From 495ad3d82aff125f237f370a70882b97843edb6f Mon Sep 17 00:00:00 2001

From: Alexander Sosedkin <asosedkin@redhat.com>

Date: Mon, 14 Feb 2022 12:44:57 +0100

Subject: [PATCH 1/8] lib/priority: split up update_system_wide_priority_string

This is done in preparation for deferring priority string evaluation.

Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>

---

 lib/priority.c | 77 ++++++++++++++++++++++++++++++--------------------

 1 file changed, 47 insertions(+), 30 deletions(-)

diff --git a/lib/priority.c b/lib/priority.c

index e7698ba7eb..755729da18 100644

--- a/lib/priority.c

+++ b/lib/priority.c

@@ -1735,110 +1735,127 @@ static int cfg_ini_handler(void *_ctx, const char *section, const char *name, co

 	return 1;

 }

-static int

-update_system_wide_priority_string(void)

+static int /* not locking system_wide_config */

+construct_system_wide_priority_string(gnutls_buffer_st* buf)

 {

-	gnutls_buffer_st buf;

 	int ret;

 	size_t i;

-	_gnutls_buffer_init(&buf;;

+	_gnutls_buffer_init(buf);

-	ret = _gnutls_buffer_append_str(&buf, "NONE");

+	ret = _gnutls_buffer_append_str(buf, "NONE");

 	if (ret < 0) {

-		_gnutls_buffer_clear(&buf;;

+		_gnutls_buffer_clear(buf);

 		return ret;

 	}

 	for (i = 0; system_wide_config.kxs[i] != 0; i++) {

-		ret = _gnutls_buffer_append_str(&buf, ":+");

+		ret = _gnutls_buffer_append_str(buf, ":+");

 		if (ret < 0) {

-			_gnutls_buffer_clear(&buf;;

+			_gnutls_buffer_clear(buf);

 			return ret;

 		}

-		ret = _gnutls_buffer_append_str(&buf,

+		ret = _gnutls_buffer_append_str(buf,

 						gnutls_kx_get_name(system_wide_config.kxs[i]));

 		if (ret < 0) {

-			_gnutls_buffer_clear(&buf;;

+			_gnutls_buffer_clear(buf);

 			return ret;

 		}

 	}

 	for (i = 0; system_wide_config.groups[i] != 0; i++) {

-		ret = _gnutls_buffer_append_str(&buf, ":+GROUP-");

+		ret = _gnutls_buffer_append_str(buf, ":+GROUP-");

 		if (ret < 0) {

-			_gnutls_buffer_clear(&buf;;

+			_gnutls_buffer_clear(buf);

 			return ret;

 		}

-		ret = _gnutls_buffer_append_str(&buf,

+		ret = _gnutls_buffer_append_str(buf,

 						gnutls_group_get_name(system_wide_config.groups[i]));

 		if (ret < 0) {

-			_gnutls_buffer_clear(&buf;;

+			_gnutls_buffer_clear(buf);

 			return ret;

 		}

 	}

 	for (i = 0; system_wide_config.ciphers[i] != 0; i++) {

-		ret = _gnutls_buffer_append_str(&buf, ":+");

+		ret = _gnutls_buffer_append_str(buf, ":+");

 		if (ret < 0) {

-			_gnutls_buffer_clear(&buf;;

+			_gnutls_buffer_clear(buf);

 			return ret;

 		}

-		ret = _gnutls_buffer_append_str(&buf,

+		ret = _gnutls_buffer_append_str(buf,

 						gnutls_cipher_get_name(system_wide_config.ciphers[i]));

 		if (ret < 0) {

-			_gnutls_buffer_clear(&buf;;

+			_gnutls_buffer_clear(buf);

 			return ret;

 		}

 	}

 	for (i = 0; system_wide_config.macs[i] != 0; i++) {

-		ret = _gnutls_buffer_append_str(&buf, ":+");

+		ret = _gnutls_buffer_append_str(buf, ":+");

 		if (ret < 0) {

-			_gnutls_buffer_clear(&buf;;

+			_gnutls_buffer_clear(buf);

 			return ret;

 		}

-		ret = _gnutls_buffer_append_str(&buf,

+		ret = _gnutls_buffer_append_str(buf,

 						gnutls_mac_get_name(system_wide_config.macs[i]));

 		if (ret < 0) {

-			_gnutls_buffer_clear(&buf;;

+			_gnutls_buffer_clear(buf);

 			return ret;

 		}

 	}

 	for (i = 0; system_wide_config.sigs[i] != 0; i++) {

-		ret = _gnutls_buffer_append_str(&buf, ":+SIGN-");

+		ret = _gnutls_buffer_append_str(buf, ":+SIGN-");

 		if (ret < 0) {

-			_gnutls_buffer_clear(&buf;;

+			_gnutls_buffer_clear(buf);

 			return ret;

 		}

-		ret = _gnutls_buffer_append_str(&buf,

+		ret = _gnutls_buffer_append_str(buf,

 						gnutls_sign_get_name(system_wide_config.sigs[i]));

 		if (ret < 0) {

-			_gnutls_buffer_clear(&buf;;

+			_gnutls_buffer_clear(buf);

 			return ret;

 		}

 	}

 	for (i = 0; system_wide_config.versions[i] != 0; i++) {

-		ret = _gnutls_buffer_append_str(&buf, ":+VERS-");

+		ret = _gnutls_buffer_append_str(buf, ":+VERS-");

 		if (ret < 0) {

-			_gnutls_buffer_clear(&buf;;

+			_gnutls_buffer_clear(buf);

 			return ret;

 		}

-		ret = _gnutls_buffer_append_str(&buf,

+		ret = _gnutls_buffer_append_str(buf,

 						gnutls_protocol_get_name(system_wide_config.versions[i]));

 		if (ret < 0) {

-			_gnutls_buffer_clear(&buf;;

+			_gnutls_buffer_clear(buf);

 			return ret;

 		}

 	}

+	return 0;

+}

+

+static int /* not locking system_wide_config */

+update_system_wide_priority_string(void)

+{

+	/* doesn't do locking, _gnutls_update_system_priorities does */

+	gnutls_buffer_st buf;

+	int ret;

+

+	ret = construct_system_wide_priority_string(&buf;;

+	if (ret < 0) {

+		_gnutls_debug_log("cfg: unable to construct "

+				  "system-wide priority string: %s",

+				  gnutls_strerror(ret));

+		_gnutls_buffer_clear(&buf;;

+		return ret;

+	}

 	gnutls_free(system_wide_config.priority_string);

 	system_wide_config.priority_string = gnutls_strdup((char *)buf.data);

-- 

2.34.1

From a74633975e97e491e1e1cdf12416ce160699b703 Mon Sep 17 00:00:00 2001

From: Alexander Sosedkin <asosedkin@redhat.com>

Date: Mon, 14 Feb 2022 13:48:37 +0100

Subject: [PATCH 2/8] lib/priority: defer setting system-wide priority string

Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>

---

 lib/global.c   |   2 +-

 lib/global.h   |   2 +-

 lib/priority.c | 112 ++++++++++++++++++++++++++++---------------------

 3 files changed, 66 insertions(+), 50 deletions(-)

diff --git a/lib/global.c b/lib/global.c

index 65c0b81709..faa7f0afb2 100644

--- a/lib/global.c

+++ b/lib/global.c

@@ -365,7 +365,7 @@ static int _gnutls_global_init(unsigned constructor)

 		_gnutls_fips_mode_reset_zombie();

 	}

 #endif

-	_gnutls_load_system_priorities();

+	_gnutls_prepare_to_load_system_priorities();

 	_gnutls_switch_lib_state(LIB_STATE_OPERATIONAL);

 	ret = 0;

diff --git a/lib/global.h b/lib/global.h

index e30187e7ad..16fde08b5c 100644

--- a/lib/global.h

+++ b/lib/global.h

@@ -46,7 +46,7 @@ extern void gnutls_crypto_deinit(void);

 extern void _gnutls_tpm_global_deinit(void);

 extern void _gnutls_nss_keylog_deinit(void);

-extern void _gnutls_load_system_priorities(void);

+extern void _gnutls_prepare_to_load_system_priorities(void);

 extern void _gnutls_unload_system_priorities(void);

 #endif /* GNUTLS_LIB_GLOBAL_H */

diff --git a/lib/priority.c b/lib/priority.c

index 755729da18..4faf96fabf 100644

--- a/lib/priority.c

+++ b/lib/priority.c

@@ -1864,11 +1864,12 @@ update_system_wide_priority_string(void)

 	return 0;

 }

-static int _gnutls_update_system_priorities(void)

+static int _gnutls_update_system_priorities(bool defer_system_wide)

 {

 	int ret, err = 0;

 	struct stat sb;

 	FILE *fp;

+	gnutls_buffer_st buf;

 	struct ini_ctx ctx;

 	ret = gnutls_rwlock_rdlock(&system_wide_config_rwlock);

@@ -1883,10 +1884,12 @@ static int _gnutls_update_system_priorities(void)

 	}

 	if (system_priority_file_loaded &&

-	    sb.st_mtime == system_priority_last_mod) {

+	    system_priority_last_mod == sb.st_mtime) {

 		_gnutls_debug_log("cfg: system priority %s has not changed\n",

 				  system_priority_file);

-		goto out;

+		if (system_wide_config.priority_string) {

+			goto out;  /* nothing to do */

+		}

 	}

 	(void)gnutls_rwlock_unlock(&system_wide_config_rwlock);

@@ -1896,54 +1899,71 @@ static int _gnutls_update_system_priorities(void)

 		return gnutls_assert_val(ret);

 	}

-	/* Another thread has successfully updated the system wide config (with

-	 * the same modification time as checked above), while upgrading to

-	 * write lock; no need to reload.

+	/* Another thread could have successfully re-read system-wide config,

+	 * skip re-reading if the mtime it has used is exactly the same.

 	 */

-	if (system_priority_file_loaded &&

-	    system_priority_last_mod == sb.st_mtime) {

-		goto out;

+	if (system_priority_file_loaded) {

+		system_priority_file_loaded =

+			(system_priority_last_mod == sb.st_mtime);

 	}

-	system_priority_file_loaded = 0;

-	_name_val_array_clear(&system_wide_config.priority_strings);

+	if (!system_priority_file_loaded) {

+		_name_val_array_clear(&system_wide_config.priority_strings);

-	gnutls_free(system_wide_config.priority_string);

-	system_wide_config.priority_string = NULL;

+		gnutls_free(system_wide_config.priority_string);

+		system_wide_config.priority_string = NULL;

-	fp = fopen(system_priority_file, "re");

-	if (fp == NULL) {

-		_gnutls_debug_log("cfg: unable to open: %s: %d\n",

-				  system_priority_file, errno);

-		goto out;

-	}

-	/* Parsing the configuration file needs to be done in 2 phases: first

-	 * parsing the [global] section and then the other sections, because the

-	 * [global] section modifies the parsing behavior.

-	 */

-	memset(&ctx, 0, sizeof(ctx));

-	err = ini_parse_file(fp, global_ini_handler, &ctx;;

-	if (!err) {

-		if (fseek(fp, 0L, SEEK_SET) < 0) {

-			_gnutls_debug_log("cfg: unable to rewind: %s\n",

-					  system_priority_file);

-			if (fail_on_invalid_config)

-				exit(1);

+		fp = fopen(system_priority_file, "re");

+		if (fp == NULL) {

+			_gnutls_debug_log("cfg: unable to open: %s: %d\n",

+					  system_priority_file, errno);

+			goto out;

 		}

-		err = ini_parse_file(fp, cfg_ini_handler, &ctx;;

-	}

-	fclose(fp);

-	if (err) {

+		/* Parsing the configuration file needs to be done in 2 phases:

+		 * first parsing the [global] section

+		 * and then the other sections,

+		 * because the [global] section modifies the parsing behavior.

+		 */

+		memset(&ctx, 0, sizeof(ctx));

+		err = ini_parse_file(fp, global_ini_handler, &ctx;;

+		if (!err) {

+			if (fseek(fp, 0L, SEEK_SET) < 0) {

+				_gnutls_debug_log("cfg: unable to rewind: %s\n",

+						  system_priority_file);

+				if (fail_on_invalid_config)

+					exit(1);

+			}

+			err = ini_parse_file(fp, cfg_ini_handler, &ctx;;

+		}

+		fclose(fp);

+		if (err) {

+			ini_ctx_deinit(&ctx;;

+			_gnutls_debug_log("cfg: unable to parse: %s: %d\n",

+					  system_priority_file, err);

+			goto out;

+		}

+		cfg_apply(&system_wide_config, &ctx;;

 		ini_ctx_deinit(&ctx;;

-		_gnutls_debug_log("cfg: unable to parse: %s: %d\n",

-				  system_priority_file, err);

-		goto out;

+		_gnutls_debug_log("cfg: loaded system config %s mtime %lld\n",

+				  system_priority_file,

+				  (unsigned long long)sb.st_mtime);

+

 	}

-	cfg_apply(&system_wide_config, &ctx;;

-	ini_ctx_deinit(&ctx;;

 	if (system_wide_config.allowlisting) {

-		ret = update_system_wide_priority_string();

+		if (defer_system_wide) {

+			/* try constructing a priority string,

+			 * but don't apply it yet, at this point

+			 * we're only interested in whether we can */

+			ret = construct_system_wide_priority_string(&buf;;

+			_gnutls_buffer_clear(&buf;;

+			_gnutls_debug_log("cfg: deferred setting "

+					  "system-wide priority string\n");

+		} else {

+			ret = update_system_wide_priority_string();

+			_gnutls_debug_log("cfg: finalized "

+					  "system-wide priority string\n");

+		}

 		if (ret < 0) {

 			_gnutls_debug_log("cfg: unable to build priority string: %s\n",

 					  gnutls_strerror(ret));

@@ -1953,10 +1973,6 @@ static int _gnutls_update_system_priorities(void)

 		}

 	}

-	_gnutls_debug_log("cfg: loaded system priority %s mtime %lld\n",

-			  system_priority_file,

-			  (unsigned long long)sb.st_mtime);

-

 	system_priority_file_loaded = 1;

 	system_priority_last_mod = sb.st_mtime;

@@ -1970,7 +1986,7 @@ static int _gnutls_update_system_priorities(void)

 	return ret;

 }

-void _gnutls_load_system_priorities(void)

+void _gnutls_prepare_to_load_system_priorities(void)

 {

 	const char *p;

 	int ret;

@@ -1983,7 +1999,7 @@ void _gnutls_load_system_priorities(void)

 	if (p != NULL && p[0] == '1' && p[1] == 0)

 		fail_on_invalid_config = 1;

-	ret = _gnutls_update_system_priorities();

+	ret = _gnutls_update_system_priorities(true /* defer_system_wide */);

 	if (ret < 0) {

 		_gnutls_debug_log("failed to update system priorities: %s\n",

 				  gnutls_strerror(ret));

@@ -2050,7 +2066,7 @@ char *_gnutls_resolve_priorities(const char* priorities)

 	/* Always try to refresh the cached data, to allow it to be

 	 * updated without restarting all applications.

 	 */

-	ret = _gnutls_update_system_priorities();

+	ret = _gnutls_update_system_priorities(false /* defer_system_wide */);

 	if (ret < 0) {

 		_gnutls_debug_log("failed to update system priorities: %s\n",

 				  gnutls_strerror(ret));

-- 

2.34.1

From 52d5c8627165ff9bc0e99564b772f178ad1f80dd Mon Sep 17 00:00:00 2001

From: Alexander Sosedkin <asosedkin@redhat.com>

Date: Mon, 21 Feb 2022 18:19:25 +0100

Subject: [PATCH 3/8] lib/algorithms: add UB warnings on late allowlisting API

 invocations

Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>

---

 lib/algorithms/ecc.c       | 3 +++

 lib/algorithms/mac.c       | 3 +++

 lib/algorithms/protocols.c | 3 +++

 lib/algorithms/sign.c      | 6 ++++++

 4 files changed, 15 insertions(+)

diff --git a/lib/algorithms/ecc.c b/lib/algorithms/ecc.c

index 736e5dd07f..52ae1db0e4 100644

--- a/lib/algorithms/ecc.c

+++ b/lib/algorithms/ecc.c

@@ -389,6 +389,9 @@ void _gnutls_ecc_curve_mark_disabled_all(void)

  * enabled through the allowlisting mode in the configuration file, or

  * when the setting is modified with a prior call to this function.

  *

+ * This function must be called prior to any session priority setting functions;

+ * otherwise the behavior is undefined.

+ *

  * Returns: 0 on success or negative error code otherwise.

  *

  * Since: 3.7.3

diff --git a/lib/algorithms/mac.c b/lib/algorithms/mac.c

index a2c66e76bb..166d51d552 100644

--- a/lib/algorithms/mac.c

+++ b/lib/algorithms/mac.c

@@ -332,6 +332,9 @@ void _gnutls_digest_mark_insecure_all(void)

  * through the allowlisting mode in the configuration file, or when

  * the setting is modified with a prior call to this function.

  *

+ * This function must be called prior to any session priority setting functions;

+ * otherwise the behavior is undefined.

+ *

  * Since: 3.7.3

  */

 int

diff --git a/lib/algorithms/protocols.c b/lib/algorithms/protocols.c

index b0f3e0bc30..64c86eba3c 100644

--- a/lib/algorithms/protocols.c

+++ b/lib/algorithms/protocols.c

@@ -237,6 +237,9 @@ void _gnutls_version_mark_revertible_all(void)

  * enabled through the allowlisting mode in the configuration file, or

  * when the setting is modified with a prior call to this function.

  *

+ * This function must be called prior to any session priority setting functions;

+ * otherwise the behavior is undefined.

+ *

  * Returns: 0 on success or negative error code otherwise.

  *

  * Since: 3.7.3

diff --git a/lib/algorithms/sign.c b/lib/algorithms/sign.c

index 543bd19bb5..06abdb4cf8 100644

--- a/lib/algorithms/sign.c

+++ b/lib/algorithms/sign.c

@@ -516,6 +516,9 @@ void _gnutls_sign_mark_insecure_all(hash_security_level_t level)

  * use in certificates.  Use gnutls_sign_set_secure_for_certs() to

  * mark it secure as well for certificates.

  *

+ * This function must be called prior to any session priority setting functions;

+ * otherwise the behavior is undefined.

+ *

  * Since: 3.7.3

  */

 int

@@ -560,6 +563,9 @@ gnutls_sign_set_secure(gnutls_sign_algorithm_t sign,

  * for the use in certificates.  Use gnutls_sign_set_secure() to mark

  * it insecure for any uses.

  *

+ * This function must be called prior to any session priority setting functions;

+ * otherwise the behavior is undefined.

+ *

  * Since: 3.7.3

  */

 int

-- 

2.34.1

From 52067e1e5b16c30b2f3ce6488a4f72d19d906721 Mon Sep 17 00:00:00 2001

From: Alexander Sosedkin <asosedkin@redhat.com>

Date: Mon, 14 Feb 2022 18:00:25 +0100

Subject: [PATCH 4/8] lib/priority: move sigalgs filtering to

 set_ciphersuite_list

Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>

---

 lib/priority.c | 25 +++++++------------------

 1 file changed, 7 insertions(+), 18 deletions(-)

diff --git a/lib/priority.c b/lib/priority.c

index 4faf96fabf..9775040410 100644

--- a/lib/priority.c

+++ b/lib/priority.c

@@ -1140,9 +1140,6 @@ cfg_apply(struct cfg *cfg, struct ini_ctx *ctx)

 	}

 	if (cfg->allowlisting) {

-		unsigned tls_sig_sem = 0;

-		size_t j;

-

 		_gnutls_digest_mark_insecure_all();

 		for (i = 0; i < ctx->hashes_size; i++) {

 			int ret = gnutls_digest_set_secure(ctx->hashes[i], 1);

@@ -1156,6 +1153,7 @@ cfg_apply(struct cfg *cfg, struct ini_ctx *ctx)

 			if (unlikely(ret < 0)) {

 				return ret;

 			}

+			cfg->sigs[i] = ctx->sigs[i];

 		}

 		for (i = 0; i < ctx->sigs_for_cert_size; i++) {

 			int ret = gnutls_sign_set_secure_for_certs(ctx->sigs_for_cert[i],

@@ -1165,13 +1163,13 @@ cfg_apply(struct cfg *cfg, struct ini_ctx *ctx)

 			}

 		}

 		_gnutls_version_mark_revertible_all();

-		for (i = 0, j = 0; i < ctx->versions_size; i++) {

-			const version_entry_st *vers;

-			vers = version_to_entry(ctx->versions[i]);

-			if (vers && vers->supported) {

-				tls_sig_sem |= vers->tls_sig_sem;

-				cfg->versions[j++] = vers->id;

+		for (i = 0; i < ctx->versions_size; i++) {

+			int ret;

+			ret = gnutls_protocol_set_enabled(ctx->versions[i], 1);

+			if (unlikely(ret < 0)) {

+				return gnutls_assert_val(ret);

 			}

+			cfg->versions[i] = ctx->versions[i];

 		}

 		_gnutls_ecc_curve_mark_disabled_all();

 		for (i = 0; i < ctx->curves_size; i++) {

@@ -1180,15 +1178,6 @@ cfg_apply(struct cfg *cfg, struct ini_ctx *ctx)

 				return ret;

 			}

 		}

-		for (i = 0, j = 0; i < ctx->sigs_size; i++) {

-			const gnutls_sign_entry_st *se;

-

-			se = _gnutls_sign_to_entry(ctx->sigs[i]);

-			if (se != NULL && se->aid.tls_sem & tls_sig_sem &&

-			    _gnutls_sign_is_secure2(se, 0)) {

-				cfg->sigs[j++] = se->id;

-			}

-		}

 	} else {

 		for (i = 0; i < ctx->hashes_size; i++) {

 			int ret = _gnutls_digest_mark_insecure(ctx->hashes[i]);

-- 

2.34.1

From fa056709aaa974360d5e5dd8ceb52089b4da7858 Mon Sep 17 00:00:00 2001

From: Alexander Sosedkin <asosedkin@redhat.com>

Date: Tue, 15 Feb 2022 14:41:53 +0100

Subject: [PATCH 5/8] lib/config_int.h: split struct cfg off lib/priority.c

Signed-off-by: Alexander Sosedkin <asosedkin@redhat.com>

---

 lib/Makefile.am  |  3 +-

 lib/config_int.h | 84 ++++++++++++++++++++++++++++++++++++++++++++++++

 lib/priority.c   | 48 +--------------------------

 3 files changed, 87 insertions(+), 48 deletions(-)

 create mode 100644 lib/config_int.h

diff --git a/lib/Makefile.am b/lib/Makefile.am

index 35df35ee8d..5b540db142 100644

--- a/lib/Makefile.am

+++ b/lib/Makefile.am

@@ -134,7 +134,8 @@ HFILES = abstract_int.h debug.h cipher.h	 \

 	srp.h auth/srp_kx.h auth/srp_passwd.h	\

 	file.h supplemental.h crypto.h random.h system.h\

 	locks.h mbuffers.h ecc.h pin.h fips.h \

-	priority_options.h secrets.h stek.h cert-cred.h

+	priority_options.h secrets.h stek.h cert-cred.h \

+	config_int.h

 if ENABLE_PKCS11

 HFILES += pkcs11_int.h pkcs11x.h

diff --git a/lib/config_int.h b/lib/config_int.h

new file mode 100644

index 0000000000..733536bb98

--- /dev/null

+++ b/lib/config_int.h

@@ -0,0 +1,84 @@

+/*

+ * Copyright (C) 2004-2015 Free Software Foundation, Inc.

+ * Copyright (C) 2015-2022 Red Hat, Inc.

+ *

+ * Author: Nikos Mavrogiannopoulos

+ *

+ * This file is part of GnuTLS.

+ *

+ * The GnuTLS is free software; you can redistribute it and/or

+ * modify it under the terms of the GNU Lesser General Public License

+ * as published by the Free Software Foundation; either version 2.1 of

+ * the License, or (at your option) any later version.

+ *

+ * This library is distributed in the hope that it will be useful, but

+ * WITHOUT ANY WARRANTY; without even the implied warranty of

+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU

+ * Lesser General Public License for more details.

+ *

+ * You should have received a copy of the GNU Lesser General Public License

+ * along with this program.  If not, see <https://www.gnu.org/licenses/>

+ *

+ */

+

+/* Code split off from priority.c, `struct cfg` and some operations on it */

+

+#ifndef GNUTLS_LIB_CONFIG_INT_H

+#define GNUTLS_LIB_CONFIG_INT_H

+

+/*

+ * struct cfg

+ */

+

+struct cfg {

+	bool allowlisting;

+

+	name_val_array_t priority_strings;

+	char *priority_string;

+	char *default_priority_string;

+	gnutls_certificate_verification_profiles_t verification_profile;

+

+	gnutls_cipher_algorithm_t ciphers[MAX_ALGOS+1];

+	gnutls_mac_algorithm_t macs[MAX_ALGOS+1];

+	gnutls_group_t groups[MAX_ALGOS+1];

+	gnutls_kx_algorithm_t kxs[MAX_ALGOS+1];

+	gnutls_sign_algorithm_t sigs[MAX_ALGOS+1];

+	gnutls_protocol_t versions[MAX_ALGOS+1];

+};

+

+/*

+ * deinit / partial duplication. no initialization, must be zero-initialized

+ */

+

+static inline void

+cfg_deinit(struct cfg *cfg)

+{

+	if (cfg->priority_strings) {

+		_name_val_array_clear(&cfg->priority_strings);

+	}

+	gnutls_free(cfg->priority_string);

+	gnutls_free(cfg->default_priority_string);

+}

+

+static inline void

+cfg_steal(struct cfg *dst, struct cfg *src)

+{

+	dst->verification_profile = src->verification_profile;

+

+	dst->priority_strings = src->priority_strings;

+	src->priority_strings = NULL;

+

+	dst->priority_string = src->priority_string;

+	src->priority_string = NULL;

+

+	dst->default_priority_string = src->default_priority_string;

+	src->default_priority_string = NULL;

+

+	dst->allowlisting = src->allowlisting;

+	memcpy(dst->ciphers, src->ciphers, sizeof(src->ciphers));

+	memcpy(dst->macs, src->macs, sizeof(src->macs));

+	memcpy(dst->groups, src->groups, sizeof(src->groups));

+	memcpy(dst->kxs, src->kxs, sizeof(src->kxs));

+}

+

+#endif /* GNUTLS_LIB_CONFIG_INT_H */

diff --git a/lib/priority.c b/lib/priority.c

index 9775040410..80b737b938 100644

--- a/lib/priority.c

+++ b/lib/priority.c

@@ -42,6 +42,7 @@

 #include "locks.h"

 #include "profiles.h"

 #include "name_val_array.h"

+#include "config_int.h"

 #define MAX_ELEMENTS GNUTLS_MAX_ALGORITHM_NUM

@@ -1008,32 +1009,6 @@ static void dummy_func(gnutls_priority_t c)

 #include <priority_options.h>

-struct cfg {

-	bool allowlisting;

-

-	name_val_array_t priority_strings;

-	char *priority_string;

-	char *default_priority_string;

-	gnutls_certificate_verification_profiles_t verification_profile;

-

-	gnutls_cipher_algorithm_t ciphers[MAX_ALGOS+1];

-	gnutls_mac_algorithm_t macs[MAX_ALGOS+1];

-	gnutls_group_t groups[MAX_ALGOS+1];

-	gnutls_kx_algorithm_t kxs[MAX_ALGOS+1];

-	gnutls_sign_algorithm_t sigs[MAX_ALGOS+1];

-	gnutls_protocol_t versions[MAX_ALGOS+1];

-};

-

-static inline void

-cfg_deinit(struct cfg *cfg)

-{

-	if (cfg->priority_strings) {

-		_name_val_array_clear(&cfg->priority_strings);

-	}

-	gnutls_free(cfg->priority_string);

-	gnutls_free(cfg->default_priority_string);

-}

-

 /* Lock for reading and writing system_wide_config */

 GNUTLS_RWLOCK(system_wide_config_rwlock);