openssl / openssl/openssl

No such file or directory:crypto/conf/conf_def.c:773:calling stat(fipsmodule.cnf)

Open
#14,899 9 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

branch: master triaged: feature
Dominant language
C
Stars
30.8k
Forks
11.5k
Avg merge
10m
Merged PRs (30d)
1

Description

When selective debugging specific tests that involve loading a provider via test/fips-and-base.cnf or the like, e.g.,

test/evp_libctx_test -config test/fips-and-base.cnf -provider fips

I often run into the annoying situation that I get

Error loading config from file test/fips-and-base.cnf
4087E970517F0000:error:80000002:system library:process_include:No such file or directory:crypto/conf/conf_def.c:773:calling stat(fipsmodule.cnf)
4087E970517F0000:error:07800069:common libcrypto routines:provider_conf_load:provider section error:crypto/provider_conf.c:90:section=fips_sect not found
4087E970517F0000:error:0700006D:configuration file routines:module_run:module initialization error:crypto/conf/conf_mod.c:242:module=providers, value=provider_sect retcode=-1      

because the relative addressing .include fipsmodule.cnf in that config file goes wrong.

As doc/man5/config.pod states:

As a general rule, the B<pathname> should be an absolute path.  Relative
paths are evaluated based on the current working directory, so unless the
file with the B<.include> directive is application-specific, the inclusion
will not work as expected.  The environment variable B<OPENSSL_CONF_INCLUDE>,
if it exists, will be prepended to all B<.include> B<pathname>'s.

A workaround is to use, e.g., OPENSSL_CONF_INCLUDE=./providers.

IMO it is bad design to interpret the .include pathname relative to the current directory of the running application,
which makes the interpretation dependent on dynamic (rather than static) context and thus very fragile.
I suggest interpreting it instead relative to the directory containing the given config file (which is in this case test/).

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Reproduce with test/evp_libctx_test -config test/fips-and-base.cnf -provider fips and inspect include handling at crypto/conf/conf_def.c:773, along with crypto/provider_conf.c and doc/man5/config.pod. Compare the current working-directory behavior with the proposed config-file-relative behavior; done means the example loads without OPENSSL_CONF_INCLUDE and the documented semantics remain coherent.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
cryptography, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.