Commit de3955f6 authored by Richard Levitte's avatar Richard Levitte
Browse files

EVP configuration section: add 'default_properties' command 



The value of the 'default_properties' command is simply passed to
EVP_set_default_properties().

Reviewed-by: default avatarPaul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/8681)
parent cb929645

crypto/evp/evp_cnf.c

+18 −4
Original line number Diff line number Diff line
@@ -13,9 +13,11 @@ 
#include <openssl/conf.h>

#include <openssl/x509.h>

#include <openssl/x509v3.h>

#include <openssl/trace.h>



/* Algorithm configuration module. */



/* TODO(3.0): the config module functions should be passed a library context */

static int alg_module_init(CONF_IMODULE *md, const CONF *cnf)

{

    int i;
@@ -23,6 +25,9 @@ static int alg_module_init(CONF_IMODULE *md, const CONF *cnf) 
    STACK_OF(CONF_VALUE) *sktmp;

    CONF_VALUE *oval;



    OSSL_TRACE2(CONF, "Loading EVP module: name %s, value %s\n",

                CONF_imodule_get_name(md), CONF_imodule_get_value(md));



    oid_section = CONF_imodule_get_value(md);

    if ((sktmp = NCONF_get_section(cnf, oid_section)) == NULL) {

        EVPerr(EVP_F_ALG_MODULE_INIT, EVP_R_ERROR_LOADING_SECTION);
@@ -32,18 +37,26 @@ static int alg_module_init(CONF_IMODULE *md, const CONF *cnf) 
        oval = sk_CONF_VALUE_value(sktmp, i);

        if (strcmp(oval->name, "fips_mode") == 0) {

            int m;



            if (!X509V3_get_value_bool(oval, &m)) {

                EVPerr(EVP_F_ALG_MODULE_INIT, EVP_R_INVALID_FIPS_MODE);

                return 0;

            }

            if (m > 0) {

                EVPerr(EVP_F_ALG_MODULE_INIT, EVP_R_FIPS_MODE_NOT_SUPPORTED);

                return 0;

            }

            /*

             * fips_mode is deprecated and should not be used in new

             * configurations.  Old configurations are likely to ONLY

             * have this, so we assume that no default properties have

             * been set before this.

             */

            if (m > 0)

                EVP_set_default_properties(NULL, "fips=yes");

        } else if (strcmp(oval->name, "default_properties") == 0) {

            EVP_set_default_properties(NULL, oval->value);

        } else {

            EVPerr(EVP_F_ALG_MODULE_INIT, EVP_R_UNKNOWN_OPTION);

            ERR_add_error_data(4, "name=", oval->name,

                               ", value=", oval->value);

            return 0;

        }



    }
@@ -52,5 +65,6 @@ static int alg_module_init(CONF_IMODULE *md, const CONF *cnf) 


void EVP_add_alg_module(void)

{

    OSSL_TRACE(CONF, "Adding config module 'alg_section'\n");

    CONF_module_add("alg_section", alg_module_init, 0);

}

doc/man5/config.pod

+25 −4
Original line number Diff line number Diff line
@@ -274,12 +274,33 @@ available to the provider. 


=head2 EVP Configuration Module



This modules has the name B<alg_section> which points to a section containing

This module has the name B<alg_section> which points to a section containing

algorithm commands.



Currently the only algorithm command supported is B<fips_mode> whose

value can only be the boolean string B<off>. If B<fips_mode> is set to B<on>,

an error occurs as this library version is not FIPS capable.

The supported algorithm commands are:



=over 4



=item B<default_properties>



The value may be anything that is acceptable as a property query

string for EVP_set_default_properties().



=item B<fips_mode> (deprecated)



The value is a boolean that can be B<yes> or B<no>.  If the value is

B<yes>, this is exactly equivalent to:



    default_properties = fips=yes



If the value is B<no>, nothing happens.



=back



These two commands should not be used together, as there is no control

over how they affect each other.

The use of B<fips_mode> is strongly discouraged and is only present

for backward compatibility with earlier OpenSSL FIPS modules.



=head2 SSL Configuration Module