|
|
5820f5 |
diff -up openssl-fips-0.9.8e/crypto/conf/conf_api.c.secure-getenv openssl-fips-0.9.8e/crypto/conf/conf_api.c
|
|
|
5820f5 |
--- openssl-fips-0.9.8e/crypto/conf/conf_api.c.secure-getenv 2013-07-17 11:38:28.172584638 +0200
|
|
|
5820f5 |
+++ openssl-fips-0.9.8e/crypto/conf/conf_api.c 2013-07-17 11:44:13.779925448 +0200
|
|
|
5820f5 |
@@ -62,6 +62,8 @@
|
|
|
5820f5 |
# undef NDEBUG /* avoid conflicting definitions */
|
|
|
5820f5 |
# define NDEBUG
|
|
|
5820f5 |
#endif
|
|
|
5820f5 |
+/* for secure_getenv */
|
|
|
5820f5 |
+#define _GNU_SOURCE
|
|
|
5820f5 |
|
|
|
5820f5 |
#include <assert.h>
|
|
|
5820f5 |
#include <string.h>
|
|
|
5820f5 |
@@ -145,7 +147,7 @@ char *_CONF_get_string(const CONF *conf,
|
|
|
5820f5 |
if (v != NULL) return(v->value);
|
|
|
5820f5 |
if (strcmp(section,"ENV") == 0)
|
|
|
5820f5 |
{
|
|
|
5820f5 |
- p=Getenv(name);
|
|
|
5820f5 |
+ p=secure_getenv(name);
|
|
|
5820f5 |
if (p != NULL) return(p);
|
|
|
5820f5 |
}
|
|
|
5820f5 |
}
|
|
|
5820f5 |
@@ -158,7 +160,7 @@ char *_CONF_get_string(const CONF *conf,
|
|
|
5820f5 |
return(NULL);
|
|
|
5820f5 |
}
|
|
|
5820f5 |
else
|
|
|
5820f5 |
- return(Getenv(name));
|
|
|
5820f5 |
+ return(secure_getenv(name));
|
|
|
5820f5 |
}
|
|
|
5820f5 |
|
|
|
5820f5 |
#if 0 /* There's no way to provide error checking with this function, so
|
|
|
5820f5 |
diff -up openssl-fips-0.9.8e/crypto/conf/conf_mod.c.secure-getenv openssl-fips-0.9.8e/crypto/conf/conf_mod.c
|
|
|
5820f5 |
--- openssl-fips-0.9.8e/crypto/conf/conf_mod.c.secure-getenv 2013-07-17 11:38:28.173584642 +0200
|
|
|
5820f5 |
+++ openssl-fips-0.9.8e/crypto/conf/conf_mod.c 2013-07-17 11:44:37.188017398 +0200
|
|
|
5820f5 |
@@ -56,6 +56,8 @@
|
|
|
5820f5 |
*
|
|
|
5820f5 |
*/
|
|
|
5820f5 |
|
|
|
5820f5 |
+/* for secure_getenv */
|
|
|
5820f5 |
+#define _GNU_SOURCE
|
|
|
5820f5 |
#include <stdio.h>
|
|
|
5820f5 |
#include <ctype.h>
|
|
|
5820f5 |
#include <openssl/crypto.h>
|
|
|
5820f5 |
@@ -548,8 +550,8 @@ char *CONF_get1_default_config_file(void
|
|
|
5820f5 |
char *file;
|
|
|
5820f5 |
int len;
|
|
|
5820f5 |
|
|
|
5820f5 |
- file = getenv("OPENSSL_CONF");
|
|
|
5820f5 |
- if (file)
|
|
|
5820f5 |
+ file = secure_getenv("OPENSSL_CONF");
|
|
|
5820f5 |
+ if (file)
|
|
|
5820f5 |
return BUF_strdup(file);
|
|
|
5820f5 |
|
|
|
5820f5 |
len = strlen(X509_get_default_cert_area());
|
|
|
5820f5 |
diff -up openssl-fips-0.9.8e/crypto/engine/eng_list.c.secure-getenv openssl-fips-0.9.8e/crypto/engine/eng_list.c
|
|
|
5820f5 |
--- openssl-fips-0.9.8e/crypto/engine/eng_list.c.secure-getenv 2005-08-06 12:34:35.000000000 +0200
|
|
|
5820f5 |
+++ openssl-fips-0.9.8e/crypto/engine/eng_list.c 2013-07-17 11:42:52.210608034 +0200
|
|
|
5820f5 |
@@ -61,6 +61,8 @@
|
|
|
5820f5 |
* SUN MICROSYSTEMS, INC., and contributed to the OpenSSL project.
|
|
|
5820f5 |
*/
|
|
|
5820f5 |
|
|
|
5820f5 |
+/* for secure_getenv */
|
|
|
5820f5 |
+#define _GNU_SOURCE
|
|
|
5820f5 |
#include "eng_int.h"
|
|
|
5820f5 |
|
|
|
5820f5 |
/* The linked-list of pointers to engine types. engine_list_head
|
|
|
5820f5 |
@@ -398,9 +400,9 @@ ENGINE *ENGINE_by_id(const char *id)
|
|
|
5820f5 |
if (strcmp(id, "dynamic"))
|
|
|
5820f5 |
{
|
|
|
5820f5 |
#ifdef OPENSSL_SYS_VMS
|
|
|
5820f5 |
- if((load_dir = getenv("OPENSSL_ENGINES")) == 0) load_dir = "SSLROOT:[ENGINES]";
|
|
|
5820f5 |
+ if(OPENSSL_issetugid() || (load_dir = getenv("OPENSSL_ENGINES")) == 0) load_dir = "SSLROOT:[ENGINES]";
|
|
|
5820f5 |
#else
|
|
|
5820f5 |
- if((load_dir = getenv("OPENSSL_ENGINES")) == 0) load_dir = ENGINESDIR;
|
|
|
5820f5 |
+ if((load_dir = secure_getenv("OPENSSL_ENGINES")) == 0) load_dir = ENGINESDIR;
|
|
|
5820f5 |
#endif
|
|
|
5820f5 |
iterator = ENGINE_by_id("dynamic");
|
|
|
5820f5 |
if(!iterator || !ENGINE_ctrl_cmd_string(iterator, "ID", id, 0) ||
|
|
|
5820f5 |
diff -up openssl-fips-0.9.8e/crypto/o_init.c.secure-getenv openssl-fips-0.9.8e/crypto/o_init.c
|
|
|
5820f5 |
--- openssl-fips-0.9.8e/crypto/o_init.c.secure-getenv 2013-07-17 11:38:28.232584911 +0200
|
|
|
5820f5 |
+++ openssl-fips-0.9.8e/crypto/o_init.c 2013-07-17 11:41:57.060391907 +0200
|
|
|
5820f5 |
@@ -56,6 +56,8 @@
|
|
|
5820f5 |
*
|
|
|
5820f5 |
*/
|
|
|
5820f5 |
|
|
|
5820f5 |
+/* for secure_getenv */
|
|
|
5820f5 |
+#define _GNU_SOURCE
|
|
|
5820f5 |
#include <e_os.h>
|
|
|
5820f5 |
#include <openssl/err.h>
|
|
|
5820f5 |
|
|
|
5820f5 |
@@ -77,7 +79,7 @@ static void init_fips_mode(void)
|
|
|
5820f5 |
char buf[2] = "0";
|
|
|
5820f5 |
int fd;
|
|
|
5820f5 |
|
|
|
5820f5 |
- if (getenv("OPENSSL_FORCE_FIPS_MODE") != NULL)
|
|
|
5820f5 |
+ if (secure_getenv("OPENSSL_FORCE_FIPS_MODE") != NULL)
|
|
|
5820f5 |
{
|
|
|
5820f5 |
buf[0] = '1';
|
|
|
5820f5 |
}
|
|
|
5820f5 |
diff -up openssl-fips-0.9.8e/crypto/rand/randfile.c.secure-getenv openssl-fips-0.9.8e/crypto/rand/randfile.c
|
|
|
5820f5 |
--- openssl-fips-0.9.8e/crypto/rand/randfile.c.secure-getenv 2007-03-02 18:44:55.000000000 +0100
|
|
|
5820f5 |
+++ openssl-fips-0.9.8e/crypto/rand/randfile.c 2013-07-17 11:43:29.891755269 +0200
|
|
|
5820f5 |
@@ -58,6 +58,8 @@
|
|
|
5820f5 |
|
|
|
5820f5 |
/* We need to define this to get macros like S_IFBLK and S_IFCHR */
|
|
|
5820f5 |
#define _XOPEN_SOURCE 500
|
|
|
5820f5 |
+/* for secure_getenv */
|
|
|
5820f5 |
+#define _GNU_SOURCE
|
|
|
5820f5 |
|
|
|
5820f5 |
#include <errno.h>
|
|
|
5820f5 |
#include <stdio.h>
|
|
|
5820f5 |
@@ -231,8 +233,7 @@ const char *RAND_file_name(char *buf, si
|
|
|
5820f5 |
struct stat sb;
|
|
|
5820f5 |
#endif
|
|
|
5820f5 |
|
|
|
5820f5 |
- if (OPENSSL_issetugid() == 0)
|
|
|
5820f5 |
- s=getenv("RANDFILE");
|
|
|
5820f5 |
+ s=secure_getenv("RANDFILE");
|
|
|
5820f5 |
if (s != NULL && *s && strlen(s) + 1 < size)
|
|
|
5820f5 |
{
|
|
|
5820f5 |
if (BUF_strlcpy(buf,s,size) >= size)
|
|
|
5820f5 |
@@ -240,8 +241,7 @@ const char *RAND_file_name(char *buf, si
|
|
|
5820f5 |
}
|
|
|
5820f5 |
else
|
|
|
5820f5 |
{
|
|
|
5820f5 |
- if (OPENSSL_issetugid() == 0)
|
|
|
5820f5 |
- s=getenv("HOME");
|
|
|
5820f5 |
+ s=secure_getenv("HOME");
|
|
|
5820f5 |
#ifdef DEFAULT_HOME
|
|
|
5820f5 |
if (s == NULL)
|
|
|
5820f5 |
{
|
|
|
5820f5 |
diff -up openssl-fips-0.9.8e/crypto/x509/by_dir.c.secure-getenv openssl-fips-0.9.8e/crypto/x509/by_dir.c
|
|
|
5820f5 |
--- openssl-fips-0.9.8e/crypto/x509/by_dir.c.secure-getenv 2007-02-18 18:23:20.000000000 +0100
|
|
|
5820f5 |
+++ openssl-fips-0.9.8e/crypto/x509/by_dir.c 2013-07-17 11:45:03.612126552 +0200
|
|
|
5820f5 |
@@ -56,6 +56,8 @@
|
|
|
5820f5 |
* [including the GNU Public Licence.]
|
|
|
5820f5 |
*/
|
|
|
5820f5 |
|
|
|
5820f5 |
+/* for secure_getenv */
|
|
|
5820f5 |
+#define _GNU_SOURCE
|
|
|
5820f5 |
#include <stdio.h>
|
|
|
5820f5 |
#include <time.h>
|
|
|
5820f5 |
#include <errno.h>
|
|
|
5820f5 |
@@ -123,7 +125,7 @@ static int dir_ctrl(X509_LOOKUP *ctx, in
|
|
|
5820f5 |
case X509_L_ADD_DIR:
|
|
|
5820f5 |
if (argl == X509_FILETYPE_DEFAULT)
|
|
|
5820f5 |
{
|
|
|
5820f5 |
- dir=(char *)Getenv(X509_get_default_cert_dir_env());
|
|
|
5820f5 |
+ dir=(char *)secure_getenv(X509_get_default_cert_dir_env());
|
|
|
5820f5 |
if (dir)
|
|
|
5820f5 |
ret=add_cert_dir(ld,dir,X509_FILETYPE_PEM);
|
|
|
5820f5 |
else
|
|
|
5820f5 |
diff -up openssl-fips-0.9.8e/crypto/x509/by_file.c.secure-getenv openssl-fips-0.9.8e/crypto/x509/by_file.c
|
|
|
5820f5 |
--- openssl-fips-0.9.8e/crypto/x509/by_file.c.secure-getenv 2013-07-17 11:38:28.127584434 +0200
|
|
|
5820f5 |
+++ openssl-fips-0.9.8e/crypto/x509/by_file.c 2013-07-17 11:45:22.708202388 +0200
|
|
|
5820f5 |
@@ -56,6 +56,8 @@
|
|
|
5820f5 |
* [including the GNU Public Licence.]
|
|
|
5820f5 |
*/
|
|
|
5820f5 |
|
|
|
5820f5 |
+/* for secure_getenv */
|
|
|
5820f5 |
+#define _GNU_SOURCE
|
|
|
5820f5 |
#include <stdio.h>
|
|
|
5820f5 |
#include <time.h>
|
|
|
5820f5 |
#include <errno.h>
|
|
|
5820f5 |
@@ -100,7 +102,7 @@ static int by_file_ctrl(X509_LOOKUP *ctx
|
|
|
5820f5 |
case X509_L_FILE_LOAD:
|
|
|
5820f5 |
if (argl == X509_FILETYPE_DEFAULT)
|
|
|
5820f5 |
{
|
|
|
5820f5 |
- file = (char *)Getenv(X509_get_default_cert_file_env());
|
|
|
5820f5 |
+ file = (char *)secure_getenv(X509_get_default_cert_file_env());
|
|
|
5820f5 |
if (file)
|
|
|
5820f5 |
ok = (X509_load_cert_crl_file(ctx,file,
|
|
|
5820f5 |
X509_FILETYPE_PEM) != 0);
|
|
|
5820f5 |
diff -up openssl-fips-0.9.8e/crypto/x509/x509_vfy.c.secure-getenv openssl-fips-0.9.8e/crypto/x509/x509_vfy.c
|
|
|
5820f5 |
--- openssl-fips-0.9.8e/crypto/x509/x509_vfy.c.secure-getenv 2013-07-17 11:38:28.396585612 +0200
|
|
|
5820f5 |
+++ openssl-fips-0.9.8e/crypto/x509/x509_vfy.c 2013-07-17 11:45:49.733310202 +0200
|
|
|
5820f5 |
@@ -56,6 +56,8 @@
|
|
|
5820f5 |
* [including the GNU Public Licence.]
|
|
|
5820f5 |
*/
|
|
|
5820f5 |
|
|
|
5820f5 |
+/* for secure_getenv */
|
|
|
5820f5 |
+#define _GNU_SOURCE
|
|
|
5820f5 |
#include <stdio.h>
|
|
|
5820f5 |
#include <time.h>
|
|
|
5820f5 |
#include <errno.h>
|
|
|
5820f5 |
@@ -414,7 +416,7 @@ static int check_chain_extensions(X509_S
|
|
|
5820f5 |
|
|
|
5820f5 |
/* A hack to keep people who don't want to modify their software
|
|
|
5820f5 |
happy */
|
|
|
5820f5 |
- if (getenv("OPENSSL_ALLOW_PROXY_CERTS"))
|
|
|
5820f5 |
+ if (secure_getenv("OPENSSL_ALLOW_PROXY_CERTS"))
|
|
|
5820f5 |
allow_proxy_certs = 1;
|
|
|
5820f5 |
|
|
|
5820f5 |
/* Check all untrusted certificates */
|