diff options
| author | Richard Levitte <levitte@openssl.org> | 2019-04-05 10:53:11 +0200 |
|---|---|---|
| committer | Richard Levitte <levitte@openssl.org> | 2019-04-05 15:43:37 +0200 |
| commit | de3955f66225e42bfae710c50b51c98aa4616ac1 (patch) | |
| tree | 402b85a2df41ef5f3382d0316dbce51bed25be9a /crypto/evp/evp_cnf.c | |
| parent | cb92964563a053d5d9c0810912fa6d3ff35c1e16 (diff) | |
EVP configuration section: add 'default_properties' command
The value of the 'default_properties' command is simply passed to
EVP_set_default_properties().
Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/8681)
Diffstat (limited to 'crypto/evp/evp_cnf.c')
| -rw-r--r-- | crypto/evp/evp_cnf.c | 22 |
1 files changed, 18 insertions, 4 deletions
diff --git a/crypto/evp/evp_cnf.c b/crypto/evp/evp_cnf.c index f75ea675d3..7cfa0a27fe 100644 --- a/crypto/evp/evp_cnf.c +++ b/crypto/evp/evp_cnf.c @@ -13,9 +13,11 @@ #include <openssl/conf.h> #include <openssl/x509.h> #include <openssl/x509v3.h> +#include <openssl/trace.h> /* Algorithm configuration module. */ +/* TODO(3.0): the config module functions should be passed a library context */ static int alg_module_init(CONF_IMODULE *md, const CONF *cnf) { int i; @@ -23,6 +25,9 @@ static int alg_module_init(CONF_IMODULE *md, const CONF *cnf) STACK_OF(CONF_VALUE) *sktmp; CONF_VALUE *oval; + OSSL_TRACE2(CONF, "Loading EVP module: name %s, value %s\n", + CONF_imodule_get_name(md), CONF_imodule_get_value(md)); + oid_section = CONF_imodule_get_value(md); if ((sktmp = NCONF_get_section(cnf, oid_section)) == NULL) { EVPerr(EVP_F_ALG_MODULE_INIT, EVP_R_ERROR_LOADING_SECTION); @@ -32,18 +37,26 @@ static int alg_module_init(CONF_IMODULE *md, const CONF *cnf) oval = sk_CONF_VALUE_value(sktmp, i); if (strcmp(oval->name, "fips_mode") == 0) { int m; + if (!X509V3_get_value_bool(oval, &m)) { EVPerr(EVP_F_ALG_MODULE_INIT, EVP_R_INVALID_FIPS_MODE); return 0; } - if (m > 0) { - EVPerr(EVP_F_ALG_MODULE_INIT, EVP_R_FIPS_MODE_NOT_SUPPORTED); - return 0; - } + /* + * fips_mode is deprecated and should not be used in new + * configurations. Old configurations are likely to ONLY + * have this, so we assume that no default properties have + * been set before this. + */ + if (m > 0) + EVP_set_default_properties(NULL, "fips=yes"); + } else if (strcmp(oval->name, "default_properties") == 0) { + EVP_set_default_properties(NULL, oval->value); } else { EVPerr(EVP_F_ALG_MODULE_INIT, EVP_R_UNKNOWN_OPTION); ERR_add_error_data(4, "name=", oval->name, ", value=", oval->value); + return 0; } } @@ -52,5 +65,6 @@ static int alg_module_init(CONF_IMODULE *md, const CONF *cnf) void EVP_add_alg_module(void) { + OSSL_TRACE(CONF, "Adding config module 'alg_section'\n"); CONF_module_add("alg_section", alg_module_init, 0); } |