1 /* $OpenBSD: conf_mod.c,v 1.25 2014/07/22 02:21:20 beck Exp $ */ 2 /* Written by Stephen Henson (steve@openssl.org) for the OpenSSL 3 * project 2001. 4 */ 5 /* ==================================================================== 6 * Copyright (c) 2001 The OpenSSL Project. All rights reserved. 7 * 8 * Redistribution and use in source and binary forms, with or without 9 * modification, are permitted provided that the following conditions 10 * are met: 11 * 12 * 1. Redistributions of source code must retain the above copyright 13 * notice, this list of conditions and the following disclaimer. 14 * 15 * 2. Redistributions in binary form must reproduce the above copyright 16 * notice, this list of conditions and the following disclaimer in 17 * the documentation and/or other materials provided with the 18 * distribution. 19 * 20 * 3. All advertising materials mentioning features or use of this 21 * software must display the following acknowledgment: 22 * "This product includes software developed by the OpenSSL Project 23 * for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)" 24 * 25 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to 26 * endorse or promote products derived from this software without 27 * prior written permission. For written permission, please contact 28 * licensing@OpenSSL.org. 29 * 30 * 5. Products derived from this software may not be called "OpenSSL" 31 * nor may "OpenSSL" appear in their names without prior written 32 * permission of the OpenSSL Project. 33 * 34 * 6. Redistributions of any form whatsoever must retain the following 35 * acknowledgment: 36 * "This product includes software developed by the OpenSSL Project 37 * for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)" 38 * 39 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY 40 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 41 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 42 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE OpenSSL PROJECT OR 43 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, 44 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT 45 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; 46 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 47 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, 48 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) 49 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED 50 * OF THE POSSIBILITY OF SUCH DAMAGE. 51 * ==================================================================== 52 * 53 * This product includes cryptographic software written by Eric Young 54 * (eay@cryptsoft.com). This product includes software written by Tim 55 * Hudson (tjh@cryptsoft.com). 56 * 57 */ 58 59 #include <ctype.h> 60 #include <stdio.h> 61 #include <string.h> 62 #include <unistd.h> 63 64 #include <openssl/conf.h> 65 #include <openssl/crypto.h> 66 #include <openssl/dso.h> 67 #include <openssl/err.h> 68 #include <openssl/x509.h> 69 70 #define DSO_mod_init_name "OPENSSL_init" 71 #define DSO_mod_finish_name "OPENSSL_finish" 72 73 /* This structure contains a data about supported modules. 74 * entries in this table correspond to either dynamic or 75 * static modules. 76 */ 77 78 struct conf_module_st { 79 /* DSO of this module or NULL if static */ 80 DSO *dso; 81 /* Name of the module */ 82 char *name; 83 /* Init function */ 84 conf_init_func *init; 85 /* Finish function */ 86 conf_finish_func *finish; 87 /* Number of successfully initialized modules */ 88 int links; 89 void *usr_data; 90 }; 91 92 93 /* This structure contains information about modules that have been 94 * successfully initialized. There may be more than one entry for a 95 * given module. 96 */ 97 98 struct conf_imodule_st { 99 CONF_MODULE *pmod; 100 char *name; 101 char *value; 102 unsigned long flags; 103 void *usr_data; 104 }; 105 106 static STACK_OF(CONF_MODULE) *supported_modules = NULL; 107 static STACK_OF(CONF_IMODULE) *initialized_modules = NULL; 108 109 static void module_free(CONF_MODULE *md); 110 static void module_finish(CONF_IMODULE *imod); 111 static int module_run(const CONF *cnf, char *name, char *value, 112 unsigned long flags); 113 static CONF_MODULE *module_add(DSO *dso, const char *name, 114 conf_init_func *ifunc, conf_finish_func *ffunc); 115 static CONF_MODULE *module_find(char *name); 116 static int module_init(CONF_MODULE *pmod, char *name, char *value, 117 const CONF *cnf); 118 static CONF_MODULE *module_load_dso(const CONF *cnf, char *name, char *value, 119 unsigned long flags); 120 121 /* Main function: load modules from a CONF structure */ 122 123 int 124 CONF_modules_load(const CONF *cnf, const char *appname, unsigned long flags) 125 { 126 STACK_OF(CONF_VALUE) *values; 127 CONF_VALUE *vl; 128 char *vsection = NULL; 129 130 int ret, i; 131 132 if (!cnf) 133 return 1; 134 135 if (appname) 136 vsection = NCONF_get_string(cnf, NULL, appname); 137 138 if (!appname || (!vsection && (flags & CONF_MFLAGS_DEFAULT_SECTION))) 139 vsection = NCONF_get_string(cnf, NULL, "openssl_conf"); 140 141 if (!vsection) { 142 ERR_clear_error(); 143 return 1; 144 } 145 146 values = NCONF_get_section(cnf, vsection); 147 148 if (!values) 149 return 0; 150 151 for (i = 0; i < sk_CONF_VALUE_num(values); i++) { 152 vl = sk_CONF_VALUE_value(values, i); 153 ret = module_run(cnf, vl->name, vl->value, flags); 154 if (ret <= 0) 155 if (!(flags & CONF_MFLAGS_IGNORE_ERRORS)) 156 return ret; 157 } 158 159 return 1; 160 } 161 162 int 163 CONF_modules_load_file(const char *filename, const char *appname, 164 unsigned long flags) 165 { 166 char *file = NULL; 167 CONF *conf = NULL; 168 int ret = 0; 169 conf = NCONF_new(NULL); 170 if (!conf) 171 goto err; 172 173 if (filename == NULL) { 174 file = CONF_get1_default_config_file(); 175 if (!file) 176 goto err; 177 } else 178 file = (char *)filename; 179 180 if (NCONF_load(conf, file, NULL) <= 0) { 181 if ((flags & CONF_MFLAGS_IGNORE_MISSING_FILE) && 182 (ERR_GET_REASON(ERR_peek_last_error()) == 183 CONF_R_NO_SUCH_FILE)) { 184 ERR_clear_error(); 185 ret = 1; 186 } 187 goto err; 188 } 189 190 ret = CONF_modules_load(conf, appname, flags); 191 192 err: 193 if (filename == NULL) 194 free(file); 195 NCONF_free(conf); 196 197 return ret; 198 } 199 200 static int 201 module_run(const CONF *cnf, char *name, char *value, unsigned long flags) 202 { 203 CONF_MODULE *md; 204 int ret; 205 206 md = module_find(name); 207 208 /* Module not found: try to load DSO */ 209 if (!md && !(flags & CONF_MFLAGS_NO_DSO)) 210 md = module_load_dso(cnf, name, value, flags); 211 212 if (!md) { 213 if (!(flags & CONF_MFLAGS_SILENT)) { 214 CONFerr(CONF_F_MODULE_RUN, CONF_R_UNKNOWN_MODULE_NAME); 215 ERR_asprintf_error_data("module=%s", name); 216 } 217 return -1; 218 } 219 220 ret = module_init(md, name, value, cnf); 221 222 if (ret <= 0) { 223 if (!(flags & CONF_MFLAGS_SILENT)) { 224 CONFerr(CONF_F_MODULE_RUN, 225 CONF_R_MODULE_INITIALIZATION_ERROR); 226 ERR_asprintf_error_data 227 ("module=%s, value=%s, retcode=%-8d", 228 name, value, ret); 229 } 230 } 231 232 return ret; 233 } 234 235 /* Load a module from a DSO */ 236 static CONF_MODULE * 237 module_load_dso(const CONF *cnf, char *name, char *value, unsigned long flags) 238 { 239 DSO *dso = NULL; 240 conf_init_func *ifunc; 241 conf_finish_func *ffunc; 242 char *path = NULL; 243 int errcode = 0; 244 CONF_MODULE *md; 245 246 /* Look for alternative path in module section */ 247 path = NCONF_get_string(cnf, value, "path"); 248 if (!path) { 249 ERR_clear_error(); 250 path = name; 251 } 252 dso = DSO_load(NULL, path, NULL, 0); 253 if (!dso) { 254 errcode = CONF_R_ERROR_LOADING_DSO; 255 goto err; 256 } 257 ifunc = (conf_init_func *)DSO_bind_func(dso, DSO_mod_init_name); 258 if (!ifunc) { 259 errcode = CONF_R_MISSING_INIT_FUNCTION; 260 goto err; 261 } 262 ffunc = (conf_finish_func *)DSO_bind_func(dso, DSO_mod_finish_name); 263 /* All OK, add module */ 264 md = module_add(dso, name, ifunc, ffunc); 265 266 if (!md) 267 goto err; 268 269 return md; 270 271 err: 272 if (dso) 273 DSO_free(dso); 274 CONFerr(CONF_F_MODULE_LOAD_DSO, errcode); 275 ERR_asprintf_error_data("module=%s, path=%s", name, path); 276 return NULL; 277 } 278 279 /* add module to list */ 280 static CONF_MODULE * 281 module_add(DSO *dso, const char *name, conf_init_func *ifunc, 282 conf_finish_func *ffunc) 283 { 284 CONF_MODULE *tmod = NULL; 285 286 if (name == NULL) 287 return NULL; 288 if (supported_modules == NULL) 289 supported_modules = sk_CONF_MODULE_new_null(); 290 if (supported_modules == NULL) 291 return NULL; 292 tmod = malloc(sizeof(CONF_MODULE)); 293 if (tmod == NULL) 294 return NULL; 295 296 tmod->dso = dso; 297 tmod->name = strdup(name); 298 tmod->init = ifunc; 299 tmod->finish = ffunc; 300 tmod->links = 0; 301 302 if (!sk_CONF_MODULE_push(supported_modules, tmod)) { 303 free(tmod); 304 return NULL; 305 } 306 307 return tmod; 308 } 309 310 /* Find a module from the list. We allow module names of the 311 * form modname.XXXX to just search for modname to allow the 312 * same module to be initialized more than once. 313 */ 314 315 static CONF_MODULE * 316 module_find(char *name) 317 { 318 CONF_MODULE *tmod; 319 int i, nchar; 320 char *p; 321 322 p = strrchr(name, '.'); 323 324 if (p) 325 nchar = p - name; 326 else 327 nchar = strlen(name); 328 329 for (i = 0; i < sk_CONF_MODULE_num(supported_modules); i++) { 330 tmod = sk_CONF_MODULE_value(supported_modules, i); 331 if (!strncmp(tmod->name, name, nchar)) 332 return tmod; 333 } 334 335 return NULL; 336 } 337 338 /* initialize a module */ 339 static int 340 module_init(CONF_MODULE *pmod, char *name, char *value, const CONF *cnf) 341 { 342 int ret = 1; 343 int init_called = 0; 344 CONF_IMODULE *imod = NULL; 345 346 /* Otherwise add initialized module to list */ 347 imod = malloc(sizeof(CONF_IMODULE)); 348 if (!imod) 349 goto err; 350 351 imod->pmod = pmod; 352 imod->name = name ? strdup(name) : NULL; 353 imod->value = value ? strdup(value) : NULL; 354 imod->usr_data = NULL; 355 356 if (!imod->name || !imod->value) 357 goto memerr; 358 359 /* Try to initialize module */ 360 if (pmod->init) { 361 ret = pmod->init(imod, cnf); 362 init_called = 1; 363 /* Error occurred, exit */ 364 if (ret <= 0) 365 goto err; 366 } 367 368 if (initialized_modules == NULL) { 369 initialized_modules = sk_CONF_IMODULE_new_null(); 370 if (!initialized_modules) { 371 CONFerr(CONF_F_MODULE_INIT, ERR_R_MALLOC_FAILURE); 372 goto err; 373 } 374 } 375 376 if (!sk_CONF_IMODULE_push(initialized_modules, imod)) { 377 CONFerr(CONF_F_MODULE_INIT, ERR_R_MALLOC_FAILURE); 378 goto err; 379 } 380 381 pmod->links++; 382 383 return ret; 384 385 err: 386 /* We've started the module so we'd better finish it */ 387 if (pmod->finish && init_called) 388 pmod->finish(imod); 389 390 memerr: 391 if (imod) { 392 free(imod->name); 393 free(imod->value); 394 free(imod); 395 } 396 397 return -1; 398 } 399 400 /* Unload any dynamic modules that have a link count of zero: 401 * i.e. have no active initialized modules. If 'all' is set 402 * then all modules are unloaded including static ones. 403 */ 404 405 void 406 CONF_modules_unload(int all) 407 { 408 int i; 409 CONF_MODULE *md; 410 411 CONF_modules_finish(); 412 413 /* unload modules in reverse order */ 414 for (i = sk_CONF_MODULE_num(supported_modules) - 1; i >= 0; i--) { 415 md = sk_CONF_MODULE_value(supported_modules, i); 416 /* If static or in use and 'all' not set ignore it */ 417 if (((md->links > 0) || !md->dso) && !all) 418 continue; 419 /* Since we're working in reverse this is OK */ 420 (void)sk_CONF_MODULE_delete(supported_modules, i); 421 module_free(md); 422 } 423 if (sk_CONF_MODULE_num(supported_modules) == 0) { 424 sk_CONF_MODULE_free(supported_modules); 425 supported_modules = NULL; 426 } 427 } 428 429 /* unload a single module */ 430 static void 431 module_free(CONF_MODULE *md) 432 { 433 if (md->dso) 434 DSO_free(md->dso); 435 free(md->name); 436 free(md); 437 } 438 439 /* finish and free up all modules instances */ 440 441 void 442 CONF_modules_finish(void) 443 { 444 CONF_IMODULE *imod; 445 446 while (sk_CONF_IMODULE_num(initialized_modules) > 0) { 447 imod = sk_CONF_IMODULE_pop(initialized_modules); 448 module_finish(imod); 449 } 450 sk_CONF_IMODULE_free(initialized_modules); 451 initialized_modules = NULL; 452 } 453 454 /* finish a module instance */ 455 456 static void 457 module_finish(CONF_IMODULE *imod) 458 { 459 if (imod->pmod->finish) 460 imod->pmod->finish(imod); 461 imod->pmod->links--; 462 free(imod->name); 463 free(imod->value); 464 free(imod); 465 } 466 467 /* Add a static module to OpenSSL */ 468 469 int 470 CONF_module_add(const char *name, conf_init_func *ifunc, 471 conf_finish_func *ffunc) 472 { 473 if (module_add(NULL, name, ifunc, ffunc)) 474 return 1; 475 else 476 return 0; 477 } 478 479 void 480 CONF_modules_free(void) 481 { 482 CONF_modules_finish(); 483 CONF_modules_unload(1); 484 } 485 486 /* Utility functions */ 487 488 const char * 489 CONF_imodule_get_name(const CONF_IMODULE *md) 490 { 491 return md->name; 492 } 493 494 const char * 495 CONF_imodule_get_value(const CONF_IMODULE *md) 496 { 497 return md->value; 498 } 499 500 void * 501 CONF_imodule_get_usr_data(const CONF_IMODULE *md) 502 { 503 return md->usr_data; 504 } 505 506 void 507 CONF_imodule_set_usr_data(CONF_IMODULE *md, void *usr_data) 508 { 509 md->usr_data = usr_data; 510 } 511 512 CONF_MODULE * 513 CONF_imodule_get_module(const CONF_IMODULE *md) 514 { 515 return md->pmod; 516 } 517 518 unsigned long 519 CONF_imodule_get_flags(const CONF_IMODULE *md) 520 { 521 return md->flags; 522 } 523 524 void 525 CONF_imodule_set_flags(CONF_IMODULE *md, unsigned long flags) 526 { 527 md->flags = flags; 528 } 529 530 void * 531 CONF_module_get_usr_data(CONF_MODULE *pmod) 532 { 533 return pmod->usr_data; 534 } 535 536 void 537 CONF_module_set_usr_data(CONF_MODULE *pmod, void *usr_data) 538 { 539 pmod->usr_data = usr_data; 540 } 541 542 /* Return default config file name */ 543 544 char * 545 CONF_get1_default_config_file(void) 546 { 547 char *file = NULL; 548 549 if (asprintf(&file, "%s/openssl.cnf", 550 X509_get_default_cert_area()) == -1) 551 return (NULL); 552 return file; 553 } 554 555 /* This function takes a list separated by 'sep' and calls the 556 * callback function giving the start and length of each member 557 * optionally stripping leading and trailing whitespace. This can 558 * be used to parse comma separated lists for example. 559 */ 560 561 int 562 CONF_parse_list(const char *list_, int sep, int nospc, 563 int (*list_cb)(const char *elem, int len, void *usr), void *arg) 564 { 565 int ret; 566 const char *lstart, *tmpend, *p; 567 568 if (list_ == NULL) { 569 CONFerr(CONF_F_CONF_PARSE_LIST, CONF_R_LIST_CANNOT_BE_NULL); 570 return 0; 571 } 572 573 lstart = list_; 574 for (;;) { 575 if (nospc) { 576 while (*lstart && isspace((unsigned char)*lstart)) 577 lstart++; 578 } 579 p = strchr(lstart, sep); 580 if (p == lstart || !*lstart) 581 ret = list_cb(NULL, 0, arg); 582 else { 583 if (p) 584 tmpend = p - 1; 585 else 586 tmpend = lstart + strlen(lstart) - 1; 587 if (nospc) { 588 while (isspace((unsigned char)*tmpend)) 589 tmpend--; 590 } 591 ret = list_cb(lstart, tmpend - lstart + 1, arg); 592 } 593 if (ret <= 0) 594 return ret; 595 if (p == NULL) 596 return 1; 597 lstart = p + 1; 598 } 599 } 600