No such file or directory:crypto/conf/conf_def.c:773:calling stat(fipsmodule.cnf)
Nobody has claimed this yet.
- Dominant language
- C
- Stars
- 30.8k
- Forks
- 11.5k
- Avg merge
- 10m
- Merged PRs (30d)
- 1
Description
When selective debugging specific tests that involve loading a provider via test/fips-and-base.cnf or the like, e.g.,
test/evp_libctx_test -config test/fips-and-base.cnf -provider fips
I often run into the annoying situation that I get
Error loading config from file test/fips-and-base.cnf
4087E970517F0000:error:80000002:system library:process_include:No such file or directory:crypto/conf/conf_def.c:773:calling stat(fipsmodule.cnf)
4087E970517F0000:error:07800069:common libcrypto routines:provider_conf_load:provider section error:crypto/provider_conf.c:90:section=fips_sect not found
4087E970517F0000:error:0700006D:configuration file routines:module_run:module initialization error:crypto/conf/conf_mod.c:242:module=providers, value=provider_sect retcode=-1
because the relative addressing .include fipsmodule.cnf in that config file goes wrong.
As doc/man5/config.pod states:
As a general rule, the B<pathname> should be an absolute path. Relative
paths are evaluated based on the current working directory, so unless the
file with the B<.include> directive is application-specific, the inclusion
will not work as expected. The environment variable B<OPENSSL_CONF_INCLUDE>,
if it exists, will be prepended to all B<.include> B<pathname>'s.
A workaround is to use, e.g., OPENSSL_CONF_INCLUDE=./providers.
IMO it is bad design to interpret the .include pathname relative to the current directory of the running application,
which makes the interpretation dependent on dynamic (rather than static) context and thus very fragile.
I suggest interpreting it instead relative to the directory containing the given config file (which is in this case test/).
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Reproduce with test/evp_libctx_test -config test/fips-and-base.cnf -provider fips and inspect include handling at crypto/conf/conf_def.c:773, along with crypto/provider_conf.c and doc/man5/config.pod. Compare the current working-directory behavior with the proposed config-file-relative behavior; done means the example loads without OPENSSL_CONF_INCLUDE and the documented semantics remain coherent.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- cryptography, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100