Line data Source code
1 : /*
2 : * Copyright (C) 2001-2016 Free Software Foundation, Inc.
3 : * Copyright (C) 2015-2016 Red Hat, Inc.
4 : *
5 : * Author: Nikos Mavrogiannopoulos
6 : *
7 : * This file is part of GnuTLS.
8 : *
9 : * The GnuTLS is free software; you can redistribute it and/or
10 : * modify it under the terms of the GNU Lesser General Public License
11 : * as published by the Free Software Foundation; either version 2.1 of
12 : * the License, or (at your option) any later version.
13 : *
14 : * This library is distributed in the hope that it will be useful, but
15 : * WITHOUT ANY WARRANTY; without even the implied warranty of
16 : * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
17 : * Lesser General Public License for more details.
18 : *
19 : * You should have received a copy of the GNU Lesser General Public License
20 : * along with this program. If not, see <https://www.gnu.org/licenses/>.
21 : *
22 : */
23 :
24 : #include "gnutls_int.h"
25 : #include "errors.h"
26 : #include <libtasn1.h>
27 : #include <dh.h>
28 : #include <random.h>
29 : #include <gnutls/pkcs11.h>
30 :
31 : #include <hello_ext.h> /* for _gnutls_hello_ext_init */
32 : #include <supplemental.h> /* for _gnutls_supplemental_deinit */
33 : #include <locks.h>
34 : #include <system.h>
35 : #include <accelerated/cryptodev.h>
36 : #include <accelerated/accelerated.h>
37 : #include <fips.h>
38 : #include <atfork.h>
39 : #include <system-keys.h>
40 : #include "str.h"
41 : #include "global.h"
42 :
43 : /* Minimum library versions we accept. */
44 : #define GNUTLS_MIN_LIBTASN1_VERSION "0.3.4"
45 :
46 : #ifdef __sun
47 : # pragma fini(lib_deinit)
48 : # pragma init(lib_init)
49 : # define _CONSTRUCTOR
50 : # define _DESTRUCTOR
51 : #else
52 : # define _CONSTRUCTOR __attribute__((constructor))
53 : # define _DESTRUCTOR __attribute__((destructor))
54 : #endif
55 :
56 : #ifndef _WIN32
57 : int __attribute__((weak)) _gnutls_global_init_skip(void);
58 6758 : int _gnutls_global_init_skip(void)
59 : {
60 6758 : return 0;
61 : }
62 : #else
63 : inline static int _gnutls_global_init_skip(void)
64 : {
65 : return 0;
66 : }
67 : #endif
68 :
69 : /* created by asn1c */
70 : extern const ASN1_ARRAY_TYPE gnutls_asn1_tab[];
71 : extern const ASN1_ARRAY_TYPE pkix_asn1_tab[];
72 : void *_gnutls_file_mutex;
73 : void *_gnutls_pkcs11_mutex;
74 :
75 : ASN1_TYPE _gnutls_pkix1_asn = ASN1_TYPE_EMPTY;
76 : ASN1_TYPE _gnutls_gnutls_asn = ASN1_TYPE_EMPTY;
77 :
78 : gnutls_log_func _gnutls_log_func = NULL;
79 : gnutls_audit_log_func _gnutls_audit_log_func = NULL;
80 : int _gnutls_log_level = 0; /* default log level */
81 :
82 : unsigned int _gnutls_global_version = GNUTLS_VERSION_NUMBER;
83 :
84 : static int _gnutls_global_init(unsigned constructor);
85 : static void _gnutls_global_deinit(unsigned destructor);
86 :
87 290 : static void default_log_func(int level, const char* str)
88 : {
89 290 : fprintf(stderr, "gnutls[%d]: %s", level, str);
90 290 : }
91 :
92 : /**
93 : * gnutls_global_set_log_function:
94 : * @log_func: it's a log function
95 : *
96 : * This is the function where you set the logging function gnutls is
97 : * going to use. This function only accepts a character array.
98 : * Normally you may not use this function since it is only used for
99 : * debugging purposes.
100 : *
101 : * @gnutls_log_func is of the form,
102 : * void (*gnutls_log_func)( int level, const char*);
103 : **/
104 6787 : void gnutls_global_set_log_function(gnutls_log_func log_func)
105 : {
106 6787 : _gnutls_log_func = log_func;
107 6787 : }
108 :
109 : /**
110 : * gnutls_global_set_audit_log_function:
111 : * @log_func: it is the audit log function
112 : *
113 : * This is the function to set the audit logging function. This
114 : * is a function to report important issues, such as possible
115 : * attacks in the protocol. This is different from gnutls_global_set_log_function()
116 : * because it will report also session-specific events. The session
117 : * parameter will be null if there is no corresponding TLS session.
118 : *
119 : * @gnutls_audit_log_func is of the form,
120 : * void (*gnutls_audit_log_func)( gnutls_session_t, const char*);
121 : *
122 : * Since: 3.0
123 : **/
124 366 : void gnutls_global_set_audit_log_function(gnutls_audit_log_func log_func)
125 : {
126 366 : _gnutls_audit_log_func = log_func;
127 366 : }
128 :
129 : /**
130 : * gnutls_global_set_time_function:
131 : * @time_func: it's the system time function, a gnutls_time_func() callback.
132 : *
133 : * This is the function where you can override the default system time
134 : * function. The application provided function should behave the same
135 : * as the standard function.
136 : *
137 : * Since: 2.12.0
138 : **/
139 800 : void gnutls_global_set_time_function(gnutls_time_func time_func)
140 : {
141 800 : gnutls_time = time_func;
142 800 : }
143 :
144 : /**
145 : * gnutls_global_set_log_level:
146 : * @level: it's an integer from 0 to 99.
147 : *
148 : * This is the function that allows you to set the log level. The
149 : * level is an integer between 0 and 9. Higher values mean more
150 : * verbosity. The default value is 0. Larger values should only be
151 : * used with care, since they may reveal sensitive information.
152 : *
153 : * Use a log level over 10 to enable all debugging options.
154 : **/
155 818 : void gnutls_global_set_log_level(int level)
156 : {
157 818 : _gnutls_log_level = level;
158 818 : }
159 :
160 : /**
161 : * gnutls_global_set_mem_functions:
162 : * @alloc_func: it's the default memory allocation function. Like malloc().
163 : * @secure_alloc_func: This is the memory allocation function that will be used for sensitive data.
164 : * @is_secure_func: a function that returns 0 if the memory given is not secure. May be NULL.
165 : * @realloc_func: A realloc function
166 : * @free_func: The function that frees allocated data. Must accept a NULL pointer.
167 : *
168 : * Deprecated: since 3.3.0 it is no longer possible to replace the internally used
169 : * memory allocation functions
170 : *
171 : * This is the function where you set the memory allocation functions
172 : * gnutls is going to use. By default the libc's allocation functions
173 : * (malloc(), free()), are used by gnutls, to allocate both sensitive
174 : * and not sensitive data. This function is provided to set the
175 : * memory allocation functions to something other than the defaults
176 : *
177 : * This function must be called before gnutls_global_init() is called.
178 : * This function is not thread safe.
179 : **/
180 : void
181 0 : gnutls_global_set_mem_functions(gnutls_alloc_function alloc_func,
182 : gnutls_alloc_function secure_alloc_func,
183 : gnutls_is_secure_function is_secure_func,
184 : gnutls_realloc_function realloc_func,
185 : gnutls_free_function free_func)
186 : {
187 0 : _gnutls_debug_log("called the deprecated gnutls_global_set_mem_functions()\n");
188 0 : }
189 :
190 : GNUTLS_STATIC_MUTEX(global_init_mutex);
191 : static int _gnutls_init = 0;
192 :
193 : /* cache the return code */
194 : static int _gnutls_init_ret = 0;
195 :
196 : /**
197 : * gnutls_global_init:
198 : *
199 : * Since GnuTLS 3.3.0 this function is no longer necessary to be explicitly
200 : * called. To disable the implicit call (in a library constructor) of this
201 : * function set the environment variable %GNUTLS_NO_EXPLICIT_INIT to 1.
202 : *
203 : * This function performs any required precalculations, detects
204 : * the supported CPU capabilities and initializes the underlying
205 : * cryptographic backend. In order to free any resources
206 : * taken by this call you should gnutls_global_deinit()
207 : * when gnutls usage is no longer needed.
208 : *
209 : * This function increments a global counter, so that
210 : * gnutls_global_deinit() only releases resources when it has been
211 : * called as many times as gnutls_global_init(). This is useful when
212 : * GnuTLS is used by more than one library in an application. This
213 : * function can be called many times, but will only do something the
214 : * first time. It is thread safe since GnuTLS 3.3.0.
215 : *
216 : * A subsequent call of this function if the initial has failed will
217 : * return the same error code.
218 : *
219 : * Returns: On success, %GNUTLS_E_SUCCESS (0) is returned,
220 : * otherwise a negative error code is returned.
221 : **/
222 7390 : int gnutls_global_init(void)
223 : {
224 7390 : return _gnutls_global_init(0);
225 : }
226 :
227 10767 : static int _gnutls_global_init(unsigned constructor)
228 : {
229 10767 : int ret = 0, res;
230 10767 : int level;
231 10767 : const char* e;
232 :
233 10767 : if (!constructor) {
234 7390 : GNUTLS_STATIC_MUTEX_LOCK(global_init_mutex);
235 : }
236 :
237 10767 : _gnutls_init++;
238 10767 : if (_gnutls_init > 1) {
239 7382 : if (_gnutls_init == 2 && _gnutls_init_ret == 0) {
240 : /* some applications may close the urandom fd
241 : * before calling gnutls_global_init(). in that
242 : * case reopen it */
243 7322 : ret = _gnutls_rnd_check();
244 7322 : if (ret < 0) {
245 0 : gnutls_assert();
246 0 : goto out;
247 : }
248 : }
249 7382 : ret = _gnutls_init_ret;
250 7382 : goto out;
251 : }
252 :
253 3385 : _gnutls_switch_lib_state(LIB_STATE_INIT);
254 :
255 3385 : e = secure_getenv("GNUTLS_DEBUG_LEVEL");
256 3385 : if (e != NULL) {
257 37 : level = atoi(e);
258 37 : gnutls_global_set_log_level(level);
259 37 : if (_gnutls_log_func == NULL)
260 37 : gnutls_global_set_log_function(default_log_func);
261 37 : _gnutls_debug_log("Enabled GnuTLS "VERSION" logging...\n");
262 : }
263 :
264 : #ifdef HAVE_DCGETTEXT
265 3385 : bindtextdomain(PACKAGE, LOCALEDIR);
266 : #endif
267 :
268 3385 : res = gnutls_crypto_init();
269 3385 : if (res != 0) {
270 0 : gnutls_assert();
271 0 : ret = GNUTLS_E_CRYPTO_INIT_FAILED;
272 0 : goto out;
273 : }
274 :
275 3385 : ret = _gnutls_system_key_init();
276 3385 : if (ret != 0) {
277 0 : gnutls_assert();
278 : }
279 :
280 : /* initialize ASN.1 parser
281 : */
282 3385 : if (asn1_check_version(GNUTLS_MIN_LIBTASN1_VERSION) == NULL) {
283 0 : gnutls_assert();
284 0 : _gnutls_debug_log
285 : ("Checking for libtasn1 failed: %s < %s\n",
286 : asn1_check_version(NULL),
287 : GNUTLS_MIN_LIBTASN1_VERSION);
288 0 : ret = GNUTLS_E_INCOMPATIBLE_LIBTASN1_LIBRARY;
289 0 : goto out;
290 : }
291 :
292 3385 : _gnutls_pkix1_asn = ASN1_TYPE_EMPTY;
293 3385 : res = asn1_array2tree(pkix_asn1_tab, &_gnutls_pkix1_asn, NULL);
294 3385 : if (res != ASN1_SUCCESS) {
295 0 : gnutls_assert();
296 0 : ret = _gnutls_asn2err(res);
297 0 : goto out;
298 : }
299 :
300 3385 : res = asn1_array2tree(gnutls_asn1_tab, &_gnutls_gnutls_asn, NULL);
301 3385 : if (res != ASN1_SUCCESS) {
302 0 : gnutls_assert();
303 0 : ret = _gnutls_asn2err(res);
304 0 : goto out;
305 : }
306 :
307 : /* Initialize the random generator */
308 3385 : ret = _gnutls_rnd_preinit();
309 3385 : if (ret < 0) {
310 0 : gnutls_assert();
311 0 : goto out;
312 : }
313 :
314 : /* Initialize the default TLS extensions */
315 3385 : ret = _gnutls_hello_ext_init();
316 3385 : if (ret < 0) {
317 0 : gnutls_assert();
318 0 : goto out;
319 : }
320 :
321 3385 : ret = gnutls_mutex_init(&_gnutls_file_mutex);
322 3385 : if (ret < 0) {
323 0 : gnutls_assert();
324 0 : goto out;
325 : }
326 :
327 3385 : ret = gnutls_mutex_init(&_gnutls_pkcs11_mutex);
328 3385 : if (ret < 0) {
329 0 : gnutls_assert();
330 0 : goto out;
331 : }
332 :
333 3385 : ret = gnutls_system_global_init();
334 3385 : if (ret < 0) {
335 0 : gnutls_assert();
336 0 : goto out;
337 : }
338 :
339 : #ifndef _WIN32
340 3385 : ret = _gnutls_register_fork_handler();
341 3385 : if (ret < 0) {
342 0 : gnutls_assert();
343 0 : goto out;
344 : }
345 : #endif
346 :
347 : #ifdef ENABLE_FIPS140
348 : res = _gnutls_fips_mode_enabled();
349 : /* res == 1 -> fips140-2 mode enabled
350 : * res == 2 -> only self checks performed - but no failure
351 : * res == not in fips140 mode
352 : */
353 : if (res != 0) {
354 : _gnutls_debug_log("FIPS140-2 mode: %d\n", res);
355 : _gnutls_priority_update_fips();
356 :
357 : /* first round of self checks, these are done on the
358 : * nettle algorithms which are used internally */
359 : ret = _gnutls_fips_perform_self_checks1();
360 : if (res != 2) {
361 : if (ret < 0) {
362 : gnutls_assert();
363 : goto out;
364 : }
365 : }
366 : }
367 : #endif
368 :
369 3385 : _gnutls_register_accel_crypto();
370 3385 : _gnutls_cryptodev_init();
371 :
372 : #ifdef ENABLE_FIPS140
373 : /* These self tests are performed on the overridden algorithms
374 : * (e.g., AESNI overridden AES). They are after _gnutls_register_accel_crypto()
375 : * intentionally */
376 : if (res != 0) {
377 : ret = _gnutls_fips_perform_self_checks2();
378 : if (res != 2) {
379 : if (ret < 0) {
380 : gnutls_assert();
381 : goto out;
382 : }
383 : }
384 : _gnutls_fips_mode_reset_zombie();
385 : }
386 : #endif
387 3385 : _gnutls_load_system_priorities();
388 3385 : _gnutls_switch_lib_state(LIB_STATE_OPERATIONAL);
389 3385 : ret = 0;
390 :
391 10767 : out:
392 10767 : _gnutls_init_ret = ret;
393 10767 : if (!constructor) {
394 7390 : GNUTLS_STATIC_MUTEX_UNLOCK(global_init_mutex);
395 : }
396 10767 : return ret;
397 : }
398 :
399 9548 : static void _gnutls_global_deinit(unsigned destructor)
400 : {
401 9548 : if (!destructor) {
402 6171 : GNUTLS_STATIC_MUTEX_LOCK(global_init_mutex);
403 : }
404 :
405 9548 : if (_gnutls_init == 1) {
406 2185 : _gnutls_init = 0;
407 2185 : if (_gnutls_init_ret < 0) {
408 : /* only deinitialize if gnutls_global_init() has
409 : * succeeded */
410 0 : gnutls_assert();
411 0 : goto fail;
412 : }
413 :
414 2185 : _gnutls_system_key_deinit();
415 2185 : gnutls_crypto_deinit();
416 2185 : _gnutls_rnd_deinit();
417 2185 : _gnutls_hello_ext_deinit();
418 2185 : asn1_delete_structure(&_gnutls_gnutls_asn);
419 2185 : asn1_delete_structure(&_gnutls_pkix1_asn);
420 :
421 2185 : _gnutls_crypto_deregister();
422 2185 : gnutls_system_global_deinit();
423 2185 : _gnutls_cryptodev_deinit();
424 :
425 2185 : _gnutls_supplemental_deinit();
426 2185 : _gnutls_unload_system_priorities();
427 :
428 : #ifdef ENABLE_PKCS11
429 : /* Do not try to deinitialize the PKCS #11 libraries
430 : * from the destructor. If we do and the PKCS #11 modules
431 : * are already being unloaded, we may crash.
432 : */
433 2185 : if (destructor == 0) {
434 13 : gnutls_pkcs11_deinit();
435 : }
436 : #endif
437 : #ifdef HAVE_TROUSERS
438 2185 : _gnutls_tpm_global_deinit();
439 : #endif
440 :
441 2185 : _gnutls_nss_keylog_deinit();
442 :
443 2185 : gnutls_mutex_deinit(&_gnutls_file_mutex);
444 2185 : gnutls_mutex_deinit(&_gnutls_pkcs11_mutex);
445 : } else {
446 7363 : if (_gnutls_init > 0)
447 7354 : _gnutls_init--;
448 : }
449 :
450 9 : fail:
451 9548 : if (!destructor) {
452 6171 : GNUTLS_STATIC_MUTEX_UNLOCK(global_init_mutex);
453 : }
454 9548 : }
455 :
456 : /**
457 : * gnutls_global_deinit:
458 : *
459 : * This function deinitializes the global data, that were initialized
460 : * using gnutls_global_init().
461 : *
462 : * Since GnuTLS 3.3.0 this function is no longer necessary to be explicitly
463 : * called. GnuTLS will automatically deinitialize on library destructor. See
464 : * gnutls_global_init() for disabling the implicit initialization/deinitialization.
465 : *
466 : **/
467 6171 : void gnutls_global_deinit(void)
468 : {
469 6171 : _gnutls_global_deinit(0);
470 6171 : }
471 :
472 : /**
473 : * gnutls_check_version:
474 : * @req_version: version string to compare with, or %NULL.
475 : *
476 : * Check the GnuTLS Library version against the provided string.
477 : * See %GNUTLS_VERSION for a suitable @req_version string.
478 : *
479 : * See also gnutls_check_version_numeric(), which provides this
480 : * functionality as a macro.
481 : *
482 : * Returns: Check that the version of the library is at
483 : * minimum the one given as a string in @req_version and return the
484 : * actual version string of the library; return %NULL if the
485 : * condition is not met. If %NULL is passed to this function no
486 : * check is done and only the version string is returned.
487 : **/
488 6 : const char *gnutls_check_version(const char *req_version)
489 : {
490 6 : if (!req_version || strverscmp(req_version, VERSION) <= 0)
491 6 : return VERSION;
492 :
493 : return NULL;
494 : }
495 :
496 3380 : static void _CONSTRUCTOR lib_init(void)
497 : {
498 3380 : int ret;
499 3380 : const char *e;
500 :
501 3380 : if (_gnutls_global_init_skip() != 0)
502 : return;
503 :
504 3379 : e = secure_getenv("GNUTLS_NO_EXPLICIT_INIT");
505 3379 : if (e != NULL) {
506 2 : ret = atoi(e);
507 2 : if (ret == 1)
508 : return;
509 : }
510 :
511 3377 : ret = _gnutls_global_init(1);
512 3377 : if (ret < 0) {
513 0 : fprintf(stderr, "Error in GnuTLS initialization: %s\n", gnutls_strerror(ret));
514 0 : _gnutls_switch_lib_state(LIB_STATE_ERROR);
515 : }
516 : }
517 :
518 3380 : static void _DESTRUCTOR lib_deinit(void)
519 : {
520 3380 : const char *e;
521 :
522 3380 : if (_gnutls_global_init_skip() != 0)
523 : return;
524 :
525 3379 : e = secure_getenv("GNUTLS_NO_EXPLICIT_INIT");
526 3379 : if (e != NULL) {
527 2 : int ret = atoi(e);
528 2 : if (ret == 1)
529 : return;
530 : }
531 :
532 3377 : _gnutls_global_deinit(1);
533 : }
|