finish_func *finish;
46 /* Number of successfully initialized modules */
47 int links;
48 void *usr_data;
49 };
50
51 /*
52 * This structure contains information about modules that have been
53 * successfully initialized. There may be more than one entry for a given
54 * module.
55 */
56
57 struct conf_imodule_st {
58 CONF_MODULE *pmod;
59 char *name;
60 char *value;
61 unsigned long flags;
62 void *usr_data;
63 };
64
65 static CRYPTO_ONCE init_module_list_lock = CRYPTO_ONCE_STATIC_INIT;
66 static CRYPTO_RWLOCK *module_list_lock = NULL;
67 static STACK_OF(CONF_MODULE) *supported_modules = NULL; /* protected by lock */
68 static STACK_OF(CONF_IMODULE) *initialized_modules = NULL; /* protected by lock */
69
70 static CRYPTO_ONCE load_builtin_modules = CRYPTO_ONCE_STATIC_INIT;
71
72 static void module_free(CONF_MODULE *md);
73 static void module_finish(CONF_IMODULE *imod);
74 static int module_run(const CONF *cnf, const char *name, const char *value,
75 unsigned long flags);
76 static CONF_MODULE *module_add(DSO *dso, const char *name,
77 conf_init_func *ifunc,
78 conf_finish_func *ffunc);
79 static CONF_MODULE *module_find(const char *name);
80 static int module_init(CONF_MODULE *pmod, const char *name, const char *value,
81 const CONF *cnf);
82 static CONF_MODULE *module_load_dso(const CONF *cnf, const char *name,
83 const char *value);
84
85 static int conf_modules_finish_int(void);
86
module_lists_free(void)87 static void module_lists_free(void)
88 {
89 CRYPTO_THREAD_lock_free(module_list_lock);
90 module_list_lock = NULL;
91
92 sk_CONF_MODULE_free(supported_modules);
93 supported_modules = NULL;
94
95 sk_CONF_IMODULE_free(initialized_modules);
96 initialized_modules = NULL;
97 }
98
DEFINE_RUN_ONCE_STATIC(do_init_module_list_lock)99 DEFINE_RUN_ONCE_STATIC(do_init_module_list_lock)
100 {
101 module_list_lock = CRYPTO_THREAD_lock_new();
102 if (module_list_lock == NULL) {
103 ERR_raise(ERR_LIB_CONF, ERR_R_MALLOC_FAILURE);
104 return 0;
105 }
106
107 return 1;
108 }
109
conf_diagnostics(const CONF * cnf)110 static int conf_diagnostics(const CONF *cnf)
111 {
112 return _CONF_get_number(cnf, NULL, "config_diagnostics") != 0;
113 }
114
115 /* Main function: load modules from a CONF structure */
116
CONF_modules_load(const CONF * cnf,const char * appname,unsigned long flags)117 int CONF_modules_load(const CONF *cnf, const char *appname,
118 unsigned long flags)
119 {
120 STACK_OF(CONF_VALUE) *values;
121 CONF_VALUE *vl;
122 char *vsection = NULL;
123 int ret, i;
124
125 if (!cnf)
126 return 1;
127
128 if (conf_diagnostics(cnf))
129 flags &= ~(CONF_MFLAGS_IGNORE_ERRORS
130 | CONF_MFLAGS_IGNORE_RETURN_CODES
131 | CONF_MFLAGS_SILENT
132 | CONF_MFLAGS_IGNORE_MISSING_FILE);
133
134 ERR_set_mark();
135 if (appname)
136 vsection = NCONF_get_string(cnf, NULL, appname);
137
138 if (!appname || (!vsection && (flags & CONF_MFLAGS_DEFAULT_SECTION)))
139 vsection = NCONF_get_string(cnf, NULL, "openssl_conf");
140
141 if (!vsection) {
142 ERR_pop_to_mark();
143 return 1;
144 }
145
146 OSSL_TRACE1(CONF, "Configuration in section %s\n", vsection);
147 values = NCONF_get_section(cnf, vsection);
148
149 if (values == NULL) {
150 if (!(flags & CONF_MFLAGS_SILENT)) {
151 ERR_clear_last_mark();
152 ERR_raise_data(ERR_LIB_CONF,
153 CONF_R_OPENSSL_CONF_REFERENCES_MISSING_SECTION,
154 "openssl_conf=%s", vsection);
155 } else {
156 ERR_pop_to_mark();
157 }
158 return 0;
159 }
160 ERR_pop_to_mark();
161
162 for (i = 0; i < sk_CONF_VALUE_num(values); i++) {
163 vl = sk_CONF_VALUE_value(values, i);
164 ERR_set_mark();
165 ret = module_run(cnf, vl->name, vl->value, flags);
166 OSSL_TRACE3(CONF, "Running module %s (%s) returned %d\n",
167 vl->name, vl->value, ret);
168 if (ret <= 0)
169 if (!(flags & CONF_MFLAGS_IGNORE_ERRORS)) {
170 ERR_clear_last_mark();
171 return ret;
172 }
173 ERR_pop_to_mark();
174 }
175
176 return 1;
177
178 }
179
CONF_modules_load_file_ex(OSSL_LIB_CTX * libctx,const char * filename,const char * appname,unsigned long flags)180 int CONF_modules_load_file_ex(OSSL_LIB_CTX *libctx, const char *filename,
181 const char *appname, unsigned long flags)
182 {
183 char *file = NULL;
184 CONF *conf = NULL;
185 int ret = 0, diagnostics = 0;
186
187 if (filename == NULL) {
188 file = CONF_get1_default_config_file();
189 if (file == NULL)
190 goto err;
191 } else {
192 file = (char *)filename;
193 }
194
195 ERR_set_mark();
196 conf = NCONF_new_ex(libctx, NULL);
197 if (conf == NULL)
198 goto err;
199
200 if (NCONF_load(conf, file, NULL) <= 0) {
201 if ((flags & CONF_MFLAGS_IGNORE_MISSING_FILE) &&
202 (ERR_GET_REASON(ERR_peek_last_error()) == CONF_R_NO_SUCH_FILE)) {
203 ret = 1;
204 }
205 goto err;
206 }
207
208 ret = CONF_modules_load(conf, appname, flags);
209 diagnostics = conf_diagnostics(conf);
210
211 err:
212 if (filename == NULL)
213 OPENSSL_free(file);
214 NCONF_free(conf);
215
216 if ((flags & CONF_MFLAGS_IGNORE_RETURN_CODES) != 0 && !diagnostics)
217 ret = 1;
218
219 if (ret > 0)
220 ERR_pop_to_mark();
221 else
222 ERR_clear_last_mark();
223
224 return ret;
225 }
226
CONF_modules_load_file(const char * filename,const char * appname,unsigned long flags)227 int CONF_modules_load_file(const char *filename,
228 const char *appname, unsigned long flags)
229 {
230 return CONF_modules_load_file_ex(NULL, filename, appname, flags);
231 }
232
DEFINE_RUN_ONCE_STATIC(do_load_builtin_modules)233 DEFINE_RUN_ONCE_STATIC(do_load_builtin_modules)
234 {
235 OPENSSL_load_builtin_modules();
236 #ifndef OPENSSL_NO_ENGINE
237 /* Need to load ENGINEs */
238 ENGINE_load_builtin_engines();
239 #endif
240 return 1;
241 }
242
module_run(const CONF * cnf,const char * name,const char * value,unsigned long flags)243 static int module_run(const CONF *cnf, const char *name, const char *value,
244 unsigned long flags)
245 {
246 CONF_MODULE *md;
247 int ret;
248
249 if (!RUN_ONCE(&load_builtin_modules, do_load_builtin_modules))
250 return -1;
251
252 md = module_find(name);
253
254 /* Module not found: try to load DSO */
255 if (!md && !(flags & CONF_MFLAGS_NO_DSO))
256 md = module_load_dso(cnf, name, value);
257
258 if (!md) {
259 if (!(flags & CONF_MFLAGS_SILENT)) {
260 ERR_raise_data(ERR_LIB_CONF, CONF_R_UNKNOWN_MODULE_NAME,
261 "module=%s", name);
262 }
263 return -1;
264 }
265
266 ret = module_init(md, name, value, cnf);
267
268 if (ret <= 0) {
269 if (!(flags & CONF_MFLAGS_SILENT))
270 ERR_raise_data(ERR_LIB_CONF, CONF_R_MODULE_INITIALIZATION_ERROR,
271 "module=%s, value=%s retcode=%-8d",
272 name, value, ret);
273 }
274
275 return ret;
276 }
277
278 /* Load a module from a DSO */
module_load_dso(const CONF * cnf,const char * name,const char * value)279 static CONF_MODULE *module_load_dso(const CONF *cnf,
280 const char *name, const char *value)
281 {
282 DSO *dso = NULL;
283 conf_init_func *ifunc;
284 conf_finish_func *ffunc;
285 const char *path = NULL;
286 int errcode = 0;
287 CONF_MODULE *md;
288
289 /* Look for alternative path in module section */
290 path = _CONF_get_string(cnf, value, "path");
291 if (path == NULL) {
292 path = name;
293 }
294 dso = DSO_load(NULL, path, NULL, 0);
295 if (dso == NULL) {
296 errcode = CONF_R_ERROR_LOADING_DSO;
297 goto err;
298 }
299 ifunc = (conf_init_func *)DSO_bind_func(dso, DSO_mod_init_name);
300 if (ifunc == NULL) {
301 errcode = CONF_R_MISSING_INIT_FUNCTION;
302 goto err;
303 }
304 ffunc = (conf_finish_func *)DSO_bind_func(dso, DSO_mod_finish_name);
305 /* All OK, add module */
306 md = module_add(dso, name, ifunc, ffunc);
307
308 if (md == NULL)
309 goto err;
310
311 return md;
312
313 err:
314 DSO_free(dso);
315 ERR_raise_data(ERR_LIB_CONF, errcode, "module=%s, path=%s", name, path);
316 return NULL;
317 }
318
319 /* add module to list */
module_add(DSO * dso,const char * name,conf_init_func * ifunc,conf_finish_func * ffunc)320 static CONF_MODULE *module_add(DSO *dso, const char *name,
321 conf_init_func *ifunc, conf_finish_func *ffunc)
322 {
323 CONF_MODULE *tmod = NULL;
324
325 if (!RUN_ONCE(&init_module_list_lock, do_init_module_list_lock))
326 return NULL;
327
328 if (!CRYPTO_THREAD_write_lock(module_list_lock))
329 return NULL;
330
331 if (supported_modules == NULL)
332 supported_modules = sk_CONF_MODULE_new_null();
333 if (supported_modules == NULL)
334 goto err;
335 if ((tmod = OPENSSL_zalloc(sizeof(*tmod))) == NULL) {
336 ERR_raise(ERR_LIB_CONF, ERR_R_MALLOC_FAILURE);
337 goto err;
338 }
339
340 tmod->dso = dso;
341 tmod->name = OPENSSL_strdup(name);
342 tmod->init = ifunc;
343 tmod->finish = ffunc;
344 if (tmod->name == NULL)
345 goto err;
346
347 if (!sk_CONF_MODULE_push(supported_modules, tmod))
348 goto err;
349
350 CRYPTO_THREAD_unlock(module_list_lock);
351 return tmod;
352
353 err:
354 CRYPTO_THREAD_unlock(module_list_lock);
355 if (tmod != NULL) {
356 OPENSSL_free(tmod->name);
357 OPENSSL_free(tmod);
358 }
359 return NULL;
360 }
361
362 /*
363 * Find a module from the list. We allow module names of the form
364 * modname.XXXX to just search for modname to allow the same module to be
365 * initialized more than once.
366 */
367
module_find(const char * name)368 static CONF_MODULE *module_find(const char *name)
369 {
370 CONF_MODULE *tmod;
371 int i, nchar;
372 char *p;
373 p = strrchr(name, '.');
374
375 if (p)
376 nchar = p - name;
377 else
378 nchar = strlen(name);
379
380 if (!RUN_ONCE(&init_module_list_lock, do_init_module_list_lock))
381 return NULL;
382
383 if (!CRYPTO_THREAD_read_lock(module_list_lock))
384 return NULL;
385
386 for (i = 0; i < sk_CONF_MODULE_num(supported_modules); i++) {
387 tmod = sk_CONF_MODULE_value(supported_modules, i);
388 if (strncmp(tmod->name, name, nchar) == 0) {
389 CRYPTO_THREAD_unlock(module_list_lock);
390 return tmod;
391 }
392 }
393
394 CRYPTO_THREAD_unlock(module_list_lock);
395 return NULL;
396 }
397
398 /* initialize a module */
module_init(CONF_MODULE * pmod,const char * name,const char * value,const CONF * cnf)399 static int module_init(CONF_MODULE *pmod, const char *name, const char *value,
400 const CONF *cnf)
401 {
402 int ret = 1;
403 int init_called = 0;
404 CONF_IMODULE *imod = NULL;
405
406 /* Otherwise add initialized module to list */
407 imod = OPENSSL_malloc(sizeof(*imod));
408 if (imod == NULL)
409 goto err;
410
411 imod->pmod = pmod;
412 imod->name = OPENSSL_strdup(name);
413 imod->value = OPENSSL_strdup(value);
414 imod->usr_data = NULL;
415
416 if (!imod->name || !imod->value)
417 goto memerr;
418
419 /* Try to initialize module */
420 if (pmod->init) {
421 ret = pmod->init(imod, cnf);
422 init_called = 1;
423 /* Error occurred, exit */
424 if (ret <= 0)
425 goto err;
426 }
427
428 if (!RUN_ONCE(&init_module_list_lock, do_init_module_list_lock))
429 goto err;
430
431 if (!CRYPTO_THREAD_write_lock(module_list_lock))
432 goto err;
433
434 if (initialized_modules == NULL) {
435 initialized_modules = sk_CONF_IMODULE_new_null();
436 if (initialized_modules == NULL) {
437 CRYPTO_THREAD_unlock(module_list_lock);
438 ERR_raise(ERR_LIB_CONF, ERR_R_MALLOC_FAILURE);
439 goto err;
440 }
441 }
442
443 if (!sk_CONF_IMODULE_push(initialized_modules, imod)) {
444 CRYPTO_THREAD_unlock(module_list_lock);
445 ERR_raise(ERR_LIB_CONF, ERR_R_MALLOC_FAILURE);
446 goto err;
447 }
448
449 pmod->links++;
450
451 CRYPTO_THREAD_unlock(module_list_lock);
452 return ret;
453
454 err:
455
456 /* We've started the module so we'd better finish it */
457 if (pmod->finish && init_called)
458 pmod->finish(imod);
459
460 memerr:
461 if (imod) {
462 OPENSSL_free(imod->name);
463 OPENSSL_free(imod->value);
464 OPENSSL_free(imod);
465 }
466
467 return -1;
468
469 }
470
471 /*
472 * Unload any dynamic modules that have a link count of zero: i.e. have no
473 * active initialized modules. If 'all' is set then all modules are unloaded
474 * including static ones.
475 */
476
CONF_modules_unload(int all)477 void CONF_modules_unload(int all)
478 {
479 int i;
480 CONF_MODULE *md;
481
482 if (!conf_modules_finish_int()) /* also inits module list lock */
483 return;
484
485 if (!CRYPTO_THREAD_write_lock(module_list_lock))
486 return;
487
488 /* unload modules in reverse order */
489 for (i = sk_CONF_MODULE_num(supported_modules) - 1; i >= 0; i--) {
490 md = sk_CONF_MODULE_value(supported_modules, i);
491 /* If static or in use and 'all' not set ignore it */
492 if (((md->links > 0) || !md->dso) && !all)
493 continue;
494 /* Since we're working in reverse this is OK */
495 (void)sk_CONF_MODULE_delete(supported_modules, i);
496 module_free(md);
497 }
498
499 if (sk_CONF_MODULE_num(supported_modules) == 0) {
500 sk_CONF_MODULE_free(supported_modules);
501 supported_modules = NULL;
502 }
503
504 CRYPTO_THREAD_unlock(module_list_lock);
505 }
506
507 /* unload a single module */
module_free(CONF_MODULE * md)508 static void module_free(CONF_MODULE *md)
509 {
510 DSO_free(md->dso);
511 OPENSSL_free(md->name);
512 OPENSSL_free(md);
513 }
514
515 /* finish and free up all modules instances */
516
conf_modules_finish_int(void)517 static int conf_modules_finish_int(void)
518 {
519 CONF_IMODULE *imod;
520
521 if (!RUN_ONCE(&init_module_list_lock, do_init_module_list_lock))
522 return 0;
523
524 /* If module_list_lock is NULL here it means we were already unloaded */
525 if (module_list_lock == NULL
526 || !CRYPTO_THREAD_write_lock(module_list_lock))
527 return 0;
528
529 while (sk_CONF_IMODULE_num(initialized_modules) > 0) {
530 imod = sk_CONF_IMODULE_pop(initialized_modules);
531 module_finish(imod);
532 }
533 sk_CONF_IMODULE_free(initialized_modules);
534 initialized_modules = NULL;
535
536 CRYPTO_THREAD_unlock(module_list_lock);
537
538 return 1;
539 }
540
CONF_modules_finish(void)541 void CONF_modules_finish(void)
542 {
543 conf_modules_finish_int();
544 }
545
546 /* finish a module instance */
547
module_finish(CONF_IMODULE * imod)548 static void module_finish(CONF_IMODULE *imod)
549 {
550 if (!imod)
551 return;
552 if (imod->pmod->finish)
553 imod->pmod->finish(imod);
554 imod->pmod->links--;
555 OPENSSL_free(imod->name);
556 OPENSSL_free(imod->value);
557 OPENSSL_free(imod);
558 }
559
560 /* Add a static module to OpenSSL */
561
CONF_module_add(const char * name,conf_init_func * ifunc,conf_finish_func * ffunc)562 int CONF_module_add(const char *name, conf_init_func *ifunc,
563 conf_finish_func *ffunc)
564 {
565 if (module_add(NULL, name, ifunc, ffunc))
566 return 1;
567 else
568 return 0;
569 }
570
ossl_config_modules_free(void)571 void ossl_config_modules_free(void)
572 {
573 CONF_modules_unload(1); /* calls CONF_modules_finish */
574 module_lists_free();
575 }
576
577 /* Utility functions */
578
CONF_imodule_get_name(const CONF_IMODULE * md)579 const char *CONF_imodule_get_name(const CONF_IMODULE *md)
580 {
581 return md->name;
582 }
583
CONF_imodule_get_value(const CONF_IMODULE * md)584 const char *CONF_imodule_get_value(const CONF_IMODULE *md)
585 {
586 return md->value;
587 }
588
CONF_imodule_get_usr_data(const CONF_IMODULE * md)589 void *CONF_imodule_get_usr_data(const CONF_IMODULE *md)
590 {
591 return md->usr_data;
592 }
593
CONF_imodule_set_usr_data(CONF_IMODULE * md,void * usr_data)594 void CONF_imodule_set_usr_data(CONF_IMODULE *md, void *usr_data)
595 {
596 md->usr_data = usr_data;
597 }
598
CONF_imodule_get_module(const CONF_IMODULE * md)599 CONF_MODULE *CONF_imodule_get_module(const CONF_IMODULE *md)
600 {
601 return md->pmod;
602 }
603
CONF_imodule_get_flags(const CONF_IMODULE * md)604 unsigned long CONF_imodule_get_flags(const CONF_IMODULE *md)
605 {
606 return md->flags;
607 }
608
CONF_imodule_set_flags(CONF_IMODULE * md,unsigned long flags)609 void CONF_imodule_set_flags(CONF_IMODULE *md, unsigned long flags)
610 {
611 md->flags = flags;
612 }
613
CONF_module_get_usr_data(CONF_MODULE * pmod)614 void *CONF_module_get_usr_data(CONF_MODULE *pmod)
615 {
616 return pmod->usr_data;
617 }
618
CONF_module_set_usr_data(CONF_MODULE * pmod,void * usr_data)619 void CONF_module_set_usr_data(CONF_MODULE *pmod, void *usr_data)
620 {
621 pmod->usr_data = usr_data;
622 }
623
624 /* Return default config file name */
CONF_get1_default_config_file(void)625 char *CONF_get1_default_config_file(void)
626 {
627 const char *t;
628 char *file, *sep = "";
629 size_t size;
630
631 if ((file = ossl_safe_getenv("OPENSSL_CONF")) != NULL)
632 return OPENSSL_strdup(file);
633
634 t = X509_get_default_cert_area();
635 #ifndef OPENSSL_SYS_VMS
636 sep = "/";
637 #endif
638 size = strlen(t) + strlen(sep) + strlen(OPENSSL_CONF) + 1;
639 file = OPENSSL_malloc(size);
640
641 if (file == NULL)
642 return NULL;
643 BIO_snprintf(file, size, "%s%s%s", t, sep, OPENSSL_CONF);
644
645 return file;
646 }
647
648 /*
649 * This function takes a list separated by 'sep' and calls the callback
650 * function giving the start and length of each member optionally stripping
651 * leading and trailing whitespace. This can be used to parse comma separated
652 * lists for example.
653 */
654
CONF_parse_list(const char * list_,int sep,int nospc,int (* list_cb)(const char * elem,int len,void * usr),void * arg)655 int CONF_parse_list(const char *list_, int sep, int nospc,
656 int (*list_cb) (const char *elem, int len, void *usr),
657 void *arg)
658 {
659 int ret;
660 const char *lstart, *tmpend, *p;
661
662 if (list_ == NULL) {
663 ERR_raise(ERR_LIB_CONF, CONF_R_LIST_CANNOT_BE_NULL);
664 return 0;
665 }
666
667 lstart = list_;
668 for (;;) {
669 if (nospc) {
670 while (*lstart && isspace((unsigned char)*lstart))
671 lstart++;
672 }
673 p = strchr(lstart, sep);
674 if (p == lstart || *lstart == '\0')
675 ret = list_cb(NULL, 0, arg);
676 else {
677 if (p)
678 tmpend = p - 1;
679 else
680 tmpend = lstart + strlen(lstart) - 1;
681 if (nospc) {
682 while (isspace((unsigned char)*tmpend))
683 tmpend--;
684 }
685 ret = list_cb(lstart, tmpend - lstart + 1, arg);
686 }
687 if (ret <= 0)
688 return ret;
689 if (p == NULL)
690 return 1;
691 lstart = p + 1;
692 }
693 }
694