1*4724848cSchristos /*
2*4724848cSchristos * Copyright 2015-2018 The OpenSSL Project Authors. All Rights Reserved.
3*4724848cSchristos *
4*4724848cSchristos * Licensed under the OpenSSL license (the "License"). You may not use
5*4724848cSchristos * this file except in compliance with the License. You can obtain a copy
6*4724848cSchristos * in the file LICENSE in the source distribution or at
7*4724848cSchristos * https://www.openssl.org/source/license.html
8*4724848cSchristos */
9*4724848cSchristos
10*4724848cSchristos #include <stdio.h>
11*4724848cSchristos #include <openssl/conf.h>
12*4724848cSchristos #include <openssl/ssl.h>
13*4724848cSchristos #include "ssl_local.h"
14*4724848cSchristos #include "internal/sslconf.h"
15*4724848cSchristos
16*4724848cSchristos /* SSL library configuration module. */
17*4724848cSchristos
SSL_add_ssl_module(void)18*4724848cSchristos void SSL_add_ssl_module(void)
19*4724848cSchristos {
20*4724848cSchristos /* Do nothing. This will be added automatically by libcrypto */
21*4724848cSchristos }
22*4724848cSchristos
ssl_do_config(SSL * s,SSL_CTX * ctx,const char * name,int system)23*4724848cSchristos static int ssl_do_config(SSL *s, SSL_CTX *ctx, const char *name, int system)
24*4724848cSchristos {
25*4724848cSchristos SSL_CONF_CTX *cctx = NULL;
26*4724848cSchristos size_t i, idx, cmd_count;
27*4724848cSchristos int rv = 0;
28*4724848cSchristos unsigned int flags;
29*4724848cSchristos const SSL_METHOD *meth;
30*4724848cSchristos const SSL_CONF_CMD *cmds;
31*4724848cSchristos
32*4724848cSchristos if (s == NULL && ctx == NULL) {
33*4724848cSchristos SSLerr(SSL_F_SSL_DO_CONFIG, ERR_R_PASSED_NULL_PARAMETER);
34*4724848cSchristos goto err;
35*4724848cSchristos }
36*4724848cSchristos
37*4724848cSchristos if (name == NULL && system)
38*4724848cSchristos name = "system_default";
39*4724848cSchristos if (!conf_ssl_name_find(name, &idx)) {
40*4724848cSchristos if (!system) {
41*4724848cSchristos SSLerr(SSL_F_SSL_DO_CONFIG, SSL_R_INVALID_CONFIGURATION_NAME);
42*4724848cSchristos ERR_add_error_data(2, "name=", name);
43*4724848cSchristos }
44*4724848cSchristos goto err;
45*4724848cSchristos }
46*4724848cSchristos cmds = conf_ssl_get(idx, &name, &cmd_count);
47*4724848cSchristos cctx = SSL_CONF_CTX_new();
48*4724848cSchristos if (cctx == NULL)
49*4724848cSchristos goto err;
50*4724848cSchristos flags = SSL_CONF_FLAG_FILE;
51*4724848cSchristos if (!system)
52*4724848cSchristos flags |= SSL_CONF_FLAG_CERTIFICATE | SSL_CONF_FLAG_REQUIRE_PRIVATE;
53*4724848cSchristos if (s != NULL) {
54*4724848cSchristos meth = s->method;
55*4724848cSchristos SSL_CONF_CTX_set_ssl(cctx, s);
56*4724848cSchristos } else {
57*4724848cSchristos meth = ctx->method;
58*4724848cSchristos SSL_CONF_CTX_set_ssl_ctx(cctx, ctx);
59*4724848cSchristos }
60*4724848cSchristos if (meth->ssl_accept != ssl_undefined_function)
61*4724848cSchristos flags |= SSL_CONF_FLAG_SERVER;
62*4724848cSchristos if (meth->ssl_connect != ssl_undefined_function)
63*4724848cSchristos flags |= SSL_CONF_FLAG_CLIENT;
64*4724848cSchristos SSL_CONF_CTX_set_flags(cctx, flags);
65*4724848cSchristos for (i = 0; i < cmd_count; i++) {
66*4724848cSchristos char *cmdstr, *arg;
67*4724848cSchristos
68*4724848cSchristos conf_ssl_get_cmd(cmds, i, &cmdstr, &arg);
69*4724848cSchristos rv = SSL_CONF_cmd(cctx, cmdstr, arg);
70*4724848cSchristos if (rv <= 0) {
71*4724848cSchristos if (rv == -2)
72*4724848cSchristos SSLerr(SSL_F_SSL_DO_CONFIG, SSL_R_UNKNOWN_COMMAND);
73*4724848cSchristos else
74*4724848cSchristos SSLerr(SSL_F_SSL_DO_CONFIG, SSL_R_BAD_VALUE);
75*4724848cSchristos ERR_add_error_data(6, "section=", name, ", cmd=", cmdstr,
76*4724848cSchristos ", arg=", arg);
77*4724848cSchristos goto err;
78*4724848cSchristos }
79*4724848cSchristos }
80*4724848cSchristos rv = SSL_CONF_CTX_finish(cctx);
81*4724848cSchristos err:
82*4724848cSchristos SSL_CONF_CTX_free(cctx);
83*4724848cSchristos return rv <= 0 ? 0 : 1;
84*4724848cSchristos }
85*4724848cSchristos
SSL_config(SSL * s,const char * name)86*4724848cSchristos int SSL_config(SSL *s, const char *name)
87*4724848cSchristos {
88*4724848cSchristos return ssl_do_config(s, NULL, name, 0);
89*4724848cSchristos }
90*4724848cSchristos
SSL_CTX_config(SSL_CTX * ctx,const char * name)91*4724848cSchristos int SSL_CTX_config(SSL_CTX *ctx, const char *name)
92*4724848cSchristos {
93*4724848cSchristos return ssl_do_config(NULL, ctx, name, 0);
94*4724848cSchristos }
95*4724848cSchristos
ssl_ctx_system_config(SSL_CTX * ctx)96*4724848cSchristos void ssl_ctx_system_config(SSL_CTX *ctx)
97*4724848cSchristos {
98*4724848cSchristos ssl_do_config(NULL, ctx, NULL, 1);
99*4724848cSchristos }
100