OPENSSL_CONF_INCLUDE does not seem to work in openssl 3.0.8

[casidapulak]

Hello,
We are using openssl dlls in our c# application using p/invoke. We need to provide relative path for fipsmodule.cnf file in openssl.cnf.
We cant use the absolute path since our customers can choose to install our application anywhere and the path to openssl.cnf and fipsmodule.cnf(both of which will be deployed in same directory) will be dependent on the installation location.
So we tried using the environment variable OPENSSL_CONF_INCLUDE in our code before setting the config path like below:
Environment.SetEnvironmentVariable("OPENSSL_CONF_INCLUDE", AppDomain.CurrentDomain.BaseDirectory,EnvironmentVariableTarget.Process);

But that environment variable does not seem to have any impact. Our application is working only when we give absolute path or if we change the current working directory.
Also is there a way to make openssl.cnf pick fipsmodule.cnf from the same directory that openssl.cnf file is in?
Request your help with this. Thanks in advance

[kulkarniamit]

A few steps to try:

• Print the value of your environment variable using Environment.GetEnvironmentVariable after setting it
• Verify if fipsmodule.cnf exists in the directory set for OPENSSL_CONF_INCLUDE
• Check the default path to be used for finding openssl.cnf by running $ openssl version -a | grep OPENSSLDIR and verify if you have openssl.cnf in that directory
  • If there's no openssl.cnf in the directory listed as OPENSSLDIR in the previous step command, you could set another environment variable OPENSSL_CONF (Reference) to the path of openssl.cnf where it can be found after your product has been installed.
• Once OPENSSL_CONF and OPENSSL_CONF_INCLUDE are set, check if fips.dll is available in the default search path for modules by running $ openssl version -a | grep MODULESDIR
  • If fips.dll is not available in the MODULESDIR directory, set environment variable OPENSSL_MODULES to the directory where fips.dll is installed
• Run a sample program that can print error message for better visibility into any errors encountered

Here's a sample program that uses environment variables to set the directory for finding openssl.cnf, set the directory for included files (in openssl.cnf) and set the directory path to find modules.

Program

#include <stdio.h>
#include <stdlib.h>
#include <openssl/provider.h>
#include <openssl/err.h>
#include <openssl/crypto.h>

int main() {
    OSSL_PROVIDER *fips_provider = NULL;
    /*
     * Use OPENSSL_CONF, OPENSSL_CONF_INCLUDE and OPENSSL_MODULES
     * environment variables to point them to the appropriate locations
     */
    fips_provider = OSSL_PROVIDER_load(NULL, "fips");
    fprintf(stdout, "FIPS provider load %s\n",
        (fips_provider == NULL ||
        !OSSL_PROVIDER_available(NULL, "fips")) ? "failed" : "succeeded");
    ERR_print_errors_fp(stderr);
    OSSL_PROVIDER_unload(fips_provider);
    exit(EXIT_SUCCESS);
}

Configuration files

$ grep "^\.include" conf/openssl.cnf
.include fipsmodule.cnf

$ grep "fips =" conf/openssl.cnf
fips = fips_sect

$ grep "activate"  conf/fipsmodule.cnf
#activate = 1

$ ls modules/
fips.so  legacy.so

Output

$ gcc -ggdb3 -O0 -L libs -I include -o program main.c -lcrypto -ldl -lpthread

$ OPENSSL_MODULES=modules OPENSSL_CONF_INCLUDE=conf OPENSSL_CONF=conf/openssl.cnf ./program
FIPS provider load succeeded

Errors if environment variables are not set correctly

$ OPENSSL_MODULES=modules OPENSSL_CONF=conf/openssl.cnf ./program
FIPS provider load failed
40E7C921857F0000:error:80000002:system library:(unknown function):No such file or directory:crypto/conf/conf_def.c:805:calling stat(fipsmodule.cnf)
40E7C921857F0000:error:07800069:common libcrypto routines:(unknown function):provider section error:crypto/provider_conf.c:156:section=fips_sect not found
40E7C921857F0000:error:0700006D:configuration file routines:(unknown function):module initialization error:crypto/conf/conf_mod.c:270:module=providers, value=provider_sect retcode=-1
40E7C921857F0000:error:1C8000D5:Provider routines:(unknown function):missing config data:providers/fips/self_test.c:290:
40E7C921857F0000:error:1C8000E0:Provider routines:(unknown function):fips module entering error state:providers/fips/self_test.c:388:
40E7C921857F0000:error:1C8000D8:Provider routines:(unknown function):self test post failure:providers/fips/fipsprov.c:707:
40E7C921857F0000:error:078C0105:common libcrypto routines:(unknown function):init fail:crypto/provider_core.c:932:name=fips

$ OPENSSL_MODULES=modules OPENSSL_CONF_INCLUDE=conf  ./program
FIPS provider load failed
40B7CD90057F0000:error:1C8000D5:Provider routines:(unknown function):missing config data:providers/fips/self_test.c:290:
40B7CD90057F0000:error:1C8000E0:Provider routines:(unknown function):fips module entering error state:providers/fips/self_test.c:388:
40B7CD90057F0000:error:1C8000D8:Provider routines:(unknown function):self test post failure:providers/fips/fipsprov.c:707:
40B7CD90057F0000:error:078C0105:common libcrypto routines:(unknown function):init fail:crypto/provider_core.c:932:name=fips

[t8m]

I assume the setting of the environment variable happens too late after the config file is already loaded.

[casidapulak]

@t8m ,
The environment variable is set before the config file is being loaded. The environment variable is set using: Environment.SetEnvironmentVariable("OPENSSL_CONF_INCLUDE", AppDomain.CurrentDomain.BaseDirectory,EnvironmentVariableTarget.Process);
The config file is being loaded with the api: OSSL_LIB_CTX_load_config
The search path is set with the api: OSSL_PROVIDER_set_default_search_path
openssl.cnf, fipsmodule.cnf are present in the config path, fips.dll is present in the search path, the environment variable is pointing to the config path where fipsmodule.cnf is present.
openssl.cnf contains the following statement .include fipsmodule.cnf

I am not sure what I am missing here. Thanks

[t8m]

Unfortunately I assume you will have to go into debugger and see whether the getenv() call inside the config parsing code really returns the expected value from the environment variable.

[nhorman]

Not a solution per-se, but its also possible that, since you said it worked if you change the working directory, that the environment variable is working, but you are selecting the wrong configuration file, given that you are using relative paths in the assignment of the OPENSSL_CONF_INCLUDE variable. You could check that fairly easily by running your program as follows:

OPENSSL_MODULES=modules OPENSSL_CONF_INCLUDE=$(realpath conf) OPENSSL_CONF=conf/openssl.cnf ./program

That will resolve your relative path to an absolute path prior to executing the program