summaryrefslogtreecommitdiffstats
path: root/crypto/conf (follow)
Commit message (Collapse)AuthorAgeFilesLines
* crypto/conf: openssl_config_int() returns unitialized valueDr. Matthias St. Pierre2019-05-291-1/+1
| | | | | | | | | | | openssl_config_int() returns the uninitialized variable `ret` when compiled with OPENSSL_SYS_UEFI. Fixes #9026 Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/9029)
* Coverity: fix two minor NPD issues.FdaSilvaYY2019-04-061-2/+4
| | | | | | | | | Found by Coverity. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8274)
* Add a bit of tracing in the core conf module runnerRichard Levitte2019-04-051-0/+4
| | | | | | Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/8680)
* Replumbing: add a configuration module for providersRichard Levitte2019-04-031-0/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This configuration module supports a configuration structure pretty much like the engine configuration module, i.e. something like this: openssl_conf = openssl_init [openssl_init] providers = provider_section [provider_section] # Configure the provider named "foo" foo = foo_section # Configure the provider named "bar" bar = bar_section [foo_section] # Override name given in the provider section identity = myfoo # The exact path of the module. This is platform specific module_path = /opt/openssl/modules/foo.so # Whether it should be automatically activated. Value is unimportant activate = whatever # Anything else goes as well, and becomes parameters that the # provider can get what = 1 # sub-sections will be followed as well ever = ever_section [ever_section] cookie = monster All the configurations in a provider section and its sub-sections become parameters for the provider to get, i.e. the "foo" provider will be able to get values for the following keys (with associated values shown): identity => myfoo module_path => /opt/openssl/modules/foo.so activate => whatever what => 1 ever.cookie => monster Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8549)
* It isn't necessary to initialise a struct stat before a stat(2) system call.Pauli2019-03-291-1/+1
| | | | | | | | The initialisation was also flawed, failing to account for padding and alignment bytes. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8611)
* OPENSSL_config(): restore error agnosticismRichard Levitte2019-03-201-0/+1
| | | | | | | | | | | | | | Great effort has been made to make initialization more configurable. However, the behavior of OPENSSL_config() was lost in the process, having it suddenly generate errors it didn't previously, which is not how it's documented to behave. A simple setting of default flags fixes this problem. Fixes #8528 Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8533)
* Allow the syntax of the .include directive to optionally have '='Tomas Mraz2019-02-111-1/+6
| | | | | | | | | | | | | If the old openssl versions not supporting the .include directive load a config file with it, they will bail out with error. This change allows using the .include = <filename> syntax which is interpreted as variable assignment by the old openssl config file parser. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8141)
* Fix null pointer dereference in ssl_module_initDaniel DeFreez2019-02-101-0/+2
| | | | | | | | CLA: Trivial Reviewed-by: Paul Yang <yang.yang@baishancloud.com> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/8183)
* More configurable crypto and ssl library initializationViktor Dukhovni2019-01-073-5/+47
| | | | | | | | | | | | | | | | | | | | | | 1. In addition to overriding the default application name, one can now also override the configuration file name and flags passed to CONF_modules_load_file(). 2. By default we still keep going when configuration file processing fails. But, applications that want to be strict about initialization errors can now make explicit flag choices via non-null OPENSSL_INIT_SETTINGS that omit the CONF_MFLAGS_IGNORE_RETURN_CODES flag (which had so far been both undocumented and unused). 3. In OPENSSL_init_ssl() do not request OPENSSL_INIT_LOAD_CONFIG if the options already include OPENSSL_INIT_NO_LOAD_CONFIG. 4. Don't set up atexit() handlers when called with INIT_BASE_ONLY. Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7986)
* Update generator copyright year.Viktor Dukhovni2019-01-071-1/+1
| | | | | | | | | Some Travis builds appear to fail because generated objects get 2019 copyrights now, and the diff complains. Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7986)
* make updateMatt Caswell2019-01-031-1/+1
| | | | | Reviewed-by: Paul Yang <yang.yang@baishancloud.com> (Merged from https://github.com/openssl/openssl/pull/7972)
* Following the license change, modify the boilerplates in crypto/conf/Richard Levitte2018-12-0611-12/+12
| | | | | | | [skip ci] Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7785)
* Refactor the computation of API version limitsRichard Levitte2018-12-061-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Previously, the API version limit was indicated with a numeric version number. This was "natural" in the pre-3.0.0 because the version was this simple number. With 3.0.0, the version is divided into three separate numbers, and it's only the major number that counts, but we still need to be able to support pre-3.0.0 version limits. Therefore, we allow OPENSSL_API_COMPAT to be defined with a pre-3.0.0 style numeric version number or with a simple major number, i.e. can be defined like this for any application: -D OPENSSL_API_COMPAT=0x10100000L -D OPENSSL_API_COMPAT=3 Since the pre-3.0.0 numerical version numbers are high, it's easy to distinguish between a simple major number and a pre-3.0.0 numerical version number and to thereby support both forms at the same time. Internally, we define the following macros depending on the value of OPENSSL_API_COMPAT: OPENSSL_API_0_9_8 OPENSSL_API_1_0_0 OPENSSL_API_1_1_0 OPENSSL_API_3 They indicate that functions marked for deprecation in the corresponding major release shall not be built if defined. Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7724)
* Use secure_getenv(3) when available.Pauli2018-09-242-7/+5
| | | | | | | | | | | | | Change all calls to getenv() inside libcrypto to use a new wrapper function that use secure_getenv() if available and an issetugid then getenv if not. CPU processor override flags are unchanged. Extra checks for OPENSSL_issetugid() have been removed in favour of the safe getenv. Reviewed-by: Bernd Edlinger <bernd.edlinger@hotmail.de> (Merged from https://github.com/openssl/openssl/pull/7047)
* Update copyright yearMatt Caswell2018-09-111-1/+1
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/7176)
* Deallocate previously loaded SSL CONF module dataTomas Mraz2018-08-141-0/+1
| | | | | | | | | | | | If application explicitly calls CONF_modules_load_file() the SSL conf module will be initialized twice and the module data would leak. We need to free it before initializing it again. Fixes #6835 Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6948)
* def_load_bio(): Free |biosk| more carefullyRichard Levitte2018-07-241-2/+16
| | | | | | | | | If there's anything in the |biosk| stack, the first element is always the input BIO. It should never be freed in this function, so we must take careful steps not to do so inadvertently when freeing the stack. Reviewed-by: Kurt Roeckx <kurt@roeckx.be> (Merged from https://github.com/openssl/openssl/pull/6769)
* crypto/*: address standard-compilance nits.Andy Polyakov2018-07-201-1/+5
| | | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Kurt Roeckx <kurt@roeckx.be> (Merged from https://github.com/openssl/openssl/pull/6745)
* NCONF_get_number refix.Pauli2018-07-112-12/+33
| | | | | | | | | | | | Fix the NULL check lack in a different way that is more compatible with non-NULL branch. Refer #6632 Also mark and pop the error stack instead of clearing all errors when something goes awry in CONF_get_number. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6643)
* Check for NULL conf in NCONF_get_numberPauli2018-07-031-4/+7
| | | | | | | | | | | | | The problematic case falls back to a NULL conf which returns the result of getenv(2). If this returns NULL, everything was good. If this returns a string an attempt to convert it to a number is made using the function pointers from conf. This fix uses the strtol(3) function instead, we don't have the configuration settings and this behaves as the default would. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6632)
* Update copyright yearMatt Caswell2018-05-291-1/+1
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/6371)
* Use void in all function definitions that do not take any argumentsKurt Roeckx2018-05-111-2/+2
| | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> GH: #6208
* Fix memory leaks in CA related functions.Pavel Kopyl2018-05-021-1/+3
| | | | | | Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4700)
* Update copyright yearRichard Levitte2018-04-172-2/+2
| | | | | Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5990)
* Fix false positives of IS_*() macros for 8-bit ASCII charactersDr. Matthias St. Pierre2018-04-083-34/+45
| | | | | | | | | | | | | | | | | | | | | Fixes #5778, #5840 The various IS_*() macros did not work correctly for 8-bit ASCII characters with the high bit set, because the CVT(a) preprocessor macro and'ed the given ASCII value with 0x7F, effectively folding the high value range 128-255 over the low value range 0-127. As a consequence, some of the IS_*() erroneously returned TRUE. This commit fixes the issue by adding range checks instead of cutting off high order bits using a mask. In order avoid multiple evaluation of macro arguments, most of the implementation was moved from macros into a static function is_keytype(). Thanks to Румен Петров for reporting and analyzing the UTF-8 parsing issue #5840. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5903)
* Move the loading of the ssl_conf module to libcryptoMatt Caswell2018-04-055-1/+200
| | | | | | | | | | | | | | | | | | | | | | | The GOST engine needs to be loaded before we initialise libssl. Otherwise the GOST ciphersuites are not enabled. However the SSL conf module must be loaded before we initialise libcrypto. Otherwise we will fail to read the SSL config from a config file properly. Another problem is that an application may make use of both libcrypto and libssl. If it performs libcrypto stuff first and OPENSSL_init_crypto() is called and loads a config file it will fail if that config file has any libssl stuff in it. This commit separates out the loading of the SSL conf module from the interpretation of its contents. The loading piece doesn't know anything about SSL so this can be moved to libcrypto. The interpretation of what it means remains in libssl. This means we can load the SSL conf data before libssl is there and interpret it when it later becomes available. Fixes #5809 Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5818)
* Don't use getenv for critical functions when run as setuid/setgidBernd Edlinger2018-04-041-3/+5
| | | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5856)
* Set error code on alloc failuresRich Salz2018-04-032-2/+4
| | | | | | | Almost all *alloc failures now set an error code. Reviewed-by: Matthias St. Pierre <Matthias.St.Pierre@ncp-e.com> (Merged from https://github.com/openssl/openssl/pull/5842)
* Remove some codeMatt Caswell2018-03-282-50/+11
| | | | | | | | | | | | | This commit removes the contribution of a user that we cannot trace to gain their consent for the licence change. After this commit the various IS_*() macros in the auto-generated file conf_def.h may incorrectly return true if the supplied character has its most significant bit set. The IS_*() macros should be able to correctly handle 8-bit characters. Note that UTF-8 support is not a requirement. Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5767)
* Revise and cleanup; use strict,warningsRich Salz2018-03-193-158/+131
| | | | | | | | Use shorter names for some defines, so also had to change the .c file that used them. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5669)
* CONF: On VMS, treat VMS syntax inclusion paths correctlyRichard Levitte2018-03-121-3/+19
| | | | | | | non-VMS syntax inclusion paths get the same treatment as on Unix. Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5587)
* Add support for .include directive in config filesTomas Mraz2018-03-052-15/+193
| | | | | | | | | | Either files or directories of *.cnf or *.conf files can be included. Recursive inclusion of directories is not supported. Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5351)
* Update copyright yearMatt Caswell2018-02-271-1/+1
| | | | Reviewed-by: Richard Levitte <levitte@openssl.org>
* Generate copyright year properlyRich Salz2018-02-132-2/+4
| | | | | | | | | Output copyright year depends on any input file(s) and the script. This is not perfect, but better than what we had. Also run 'make update' Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/5350)
* Resolve warnings in VC-WIN32 build, which allows to add /WX.Andy Polyakov2017-11-131-0/+4
| | | | | | | | It's argued that /WX allows to keep better focus on new code, which motivates its comeback... Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4721)
* Remove parentheses of return.KaoruToda2017-10-182-13/+13
| | | | | | | | | Since return is inconsistent, I removed unnecessary parentheses and unified them. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4541)
* Use safestack.h exclusively internally.Pauli2017-09-281-1/+0
| | | | | | | | | | | | Remove all stack headers from some includes that don't use them. Avoid a genearic untyped stack use. Update stack POD file to include the OPENSSL_sk_ API functions in the notes section. They were mentioned in the name section but not defined anywhere. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4430)
* Move e_os.h to be the very first include.Pauli2017-08-293-4/+3
| | | | | | | | cryptilib.h is the second. Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4188)
* e_os.h removal from other headers and source files.Pauli2017-08-291-0/+1
| | | | | | | | | | | | | Removed e_os.h from all bar three headers (apps/apps.h crypto/bio/bio_lcl.h and ssl/ssl_locl.h). Added e_os.h into the files that need it now. Directly reference internal/nelem.h when required. Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4188)
* Use "" not <> for internal/ includesRich Salz2017-08-222-2/+2
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/4217)
* Remove OPENSSL_assert() from conf_api.cMatt Caswell2017-08-211-1/+2
| | | | | Reviewed-by: Andy Polyakov <appro@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3740)
* Trivial bounds checking.Pauli2017-07-072-22/+20
| | | | | | | | | Bounds checking strpy, strcat and sprintf. These are the remaining easy ones to cover a recently removed commit. Some are trivial, some have been modified and a couple left as they are because the reverted change didn't bounds check properly. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3871)
* Undo commit d420ac2Rich Salz2017-07-052-6/+6
| | | | | | | | | | | | | | | [extended tests] Original text: Use BUF_strlcpy() instead of strcpy(). Use BUF_strlcat() instead of strcat(). Use BIO_snprintf() instead of sprintf(). In some cases, keep better track of buffer lengths. This is part of a large change submitted by Markus Friedl <markus@openbsd.org> Reviewed-by: Tim Hudson <tjh@openssl.org> Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/3701)
* make error tables const and separate header fileRich Salz2017-06-071-51/+51
| | | | | | | | | | | | | | | | | | | Run perltidy on util/mkerr Change some mkerr flags, write some doc comments Make generated tables "const" when genearting lib-internal ones. Add "state" file for mkerr Renerate error tables and headers Rationalize declaration of ERR_load_XXX_strings Fix out-of-tree build Add -static; sort flags/vars for options. Also tweak code output Moved engines/afalg to engines (from master) Use -static flag Standard engine #include's of errors Don't linewrap err string tables unless necessary Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/3392)
* Fix out-of-memory condition in confMatt Caswell2017-03-122-3/+17
| | | | | | | | | | | | conf has the ability to expand variables in config files. Repeatedly doing this can lead to an exponential increase in the amount of memory required. This places a limit on the length of a value that can result from an expansion. Credit to OSS-Fuzz for finding this problem. Reviewed-by: Rich Salz <rsalz@openssl.org> Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/2894)
* Check for errors allocating the error strings.Kurt Roeckx2016-07-201-1/+2
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> GH: #1330
* Whitespace cleanup in cryptoFdaSilvaYY2016-06-291-2/+2
| | | | | | Reviewed-by: Andy Polyakov <appro@openssl.org> Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1264)
* Constify some conf_mod.c internal methodsFdaSilvaYY2016-06-151-9/+11
| | | | | Reviewed-by: Kurt Roeckx <kurt@openssl.org> Reviewed-by: Rich Salz <rsalz@openssl.org> (Merged from https://github.com/openssl/openssl/pull/1215)
* RT4562: Fix misleading doc on OPENSSL_configRich Salz2016-06-142-14/+14
| | | | | | Also changed the code to use "appname" not "filename" Reviewed-by: Matt Caswell <matt@openssl.org>
* Handle Visual C warning about non-standard function names.Richard Levitte2016-05-261-0/+1
| | | | | | | | | | | | | | | | | Visual C version from version 2003 complain about certain function names, for example: apps\apps.c(2572) : warning C4996: 'open': The POSIX name for this item is deprecated. Instead, use the ISO C++ conformant name: _open. See online help for details. This adds preprocessor aliases for them in e_os.h. Additionally, crypto/conf/conf_lib.c needs to include e_os.h to catch those aliases. RT#4488 RT#4489 Reviewed-by: Matt Caswell <matt@openssl.org>
generated by cgit v1.2.3 (git 2.39.1) at 2025-01-07 16:01:56 +0100