1 /* 2 * Copyright 2016 The OpenSSL Project Authors. All Rights Reserved. 3 * 4 * Licensed under the OpenSSL license (the "License"). You may not use 5 * this file except in compliance with the License. You can obtain a copy 6 * in the file LICENSE in the source distribution or at 7 * https://www.openssl.org/source/license.html 8 */ 9 10 #include "e_os.h" 11 12 #include "internal/err.h" 13 #include <openssl/crypto.h> 14 #include <openssl/evp.h> 15 #include <assert.h> 16 #include "ssl_locl.h" 17 #include "internal/thread_once.h" 18 19 static int stopped; 20 21 static void ssl_library_stop(void); 22 23 static CRYPTO_ONCE ssl_base = CRYPTO_ONCE_STATIC_INIT; 24 static int ssl_base_inited = 0; 25 DEFINE_RUN_ONCE_STATIC(ossl_init_ssl_base) 26 { 27 #ifdef OPENSSL_INIT_DEBUG 28 fprintf(stderr, "OPENSSL_INIT: ossl_init_ssl_base: " 29 "Adding SSL ciphers and digests\n"); 30 #endif 31 #ifndef OPENSSL_NO_DES 32 EVP_add_cipher(EVP_des_cbc()); 33 EVP_add_cipher(EVP_des_ede3_cbc()); 34 #endif 35 #ifndef OPENSSL_NO_IDEA 36 EVP_add_cipher(EVP_idea_cbc()); 37 #endif 38 #ifndef OPENSSL_NO_RC4 39 EVP_add_cipher(EVP_rc4()); 40 # ifndef OPENSSL_NO_MD5 41 EVP_add_cipher(EVP_rc4_hmac_md5()); 42 # endif 43 #endif 44 #ifndef OPENSSL_NO_RC2 45 EVP_add_cipher(EVP_rc2_cbc()); 46 /* 47 * Not actually used for SSL/TLS but this makes PKCS#12 work if an 48 * application only calls SSL_library_init(). 49 */ 50 EVP_add_cipher(EVP_rc2_40_cbc()); 51 #endif 52 EVP_add_cipher(EVP_aes_128_cbc()); 53 EVP_add_cipher(EVP_aes_192_cbc()); 54 EVP_add_cipher(EVP_aes_256_cbc()); 55 EVP_add_cipher(EVP_aes_128_gcm()); 56 EVP_add_cipher(EVP_aes_256_gcm()); 57 EVP_add_cipher(EVP_aes_128_ccm()); 58 EVP_add_cipher(EVP_aes_256_ccm()); 59 EVP_add_cipher(EVP_aes_128_cbc_hmac_sha1()); 60 EVP_add_cipher(EVP_aes_256_cbc_hmac_sha1()); 61 EVP_add_cipher(EVP_aes_128_cbc_hmac_sha256()); 62 EVP_add_cipher(EVP_aes_256_cbc_hmac_sha256()); 63 #ifndef OPENSSL_NO_CAMELLIA 64 EVP_add_cipher(EVP_camellia_128_cbc()); 65 EVP_add_cipher(EVP_camellia_256_cbc()); 66 #endif 67 #if !defined(OPENSSL_NO_CHACHA) && !defined(OPENSSL_NO_POLY1305) 68 EVP_add_cipher(EVP_chacha20_poly1305()); 69 #endif 70 71 #ifndef OPENSSL_NO_SEED 72 EVP_add_cipher(EVP_seed_cbc()); 73 #endif 74 75 #ifndef OPENSSL_NO_MD5 76 EVP_add_digest(EVP_md5()); 77 EVP_add_digest_alias(SN_md5, "ssl3-md5"); 78 EVP_add_digest(EVP_md5_sha1()); 79 #endif 80 EVP_add_digest(EVP_sha1()); /* RSA with sha1 */ 81 EVP_add_digest_alias(SN_sha1, "ssl3-sha1"); 82 EVP_add_digest_alias(SN_sha1WithRSAEncryption, SN_sha1WithRSA); 83 EVP_add_digest(EVP_sha224()); 84 EVP_add_digest(EVP_sha256()); 85 EVP_add_digest(EVP_sha384()); 86 EVP_add_digest(EVP_sha512()); 87 #ifndef OPENSSL_NO_COMP 88 # ifdef OPENSSL_INIT_DEBUG 89 fprintf(stderr, "OPENSSL_INIT: ossl_init_ssl_base: " 90 "SSL_COMP_get_compression_methods()\n"); 91 # endif 92 /* 93 * This will initialise the built-in compression algorithms. The value 94 * returned is a STACK_OF(SSL_COMP), but that can be discarded safely 95 */ 96 SSL_COMP_get_compression_methods(); 97 #endif 98 /* initialize cipher/digest methods table */ 99 ssl_load_ciphers(); 100 101 #ifdef OPENSSL_INIT_DEBUG 102 fprintf(stderr, "OPENSSL_INIT: ossl_init_ssl_base: " 103 "SSL_add_ssl_module()\n"); 104 #endif 105 SSL_add_ssl_module(); 106 /* 107 * We ignore an error return here. Not much we can do - but not that bad 108 * either. We can still safely continue. 109 */ 110 OPENSSL_atexit(ssl_library_stop); 111 ssl_base_inited = 1; 112 return 1; 113 } 114 115 static CRYPTO_ONCE ssl_strings = CRYPTO_ONCE_STATIC_INIT; 116 static int ssl_strings_inited = 0; 117 DEFINE_RUN_ONCE_STATIC(ossl_init_load_ssl_strings) 118 { 119 /* 120 * OPENSSL_NO_AUTOERRINIT is provided here to prevent at compile time 121 * pulling in all the error strings during static linking 122 */ 123 #if !defined(OPENSSL_NO_ERR) && !defined(OPENSSL_NO_AUTOERRINIT) 124 # ifdef OPENSSL_INIT_DEBUG 125 fprintf(stderr, "OPENSSL_INIT: ossl_init_load_ssl_strings: " 126 "ERR_load_SSL_strings()\n"); 127 # endif 128 ERR_load_SSL_strings(); 129 #endif 130 ssl_strings_inited = 1; 131 return 1; 132 } 133 134 DEFINE_RUN_ONCE_STATIC(ossl_init_no_load_ssl_strings) 135 { 136 /* Do nothing in this case */ 137 return 1; 138 } 139 140 static void ssl_library_stop(void) 141 { 142 /* Might be explicitly called and also by atexit */ 143 if (stopped) 144 return; 145 stopped = 1; 146 147 if (ssl_base_inited) { 148 #ifndef OPENSSL_NO_COMP 149 # ifdef OPENSSL_INIT_DEBUG 150 fprintf(stderr, "OPENSSL_INIT: ssl_library_stop: " 151 "ssl_comp_free_compression_methods_int()\n"); 152 # endif 153 ssl_comp_free_compression_methods_int(); 154 #endif 155 } 156 157 if (ssl_strings_inited) { 158 #ifdef OPENSSL_INIT_DEBUG 159 fprintf(stderr, "OPENSSL_INIT: ssl_library_stop: " 160 "err_free_strings_int()\n"); 161 #endif 162 /* 163 * If both crypto and ssl error strings are inited we will end up 164 * calling err_free_strings_int() twice - but that's ok. The second 165 * time will be a no-op. It's easier to do that than to try and track 166 * between the two libraries whether they have both been inited. 167 */ 168 err_free_strings_int(); 169 } 170 } 171 172 /* 173 * If this function is called with a non NULL settings value then it must be 174 * called prior to any threads making calls to any OpenSSL functions, 175 * i.e. passing a non-null settings value is assumed to be single-threaded. 176 */ 177 int OPENSSL_init_ssl(uint64_t opts, const OPENSSL_INIT_SETTINGS * settings) 178 { 179 static int stoperrset = 0; 180 181 if (stopped) { 182 if (!stoperrset) { 183 /* 184 * We only ever set this once to avoid getting into an infinite 185 * loop where the error system keeps trying to init and fails so 186 * sets an error etc 187 */ 188 stoperrset = 1; 189 SSLerr(SSL_F_OPENSSL_INIT_SSL, ERR_R_INIT_FAIL); 190 } 191 return 0; 192 } 193 194 if (!RUN_ONCE(&ssl_base, ossl_init_ssl_base)) 195 return 0; 196 197 if (!OPENSSL_init_crypto(opts | OPENSSL_INIT_ADD_ALL_CIPHERS 198 | OPENSSL_INIT_ADD_ALL_DIGESTS, settings)) 199 return 0; 200 201 if ((opts & OPENSSL_INIT_NO_LOAD_SSL_STRINGS) 202 && !RUN_ONCE(&ssl_strings, ossl_init_no_load_ssl_strings)) 203 return 0; 204 205 if ((opts & OPENSSL_INIT_LOAD_SSL_STRINGS) 206 && !RUN_ONCE(&ssl_strings, ossl_init_load_ssl_strings)) 207 return 0; 208 209 return 1; 210 } 211