diff options
Diffstat (limited to 'crypto/conf/conf_mod.c')
| -rw-r--r-- | crypto/conf/conf_mod.c | 280 |
1 files changed, 211 insertions, 69 deletions
diff --git a/crypto/conf/conf_mod.c b/crypto/conf/conf_mod.c index e703d97f5451..17bbbf7a2747 100644 --- a/crypto/conf/conf_mod.c +++ b/crypto/conf/conf_mod.c @@ -1,19 +1,30 @@ /* - * Copyright 2002-2019 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2002-2022 The OpenSSL Project Authors. All Rights Reserved. * - * Licensed under the OpenSSL license (the "License"). You may not use + * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy * in the file LICENSE in the source distribution or at * https://www.openssl.org/source/license.html */ +/* We need to use some engine deprecated APIs */ +#define OPENSSL_SUPPRESS_DEPRECATED + #include "internal/cryptlib.h" #include <stdio.h> #include <ctype.h> #include <openssl/crypto.h> #include "internal/conf.h" +#include <openssl/conf_api.h> #include "internal/dso.h" +#include "internal/thread_once.h" #include <openssl/x509.h> +#include <openssl/trace.h> +#include <openssl/engine.h> +#include "conf_local.h" + +DEFINE_STACK_OF(CONF_MODULE) +DEFINE_STACK_OF(CONF_IMODULE) #define DSO_mod_init_name "OPENSSL_init" #define DSO_mod_finish_name "OPENSSL_finish" @@ -51,8 +62,12 @@ struct conf_imodule_st { void *usr_data; }; -static STACK_OF(CONF_MODULE) *supported_modules = NULL; -static STACK_OF(CONF_IMODULE) *initialized_modules = NULL; +static CRYPTO_ONCE init_module_list_lock = CRYPTO_ONCE_STATIC_INIT; +static CRYPTO_RWLOCK *module_list_lock = NULL; +static STACK_OF(CONF_MODULE) *supported_modules = NULL; /* protected by lock */ +static STACK_OF(CONF_IMODULE) *initialized_modules = NULL; /* protected by lock */ + +static CRYPTO_ONCE load_builtin_modules = CRYPTO_ONCE_STATIC_INIT; static void module_free(CONF_MODULE *md); static void module_finish(CONF_IMODULE *imod); @@ -67,6 +82,36 @@ static int module_init(CONF_MODULE *pmod, const char *name, const char *value, static CONF_MODULE *module_load_dso(const CONF *cnf, const char *name, const char *value); +static int conf_modules_finish_int(void); + +static void module_lists_free(void) +{ + CRYPTO_THREAD_lock_free(module_list_lock); + module_list_lock = NULL; + + sk_CONF_MODULE_free(supported_modules); + supported_modules = NULL; + + sk_CONF_IMODULE_free(initialized_modules); + initialized_modules = NULL; +} + +DEFINE_RUN_ONCE_STATIC(do_init_module_list_lock) +{ + module_list_lock = CRYPTO_THREAD_lock_new(); + if (module_list_lock == NULL) { + ERR_raise(ERR_LIB_CONF, ERR_R_MALLOC_FAILURE); + return 0; + } + + return 1; +} + +static int conf_diagnostics(const CONF *cnf) +{ + return _CONF_get_number(cnf, NULL, "config_diagnostics") != 0; +} + /* Main function: load modules from a CONF structure */ int CONF_modules_load(const CONF *cnf, const char *appname, @@ -75,12 +120,18 @@ int CONF_modules_load(const CONF *cnf, const char *appname, STACK_OF(CONF_VALUE) *values; CONF_VALUE *vl; char *vsection = NULL; - int ret, i; if (!cnf) return 1; + if (conf_diagnostics(cnf)) + flags &= ~(CONF_MFLAGS_IGNORE_ERRORS + | CONF_MFLAGS_IGNORE_RETURN_CODES + | CONF_MFLAGS_SILENT + | CONF_MFLAGS_IGNORE_MISSING_FILE); + + ERR_set_mark(); if (appname) vsection = NCONF_get_string(cnf, NULL, appname); @@ -88,72 +139,116 @@ int CONF_modules_load(const CONF *cnf, const char *appname, vsection = NCONF_get_string(cnf, NULL, "openssl_conf"); if (!vsection) { - ERR_clear_error(); + ERR_pop_to_mark(); return 1; } + OSSL_TRACE1(CONF, "Configuration in section %s\n", vsection); values = NCONF_get_section(cnf, vsection); - if (!values) + if (values == NULL) { + if (!(flags & CONF_MFLAGS_SILENT)) { + ERR_clear_last_mark(); + ERR_raise_data(ERR_LIB_CONF, + CONF_R_OPENSSL_CONF_REFERENCES_MISSING_SECTION, + "openssl_conf=%s", vsection); + } else { + ERR_pop_to_mark(); + } return 0; + } + ERR_pop_to_mark(); for (i = 0; i < sk_CONF_VALUE_num(values); i++) { vl = sk_CONF_VALUE_value(values, i); + ERR_set_mark(); ret = module_run(cnf, vl->name, vl->value, flags); + OSSL_TRACE3(CONF, "Running module %s (%s) returned %d\n", + vl->name, vl->value, ret); if (ret <= 0) - if (!(flags & CONF_MFLAGS_IGNORE_ERRORS)) + if (!(flags & CONF_MFLAGS_IGNORE_ERRORS)) { + ERR_clear_last_mark(); return ret; + } + ERR_pop_to_mark(); } return 1; } -int CONF_modules_load_file(const char *filename, const char *appname, - unsigned long flags) +int CONF_modules_load_file_ex(OSSL_LIB_CTX *libctx, const char *filename, + const char *appname, unsigned long flags) { char *file = NULL; CONF *conf = NULL; - int ret = 0; - conf = NCONF_new(NULL); - if (conf == NULL) - goto err; + int ret = 0, diagnostics = 0; if (filename == NULL) { file = CONF_get1_default_config_file(); - if (!file) + if (file == NULL) goto err; - } else + } else { file = (char *)filename; + } + + ERR_set_mark(); + conf = NCONF_new_ex(libctx, NULL); + if (conf == NULL) + goto err; if (NCONF_load(conf, file, NULL) <= 0) { if ((flags & CONF_MFLAGS_IGNORE_MISSING_FILE) && (ERR_GET_REASON(ERR_peek_last_error()) == CONF_R_NO_SUCH_FILE)) { - ERR_clear_error(); ret = 1; } goto err; } ret = CONF_modules_load(conf, appname, flags); + diagnostics = conf_diagnostics(conf); err: if (filename == NULL) OPENSSL_free(file); NCONF_free(conf); - if (flags & CONF_MFLAGS_IGNORE_RETURN_CODES) - return 1; + if ((flags & CONF_MFLAGS_IGNORE_RETURN_CODES) != 0 && !diagnostics) + ret = 1; + + if (ret > 0) + ERR_pop_to_mark(); + else + ERR_clear_last_mark(); return ret; } +int CONF_modules_load_file(const char *filename, + const char *appname, unsigned long flags) +{ + return CONF_modules_load_file_ex(NULL, filename, appname, flags); +} + +DEFINE_RUN_ONCE_STATIC(do_load_builtin_modules) +{ + OPENSSL_load_builtin_modules(); +#ifndef OPENSSL_NO_ENGINE + /* Need to load ENGINEs */ + ENGINE_load_builtin_engines(); +#endif + return 1; +} + static int module_run(const CONF *cnf, const char *name, const char *value, unsigned long flags) { CONF_MODULE *md; int ret; + if (!RUN_ONCE(&load_builtin_modules, do_load_builtin_modules)) + return -1; + md = module_find(name); /* Module not found: try to load DSO */ @@ -162,8 +257,8 @@ static int module_run(const CONF *cnf, const char *name, const char *value, if (!md) { if (!(flags & CONF_MFLAGS_SILENT)) { - CONFerr(CONF_F_MODULE_RUN, CONF_R_UNKNOWN_MODULE_NAME); - ERR_add_error_data(2, "module=", name); + ERR_raise_data(ERR_LIB_CONF, CONF_R_UNKNOWN_MODULE_NAME, + "module=%s", name); } return -1; } @@ -171,14 +266,10 @@ static int module_run(const CONF *cnf, const char *name, const char *value, ret = module_init(md, name, value, cnf); if (ret <= 0) { - if (!(flags & CONF_MFLAGS_SILENT)) { - char rcode[DECIMAL_SIZE(ret) + 1]; - - CONFerr(CONF_F_MODULE_RUN, CONF_R_MODULE_INITIALIZATION_ERROR); - BIO_snprintf(rcode, sizeof(rcode), "%-8d", ret); - ERR_add_error_data(6, "module=", name, ", value=", value, - ", retcode=", rcode); - } + if (!(flags & CONF_MFLAGS_SILENT)) + ERR_raise_data(ERR_LIB_CONF, CONF_R_MODULE_INITIALIZATION_ERROR, + "module=%s, value=%s retcode=%-8d", + name, value, ret); } return ret; @@ -194,19 +285,19 @@ static CONF_MODULE *module_load_dso(const CONF *cnf, const char *path = NULL; int errcode = 0; CONF_MODULE *md; + /* Look for alternative path in module section */ - path = NCONF_get_string(cnf, value, "path"); - if (!path) { - ERR_clear_error(); + path = _CONF_get_string(cnf, value, "path"); + if (path == NULL) { path = name; } dso = DSO_load(NULL, path, NULL, 0); - if (!dso) { + if (dso == NULL) { errcode = CONF_R_ERROR_LOADING_DSO; goto err; } ifunc = (conf_init_func *)DSO_bind_func(dso, DSO_mod_init_name); - if (!ifunc) { + if (ifunc == NULL) { errcode = CONF_R_MISSING_INIT_FUNCTION; goto err; } @@ -214,15 +305,14 @@ static CONF_MODULE *module_load_dso(const CONF *cnf, /* All OK, add module */ md = module_add(dso, name, ifunc, ffunc); - if (!md) + if (md == NULL) goto err; return md; err: DSO_free(dso); - CONFerr(CONF_F_MODULE_LOAD_DSO, errcode); - ERR_add_error_data(4, "module=", name, ", path=", path); + ERR_raise_data(ERR_LIB_CONF, errcode, "module=%s, path=%s", name, path); return NULL; } @@ -231,31 +321,42 @@ static CONF_MODULE *module_add(DSO *dso, const char *name, conf_init_func *ifunc, conf_finish_func *ffunc) { CONF_MODULE *tmod = NULL; + + if (!RUN_ONCE(&init_module_list_lock, do_init_module_list_lock)) + return NULL; + + if (!CRYPTO_THREAD_write_lock(module_list_lock)) + return NULL; + if (supported_modules == NULL) supported_modules = sk_CONF_MODULE_new_null(); if (supported_modules == NULL) - return NULL; + goto err; if ((tmod = OPENSSL_zalloc(sizeof(*tmod))) == NULL) { - CONFerr(CONF_F_MODULE_ADD, ERR_R_MALLOC_FAILURE); - return NULL; + ERR_raise(ERR_LIB_CONF, ERR_R_MALLOC_FAILURE); + goto err; } tmod->dso = dso; tmod->name = OPENSSL_strdup(name); tmod->init = ifunc; tmod->finish = ffunc; - if (tmod->name == NULL) { - OPENSSL_free(tmod); - return NULL; - } + if (tmod->name == NULL) + goto err; + + if (!sk_CONF_MODULE_push(supported_modules, tmod)) + goto err; - if (!sk_CONF_MODULE_push(supported_modules, tmod)) { + CRYPTO_THREAD_unlock(module_list_lock); + return tmod; + + err: + CRYPTO_THREAD_unlock(module_list_lock); + if (tmod != NULL) { OPENSSL_free(tmod->name); OPENSSL_free(tmod); - return NULL; } - - return tmod; + return NULL; } /* @@ -276,14 +377,22 @@ static CONF_MODULE *module_find(const char *name) else nchar = strlen(name); + if (!RUN_ONCE(&init_module_list_lock, do_init_module_list_lock)) + return NULL; + + if (!CRYPTO_THREAD_read_lock(module_list_lock)) + return NULL; + for (i = 0; i < sk_CONF_MODULE_num(supported_modules); i++) { tmod = sk_CONF_MODULE_value(supported_modules, i); - if (strncmp(tmod->name, name, nchar) == 0) + if (strncmp(tmod->name, name, nchar) == 0) { + CRYPTO_THREAD_unlock(module_list_lock); return tmod; + } } + CRYPTO_THREAD_unlock(module_list_lock); return NULL; - } /* initialize a module */ @@ -316,21 +425,30 @@ static int module_init(CONF_MODULE *pmod, const char *name, const char *value, goto err; } + if (!RUN_ONCE(&init_module_list_lock, do_init_module_list_lock)) + goto err; + + if (!CRYPTO_THREAD_write_lock(module_list_lock)) + goto err; + if (initialized_modules == NULL) { initialized_modules = sk_CONF_IMODULE_new_null(); - if (!initialized_modules) { - CONFerr(CONF_F_MODULE_INIT, ERR_R_MALLOC_FAILURE); + if (initialized_modules == NULL) { + CRYPTO_THREAD_unlock(module_list_lock); + ERR_raise(ERR_LIB_CONF, ERR_R_MALLOC_FAILURE); goto err; } } if (!sk_CONF_IMODULE_push(initialized_modules, imod)) { - CONFerr(CONF_F_MODULE_INIT, ERR_R_MALLOC_FAILURE); + CRYPTO_THREAD_unlock(module_list_lock); + ERR_raise(ERR_LIB_CONF, ERR_R_MALLOC_FAILURE); goto err; } pmod->links++; + CRYPTO_THREAD_unlock(module_list_lock); return ret; err: @@ -360,7 +478,13 @@ void CONF_modules_unload(int all) { int i; CONF_MODULE *md; - CONF_modules_finish(); + + if (!conf_modules_finish_int()) /* also inits module list lock */ + return; + + if (!CRYPTO_THREAD_write_lock(module_list_lock)) + return; + /* unload modules in reverse order */ for (i = sk_CONF_MODULE_num(supported_modules) - 1; i >= 0; i--) { md = sk_CONF_MODULE_value(supported_modules, i); @@ -371,10 +495,13 @@ void CONF_modules_unload(int all) (void)sk_CONF_MODULE_delete(supported_modules, i); module_free(md); } + if (sk_CONF_MODULE_num(supported_modules) == 0) { sk_CONF_MODULE_free(supported_modules); supported_modules = NULL; } + + CRYPTO_THREAD_unlock(module_list_lock); } /* unload a single module */ @@ -387,15 +514,33 @@ static void module_free(CONF_MODULE *md) /* finish and free up all modules instances */ -void CONF_modules_finish(void) +static int conf_modules_finish_int(void) { CONF_IMODULE *imod; + + if (!RUN_ONCE(&init_module_list_lock, do_init_module_list_lock)) + return 0; + + /* If module_list_lock is NULL here it means we were already unloaded */ + if (module_list_lock == NULL + || !CRYPTO_THREAD_write_lock(module_list_lock)) + return 0; + while (sk_CONF_IMODULE_num(initialized_modules) > 0) { imod = sk_CONF_IMODULE_pop(initialized_modules); module_finish(imod); } sk_CONF_IMODULE_free(initialized_modules); initialized_modules = NULL; + + CRYPTO_THREAD_unlock(module_list_lock); + + return 1; +} + +void CONF_modules_finish(void) +{ + conf_modules_finish_int(); } /* finish a module instance */ @@ -423,10 +568,10 @@ int CONF_module_add(const char *name, conf_init_func *ifunc, return 0; } -void conf_modules_free_int(void) +void ossl_config_modules_free(void) { - CONF_modules_finish(); - CONF_modules_unload(1); + CONF_modules_unload(1); /* calls CONF_modules_finish */ + module_lists_free(); } /* Utility functions */ @@ -477,28 +622,25 @@ void CONF_module_set_usr_data(CONF_MODULE *pmod, void *usr_data) } /* Return default config file name */ - char *CONF_get1_default_config_file(void) { + const char *t; char *file, *sep = ""; - int len; + size_t size; if ((file = ossl_safe_getenv("OPENSSL_CONF")) != NULL) return OPENSSL_strdup(file); - len = strlen(X509_get_default_cert_area()); + t = X509_get_default_cert_area(); #ifndef OPENSSL_SYS_VMS - len++; sep = "/"; #endif - len += strlen(OPENSSL_CONF); - - file = OPENSSL_malloc(len + 1); + size = strlen(t) + strlen(sep) + strlen(OPENSSL_CONF) + 1; + file = OPENSSL_malloc(size); if (file == NULL) return NULL; - BIO_snprintf(file, len + 1, "%s%s%s", X509_get_default_cert_area(), - sep, OPENSSL_CONF); + BIO_snprintf(file, size, "%s%s%s", t, sep, OPENSSL_CONF); return file; } @@ -518,7 +660,7 @@ int CONF_parse_list(const char *list_, int sep, int nospc, const char *lstart, *tmpend, *p; if (list_ == NULL) { - CONFerr(CONF_F_CONF_PARSE_LIST, CONF_R_LIST_CANNOT_BE_NULL); + ERR_raise(ERR_LIB_CONF, CONF_R_LIST_CANNOT_BE_NULL); return 0; } @@ -529,7 +671,7 @@ int CONF_parse_list(const char *list_, int sep, int nospc, lstart++; } p = strchr(lstart, sep); - if (p == lstart || !*lstart) + if (p == lstart || *lstart == '\0') ret = list_cb(NULL, 0, arg); else { if (p) |