luna - wolfssl/src/conf.c

   1/* conf.c
   2 *
   3 * Copyright (C) 2006-2026 wolfSSL Inc.
   4 *
   5 * This file is part of wolfSSL.
   6 *
   7 * wolfSSL is free software; you can redistribute it and/or modify
   8 * it under the terms of the GNU General Public License as published by
   9 * the Free Software Foundation; either version 3 of the License, or
  10 * (at your option) any later version.
  11 *
  12 * wolfSSL is distributed in the hope that it will be useful,
  13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
  14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  15 * GNU General Public License for more details.
  16 *
  17 * You should have received a copy of the GNU General Public License
  18 * along with this program; if not, write to the Free Software
  19 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1335, USA
  20 */
  21
  22#include <wolfssl/wolfcrypt/libwolfssl_sources.h>
  23
  24#if !defined(WOLFSSL_CONF_INCLUDED)
  25    #ifndef WOLFSSL_IGNORE_FILE_WARN
  26        #warning conf.c does not need to be compiled separately from ssl.c
  27    #endif
  28#else
  29
  30/*******************************************************************************
  31 * START OF TXT_DB API
  32 ******************************************************************************/
  33
  34#define LINE_BUFFER_SIZE 512 /* enough for a single row */
  35
  36#if defined(OPENSSL_ALL) && !defined(NO_BIO)
  37/**
  38 * This function reads a tab delimetered CSV input and returns
  39 * a populated WOLFSSL_TXT_DB structure.
  40 * @param in Tab delimetered CSV input
  41 * @param num Number of fields in each row.
  42 * @return
  43 */
  44WOLFSSL_TXT_DB *wolfSSL_TXT_DB_read(WOLFSSL_BIO *in, int num)
  45{
  46    WOLFSSL_TXT_DB *ret = NULL;
  47    char *buf = NULL;
  48    char *bufEnd = NULL;
  49    char *idx = NULL;
  50    char* lineEnd = NULL;
  51    int bufSz;
  52    int failed = 1;
  53    /* Space in front of str reserved for field pointers + \0 */
  54    int fieldsSz = (num + 1) * sizeof(char *);
  55    WOLFSSL_ENTER("wolfSSL_TXT_DB_read");
  56
  57    if (!in || num <= 0 || num > WOLFSSL_TXT_DB_MAX_FIELDS) {
  58        WOLFSSL_MSG("Bad parameter or too many fields");
  59        return NULL;
  60    }
  61
  62    if (!(ret = (WOLFSSL_TXT_DB*)XMALLOC(sizeof(WOLFSSL_TXT_DB), NULL,
  63            DYNAMIC_TYPE_OPENSSL))) {
  64        WOLFSSL_MSG("malloc error");
  65        goto error;
  66    }
  67    XMEMSET (ret, 0, sizeof(WOLFSSL_TXT_DB));
  68    ret->num_fields = num;
  69
  70    if (!(ret->data = wolfSSL_sk_WOLFSSL_STRING_new())) {
  71        WOLFSSL_MSG("wolfSSL_sk_WOLFSSL_STRING_new error");
  72        goto error;
  73    }
  74
  75    bufSz = wolfSSL_BIO_get_len(in);
  76    if (bufSz <= 0 ||
  77            !(buf = (char*)XMALLOC(bufSz+1, NULL,
  78                    DYNAMIC_TYPE_TMP_BUFFER))) {
  79        WOLFSSL_MSG("malloc error or no data in BIO");
  80        goto error;
  81    }
  82
  83    if (wolfSSL_BIO_read(in, buf, bufSz) != bufSz) {
  84        WOLFSSL_MSG("malloc error or no data in BIO");
  85        goto error;
  86    }
  87
  88    buf[bufSz] = '\0';
  89    idx = buf;
  90    for (bufEnd = buf + bufSz; idx < bufEnd; idx = lineEnd + 1) {
  91        char* strBuf = NULL;
  92        char** fieldPtr = NULL;
  93        int fieldPtrIdx = 0;
  94        char* fieldCheckIdx = NULL;
  95        lineEnd = XSTRNSTR(idx, "\n", (size_t)(bufEnd - idx));
  96        if (!lineEnd)
  97            lineEnd = bufEnd;
  98        if (idx == lineEnd) /* empty line */
  99            continue;
 100        if (*idx == '#')
 101            continue;
 102        *lineEnd = '\0';
 103        strBuf = (char*)XMALLOC(fieldsSz + (lineEnd - idx) + 1, NULL,
 104                                DYNAMIC_TYPE_OPENSSL);
 105        if (!strBuf) {
 106            WOLFSSL_MSG("malloc error");
 107            goto error;
 108        }
 109        XMEMCPY(strBuf + fieldsSz, idx, lineEnd - idx + 1); /* + 1 for NULL */
 110        XMEMSET(strBuf, 0, fieldsSz);
 111        /* Check for appropriate number of fields */
 112        fieldPtr = (char**)strBuf;
 113        fieldCheckIdx = strBuf + fieldsSz;
 114        fieldPtr[fieldPtrIdx++] = fieldCheckIdx;
 115        while (*fieldCheckIdx != '\0') {
 116            /* Handle escaped tabs */
 117            if (*fieldCheckIdx == '\t' && fieldCheckIdx[-1] != '\\') {
 118                fieldPtr[fieldPtrIdx++] = fieldCheckIdx + 1;
 119                *fieldCheckIdx = '\0';
 120                if (fieldPtrIdx > num) {
 121                    WOLFSSL_MSG("too many fields");
 122                    XFREE(strBuf, NULL, DYNAMIC_TYPE_OPENSSL);
 123                    goto error;
 124                }
 125            }
 126            fieldCheckIdx++;
 127        }
 128        if (fieldPtrIdx != num) {
 129            WOLFSSL_MSG("wrong number of fields");
 130            XFREE(strBuf, NULL, DYNAMIC_TYPE_OPENSSL);
 131            goto error;
 132        }
 133        if (wolfSSL_sk_push(ret->data, strBuf) <= 0) {
 134            WOLFSSL_MSG("wolfSSL_sk_push error");
 135            XFREE(strBuf, NULL, DYNAMIC_TYPE_OPENSSL);
 136            goto error;
 137        }
 138    }
 139
 140    failed = 0;
 141error:
 142    if (failed && ret) {
 143        wolfSSL_TXT_DB_free(ret);
 144        ret = NULL;
 145    }
 146    XFREE(buf, NULL, DYNAMIC_TYPE_TMP_BUFFER);
 147    return ret;
 148}
 149
 150long wolfSSL_TXT_DB_write(WOLFSSL_BIO *out, WOLFSSL_TXT_DB *db)
 151{
 152    const WOLF_STACK_OF(WOLFSSL_STRING)* data;
 153    long totalLen = 0;
 154    WC_DECLARE_VAR(buf, char, LINE_BUFFER_SIZE, NULL); /* enough for a single row */
 155    char* bufEnd;
 156    int i;
 157
 158    WOLFSSL_ENTER("wolfSSL_TXT_DB_write");
 159
 160    if (!out || !db || !db->num_fields) {
 161        WOLFSSL_MSG("Bad parameter");
 162        return WOLFSSL_FAILURE;
 163    }
 164
 165    WC_ALLOC_VAR_EX(buf, char, LINE_BUFFER_SIZE, NULL, DYNAMIC_TYPE_TMP_BUFFER,
 166                    return WOLFSSL_FAILURE);
 167    bufEnd = buf + LINE_BUFFER_SIZE;
 168
 169    data = db->data;
 170    while (data) {
 171        char** fields = (char**)data->data.string;
 172        char* idx = buf;
 173        int sz;
 174
 175        if (!fields) {
 176            WOLFSSL_MSG("Missing row");
 177            WC_FREE_VAR_EX(buf, NULL, DYNAMIC_TYPE_TMP_BUFFER);
 178            return WOLFSSL_FAILURE;
 179        }
 180
 181        for (i = 0; i < db->num_fields; i++) {
 182            const char* fieldValue = fields[i];
 183            if (!fieldValue) {
 184                fieldValue = "";
 185            }
 186
 187            /* Copy over field escaping tabs */
 188            while (*fieldValue != '\0') {
 189                if (idx+1 < bufEnd) {
 190                    if (*fieldValue == '\t')
 191                        *idx++ = '\\';
 192                    *idx++ = *fieldValue++;
 193                }
 194                else {
 195                    WOLFSSL_MSG("Data row is too big");
 196                    WC_FREE_VAR_EX(buf, NULL, DYNAMIC_TYPE_TMP_BUFFER);
 197                    return WOLFSSL_FAILURE;
 198                }
 199            }
 200            if (idx < bufEnd) {
 201                *idx++ = '\t';
 202            }
 203            else {
 204                WOLFSSL_MSG("Data row is too big");
 205                WC_FREE_VAR_EX(buf, NULL, DYNAMIC_TYPE_TMP_BUFFER);
 206                return WOLFSSL_FAILURE;
 207            }
 208        }
 209        if (idx > buf)
 210            idx[-1] = '\n';
 211        else {
 212            WC_FREE_VAR_EX(buf, NULL, DYNAMIC_TYPE_TMP_BUFFER);
 213            return WOLFSSL_FAILURE;
 214        }
 215        sz = (int)(idx - buf);
 216
 217        if (wolfSSL_BIO_write(out, buf, sz) != sz) {
 218            WOLFSSL_MSG("wolfSSL_BIO_write error");
 219            WC_FREE_VAR_EX(buf, NULL, DYNAMIC_TYPE_TMP_BUFFER);
 220            return WOLFSSL_FAILURE;
 221        }
 222        totalLen += sz;
 223
 224        data = data->next;
 225    }
 226
 227    WC_FREE_VAR_EX(buf, NULL, DYNAMIC_TYPE_TMP_BUFFER);
 228    return totalLen;
 229}
 230
 231int wolfSSL_TXT_DB_insert(WOLFSSL_TXT_DB *db, WOLFSSL_STRING *row)
 232{
 233    WOLFSSL_ENTER("wolfSSL_TXT_DB_insert");
 234
 235    if (!db || !row || !db->data) {
 236        WOLFSSL_MSG("Bad parameter");
 237        return WOLFSSL_FAILURE;
 238    }
 239
 240    if (wolfSSL_sk_push(db->data, row) <= 0) {
 241        WOLFSSL_MSG("wolfSSL_sk_push error");
 242        return WOLFSSL_FAILURE;
 243    }
 244
 245    return WOLFSSL_SUCCESS;
 246}
 247
 248void wolfSSL_TXT_DB_free(WOLFSSL_TXT_DB *db)
 249{
 250    WOLFSSL_ENTER("wolfSSL_TXT_DB_free");
 251    if (db) {
 252        if (db->data) {
 253            wolfSSL_sk_pop_free(db->data, NULL);
 254        }
 255        XFREE(db, NULL, DYNAMIC_TYPE_OPENSSL);
 256    }
 257}
 258
 259int wolfSSL_TXT_DB_create_index(WOLFSSL_TXT_DB *db, int field,
 260        void* qual, wolf_sk_hash_cb hash, wolf_lh_compare_cb cmp)
 261{
 262    WOLFSSL_ENTER("wolfSSL_TXT_DB_create_index");
 263    (void)qual;
 264    (void)cmp;
 265
 266    if (!db || !hash || !cmp || field >= db->num_fields || field < 0) {
 267        WOLFSSL_MSG("Bad parameter");
 268        return WOLFSSL_FAILURE;
 269    }
 270
 271    db->hash_fn[field] = hash;
 272
 273    return WOLFSSL_SUCCESS;
 274}
 275
 276WOLFSSL_STRING *wolfSSL_TXT_DB_get_by_index(WOLFSSL_TXT_DB *db, int idx,
 277        WOLFSSL_STRING *value)
 278{
 279    WOLFSSL_ENTER("wolfSSL_TXT_DB_get_by_index");
 280
 281    if (!db || !db->data || idx < 0 || idx >= db->num_fields) {
 282        WOLFSSL_MSG("Bad parameter");
 283        return NULL;
 284    }
 285
 286    if (!db->hash_fn[idx]) {
 287        WOLFSSL_MSG("Missing hash functions");
 288        return NULL;
 289    }
 290
 291    /* If first data struct has correct hash function
 292     * then assume others do too */
 293    if (db->data->hash_fn != db->hash_fn[idx]) {
 294        /* Set the hash and comp functions */
 295        WOLF_STACK_OF(WOLFSSL_STRING)* data = db->data;
 296        while (data) {
 297            if (data->hash_fn != db->hash_fn[idx]) {
 298                data->hash_fn = db->hash_fn[idx];
 299                data->hash = 0;
 300            }
 301            data= data->next;
 302        }
 303    }
 304    return (WOLFSSL_STRING*) wolfSSL_lh_retrieve(db->data, value);
 305}
 306
 307#endif /* OPENSSL_ALL && !NO_BIO */
 308
 309/*******************************************************************************
 310 * END OF TXT_DB API
 311 ******************************************************************************/
 312
 313/*******************************************************************************
 314 * START OF CONF API
 315 ******************************************************************************/
 316
 317#if defined(OPENSSL_ALL) || defined(WOLFSSL_NGINX) || defined(WOLFSSL_HAPROXY) \
 318 || defined(HAVE_STUNNEL)
 319#ifndef NO_WOLFSSL_STUB
 320void wolfSSL_OPENSSL_config(char *config_name)
 321{
 322    (void)config_name;
 323    WOLFSSL_STUB("OPENSSL_config");
 324}
 325#endif /* !NO_WOLFSSL_STUB */
 326#endif /* OPENSSL_ALL || WOLFSSL_NGINX || WOLFSSL_HAPROXY || HAVE_STUNNEL*/
 327
 328#if !defined(NO_CERTS) && defined(OPENSSL_EXTRA) && defined(OPENSSL_ALL)
 329
 330/**
 331 * This is the same hashing algo for WOLFSSL_CONF_VALUE as OpenSSL
 332 */
 333static unsigned long wolfSSL_CONF_VALUE_hash(const WOLFSSL_CONF_VALUE *val)
 334{
 335    if (val)
 336        return (wolfSSL_LH_strhash(val->section) << 2) ^
 337                wolfSSL_LH_strhash(val->name);
 338    else
 339        return 0;
 340}
 341
 342/* Use SHA[256] for hashing as OpenSSL uses a hash algorithm that is
 343 * "not as good as MD5, but still good" so using SHA should be more
 344 * than good enough for this application. The produced hashes don't
 345 * need to line up between OpenSSL and wolfSSL. The hashes are for
 346 * internal indexing only */
 347unsigned long wolfSSL_LH_strhash(const char *str)
 348{
 349    unsigned long ret = 0;
 350    int strLen;
 351#if !defined(NO_SHA)
 352    wc_Sha sha;
 353    byte digest[WC_SHA_DIGEST_SIZE];
 354#elif !defined(NO_SHA256)
 355    wc_Sha256 sha;
 356    byte digest[WC_SHA256_DIGEST_SIZE];
 357#endif
 358    WOLFSSL_ENTER("wolfSSL_LH_strhash");
 359
 360    if (!str)
 361        return 0;
 362    strLen = (int)XSTRLEN(str);
 363
 364#if !defined(NO_SHA)
 365    if (wc_InitSha_ex(&sha, NULL, 0) != 0) {
 366        WOLFSSL_MSG("SHA1 Init failed");
 367        return 0;
 368    }
 369
 370    ret = wc_ShaUpdate(&sha, (const byte *)str, (word32)strLen);
 371    if (ret != 0) {
 372        WOLFSSL_MSG("SHA1 Update failed");
 373    } else {
 374        ret = wc_ShaFinal(&sha, digest);
 375        if (ret != 0) {
 376            WOLFSSL_MSG("SHA1 Final failed");
 377        }
 378    }
 379    wc_ShaFree(&sha);
 380#elif !defined(NO_SHA256)
 381    if (wc_InitSha256_ex(&sha, NULL, 0) != 0) {
 382        WOLFSSL_MSG("SHA256 Init failed");
 383        return 0;
 384    }
 385
 386    ret = wc_Sha256Update(&sha, (const byte *)str, (word32)strLen);
 387    if (ret != 0) {
 388        WOLFSSL_MSG("SHA256 Update failed");
 389    } else {
 390        ret = wc_Sha256Final(&sha, digest);
 391        if (ret != 0) {
 392            WOLFSSL_MSG("SHA256 Final failed");
 393        }
 394    }
 395    wc_Sha256Free(&sha);
 396#endif
 397
 398#if !defined(NO_SHA) || !defined(NO_SHA256)
 399    if (ret != 0)
 400        return 0;
 401
 402    /* Take first 4 bytes in small endian as unsigned long */
 403    ret  =  (unsigned int)digest[0];
 404    ret |= ((unsigned int)digest[1] << 8 );
 405    ret |= ((unsigned int)digest[2] << 16);
 406    ret |= ((unsigned int)digest[3] << 24);
 407#else
 408    WOLFSSL_MSG("No SHA available for wolfSSL_LH_strhash");
 409#endif
 410    return ret;
 411}
 412
 413WOLFSSL_CONF_VALUE *wolfSSL_lh_WOLFSSL_CONF_VALUE_retrieve(
 414        WOLF_LHASH_OF(WOLFSSL_CONF_VALUE) *sk, WOLFSSL_CONF_VALUE *data)
 415{
 416    WOLFSSL_ENTER("wolfSSL_lh_WOLFSSL_CONF_VALUE_retrieve");
 417
 418    if (!sk || !data) {
 419        WOLFSSL_MSG("Bad parameter");
 420        return NULL;
 421    }
 422
 423    return (WOLFSSL_CONF_VALUE*)wolfSSL_lh_retrieve(sk, data);
 424}
 425
 426int wolfSSL_CONF_modules_load(const WOLFSSL_CONF *cnf, const char *appname,
 427                      unsigned long flags)
 428{
 429    WOLFSSL_ENTER("wolfSSL_CONF_modules_load");
 430    WOLFSSL_MSG("All wolfSSL modules are already compiled in. "
 431                "wolfSSL_CONF_modules_load doesn't load anything new.");
 432    (void)cnf;
 433    (void)appname;
 434    (void)flags;
 435    return WOLFSSL_SUCCESS;
 436}
 437
 438WOLFSSL_CONF_VALUE *wolfSSL_CONF_VALUE_new(void)
 439{
 440    WOLFSSL_CONF_VALUE* ret;
 441
 442    WOLFSSL_ENTER("wolfSSL_CONF_new");
 443
 444    ret = (WOLFSSL_CONF_VALUE*)XMALLOC(sizeof(WOLFSSL_CONF_VALUE),
 445            NULL, DYNAMIC_TYPE_OPENSSL);
 446    if (ret)
 447        XMEMSET(ret, 0, sizeof(WOLFSSL_CONF_VALUE));
 448    return ret;
 449}
 450
 451int wolfSSL_CONF_add_string(WOLFSSL_CONF *conf,
 452        WOLFSSL_CONF_VALUE *section, WOLFSSL_CONF_VALUE *value)
 453{
 454    WOLF_STACK_OF(WOLFSSL_CONF_VALUE) *sk = NULL;
 455
 456    if (!conf || !section || !value) {
 457        WOLFSSL_MSG("Bad parameter");
 458        return WOLFSSL_FAILURE;
 459    }
 460
 461    sk = (WOLF_STACK_OF(WOLFSSL_CONF_VALUE) *)section->value;
 462    value->section = section->section;
 463
 464    if (wolfSSL_sk_CONF_VALUE_push(sk, value) <= 0) {
 465        WOLFSSL_MSG("wolfSSL_sk_CONF_VALUE_push error");
 466        return WOLFSSL_FAILURE;
 467    }
 468    if (wolfSSL_sk_CONF_VALUE_push(conf->data, value) <= 0) {
 469        WOLFSSL_MSG("wolfSSL_sk_CONF_VALUE_push error");
 470        wolfssl_sk_pop_type(sk, STACK_TYPE_CONF_VALUE);
 471        return WOLFSSL_FAILURE;
 472    }
 473
 474    return WOLFSSL_SUCCESS;
 475}
 476
 477WOLFSSL_CONF_VALUE *wolfSSL_CONF_new_section(WOLFSSL_CONF *conf,
 478        const char *section)
 479{
 480    WOLFSSL_CONF_VALUE* ret = NULL;
 481    WOLF_STACK_OF(WOLFSSL_CONF_VALUE) *sk = NULL;
 482    int slen;
 483
 484    WOLFSSL_ENTER("wolfSSL_CONF_new_section");
 485
 486    if (!conf || !section) {
 487        WOLFSSL_MSG("Bad parameter");
 488        return NULL;
 489    }
 490
 491    slen = (int)XSTRLEN(section);
 492
 493    if (!(ret = wolfSSL_CONF_VALUE_new())) {
 494        WOLFSSL_MSG("wolfSSL_CONF_new error");
 495        goto error;
 496    }
 497
 498    if (!(ret->section = (char*)XMALLOC(slen+1, NULL, DYNAMIC_TYPE_OPENSSL))) {
 499        WOLFSSL_MSG("section malloc error");
 500        goto error;
 501    }
 502    XMEMCPY(ret->section, section, slen+1);
 503
 504    if (!(sk = wolfSSL_sk_CONF_VALUE_new(NULL))) {
 505        WOLFSSL_MSG("wolfSSL_sk_CONF_VALUE_new error");
 506        goto error;
 507    }
 508
 509    ret->value = (char*)sk;
 510
 511    if (wolfSSL_sk_CONF_VALUE_push(conf->data, ret) <= 0) {
 512        WOLFSSL_MSG("wolfSSL_sk_CONF_VALUE_push error");
 513        goto error;
 514    }
 515
 516    return ret;
 517error:
 518    if (ret) {
 519        /* NULL so that wolfSSL_X509V3_conf_free doesn't attempt to free it */
 520        ret->value = NULL;
 521        wolfSSL_X509V3_conf_free(ret);
 522    }
 523    if (sk) {
 524        wolfSSL_sk_CONF_VALUE_free(sk);
 525    }
 526    return NULL;
 527}
 528
 529WOLFSSL_CONF_VALUE *wolfSSL_CONF_get_section(WOLFSSL_CONF *conf,
 530        const char *section)
 531{
 532    WOLF_STACK_OF(WOLFSSL_CONF_VALUE) *sk = NULL;
 533
 534    WOLFSSL_ENTER("wolfSSL_CONF_get_section");
 535
 536    if (!conf || !section) {
 537        WOLFSSL_MSG("Bad parameter");
 538        return NULL;
 539    }
 540
 541    sk = conf->data;
 542
 543    while (sk) {
 544        WOLFSSL_CONF_VALUE* val = sk->data.conf;
 545        if (val) {
 546            if (!val->name && XSTRCMP(section, val->section) == 0) {
 547                return val;
 548            }
 549        }
 550        sk = sk->next;
 551    }
 552
 553    return NULL;
 554}
 555
 556WOLFSSL_CONF *wolfSSL_NCONF_new(void *meth)
 557{
 558    WOLFSSL_CONF* ret;
 559    WOLFSSL_ENTER("wolfSSL_NCONF_new");
 560
 561    if (meth) {
 562        WOLFSSL_MSG("wolfSSL does not support CONF_METHOD");
 563    }
 564
 565    ret = (WOLFSSL_CONF*)XMALLOC(sizeof(WOLFSSL_CONF), NULL, DYNAMIC_TYPE_OPENSSL);
 566    if (ret) {
 567        XMEMSET(ret, 0, sizeof(WOLFSSL_CONF));
 568        ret->data = wolfSSL_sk_CONF_VALUE_new(NULL);
 569        if (!ret->data) {
 570            wolfSSL_NCONF_free(ret);
 571            return NULL;
 572        }
 573    }
 574    return ret;
 575}
 576
 577char *wolfSSL_NCONF_get_string(const WOLFSSL_CONF *conf,
 578        const char *group, const char *name)
 579{
 580    WOLFSSL_CONF_VALUE find_val;
 581    WOLFSSL_CONF_VALUE *val;
 582    WOLFSSL_ENTER("wolfSSL_NCONF_get_string");
 583
 584    if (!conf) {
 585#ifdef HAVE_SECURE_GETENV
 586        return secure_getenv(name);
 587#else
 588        WOLFSSL_MSG("Missing secure_getenv");
 589        return NULL;
 590#endif
 591    }
 592
 593    find_val.name = (char *)name;
 594    if (group) {
 595        find_val.section = (char *)group;
 596        val = wolfSSL_lh_WOLFSSL_CONF_VALUE_retrieve(conf->data, &find_val);
 597        if (val)
 598            return val->value;
 599        if (XSTRCMP(group, "ENV") == 0) {
 600#ifdef HAVE_SECURE_GETENV
 601            return secure_getenv(name);
 602#else
 603        WOLFSSL_MSG("Missing secure_getenv");
 604            return NULL;
 605#endif
 606        }
 607    }
 608
 609    find_val.section = (char *)"default";
 610    val = wolfSSL_lh_WOLFSSL_CONF_VALUE_retrieve(conf->data, &find_val);
 611    if (val)
 612        return val->value;
 613    else
 614        return NULL;
 615}
 616
 617int wolfSSL_NCONF_get_number(const WOLFSSL_CONF *conf, const char *group,
 618        const char *name, long *result)
 619{
 620    char *str;
 621    WOLFSSL_ENTER("wolfSSL_NCONF_get_number");
 622
 623    if (!conf || !name || !result) {
 624        WOLFSSL_MSG("Bad parameter");
 625        return WOLFSSL_FAILURE;
 626    }
 627
 628    if (!(str = wolfSSL_NCONF_get_string(conf, group, name))) {
 629        WOLFSSL_MSG("wolfSSL_NCONF_get_string error");
 630        return WOLFSSL_FAILURE;
 631    }
 632
 633    *result = atol(str);
 634    return WOLFSSL_SUCCESS;
 635}
 636
 637/**
 638 * The WOLFSSL_CONF->value member is treated as a
 639 * WOLFSSL_STACK_OF(WOLFSSL_CONF_VALUE) which becomes
 640 * the return value.
 641 * @param conf
 642 * @param section
 643 * @return WOLFSSL_STACK_OF(WOLFSSL_CONF_VALUE)
 644 */
 645WOLFSSL_STACK *wolfSSL_NCONF_get_section(
 646        const WOLFSSL_CONF *conf, const char *section)
 647{
 648    WOLFSSL_CONF_VALUE *val;
 649    WOLFSSL_CONF_VALUE find_val;
 650
 651    WOLFSSL_ENTER("wolfSSL_NCONF_get_section");
 652
 653    if (!conf || !section) {
 654        WOLFSSL_MSG("Bad parameter");
 655        return NULL;
 656    }
 657
 658    find_val.name = NULL;
 659    find_val.section = (char*)section;
 660    val = wolfSSL_lh_WOLFSSL_CONF_VALUE_retrieve(conf->data, &find_val);
 661    if (val)
 662        return (WOLFSSL_STACK*)val->value;
 663    else
 664        return NULL;
 665}
 666
 667#if  !defined(NO_BIO)
 668static WOLFSSL_CONF_VALUE *wolfSSL_CONF_VALUE_new_values(char* section,
 669        char* name, char* value)
 670{
 671    WOLFSSL_CONF_VALUE* ret;
 672    int len;
 673
 674    WOLFSSL_ENTER("wolfSSL_CONF_VALUE_new_values");
 675
 676    if (!(ret = wolfSSL_CONF_VALUE_new())) {
 677        WOLFSSL_MSG("wolfSSL_CONF_VALUE_new error");
 678        return NULL;
 679    }
 680
 681    if (section) {
 682        len = (int)XSTRLEN(section);
 683        ret->section = (char*)XMALLOC(len+1, NULL, DYNAMIC_TYPE_OPENSSL);
 684        if (!ret->section) {
 685            WOLFSSL_MSG("malloc error");
 686            wolfSSL_X509V3_conf_free(ret);
 687            return NULL;
 688        }
 689        XMEMCPY(ret->section, section, len+1);
 690    }
 691
 692    if (name) {
 693        len = (int)XSTRLEN(name);
 694        ret->name = (char*)XMALLOC(len+1, NULL, DYNAMIC_TYPE_OPENSSL);
 695        if (!ret->name) {
 696            WOLFSSL_MSG("malloc error");
 697            wolfSSL_X509V3_conf_free(ret);
 698            return NULL;
 699        }
 700        XMEMCPY(ret->name, name, len+1);
 701    }
 702
 703    if (value) {
 704        len = (int)XSTRLEN(value);
 705        ret->value = (char*)XMALLOC(len+1, NULL, DYNAMIC_TYPE_OPENSSL);
 706        if (!ret->value) {
 707            WOLFSSL_MSG("malloc error");
 708            wolfSSL_X509V3_conf_free(ret);
 709            return NULL;
 710        }
 711        XMEMCPY(ret->value, value, len+1);
 712    }
 713
 714    return ret;
 715}
 716
 717static char* expandValue(WOLFSSL_CONF *conf, const char* section,
 718        char *str)
 719{
 720    int strLen = (int)XSTRLEN(str);
 721    char* ret = NULL;
 722
 723    /* Check to see if there is anything to expand */
 724    if (XSTRNSTR(str, "$", strLen)) {
 725        int idx = 0;
 726        char* strIdx = str;
 727        ret = (char*)XMALLOC(strLen + 1, NULL, DYNAMIC_TYPE_OPENSSL);
 728        if (!ret) {
 729            WOLFSSL_MSG("malloc error");
 730            return str;
 731        }
 732
 733        while (*strIdx) {
 734            if (*strIdx == '$') {
 735                /* Expand variable */
 736                char* startIdx = ++strIdx;
 737                char* endIdx;
 738                const char* s = section;
 739                const char* value;
 740                char prevValue;
 741
 742                if (*startIdx == '{') {
 743                    /* First read the section.
 744                     * format: ${section_name::var_name} */
 745                    s = ++startIdx;
 746                    while (*strIdx && *strIdx != ':') strIdx++;
 747                    if (!*strIdx || s == strIdx || strIdx[1] != ':') {
 748                        WOLFSSL_MSG("invalid section name in "
 749                                    "variable expansion");
 750                        goto expand_cleanup;
 751                    }
 752                    *strIdx = '\0';
 753                    strIdx += 2;
 754                    startIdx = strIdx;
 755                }
 756                while (*strIdx && (XISALNUM((unsigned char)*strIdx) || *strIdx == '_'))
 757                    strIdx++;
 758                endIdx = strIdx;
 759                if (startIdx == endIdx) {
 760                    WOLFSSL_MSG("invalid variable name in config");
 761                    goto expand_cleanup;
 762                }
 763                if (s != section) {
 764                    /* We are expecting a trailing '}' */
 765                    if (*strIdx != '}') {
 766                        WOLFSSL_MSG("Missing '}' in variable");
 767                        goto expand_cleanup;
 768                    }
 769                    strIdx++;
 770                }
 771                /* Save char value at the end of the name so that we can place
 772                 * a null char there. */
 773                prevValue = *endIdx;
 774                *endIdx = '\0';
 775                value = wolfSSL_NCONF_get_string(conf, s, startIdx);
 776                *endIdx = prevValue;
 777                /* Skip copy if no value or zero-length value */
 778                if (value && *value) {
 779                    int valueLen = (int)XSTRLEN(value);
 780                    char* newRet;
 781                    /* This will allocate slightly more memory than necessary
 782                     * but better be safe */
 783                    strLen += valueLen;
 784                #ifdef WOLFSSL_NO_REALLOC
 785                    newRet = (char*)XMALLOC(strLen + 1, NULL,
 786                            DYNAMIC_TYPE_OPENSSL);
 787                    if (newRet != NULL && ret != NULL) {
 788                       XMEMCPY(newRet, ret, (strLen - valueLen) + 1);
 789                       XFREE(ret, NULL, DYNAMIC_TYPE_OPENSSL);
 790                       ret = NULL;
 791                    }
 792                #else
 793                    newRet = (char*)XREALLOC(ret, strLen + 1, NULL,
 794                            DYNAMIC_TYPE_OPENSSL);
 795                #endif
 796                    if (!newRet) {
 797                        WOLFSSL_MSG("realloc error");
 798                        goto expand_cleanup;
 799                    }
 800                    ret = newRet;
 801                    XMEMCPY(ret + idx, value, valueLen);
 802                    idx += valueLen;
 803                }
 804            }
 805            else {
 806                ret[idx++] = *strIdx++;
 807            }
 808        }
 809        ret[idx] = '\0';
 810    }
 811
 812    return ret ? ret : str;
 813
 814expand_cleanup:
 815    XFREE(ret, NULL, DYNAMIC_TYPE_OPENSSL);
 816    return NULL;
 817}
 818
 819#define SKIP_WHITESPACE(idx, max_idx) \
 820    while ((idx) < (max_idx) && (*(idx) == ' ' || *(idx) == '\t'))      \
 821        {(idx)++;}
 822int wolfSSL_NCONF_load(WOLFSSL_CONF *conf, const char *file, long *eline)
 823{
 824    int ret = WC_NO_ERR_TRACE(WOLFSSL_FAILURE);
 825    WOLFSSL_BIO *in = NULL;
 826    char* buf = NULL;
 827    char* idx = NULL;
 828    char* bufEnd = NULL;
 829    CONF_VALUE* section = NULL;
 830    long line = 0;
 831    int bufLen = 0;
 832
 833    if (!conf || !file) {
 834        WOLFSSL_MSG("Bad parameter");
 835        return WOLFSSL_FAILURE;
 836    }
 837
 838    /* Open file */
 839    if (!(in = wolfSSL_BIO_new_file(file, "rb"))) {
 840        WOLFSSL_MSG("wolfSSL_BIO_new_file error");
 841        return WOLFSSL_FAILURE;
 842    }
 843
 844    /* Read file */
 845    bufLen = wolfSSL_BIO_get_len(in);
 846    if (bufLen <= 0) {
 847        WOLFSSL_MSG("wolfSSL_BIO_get_len error");
 848        goto cleanup;
 849    }
 850    if (!(buf = (char*)XMALLOC(bufLen + 1, NULL, DYNAMIC_TYPE_TMP_BUFFER))) {
 851        WOLFSSL_MSG("malloc error");
 852        goto cleanup;
 853    }
 854    if (wolfSSL_BIO_read(in, buf, bufLen) != bufLen) {
 855        WOLFSSL_MSG("wolfSSL_BIO_read error");
 856        goto cleanup;
 857    }
 858
 859    if (!(section = wolfSSL_CONF_new_section(conf, "default"))) {
 860        WOLFSSL_MSG("wolfSSL_CONF_new_section error");
 861        goto cleanup;
 862    }
 863
 864    /* LETS START READING SOME CONFIGS */
 865    idx = buf;
 866    bufEnd = buf + bufLen;
 867    while (idx < bufEnd) {
 868        char* lineEnd = XSTRNSTR(idx, "\n", (size_t)(bufEnd - idx));
 869        char* maxIdx;
 870        if (!lineEnd)
 871            lineEnd = bufEnd; /* Last line in file */
 872        maxIdx = XSTRNSTR(idx, "#", (size_t)(lineEnd - idx));
 873        if (!maxIdx)
 874            maxIdx = lineEnd;
 875        line++;
 876        SKIP_WHITESPACE(idx, maxIdx);
 877        if (idx == maxIdx) {
 878            /* Empty line */
 879            idx = lineEnd + 1;
 880            continue;
 881        }
 882
 883        if (*idx == '[') {
 884            /* New section. Spaces not allowed in section name. */
 885            char* sectionName;
 886            int sectionNameLen;
 887
 888            if (idx < maxIdx)
 889                idx++;
 890            else {
 891                WOLFSSL_MSG("Invalid section definition.");
 892                goto cleanup;
 893            }
 894
 895            SKIP_WHITESPACE(idx, maxIdx);
 896            sectionName = idx;
 897            /* Find end of section name */
 898            while (idx < maxIdx && *idx != ' ' && *idx != ']')
 899                idx++;
 900            sectionNameLen = (int)(idx - sectionName);
 901            SKIP_WHITESPACE(idx, maxIdx);
 902
 903            if (*idx != ']') {
 904                WOLFSSL_MSG("Section definition error. "
 905                            "Closing brace not found.");
 906                goto cleanup;
 907            }
 908
 909            sectionName[sectionNameLen] = '\0';
 910            if (!(section = wolfSSL_CONF_get_section(conf, sectionName))) {
 911                section = wolfSSL_CONF_new_section(conf, sectionName);
 912                if (!section)
 913                    goto cleanup;
 914            }
 915        }
 916        else {
 917            char* name;
 918            int   nameLen;
 919            char* value;
 920            char* exValue; /* expanded value */
 921            int   valueLen;
 922            WOLFSSL_CONF_VALUE* newVal = NULL;
 923
 924            SKIP_WHITESPACE(idx, maxIdx);
 925            name = idx;
 926            /* Find end of name */
 927            while (idx < maxIdx && *idx != ' ' && *idx != '=')
 928                idx++;
 929            nameLen = (int)(idx - name);
 930            SKIP_WHITESPACE(idx, maxIdx);
 931            if (*idx != '=') {
 932                WOLFSSL_MSG("Missing equals sign");
 933                goto cleanup;
 934            }
 935            idx++;
 936            SKIP_WHITESPACE(idx, maxIdx);
 937            value = idx;
 938            /* Find end of value */
 939            idx = maxIdx-1;
 940            while (idx >= value && (*idx == ' ' || *idx == '\t' || *idx == '\r'))
 941                idx--;
 942            valueLen = (int)(idx - value + 1);
 943
 944            /* Sanity checks */
 945            if (nameLen <= 0 || valueLen <= 0) {
 946                WOLFSSL_MSG("Sanity checks failed");
 947                goto cleanup;
 948            }
 949            name[nameLen] = '\0';
 950            value[valueLen] = '\0';
 951
 952            if (!(exValue = expandValue(conf, section->section, value))) {
 953                WOLFSSL_MSG("Variable expansion failed");
 954                goto cleanup;
 955            }
 956
 957            if (!(newVal = wolfSSL_CONF_VALUE_new_values(NULL,
 958                    name, exValue))) {
 959                WOLFSSL_MSG("wolfSSL_CONF_VALUE_new_values error");
 960                if (exValue != value)
 961                    XFREE(exValue, NULL, DYNAMIC_TYPE_OPENSSL);
 962                goto cleanup;
 963            }
 964
 965            if (exValue != value)
 966                XFREE(exValue, NULL, DYNAMIC_TYPE_OPENSSL);
 967
 968            if (wolfSSL_CONF_add_string(conf, section, newVal) !=
 969                    WOLFSSL_SUCCESS) {
 970                wolfSSL_X509V3_conf_free(newVal);
 971                WOLFSSL_MSG("wolfSSL_CONF_add_string error");
 972                goto cleanup;
 973            }
 974        }
 975        idx = lineEnd + 1;
 976    }
 977
 978    ret = WOLFSSL_SUCCESS;
 979cleanup:
 980    if (in)
 981        wolfSSL_BIO_free(in);
 982    XFREE(buf, NULL, DYNAMIC_TYPE_TMP_BUFFER);
 983    if (eline)
 984        *eline = line;
 985    return ret;
 986}
 987#endif /* !NO_BIO */
 988
 989void wolfSSL_NCONF_free(WOLFSSL_CONF *conf)
 990{
 991    WOLFSSL_ENTER("wolfSSL_NCONF_free");
 992    if (conf) {
 993        wolfSSL_sk_CONF_VALUE_free(conf->data);
 994        XFREE(conf, NULL, DYNAMIC_TYPE_OPENSSL);
 995    }
 996}
 997
 998void wolfSSL_X509V3_conf_free(WOLFSSL_CONF_VALUE *val)
 999{
1000    if (val) {
1001        if (val->name) {
1002            /* Not a section. Don't free section as it is a shared pointer. */
1003            XFREE(val->name, NULL, DYNAMIC_TYPE_OPENSSL);
1004            XFREE(val->value, NULL, DYNAMIC_TYPE_OPENSSL);
1005        }
1006        else {
1007            /* Section so val->value is a stack */
1008            XFREE(val->section, NULL, DYNAMIC_TYPE_OPENSSL);
1009            /* Only free the stack structures. The contained conf values
1010             * will be freed in wolfSSL_NCONF_free */
1011            wolfSSL_sk_free((WOLF_STACK_OF(WOLFSSL_CONF_VALUE)*)val->value);
1012        }
1013        XFREE(val, NULL, DYNAMIC_TYPE_OPENSSL);
1014    }
1015}
1016
1017WOLFSSL_STACK *wolfSSL_sk_CONF_VALUE_new(
1018    WOLF_SK_COMPARE_CB(WOLFSSL_CONF_VALUE, compFunc))
1019{
1020    WOLFSSL_STACK* ret;
1021    WOLFSSL_ENTER("wolfSSL_sk_CONF_VALUE_new");
1022    ret = wolfSSL_sk_new_node(NULL);
1023    if (!ret)
1024        return NULL;
1025    ret->hash_fn = (wolf_sk_hash_cb)wolfSSL_CONF_VALUE_hash;
1026    ret->type = STACK_TYPE_CONF_VALUE;
1027    (void)compFunc;
1028    return ret;
1029}
1030
1031/* Free the structure for WOLFSSL_CONF_VALUE stack
1032 *
1033 * sk  stack to free nodes in
1034 */
1035void wolfSSL_sk_CONF_VALUE_free(WOLF_STACK_OF(WOLFSSL_CONF_VALUE)* sk)
1036{
1037    WOLFSSL_ENTER("wolfSSL_sk_CONF_VALUE_free");
1038
1039    wolfSSL_sk_pop_free(sk, NULL);
1040}
1041
1042int wolfSSL_sk_CONF_VALUE_num(const WOLFSSL_STACK *sk)
1043{
1044    WOLFSSL_ENTER("wolfSSL_sk_CONF_VALUE_num");
1045    if (sk)
1046        return wolfSSL_sk_num(sk);
1047    return 0;
1048}
1049
1050WOLFSSL_CONF_VALUE *wolfSSL_sk_CONF_VALUE_value(const WOLFSSL_STACK *sk, int i)
1051{
1052    WOLFSSL_ENTER("wolfSSL_sk_CONF_VALUE_value");
1053    if (sk)
1054        return (WOLFSSL_CONF_VALUE*)wolfSSL_sk_value(sk, i);
1055    return NULL;
1056}
1057
1058/* return 1 on success 0 on fail */
1059int wolfSSL_sk_CONF_VALUE_push(WOLF_STACK_OF(WOLFSSL_CONF_VALUE)* sk,
1060        WOLFSSL_CONF_VALUE* val)
1061{
1062    WOLFSSL_ENTER("wolfSSL_sk_CONF_VALUE_push");
1063
1064    if (sk == NULL || val == NULL) {
1065        return WOLFSSL_FAILURE;
1066    }
1067
1068    return wolfSSL_sk_push(sk, val);
1069}
1070
1071#endif /* !NO_CERTS && OPENSSL_EXTRA && OPENSSL_ALL */
1072
1073#ifdef OPENSSL_EXTRA
1074#ifndef NO_WOLFSSL_STUB
1075/* Returns default file name and path of config file. However
1076   a wolfssl.cnf file is not currently supported */
1077char* wolfSSL_CONF_get1_default_config_file(void)
1078{
1079    WOLFSSL_ENTER("wolfSSL_CONF_get1_default_config_file");
1080    WOLFSSL_STUB("CONF_get1_default_config_file");
1081    return NULL;
1082}
1083#endif
1084
1085/**
1086 * Allocate WOLFSSL_CONF_CTX instance
1087 * @return pointer to WOLFSSL_CONF_CTX structure on success and NULL on fail
1088 */
1089WOLFSSL_CONF_CTX* wolfSSL_CONF_CTX_new(void)
1090{
1091    WOLFSSL_CONF_CTX* cctx;
1092
1093    WOLFSSL_ENTER("wolfSSL_CONF_CTX_new");
1094
1095    cctx = (WOLFSSL_CONF_CTX*)XMALLOC(sizeof(WOLFSSL_CONF_CTX), NULL,
1096                                                    DYNAMIC_TYPE_OPENSSL);
1097    if (!cctx) {
1098        WOLFSSL_MSG("malloc error");
1099        return NULL;
1100    }
1101    XMEMSET(cctx, 0, sizeof(WOLFSSL_CONF_CTX));
1102
1103    return cctx;
1104}
1105/**
1106 * Release WOLFSSL_CONF_CTX instance
1107 * @param cctx a pointer to WOLFSSL_CONF_CTX structure to be freed
1108 */
1109void wolfSSL_CONF_CTX_free(WOLFSSL_CONF_CTX* cctx)
1110{
1111    WOLFSSL_ENTER("wolfSSL_CONF_CTX_free");
1112
1113    XFREE(cctx, NULL, DYNAMIC_TYPE_OPENSSL);
1114
1115    WOLFSSL_LEAVE("wolfSSL_CONF_CTX_free", 1);
1116}
1117/**
1118 * Set WOLFSSL_CTX instance to WOLFSSL_CONF_CTX
1119 * @param cctx a pointer to WOLFSSL_CONF_CTX structure to set a WOLFSSL_CTX
1120 *             pointer to its ctx
1121 * @param ctx  a pointer to WOLFSSL_CTX structure to be set
1122 */
1123void wolfSSL_CONF_CTX_set_ssl_ctx(WOLFSSL_CONF_CTX* cctx, WOLFSSL_CTX *ctx)
1124{
1125    WOLFSSL_ENTER("wolfSSL_CONF_CTX_set_ssl_ctx");
1126
1127    /* sanity check */
1128    if (cctx == NULL) {
1129        WOLFSSL_MSG("cctx is null");
1130        return;
1131    }
1132
1133    cctx->ctx = ctx;
1134    WOLFSSL_LEAVE("wolfSSL_CONF_CTX_set_ssl_ctx", 1);
1135}
1136/**
1137 * set flag value into WOLFSSL_CONF_CTX
1138 * @param cctx  a pointer to WOLFSSL_CONF_CTX structure to be set
1139 * @param flags flag value to be OR'd
1140 * @return OR'd flag value, otherwise 0
1141 */
1142unsigned int wolfSSL_CONF_CTX_set_flags(WOLFSSL_CONF_CTX* cctx,
1143                                                            unsigned int flags)
1144{
1145    /* sanity check */
1146    if (cctx == NULL)
1147        return 0;
1148
1149    cctx->flags |= flags;
1150    return cctx->flags;
1151}
1152
1153/**
1154 * finish configuration command operation
1155 * @param cctx  a pointer to WOLFSSL_CONF_CTX structure to be set
1156 * @return WOLFSSL_SUCCESS on success
1157 */
1158int wolfSSL_CONF_CTX_finish(WOLFSSL_CONF_CTX* cctx)
1159{
1160    (void)cctx;
1161    return WOLFSSL_SUCCESS;
1162}
1163/*
1164 * The following definitions and static functions are used for
1165 * wolfSSL_CONF_cmd() to handle command.
1166 *
1167 * Definitions below are a part of conf_cmds_tbl[] contents.
1168 *  WOLFSSL_CONF_FILE_CMDx  represents command name in configuration file
1169 *  WOLFSSL_CONF_CMDL_CMDx  represents command name on command line
1170 *
1171 * The static functions after the definition section process
1172 *                 those FILE or CMDL which are defined in the conf_cmds_tbl.
1173 *
1174 * To add a new command handling:
1175 *  1. Add new #define to a section of WOLFSSL_CONF_FILE_CMD* and
1176 *                                      WOLFSSL_CONF_CMDL_CMD*
1177 *  2. Add new static function after #define section, before
1178 *                      "typedef struct conf_cmd_tbl {" line
1179 *  3. Add new entry to conf_cmds_tbl[] by following other command entries
1180 */
1181#define WOLFSSL_CONF_FILE_CMD1  "Curves"
1182#define WOLFSSL_CONF_FILE_CMD2  "Certificate"
1183#define WOLFSSL_CONF_FILE_CMD3  "PrivateKey"
1184#define WOLFSSL_CONF_FILE_CMD4  "Protocol"
1185#define WOLFSSL_CONF_FILE_CMD5  "Options"
1186#define WOLFSSL_CONF_FILE_CMD6  "ServerInfoFile"
1187#define WOLFSSL_CONF_FILE_CMD7  "SignatureAlgorithms"
1188#define WOLFSSL_CONF_FILE_CMD8  "ClientSignatureAlgorithms"
1189#define WOLFSSL_CONF_FILE_CMD9  "CipherString"
1190
1191#define WOLFSSL_CONF_CMDL_CMD1  "curves"
1192#define WOLFSSL_CONF_CMDL_CMD2  "cert"
1193#define WOLFSSL_CONF_CMDL_CMD3  "key"
1194#define WOLFSSL_CONF_CMDL_CMD4  NULL
1195#define WOLFSSL_CONF_CMDL_CMD5  NULL
1196#define WOLFSSL_CONF_CMDL_CMD6  NULL
1197#define WOLFSSL_CONF_CMDL_CMD7  "sigalgs"
1198#define WOLFSSL_CONF_CMDL_CMD8  "client_sigalgs"
1199#define WOLFSSL_CONF_CMDL_CMD9  "cipher"
1200
1201#if !defined(NO_DH) && !defined(NO_BIO)
1202#define WOLFSSL_CONF_FILE_CMD10 "DHParameters"
1203#define WOLFSSL_CONF_CMDL_CMD10 "dhparam"
1204#endif
1205
1206#ifdef HAVE_ECC
1207#define WOLFSSL_CONF_FILE_CMD11 "ECDHParameters"
1208#define WOLFSSL_CONF_CMDL_CMD11 "named_curves"
1209#endif
1210
1211/**
1212 * process Cipher String command
1213 * @param cctx  a pointer to WOLFSSL_CONF_CTX structure
1214 * @param value arguments for cmd
1215 * @return WOLFSSL_SUCCESS on success,
1216 *     otherwise WOLFSSL_FAILURE or
1217 *               -3 if value is null or
1218 *               negative value on other failure
1219 */
1220static int cmdfunc_cipherstring(WOLFSSL_CONF_CTX* cctx, const char* value)
1221{
1222    int ret = -3;
1223
1224    WOLFSSL_ENTER("cmdfunc_cipherstring");
1225
1226     /* sanity check */
1227    if (cctx == NULL)
1228        return WOLFSSL_FAILURE;
1229
1230    if (value == NULL) {
1231        WOLFSSL_MSG("bad arguments");
1232        return ret;
1233    }
1234
1235    if (cctx->ctx) {
1236        ret = wolfSSL_CTX_set_cipher_list(cctx->ctx, value);
1237    }
1238
1239    if (((cctx->ctx  && ret == WOLFSSL_SUCCESS) ||
1240         (!cctx->ctx && ret == -3)) &&
1241        cctx->ssl) {
1242        ret = wolfSSL_set_cipher_list(cctx->ssl, value);
1243    }
1244
1245    WOLFSSL_LEAVE("cmdfunc_cipherstring", ret);
1246    return ret;
1247}
1248
1249/**
1250 * process curves command
1251 * @param cctx  a pointer to WOLFSSL_CONF_CTX structure
1252 * @param value arguments for cmd
1253 * @return WOLFSSL_SUCCESS on success,
1254 *     otherwise WOLFSSL_FAILURE or
1255 *               -3 if value is null or
1256 *               negative value on other failure
1257 */
1258#if defined(HAVE_ECC)
1259static int cmdfunc_curves(WOLFSSL_CONF_CTX* cctx, const char* value)
1260{
1261    int ret = -3;
1262
1263    WOLFSSL_ENTER("cmdfunc_curves");
1264
1265     /* sanity check */
1266    if (cctx == NULL)
1267        return WOLFSSL_FAILURE;
1268
1269    if (value == NULL) {
1270        WOLFSSL_MSG("bad arguments");
1271        return ret;
1272    }
1273
1274    if (cctx->ctx) {
1275        ret = wolfSSL_CTX_set1_curves_list(cctx->ctx, value);
1276    }
1277
1278    if (((cctx->ctx  && ret == WOLFSSL_SUCCESS) ||
1279         (!cctx->ctx && ret == -3)) &&
1280        cctx->ssl) {
1281        ret = wolfSSL_set1_curves_list(cctx->ssl, value);
1282    }
1283
1284    WOLFSSL_LEAVE("cmdfunc_curves", ret);
1285    return ret;
1286}
1287#endif
1288
1289#ifndef NO_FILESYSTEM
1290/**
1291 * process cert command
1292 * @param cctx  a pointer to WOLFSSL_CONF_CTX structure
1293 * @param value arguments for cmd
1294 * @return WOLFSSL_SUCCESS on success,
1295 *     otherwise WOLFSSL_FAILURE or
1296 *               -3 if value is null or
1297 *               negative value on other failure
1298 */
1299static int cmdfunc_cert(WOLFSSL_CONF_CTX* cctx, const char* value)
1300{
1301    int ret = -3;
1302
1303    WOLFSSL_ENTER("cmdfunc_cert");
1304
1305    /* sanity check */
1306    if (cctx == NULL)
1307        return WOLFSSL_FAILURE;
1308
1309    if (value == NULL) {
1310        WOLFSSL_MSG("bad arguments");
1311        return ret;
1312    }
1313
1314    if (!(cctx->flags & WOLFSSL_CONF_FLAG_CERTIFICATE)) {
1315        WOLFSSL_MSG("certificate flag is not set");
1316        return -2;
1317    }
1318
1319    if (cctx->ctx) {
1320        ret = wolfSSL_CTX_use_certificate_chain_file(cctx->ctx, value);
1321    }
1322
1323    if (((cctx->ctx  && ret == WOLFSSL_SUCCESS) ||
1324         (!cctx->ctx && ret == -3)) &&
1325        cctx->ssl) {
1326        ret = wolfSSL_use_certificate_file(cctx->ssl, value,
1327                                                    WOLFSSL_FILETYPE_PEM);
1328    }
1329
1330    WOLFSSL_LEAVE("cmdfunc_cert", ret);
1331    return ret;
1332}
1333/**
1334 * process key command
1335 * @param cctx  a pointer to WOLFSSL_CONF_CTX structure
1336 * @param value arguments for cmd
1337 * @return WOLFSSL_SUCCESS on success,
1338 *     otherwise WOLFSSL_FAILURE or
1339 *               -3 if value is null or
1340 *               negative value on other failure
1341 */
1342static int cmdfunc_key(WOLFSSL_CONF_CTX* cctx, const char* value)
1343{
1344    int ret = -3;
1345
1346    WOLFSSL_ENTER("cmdfunc_key");
1347
1348     /* sanity check */
1349    if (cctx == NULL)
1350        return WOLFSSL_FAILURE;
1351
1352    if (value == NULL) {
1353        WOLFSSL_MSG("bad arguments");
1354        return ret;
1355    }
1356
1357    if (!(cctx->flags & WOLFSSL_CONF_FLAG_CERTIFICATE)) {
1358        WOLFSSL_MSG("certificate flag is not set");
1359        return -2;
1360    }
1361
1362    if (cctx->ctx) {
1363        ret = wolfSSL_CTX_use_PrivateKey_file(cctx->ctx, value,
1364                                                    WOLFSSL_FILETYPE_PEM);
1365    }
1366
1367    if (((cctx->ctx  && ret == WOLFSSL_SUCCESS) ||
1368         (!cctx->ctx && ret == -3)) &&
1369        cctx->ssl) {
1370        ret = wolfSSL_use_PrivateKey_file(cctx->ssl, value,
1371                                                    WOLFSSL_FILETYPE_PEM);
1372    }
1373
1374    WOLFSSL_LEAVE("cmdfunc_key", ret);
1375    return ret;
1376}
1377#endif /* NO_FILESYSTEM */
1378/**
1379 * process DH parameter command
1380 * @param cctx  a pointer to WOLFSSL_CONF_CTX structure
1381 * @param value arguments for cmd
1382 * @return WOLFSSL_SUCCESS on success,
1383 *     otherwise WOLFSSL_FAILURE or
1384 *               -3 if value is null or
1385 *               negative value on other failure
1386 */
1387#if !defined(NO_DH) && !defined(NO_BIO)
1388static int cmdfunc_dhparam(WOLFSSL_CONF_CTX* cctx, const char* value)
1389{
1390    int ret = -3;
1391    WOLFSSL_DH* dh = NULL;
1392    WOLFSSL_BIO* bio = NULL;
1393
1394    WOLFSSL_MSG("cmdfunc_dhparam");
1395
1396     /* sanity check */
1397    if (cctx == NULL)
1398        return WOLFSSL_FAILURE;
1399
1400    if (value == NULL) {
1401        WOLFSSL_MSG("bad arguments");
1402        return ret;
1403    }
1404
1405    if (cctx->ctx || cctx->ssl) {
1406        bio = wolfSSL_BIO_new_file(value, "rb");
1407        if (!bio) {
1408            WOLFSSL_MSG("bio new file failed");
1409            return WOLFSSL_FAILURE;
1410        }
1411        dh = wolfSSL_PEM_read_bio_DHparams(bio, NULL, NULL, NULL);
1412        if (!dh) {
1413            wolfSSL_BIO_free(bio);
1414            WOLFSSL_MSG("PEM read bio failed");
1415            return WOLFSSL_FAILURE;
1416        }
1417    } else {
1418        return 1;
1419    }
1420
1421    if (cctx->ctx) {
1422        ret = (int)wolfSSL_CTX_set_tmp_dh(cctx->ctx, dh);
1423    }
1424
1425    if (((cctx->ctx  && ret == WOLFSSL_SUCCESS) ||
1426         (!cctx->ctx && ret == -3)) &&
1427        cctx->ssl) {
1428        ret = (int)wolfSSL_CTX_set_tmp_dh(cctx->ssl->ctx, dh);
1429    }
1430
1431    if (dh)
1432        wolfSSL_DH_free(dh);
1433    if (bio)
1434        wolfSSL_BIO_free(bio);
1435
1436    WOLFSSL_LEAVE("cmdfunc_dhparam", ret);
1437    return ret;
1438}
1439#endif /* !NO_DH && !NO_BIO */
1440/**
1441 * command table
1442 */
1443typedef struct conf_cmd_tbl {
1444    const char* file_cmd;
1445    const char* cmdline_cmd;
1446    word32 data_type;
1447    int (*cmdfunc)(WOLFSSL_CONF_CTX* cctx, const char* value);
1448}conf_cmd_tbl;
1449
1450static const conf_cmd_tbl conf_cmds_tbl[] = {
1451#if defined(HAVE_ECC)
1452    /* cmd Curves */
1453    {WOLFSSL_CONF_FILE_CMD1, WOLFSSL_CONF_CMDL_CMD1,
1454                                    WOLFSSL_CONF_TYPE_STRING, cmdfunc_curves},
1455#endif
1456#if !defined(NO_FILESYSTEM)
1457    /* cmd Certificate */
1458    {WOLFSSL_CONF_FILE_CMD2, WOLFSSL_CONF_CMDL_CMD2,
1459                                    WOLFSSL_CONF_TYPE_FILE, cmdfunc_cert},
1460    /* cmd PrivateKey */
1461    {WOLFSSL_CONF_FILE_CMD3, WOLFSSL_CONF_CMDL_CMD3,
1462                                    WOLFSSL_CONF_TYPE_FILE, cmdfunc_key},
1463#endif
1464    /* cmd Protocol */
1465    {WOLFSSL_CONF_FILE_CMD4, WOLFSSL_CONF_CMDL_CMD4,
1466                                    WOLFSSL_CONF_TYPE_STRING, NULL},
1467    /* cmd Options */
1468    {WOLFSSL_CONF_FILE_CMD5, WOLFSSL_CONF_CMDL_CMD5,
1469                                    WOLFSSL_CONF_TYPE_STRING, NULL},
1470    /* cmd ServerInfoFile */
1471    {WOLFSSL_CONF_FILE_CMD6, WOLFSSL_CONF_CMDL_CMD6,
1472                                    WOLFSSL_CONF_TYPE_FILE, NULL},
1473    /* cmd SignatureAlgorithms */
1474    {WOLFSSL_CONF_FILE_CMD7, WOLFSSL_CONF_CMDL_CMD7,
1475                                    WOLFSSL_CONF_TYPE_STRING, NULL},
1476    /* cmd ClientSignatureAlgorithms */
1477    {WOLFSSL_CONF_FILE_CMD8, WOLFSSL_CONF_CMDL_CMD8,
1478                                    WOLFSSL_CONF_TYPE_STRING, NULL},
1479    /* cmd CipherString */
1480    {WOLFSSL_CONF_FILE_CMD9, WOLFSSL_CONF_CMDL_CMD9,
1481                              WOLFSSL_CONF_TYPE_STRING, cmdfunc_cipherstring},
1482#if !defined(NO_DH) && !defined(NO_BIO)
1483    /* cmd DHParameters */
1484    {WOLFSSL_CONF_FILE_CMD10, WOLFSSL_CONF_CMDL_CMD10,
1485                                    WOLFSSL_CONF_TYPE_FILE, cmdfunc_dhparam},
1486#endif
1487#ifdef HAVE_ECC
1488    /* cmd ECHDParameters */
1489    {WOLFSSL_CONF_FILE_CMD11, WOLFSSL_CONF_CMDL_CMD11,
1490                                    WOLFSSL_CONF_TYPE_STRING, NULL},
1491#endif
1492};
1493/* size of command table */
1494static const size_t size_of_cmd_tbls = sizeof(conf_cmds_tbl)
1495                                                    / sizeof(conf_cmd_tbl);
1496
1497static const conf_cmd_tbl* wolfssl_conf_find_cmd(WOLFSSL_CONF_CTX* cctx,
1498                                         const char* cmd)
1499{
1500    size_t i = 0;
1501
1502    if (cctx->flags & WOLFSSL_CONF_FLAG_CMDLINE) {
1503        size_t cmdlen = XSTRLEN(cmd);
1504
1505        if (cmdlen < 2) {
1506            WOLFSSL_MSG("bad cmdline command");
1507            return NULL;
1508        }
1509        /* skip "-" prefix */
1510        ++cmd;
1511    }
1512
1513    for (i = 0; i < size_of_cmd_tbls; i++) {
1514        /* check if the cmd is valid */
1515        if (cctx->flags & WOLFSSL_CONF_FLAG_CMDLINE) {
1516            if (conf_cmds_tbl[i].cmdline_cmd != NULL &&
1517                XSTRCMP(cmd, conf_cmds_tbl[i].cmdline_cmd) == 0) {
1518                return &conf_cmds_tbl[i];
1519            }
1520        }
1521
1522        if (cctx->flags & WOLFSSL_CONF_FLAG_FILE) {
1523            if (conf_cmds_tbl[i].file_cmd != NULL &&
1524                XSTRCMP(cmd, conf_cmds_tbl[i].file_cmd) == 0) {
1525                return &conf_cmds_tbl[i];
1526            }
1527        }
1528    }
1529
1530    return NULL;
1531}
1532
1533/**
1534 * send configuration command
1535 * @param cctx  a pointer to WOLFSSL_CONF_CTX structure
1536 * @param cmd   configuration command
1537 * @param value arguments for cmd
1538 * @return 1 when cmd is recognised, but value is not used
1539 *         2 both cmd and value are used
1540 *  otherwise WOLFSSL_FAILURE
1541 *         -2 if cmd is not recognised
1542 *         -3 if value is NULL, but cmd is recognized
1543 */
1544int wolfSSL_CONF_cmd(WOLFSSL_CONF_CTX* cctx, const char* cmd, const char* value)
1545{
1546    int ret = WC_NO_ERR_TRACE(WOLFSSL_FAILURE);
1547    const conf_cmd_tbl* confcmd = NULL;
1548    WOLFSSL_ENTER("wolfSSL_CONF_cmd");
1549
1550    /* sanity check */
1551    if (cctx == NULL || cmd == NULL) {
1552        WOLFSSL_MSG("bad arguments");
1553        return ret;
1554    }
1555
1556    confcmd = wolfssl_conf_find_cmd(cctx, cmd);
1557    if (confcmd == NULL)
1558        return -2;
1559
1560    if (confcmd->cmdfunc == NULL) {
1561        WOLFSSL_MSG("cmd not yet implemented");
1562        return -2;
1563    }
1564
1565    ret = confcmd->cmdfunc(cctx, value);
1566
1567    /* return code compliant with OpenSSL */
1568    if (ret < -3)
1569        ret = 0;
1570
1571    WOLFSSL_LEAVE("wolfSSL_CONF_cmd", ret);
1572    return ret;
1573}
1574
1575/**
1576 *
1577 * @param cctx a pointer to WOLFSSL_CONF_CTX structure
1578 * @param cmd  configuration command
1579 * @return The SSL_CONF_TYPE_* type or SSL_CONF_TYPE_UNKNOWN if an
1580 *         invalid command
1581 */
1582int wolfSSL_CONF_cmd_value_type(WOLFSSL_CONF_CTX *cctx, const char *cmd)
1583{
1584    const conf_cmd_tbl* confcmd = NULL;
1585    WOLFSSL_ENTER("wolfSSL_CONF_cmd_value_type");
1586
1587    confcmd = wolfssl_conf_find_cmd(cctx, cmd);
1588    if (confcmd == NULL)
1589        return WOLFSSL_CONF_TYPE_UNKNOWN;
1590    return (int)confcmd->data_type;
1591}
1592
1593#endif /* OPENSSL_EXTRA */
1594
1595
1596/*******************************************************************************
1597 * END OF CONF API
1598 ******************************************************************************/
1599
1600#if defined(OPENSSL_EXTRA)
1601WOLFSSL_INIT_SETTINGS* wolfSSL_OPENSSL_INIT_new(void)
1602{
1603    WOLFSSL_INIT_SETTINGS* init = (WOLFSSL_INIT_SETTINGS*)XMALLOC(
1604            sizeof(WOLFSSL_INIT_SETTINGS), NULL, DYNAMIC_TYPE_OPENSSL);
1605
1606    return init;
1607}
1608
1609void wolfSSL_OPENSSL_INIT_free(WOLFSSL_INIT_SETTINGS* init)
1610{
1611    XFREE(init, NULL, DYNAMIC_TYPE_OPENSSL);
1612}
1613
1614#ifndef NO_WOLFSSL_STUB
1615int wolfSSL_OPENSSL_INIT_set_config_appname(WOLFSSL_INIT_SETTINGS* init,
1616        char* appname)
1617{
1618    (void)init;
1619    (void)appname;
1620    WOLFSSL_STUB("OPENSSL_INIT_set_config_appname");
1621    return WOLFSSL_SUCCESS;
1622}
1623#endif
1624
1625#endif /* OPENSSL_EXTRA */
1626
1627
1628
1629#endif /* WOLFSSL_CONF_INCLUDED */