zzy/openssl
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
openssl/crypto/provider_conf.c
Neil Horman 506ff20662 Make the activate setting more intuitive 
Currently, a provider is activated from our config file using the
activate parameter.  However, the presence of the config parameter is
sufficient to trigger activation, leading to a counterintuitive
situation in which setting "activate = 0" still activates the provider

Make activation more intuitive by requiring that activate be set to one
of yes|true|1 to trigger activation.  Any other value, as well as
omitting the parameter entirely, prevents activation (and also maintains
backward compatibility.

It seems a bit heavyweight to create a test specifically to validate the
plurality of these settings.  Instead, modify the exiting openssl config
files in the test directory to use variants of these settings, and
augment the default.cnf file to include a provider section that is
explicitly disabled

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com>
Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/22906)
2023-12-21 09:22:40 -05:00

344 lines
11 KiB
C
Raw Blame History

/*
* Copyright 2019-2023 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
* in the file LICENSE in the source distribution or at
* https://www.openssl.org/source/license.html
*/
#include <string.h>
#include <openssl/trace.h>
#include <openssl/err.h>
#include <openssl/conf.h>
#include <openssl/safestack.h>
#include <openssl/provider.h>
#include "internal/provider.h"
#include "internal/cryptlib.h"
#include "provider_local.h"
#include "crypto/context.h"
DEFINE_STACK_OF(OSSL_PROVIDER)
/* PROVIDER config module */
typedef struct {
CRYPTO_RWLOCK *lock;
STACK_OF(OSSL_PROVIDER) *activated_providers;
} PROVIDER_CONF_GLOBAL;
void *ossl_prov_conf_ctx_new(OSSL_LIB_CTX *libctx)
{
PROVIDER_CONF_GLOBAL *pcgbl = OPENSSL_zalloc(sizeof(*pcgbl));
if (pcgbl == NULL)
return NULL;
pcgbl->lock = CRYPTO_THREAD_lock_new();
if (pcgbl->lock == NULL) {
OPENSSL_free(pcgbl);
return NULL;
}
return pcgbl;
}
void ossl_prov_conf_ctx_free(void *vpcgbl)
{
PROVIDER_CONF_GLOBAL *pcgbl = vpcgbl;
sk_OSSL_PROVIDER_pop_free(pcgbl->activated_providers,
ossl_provider_free);
OSSL_TRACE(CONF, "Cleaned up providers\n");
CRYPTO_THREAD_lock_free(pcgbl->lock);
OPENSSL_free(pcgbl);
}
static const char *skip_dot(const char *name)
{
const char *p = strchr(name, '.');
if (p != NULL)
return p + 1;
return name;
}
static int provider_conf_params(OSSL_PROVIDER *prov,
OSSL_PROVIDER_INFO *provinfo,
const char *name, const char *value,
const CONF *cnf)
{
STACK_OF(CONF_VALUE) *sect;
int ok = 1;
sect = NCONF_get_section(cnf, value);
if (sect != NULL) {
int i;
char buffer[512];
size_t buffer_len = 0;
OSSL_TRACE1(CONF, "Provider params: start section %s\n", value);
if (name != NULL) {
OPENSSL_strlcpy(buffer, name, sizeof(buffer));
OPENSSL_strlcat(buffer, ".", sizeof(buffer));
buffer_len = strlen(buffer);
}
for (i = 0; i < sk_CONF_VALUE_num(sect); i++) {
CONF_VALUE *sectconf = sk_CONF_VALUE_value(sect, i);
if (buffer_len + strlen(sectconf->name) >= sizeof(buffer))
return 0;
buffer[buffer_len] = '\0';
OPENSSL_strlcat(buffer, sectconf->name, sizeof(buffer));
if (!provider_conf_params(prov, provinfo, buffer, sectconf->value,
cnf))
return 0;
}
OSSL_TRACE1(CONF, "Provider params: finish section %s\n", value);
} else {
OSSL_TRACE2(CONF, "Provider params: %s = %s\n", name, value);
if (prov != NULL)
ok = ossl_provider_add_parameter(prov, name, value);
else
ok = ossl_provider_info_add_parameter(provinfo, name, value);
}
return ok;
}
static int prov_already_activated(const char *name,
STACK_OF(OSSL_PROVIDER) *activated)
{
int i, max;
if (activated == NULL)
return 0;
max = sk_OSSL_PROVIDER_num(activated);
for (i = 0; i < max; i++) {
OSSL_PROVIDER *tstprov = sk_OSSL_PROVIDER_value(activated, i);
if (strcmp(OSSL_PROVIDER_get0_name(tstprov), name) == 0) {
return 1;
}
}
return 0;
}
static int provider_conf_activate(OSSL_LIB_CTX *libctx, const char *name,
const char *value, const char *path,
int soft, const CONF *cnf)
{
PROVIDER_CONF_GLOBAL *pcgbl
= ossl_lib_ctx_get_data(libctx, OSSL_LIB_CTX_PROVIDER_CONF_INDEX);
OSSL_PROVIDER *prov = NULL, *actual = NULL;
int ok = 0;
if (pcgbl == NULL || !CRYPTO_THREAD_write_lock(pcgbl->lock)) {
ERR_raise(ERR_LIB_CRYPTO, ERR_R_INTERNAL_ERROR);
return 0;
}
if (!prov_already_activated(name, pcgbl->activated_providers)) {
/*
* There is an attempt to activate a provider, so we should disable
* loading of fallbacks. Otherwise a misconfiguration could mean the
* intended provider does not get loaded. Subsequent fetches could
* then fallback to the default provider - which may be the wrong
* thing.
*/
if (!ossl_provider_disable_fallback_loading(libctx)) {
CRYPTO_THREAD_unlock(pcgbl->lock);
ERR_raise(ERR_LIB_CRYPTO, ERR_R_INTERNAL_ERROR);
return 0;
}
prov = ossl_provider_find(libctx, name, 1);
if (prov == NULL)
prov = ossl_provider_new(libctx, name, NULL, NULL, 1);
if (prov == NULL) {
CRYPTO_THREAD_unlock(pcgbl->lock);
if (soft)
ERR_clear_error();
return 0;
}
if (path != NULL)
ossl_provider_set_module_path(prov, path);
ok = provider_conf_params(prov, NULL, NULL, value, cnf);
if (ok) {
if (!ossl_provider_activate(prov, 1, 0)) {
ok = 0;
} else if (!ossl_provider_add_to_store(prov, &actual, 0)) {
ossl_provider_deactivate(prov, 1);
ok = 0;
} else if (actual != prov
&& !ossl_provider_activate(actual, 1, 0)) {
ossl_provider_free(actual);
ok = 0;
} else {
if (pcgbl->activated_providers == NULL)
pcgbl->activated_providers = sk_OSSL_PROVIDER_new_null();
if (pcgbl->activated_providers == NULL
|| !sk_OSSL_PROVIDER_push(pcgbl->activated_providers,
actual)) {
ossl_provider_deactivate(actual, 1);
ossl_provider_free(actual);
ok = 0;
} else {
ok = 1;
}
}
}
if (!ok)
ossl_provider_free(prov);
}
CRYPTO_THREAD_unlock(pcgbl->lock);
return ok;
}
static int provider_conf_load(OSSL_LIB_CTX *libctx, const char *name,
const char *value, const CONF *cnf)
{
int i;
STACK_OF(CONF_VALUE) *ecmds;
int soft = 0;
const char *path = NULL;
long activate = 0;
int ok = 0;
name = skip_dot(name);
OSSL_TRACE1(CONF, "Configuring provider %s\n", name);
/* Value is a section containing PROVIDER commands */
ecmds = NCONF_get_section(cnf, value);
if (!ecmds) {
ERR_raise_data(ERR_LIB_CRYPTO, CRYPTO_R_PROVIDER_SECTION_ERROR,
"section=%s not found", value);
return 0;
}
/* Find the needed data first */
for (i = 0; i < sk_CONF_VALUE_num(ecmds); i++) {
CONF_VALUE *ecmd = sk_CONF_VALUE_value(ecmds, i);
const char *confname = skip_dot(ecmd->name);
const char *confvalue = ecmd->value;
OSSL_TRACE2(CONF, "Provider command: %s = %s\n",
confname, confvalue);
/* First handle some special pseudo confs */
/* Override provider name to use */
if (strcmp(confname, "identity") == 0) {
name = confvalue;
} else if (strcmp(confname, "soft_load") == 0) {
soft = 1;
/* Load a dynamic PROVIDER */
} else if (strcmp(confname, "module") == 0) {
path = confvalue;
} else if (strcmp(confname, "activate") == 0) {
if (confvalue == NULL) {
ERR_raise_data(ERR_LIB_CRYPTO, CRYPTO_R_PROVIDER_SECTION_ERROR,
"section=%s activate set to unrecognized value",
value);
return 0;
}
if ((strcmp(confvalue, "1") == 0)
|| (strcmp(confvalue, "yes") == 0)
|| (strcmp(confvalue, "YES") == 0)
|| (strcmp(confvalue, "true") == 0)
|| (strcmp(confvalue, "TRUE") == 0)
|| (strcmp(confvalue, "on") == 0)
|| (strcmp(confvalue, "ON") == 0)) {
activate = 1;
} else if ((strcmp(confvalue, "0") == 0)
|| (strcmp(confvalue, "no") == 0)
|| (strcmp(confvalue, "NO") == 0)
|| (strcmp(confvalue, "false") == 0)
|| (strcmp(confvalue, "FALSE") == 0)
|| (strcmp(confvalue, "off") == 0)
|| (strcmp(confvalue, "OFF") == 0)) {
activate = 0;
} else {
ERR_raise_data(ERR_LIB_CRYPTO, CRYPTO_R_PROVIDER_SECTION_ERROR,
"section=%s activate set to unrecognized value",
value);
return 0;
}
}
}
if (activate) {
ok = provider_conf_activate(libctx, name, value, path, soft, cnf);
} else {
OSSL_PROVIDER_INFO entry;
memset(&entry, 0, sizeof(entry));
ok = 1;
if (name != NULL) {
entry.name = OPENSSL_strdup(name);
if (entry.name == NULL)
ok = 0;
}
if (ok && path != NULL) {
entry.path = OPENSSL_strdup(path);
if (entry.path == NULL)
ok = 0;
}
if (ok)
ok = provider_conf_params(NULL, &entry, NULL, value, cnf);
if (ok && (entry.path != NULL || entry.parameters != NULL))
ok = ossl_provider_info_add_to_store(libctx, &entry);
if (!ok || (entry.path == NULL && entry.parameters == NULL)) {
ossl_provider_info_clear(&entry);
}
}
/*
* Even if ok is 0, we still return success. Failure to load a provider is
* not fatal. We want to continue to load the rest of the config file.
*/
return 1;
}
static int provider_conf_init(CONF_IMODULE *md, const CONF *cnf)
{
STACK_OF(CONF_VALUE) *elist;
CONF_VALUE *cval;
int i;
OSSL_TRACE1(CONF, "Loading providers module: section %s\n",
CONF_imodule_get_value(md));
/* Value is a section containing PROVIDERs to configure */
elist = NCONF_get_section(cnf, CONF_imodule_get_value(md));
if (!elist) {
ERR_raise(ERR_LIB_CRYPTO, CRYPTO_R_PROVIDER_SECTION_ERROR);
return 0;
}
for (i = 0; i < sk_CONF_VALUE_num(elist); i++) {
cval = sk_CONF_VALUE_value(elist, i);
if (!provider_conf_load(NCONF_get0_libctx((CONF *)cnf),
cval->name, cval->value, cnf))
return 0;
}
return 1;
}
void ossl_provider_add_conf_module(void)
{
OSSL_TRACE(CONF, "Adding config module 'providers'\n");
CONF_module_add("providers", provider_conf_init, NULL);
}
Reference in New Issue View Git Blame Copy Permalink