ssl_conf.c 35 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118
  1. /*
  2. * Copyright 2012-2023 The OpenSSL Project Authors. All Rights Reserved.
  3. *
  4. * Licensed under the Apache License 2.0 (the "License"). You may not use
  5. * this file except in compliance with the License. You can obtain a copy
  6. * in the file LICENSE in the source distribution or at
  7. * https://www.openssl.org/source/license.html
  8. */
  9. #include <stdio.h>
  10. #include "ssl_local.h"
  11. #include <openssl/conf.h>
  12. #include <openssl/objects.h>
  13. #include <openssl/decoder.h>
  14. #include <openssl/core_dispatch.h>
  15. #include "internal/nelem.h"
  16. /*
  17. * structure holding name tables. This is used for permitted elements in lists
  18. * such as TLSv1.
  19. */
  20. typedef struct {
  21. const char *name;
  22. int namelen;
  23. unsigned int name_flags;
  24. uint64_t option_value;
  25. } ssl_flag_tbl;
  26. /* Switch table: use for single command line switches like no_tls2 */
  27. typedef struct {
  28. uint64_t option_value;
  29. unsigned int name_flags;
  30. } ssl_switch_tbl;
  31. /* Sense of name is inverted e.g. "TLSv1" will clear SSL_OP_NO_TLSv1 */
  32. #define SSL_TFLAG_INV 0x1
  33. /* Mask for type of flag referred to */
  34. #define SSL_TFLAG_TYPE_MASK 0xf00
  35. /* Flag is for options */
  36. #define SSL_TFLAG_OPTION 0x000
  37. /* Flag is for cert_flags */
  38. #define SSL_TFLAG_CERT 0x100
  39. /* Flag is for verify mode */
  40. #define SSL_TFLAG_VFY 0x200
  41. /* Option can only be used for clients */
  42. #define SSL_TFLAG_CLIENT SSL_CONF_FLAG_CLIENT
  43. /* Option can only be used for servers */
  44. #define SSL_TFLAG_SERVER SSL_CONF_FLAG_SERVER
  45. #define SSL_TFLAG_BOTH (SSL_TFLAG_CLIENT|SSL_TFLAG_SERVER)
  46. #define SSL_FLAG_TBL(str, flag) \
  47. {str, (int)(sizeof(str) - 1), SSL_TFLAG_BOTH, flag}
  48. #define SSL_FLAG_TBL_SRV(str, flag) \
  49. {str, (int)(sizeof(str) - 1), SSL_TFLAG_SERVER, flag}
  50. #define SSL_FLAG_TBL_CLI(str, flag) \
  51. {str, (int)(sizeof(str) - 1), SSL_TFLAG_CLIENT, flag}
  52. #define SSL_FLAG_TBL_INV(str, flag) \
  53. {str, (int)(sizeof(str) - 1), SSL_TFLAG_INV|SSL_TFLAG_BOTH, flag}
  54. #define SSL_FLAG_TBL_SRV_INV(str, flag) \
  55. {str, (int)(sizeof(str) - 1), SSL_TFLAG_INV|SSL_TFLAG_SERVER, flag}
  56. #define SSL_FLAG_TBL_CERT(str, flag) \
  57. {str, (int)(sizeof(str) - 1), SSL_TFLAG_CERT|SSL_TFLAG_BOTH, flag}
  58. #define SSL_FLAG_VFY_CLI(str, flag) \
  59. {str, (int)(sizeof(str) - 1), SSL_TFLAG_VFY | SSL_TFLAG_CLIENT, flag}
  60. #define SSL_FLAG_VFY_SRV(str, flag) \
  61. {str, (int)(sizeof(str) - 1), SSL_TFLAG_VFY | SSL_TFLAG_SERVER, flag}
  62. /*
  63. * Opaque structure containing SSL configuration context.
  64. */
  65. struct ssl_conf_ctx_st {
  66. /*
  67. * Various flags indicating (among other things) which options we will
  68. * recognise.
  69. */
  70. unsigned int flags;
  71. /* Prefix and length of commands */
  72. char *prefix;
  73. size_t prefixlen;
  74. /* SSL_CTX or SSL structure to perform operations on */
  75. SSL_CTX *ctx;
  76. SSL *ssl;
  77. /* Pointer to SSL or SSL_CTX options field or NULL if none */
  78. uint64_t *poptions;
  79. /* Certificate filenames for each type */
  80. char *cert_filename[SSL_PKEY_NUM];
  81. /* Pointer to SSL or SSL_CTX cert_flags or NULL if none */
  82. uint32_t *pcert_flags;
  83. /* Pointer to SSL or SSL_CTX verify_mode or NULL if none */
  84. uint32_t *pvfy_flags;
  85. /* Pointer to SSL or SSL_CTX min_version field or NULL if none */
  86. int *min_version;
  87. /* Pointer to SSL or SSL_CTX max_version field or NULL if none */
  88. int *max_version;
  89. /* Current flag table being worked on */
  90. const ssl_flag_tbl *tbl;
  91. /* Size of table */
  92. size_t ntbl;
  93. /* Client CA names */
  94. STACK_OF(X509_NAME) *canames;
  95. };
  96. static void ssl_set_option(SSL_CONF_CTX *cctx, unsigned int name_flags,
  97. uint64_t option_value, int onoff)
  98. {
  99. uint32_t *pflags;
  100. if (cctx->poptions == NULL)
  101. return;
  102. if (name_flags & SSL_TFLAG_INV)
  103. onoff ^= 1;
  104. switch (name_flags & SSL_TFLAG_TYPE_MASK) {
  105. case SSL_TFLAG_CERT:
  106. pflags = cctx->pcert_flags;
  107. break;
  108. case SSL_TFLAG_VFY:
  109. pflags = cctx->pvfy_flags;
  110. break;
  111. case SSL_TFLAG_OPTION:
  112. if (onoff)
  113. *cctx->poptions |= option_value;
  114. else
  115. *cctx->poptions &= ~option_value;
  116. return;
  117. default:
  118. return;
  119. }
  120. if (onoff)
  121. *pflags |= option_value;
  122. else
  123. *pflags &= ~option_value;
  124. }
  125. static int ssl_match_option(SSL_CONF_CTX *cctx, const ssl_flag_tbl *tbl,
  126. const char *name, int namelen, int onoff)
  127. {
  128. /* If name not relevant for context skip */
  129. if (!(cctx->flags & tbl->name_flags & SSL_TFLAG_BOTH))
  130. return 0;
  131. if (namelen == -1) {
  132. if (strcmp(tbl->name, name))
  133. return 0;
  134. } else if (tbl->namelen != namelen
  135. || OPENSSL_strncasecmp(tbl->name, name, namelen))
  136. return 0;
  137. ssl_set_option(cctx, tbl->name_flags, tbl->option_value, onoff);
  138. return 1;
  139. }
  140. static int ssl_set_option_list(const char *elem, int len, void *usr)
  141. {
  142. SSL_CONF_CTX *cctx = usr;
  143. size_t i;
  144. const ssl_flag_tbl *tbl;
  145. int onoff = 1;
  146. /*
  147. * len == -1 indicates not being called in list context, just for single
  148. * command line switches, so don't allow +, -.
  149. */
  150. if (elem == NULL)
  151. return 0;
  152. if (len != -1) {
  153. if (*elem == '+') {
  154. elem++;
  155. len--;
  156. onoff = 1;
  157. } else if (*elem == '-') {
  158. elem++;
  159. len--;
  160. onoff = 0;
  161. }
  162. }
  163. for (i = 0, tbl = cctx->tbl; i < cctx->ntbl; i++, tbl++) {
  164. if (ssl_match_option(cctx, tbl, elem, len, onoff))
  165. return 1;
  166. }
  167. return 0;
  168. }
  169. /* Set supported signature algorithms */
  170. static int cmd_SignatureAlgorithms(SSL_CONF_CTX *cctx, const char *value)
  171. {
  172. int rv;
  173. if (cctx->ssl)
  174. rv = SSL_set1_sigalgs_list(cctx->ssl, value);
  175. /* NB: ctx == NULL performs syntax checking only */
  176. else
  177. rv = SSL_CTX_set1_sigalgs_list(cctx->ctx, value);
  178. return rv > 0;
  179. }
  180. /* Set supported client signature algorithms */
  181. static int cmd_ClientSignatureAlgorithms(SSL_CONF_CTX *cctx, const char *value)
  182. {
  183. int rv;
  184. if (cctx->ssl)
  185. rv = SSL_set1_client_sigalgs_list(cctx->ssl, value);
  186. /* NB: ctx == NULL performs syntax checking only */
  187. else
  188. rv = SSL_CTX_set1_client_sigalgs_list(cctx->ctx, value);
  189. return rv > 0;
  190. }
  191. static int cmd_Groups(SSL_CONF_CTX *cctx, const char *value)
  192. {
  193. int rv;
  194. if (cctx->ssl)
  195. rv = SSL_set1_groups_list(cctx->ssl, value);
  196. /* NB: ctx == NULL performs syntax checking only */
  197. else
  198. rv = SSL_CTX_set1_groups_list(cctx->ctx, value);
  199. return rv > 0;
  200. }
  201. /* This is the old name for cmd_Groups - retained for backwards compatibility */
  202. static int cmd_Curves(SSL_CONF_CTX *cctx, const char *value)
  203. {
  204. return cmd_Groups(cctx, value);
  205. }
  206. /* ECDH temporary parameters */
  207. static int cmd_ECDHParameters(SSL_CONF_CTX *cctx, const char *value)
  208. {
  209. int rv = 1;
  210. /* Ignore values supported by 1.0.2 for the automatic selection */
  211. if ((cctx->flags & SSL_CONF_FLAG_FILE)
  212. && (OPENSSL_strcasecmp(value, "+automatic") == 0
  213. || OPENSSL_strcasecmp(value, "automatic") == 0))
  214. return 1;
  215. if ((cctx->flags & SSL_CONF_FLAG_CMDLINE) &&
  216. strcmp(value, "auto") == 0)
  217. return 1;
  218. /* ECDHParameters accepts a single group name */
  219. if (strstr(value, ":") != NULL)
  220. return 0;
  221. if (cctx->ctx)
  222. rv = SSL_CTX_set1_groups_list(cctx->ctx, value);
  223. else if (cctx->ssl)
  224. rv = SSL_set1_groups_list(cctx->ssl, value);
  225. return rv > 0;
  226. }
  227. static int cmd_CipherString(SSL_CONF_CTX *cctx, const char *value)
  228. {
  229. int rv = 1;
  230. if (cctx->ctx)
  231. rv = SSL_CTX_set_cipher_list(cctx->ctx, value);
  232. if (cctx->ssl)
  233. rv = SSL_set_cipher_list(cctx->ssl, value);
  234. return rv > 0;
  235. }
  236. static int cmd_Ciphersuites(SSL_CONF_CTX *cctx, const char *value)
  237. {
  238. int rv = 1;
  239. if (cctx->ctx)
  240. rv = SSL_CTX_set_ciphersuites(cctx->ctx, value);
  241. if (cctx->ssl)
  242. rv = SSL_set_ciphersuites(cctx->ssl, value);
  243. return rv > 0;
  244. }
  245. static int cmd_Protocol(SSL_CONF_CTX *cctx, const char *value)
  246. {
  247. static const ssl_flag_tbl ssl_protocol_list[] = {
  248. SSL_FLAG_TBL_INV("ALL", SSL_OP_NO_SSL_MASK),
  249. SSL_FLAG_TBL_INV("SSLv2", SSL_OP_NO_SSLv2),
  250. SSL_FLAG_TBL_INV("SSLv3", SSL_OP_NO_SSLv3),
  251. SSL_FLAG_TBL_INV("TLSv1", SSL_OP_NO_TLSv1),
  252. SSL_FLAG_TBL_INV("TLSv1.1", SSL_OP_NO_TLSv1_1),
  253. SSL_FLAG_TBL_INV("TLSv1.2", SSL_OP_NO_TLSv1_2),
  254. SSL_FLAG_TBL_INV("TLSv1.3", SSL_OP_NO_TLSv1_3),
  255. SSL_FLAG_TBL_INV("DTLSv1", SSL_OP_NO_DTLSv1),
  256. SSL_FLAG_TBL_INV("DTLSv1.2", SSL_OP_NO_DTLSv1_2)
  257. };
  258. cctx->tbl = ssl_protocol_list;
  259. cctx->ntbl = OSSL_NELEM(ssl_protocol_list);
  260. return CONF_parse_list(value, ',', 1, ssl_set_option_list, cctx);
  261. }
  262. /*
  263. * protocol_from_string - converts a protocol version string to a number
  264. *
  265. * Returns -1 on failure or the version on success
  266. */
  267. static int protocol_from_string(const char *value)
  268. {
  269. struct protocol_versions {
  270. const char *name;
  271. int version;
  272. };
  273. /*
  274. * Note: To avoid breaking previously valid configurations, we must retain
  275. * legacy entries in this table even if the underlying protocol is no
  276. * longer supported. This also means that the constants SSL3_VERSION, ...
  277. * need to be retained indefinitely. This table can only grow, never
  278. * shrink.
  279. */
  280. static const struct protocol_versions versions[] = {
  281. {"None", 0},
  282. {"SSLv3", SSL3_VERSION},
  283. {"TLSv1", TLS1_VERSION},
  284. {"TLSv1.1", TLS1_1_VERSION},
  285. {"TLSv1.2", TLS1_2_VERSION},
  286. {"TLSv1.3", TLS1_3_VERSION},
  287. {"DTLSv1", DTLS1_VERSION},
  288. {"DTLSv1.2", DTLS1_2_VERSION}
  289. };
  290. size_t i;
  291. size_t n = OSSL_NELEM(versions);
  292. for (i = 0; i < n; i++)
  293. if (strcmp(versions[i].name, value) == 0)
  294. return versions[i].version;
  295. return -1;
  296. }
  297. static int min_max_proto(SSL_CONF_CTX *cctx, const char *value, int *bound)
  298. {
  299. int method_version;
  300. int new_version;
  301. if (cctx->ctx != NULL)
  302. method_version = cctx->ctx->method->version;
  303. else if (cctx->ssl != NULL)
  304. method_version = cctx->ssl->defltmeth->version;
  305. else
  306. return 0;
  307. if ((new_version = protocol_from_string(value)) < 0)
  308. return 0;
  309. return ssl_set_version_bound(method_version, new_version, bound);
  310. }
  311. /*
  312. * cmd_MinProtocol - Set min protocol version
  313. * @cctx: config structure to save settings in
  314. * @value: The min protocol version in string form
  315. *
  316. * Returns 1 on success and 0 on failure.
  317. */
  318. static int cmd_MinProtocol(SSL_CONF_CTX *cctx, const char *value)
  319. {
  320. return min_max_proto(cctx, value, cctx->min_version);
  321. }
  322. /*
  323. * cmd_MaxProtocol - Set max protocol version
  324. * @cctx: config structure to save settings in
  325. * @value: The max protocol version in string form
  326. *
  327. * Returns 1 on success and 0 on failure.
  328. */
  329. static int cmd_MaxProtocol(SSL_CONF_CTX *cctx, const char *value)
  330. {
  331. return min_max_proto(cctx, value, cctx->max_version);
  332. }
  333. static int cmd_Options(SSL_CONF_CTX *cctx, const char *value)
  334. {
  335. static const ssl_flag_tbl ssl_option_list[] = {
  336. SSL_FLAG_TBL_INV("SessionTicket", SSL_OP_NO_TICKET),
  337. SSL_FLAG_TBL_INV("EmptyFragments",
  338. SSL_OP_DONT_INSERT_EMPTY_FRAGMENTS),
  339. SSL_FLAG_TBL("Bugs", SSL_OP_ALL),
  340. SSL_FLAG_TBL_INV("Compression", SSL_OP_NO_COMPRESSION),
  341. SSL_FLAG_TBL_SRV("ServerPreference", SSL_OP_CIPHER_SERVER_PREFERENCE),
  342. SSL_FLAG_TBL_SRV("NoResumptionOnRenegotiation",
  343. SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION),
  344. SSL_FLAG_TBL_SRV("DHSingle", SSL_OP_SINGLE_DH_USE),
  345. SSL_FLAG_TBL_SRV("ECDHSingle", SSL_OP_SINGLE_ECDH_USE),
  346. SSL_FLAG_TBL("UnsafeLegacyRenegotiation",
  347. SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION),
  348. SSL_FLAG_TBL("UnsafeLegacyServerConnect",
  349. SSL_OP_LEGACY_SERVER_CONNECT),
  350. SSL_FLAG_TBL("ClientRenegotiation",
  351. SSL_OP_ALLOW_CLIENT_RENEGOTIATION),
  352. SSL_FLAG_TBL_INV("EncryptThenMac", SSL_OP_NO_ENCRYPT_THEN_MAC),
  353. SSL_FLAG_TBL("NoRenegotiation", SSL_OP_NO_RENEGOTIATION),
  354. SSL_FLAG_TBL("AllowNoDHEKEX", SSL_OP_ALLOW_NO_DHE_KEX),
  355. SSL_FLAG_TBL("PrioritizeChaCha", SSL_OP_PRIORITIZE_CHACHA),
  356. SSL_FLAG_TBL("MiddleboxCompat", SSL_OP_ENABLE_MIDDLEBOX_COMPAT),
  357. SSL_FLAG_TBL_INV("AntiReplay", SSL_OP_NO_ANTI_REPLAY),
  358. SSL_FLAG_TBL_INV("ExtendedMasterSecret", SSL_OP_NO_EXTENDED_MASTER_SECRET),
  359. SSL_FLAG_TBL_INV("CANames", SSL_OP_DISABLE_TLSEXT_CA_NAMES),
  360. SSL_FLAG_TBL("KTLS", SSL_OP_ENABLE_KTLS),
  361. SSL_FLAG_TBL_CERT("StrictCertCheck", SSL_CERT_FLAG_TLS_STRICT),
  362. SSL_FLAG_TBL_INV("TxCertificateCompression", SSL_OP_NO_TX_CERTIFICATE_COMPRESSION),
  363. SSL_FLAG_TBL_INV("RxCertificateCompression", SSL_OP_NO_RX_CERTIFICATE_COMPRESSION),
  364. SSL_FLAG_TBL("KTLSTxZerocopySendfile", SSL_OP_ENABLE_KTLS_TX_ZEROCOPY_SENDFILE),
  365. SSL_FLAG_TBL("IgnoreUnexpectedEOF", SSL_OP_IGNORE_UNEXPECTED_EOF),
  366. };
  367. if (value == NULL)
  368. return -3;
  369. cctx->tbl = ssl_option_list;
  370. cctx->ntbl = OSSL_NELEM(ssl_option_list);
  371. return CONF_parse_list(value, ',', 1, ssl_set_option_list, cctx);
  372. }
  373. static int cmd_VerifyMode(SSL_CONF_CTX *cctx, const char *value)
  374. {
  375. static const ssl_flag_tbl ssl_vfy_list[] = {
  376. SSL_FLAG_VFY_CLI("Peer", SSL_VERIFY_PEER),
  377. SSL_FLAG_VFY_SRV("Request", SSL_VERIFY_PEER),
  378. SSL_FLAG_VFY_SRV("Require",
  379. SSL_VERIFY_PEER | SSL_VERIFY_FAIL_IF_NO_PEER_CERT),
  380. SSL_FLAG_VFY_SRV("Once", SSL_VERIFY_PEER | SSL_VERIFY_CLIENT_ONCE),
  381. SSL_FLAG_VFY_SRV("RequestPostHandshake",
  382. SSL_VERIFY_PEER | SSL_VERIFY_POST_HANDSHAKE),
  383. SSL_FLAG_VFY_SRV("RequirePostHandshake",
  384. SSL_VERIFY_PEER | SSL_VERIFY_POST_HANDSHAKE |
  385. SSL_VERIFY_FAIL_IF_NO_PEER_CERT),
  386. };
  387. if (value == NULL)
  388. return -3;
  389. cctx->tbl = ssl_vfy_list;
  390. cctx->ntbl = OSSL_NELEM(ssl_vfy_list);
  391. return CONF_parse_list(value, ',', 1, ssl_set_option_list, cctx);
  392. }
  393. static int cmd_Certificate(SSL_CONF_CTX *cctx, const char *value)
  394. {
  395. int rv = 1;
  396. CERT *c = NULL;
  397. if (cctx->ctx != NULL) {
  398. rv = SSL_CTX_use_certificate_chain_file(cctx->ctx, value);
  399. c = cctx->ctx->cert;
  400. }
  401. if (cctx->ssl != NULL) {
  402. SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(cctx->ssl);
  403. if (sc != NULL) {
  404. rv = SSL_use_certificate_chain_file(cctx->ssl, value);
  405. c = sc->cert;
  406. } else {
  407. rv = 0;
  408. }
  409. }
  410. if (rv > 0 && c != NULL && cctx->flags & SSL_CONF_FLAG_REQUIRE_PRIVATE) {
  411. char **pfilename = &cctx->cert_filename[c->key - c->pkeys];
  412. OPENSSL_free(*pfilename);
  413. *pfilename = OPENSSL_strdup(value);
  414. if (*pfilename == NULL)
  415. rv = 0;
  416. }
  417. return rv > 0;
  418. }
  419. static int cmd_PrivateKey(SSL_CONF_CTX *cctx, const char *value)
  420. {
  421. int rv = 1;
  422. if (!(cctx->flags & SSL_CONF_FLAG_CERTIFICATE))
  423. return -2;
  424. if (cctx->ctx)
  425. rv = SSL_CTX_use_PrivateKey_file(cctx->ctx, value, SSL_FILETYPE_PEM);
  426. if (cctx->ssl)
  427. rv = SSL_use_PrivateKey_file(cctx->ssl, value, SSL_FILETYPE_PEM);
  428. return rv > 0;
  429. }
  430. static int cmd_ServerInfoFile(SSL_CONF_CTX *cctx, const char *value)
  431. {
  432. int rv = 1;
  433. if (cctx->ctx)
  434. rv = SSL_CTX_use_serverinfo_file(cctx->ctx, value);
  435. return rv > 0;
  436. }
  437. static int do_store(SSL_CONF_CTX *cctx,
  438. const char *CAfile, const char *CApath, const char *CAstore,
  439. int verify_store)
  440. {
  441. CERT *cert;
  442. X509_STORE **st;
  443. SSL_CTX *ctx;
  444. OSSL_LIB_CTX *libctx = NULL;
  445. const char *propq = NULL;
  446. if (cctx->ctx != NULL) {
  447. cert = cctx->ctx->cert;
  448. ctx = cctx->ctx;
  449. } else if (cctx->ssl != NULL) {
  450. SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(cctx->ssl);
  451. if (sc == NULL)
  452. return 0;
  453. cert = sc->cert;
  454. ctx = cctx->ssl->ctx;
  455. } else {
  456. return 1;
  457. }
  458. if (ctx != NULL) {
  459. libctx = ctx->libctx;
  460. propq = ctx->propq;
  461. }
  462. st = verify_store ? &cert->verify_store : &cert->chain_store;
  463. if (*st == NULL) {
  464. *st = X509_STORE_new();
  465. if (*st == NULL)
  466. return 0;
  467. }
  468. if (CAfile != NULL && !X509_STORE_load_file_ex(*st, CAfile, libctx, propq))
  469. return 0;
  470. if (CApath != NULL && !X509_STORE_load_path(*st, CApath))
  471. return 0;
  472. if (CAstore != NULL && !X509_STORE_load_store_ex(*st, CAstore, libctx,
  473. propq))
  474. return 0;
  475. return 1;
  476. }
  477. static int cmd_ChainCAPath(SSL_CONF_CTX *cctx, const char *value)
  478. {
  479. return do_store(cctx, NULL, value, NULL, 0);
  480. }
  481. static int cmd_ChainCAFile(SSL_CONF_CTX *cctx, const char *value)
  482. {
  483. return do_store(cctx, value, NULL, NULL, 0);
  484. }
  485. static int cmd_ChainCAStore(SSL_CONF_CTX *cctx, const char *value)
  486. {
  487. return do_store(cctx, NULL, NULL, value, 0);
  488. }
  489. static int cmd_VerifyCAPath(SSL_CONF_CTX *cctx, const char *value)
  490. {
  491. return do_store(cctx, NULL, value, NULL, 1);
  492. }
  493. static int cmd_VerifyCAFile(SSL_CONF_CTX *cctx, const char *value)
  494. {
  495. return do_store(cctx, value, NULL, NULL, 1);
  496. }
  497. static int cmd_VerifyCAStore(SSL_CONF_CTX *cctx, const char *value)
  498. {
  499. return do_store(cctx, NULL, NULL, value, 1);
  500. }
  501. static int cmd_RequestCAFile(SSL_CONF_CTX *cctx, const char *value)
  502. {
  503. if (cctx->canames == NULL)
  504. cctx->canames = sk_X509_NAME_new_null();
  505. if (cctx->canames == NULL)
  506. return 0;
  507. return SSL_add_file_cert_subjects_to_stack(cctx->canames, value);
  508. }
  509. static int cmd_ClientCAFile(SSL_CONF_CTX *cctx, const char *value)
  510. {
  511. return cmd_RequestCAFile(cctx, value);
  512. }
  513. static int cmd_RequestCAPath(SSL_CONF_CTX *cctx, const char *value)
  514. {
  515. if (cctx->canames == NULL)
  516. cctx->canames = sk_X509_NAME_new_null();
  517. if (cctx->canames == NULL)
  518. return 0;
  519. return SSL_add_dir_cert_subjects_to_stack(cctx->canames, value);
  520. }
  521. static int cmd_ClientCAPath(SSL_CONF_CTX *cctx, const char *value)
  522. {
  523. return cmd_RequestCAPath(cctx, value);
  524. }
  525. static int cmd_RequestCAStore(SSL_CONF_CTX *cctx, const char *value)
  526. {
  527. if (cctx->canames == NULL)
  528. cctx->canames = sk_X509_NAME_new_null();
  529. if (cctx->canames == NULL)
  530. return 0;
  531. return SSL_add_store_cert_subjects_to_stack(cctx->canames, value);
  532. }
  533. static int cmd_ClientCAStore(SSL_CONF_CTX *cctx, const char *value)
  534. {
  535. return cmd_RequestCAStore(cctx, value);
  536. }
  537. static int cmd_DHParameters(SSL_CONF_CTX *cctx, const char *value)
  538. {
  539. int rv = 0;
  540. EVP_PKEY *dhpkey = NULL;
  541. BIO *in = NULL;
  542. SSL_CTX *sslctx = (cctx->ssl != NULL) ? cctx->ssl->ctx : cctx->ctx;
  543. OSSL_DECODER_CTX *decoderctx = NULL;
  544. if (cctx->ctx != NULL || cctx->ssl != NULL) {
  545. in = BIO_new(BIO_s_file());
  546. if (in == NULL)
  547. goto end;
  548. if (BIO_read_filename(in, value) <= 0)
  549. goto end;
  550. decoderctx
  551. = OSSL_DECODER_CTX_new_for_pkey(&dhpkey, "PEM", NULL, "DH",
  552. OSSL_KEYMGMT_SELECT_DOMAIN_PARAMETERS,
  553. sslctx->libctx, sslctx->propq);
  554. if (decoderctx == NULL)
  555. goto end;
  556. ERR_set_mark();
  557. while (!OSSL_DECODER_from_bio(decoderctx, in)
  558. && dhpkey == NULL
  559. && !BIO_eof(in));
  560. OSSL_DECODER_CTX_free(decoderctx);
  561. if (dhpkey == NULL) {
  562. ERR_clear_last_mark();
  563. goto end;
  564. }
  565. ERR_pop_to_mark();
  566. } else {
  567. return 1;
  568. }
  569. if (cctx->ctx != NULL) {
  570. if ((rv = SSL_CTX_set0_tmp_dh_pkey(cctx->ctx, dhpkey)) > 0)
  571. dhpkey = NULL;
  572. }
  573. if (cctx->ssl != NULL) {
  574. if ((rv = SSL_set0_tmp_dh_pkey(cctx->ssl, dhpkey)) > 0)
  575. dhpkey = NULL;
  576. }
  577. end:
  578. EVP_PKEY_free(dhpkey);
  579. BIO_free(in);
  580. return rv > 0;
  581. }
  582. static int cmd_RecordPadding(SSL_CONF_CTX *cctx, const char *value)
  583. {
  584. int rv = 0;
  585. int block_size = atoi(value);
  586. /*
  587. * All we care about is a non-negative value,
  588. * the setters check the range
  589. */
  590. if (block_size >= 0) {
  591. if (cctx->ctx)
  592. rv = SSL_CTX_set_block_padding(cctx->ctx, block_size);
  593. if (cctx->ssl)
  594. rv = SSL_set_block_padding(cctx->ssl, block_size);
  595. }
  596. return rv;
  597. }
  598. static int cmd_NumTickets(SSL_CONF_CTX *cctx, const char *value)
  599. {
  600. int rv = 0;
  601. int num_tickets = atoi(value);
  602. if (num_tickets >= 0) {
  603. if (cctx->ctx)
  604. rv = SSL_CTX_set_num_tickets(cctx->ctx, num_tickets);
  605. if (cctx->ssl)
  606. rv = SSL_set_num_tickets(cctx->ssl, num_tickets);
  607. }
  608. return rv;
  609. }
  610. typedef struct {
  611. int (*cmd) (SSL_CONF_CTX *cctx, const char *value);
  612. const char *str_file;
  613. const char *str_cmdline;
  614. unsigned short flags;
  615. unsigned short value_type;
  616. } ssl_conf_cmd_tbl;
  617. /* Table of supported parameters */
  618. #define SSL_CONF_CMD(name, cmdopt, flags, type) \
  619. {cmd_##name, #name, cmdopt, flags, type}
  620. #define SSL_CONF_CMD_STRING(name, cmdopt, flags) \
  621. SSL_CONF_CMD(name, cmdopt, flags, SSL_CONF_TYPE_STRING)
  622. #define SSL_CONF_CMD_SWITCH(name, flags) \
  623. {0, NULL, name, flags, SSL_CONF_TYPE_NONE}
  624. /* See apps/include/opt.h if you change this table. */
  625. /* The SSL_CONF_CMD_SWITCH should be the same order as ssl_cmd_switches */
  626. static const ssl_conf_cmd_tbl ssl_conf_cmds[] = {
  627. SSL_CONF_CMD_SWITCH("no_ssl3", 0),
  628. SSL_CONF_CMD_SWITCH("no_tls1", 0),
  629. SSL_CONF_CMD_SWITCH("no_tls1_1", 0),
  630. SSL_CONF_CMD_SWITCH("no_tls1_2", 0),
  631. SSL_CONF_CMD_SWITCH("no_tls1_3", 0),
  632. SSL_CONF_CMD_SWITCH("bugs", 0),
  633. SSL_CONF_CMD_SWITCH("no_comp", 0),
  634. SSL_CONF_CMD_SWITCH("comp", 0),
  635. SSL_CONF_CMD_SWITCH("no_tx_cert_comp", 0),
  636. SSL_CONF_CMD_SWITCH("tx_cert_comp", 0),
  637. SSL_CONF_CMD_SWITCH("no_rx_cert_comp", 0),
  638. SSL_CONF_CMD_SWITCH("rx_cert_comp", 0),
  639. SSL_CONF_CMD_SWITCH("ecdh_single", SSL_CONF_FLAG_SERVER),
  640. SSL_CONF_CMD_SWITCH("no_ticket", 0),
  641. SSL_CONF_CMD_SWITCH("serverpref", SSL_CONF_FLAG_SERVER),
  642. SSL_CONF_CMD_SWITCH("legacy_renegotiation", 0),
  643. SSL_CONF_CMD_SWITCH("client_renegotiation", SSL_CONF_FLAG_SERVER),
  644. SSL_CONF_CMD_SWITCH("legacy_server_connect", SSL_CONF_FLAG_CLIENT),
  645. SSL_CONF_CMD_SWITCH("no_renegotiation", 0),
  646. SSL_CONF_CMD_SWITCH("no_resumption_on_reneg", SSL_CONF_FLAG_SERVER),
  647. SSL_CONF_CMD_SWITCH("no_legacy_server_connect", SSL_CONF_FLAG_CLIENT),
  648. SSL_CONF_CMD_SWITCH("allow_no_dhe_kex", 0),
  649. SSL_CONF_CMD_SWITCH("prioritize_chacha", SSL_CONF_FLAG_SERVER),
  650. SSL_CONF_CMD_SWITCH("strict", 0),
  651. SSL_CONF_CMD_SWITCH("no_middlebox", 0),
  652. SSL_CONF_CMD_SWITCH("anti_replay", SSL_CONF_FLAG_SERVER),
  653. SSL_CONF_CMD_SWITCH("no_anti_replay", SSL_CONF_FLAG_SERVER),
  654. SSL_CONF_CMD_SWITCH("no_etm", 0),
  655. SSL_CONF_CMD_SWITCH("no_ems", 0),
  656. SSL_CONF_CMD_STRING(SignatureAlgorithms, "sigalgs", 0),
  657. SSL_CONF_CMD_STRING(ClientSignatureAlgorithms, "client_sigalgs", 0),
  658. SSL_CONF_CMD_STRING(Curves, "curves", 0),
  659. SSL_CONF_CMD_STRING(Groups, "groups", 0),
  660. SSL_CONF_CMD_STRING(ECDHParameters, "named_curve", SSL_CONF_FLAG_SERVER),
  661. SSL_CONF_CMD_STRING(CipherString, "cipher", 0),
  662. SSL_CONF_CMD_STRING(Ciphersuites, "ciphersuites", 0),
  663. SSL_CONF_CMD_STRING(Protocol, NULL, 0),
  664. SSL_CONF_CMD_STRING(MinProtocol, "min_protocol", 0),
  665. SSL_CONF_CMD_STRING(MaxProtocol, "max_protocol", 0),
  666. SSL_CONF_CMD_STRING(Options, NULL, 0),
  667. SSL_CONF_CMD_STRING(VerifyMode, NULL, 0),
  668. SSL_CONF_CMD(Certificate, "cert", SSL_CONF_FLAG_CERTIFICATE,
  669. SSL_CONF_TYPE_FILE),
  670. SSL_CONF_CMD(PrivateKey, "key", SSL_CONF_FLAG_CERTIFICATE,
  671. SSL_CONF_TYPE_FILE),
  672. SSL_CONF_CMD(ServerInfoFile, NULL,
  673. SSL_CONF_FLAG_SERVER | SSL_CONF_FLAG_CERTIFICATE,
  674. SSL_CONF_TYPE_FILE),
  675. SSL_CONF_CMD(ChainCAPath, "chainCApath", SSL_CONF_FLAG_CERTIFICATE,
  676. SSL_CONF_TYPE_DIR),
  677. SSL_CONF_CMD(ChainCAFile, "chainCAfile", SSL_CONF_FLAG_CERTIFICATE,
  678. SSL_CONF_TYPE_FILE),
  679. SSL_CONF_CMD(ChainCAStore, "chainCAstore", SSL_CONF_FLAG_CERTIFICATE,
  680. SSL_CONF_TYPE_STORE),
  681. SSL_CONF_CMD(VerifyCAPath, "verifyCApath", SSL_CONF_FLAG_CERTIFICATE,
  682. SSL_CONF_TYPE_DIR),
  683. SSL_CONF_CMD(VerifyCAFile, "verifyCAfile", SSL_CONF_FLAG_CERTIFICATE,
  684. SSL_CONF_TYPE_FILE),
  685. SSL_CONF_CMD(VerifyCAStore, "verifyCAstore", SSL_CONF_FLAG_CERTIFICATE,
  686. SSL_CONF_TYPE_STORE),
  687. SSL_CONF_CMD(RequestCAFile, "requestCAFile", SSL_CONF_FLAG_CERTIFICATE,
  688. SSL_CONF_TYPE_FILE),
  689. SSL_CONF_CMD(ClientCAFile, NULL,
  690. SSL_CONF_FLAG_SERVER | SSL_CONF_FLAG_CERTIFICATE,
  691. SSL_CONF_TYPE_FILE),
  692. SSL_CONF_CMD(RequestCAPath, NULL, SSL_CONF_FLAG_CERTIFICATE,
  693. SSL_CONF_TYPE_DIR),
  694. SSL_CONF_CMD(ClientCAPath, NULL,
  695. SSL_CONF_FLAG_SERVER | SSL_CONF_FLAG_CERTIFICATE,
  696. SSL_CONF_TYPE_DIR),
  697. SSL_CONF_CMD(RequestCAStore, "requestCAStore", SSL_CONF_FLAG_CERTIFICATE,
  698. SSL_CONF_TYPE_STORE),
  699. SSL_CONF_CMD(ClientCAStore, NULL,
  700. SSL_CONF_FLAG_SERVER | SSL_CONF_FLAG_CERTIFICATE,
  701. SSL_CONF_TYPE_STORE),
  702. SSL_CONF_CMD(DHParameters, "dhparam",
  703. SSL_CONF_FLAG_SERVER | SSL_CONF_FLAG_CERTIFICATE,
  704. SSL_CONF_TYPE_FILE),
  705. SSL_CONF_CMD_STRING(RecordPadding, "record_padding", 0),
  706. SSL_CONF_CMD_STRING(NumTickets, "num_tickets", SSL_CONF_FLAG_SERVER),
  707. };
  708. /* Supported switches: must match order of switches in ssl_conf_cmds */
  709. static const ssl_switch_tbl ssl_cmd_switches[] = {
  710. {SSL_OP_NO_SSLv3, 0}, /* no_ssl3 */
  711. {SSL_OP_NO_TLSv1, 0}, /* no_tls1 */
  712. {SSL_OP_NO_TLSv1_1, 0}, /* no_tls1_1 */
  713. {SSL_OP_NO_TLSv1_2, 0}, /* no_tls1_2 */
  714. {SSL_OP_NO_TLSv1_3, 0}, /* no_tls1_3 */
  715. {SSL_OP_ALL, 0}, /* bugs */
  716. {SSL_OP_NO_COMPRESSION, 0}, /* no_comp */
  717. {SSL_OP_NO_COMPRESSION, SSL_TFLAG_INV}, /* comp */
  718. {SSL_OP_NO_TX_CERTIFICATE_COMPRESSION, 0}, /* no_tx_cert_comp */
  719. {SSL_OP_NO_TX_CERTIFICATE_COMPRESSION, SSL_TFLAG_INV}, /* tx_cert_comp */
  720. {SSL_OP_NO_RX_CERTIFICATE_COMPRESSION, 0}, /* no_rx_cert_comp */
  721. {SSL_OP_NO_RX_CERTIFICATE_COMPRESSION, SSL_TFLAG_INV}, /* rx_cert_comp */
  722. {SSL_OP_SINGLE_ECDH_USE, 0}, /* ecdh_single */
  723. {SSL_OP_NO_TICKET, 0}, /* no_ticket */
  724. {SSL_OP_CIPHER_SERVER_PREFERENCE, 0}, /* serverpref */
  725. /* legacy_renegotiation */
  726. {SSL_OP_ALLOW_UNSAFE_LEGACY_RENEGOTIATION, 0},
  727. /* Allow client renegotiation */
  728. {SSL_OP_ALLOW_CLIENT_RENEGOTIATION, 0},
  729. /* legacy_server_connect */
  730. {SSL_OP_LEGACY_SERVER_CONNECT, 0},
  731. /* no_renegotiation */
  732. {SSL_OP_NO_RENEGOTIATION, 0},
  733. /* no_resumption_on_reneg */
  734. {SSL_OP_NO_SESSION_RESUMPTION_ON_RENEGOTIATION, 0},
  735. /* no_legacy_server_connect */
  736. {SSL_OP_LEGACY_SERVER_CONNECT, SSL_TFLAG_INV},
  737. /* allow_no_dhe_kex */
  738. {SSL_OP_ALLOW_NO_DHE_KEX, 0},
  739. /* chacha reprioritization */
  740. {SSL_OP_PRIORITIZE_CHACHA, 0},
  741. {SSL_CERT_FLAG_TLS_STRICT, SSL_TFLAG_CERT}, /* strict */
  742. /* no_middlebox */
  743. {SSL_OP_ENABLE_MIDDLEBOX_COMPAT, SSL_TFLAG_INV},
  744. /* anti_replay */
  745. {SSL_OP_NO_ANTI_REPLAY, SSL_TFLAG_INV},
  746. /* no_anti_replay */
  747. {SSL_OP_NO_ANTI_REPLAY, 0},
  748. /* no Encrypt-then-Mac */
  749. {SSL_OP_NO_ENCRYPT_THEN_MAC, 0},
  750. /* no Extended master secret */
  751. {SSL_OP_NO_EXTENDED_MASTER_SECRET, 0},
  752. };
  753. static int ssl_conf_cmd_skip_prefix(SSL_CONF_CTX *cctx, const char **pcmd)
  754. {
  755. if (pcmd == NULL || *pcmd == NULL)
  756. return 0;
  757. /* If a prefix is set, check and skip */
  758. if (cctx->prefix) {
  759. if (strlen(*pcmd) <= cctx->prefixlen)
  760. return 0;
  761. if (cctx->flags & SSL_CONF_FLAG_CMDLINE &&
  762. strncmp(*pcmd, cctx->prefix, cctx->prefixlen))
  763. return 0;
  764. if (cctx->flags & SSL_CONF_FLAG_FILE &&
  765. OPENSSL_strncasecmp(*pcmd, cctx->prefix, cctx->prefixlen))
  766. return 0;
  767. *pcmd += cctx->prefixlen;
  768. } else if (cctx->flags & SSL_CONF_FLAG_CMDLINE) {
  769. if (**pcmd != '-' || !(*pcmd)[1])
  770. return 0;
  771. *pcmd += 1;
  772. }
  773. return 1;
  774. }
  775. /* Determine if a command is allowed according to cctx flags */
  776. static int ssl_conf_cmd_allowed(SSL_CONF_CTX *cctx, const ssl_conf_cmd_tbl *t)
  777. {
  778. unsigned int tfl = t->flags;
  779. unsigned int cfl = cctx->flags;
  780. if ((tfl & SSL_CONF_FLAG_SERVER) && !(cfl & SSL_CONF_FLAG_SERVER))
  781. return 0;
  782. if ((tfl & SSL_CONF_FLAG_CLIENT) && !(cfl & SSL_CONF_FLAG_CLIENT))
  783. return 0;
  784. if ((tfl & SSL_CONF_FLAG_CERTIFICATE)
  785. && !(cfl & SSL_CONF_FLAG_CERTIFICATE))
  786. return 0;
  787. return 1;
  788. }
  789. static const ssl_conf_cmd_tbl *ssl_conf_cmd_lookup(SSL_CONF_CTX *cctx,
  790. const char *cmd)
  791. {
  792. const ssl_conf_cmd_tbl *t;
  793. size_t i;
  794. if (cmd == NULL)
  795. return NULL;
  796. /* Look for matching parameter name in table */
  797. for (i = 0, t = ssl_conf_cmds; i < OSSL_NELEM(ssl_conf_cmds); i++, t++) {
  798. if (ssl_conf_cmd_allowed(cctx, t)) {
  799. if (cctx->flags & SSL_CONF_FLAG_CMDLINE) {
  800. if (t->str_cmdline && strcmp(t->str_cmdline, cmd) == 0)
  801. return t;
  802. }
  803. if (cctx->flags & SSL_CONF_FLAG_FILE) {
  804. if (t->str_file && OPENSSL_strcasecmp(t->str_file, cmd) == 0)
  805. return t;
  806. }
  807. }
  808. }
  809. return NULL;
  810. }
  811. static int ctrl_switch_option(SSL_CONF_CTX *cctx, const ssl_conf_cmd_tbl *cmd)
  812. {
  813. /* Find index of command in table */
  814. size_t idx = cmd - ssl_conf_cmds;
  815. const ssl_switch_tbl *scmd;
  816. /* Sanity check index */
  817. if (idx >= OSSL_NELEM(ssl_cmd_switches))
  818. return 0;
  819. /* Obtain switches entry with same index */
  820. scmd = ssl_cmd_switches + idx;
  821. ssl_set_option(cctx, scmd->name_flags, scmd->option_value, 1);
  822. return 1;
  823. }
  824. int SSL_CONF_cmd(SSL_CONF_CTX *cctx, const char *cmd, const char *value)
  825. {
  826. const ssl_conf_cmd_tbl *runcmd;
  827. if (cmd == NULL) {
  828. ERR_raise(ERR_LIB_SSL, SSL_R_INVALID_NULL_CMD_NAME);
  829. return 0;
  830. }
  831. if (!ssl_conf_cmd_skip_prefix(cctx, &cmd))
  832. return -2;
  833. runcmd = ssl_conf_cmd_lookup(cctx, cmd);
  834. if (runcmd) {
  835. int rv;
  836. if (runcmd->value_type == SSL_CONF_TYPE_NONE) {
  837. return ctrl_switch_option(cctx, runcmd);
  838. }
  839. if (value == NULL)
  840. return -3;
  841. rv = runcmd->cmd(cctx, value);
  842. if (rv > 0)
  843. return 2;
  844. if (rv == -2)
  845. return -2;
  846. if (cctx->flags & SSL_CONF_FLAG_SHOW_ERRORS)
  847. ERR_raise_data(ERR_LIB_SSL, SSL_R_BAD_VALUE,
  848. "cmd=%s, value=%s", cmd, value);
  849. return 0;
  850. }
  851. if (cctx->flags & SSL_CONF_FLAG_SHOW_ERRORS)
  852. ERR_raise_data(ERR_LIB_SSL, SSL_R_UNKNOWN_CMD_NAME, "cmd=%s", cmd);
  853. return -2;
  854. }
  855. int SSL_CONF_cmd_argv(SSL_CONF_CTX *cctx, int *pargc, char ***pargv)
  856. {
  857. int rv;
  858. const char *arg = NULL, *argn;
  859. if (pargc != NULL && *pargc == 0)
  860. return 0;
  861. if (pargc == NULL || *pargc > 0)
  862. arg = **pargv;
  863. if (arg == NULL)
  864. return 0;
  865. if (pargc == NULL || *pargc > 1)
  866. argn = (*pargv)[1];
  867. else
  868. argn = NULL;
  869. cctx->flags &= ~SSL_CONF_FLAG_FILE;
  870. cctx->flags |= SSL_CONF_FLAG_CMDLINE;
  871. rv = SSL_CONF_cmd(cctx, arg, argn);
  872. if (rv > 0) {
  873. /* Success: update pargc, pargv */
  874. (*pargv) += rv;
  875. if (pargc)
  876. (*pargc) -= rv;
  877. return rv;
  878. }
  879. /* Unknown switch: indicate no arguments processed */
  880. if (rv == -2)
  881. return 0;
  882. /* Some error occurred processing command, return fatal error */
  883. if (rv == 0)
  884. return -1;
  885. return rv;
  886. }
  887. int SSL_CONF_cmd_value_type(SSL_CONF_CTX *cctx, const char *cmd)
  888. {
  889. if (ssl_conf_cmd_skip_prefix(cctx, &cmd)) {
  890. const ssl_conf_cmd_tbl *runcmd;
  891. runcmd = ssl_conf_cmd_lookup(cctx, cmd);
  892. if (runcmd)
  893. return runcmd->value_type;
  894. }
  895. return SSL_CONF_TYPE_UNKNOWN;
  896. }
  897. SSL_CONF_CTX *SSL_CONF_CTX_new(void)
  898. {
  899. SSL_CONF_CTX *ret = OPENSSL_zalloc(sizeof(*ret));
  900. return ret;
  901. }
  902. int SSL_CONF_CTX_finish(SSL_CONF_CTX *cctx)
  903. {
  904. /* See if any certificates are missing private keys */
  905. size_t i;
  906. CERT *c = NULL;
  907. if (cctx->ctx != NULL) {
  908. c = cctx->ctx->cert;
  909. } else if (cctx->ssl != NULL) {
  910. SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(cctx->ssl);
  911. if (sc != NULL)
  912. c = sc->cert;
  913. }
  914. if (c != NULL && cctx->flags & SSL_CONF_FLAG_REQUIRE_PRIVATE) {
  915. for (i = 0; i < SSL_PKEY_NUM; i++) {
  916. const char *p = cctx->cert_filename[i];
  917. /*
  918. * If missing private key try to load one from certificate file
  919. */
  920. if (p && !c->pkeys[i].privatekey) {
  921. if (!cmd_PrivateKey(cctx, p))
  922. return 0;
  923. }
  924. }
  925. }
  926. if (cctx->canames) {
  927. if (cctx->ssl)
  928. SSL_set0_CA_list(cctx->ssl, cctx->canames);
  929. else if (cctx->ctx)
  930. SSL_CTX_set0_CA_list(cctx->ctx, cctx->canames);
  931. else
  932. sk_X509_NAME_pop_free(cctx->canames, X509_NAME_free);
  933. cctx->canames = NULL;
  934. }
  935. return 1;
  936. }
  937. void SSL_CONF_CTX_free(SSL_CONF_CTX *cctx)
  938. {
  939. if (cctx) {
  940. size_t i;
  941. for (i = 0; i < SSL_PKEY_NUM; i++)
  942. OPENSSL_free(cctx->cert_filename[i]);
  943. OPENSSL_free(cctx->prefix);
  944. sk_X509_NAME_pop_free(cctx->canames, X509_NAME_free);
  945. OPENSSL_free(cctx);
  946. }
  947. }
  948. unsigned int SSL_CONF_CTX_set_flags(SSL_CONF_CTX *cctx, unsigned int flags)
  949. {
  950. cctx->flags |= flags;
  951. return cctx->flags;
  952. }
  953. unsigned int SSL_CONF_CTX_clear_flags(SSL_CONF_CTX *cctx, unsigned int flags)
  954. {
  955. cctx->flags &= ~flags;
  956. return cctx->flags;
  957. }
  958. int SSL_CONF_CTX_set1_prefix(SSL_CONF_CTX *cctx, const char *pre)
  959. {
  960. char *tmp = NULL;
  961. if (pre) {
  962. tmp = OPENSSL_strdup(pre);
  963. if (tmp == NULL)
  964. return 0;
  965. }
  966. OPENSSL_free(cctx->prefix);
  967. cctx->prefix = tmp;
  968. if (tmp)
  969. cctx->prefixlen = strlen(tmp);
  970. else
  971. cctx->prefixlen = 0;
  972. return 1;
  973. }
  974. void SSL_CONF_CTX_set_ssl(SSL_CONF_CTX *cctx, SSL *ssl)
  975. {
  976. cctx->ssl = ssl;
  977. cctx->ctx = NULL;
  978. if (ssl != NULL) {
  979. SSL_CONNECTION *sc = SSL_CONNECTION_FROM_SSL(ssl);
  980. if (sc == NULL)
  981. return;
  982. cctx->poptions = &sc->options;
  983. cctx->min_version = &sc->min_proto_version;
  984. cctx->max_version = &sc->max_proto_version;
  985. cctx->pcert_flags = &sc->cert->cert_flags;
  986. cctx->pvfy_flags = &sc->verify_mode;
  987. } else {
  988. cctx->poptions = NULL;
  989. cctx->min_version = NULL;
  990. cctx->max_version = NULL;
  991. cctx->pcert_flags = NULL;
  992. cctx->pvfy_flags = NULL;
  993. }
  994. }
  995. void SSL_CONF_CTX_set_ssl_ctx(SSL_CONF_CTX *cctx, SSL_CTX *ctx)
  996. {
  997. cctx->ctx = ctx;
  998. cctx->ssl = NULL;
  999. if (ctx) {
  1000. cctx->poptions = &ctx->options;
  1001. cctx->min_version = &ctx->min_proto_version;
  1002. cctx->max_version = &ctx->max_proto_version;
  1003. cctx->pcert_flags = &ctx->cert->cert_flags;
  1004. cctx->pvfy_flags = &ctx->verify_mode;
  1005. } else {
  1006. cctx->poptions = NULL;
  1007. cctx->min_version = NULL;
  1008. cctx->max_version = NULL;
  1009. cctx->pcert_flags = NULL;
  1010. cctx->pvfy_flags = NULL;
  1011. }
  1012. }