SSL library configuration module.

__owur int SSL_CONF_cmd_argv(SSL_CONF_CTX *cctx, int *pargc, char ***pargv);

__owur int SSL_CONF_cmd_value_type(SSL_CONF_CTX *cctx, const char *cmd);

void SSL_add_ssl_module(void);

int SSL_config(SSL *s, const char *name);

int SSL_CTX_config(SSL_CTX *ctx, const char *name);

# ifndef OPENSSL_NO_SSL_TRACE

void SSL_trace(int write_p, int version, int content_type,

               const void *buf, size_t len, SSL *ssl, void *arg);

/* ssl_mcnf.c */

/*

 * Written by Stephen Henson (steve@openssl.org) for the OpenSSL project

 * 2015.

 */

/* ====================================================================

 * Copyright (c) 2015 The OpenSSL Project.  All rights reserved.

 *

 * Redistribution and use in source and binary forms, with or without

 * modification, are permitted provided that the following conditions

 * are met:

 *

 * 1. Redistributions of source code must retain the above copyright

 *    notice, this list of conditions and the following disclaimer.

 *

 * 2. Redistributions in binary form must reproduce the above copyright

 *    notice, this list of conditions and the following disclaimer in

 *    the documentation and/or other materials provided with the

 *    distribution.

 *

 * 3. All advertising materials mentioning features or use of this

 *    software must display the following acknowledgment:

 *    "This product includes software developed by the OpenSSL Project

 *    for use in the OpenSSL Toolkit. (http://www.OpenSSL.org/)"

 *

 * 4. The names "OpenSSL Toolkit" and "OpenSSL Project" must not be used to

 *    endorse or promote products derived from this software without

 *    prior written permission. For written permission, please contact

 *    licensing@OpenSSL.org.

 *

 * 5. Products derived from this software may not be called "OpenSSL"

 *    nor may "OpenSSL" appear in their names without prior written

 *    permission of the OpenSSL Project.

 *

 * 6. Redistributions of any form whatsoever must retain the following

 *    acknowledgment:

 *    "This product includes software developed by the OpenSSL Project

 *    for use in the OpenSSL Toolkit (http://www.OpenSSL.org/)"

 *

 * THIS SOFTWARE IS PROVIDED BY THE OpenSSL PROJECT ``AS IS'' AND ANY

 * EXPRESSED OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE

 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR

 * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE OpenSSL PROJECT OR

 * ITS CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,

 * SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT

 * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;

 * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)

 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,

 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)

 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED

 * OF THE POSSIBILITY OF SUCH DAMAGE.

 * ====================================================================

 *

 * This product includes cryptographic software written by Eric Young

 * (eay@cryptsoft.com).  This product includes software written by Tim

 * Hudson (tjh@cryptsoft.com).

 *

 */

#include <stdio.h>

#include <openssl/conf.h>

#include <openssl/ssl.h>

#include "ssl_locl.h"

/* SSL library configuration module. */

struct ssl_conf_name {

    /* Name of this set of commands */

    char *name;

    /* List of commands */

    struct ssl_conf_cmd *cmds;

    /* Number of commands */

    size_t cmd_count;

};

struct ssl_conf_cmd {

    /* Command */

    char *cmd;

    /* Argument */

    char *arg;

};

static struct ssl_conf_name *ssl_names;

static size_t ssl_names_count;

static void ssl_module_free()

{

    size_t i, j;

    if (ssl_names == NULL)

        return;

    for (i = 0; i < ssl_names_count; i++) {

        struct ssl_conf_name *tname = ssl_names + i;

        OPENSSL_free(tname->name);

        for (j = 0; j < tname->cmd_count; j++) {

            OPENSSL_free(tname->cmds[j].cmd);

            OPENSSL_free(tname->cmds[j].arg);

        }

        OPENSSL_free(tname->cmds);

    }

    OPENSSL_free(ssl_names);

    ssl_names = NULL;

    ssl_names_count = 0;

}

static int ssl_module_init(CONF_IMODULE *md, const CONF *cnf)

{

    size_t i, j, cnt;

    int rv = 0;

    const char *ssl_conf_section;

    STACK_OF(CONF_VALUE) *cmd_lists;

    ssl_conf_section = CONF_imodule_get_value(md);

    cmd_lists = NCONF_get_section(cnf, ssl_conf_section);

    if (sk_CONF_VALUE_num(cmd_lists) <= 0){

        if (cmd_lists == NULL)

            SSLerr(SSL_F_SSL_MODULE_INIT, SSL_R_SSL_SECTION_NOT_FOUND);

        else

            SSLerr(SSL_F_SSL_MODULE_INIT, SSL_R_SSL_SECTION_EMPTY);

        ERR_add_error_data(2, "section=", ssl_conf_section);

        goto err;

    }

    cnt = sk_CONF_VALUE_num(cmd_lists);

    ssl_names = OPENSSL_zalloc(sizeof(*ssl_names) * cnt);

    ssl_names_count = cnt;

    for (i = 0; i < ssl_names_count; i++) {

        struct ssl_conf_name *ssl_name = ssl_names + i;

        CONF_VALUE *sect = sk_CONF_VALUE_value(cmd_lists, i);

        STACK_OF(CONF_VALUE) *cmds = NCONF_get_section(cnf, sect->value);

        if (sk_CONF_VALUE_num(cmds) <= 0) {

            if (cmds == NULL)

                SSLerr(SSL_F_SSL_MODULE_INIT, SSL_R_SSL_COMMAND_SECTION_NOT_FOUND);

            else

                SSLerr(SSL_F_SSL_MODULE_INIT, SSL_R_SSL_COMMAND_SECTION_EMPTY);

            ERR_add_error_data(4, "name=", sect->name, ", value=", sect->value);

            goto err;

        }

        ssl_name->name = BUF_strdup(sect->name);

        if (ssl_name->name == NULL)

            goto err;

        cnt = sk_CONF_VALUE_num(cmds);

        ssl_name->cmds = OPENSSL_zalloc(cnt * sizeof(struct ssl_conf_cmd));

        if (ssl_name->cmds == NULL)

            goto err;

        ssl_name->cmd_count = cnt;

        for (j = 0; j < cnt; j++) {

            const char *name;

            CONF_VALUE *cmd_conf = sk_CONF_VALUE_value(cmds, j);

            struct ssl_conf_cmd *cmd = ssl_name->cmds + j;

            /* Skip any initial dot in name */

            name = strchr(cmd_conf->name, '.');

            if (name != NULL)

                name++;

            else

                name = cmd_conf->name;

            cmd->cmd = BUF_strdup(name);

            cmd->arg = BUF_strdup(cmd_conf->value);

            if (cmd->cmd == NULL || cmd->arg == NULL)

                goto err;

        }

    }

    rv = 1;

    err:

    if (rv == 0)

        ssl_module_free();

    return rv;

}

void SSL_add_ssl_module(void)

{

    CONF_module_add("ssl_conf", ssl_module_init, ssl_module_free);

}

static const struct ssl_conf_name *ssl_name_find(const char *name)

{

    size_t i;

    const struct ssl_conf_name *nm;

    if (name == NULL)

        return NULL;

    for (i = 0, nm = ssl_names; i < ssl_names_count; i++, nm++) {

        if (strcmp(nm->name, name) == 0)

            return nm;

    }

    return NULL;

}

static int ssl_do_config(SSL *s, SSL_CTX *ctx, const char *name)

{

    SSL_CONF_CTX *cctx = NULL;

    size_t i;

    int rv = 0;

    unsigned int flags;

    const SSL_METHOD *meth;

    const struct ssl_conf_name *nm;

    struct ssl_conf_cmd *cmd;

    if (s == NULL && ctx == NULL) {

        SSLerr(SSL_F_SSL_DO_CONFIG, ERR_R_PASSED_NULL_PARAMETER);

        goto err;

    }

    nm = ssl_name_find(name);

    if (nm == NULL) {

        SSLerr(SSL_F_SSL_DO_CONFIG, SSL_R_INVALID_CONFIGURATION_NAME);

        ERR_add_error_data(2, "name=", name);

        goto err;

    }

    cctx = SSL_CONF_CTX_new();

    if (cctx == NULL)

        goto err;

    flags = SSL_CONF_FLAG_FILE;

    flags |= SSL_CONF_FLAG_CERTIFICATE | SSL_CONF_FLAG_REQUIRE_PRIVATE;

    if (s != NULL) {

        meth = s->method;

        SSL_CONF_CTX_set_ssl(cctx, s);

    } else {

        meth = ctx->method;

        SSL_CONF_CTX_set_ssl_ctx(cctx, ctx);

    }

    if (meth->ssl_accept != ssl_undefined_function)

            flags |= SSL_CONF_FLAG_SERVER;

    if (meth->ssl_connect != ssl_undefined_function)

            flags |= SSL_CONF_FLAG_CLIENT;

    SSL_CONF_CTX_set_flags(cctx, flags);

    for (i = 0, cmd = nm->cmds; i < nm->cmd_count; i++, cmd++) {

        rv = SSL_CONF_cmd(cctx, cmd->cmd, cmd->arg);

        if (rv <= 0) {

            if (rv == -2)

                SSLerr(SSL_F_SSL_DO_CONFIG, SSL_R_UNKNOWN_COMMAND);

            else 

                SSLerr(SSL_F_SSL_DO_CONFIG, SSL_R_BAD_VALUE);

            ERR_add_error_data(6, "section=", name, ", cmd=", cmd->cmd,

                                    ", arg=", cmd->arg);

            goto err;

        }

    }

    rv = SSL_CONF_CTX_finish(cctx);

    err:

    SSL_CONF_CTX_free(cctx);

    return rv <= 0 ? 0 : 1;

}

int SSL_config(SSL *s, const char *name)

{

    return ssl_do_config(s, NULL, name);

}

int SSL_CTX_config(SSL_CTX *ctx, const char *name)

{

    return ssl_do_config(NULL, ctx, name);

}