1 /* 2 * Copyright 2002-2019 The OpenSSL Project Authors. All Rights Reserved. 3 * 4 * Licensed under the OpenSSL license (the "License"). You may not use 5 * this file except in compliance with the License. You can obtain a copy 6 * in the file LICENSE in the source distribution or at 7 * https://www.openssl.org/source/license.html 8 */ 9 10 #include "internal/cryptlib.h" 11 #include <stdio.h> 12 #include <ctype.h> 13 #include <openssl/crypto.h> 14 #include "internal/conf.h" 15 #include "internal/dso.h" 16 #include <openssl/x509.h> 17 18 #define DSO_mod_init_name "OPENSSL_init" 19 #define DSO_mod_finish_name "OPENSSL_finish" 20 21 /* 22 * This structure contains a data about supported modules. entries in this 23 * table correspond to either dynamic or static modules. 24 */ 25 26 struct conf_module_st { 27 /* DSO of this module or NULL if static */ 28 DSO *dso; 29 /* Name of the module */ 30 char *name; 31 /* Init function */ 32 conf_init_func *init; 33 /* Finish function */ 34 conf_finish_func *finish; 35 /* Number of successfully initialized modules */ 36 int links; 37 void *usr_data; 38 }; 39 40 /* 41 * This structure contains information about modules that have been 42 * successfully initialized. There may be more than one entry for a given 43 * module. 44 */ 45 46 struct conf_imodule_st { 47 CONF_MODULE *pmod; 48 char *name; 49 char *value; 50 unsigned long flags; 51 void *usr_data; 52 }; 53 54 static STACK_OF(CONF_MODULE) *supported_modules = NULL; 55 static STACK_OF(CONF_IMODULE) *initialized_modules = NULL; 56 57 static void module_free(CONF_MODULE *md); 58 static void module_finish(CONF_IMODULE *imod); 59 static int module_run(const CONF *cnf, const char *name, const char *value, 60 unsigned long flags); 61 static CONF_MODULE *module_add(DSO *dso, const char *name, 62 conf_init_func *ifunc, 63 conf_finish_func *ffunc); 64 static CONF_MODULE *module_find(const char *name); 65 static int module_init(CONF_MODULE *pmod, const char *name, const char *value, 66 const CONF *cnf); 67 static CONF_MODULE *module_load_dso(const CONF *cnf, const char *name, 68 const char *value); 69 70 /* Main function: load modules from a CONF structure */ 71 72 int CONF_modules_load(const CONF *cnf, const char *appname, 73 unsigned long flags) 74 { 75 STACK_OF(CONF_VALUE) *values; 76 CONF_VALUE *vl; 77 char *vsection = NULL; 78 79 int ret, i; 80 81 if (!cnf) 82 return 1; 83 84 if (appname) 85 vsection = NCONF_get_string(cnf, NULL, appname); 86 87 if (!appname || (!vsection && (flags & CONF_MFLAGS_DEFAULT_SECTION))) 88 vsection = NCONF_get_string(cnf, NULL, "openssl_conf"); 89 90 if (!vsection) { 91 ERR_clear_error(); 92 return 1; 93 } 94 95 values = NCONF_get_section(cnf, vsection); 96 97 if (!values) 98 return 0; 99 100 for (i = 0; i < sk_CONF_VALUE_num(values); i++) { 101 vl = sk_CONF_VALUE_value(values, i); 102 ret = module_run(cnf, vl->name, vl->value, flags); 103 if (ret <= 0) 104 if (!(flags & CONF_MFLAGS_IGNORE_ERRORS)) 105 return ret; 106 } 107 108 return 1; 109 110 } 111 112 int CONF_modules_load_file(const char *filename, const char *appname, 113 unsigned long flags) 114 { 115 char *file = NULL; 116 CONF *conf = NULL; 117 int ret = 0; 118 conf = NCONF_new(NULL); 119 if (conf == NULL) 120 goto err; 121 122 if (filename == NULL) { 123 file = CONF_get1_default_config_file(); 124 if (!file) 125 goto err; 126 } else 127 file = (char *)filename; 128 129 if (NCONF_load(conf, file, NULL) <= 0) { 130 if ((flags & CONF_MFLAGS_IGNORE_MISSING_FILE) && 131 (ERR_GET_REASON(ERR_peek_last_error()) == CONF_R_NO_SUCH_FILE)) { 132 ERR_clear_error(); 133 ret = 1; 134 } 135 goto err; 136 } 137 138 ret = CONF_modules_load(conf, appname, flags); 139 140 err: 141 if (filename == NULL) 142 OPENSSL_free(file); 143 NCONF_free(conf); 144 145 if (flags & CONF_MFLAGS_IGNORE_RETURN_CODES) 146 return 1; 147 148 return ret; 149 } 150 151 static int module_run(const CONF *cnf, const char *name, const char *value, 152 unsigned long flags) 153 { 154 CONF_MODULE *md; 155 int ret; 156 157 md = module_find(name); 158 159 /* Module not found: try to load DSO */ 160 if (!md && !(flags & CONF_MFLAGS_NO_DSO)) 161 md = module_load_dso(cnf, name, value); 162 163 if (!md) { 164 if (!(flags & CONF_MFLAGS_SILENT)) { 165 CONFerr(CONF_F_MODULE_RUN, CONF_R_UNKNOWN_MODULE_NAME); 166 ERR_add_error_data(2, "module=", name); 167 } 168 return -1; 169 } 170 171 ret = module_init(md, name, value, cnf); 172 173 if (ret <= 0) { 174 if (!(flags & CONF_MFLAGS_SILENT)) { 175 char rcode[DECIMAL_SIZE(ret) + 1]; 176 177 CONFerr(CONF_F_MODULE_RUN, CONF_R_MODULE_INITIALIZATION_ERROR); 178 BIO_snprintf(rcode, sizeof(rcode), "%-8d", ret); 179 ERR_add_error_data(6, "module=", name, ", value=", value, 180 ", retcode=", rcode); 181 } 182 } 183 184 return ret; 185 } 186 187 /* Load a module from a DSO */ 188 static CONF_MODULE *module_load_dso(const CONF *cnf, 189 const char *name, const char *value) 190 { 191 DSO *dso = NULL; 192 conf_init_func *ifunc; 193 conf_finish_func *ffunc; 194 const char *path = NULL; 195 int errcode = 0; 196 CONF_MODULE *md; 197 /* Look for alternative path in module section */ 198 path = NCONF_get_string(cnf, value, "path"); 199 if (!path) { 200 ERR_clear_error(); 201 path = name; 202 } 203 dso = DSO_load(NULL, path, NULL, 0); 204 if (!dso) { 205 errcode = CONF_R_ERROR_LOADING_DSO; 206 goto err; 207 } 208 ifunc = (conf_init_func *)DSO_bind_func(dso, DSO_mod_init_name); 209 if (!ifunc) { 210 errcode = CONF_R_MISSING_INIT_FUNCTION; 211 goto err; 212 } 213 ffunc = (conf_finish_func *)DSO_bind_func(dso, DSO_mod_finish_name); 214 /* All OK, add module */ 215 md = module_add(dso, name, ifunc, ffunc); 216 217 if (!md) 218 goto err; 219 220 return md; 221 222 err: 223 DSO_free(dso); 224 CONFerr(CONF_F_MODULE_LOAD_DSO, errcode); 225 ERR_add_error_data(4, "module=", name, ", path=", path); 226 return NULL; 227 } 228 229 /* add module to list */ 230 static CONF_MODULE *module_add(DSO *dso, const char *name, 231 conf_init_func *ifunc, conf_finish_func *ffunc) 232 { 233 CONF_MODULE *tmod = NULL; 234 if (supported_modules == NULL) 235 supported_modules = sk_CONF_MODULE_new_null(); 236 if (supported_modules == NULL) 237 return NULL; 238 if ((tmod = OPENSSL_zalloc(sizeof(*tmod))) == NULL) { 239 CONFerr(CONF_F_MODULE_ADD, ERR_R_MALLOC_FAILURE); 240 return NULL; 241 } 242 243 tmod->dso = dso; 244 tmod->name = OPENSSL_strdup(name); 245 tmod->init = ifunc; 246 tmod->finish = ffunc; 247 if (tmod->name == NULL) { 248 OPENSSL_free(tmod); 249 return NULL; 250 } 251 252 if (!sk_CONF_MODULE_push(supported_modules, tmod)) { 253 OPENSSL_free(tmod->name); 254 OPENSSL_free(tmod); 255 return NULL; 256 } 257 258 return tmod; 259 } 260 261 /* 262 * Find a module from the list. We allow module names of the form 263 * modname.XXXX to just search for modname to allow the same module to be 264 * initialized more than once. 265 */ 266 267 static CONF_MODULE *module_find(const char *name) 268 { 269 CONF_MODULE *tmod; 270 int i, nchar; 271 char *p; 272 p = strrchr(name, '.'); 273 274 if (p) 275 nchar = p - name; 276 else 277 nchar = strlen(name); 278 279 for (i = 0; i < sk_CONF_MODULE_num(supported_modules); i++) { 280 tmod = sk_CONF_MODULE_value(supported_modules, i); 281 if (strncmp(tmod->name, name, nchar) == 0) 282 return tmod; 283 } 284 285 return NULL; 286 287 } 288 289 /* initialize a module */ 290 static int module_init(CONF_MODULE *pmod, const char *name, const char *value, 291 const CONF *cnf) 292 { 293 int ret = 1; 294 int init_called = 0; 295 CONF_IMODULE *imod = NULL; 296 297 /* Otherwise add initialized module to list */ 298 imod = OPENSSL_malloc(sizeof(*imod)); 299 if (imod == NULL) 300 goto err; 301 302 imod->pmod = pmod; 303 imod->name = OPENSSL_strdup(name); 304 imod->value = OPENSSL_strdup(value); 305 imod->usr_data = NULL; 306 307 if (!imod->name || !imod->value) 308 goto memerr; 309 310 /* Try to initialize module */ 311 if (pmod->init) { 312 ret = pmod->init(imod, cnf); 313 init_called = 1; 314 /* Error occurred, exit */ 315 if (ret <= 0) 316 goto err; 317 } 318 319 if (initialized_modules == NULL) { 320 initialized_modules = sk_CONF_IMODULE_new_null(); 321 if (!initialized_modules) { 322 CONFerr(CONF_F_MODULE_INIT, ERR_R_MALLOC_FAILURE); 323 goto err; 324 } 325 } 326 327 if (!sk_CONF_IMODULE_push(initialized_modules, imod)) { 328 CONFerr(CONF_F_MODULE_INIT, ERR_R_MALLOC_FAILURE); 329 goto err; 330 } 331 332 pmod->links++; 333 334 return ret; 335 336 err: 337 338 /* We've started the module so we'd better finish it */ 339 if (pmod->finish && init_called) 340 pmod->finish(imod); 341 342 memerr: 343 if (imod) { 344 OPENSSL_free(imod->name); 345 OPENSSL_free(imod->value); 346 OPENSSL_free(imod); 347 } 348 349 return -1; 350 351 } 352 353 /* 354 * Unload any dynamic modules that have a link count of zero: i.e. have no 355 * active initialized modules. If 'all' is set then all modules are unloaded 356 * including static ones. 357 */ 358 359 void CONF_modules_unload(int all) 360 { 361 int i; 362 CONF_MODULE *md; 363 CONF_modules_finish(); 364 /* unload modules in reverse order */ 365 for (i = sk_CONF_MODULE_num(supported_modules) - 1; i >= 0; i--) { 366 md = sk_CONF_MODULE_value(supported_modules, i); 367 /* If static or in use and 'all' not set ignore it */ 368 if (((md->links > 0) || !md->dso) && !all) 369 continue; 370 /* Since we're working in reverse this is OK */ 371 (void)sk_CONF_MODULE_delete(supported_modules, i); 372 module_free(md); 373 } 374 if (sk_CONF_MODULE_num(supported_modules) == 0) { 375 sk_CONF_MODULE_free(supported_modules); 376 supported_modules = NULL; 377 } 378 } 379 380 /* unload a single module */ 381 static void module_free(CONF_MODULE *md) 382 { 383 DSO_free(md->dso); 384 OPENSSL_free(md->name); 385 OPENSSL_free(md); 386 } 387 388 /* finish and free up all modules instances */ 389 390 void CONF_modules_finish(void) 391 { 392 CONF_IMODULE *imod; 393 while (sk_CONF_IMODULE_num(initialized_modules) > 0) { 394 imod = sk_CONF_IMODULE_pop(initialized_modules); 395 module_finish(imod); 396 } 397 sk_CONF_IMODULE_free(initialized_modules); 398 initialized_modules = NULL; 399 } 400 401 /* finish a module instance */ 402 403 static void module_finish(CONF_IMODULE *imod) 404 { 405 if (!imod) 406 return; 407 if (imod->pmod->finish) 408 imod->pmod->finish(imod); 409 imod->pmod->links--; 410 OPENSSL_free(imod->name); 411 OPENSSL_free(imod->value); 412 OPENSSL_free(imod); 413 } 414 415 /* Add a static module to OpenSSL */ 416 417 int CONF_module_add(const char *name, conf_init_func *ifunc, 418 conf_finish_func *ffunc) 419 { 420 if (module_add(NULL, name, ifunc, ffunc)) 421 return 1; 422 else 423 return 0; 424 } 425 426 void conf_modules_free_int(void) 427 { 428 CONF_modules_finish(); 429 CONF_modules_unload(1); 430 } 431 432 /* Utility functions */ 433 434 const char *CONF_imodule_get_name(const CONF_IMODULE *md) 435 { 436 return md->name; 437 } 438 439 const char *CONF_imodule_get_value(const CONF_IMODULE *md) 440 { 441 return md->value; 442 } 443 444 void *CONF_imodule_get_usr_data(const CONF_IMODULE *md) 445 { 446 return md->usr_data; 447 } 448 449 void CONF_imodule_set_usr_data(CONF_IMODULE *md, void *usr_data) 450 { 451 md->usr_data = usr_data; 452 } 453 454 CONF_MODULE *CONF_imodule_get_module(const CONF_IMODULE *md) 455 { 456 return md->pmod; 457 } 458 459 unsigned long CONF_imodule_get_flags(const CONF_IMODULE *md) 460 { 461 return md->flags; 462 } 463 464 void CONF_imodule_set_flags(CONF_IMODULE *md, unsigned long flags) 465 { 466 md->flags = flags; 467 } 468 469 void *CONF_module_get_usr_data(CONF_MODULE *pmod) 470 { 471 return pmod->usr_data; 472 } 473 474 void CONF_module_set_usr_data(CONF_MODULE *pmod, void *usr_data) 475 { 476 pmod->usr_data = usr_data; 477 } 478 479 /* Return default config file name */ 480 481 char *CONF_get1_default_config_file(void) 482 { 483 char *file, *sep = ""; 484 int len; 485 486 if ((file = ossl_safe_getenv("OPENSSL_CONF")) != NULL) 487 return OPENSSL_strdup(file); 488 489 len = strlen(X509_get_default_cert_area()); 490 #ifndef OPENSSL_SYS_VMS 491 len++; 492 sep = "/"; 493 #endif 494 len += strlen(OPENSSL_CONF); 495 496 file = OPENSSL_malloc(len + 1); 497 498 if (file == NULL) 499 return NULL; 500 BIO_snprintf(file, len + 1, "%s%s%s", X509_get_default_cert_area(), 501 sep, OPENSSL_CONF); 502 503 return file; 504 } 505 506 /* 507 * This function takes a list separated by 'sep' and calls the callback 508 * function giving the start and length of each member optionally stripping 509 * leading and trailing whitespace. This can be used to parse comma separated 510 * lists for example. 511 */ 512 513 int CONF_parse_list(const char *list_, int sep, int nospc, 514 int (*list_cb) (const char *elem, int len, void *usr), 515 void *arg) 516 { 517 int ret; 518 const char *lstart, *tmpend, *p; 519 520 if (list_ == NULL) { 521 CONFerr(CONF_F_CONF_PARSE_LIST, CONF_R_LIST_CANNOT_BE_NULL); 522 return 0; 523 } 524 525 lstart = list_; 526 for (;;) { 527 if (nospc) { 528 while (*lstart && isspace((unsigned char)*lstart)) 529 lstart++; 530 } 531 p = strchr(lstart, sep); 532 if (p == lstart || !*lstart) 533 ret = list_cb(NULL, 0, arg); 534 else { 535 if (p) 536 tmpend = p - 1; 537 else 538 tmpend = lstart + strlen(lstart) - 1; 539 if (nospc) { 540 while (isspace((unsigned char)*tmpend)) 541 tmpend--; 542 } 543 ret = list_cb(lstart, tmpend - lstart + 1, arg); 544 } 545 if (ret <= 0) 546 return ret; 547 if (p == NULL) 548 return 1; 549 lstart = p + 1; 550 } 551 } 552