1 // -*- mode:C++; tab-width:8; c-basic-offset:2; indent-tabs-mode:t -*-
2 // vim: ts=8 sw=2 smarttab
4 * Ceph - scalable distributed file system
6 * Copyright (c) 2020 Huawei Technologies Co., Ltd.
8 * This library is free software; you can redistribute it and/or
9 * modify it under the terms of the GNU Lesser General Public
10 * License as published by the Free Software Foundation; either
11 * version 2.1 of the License, or (at your option) any later version.
15 #include "openssl_opts_handler.h"
17 #include <openssl/bio.h>
18 #include <openssl/conf.h>
19 #include <openssl/engine.h>
24 #include "common/debug.h"
25 #include "global/global_context.h"
26 #include "include/str_list.h"
27 #include "include/scope_guard.h"
32 // -----------------------------------------------------------------------------
33 #define dout_context g_ceph_context
34 #define dout_subsys ceph_subsys_common
36 #define dout_prefix _prefix(_dout)
38 static ostream
&_prefix(std::ostream
*_dout
)
40 return *_dout
<< "OpenSSLOptsHandler: ";
42 // -----------------------------------------------------------------------------
44 string
construct_engine_conf(const string
&opts
)
46 const string conf_header
= "openssl_conf=openssl_def\n[openssl_def]\n";
47 const string engine_header
= "engines=engine_section\n[engine_section]\n";
49 string engine_id
, engine_statement
, engine_detail
;
50 const string id_prefix
= "engine";
51 const string suffix
= "_section";
52 const char delimiter
= '\n';
55 vector
<string
> confs
= get_str_vec(opts
, ":");
56 for (auto conf
: confs
) {
57 // Construct engine section statement like "engine1=engine1_section"
58 engine_id
= id_prefix
+ to_string(index
++);
59 engine_statement
+= engine_id
+ "=" + engine_id
+ suffix
+ delimiter
;
61 // Adapt to OpenSSL parser
62 // Replace ',' with '\n' and add section in front
63 std::replace(conf
.begin(), conf
.end(), ',', delimiter
);
64 engine_detail
+= "[" + engine_id
+ suffix
+ "]" + delimiter
;
65 engine_detail
+= conf
+ delimiter
;
68 return conf_header
+ engine_header
+ engine_statement
+ engine_detail
;
71 string
get_openssl_error()
73 BIO
*bio
= BIO_new(BIO_s_mem());
75 return "failed to create BIO for more error printing";
77 ERR_print_errors(bio
);
79 size_t len
= BIO_get_mem_data(bio
, &buf
);
85 void log_error(const string
&err
)
87 derr
<< "Intended OpenSSL engine acceleration failed.\n"
88 << "set by openssl_engine_opts = "
89 << g_ceph_context
->_conf
->openssl_engine_opts
90 << "\ndetail error information:\n" << err
<< dendl
;
93 void load_module(const string
&engine_conf
)
95 BIO
*mem
= BIO_new_mem_buf(engine_conf
.c_str(), engine_conf
.size());
97 log_error("failed to new BIO memory");
100 auto sg_mem
= make_scope_guard([&mem
] { BIO_free(mem
); });
102 CONF
*conf
= NCONF_new(nullptr);
103 if (conf
== nullptr) {
104 log_error("failed to new OpenSSL CONF");
107 auto sg_conf
= make_scope_guard([&conf
] { NCONF_free(conf
); });
109 if (NCONF_load_bio(conf
, mem
, nullptr) <= 0) {
110 log_error("failed to load CONF from BIO:\n" + get_openssl_error());
114 OPENSSL_load_builtin_modules();
115 ENGINE_load_builtin_engines();
117 if (CONF_modules_load(
119 CONF_MFLAGS_DEFAULT_SECTION
| CONF_MFLAGS_IGNORE_MISSING_FILE
) <= 0) {
120 log_error("failed to load modules from CONF:\n" + get_openssl_error());
126 string opts
= g_ceph_context
->_conf
->openssl_engine_opts
;
130 string engine_conf
= construct_engine_conf(opts
);
131 load_module(engine_conf
);
134 void ceph::crypto::init_openssl_engine_once()
136 static std::once_flag flag
;
137 std::call_once(flag
, init_engine
);