1 /* 2 * Copyright 2002-2018 The OpenSSL Project Authors. All Rights Reserved. 3 * 4 * Licensed under the OpenSSL license (the "License"). You may not use 5 * this file except in compliance with the License. You can obtain a copy 6 * in the file LICENSE in the source distribution or at 7 * https://www.openssl.org/source/license.html 8 */ 9 10 #include "internal/cryptlib.h" 11 #include <stdio.h> 12 #include <ctype.h> 13 #include <openssl/crypto.h> 14 #include "internal/conf.h" 15 #include "internal/dso.h" 16 #include <openssl/x509.h> 17 18 #define DSO_mod_init_name "OPENSSL_init" 19 #define DSO_mod_finish_name "OPENSSL_finish" 20 21 /* 22 * This structure contains a data about supported modules. entries in this 23 * table correspond to either dynamic or static modules. 24 */ 25 26 struct conf_module_st { 27 /* DSO of this module or NULL if static */ 28 DSO *dso; 29 /* Name of the module */ 30 char *name; 31 /* Init function */ 32 conf_init_func *init; 33 /* Finish function */ 34 conf_finish_func *finish; 35 /* Number of successfully initialized modules */ 36 int links; 37 void *usr_data; 38 }; 39 40 /* 41 * This structure contains information about modules that have been 42 * successfully initialized. There may be more than one entry for a given 43 * module. 44 */ 45 46 struct conf_imodule_st { 47 CONF_MODULE *pmod; 48 char *name; 49 char *value; 50 unsigned long flags; 51 void *usr_data; 52 }; 53 54 static STACK_OF(CONF_MODULE) *supported_modules = NULL; 55 static STACK_OF(CONF_IMODULE) *initialized_modules = NULL; 56 57 static void module_free(CONF_MODULE *md); 58 static void module_finish(CONF_IMODULE *imod); 59 static int module_run(const CONF *cnf, const char *name, const char *value, 60 unsigned long flags); 61 static CONF_MODULE *module_add(DSO *dso, const char *name, 62 conf_init_func *ifunc, 63 conf_finish_func *ffunc); 64 static CONF_MODULE *module_find(const char *name); 65 static int module_init(CONF_MODULE *pmod, const char *name, const char *value, 66 const CONF *cnf); 67 static CONF_MODULE *module_load_dso(const CONF *cnf, const char *name, 68 const char *value); 69 70 /* Main function: load modules from a CONF structure */ 71 72 int CONF_modules_load(const CONF *cnf, const char *appname, 73 unsigned long flags) 74 { 75 STACK_OF(CONF_VALUE) *values; 76 CONF_VALUE *vl; 77 char *vsection = NULL; 78 79 int ret, i; 80 81 if (!cnf) 82 return 1; 83 84 if (appname) 85 vsection = NCONF_get_string(cnf, NULL, appname); 86 87 if (!appname || (!vsection && (flags & CONF_MFLAGS_DEFAULT_SECTION))) 88 vsection = NCONF_get_string(cnf, NULL, "openssl_conf"); 89 90 if (!vsection) { 91 ERR_clear_error(); 92 return 1; 93 } 94 95 values = NCONF_get_section(cnf, vsection); 96 97 if (!values) 98 return 0; 99 100 for (i = 0; i < sk_CONF_VALUE_num(values); i++) { 101 vl = sk_CONF_VALUE_value(values, i); 102 ret = module_run(cnf, vl->name, vl->value, flags); 103 if (ret <= 0) 104 if (!(flags & CONF_MFLAGS_IGNORE_ERRORS)) 105 return ret; 106 } 107 108 return 1; 109 110 } 111 112 int CONF_modules_load_file(const char *filename, const char *appname, 113 unsigned long flags) 114 { 115 char *file = NULL; 116 CONF *conf = NULL; 117 int ret = 0; 118 conf = NCONF_new(NULL); 119 if (conf == NULL) 120 goto err; 121 122 if (filename == NULL) { 123 file = CONF_get1_default_config_file(); 124 if (!file) 125 goto err; 126 } else 127 file = (char *)filename; 128 129 if (NCONF_load(conf, file, NULL) <= 0) { 130 if ((flags & CONF_MFLAGS_IGNORE_MISSING_FILE) && 131 (ERR_GET_REASON(ERR_peek_last_error()) == CONF_R_NO_SUCH_FILE)) { 132 ERR_clear_error(); 133 ret = 1; 134 } 135 goto err; 136 } 137 138 ret = CONF_modules_load(conf, appname, flags); 139 140 err: 141 if (filename == NULL) 142 OPENSSL_free(file); 143 NCONF_free(conf); 144 145 return ret; 146 } 147 148 static int module_run(const CONF *cnf, const char *name, const char *value, 149 unsigned long flags) 150 { 151 CONF_MODULE *md; 152 int ret; 153 154 md = module_find(name); 155 156 /* Module not found: try to load DSO */ 157 if (!md && !(flags & CONF_MFLAGS_NO_DSO)) 158 md = module_load_dso(cnf, name, value); 159 160 if (!md) { 161 if (!(flags & CONF_MFLAGS_SILENT)) { 162 CONFerr(CONF_F_MODULE_RUN, CONF_R_UNKNOWN_MODULE_NAME); 163 ERR_add_error_data(2, "module=", name); 164 } 165 return -1; 166 } 167 168 ret = module_init(md, name, value, cnf); 169 170 if (ret <= 0) { 171 if (!(flags & CONF_MFLAGS_SILENT)) { 172 char rcode[DECIMAL_SIZE(ret) + 1]; 173 174 CONFerr(CONF_F_MODULE_RUN, CONF_R_MODULE_INITIALIZATION_ERROR); 175 BIO_snprintf(rcode, sizeof(rcode), "%-8d", ret); 176 ERR_add_error_data(6, "module=", name, ", value=", value, 177 ", retcode=", rcode); 178 } 179 } 180 181 return ret; 182 } 183 184 /* Load a module from a DSO */ 185 static CONF_MODULE *module_load_dso(const CONF *cnf, 186 const char *name, const char *value) 187 { 188 DSO *dso = NULL; 189 conf_init_func *ifunc; 190 conf_finish_func *ffunc; 191 const char *path = NULL; 192 int errcode = 0; 193 CONF_MODULE *md; 194 /* Look for alternative path in module section */ 195 path = NCONF_get_string(cnf, value, "path"); 196 if (!path) { 197 ERR_clear_error(); 198 path = name; 199 } 200 dso = DSO_load(NULL, path, NULL, 0); 201 if (!dso) { 202 errcode = CONF_R_ERROR_LOADING_DSO; 203 goto err; 204 } 205 ifunc = (conf_init_func *)DSO_bind_func(dso, DSO_mod_init_name); 206 if (!ifunc) { 207 errcode = CONF_R_MISSING_INIT_FUNCTION; 208 goto err; 209 } 210 ffunc = (conf_finish_func *)DSO_bind_func(dso, DSO_mod_finish_name); 211 /* All OK, add module */ 212 md = module_add(dso, name, ifunc, ffunc); 213 214 if (!md) 215 goto err; 216 217 return md; 218 219 err: 220 DSO_free(dso); 221 CONFerr(CONF_F_MODULE_LOAD_DSO, errcode); 222 ERR_add_error_data(4, "module=", name, ", path=", path); 223 return NULL; 224 } 225 226 /* add module to list */ 227 static CONF_MODULE *module_add(DSO *dso, const char *name, 228 conf_init_func *ifunc, conf_finish_func *ffunc) 229 { 230 CONF_MODULE *tmod = NULL; 231 if (supported_modules == NULL) 232 supported_modules = sk_CONF_MODULE_new_null(); 233 if (supported_modules == NULL) 234 return NULL; 235 if ((tmod = OPENSSL_zalloc(sizeof(*tmod))) == NULL) { 236 CONFerr(CONF_F_MODULE_ADD, ERR_R_MALLOC_FAILURE); 237 return NULL; 238 } 239 240 tmod->dso = dso; 241 tmod->name = OPENSSL_strdup(name); 242 tmod->init = ifunc; 243 tmod->finish = ffunc; 244 if (tmod->name == NULL) { 245 OPENSSL_free(tmod); 246 return NULL; 247 } 248 249 if (!sk_CONF_MODULE_push(supported_modules, tmod)) { 250 OPENSSL_free(tmod->name); 251 OPENSSL_free(tmod); 252 return NULL; 253 } 254 255 return tmod; 256 } 257 258 /* 259 * Find a module from the list. We allow module names of the form 260 * modname.XXXX to just search for modname to allow the same module to be 261 * initialized more than once. 262 */ 263 264 static CONF_MODULE *module_find(const char *name) 265 { 266 CONF_MODULE *tmod; 267 int i, nchar; 268 char *p; 269 p = strrchr(name, '.'); 270 271 if (p) 272 nchar = p - name; 273 else 274 nchar = strlen(name); 275 276 for (i = 0; i < sk_CONF_MODULE_num(supported_modules); i++) { 277 tmod = sk_CONF_MODULE_value(supported_modules, i); 278 if (strncmp(tmod->name, name, nchar) == 0) 279 return tmod; 280 } 281 282 return NULL; 283 284 } 285 286 /* initialize a module */ 287 static int module_init(CONF_MODULE *pmod, const char *name, const char *value, 288 const CONF *cnf) 289 { 290 int ret = 1; 291 int init_called = 0; 292 CONF_IMODULE *imod = NULL; 293 294 /* Otherwise add initialized module to list */ 295 imod = OPENSSL_malloc(sizeof(*imod)); 296 if (imod == NULL) 297 goto err; 298 299 imod->pmod = pmod; 300 imod->name = OPENSSL_strdup(name); 301 imod->value = OPENSSL_strdup(value); 302 imod->usr_data = NULL; 303 304 if (!imod->name || !imod->value) 305 goto memerr; 306 307 /* Try to initialize module */ 308 if (pmod->init) { 309 ret = pmod->init(imod, cnf); 310 init_called = 1; 311 /* Error occurred, exit */ 312 if (ret <= 0) 313 goto err; 314 } 315 316 if (initialized_modules == NULL) { 317 initialized_modules = sk_CONF_IMODULE_new_null(); 318 if (!initialized_modules) { 319 CONFerr(CONF_F_MODULE_INIT, ERR_R_MALLOC_FAILURE); 320 goto err; 321 } 322 } 323 324 if (!sk_CONF_IMODULE_push(initialized_modules, imod)) { 325 CONFerr(CONF_F_MODULE_INIT, ERR_R_MALLOC_FAILURE); 326 goto err; 327 } 328 329 pmod->links++; 330 331 return ret; 332 333 err: 334 335 /* We've started the module so we'd better finish it */ 336 if (pmod->finish && init_called) 337 pmod->finish(imod); 338 339 memerr: 340 if (imod) { 341 OPENSSL_free(imod->name); 342 OPENSSL_free(imod->value); 343 OPENSSL_free(imod); 344 } 345 346 return -1; 347 348 } 349 350 /* 351 * Unload any dynamic modules that have a link count of zero: i.e. have no 352 * active initialized modules. If 'all' is set then all modules are unloaded 353 * including static ones. 354 */ 355 356 void CONF_modules_unload(int all) 357 { 358 int i; 359 CONF_MODULE *md; 360 CONF_modules_finish(); 361 /* unload modules in reverse order */ 362 for (i = sk_CONF_MODULE_num(supported_modules) - 1; i >= 0; i--) { 363 md = sk_CONF_MODULE_value(supported_modules, i); 364 /* If static or in use and 'all' not set ignore it */ 365 if (((md->links > 0) || !md->dso) && !all) 366 continue; 367 /* Since we're working in reverse this is OK */ 368 (void)sk_CONF_MODULE_delete(supported_modules, i); 369 module_free(md); 370 } 371 if (sk_CONF_MODULE_num(supported_modules) == 0) { 372 sk_CONF_MODULE_free(supported_modules); 373 supported_modules = NULL; 374 } 375 } 376 377 /* unload a single module */ 378 static void module_free(CONF_MODULE *md) 379 { 380 DSO_free(md->dso); 381 OPENSSL_free(md->name); 382 OPENSSL_free(md); 383 } 384 385 /* finish and free up all modules instances */ 386 387 void CONF_modules_finish(void) 388 { 389 CONF_IMODULE *imod; 390 while (sk_CONF_IMODULE_num(initialized_modules) > 0) { 391 imod = sk_CONF_IMODULE_pop(initialized_modules); 392 module_finish(imod); 393 } 394 sk_CONF_IMODULE_free(initialized_modules); 395 initialized_modules = NULL; 396 } 397 398 /* finish a module instance */ 399 400 static void module_finish(CONF_IMODULE *imod) 401 { 402 if (!imod) 403 return; 404 if (imod->pmod->finish) 405 imod->pmod->finish(imod); 406 imod->pmod->links--; 407 OPENSSL_free(imod->name); 408 OPENSSL_free(imod->value); 409 OPENSSL_free(imod); 410 } 411 412 /* Add a static module to OpenSSL */ 413 414 int CONF_module_add(const char *name, conf_init_func *ifunc, 415 conf_finish_func *ffunc) 416 { 417 if (module_add(NULL, name, ifunc, ffunc)) 418 return 1; 419 else 420 return 0; 421 } 422 423 void conf_modules_free_int(void) 424 { 425 CONF_modules_finish(); 426 CONF_modules_unload(1); 427 } 428 429 /* Utility functions */ 430 431 const char *CONF_imodule_get_name(const CONF_IMODULE *md) 432 { 433 return md->name; 434 } 435 436 const char *CONF_imodule_get_value(const CONF_IMODULE *md) 437 { 438 return md->value; 439 } 440 441 void *CONF_imodule_get_usr_data(const CONF_IMODULE *md) 442 { 443 return md->usr_data; 444 } 445 446 void CONF_imodule_set_usr_data(CONF_IMODULE *md, void *usr_data) 447 { 448 md->usr_data = usr_data; 449 } 450 451 CONF_MODULE *CONF_imodule_get_module(const CONF_IMODULE *md) 452 { 453 return md->pmod; 454 } 455 456 unsigned long CONF_imodule_get_flags(const CONF_IMODULE *md) 457 { 458 return md->flags; 459 } 460 461 void CONF_imodule_set_flags(CONF_IMODULE *md, unsigned long flags) 462 { 463 md->flags = flags; 464 } 465 466 void *CONF_module_get_usr_data(CONF_MODULE *pmod) 467 { 468 return pmod->usr_data; 469 } 470 471 void CONF_module_set_usr_data(CONF_MODULE *pmod, void *usr_data) 472 { 473 pmod->usr_data = usr_data; 474 } 475 476 /* Return default config file name */ 477 478 char *CONF_get1_default_config_file(void) 479 { 480 char *file, *sep = ""; 481 int len; 482 483 if ((file = ossl_safe_getenv("OPENSSL_CONF")) != NULL) 484 return OPENSSL_strdup(file); 485 486 len = strlen(X509_get_default_cert_area()); 487 #ifndef OPENSSL_SYS_VMS 488 len++; 489 sep = "/"; 490 #endif 491 len += strlen(OPENSSL_CONF); 492 493 file = OPENSSL_malloc(len + 1); 494 495 if (file == NULL) 496 return NULL; 497 BIO_snprintf(file, len + 1, "%s%s%s", X509_get_default_cert_area(), 498 sep, OPENSSL_CONF); 499 500 return file; 501 } 502 503 /* 504 * This function takes a list separated by 'sep' and calls the callback 505 * function giving the start and length of each member optionally stripping 506 * leading and trailing whitespace. This can be used to parse comma separated 507 * lists for example. 508 */ 509 510 int CONF_parse_list(const char *list_, int sep, int nospc, 511 int (*list_cb) (const char *elem, int len, void *usr), 512 void *arg) 513 { 514 int ret; 515 const char *lstart, *tmpend, *p; 516 517 if (list_ == NULL) { 518 CONFerr(CONF_F_CONF_PARSE_LIST, CONF_R_LIST_CANNOT_BE_NULL); 519 return 0; 520 } 521 522 lstart = list_; 523 for (;;) { 524 if (nospc) { 525 while (*lstart && isspace((unsigned char)*lstart)) 526 lstart++; 527 } 528 p = strchr(lstart, sep); 529 if (p == lstart || !*lstart) 530 ret = list_cb(NULL, 0, arg); 531 else { 532 if (p) 533 tmpend = p - 1; 534 else 535 tmpend = lstart + strlen(lstart) - 1; 536 if (nospc) { 537 while (isspace((unsigned char)*tmpend)) 538 tmpend--; 539 } 540 ret = list_cb(lstart, tmpend - lstart + 1, arg); 541 } 542 if (ret <= 0) 543 return ret; 544 if (p == NULL) 545 return 1; 546 lstart = p + 1; 547 } 548 } 549