/src/openssl31/crypto/provider_core.c
Line | Count | Source (jump to first uncovered line) |
1 | | /* |
2 | | * Copyright 2019-2024 The OpenSSL Project Authors. All Rights Reserved. |
3 | | * |
4 | | * Licensed under the Apache License 2.0 (the "License"). You may not use |
5 | | * this file except in compliance with the License. You can obtain a copy |
6 | | * in the file LICENSE in the source distribution or at |
7 | | * https://www.openssl.org/source/license.html |
8 | | */ |
9 | | |
10 | | #include <assert.h> |
11 | | #include <openssl/core.h> |
12 | | #include <openssl/core_dispatch.h> |
13 | | #include <openssl/core_names.h> |
14 | | #include <openssl/provider.h> |
15 | | #include <openssl/params.h> |
16 | | #include <openssl/opensslv.h> |
17 | | #include "crypto/cryptlib.h" |
18 | | #ifndef FIPS_MODULE |
19 | | #include "crypto/decoder.h" /* ossl_decoder_store_cache_flush */ |
20 | | #include "crypto/encoder.h" /* ossl_encoder_store_cache_flush */ |
21 | | #include "crypto/store.h" /* ossl_store_loader_store_cache_flush */ |
22 | | #endif |
23 | | #include "crypto/evp.h" /* evp_method_store_cache_flush */ |
24 | | #include "crypto/rand.h" |
25 | | #include "internal/nelem.h" |
26 | | #include "internal/thread_once.h" |
27 | | #include "internal/provider.h" |
28 | | #include "internal/refcount.h" |
29 | | #include "internal/bio.h" |
30 | | #include "internal/core.h" |
31 | | #include "provider_local.h" |
32 | | #include "crypto/context.h" |
33 | | #ifndef FIPS_MODULE |
34 | | # include <openssl/self_test.h> |
35 | | #endif |
36 | | |
37 | | /* |
38 | | * This file defines and uses a number of different structures: |
39 | | * |
40 | | * OSSL_PROVIDER (provider_st): Used to represent all information related to a |
41 | | * single instance of a provider. |
42 | | * |
43 | | * provider_store_st: Holds information about the collection of providers that |
44 | | * are available within the current library context (OSSL_LIB_CTX). It also |
45 | | * holds configuration information about providers that could be loaded at some |
46 | | * future point. |
47 | | * |
48 | | * OSSL_PROVIDER_CHILD_CB: An instance of this structure holds the callbacks |
49 | | * that have been registered for a child library context and the associated |
50 | | * provider that registered those callbacks. |
51 | | * |
52 | | * Where a child library context exists then it has its own instance of the |
53 | | * provider store. Each provider that exists in the parent provider store, has |
54 | | * an associated child provider in the child library context's provider store. |
55 | | * As providers get activated or deactivated this needs to be mirrored in the |
56 | | * associated child providers. |
57 | | * |
58 | | * LOCKING |
59 | | * ======= |
60 | | * |
61 | | * There are a number of different locks used in this file and it is important |
62 | | * to understand how they should be used in order to avoid deadlocks. |
63 | | * |
64 | | * Fields within a structure can often be "write once" on creation, and then |
65 | | * "read many". Creation of a structure is done by a single thread, and |
66 | | * therefore no lock is required for the "write once/read many" fields. It is |
67 | | * safe for multiple threads to read these fields without a lock, because they |
68 | | * will never be changed. |
69 | | * |
70 | | * However some fields may be changed after a structure has been created and |
71 | | * shared between multiple threads. Where this is the case a lock is required. |
72 | | * |
73 | | * The locks available are: |
74 | | * |
75 | | * The provider flag_lock: Used to control updates to the various provider |
76 | | * "flags" (flag_initialized and flag_activated) and associated |
77 | | * "counts" (activatecnt). |
78 | | * |
79 | | * The provider refcnt_lock: Only ever used to control updates to the provider |
80 | | * refcnt value. |
81 | | * |
82 | | * The provider optbits_lock: Used to control access to the provider's |
83 | | * operation_bits and operation_bits_sz fields. |
84 | | * |
85 | | * The store default_path_lock: Used to control access to the provider store's |
86 | | * default search path value (default_path) |
87 | | * |
88 | | * The store lock: Used to control the stack of provider's held within the |
89 | | * provider store, as well as the stack of registered child provider callbacks. |
90 | | * |
91 | | * As a general rule-of-thumb it is best to: |
92 | | * - keep the scope of the code that is protected by a lock to the absolute |
93 | | * minimum possible; |
94 | | * - try to keep the scope of the lock to within a single function (i.e. avoid |
95 | | * making calls to other functions while holding a lock); |
96 | | * - try to only ever hold one lock at a time. |
97 | | * |
98 | | * Unfortunately, it is not always possible to stick to the above guidelines. |
99 | | * Where they are not adhered to there is always a danger of inadvertently |
100 | | * introducing the possibility of deadlock. The following rules MUST be adhered |
101 | | * to in order to avoid that: |
102 | | * - Holding multiple locks at the same time is only allowed for the |
103 | | * provider store lock, the provider flag_lock and the provider refcnt_lock. |
104 | | * - When holding multiple locks they must be acquired in the following order of |
105 | | * precedence: |
106 | | * 1) provider store lock |
107 | | * 2) provider flag_lock |
108 | | * 3) provider refcnt_lock |
109 | | * - When releasing locks they must be released in the reverse order to which |
110 | | * they were acquired |
111 | | * - No locks may be held when making an upcall. NOTE: Some common functions |
112 | | * can make upcalls as part of their normal operation. If you need to call |
113 | | * some other function while holding a lock make sure you know whether it |
114 | | * will make any upcalls or not. For example ossl_provider_up_ref() can call |
115 | | * ossl_provider_up_ref_parent() which can call the c_prov_up_ref() upcall. |
116 | | * - It is permissible to hold the store and flag locks when calling child |
117 | | * provider callbacks. No other locks may be held during such callbacks. |
118 | | */ |
119 | | |
120 | | static OSSL_PROVIDER *provider_new(const char *name, |
121 | | OSSL_provider_init_fn *init_function, |
122 | | STACK_OF(INFOPAIR) *parameters); |
123 | | |
124 | | /*- |
125 | | * Provider Object structure |
126 | | * ========================= |
127 | | */ |
128 | | |
129 | | #ifndef FIPS_MODULE |
130 | | typedef struct { |
131 | | OSSL_PROVIDER *prov; |
132 | | int (*create_cb)(const OSSL_CORE_HANDLE *provider, void *cbdata); |
133 | | int (*remove_cb)(const OSSL_CORE_HANDLE *provider, void *cbdata); |
134 | | int (*global_props_cb)(const char *props, void *cbdata); |
135 | | void *cbdata; |
136 | | } OSSL_PROVIDER_CHILD_CB; |
137 | | DEFINE_STACK_OF(OSSL_PROVIDER_CHILD_CB) |
138 | | #endif |
139 | | |
140 | | struct provider_store_st; /* Forward declaration */ |
141 | | |
142 | | struct ossl_provider_st { |
143 | | /* Flag bits */ |
144 | | unsigned int flag_initialized:1; |
145 | | unsigned int flag_activated:1; |
146 | | |
147 | | /* Getting and setting the flags require synchronization */ |
148 | | CRYPTO_RWLOCK *flag_lock; |
149 | | |
150 | | /* OpenSSL library side data */ |
151 | | CRYPTO_REF_COUNT refcnt; |
152 | | CRYPTO_RWLOCK *refcnt_lock; /* For the ref counter */ |
153 | | int activatecnt; |
154 | | char *name; |
155 | | char *path; |
156 | | DSO *module; |
157 | | OSSL_provider_init_fn *init_function; |
158 | | STACK_OF(INFOPAIR) *parameters; |
159 | | OSSL_LIB_CTX *libctx; /* The library context this instance is in */ |
160 | | struct provider_store_st *store; /* The store this instance belongs to */ |
161 | | #ifndef FIPS_MODULE |
162 | | /* |
163 | | * In the FIPS module inner provider, this isn't needed, since the |
164 | | * error upcalls are always direct calls to the outer provider. |
165 | | */ |
166 | | int error_lib; /* ERR library number, one for each provider */ |
167 | | # ifndef OPENSSL_NO_ERR |
168 | | ERR_STRING_DATA *error_strings; /* Copy of what the provider gives us */ |
169 | | # endif |
170 | | #endif |
171 | | |
172 | | /* Provider side functions */ |
173 | | OSSL_FUNC_provider_teardown_fn *teardown; |
174 | | OSSL_FUNC_provider_gettable_params_fn *gettable_params; |
175 | | OSSL_FUNC_provider_get_params_fn *get_params; |
176 | | OSSL_FUNC_provider_get_capabilities_fn *get_capabilities; |
177 | | OSSL_FUNC_provider_self_test_fn *self_test; |
178 | | OSSL_FUNC_provider_query_operation_fn *query_operation; |
179 | | OSSL_FUNC_provider_unquery_operation_fn *unquery_operation; |
180 | | |
181 | | /* |
182 | | * Cache of bit to indicate of query_operation() has been called on |
183 | | * a specific operation or not. |
184 | | */ |
185 | | unsigned char *operation_bits; |
186 | | size_t operation_bits_sz; |
187 | | CRYPTO_RWLOCK *opbits_lock; |
188 | | |
189 | | #ifndef FIPS_MODULE |
190 | | /* Whether this provider is the child of some other provider */ |
191 | | const OSSL_CORE_HANDLE *handle; |
192 | | unsigned int ischild:1; |
193 | | #endif |
194 | | |
195 | | /* Provider side data */ |
196 | | void *provctx; |
197 | | const OSSL_DISPATCH *dispatch; |
198 | | }; |
199 | | DEFINE_STACK_OF(OSSL_PROVIDER) |
200 | | |
201 | | static int ossl_provider_cmp(const OSSL_PROVIDER * const *a, |
202 | | const OSSL_PROVIDER * const *b) |
203 | 11 | { |
204 | 11 | return strcmp((*a)->name, (*b)->name); |
205 | 11 | } |
206 | | |
207 | | /*- |
208 | | * Provider Object store |
209 | | * ===================== |
210 | | * |
211 | | * The Provider Object store is a library context object, and therefore needs |
212 | | * an index. |
213 | | */ |
214 | | |
215 | | struct provider_store_st { |
216 | | OSSL_LIB_CTX *libctx; |
217 | | STACK_OF(OSSL_PROVIDER) *providers; |
218 | | STACK_OF(OSSL_PROVIDER_CHILD_CB) *child_cbs; |
219 | | CRYPTO_RWLOCK *default_path_lock; |
220 | | CRYPTO_RWLOCK *lock; |
221 | | char *default_path; |
222 | | OSSL_PROVIDER_INFO *provinfo; |
223 | | size_t numprovinfo; |
224 | | size_t provinfosz; |
225 | | unsigned int use_fallbacks:1; |
226 | | unsigned int freeing:1; |
227 | | }; |
228 | | |
229 | | /* |
230 | | * provider_deactivate_free() is a wrapper around ossl_provider_deactivate() |
231 | | * and ossl_provider_free(), called as needed. |
232 | | * Since this is only called when the provider store is being emptied, we |
233 | | * don't need to care about any lock. |
234 | | */ |
235 | | static void provider_deactivate_free(OSSL_PROVIDER *prov) |
236 | 103 | { |
237 | 103 | if (prov->flag_activated) |
238 | 103 | ossl_provider_deactivate(prov, 1); |
239 | 103 | ossl_provider_free(prov); |
240 | 103 | } |
241 | | |
242 | | #ifndef FIPS_MODULE |
243 | | static void ossl_provider_child_cb_free(OSSL_PROVIDER_CHILD_CB *cb) |
244 | 0 | { |
245 | 0 | OPENSSL_free(cb); |
246 | 0 | } |
247 | | #endif |
248 | | |
249 | | static void infopair_free(INFOPAIR *pair) |
250 | 0 | { |
251 | 0 | OPENSSL_free(pair->name); |
252 | 0 | OPENSSL_free(pair->value); |
253 | 0 | OPENSSL_free(pair); |
254 | 0 | } |
255 | | |
256 | | static INFOPAIR *infopair_copy(const INFOPAIR *src) |
257 | 0 | { |
258 | 0 | INFOPAIR *dest = OPENSSL_zalloc(sizeof(*dest)); |
259 | |
|
260 | 0 | if (dest == NULL) |
261 | 0 | return NULL; |
262 | 0 | if (src->name != NULL) { |
263 | 0 | dest->name = OPENSSL_strdup(src->name); |
264 | 0 | if (dest->name == NULL) |
265 | 0 | goto err; |
266 | 0 | } |
267 | 0 | if (src->value != NULL) { |
268 | 0 | dest->value = OPENSSL_strdup(src->value); |
269 | 0 | if (dest->value == NULL) |
270 | 0 | goto err; |
271 | 0 | } |
272 | 0 | return dest; |
273 | 0 | err: |
274 | 0 | OPENSSL_free(dest->name); |
275 | 0 | OPENSSL_free(dest); |
276 | 0 | return NULL; |
277 | 0 | } |
278 | | |
279 | | void ossl_provider_info_clear(OSSL_PROVIDER_INFO *info) |
280 | 60 | { |
281 | 60 | OPENSSL_free(info->name); |
282 | 60 | OPENSSL_free(info->path); |
283 | 60 | sk_INFOPAIR_pop_free(info->parameters, infopair_free); |
284 | 60 | } |
285 | | |
286 | | void ossl_provider_store_free(void *vstore) |
287 | 99 | { |
288 | 99 | struct provider_store_st *store = vstore; |
289 | 99 | size_t i; |
290 | | |
291 | 99 | if (store == NULL) |
292 | 0 | return; |
293 | 99 | store->freeing = 1; |
294 | 99 | OPENSSL_free(store->default_path); |
295 | 99 | sk_OSSL_PROVIDER_pop_free(store->providers, provider_deactivate_free); |
296 | 99 | #ifndef FIPS_MODULE |
297 | 99 | sk_OSSL_PROVIDER_CHILD_CB_pop_free(store->child_cbs, |
298 | 99 | ossl_provider_child_cb_free); |
299 | 99 | #endif |
300 | 99 | CRYPTO_THREAD_lock_free(store->default_path_lock); |
301 | 99 | CRYPTO_THREAD_lock_free(store->lock); |
302 | 149 | for (i = 0; i < store->numprovinfo; i++) |
303 | 50 | ossl_provider_info_clear(&store->provinfo[i]); |
304 | 99 | OPENSSL_free(store->provinfo); |
305 | 99 | OPENSSL_free(store); |
306 | 99 | } |
307 | | |
308 | | void *ossl_provider_store_new(OSSL_LIB_CTX *ctx) |
309 | 151 | { |
310 | 151 | struct provider_store_st *store = OPENSSL_zalloc(sizeof(*store)); |
311 | | |
312 | 151 | if (store == NULL |
313 | 151 | || (store->providers = sk_OSSL_PROVIDER_new(ossl_provider_cmp)) == NULL |
314 | 151 | || (store->default_path_lock = CRYPTO_THREAD_lock_new()) == NULL |
315 | 151 | #ifndef FIPS_MODULE |
316 | 151 | || (store->child_cbs = sk_OSSL_PROVIDER_CHILD_CB_new_null()) == NULL |
317 | 151 | #endif |
318 | 151 | || (store->lock = CRYPTO_THREAD_lock_new()) == NULL) { |
319 | 0 | ossl_provider_store_free(store); |
320 | 0 | return NULL; |
321 | 0 | } |
322 | 151 | store->libctx = ctx; |
323 | 151 | store->use_fallbacks = 1; |
324 | | |
325 | 151 | return store; |
326 | 151 | } |
327 | | |
328 | | static struct provider_store_st *get_provider_store(OSSL_LIB_CTX *libctx) |
329 | 6.37M | { |
330 | 6.37M | struct provider_store_st *store = NULL; |
331 | | |
332 | 6.37M | store = ossl_lib_ctx_get_data(libctx, OSSL_LIB_CTX_PROVIDER_STORE_INDEX); |
333 | 6.37M | if (store == NULL) |
334 | 6.37M | ERR_raise(ERR_LIB_CRYPTO, ERR_R_INTERNAL_ERROR); |
335 | 6.37M | return store; |
336 | 6.37M | } |
337 | | |
338 | | int ossl_provider_disable_fallback_loading(OSSL_LIB_CTX *libctx) |
339 | 0 | { |
340 | 0 | struct provider_store_st *store; |
341 | |
|
342 | 0 | if ((store = get_provider_store(libctx)) != NULL) { |
343 | 0 | if (!CRYPTO_THREAD_write_lock(store->lock)) |
344 | 0 | return 0; |
345 | 0 | store->use_fallbacks = 0; |
346 | 0 | CRYPTO_THREAD_unlock(store->lock); |
347 | 0 | return 1; |
348 | 0 | } |
349 | 0 | return 0; |
350 | 0 | } |
351 | | |
352 | 60 | #define BUILTINS_BLOCK_SIZE 10 |
353 | | |
354 | | int ossl_provider_info_add_to_store(OSSL_LIB_CTX *libctx, |
355 | | OSSL_PROVIDER_INFO *entry) |
356 | 60 | { |
357 | 60 | struct provider_store_st *store = get_provider_store(libctx); |
358 | 60 | int ret = 0; |
359 | | |
360 | 60 | if (entry->name == NULL) { |
361 | 0 | ERR_raise(ERR_LIB_CRYPTO, ERR_R_PASSED_NULL_PARAMETER); |
362 | 0 | return 0; |
363 | 0 | } |
364 | | |
365 | 60 | if (store == NULL) { |
366 | 0 | ERR_raise(ERR_LIB_CRYPTO, ERR_R_INTERNAL_ERROR); |
367 | 0 | return 0; |
368 | 0 | } |
369 | | |
370 | 60 | if (!CRYPTO_THREAD_write_lock(store->lock)) |
371 | 0 | return 0; |
372 | 60 | if (store->provinfosz == 0) { |
373 | 60 | store->provinfo = OPENSSL_zalloc(sizeof(*store->provinfo) |
374 | 60 | * BUILTINS_BLOCK_SIZE); |
375 | 60 | if (store->provinfo == NULL) { |
376 | 0 | ERR_raise(ERR_LIB_CRYPTO, ERR_R_MALLOC_FAILURE); |
377 | 0 | goto err; |
378 | 0 | } |
379 | 60 | store->provinfosz = BUILTINS_BLOCK_SIZE; |
380 | 60 | } else if (store->numprovinfo == store->provinfosz) { |
381 | 0 | OSSL_PROVIDER_INFO *tmpbuiltins; |
382 | 0 | size_t newsz = store->provinfosz + BUILTINS_BLOCK_SIZE; |
383 | |
|
384 | 0 | tmpbuiltins = OPENSSL_realloc(store->provinfo, |
385 | 0 | sizeof(*store->provinfo) * newsz); |
386 | 0 | if (tmpbuiltins == NULL) { |
387 | 0 | ERR_raise(ERR_LIB_CRYPTO, ERR_R_MALLOC_FAILURE); |
388 | 0 | goto err; |
389 | 0 | } |
390 | 0 | store->provinfo = tmpbuiltins; |
391 | 0 | store->provinfosz = newsz; |
392 | 0 | } |
393 | 60 | store->provinfo[store->numprovinfo] = *entry; |
394 | 60 | store->numprovinfo++; |
395 | | |
396 | 60 | ret = 1; |
397 | 60 | err: |
398 | 60 | CRYPTO_THREAD_unlock(store->lock); |
399 | 60 | return ret; |
400 | 60 | } |
401 | | |
402 | | OSSL_PROVIDER *ossl_provider_find(OSSL_LIB_CTX *libctx, const char *name, |
403 | | ossl_unused int noconfig) |
404 | 71 | { |
405 | 71 | struct provider_store_st *store = NULL; |
406 | 71 | OSSL_PROVIDER *prov = NULL; |
407 | | |
408 | 71 | if ((store = get_provider_store(libctx)) != NULL) { |
409 | 71 | OSSL_PROVIDER tmpl = { 0, }; |
410 | 71 | int i; |
411 | | |
412 | 71 | #if !defined(FIPS_MODULE) && !defined(OPENSSL_NO_AUTOLOAD_CONFIG) |
413 | | /* |
414 | | * Make sure any providers are loaded from config before we try to find |
415 | | * them. |
416 | | */ |
417 | 71 | if (!noconfig) { |
418 | 60 | if (ossl_lib_ctx_is_default(libctx)) |
419 | 60 | OPENSSL_init_crypto(OPENSSL_INIT_LOAD_CONFIG, NULL); |
420 | 60 | } |
421 | 71 | #endif |
422 | | |
423 | 71 | tmpl.name = (char *)name; |
424 | | /* |
425 | | * A "find" operation can sort the stack, and therefore a write lock is |
426 | | * required. |
427 | | */ |
428 | 71 | if (!CRYPTO_THREAD_write_lock(store->lock)) |
429 | 0 | return NULL; |
430 | 71 | if ((i = sk_OSSL_PROVIDER_find(store->providers, &tmpl)) != -1) |
431 | 11 | prov = sk_OSSL_PROVIDER_value(store->providers, i); |
432 | 71 | CRYPTO_THREAD_unlock(store->lock); |
433 | 71 | if (prov != NULL && !ossl_provider_up_ref(prov)) |
434 | 0 | prov = NULL; |
435 | 71 | } |
436 | | |
437 | 71 | return prov; |
438 | 71 | } |
439 | | |
440 | | /*- |
441 | | * Provider Object methods |
442 | | * ======================= |
443 | | */ |
444 | | |
445 | | static OSSL_PROVIDER *provider_new(const char *name, |
446 | | OSSL_provider_init_fn *init_function, |
447 | | STACK_OF(INFOPAIR) *parameters) |
448 | 34 | { |
449 | 34 | OSSL_PROVIDER *prov = NULL; |
450 | | |
451 | 34 | if ((prov = OPENSSL_zalloc(sizeof(*prov))) == NULL |
452 | | #ifndef HAVE_ATOMICS |
453 | | || (prov->refcnt_lock = CRYPTO_THREAD_lock_new()) == NULL |
454 | | #endif |
455 | 34 | ) { |
456 | 0 | OPENSSL_free(prov); |
457 | 0 | ERR_raise(ERR_LIB_CRYPTO, ERR_R_MALLOC_FAILURE); |
458 | 0 | return NULL; |
459 | 0 | } |
460 | | |
461 | 34 | prov->refcnt = 1; /* 1 One reference to be returned */ |
462 | | |
463 | 34 | if ((prov->opbits_lock = CRYPTO_THREAD_lock_new()) == NULL |
464 | 34 | || (prov->flag_lock = CRYPTO_THREAD_lock_new()) == NULL |
465 | 34 | || (prov->name = OPENSSL_strdup(name)) == NULL |
466 | 34 | || (prov->parameters = sk_INFOPAIR_deep_copy(parameters, |
467 | 34 | infopair_copy, |
468 | 34 | infopair_free)) == NULL) { |
469 | 0 | ossl_provider_free(prov); |
470 | 0 | ERR_raise(ERR_LIB_CRYPTO, ERR_R_MALLOC_FAILURE); |
471 | 0 | return NULL; |
472 | 0 | } |
473 | | |
474 | 34 | prov->init_function = init_function; |
475 | | |
476 | 34 | return prov; |
477 | 34 | } |
478 | | |
479 | | int ossl_provider_up_ref(OSSL_PROVIDER *prov) |
480 | 10.1k | { |
481 | 10.1k | int ref = 0; |
482 | | |
483 | 10.1k | if (CRYPTO_UP_REF(&prov->refcnt, &ref, prov->refcnt_lock) <= 0) |
484 | 0 | return 0; |
485 | | |
486 | 10.1k | #ifndef FIPS_MODULE |
487 | 10.1k | if (prov->ischild) { |
488 | 0 | if (!ossl_provider_up_ref_parent(prov, 0)) { |
489 | 0 | ossl_provider_free(prov); |
490 | 0 | return 0; |
491 | 0 | } |
492 | 0 | } |
493 | 10.1k | #endif |
494 | | |
495 | 10.1k | return ref; |
496 | 10.1k | } |
497 | | |
498 | | #ifndef FIPS_MODULE |
499 | | static int provider_up_ref_intern(OSSL_PROVIDER *prov, int activate) |
500 | 0 | { |
501 | 0 | if (activate) |
502 | 0 | return ossl_provider_activate(prov, 1, 0); |
503 | | |
504 | 0 | return ossl_provider_up_ref(prov); |
505 | 0 | } |
506 | | |
507 | | static int provider_free_intern(OSSL_PROVIDER *prov, int deactivate) |
508 | 0 | { |
509 | 0 | if (deactivate) |
510 | 0 | return ossl_provider_deactivate(prov, 1); |
511 | | |
512 | 0 | ossl_provider_free(prov); |
513 | 0 | return 1; |
514 | 0 | } |
515 | | #endif |
516 | | |
517 | | /* |
518 | | * We assume that the requested provider does not already exist in the store. |
519 | | * The caller should check. If it does exist then adding it to the store later |
520 | | * will fail. |
521 | | */ |
522 | | OSSL_PROVIDER *ossl_provider_new(OSSL_LIB_CTX *libctx, const char *name, |
523 | | OSSL_provider_init_fn *init_function, |
524 | | int noconfig) |
525 | 20 | { |
526 | 20 | struct provider_store_st *store = NULL; |
527 | 20 | OSSL_PROVIDER_INFO template; |
528 | 20 | OSSL_PROVIDER *prov = NULL; |
529 | | |
530 | 20 | if ((store = get_provider_store(libctx)) == NULL) |
531 | 0 | return NULL; |
532 | | |
533 | 20 | memset(&template, 0, sizeof(template)); |
534 | 20 | if (init_function == NULL) { |
535 | 20 | const OSSL_PROVIDER_INFO *p; |
536 | 20 | size_t i; |
537 | | |
538 | | /* Check if this is a predefined builtin provider */ |
539 | 80 | for (p = ossl_predefined_providers; p->name != NULL; p++) { |
540 | 60 | if (strcmp(p->name, name) == 0) { |
541 | 0 | template = *p; |
542 | 0 | break; |
543 | 0 | } |
544 | 60 | } |
545 | 20 | if (p->name == NULL) { |
546 | | /* Check if this is a user added builtin provider */ |
547 | 20 | if (!CRYPTO_THREAD_read_lock(store->lock)) |
548 | 0 | return NULL; |
549 | 20 | for (i = 0, p = store->provinfo; i < store->numprovinfo; p++, i++) { |
550 | 20 | if (strcmp(p->name, name) == 0) { |
551 | 20 | template = *p; |
552 | 20 | break; |
553 | 20 | } |
554 | 20 | } |
555 | 20 | CRYPTO_THREAD_unlock(store->lock); |
556 | 20 | } |
557 | 20 | } else { |
558 | 0 | template.init = init_function; |
559 | 0 | } |
560 | | |
561 | | /* provider_new() generates an error, so no need here */ |
562 | 20 | prov = provider_new(name, template.init, template.parameters); |
563 | | |
564 | 20 | if (prov == NULL) |
565 | 0 | return NULL; |
566 | | |
567 | 20 | if (!ossl_provider_set_module_path(prov, template.path)) { |
568 | 0 | ossl_provider_free(prov); |
569 | 0 | return NULL; |
570 | 0 | } |
571 | | |
572 | 20 | prov->libctx = libctx; |
573 | 20 | #ifndef FIPS_MODULE |
574 | 20 | prov->error_lib = ERR_get_next_error_library(); |
575 | 20 | #endif |
576 | | |
577 | | /* |
578 | | * At this point, the provider is only partially "loaded". To be |
579 | | * fully "loaded", ossl_provider_activate() must also be called and it must |
580 | | * then be added to the provider store. |
581 | | */ |
582 | | |
583 | 20 | return prov; |
584 | 20 | } |
585 | | |
586 | | /* Assumes that the store lock is held */ |
587 | | static int create_provider_children(OSSL_PROVIDER *prov) |
588 | 60 | { |
589 | 60 | int ret = 1; |
590 | 60 | #ifndef FIPS_MODULE |
591 | 60 | struct provider_store_st *store = prov->store; |
592 | 60 | OSSL_PROVIDER_CHILD_CB *child_cb; |
593 | 60 | int i, max; |
594 | | |
595 | 60 | max = sk_OSSL_PROVIDER_CHILD_CB_num(store->child_cbs); |
596 | 60 | for (i = 0; i < max; i++) { |
597 | | /* |
598 | | * This is newly activated (activatecnt == 1), so we need to |
599 | | * create child providers as necessary. |
600 | | */ |
601 | 0 | child_cb = sk_OSSL_PROVIDER_CHILD_CB_value(store->child_cbs, i); |
602 | 0 | ret &= child_cb->create_cb((OSSL_CORE_HANDLE *)prov, child_cb->cbdata); |
603 | 0 | } |
604 | 60 | #endif |
605 | | |
606 | 60 | return ret; |
607 | 60 | } |
608 | | |
609 | | int ossl_provider_add_to_store(OSSL_PROVIDER *prov, OSSL_PROVIDER **actualprov, |
610 | | int retain_fallbacks) |
611 | 20 | { |
612 | 20 | struct provider_store_st *store; |
613 | 20 | int idx; |
614 | 20 | OSSL_PROVIDER tmpl = { 0, }; |
615 | 20 | OSSL_PROVIDER *actualtmp = NULL; |
616 | | |
617 | 20 | if (actualprov != NULL) |
618 | 20 | *actualprov = NULL; |
619 | | |
620 | 20 | if ((store = get_provider_store(prov->libctx)) == NULL) |
621 | 0 | return 0; |
622 | | |
623 | 20 | if (!CRYPTO_THREAD_write_lock(store->lock)) |
624 | 0 | return 0; |
625 | | |
626 | 20 | tmpl.name = (char *)prov->name; |
627 | 20 | idx = sk_OSSL_PROVIDER_find(store->providers, &tmpl); |
628 | 20 | if (idx == -1) |
629 | 20 | actualtmp = prov; |
630 | 0 | else |
631 | 0 | actualtmp = sk_OSSL_PROVIDER_value(store->providers, idx); |
632 | | |
633 | 20 | if (idx == -1) { |
634 | 20 | if (sk_OSSL_PROVIDER_push(store->providers, prov) == 0) |
635 | 0 | goto err; |
636 | 20 | prov->store = store; |
637 | 20 | if (!create_provider_children(prov)) { |
638 | 0 | sk_OSSL_PROVIDER_delete_ptr(store->providers, prov); |
639 | 0 | goto err; |
640 | 0 | } |
641 | 20 | if (!retain_fallbacks) |
642 | 0 | store->use_fallbacks = 0; |
643 | 20 | } |
644 | | |
645 | 20 | CRYPTO_THREAD_unlock(store->lock); |
646 | | |
647 | 20 | if (actualprov != NULL) { |
648 | 20 | if (!ossl_provider_up_ref(actualtmp)) { |
649 | 0 | ERR_raise(ERR_LIB_CRYPTO, ERR_R_MALLOC_FAILURE); |
650 | 0 | actualtmp = NULL; |
651 | 0 | return 0; |
652 | 0 | } |
653 | 20 | *actualprov = actualtmp; |
654 | 20 | } |
655 | | |
656 | 20 | if (idx >= 0) { |
657 | | /* |
658 | | * The provider is already in the store. Probably two threads |
659 | | * independently initialised their own provider objects with the same |
660 | | * name and raced to put them in the store. This thread lost. We |
661 | | * deactivate the one we just created and use the one that already |
662 | | * exists instead. |
663 | | * If we get here then we know we did not create provider children |
664 | | * above, so we inform ossl_provider_deactivate not to attempt to remove |
665 | | * any. |
666 | | */ |
667 | 0 | ossl_provider_deactivate(prov, 0); |
668 | 0 | ossl_provider_free(prov); |
669 | 0 | } |
670 | | |
671 | 20 | return 1; |
672 | | |
673 | 0 | err: |
674 | 0 | CRYPTO_THREAD_unlock(store->lock); |
675 | 0 | return 0; |
676 | 20 | } |
677 | | |
678 | | void ossl_provider_free(OSSL_PROVIDER *prov) |
679 | 9.64k | { |
680 | 9.64k | if (prov != NULL) { |
681 | 9.61k | int ref = 0; |
682 | | |
683 | 9.61k | CRYPTO_DOWN_REF(&prov->refcnt, &ref, prov->refcnt_lock); |
684 | | |
685 | | /* |
686 | | * When the refcount drops to zero, we clean up the provider. |
687 | | * Note that this also does teardown, which may seem late, |
688 | | * considering that init happens on first activation. However, |
689 | | * there may be other structures hanging on to the provider after |
690 | | * the last deactivation and may therefore need full access to the |
691 | | * provider's services. Therefore, we deinit late. |
692 | | */ |
693 | 9.61k | if (ref == 0) { |
694 | 43 | if (prov->flag_initialized) { |
695 | 43 | ossl_provider_teardown(prov); |
696 | 43 | #ifndef OPENSSL_NO_ERR |
697 | 43 | # ifndef FIPS_MODULE |
698 | 43 | if (prov->error_strings != NULL) { |
699 | 0 | ERR_unload_strings(prov->error_lib, prov->error_strings); |
700 | 0 | OPENSSL_free(prov->error_strings); |
701 | 0 | prov->error_strings = NULL; |
702 | 0 | } |
703 | 43 | # endif |
704 | 43 | #endif |
705 | 43 | OPENSSL_free(prov->operation_bits); |
706 | 43 | prov->operation_bits = NULL; |
707 | 43 | prov->operation_bits_sz = 0; |
708 | 43 | prov->flag_initialized = 0; |
709 | 43 | } |
710 | | |
711 | 43 | #ifndef FIPS_MODULE |
712 | | /* |
713 | | * We deregister thread handling whether or not the provider was |
714 | | * initialized. If init was attempted but was not successful then |
715 | | * the provider may still have registered a thread handler. |
716 | | */ |
717 | 43 | ossl_init_thread_deregister(prov); |
718 | 43 | DSO_free(prov->module); |
719 | 43 | #endif |
720 | 43 | OPENSSL_free(prov->name); |
721 | 43 | OPENSSL_free(prov->path); |
722 | 43 | sk_INFOPAIR_pop_free(prov->parameters, infopair_free); |
723 | 43 | CRYPTO_THREAD_lock_free(prov->opbits_lock); |
724 | 43 | CRYPTO_THREAD_lock_free(prov->flag_lock); |
725 | | #ifndef HAVE_ATOMICS |
726 | | CRYPTO_THREAD_lock_free(prov->refcnt_lock); |
727 | | #endif |
728 | 43 | OPENSSL_free(prov); |
729 | 43 | } |
730 | 9.56k | #ifndef FIPS_MODULE |
731 | 9.56k | else if (prov->ischild) { |
732 | 0 | ossl_provider_free_parent(prov, 0); |
733 | 0 | } |
734 | 9.61k | #endif |
735 | 9.61k | } |
736 | 9.64k | } |
737 | | |
738 | | /* Setters */ |
739 | | int ossl_provider_set_module_path(OSSL_PROVIDER *prov, const char *module_path) |
740 | 60 | { |
741 | 60 | OPENSSL_free(prov->path); |
742 | 60 | prov->path = NULL; |
743 | 60 | if (module_path == NULL) |
744 | 60 | return 1; |
745 | 0 | if ((prov->path = OPENSSL_strdup(module_path)) != NULL) |
746 | 0 | return 1; |
747 | 0 | ERR_raise(ERR_LIB_CRYPTO, ERR_R_MALLOC_FAILURE); |
748 | 0 | return 0; |
749 | 0 | } |
750 | | |
751 | | static int infopair_add(STACK_OF(INFOPAIR) **infopairsk, const char *name, |
752 | | const char *value) |
753 | 0 | { |
754 | 0 | INFOPAIR *pair = NULL; |
755 | |
|
756 | 0 | if ((pair = OPENSSL_zalloc(sizeof(*pair))) != NULL |
757 | 0 | && (*infopairsk != NULL |
758 | 0 | || (*infopairsk = sk_INFOPAIR_new_null()) != NULL) |
759 | 0 | && (pair->name = OPENSSL_strdup(name)) != NULL |
760 | 0 | && (pair->value = OPENSSL_strdup(value)) != NULL |
761 | 0 | && sk_INFOPAIR_push(*infopairsk, pair) > 0) |
762 | 0 | return 1; |
763 | | |
764 | 0 | if (pair != NULL) { |
765 | 0 | OPENSSL_free(pair->name); |
766 | 0 | OPENSSL_free(pair->value); |
767 | 0 | OPENSSL_free(pair); |
768 | 0 | } |
769 | 0 | ERR_raise(ERR_LIB_CRYPTO, ERR_R_MALLOC_FAILURE); |
770 | 0 | return 0; |
771 | 0 | } |
772 | | |
773 | | int ossl_provider_add_parameter(OSSL_PROVIDER *prov, |
774 | | const char *name, const char *value) |
775 | 0 | { |
776 | 0 | return infopair_add(&prov->parameters, name, value); |
777 | 0 | } |
778 | | |
779 | | int ossl_provider_info_add_parameter(OSSL_PROVIDER_INFO *provinfo, |
780 | | const char *name, |
781 | | const char *value) |
782 | 0 | { |
783 | 0 | return infopair_add(&provinfo->parameters, name, value); |
784 | 0 | } |
785 | | |
786 | | /* |
787 | | * Provider activation. |
788 | | * |
789 | | * What "activation" means depends on the provider form; for built in |
790 | | * providers (in the library or the application alike), the provider |
791 | | * can already be considered to be loaded, all that's needed is to |
792 | | * initialize it. However, for dynamically loadable provider modules, |
793 | | * we must first load that module. |
794 | | * |
795 | | * Built in modules are distinguished from dynamically loaded modules |
796 | | * with an already assigned init function. |
797 | | */ |
798 | | static const OSSL_DISPATCH *core_dispatch; /* Define further down */ |
799 | | |
800 | | int OSSL_PROVIDER_set_default_search_path(OSSL_LIB_CTX *libctx, |
801 | | const char *path) |
802 | 0 | { |
803 | 0 | struct provider_store_st *store; |
804 | 0 | char *p = NULL; |
805 | |
|
806 | 0 | if (path != NULL) { |
807 | 0 | p = OPENSSL_strdup(path); |
808 | 0 | if (p == NULL) { |
809 | 0 | ERR_raise(ERR_LIB_CRYPTO, ERR_R_MALLOC_FAILURE); |
810 | 0 | return 0; |
811 | 0 | } |
812 | 0 | } |
813 | 0 | if ((store = get_provider_store(libctx)) != NULL |
814 | 0 | && CRYPTO_THREAD_write_lock(store->default_path_lock)) { |
815 | 0 | OPENSSL_free(store->default_path); |
816 | 0 | store->default_path = p; |
817 | 0 | CRYPTO_THREAD_unlock(store->default_path_lock); |
818 | 0 | return 1; |
819 | 0 | } |
820 | 0 | OPENSSL_free(p); |
821 | 0 | return 0; |
822 | 0 | } |
823 | | |
824 | | /* |
825 | | * Internal version that doesn't affect the store flags, and thereby avoid |
826 | | * locking. Direct callers must remember to set the store flags when |
827 | | * appropriate. |
828 | | */ |
829 | | static int provider_init(OSSL_PROVIDER *prov) |
830 | 58 | { |
831 | 58 | const OSSL_DISPATCH *provider_dispatch = NULL; |
832 | 58 | void *tmp_provctx = NULL; /* safety measure */ |
833 | 58 | #ifndef OPENSSL_NO_ERR |
834 | 58 | # ifndef FIPS_MODULE |
835 | 58 | OSSL_FUNC_provider_get_reason_strings_fn *p_get_reason_strings = NULL; |
836 | 58 | # endif |
837 | 58 | #endif |
838 | 58 | int ok = 0; |
839 | | |
840 | 58 | if (!ossl_assert(!prov->flag_initialized)) { |
841 | 0 | ERR_raise(ERR_LIB_CRYPTO, ERR_R_INTERNAL_ERROR); |
842 | 0 | goto end; |
843 | 0 | } |
844 | | |
845 | | /* |
846 | | * If the init function isn't set, it indicates that this provider is |
847 | | * a loadable module. |
848 | | */ |
849 | 58 | if (prov->init_function == NULL) { |
850 | | #ifdef FIPS_MODULE |
851 | | goto end; |
852 | | #else |
853 | 0 | if (prov->module == NULL) { |
854 | 0 | char *allocated_path = NULL; |
855 | 0 | const char *module_path = NULL; |
856 | 0 | char *merged_path = NULL; |
857 | 0 | const char *load_dir = NULL; |
858 | 0 | char *allocated_load_dir = NULL; |
859 | 0 | struct provider_store_st *store; |
860 | |
|
861 | 0 | if ((prov->module = DSO_new()) == NULL) { |
862 | | /* DSO_new() generates an error already */ |
863 | 0 | goto end; |
864 | 0 | } |
865 | | |
866 | 0 | if ((store = get_provider_store(prov->libctx)) == NULL |
867 | 0 | || !CRYPTO_THREAD_read_lock(store->default_path_lock)) |
868 | 0 | goto end; |
869 | | |
870 | 0 | if (store->default_path != NULL) { |
871 | 0 | allocated_load_dir = OPENSSL_strdup(store->default_path); |
872 | 0 | CRYPTO_THREAD_unlock(store->default_path_lock); |
873 | 0 | if (allocated_load_dir == NULL) { |
874 | 0 | ERR_raise(ERR_LIB_CRYPTO, ERR_R_MALLOC_FAILURE); |
875 | 0 | goto end; |
876 | 0 | } |
877 | 0 | load_dir = allocated_load_dir; |
878 | 0 | } else { |
879 | 0 | CRYPTO_THREAD_unlock(store->default_path_lock); |
880 | 0 | } |
881 | | |
882 | 0 | if (load_dir == NULL) { |
883 | 0 | load_dir = ossl_safe_getenv("OPENSSL_MODULES"); |
884 | 0 | if (load_dir == NULL) |
885 | 0 | load_dir = MODULESDIR; |
886 | 0 | } |
887 | |
|
888 | 0 | DSO_ctrl(prov->module, DSO_CTRL_SET_FLAGS, |
889 | 0 | DSO_FLAG_NAME_TRANSLATION_EXT_ONLY, NULL); |
890 | |
|
891 | 0 | module_path = prov->path; |
892 | 0 | if (module_path == NULL) |
893 | 0 | module_path = allocated_path = |
894 | 0 | DSO_convert_filename(prov->module, prov->name); |
895 | 0 | if (module_path != NULL) |
896 | 0 | merged_path = DSO_merge(prov->module, module_path, load_dir); |
897 | |
|
898 | 0 | if (merged_path == NULL |
899 | 0 | || (DSO_load(prov->module, merged_path, NULL, 0)) == NULL) { |
900 | 0 | DSO_free(prov->module); |
901 | 0 | prov->module = NULL; |
902 | 0 | } |
903 | |
|
904 | 0 | OPENSSL_free(merged_path); |
905 | 0 | OPENSSL_free(allocated_path); |
906 | 0 | OPENSSL_free(allocated_load_dir); |
907 | 0 | } |
908 | | |
909 | 0 | if (prov->module == NULL) { |
910 | | /* DSO has already recorded errors, this is just a tracepoint */ |
911 | 0 | ERR_raise_data(ERR_LIB_CRYPTO, ERR_R_DSO_LIB, |
912 | 0 | "name=%s", prov->name); |
913 | 0 | goto end; |
914 | 0 | } |
915 | | |
916 | 0 | prov->init_function = (OSSL_provider_init_fn *) |
917 | 0 | DSO_bind_func(prov->module, "OSSL_provider_init"); |
918 | 0 | #endif |
919 | 0 | } |
920 | | |
921 | | /* Check for and call the initialise function for the provider. */ |
922 | 58 | if (prov->init_function == NULL) { |
923 | 0 | ERR_raise_data(ERR_LIB_CRYPTO, ERR_R_UNSUPPORTED, |
924 | 0 | "name=%s, provider has no provider init function", |
925 | 0 | prov->name); |
926 | 0 | goto end; |
927 | 0 | } |
928 | | |
929 | 58 | if (!prov->init_function((OSSL_CORE_HANDLE *)prov, core_dispatch, |
930 | 58 | &provider_dispatch, &tmp_provctx)) { |
931 | 0 | ERR_raise_data(ERR_LIB_CRYPTO, ERR_R_INIT_FAIL, |
932 | 0 | "name=%s", prov->name); |
933 | 0 | goto end; |
934 | 0 | } |
935 | 58 | prov->provctx = tmp_provctx; |
936 | 58 | prov->dispatch = provider_dispatch; |
937 | | |
938 | 58 | if (provider_dispatch != NULL) { |
939 | 246 | for (; provider_dispatch->function_id != 0; provider_dispatch++) { |
940 | 188 | switch (provider_dispatch->function_id) { |
941 | 58 | case OSSL_FUNC_PROVIDER_TEARDOWN: |
942 | 58 | prov->teardown = |
943 | 58 | OSSL_FUNC_provider_teardown(provider_dispatch); |
944 | 58 | break; |
945 | 24 | case OSSL_FUNC_PROVIDER_GETTABLE_PARAMS: |
946 | 24 | prov->gettable_params = |
947 | 24 | OSSL_FUNC_provider_gettable_params(provider_dispatch); |
948 | 24 | break; |
949 | 24 | case OSSL_FUNC_PROVIDER_GET_PARAMS: |
950 | 24 | prov->get_params = |
951 | 24 | OSSL_FUNC_provider_get_params(provider_dispatch); |
952 | 24 | break; |
953 | 0 | case OSSL_FUNC_PROVIDER_SELF_TEST: |
954 | 0 | prov->self_test = |
955 | 0 | OSSL_FUNC_provider_self_test(provider_dispatch); |
956 | 0 | break; |
957 | 24 | case OSSL_FUNC_PROVIDER_GET_CAPABILITIES: |
958 | 24 | prov->get_capabilities = |
959 | 24 | OSSL_FUNC_provider_get_capabilities(provider_dispatch); |
960 | 24 | break; |
961 | 58 | case OSSL_FUNC_PROVIDER_QUERY_OPERATION: |
962 | 58 | prov->query_operation = |
963 | 58 | OSSL_FUNC_provider_query_operation(provider_dispatch); |
964 | 58 | break; |
965 | 0 | case OSSL_FUNC_PROVIDER_UNQUERY_OPERATION: |
966 | 0 | prov->unquery_operation = |
967 | 0 | OSSL_FUNC_provider_unquery_operation(provider_dispatch); |
968 | 0 | break; |
969 | 0 | #ifndef OPENSSL_NO_ERR |
970 | 0 | # ifndef FIPS_MODULE |
971 | 0 | case OSSL_FUNC_PROVIDER_GET_REASON_STRINGS: |
972 | 0 | p_get_reason_strings = |
973 | 0 | OSSL_FUNC_provider_get_reason_strings(provider_dispatch); |
974 | 0 | break; |
975 | 188 | # endif |
976 | 188 | #endif |
977 | 188 | } |
978 | 188 | } |
979 | 58 | } |
980 | | |
981 | 58 | #ifndef OPENSSL_NO_ERR |
982 | 58 | # ifndef FIPS_MODULE |
983 | 58 | if (p_get_reason_strings != NULL) { |
984 | 0 | const OSSL_ITEM *reasonstrings = p_get_reason_strings(prov->provctx); |
985 | 0 | size_t cnt, cnt2; |
986 | | |
987 | | /* |
988 | | * ERR_load_strings() handles ERR_STRING_DATA rather than OSSL_ITEM, |
989 | | * although they are essentially the same type. |
990 | | * Furthermore, ERR_load_strings() patches the array's error number |
991 | | * with the error library number, so we need to make a copy of that |
992 | | * array either way. |
993 | | */ |
994 | 0 | cnt = 0; |
995 | 0 | while (reasonstrings[cnt].id != 0) { |
996 | 0 | if (ERR_GET_LIB(reasonstrings[cnt].id) != 0) |
997 | 0 | goto end; |
998 | 0 | cnt++; |
999 | 0 | } |
1000 | 0 | cnt++; /* One for the terminating item */ |
1001 | | |
1002 | | /* Allocate one extra item for the "library" name */ |
1003 | 0 | prov->error_strings = |
1004 | 0 | OPENSSL_zalloc(sizeof(ERR_STRING_DATA) * (cnt + 1)); |
1005 | 0 | if (prov->error_strings == NULL) |
1006 | 0 | goto end; |
1007 | | |
1008 | | /* |
1009 | | * Set the "library" name. |
1010 | | */ |
1011 | 0 | prov->error_strings[0].error = ERR_PACK(prov->error_lib, 0, 0); |
1012 | 0 | prov->error_strings[0].string = prov->name; |
1013 | | /* |
1014 | | * Copy reasonstrings item 0..cnt-1 to prov->error_trings positions |
1015 | | * 1..cnt. |
1016 | | */ |
1017 | 0 | for (cnt2 = 1; cnt2 <= cnt; cnt2++) { |
1018 | 0 | prov->error_strings[cnt2].error = (int)reasonstrings[cnt2-1].id; |
1019 | 0 | prov->error_strings[cnt2].string = reasonstrings[cnt2-1].ptr; |
1020 | 0 | } |
1021 | |
|
1022 | 0 | ERR_load_strings(prov->error_lib, prov->error_strings); |
1023 | 0 | } |
1024 | 58 | # endif |
1025 | 58 | #endif |
1026 | | |
1027 | | /* With this flag set, this provider has become fully "loaded". */ |
1028 | 58 | prov->flag_initialized = 1; |
1029 | 58 | ok = 1; |
1030 | | |
1031 | 58 | end: |
1032 | 58 | return ok; |
1033 | 58 | } |
1034 | | |
1035 | | /* |
1036 | | * Deactivate a provider. If upcalls is 0 then we suppress any upcalls to a |
1037 | | * parent provider. If removechildren is 0 then we suppress any calls to remove |
1038 | | * child providers. |
1039 | | * Return -1 on failure and the activation count on success |
1040 | | */ |
1041 | | static int provider_deactivate(OSSL_PROVIDER *prov, int upcalls, |
1042 | | int removechildren) |
1043 | 3.40M | { |
1044 | 3.40M | int count; |
1045 | 3.40M | struct provider_store_st *store; |
1046 | 3.40M | #ifndef FIPS_MODULE |
1047 | 3.40M | int freeparent = 0; |
1048 | 3.40M | #endif |
1049 | 3.40M | int lock = 1; |
1050 | | |
1051 | 3.40M | if (!ossl_assert(prov != NULL)) |
1052 | 0 | return -1; |
1053 | | |
1054 | | /* |
1055 | | * No need to lock if we've got no store because we've not been shared with |
1056 | | * other threads. |
1057 | | */ |
1058 | 3.40M | store = get_provider_store(prov->libctx); |
1059 | 3.40M | if (store == NULL) |
1060 | 0 | lock = 0; |
1061 | | |
1062 | 3.40M | if (lock && !CRYPTO_THREAD_read_lock(store->lock)) |
1063 | 0 | return -1; |
1064 | 3.40M | if (lock && !CRYPTO_THREAD_write_lock(prov->flag_lock)) { |
1065 | 0 | CRYPTO_THREAD_unlock(store->lock); |
1066 | 0 | return -1; |
1067 | 0 | } |
1068 | | |
1069 | 3.40M | #ifndef FIPS_MODULE |
1070 | 3.40M | if (prov->activatecnt >= 2 && prov->ischild && upcalls) { |
1071 | | /* |
1072 | | * We have had a direct activation in this child libctx so we need to |
1073 | | * now down the ref count in the parent provider. We do the actual down |
1074 | | * ref outside of the flag_lock, since it could involve getting other |
1075 | | * locks. |
1076 | | */ |
1077 | 0 | freeparent = 1; |
1078 | 0 | } |
1079 | 3.40M | #endif |
1080 | | |
1081 | 3.40M | if ((count = --prov->activatecnt) < 1) |
1082 | 34 | prov->flag_activated = 0; |
1083 | 3.40M | #ifndef FIPS_MODULE |
1084 | 3.40M | else |
1085 | 3.40M | removechildren = 0; |
1086 | 3.40M | #endif |
1087 | | |
1088 | 3.40M | #ifndef FIPS_MODULE |
1089 | 3.40M | if (removechildren && store != NULL) { |
1090 | 34 | int i, max = sk_OSSL_PROVIDER_CHILD_CB_num(store->child_cbs); |
1091 | 34 | OSSL_PROVIDER_CHILD_CB *child_cb; |
1092 | | |
1093 | 34 | for (i = 0; i < max; i++) { |
1094 | 0 | child_cb = sk_OSSL_PROVIDER_CHILD_CB_value(store->child_cbs, i); |
1095 | 0 | child_cb->remove_cb((OSSL_CORE_HANDLE *)prov, child_cb->cbdata); |
1096 | 0 | } |
1097 | 34 | } |
1098 | 3.40M | #endif |
1099 | 3.40M | if (lock) { |
1100 | 3.40M | CRYPTO_THREAD_unlock(prov->flag_lock); |
1101 | 3.40M | CRYPTO_THREAD_unlock(store->lock); |
1102 | 3.40M | } |
1103 | 3.40M | #ifndef FIPS_MODULE |
1104 | 3.40M | if (freeparent) |
1105 | 0 | ossl_provider_free_parent(prov, 1); |
1106 | 3.40M | #endif |
1107 | | |
1108 | | /* We don't deinit here, that's done in ossl_provider_free() */ |
1109 | 3.40M | return count; |
1110 | 3.40M | } |
1111 | | |
1112 | | /* |
1113 | | * Activate a provider. |
1114 | | * Return -1 on failure and the activation count on success |
1115 | | */ |
1116 | | static int provider_activate(OSSL_PROVIDER *prov, int lock, int upcalls) |
1117 | 3.40M | { |
1118 | 3.40M | int count = -1; |
1119 | 3.40M | struct provider_store_st *store; |
1120 | 3.40M | int ret = 1; |
1121 | | |
1122 | 3.40M | store = prov->store; |
1123 | | /* |
1124 | | * If the provider hasn't been added to the store, then we don't need |
1125 | | * any locks because we've not shared it with other threads. |
1126 | | */ |
1127 | 3.40M | if (store == NULL) { |
1128 | 34 | lock = 0; |
1129 | 34 | if (!provider_init(prov)) |
1130 | 0 | return -1; |
1131 | 34 | } |
1132 | | |
1133 | 3.40M | #ifndef FIPS_MODULE |
1134 | 3.40M | if (prov->ischild && upcalls && !ossl_provider_up_ref_parent(prov, 1)) |
1135 | 0 | return -1; |
1136 | 3.40M | #endif |
1137 | | |
1138 | 3.40M | if (lock && !CRYPTO_THREAD_read_lock(store->lock)) { |
1139 | 0 | #ifndef FIPS_MODULE |
1140 | 0 | if (prov->ischild && upcalls) |
1141 | 0 | ossl_provider_free_parent(prov, 1); |
1142 | 0 | #endif |
1143 | 0 | return -1; |
1144 | 0 | } |
1145 | | |
1146 | 3.40M | if (lock && !CRYPTO_THREAD_write_lock(prov->flag_lock)) { |
1147 | 0 | CRYPTO_THREAD_unlock(store->lock); |
1148 | 0 | #ifndef FIPS_MODULE |
1149 | 0 | if (prov->ischild && upcalls) |
1150 | 0 | ossl_provider_free_parent(prov, 1); |
1151 | 0 | #endif |
1152 | 0 | return -1; |
1153 | 0 | } |
1154 | | |
1155 | 3.40M | count = ++prov->activatecnt; |
1156 | 3.40M | prov->flag_activated = 1; |
1157 | | |
1158 | 3.40M | if (prov->activatecnt == 1 && store != NULL) { |
1159 | 0 | ret = create_provider_children(prov); |
1160 | 0 | } |
1161 | 3.40M | if (lock) { |
1162 | 0 | CRYPTO_THREAD_unlock(prov->flag_lock); |
1163 | 0 | CRYPTO_THREAD_unlock(store->lock); |
1164 | 0 | } |
1165 | | |
1166 | 3.40M | if (!ret) |
1167 | 0 | return -1; |
1168 | | |
1169 | 3.40M | return count; |
1170 | 3.40M | } |
1171 | | |
1172 | | static int provider_flush_store_cache(const OSSL_PROVIDER *prov) |
1173 | 60 | { |
1174 | 60 | struct provider_store_st *store; |
1175 | 60 | int freeing; |
1176 | | |
1177 | 60 | if ((store = get_provider_store(prov->libctx)) == NULL) |
1178 | 0 | return 0; |
1179 | | |
1180 | 60 | if (!CRYPTO_THREAD_read_lock(store->lock)) |
1181 | 0 | return 0; |
1182 | 60 | freeing = store->freeing; |
1183 | 60 | CRYPTO_THREAD_unlock(store->lock); |
1184 | | |
1185 | 60 | if (!freeing) { |
1186 | 60 | int acc |
1187 | 60 | = evp_method_store_cache_flush(prov->libctx) |
1188 | 60 | #ifndef FIPS_MODULE |
1189 | 60 | + ossl_encoder_store_cache_flush(prov->libctx) |
1190 | 60 | + ossl_decoder_store_cache_flush(prov->libctx) |
1191 | 60 | + ossl_store_loader_store_cache_flush(prov->libctx) |
1192 | 60 | #endif |
1193 | 60 | ; |
1194 | | |
1195 | 60 | #ifndef FIPS_MODULE |
1196 | 60 | return acc == 4; |
1197 | | #else |
1198 | | return acc == 1; |
1199 | | #endif |
1200 | 60 | } |
1201 | 0 | return 1; |
1202 | 60 | } |
1203 | | |
1204 | | static int provider_remove_store_methods(OSSL_PROVIDER *prov) |
1205 | 103 | { |
1206 | 103 | struct provider_store_st *store; |
1207 | 103 | int freeing; |
1208 | | |
1209 | 103 | if ((store = get_provider_store(prov->libctx)) == NULL) |
1210 | 0 | return 0; |
1211 | | |
1212 | 103 | if (!CRYPTO_THREAD_read_lock(store->lock)) |
1213 | 0 | return 0; |
1214 | 103 | freeing = store->freeing; |
1215 | 103 | CRYPTO_THREAD_unlock(store->lock); |
1216 | | |
1217 | 103 | if (!freeing) { |
1218 | 0 | int acc; |
1219 | |
|
1220 | 0 | if (!CRYPTO_THREAD_write_lock(prov->opbits_lock)) |
1221 | 0 | return 0; |
1222 | 0 | OPENSSL_free(prov->operation_bits); |
1223 | 0 | prov->operation_bits = NULL; |
1224 | 0 | prov->operation_bits_sz = 0; |
1225 | 0 | CRYPTO_THREAD_unlock(prov->opbits_lock); |
1226 | |
|
1227 | 0 | acc = evp_method_store_remove_all_provided(prov) |
1228 | 0 | #ifndef FIPS_MODULE |
1229 | 0 | + ossl_encoder_store_remove_all_provided(prov) |
1230 | 0 | + ossl_decoder_store_remove_all_provided(prov) |
1231 | 0 | + ossl_store_loader_store_remove_all_provided(prov) |
1232 | 0 | #endif |
1233 | 0 | ; |
1234 | |
|
1235 | 0 | #ifndef FIPS_MODULE |
1236 | 0 | return acc == 4; |
1237 | | #else |
1238 | | return acc == 1; |
1239 | | #endif |
1240 | 0 | } |
1241 | 103 | return 1; |
1242 | 103 | } |
1243 | | |
1244 | | int ossl_provider_activate(OSSL_PROVIDER *prov, int upcalls, int aschild) |
1245 | 60 | { |
1246 | 60 | int count; |
1247 | | |
1248 | 60 | if (prov == NULL) |
1249 | 0 | return 0; |
1250 | 60 | #ifndef FIPS_MODULE |
1251 | | /* |
1252 | | * If aschild is true, then we only actually do the activation if the |
1253 | | * provider is a child. If its not, this is still success. |
1254 | | */ |
1255 | 60 | if (aschild && !prov->ischild) |
1256 | 0 | return 1; |
1257 | 60 | #endif |
1258 | 60 | if ((count = provider_activate(prov, 1, upcalls)) > 0) |
1259 | 60 | return count == 1 ? provider_flush_store_cache(prov) : 1; |
1260 | | |
1261 | 0 | return 0; |
1262 | 60 | } |
1263 | | |
1264 | | int ossl_provider_deactivate(OSSL_PROVIDER *prov, int removechildren) |
1265 | 103 | { |
1266 | 103 | int count; |
1267 | | |
1268 | 103 | if (prov == NULL |
1269 | 103 | || (count = provider_deactivate(prov, 1, removechildren)) < 0) |
1270 | 0 | return 0; |
1271 | 103 | return count == 0 ? provider_remove_store_methods(prov) : 1; |
1272 | 103 | } |
1273 | | |
1274 | | void *ossl_provider_ctx(const OSSL_PROVIDER *prov) |
1275 | 11.7M | { |
1276 | 11.7M | return prov != NULL ? prov->provctx : NULL; |
1277 | 11.7M | } |
1278 | | |
1279 | | /* |
1280 | | * This function only does something once when store->use_fallbacks == 1, |
1281 | | * and then sets store->use_fallbacks = 0, so the second call and so on is |
1282 | | * effectively a no-op. |
1283 | | */ |
1284 | | static int provider_activate_fallbacks(struct provider_store_st *store) |
1285 | 2.36M | { |
1286 | 2.36M | int use_fallbacks; |
1287 | 2.36M | int activated_fallback_count = 0; |
1288 | 2.36M | int ret = 0; |
1289 | 2.36M | const OSSL_PROVIDER_INFO *p; |
1290 | | |
1291 | 2.36M | if (!CRYPTO_THREAD_read_lock(store->lock)) |
1292 | 0 | return 0; |
1293 | 2.36M | use_fallbacks = store->use_fallbacks; |
1294 | 2.36M | CRYPTO_THREAD_unlock(store->lock); |
1295 | 2.36M | if (!use_fallbacks) |
1296 | 2.36M | return 1; |
1297 | | |
1298 | 24 | if (!CRYPTO_THREAD_write_lock(store->lock)) |
1299 | 0 | return 0; |
1300 | | /* Check again, just in case another thread changed it */ |
1301 | 24 | use_fallbacks = store->use_fallbacks; |
1302 | 24 | if (!use_fallbacks) { |
1303 | 0 | CRYPTO_THREAD_unlock(store->lock); |
1304 | 0 | return 1; |
1305 | 0 | } |
1306 | | |
1307 | 96 | for (p = ossl_predefined_providers; p->name != NULL; p++) { |
1308 | 72 | OSSL_PROVIDER *prov = NULL; |
1309 | | |
1310 | 72 | if (!p->is_fallback) |
1311 | 48 | continue; |
1312 | | /* |
1313 | | * We use the internal constructor directly here, |
1314 | | * otherwise we get a call loop |
1315 | | */ |
1316 | 24 | prov = provider_new(p->name, p->init, NULL); |
1317 | 24 | if (prov == NULL) |
1318 | 0 | goto err; |
1319 | 24 | prov->libctx = store->libctx; |
1320 | 24 | #ifndef FIPS_MODULE |
1321 | 24 | prov->error_lib = ERR_get_next_error_library(); |
1322 | 24 | #endif |
1323 | | |
1324 | | /* |
1325 | | * We are calling provider_activate while holding the store lock. This |
1326 | | * means the init function will be called while holding a lock. Normally |
1327 | | * we try to avoid calling a user callback while holding a lock. |
1328 | | * However, fallbacks are never third party providers so we accept this. |
1329 | | */ |
1330 | 24 | if (provider_activate(prov, 0, 0) < 0) { |
1331 | 0 | ossl_provider_free(prov); |
1332 | 0 | goto err; |
1333 | 0 | } |
1334 | 24 | prov->store = store; |
1335 | 24 | if (sk_OSSL_PROVIDER_push(store->providers, prov) == 0) { |
1336 | 0 | ossl_provider_free(prov); |
1337 | 0 | goto err; |
1338 | 0 | } |
1339 | 24 | activated_fallback_count++; |
1340 | 24 | } |
1341 | | |
1342 | 24 | if (activated_fallback_count > 0) { |
1343 | 24 | store->use_fallbacks = 0; |
1344 | 24 | ret = 1; |
1345 | 24 | } |
1346 | 24 | err: |
1347 | 24 | CRYPTO_THREAD_unlock(store->lock); |
1348 | 24 | return ret; |
1349 | 24 | } |
1350 | | |
1351 | | int ossl_provider_doall_activated(OSSL_LIB_CTX *ctx, |
1352 | | int (*cb)(OSSL_PROVIDER *provider, |
1353 | | void *cbdata), |
1354 | | void *cbdata) |
1355 | 1.89M | { |
1356 | 1.89M | int ret = 0, curr, max, ref = 0; |
1357 | 1.89M | struct provider_store_st *store = get_provider_store(ctx); |
1358 | 1.89M | STACK_OF(OSSL_PROVIDER) *provs = NULL; |
1359 | | |
1360 | 1.89M | #if !defined(FIPS_MODULE) && !defined(OPENSSL_NO_AUTOLOAD_CONFIG) |
1361 | | /* |
1362 | | * Make sure any providers are loaded from config before we try to use |
1363 | | * them. |
1364 | | */ |
1365 | 1.89M | if (ossl_lib_ctx_is_default(ctx)) |
1366 | 1.89M | OPENSSL_init_crypto(OPENSSL_INIT_LOAD_CONFIG, NULL); |
1367 | 1.89M | #endif |
1368 | | |
1369 | 1.89M | if (store == NULL) |
1370 | 0 | return 1; |
1371 | 1.89M | if (!provider_activate_fallbacks(store)) |
1372 | 0 | return 0; |
1373 | | |
1374 | | /* |
1375 | | * Under lock, grab a copy of the provider list and up_ref each |
1376 | | * provider so that they don't disappear underneath us. |
1377 | | */ |
1378 | 1.89M | if (!CRYPTO_THREAD_read_lock(store->lock)) |
1379 | 0 | return 0; |
1380 | 1.89M | provs = sk_OSSL_PROVIDER_dup(store->providers); |
1381 | 1.89M | if (provs == NULL) { |
1382 | 0 | CRYPTO_THREAD_unlock(store->lock); |
1383 | 0 | return 0; |
1384 | 0 | } |
1385 | 1.89M | max = sk_OSSL_PROVIDER_num(provs); |
1386 | | /* |
1387 | | * We work backwards through the stack so that we can safely delete items |
1388 | | * as we go. |
1389 | | */ |
1390 | 5.30M | for (curr = max - 1; curr >= 0; curr--) { |
1391 | 3.40M | OSSL_PROVIDER *prov = sk_OSSL_PROVIDER_value(provs, curr); |
1392 | | |
1393 | 3.40M | if (!CRYPTO_THREAD_write_lock(prov->flag_lock)) |
1394 | 0 | goto err_unlock; |
1395 | 3.40M | if (prov->flag_activated) { |
1396 | | /* |
1397 | | * We call CRYPTO_UP_REF directly rather than ossl_provider_up_ref |
1398 | | * to avoid upping the ref count on the parent provider, which we |
1399 | | * must not do while holding locks. |
1400 | | */ |
1401 | 3.40M | if (CRYPTO_UP_REF(&prov->refcnt, &ref, prov->refcnt_lock) <= 0) { |
1402 | 0 | CRYPTO_THREAD_unlock(prov->flag_lock); |
1403 | 0 | goto err_unlock; |
1404 | 0 | } |
1405 | | /* |
1406 | | * It's already activated, but we up the activated count to ensure |
1407 | | * it remains activated until after we've called the user callback. |
1408 | | * We do this with no locking (because we already hold the locks) |
1409 | | * and no upcalls (which must not be called when locks are held). In |
1410 | | * theory this could mean the parent provider goes inactive, whilst |
1411 | | * still activated in the child for a short period. That's ok. |
1412 | | */ |
1413 | 3.40M | if (provider_activate(prov, 0, 0) < 0) { |
1414 | 0 | CRYPTO_DOWN_REF(&prov->refcnt, &ref, prov->refcnt_lock); |
1415 | 0 | CRYPTO_THREAD_unlock(prov->flag_lock); |
1416 | 0 | goto err_unlock; |
1417 | 0 | } |
1418 | 3.40M | } else { |
1419 | 0 | sk_OSSL_PROVIDER_delete(provs, curr); |
1420 | 0 | max--; |
1421 | 0 | } |
1422 | 3.40M | CRYPTO_THREAD_unlock(prov->flag_lock); |
1423 | 3.40M | } |
1424 | 1.89M | CRYPTO_THREAD_unlock(store->lock); |
1425 | | |
1426 | | /* |
1427 | | * Now, we sweep through all providers not under lock |
1428 | | */ |
1429 | 5.30M | for (curr = 0; curr < max; curr++) { |
1430 | 3.40M | OSSL_PROVIDER *prov = sk_OSSL_PROVIDER_value(provs, curr); |
1431 | | |
1432 | 3.40M | if (!cb(prov, cbdata)) { |
1433 | 0 | curr = -1; |
1434 | 0 | goto finish; |
1435 | 0 | } |
1436 | 3.40M | } |
1437 | 1.89M | curr = -1; |
1438 | | |
1439 | 1.89M | ret = 1; |
1440 | 1.89M | goto finish; |
1441 | | |
1442 | 0 | err_unlock: |
1443 | 0 | CRYPTO_THREAD_unlock(store->lock); |
1444 | 1.89M | finish: |
1445 | | /* |
1446 | | * The pop_free call doesn't do what we want on an error condition. We |
1447 | | * either start from the first item in the stack, or part way through if |
1448 | | * we only processed some of the items. |
1449 | | */ |
1450 | 5.30M | for (curr++; curr < max; curr++) { |
1451 | 3.40M | OSSL_PROVIDER *prov = sk_OSSL_PROVIDER_value(provs, curr); |
1452 | | |
1453 | 3.40M | provider_deactivate(prov, 0, 1); |
1454 | | /* |
1455 | | * As above where we did the up-ref, we don't call ossl_provider_free |
1456 | | * to avoid making upcalls. There should always be at least one ref |
1457 | | * to the provider in the store, so this should never drop to 0. |
1458 | | */ |
1459 | 3.40M | CRYPTO_DOWN_REF(&prov->refcnt, &ref, prov->refcnt_lock); |
1460 | | /* |
1461 | | * Not much we can do if this assert ever fails. So we don't use |
1462 | | * ossl_assert here. |
1463 | | */ |
1464 | 3.40M | assert(ref > 0); |
1465 | 3.40M | } |
1466 | 1.89M | sk_OSSL_PROVIDER_free(provs); |
1467 | 1.89M | return ret; |
1468 | 1.89M | } |
1469 | | |
1470 | | int OSSL_PROVIDER_available(OSSL_LIB_CTX *libctx, const char *name) |
1471 | 0 | { |
1472 | 0 | OSSL_PROVIDER *prov = NULL; |
1473 | 0 | int available = 0; |
1474 | 0 | struct provider_store_st *store = get_provider_store(libctx); |
1475 | |
|
1476 | 0 | if (store == NULL || !provider_activate_fallbacks(store)) |
1477 | 0 | return 0; |
1478 | | |
1479 | 0 | prov = ossl_provider_find(libctx, name, 0); |
1480 | 0 | if (prov != NULL) { |
1481 | 0 | if (!CRYPTO_THREAD_read_lock(prov->flag_lock)) |
1482 | 0 | return 0; |
1483 | 0 | available = prov->flag_activated; |
1484 | 0 | CRYPTO_THREAD_unlock(prov->flag_lock); |
1485 | 0 | ossl_provider_free(prov); |
1486 | 0 | } |
1487 | 0 | return available; |
1488 | 0 | } |
1489 | | |
1490 | | /* Getters of Provider Object data */ |
1491 | | const char *ossl_provider_name(const OSSL_PROVIDER *prov) |
1492 | 42 | { |
1493 | 42 | return prov->name; |
1494 | 42 | } |
1495 | | |
1496 | | const DSO *ossl_provider_dso(const OSSL_PROVIDER *prov) |
1497 | 0 | { |
1498 | 0 | return prov->module; |
1499 | 0 | } |
1500 | | |
1501 | | const char *ossl_provider_module_name(const OSSL_PROVIDER *prov) |
1502 | 0 | { |
1503 | | #ifdef FIPS_MODULE |
1504 | | return NULL; |
1505 | | #else |
1506 | 0 | return DSO_get_filename(prov->module); |
1507 | 0 | #endif |
1508 | 0 | } |
1509 | | |
1510 | | const char *ossl_provider_module_path(const OSSL_PROVIDER *prov) |
1511 | 0 | { |
1512 | | #ifdef FIPS_MODULE |
1513 | | return NULL; |
1514 | | #else |
1515 | | /* FIXME: Ensure it's a full path */ |
1516 | 0 | return DSO_get_filename(prov->module); |
1517 | 0 | #endif |
1518 | 0 | } |
1519 | | |
1520 | | void *ossl_provider_prov_ctx(const OSSL_PROVIDER *prov) |
1521 | 321M | { |
1522 | 321M | if (prov != NULL) |
1523 | 321M | return prov->provctx; |
1524 | | |
1525 | 0 | return NULL; |
1526 | 321M | } |
1527 | | |
1528 | | const OSSL_DISPATCH *ossl_provider_get0_dispatch(const OSSL_PROVIDER *prov) |
1529 | 0 | { |
1530 | 0 | if (prov != NULL) |
1531 | 0 | return prov->dispatch; |
1532 | | |
1533 | 0 | return NULL; |
1534 | 0 | } |
1535 | | |
1536 | | OSSL_LIB_CTX *ossl_provider_libctx(const OSSL_PROVIDER *prov) |
1537 | 276M | { |
1538 | 276M | return prov != NULL ? prov->libctx : NULL; |
1539 | 276M | } |
1540 | | |
1541 | | /* Wrappers around calls to the provider */ |
1542 | | void ossl_provider_teardown(const OSSL_PROVIDER *prov) |
1543 | 24 | { |
1544 | 24 | if (prov->teardown != NULL |
1545 | 24 | #ifndef FIPS_MODULE |
1546 | 24 | && !prov->ischild |
1547 | 24 | #endif |
1548 | 24 | ) |
1549 | 24 | prov->teardown(prov->provctx); |
1550 | 24 | } |
1551 | | |
1552 | | const OSSL_PARAM *ossl_provider_gettable_params(const OSSL_PROVIDER *prov) |
1553 | 0 | { |
1554 | 0 | return prov->gettable_params == NULL |
1555 | 0 | ? NULL : prov->gettable_params(prov->provctx); |
1556 | 0 | } |
1557 | | |
1558 | | int ossl_provider_get_params(const OSSL_PROVIDER *prov, OSSL_PARAM params[]) |
1559 | 0 | { |
1560 | 0 | return prov->get_params == NULL |
1561 | 0 | ? 0 : prov->get_params(prov->provctx, params); |
1562 | 0 | } |
1563 | | |
1564 | | int ossl_provider_self_test(const OSSL_PROVIDER *prov) |
1565 | 0 | { |
1566 | 0 | int ret; |
1567 | |
|
1568 | 0 | if (prov->self_test == NULL) |
1569 | 0 | return 1; |
1570 | 0 | ret = prov->self_test(prov->provctx); |
1571 | 0 | if (ret == 0) |
1572 | 0 | (void)provider_remove_store_methods((OSSL_PROVIDER *)prov); |
1573 | 0 | return ret; |
1574 | 0 | } |
1575 | | |
1576 | | int ossl_provider_get_capabilities(const OSSL_PROVIDER *prov, |
1577 | | const char *capability, |
1578 | | OSSL_CALLBACK *cb, |
1579 | | void *arg) |
1580 | 144k | { |
1581 | 144k | return prov->get_capabilities == NULL |
1582 | 144k | ? 1 : prov->get_capabilities(prov->provctx, capability, cb, arg); |
1583 | 144k | } |
1584 | | |
1585 | | const OSSL_ALGORITHM *ossl_provider_query_operation(const OSSL_PROVIDER *prov, |
1586 | | int operation_id, |
1587 | | int *no_cache) |
1588 | 4.20M | { |
1589 | 4.20M | const OSSL_ALGORITHM *res; |
1590 | | |
1591 | 4.20M | if (prov->query_operation == NULL) |
1592 | 0 | return NULL; |
1593 | 4.20M | res = prov->query_operation(prov->provctx, operation_id, no_cache); |
1594 | | #if defined(OPENSSL_NO_CACHED_FETCH) |
1595 | | /* Forcing the non-caching of queries */ |
1596 | | if (no_cache != NULL) |
1597 | | *no_cache = 1; |
1598 | | #endif |
1599 | 4.20M | return res; |
1600 | 4.20M | } |
1601 | | |
1602 | | void ossl_provider_unquery_operation(const OSSL_PROVIDER *prov, |
1603 | | int operation_id, |
1604 | | const OSSL_ALGORITHM *algs) |
1605 | 4.20M | { |
1606 | 4.20M | if (prov->unquery_operation != NULL) |
1607 | 0 | prov->unquery_operation(prov->provctx, operation_id, algs); |
1608 | 4.20M | } |
1609 | | |
1610 | | int ossl_provider_set_operation_bit(OSSL_PROVIDER *provider, size_t bitnum) |
1611 | 482 | { |
1612 | 482 | size_t byte = bitnum / 8; |
1613 | 482 | unsigned char bit = (1 << (bitnum % 8)) & 0xFF; |
1614 | | |
1615 | 482 | if (!CRYPTO_THREAD_write_lock(provider->opbits_lock)) |
1616 | 0 | return 0; |
1617 | 482 | if (provider->operation_bits_sz <= byte) { |
1618 | 171 | unsigned char *tmp = OPENSSL_realloc(provider->operation_bits, |
1619 | 171 | byte + 1); |
1620 | | |
1621 | 171 | if (tmp == NULL) { |
1622 | 0 | CRYPTO_THREAD_unlock(provider->opbits_lock); |
1623 | 0 | ERR_raise(ERR_LIB_CRYPTO, ERR_R_MALLOC_FAILURE); |
1624 | 0 | return 0; |
1625 | 0 | } |
1626 | 171 | provider->operation_bits = tmp; |
1627 | 171 | memset(provider->operation_bits + provider->operation_bits_sz, |
1628 | 171 | '\0', byte + 1 - provider->operation_bits_sz); |
1629 | 171 | provider->operation_bits_sz = byte + 1; |
1630 | 171 | } |
1631 | 482 | provider->operation_bits[byte] |= bit; |
1632 | 482 | CRYPTO_THREAD_unlock(provider->opbits_lock); |
1633 | 482 | return 1; |
1634 | 482 | } |
1635 | | |
1636 | | int ossl_provider_test_operation_bit(OSSL_PROVIDER *provider, size_t bitnum, |
1637 | | int *result) |
1638 | 5.28M | { |
1639 | 5.28M | size_t byte = bitnum / 8; |
1640 | 5.28M | unsigned char bit = (1 << (bitnum % 8)) & 0xFF; |
1641 | | |
1642 | 5.28M | if (!ossl_assert(result != NULL)) { |
1643 | 0 | ERR_raise(ERR_LIB_CRYPTO, ERR_R_PASSED_NULL_PARAMETER); |
1644 | 0 | return 0; |
1645 | 0 | } |
1646 | | |
1647 | 5.28M | *result = 0; |
1648 | 5.28M | if (!CRYPTO_THREAD_read_lock(provider->opbits_lock)) |
1649 | 0 | return 0; |
1650 | 5.28M | if (provider->operation_bits_sz > byte) |
1651 | 5.28M | *result = ((provider->operation_bits[byte] & bit) != 0); |
1652 | 5.28M | CRYPTO_THREAD_unlock(provider->opbits_lock); |
1653 | 5.28M | return 1; |
1654 | 5.28M | } |
1655 | | |
1656 | | #ifndef FIPS_MODULE |
1657 | | const OSSL_CORE_HANDLE *ossl_provider_get_parent(OSSL_PROVIDER *prov) |
1658 | 0 | { |
1659 | 0 | return prov->handle; |
1660 | 0 | } |
1661 | | |
1662 | | int ossl_provider_is_child(const OSSL_PROVIDER *prov) |
1663 | 0 | { |
1664 | 0 | return prov->ischild; |
1665 | 0 | } |
1666 | | |
1667 | | int ossl_provider_set_child(OSSL_PROVIDER *prov, const OSSL_CORE_HANDLE *handle) |
1668 | 0 | { |
1669 | 0 | prov->handle = handle; |
1670 | 0 | prov->ischild = 1; |
1671 | |
|
1672 | 0 | return 1; |
1673 | 0 | } |
1674 | | |
1675 | | int ossl_provider_default_props_update(OSSL_LIB_CTX *libctx, const char *props) |
1676 | 0 | { |
1677 | 0 | #ifndef FIPS_MODULE |
1678 | 0 | struct provider_store_st *store = NULL; |
1679 | 0 | int i, max; |
1680 | 0 | OSSL_PROVIDER_CHILD_CB *child_cb; |
1681 | |
|
1682 | 0 | if ((store = get_provider_store(libctx)) == NULL) |
1683 | 0 | return 0; |
1684 | | |
1685 | 0 | if (!CRYPTO_THREAD_read_lock(store->lock)) |
1686 | 0 | return 0; |
1687 | | |
1688 | 0 | max = sk_OSSL_PROVIDER_CHILD_CB_num(store->child_cbs); |
1689 | 0 | for (i = 0; i < max; i++) { |
1690 | 0 | child_cb = sk_OSSL_PROVIDER_CHILD_CB_value(store->child_cbs, i); |
1691 | 0 | child_cb->global_props_cb(props, child_cb->cbdata); |
1692 | 0 | } |
1693 | |
|
1694 | 0 | CRYPTO_THREAD_unlock(store->lock); |
1695 | 0 | #endif |
1696 | 0 | return 1; |
1697 | 0 | } |
1698 | | |
1699 | | static int ossl_provider_register_child_cb(const OSSL_CORE_HANDLE *handle, |
1700 | | int (*create_cb)( |
1701 | | const OSSL_CORE_HANDLE *provider, |
1702 | | void *cbdata), |
1703 | | int (*remove_cb)( |
1704 | | const OSSL_CORE_HANDLE *provider, |
1705 | | void *cbdata), |
1706 | | int (*global_props_cb)( |
1707 | | const char *props, |
1708 | | void *cbdata), |
1709 | | void *cbdata) |
1710 | 0 | { |
1711 | | /* |
1712 | | * This is really an OSSL_PROVIDER that we created and cast to |
1713 | | * OSSL_CORE_HANDLE originally. Therefore it is safe to cast it back. |
1714 | | */ |
1715 | 0 | OSSL_PROVIDER *thisprov = (OSSL_PROVIDER *)handle; |
1716 | 0 | OSSL_PROVIDER *prov; |
1717 | 0 | OSSL_LIB_CTX *libctx = thisprov->libctx; |
1718 | 0 | struct provider_store_st *store = NULL; |
1719 | 0 | int ret = 0, i, max; |
1720 | 0 | OSSL_PROVIDER_CHILD_CB *child_cb; |
1721 | 0 | char *propsstr = NULL; |
1722 | |
|
1723 | 0 | if ((store = get_provider_store(libctx)) == NULL) |
1724 | 0 | return 0; |
1725 | | |
1726 | 0 | child_cb = OPENSSL_malloc(sizeof(*child_cb)); |
1727 | 0 | if (child_cb == NULL) |
1728 | 0 | return 0; |
1729 | 0 | child_cb->prov = thisprov; |
1730 | 0 | child_cb->create_cb = create_cb; |
1731 | 0 | child_cb->remove_cb = remove_cb; |
1732 | 0 | child_cb->global_props_cb = global_props_cb; |
1733 | 0 | child_cb->cbdata = cbdata; |
1734 | |
|
1735 | 0 | if (!CRYPTO_THREAD_write_lock(store->lock)) { |
1736 | 0 | OPENSSL_free(child_cb); |
1737 | 0 | return 0; |
1738 | 0 | } |
1739 | 0 | propsstr = evp_get_global_properties_str(libctx, 0); |
1740 | |
|
1741 | 0 | if (propsstr != NULL) { |
1742 | 0 | global_props_cb(propsstr, cbdata); |
1743 | 0 | OPENSSL_free(propsstr); |
1744 | 0 | } |
1745 | 0 | max = sk_OSSL_PROVIDER_num(store->providers); |
1746 | 0 | for (i = 0; i < max; i++) { |
1747 | 0 | int activated; |
1748 | |
|
1749 | 0 | prov = sk_OSSL_PROVIDER_value(store->providers, i); |
1750 | |
|
1751 | 0 | if (!CRYPTO_THREAD_read_lock(prov->flag_lock)) |
1752 | 0 | break; |
1753 | 0 | activated = prov->flag_activated; |
1754 | 0 | CRYPTO_THREAD_unlock(prov->flag_lock); |
1755 | | /* |
1756 | | * We hold the store lock while calling the user callback. This means |
1757 | | * that the user callback must be short and simple and not do anything |
1758 | | * likely to cause a deadlock. We don't hold the flag_lock during this |
1759 | | * call. In theory this means that another thread could deactivate it |
1760 | | * while we are calling create. This is ok because the other thread |
1761 | | * will also call remove_cb, but won't be able to do so until we release |
1762 | | * the store lock. |
1763 | | */ |
1764 | 0 | if (activated && !create_cb((OSSL_CORE_HANDLE *)prov, cbdata)) |
1765 | 0 | break; |
1766 | 0 | } |
1767 | 0 | if (i == max) { |
1768 | | /* Success */ |
1769 | 0 | ret = sk_OSSL_PROVIDER_CHILD_CB_push(store->child_cbs, child_cb); |
1770 | 0 | } |
1771 | 0 | if (i != max || ret <= 0) { |
1772 | | /* Failed during creation. Remove everything we just added */ |
1773 | 0 | for (; i >= 0; i--) { |
1774 | 0 | prov = sk_OSSL_PROVIDER_value(store->providers, i); |
1775 | 0 | remove_cb((OSSL_CORE_HANDLE *)prov, cbdata); |
1776 | 0 | } |
1777 | 0 | OPENSSL_free(child_cb); |
1778 | 0 | ret = 0; |
1779 | 0 | } |
1780 | 0 | CRYPTO_THREAD_unlock(store->lock); |
1781 | |
|
1782 | 0 | return ret; |
1783 | 0 | } |
1784 | | |
1785 | | static void ossl_provider_deregister_child_cb(const OSSL_CORE_HANDLE *handle) |
1786 | 0 | { |
1787 | | /* |
1788 | | * This is really an OSSL_PROVIDER that we created and cast to |
1789 | | * OSSL_CORE_HANDLE originally. Therefore it is safe to cast it back. |
1790 | | */ |
1791 | 0 | OSSL_PROVIDER *thisprov = (OSSL_PROVIDER *)handle; |
1792 | 0 | OSSL_LIB_CTX *libctx = thisprov->libctx; |
1793 | 0 | struct provider_store_st *store = NULL; |
1794 | 0 | int i, max; |
1795 | 0 | OSSL_PROVIDER_CHILD_CB *child_cb; |
1796 | |
|
1797 | 0 | if ((store = get_provider_store(libctx)) == NULL) |
1798 | 0 | return; |
1799 | | |
1800 | 0 | if (!CRYPTO_THREAD_write_lock(store->lock)) |
1801 | 0 | return; |
1802 | 0 | max = sk_OSSL_PROVIDER_CHILD_CB_num(store->child_cbs); |
1803 | 0 | for (i = 0; i < max; i++) { |
1804 | 0 | child_cb = sk_OSSL_PROVIDER_CHILD_CB_value(store->child_cbs, i); |
1805 | 0 | if (child_cb->prov == thisprov) { |
1806 | | /* Found an entry */ |
1807 | 0 | sk_OSSL_PROVIDER_CHILD_CB_delete(store->child_cbs, i); |
1808 | 0 | OPENSSL_free(child_cb); |
1809 | 0 | break; |
1810 | 0 | } |
1811 | 0 | } |
1812 | 0 | CRYPTO_THREAD_unlock(store->lock); |
1813 | 0 | } |
1814 | | #endif |
1815 | | |
1816 | | /*- |
1817 | | * Core functions for the provider |
1818 | | * =============================== |
1819 | | * |
1820 | | * This is the set of functions that the core makes available to the provider |
1821 | | */ |
1822 | | |
1823 | | /* |
1824 | | * This returns a list of Provider Object parameters with their types, for |
1825 | | * discovery. We do not expect that many providers will use this, but one |
1826 | | * never knows. |
1827 | | */ |
1828 | | static const OSSL_PARAM param_types[] = { |
1829 | | OSSL_PARAM_DEFN(OSSL_PROV_PARAM_CORE_VERSION, OSSL_PARAM_UTF8_PTR, NULL, 0), |
1830 | | OSSL_PARAM_DEFN(OSSL_PROV_PARAM_CORE_PROV_NAME, OSSL_PARAM_UTF8_PTR, |
1831 | | NULL, 0), |
1832 | | #ifndef FIPS_MODULE |
1833 | | OSSL_PARAM_DEFN(OSSL_PROV_PARAM_CORE_MODULE_FILENAME, OSSL_PARAM_UTF8_PTR, |
1834 | | NULL, 0), |
1835 | | #endif |
1836 | | OSSL_PARAM_END |
1837 | | }; |
1838 | | |
1839 | | /* |
1840 | | * Forward declare all the functions that are provided aa dispatch. |
1841 | | * This ensures that the compiler will complain if they aren't defined |
1842 | | * with the correct signature. |
1843 | | */ |
1844 | | static OSSL_FUNC_core_gettable_params_fn core_gettable_params; |
1845 | | static OSSL_FUNC_core_get_params_fn core_get_params; |
1846 | | static OSSL_FUNC_core_get_libctx_fn core_get_libctx; |
1847 | | static OSSL_FUNC_core_thread_start_fn core_thread_start; |
1848 | | #ifndef FIPS_MODULE |
1849 | | static OSSL_FUNC_core_new_error_fn core_new_error; |
1850 | | static OSSL_FUNC_core_set_error_debug_fn core_set_error_debug; |
1851 | | static OSSL_FUNC_core_vset_error_fn core_vset_error; |
1852 | | static OSSL_FUNC_core_set_error_mark_fn core_set_error_mark; |
1853 | | static OSSL_FUNC_core_clear_last_error_mark_fn core_clear_last_error_mark; |
1854 | | static OSSL_FUNC_core_pop_error_to_mark_fn core_pop_error_to_mark; |
1855 | | OSSL_FUNC_BIO_new_file_fn ossl_core_bio_new_file; |
1856 | | OSSL_FUNC_BIO_new_membuf_fn ossl_core_bio_new_mem_buf; |
1857 | | OSSL_FUNC_BIO_read_ex_fn ossl_core_bio_read_ex; |
1858 | | OSSL_FUNC_BIO_write_ex_fn ossl_core_bio_write_ex; |
1859 | | OSSL_FUNC_BIO_gets_fn ossl_core_bio_gets; |
1860 | | OSSL_FUNC_BIO_puts_fn ossl_core_bio_puts; |
1861 | | OSSL_FUNC_BIO_up_ref_fn ossl_core_bio_up_ref; |
1862 | | OSSL_FUNC_BIO_free_fn ossl_core_bio_free; |
1863 | | OSSL_FUNC_BIO_vprintf_fn ossl_core_bio_vprintf; |
1864 | | OSSL_FUNC_BIO_vsnprintf_fn BIO_vsnprintf; |
1865 | | static OSSL_FUNC_self_test_cb_fn core_self_test_get_callback; |
1866 | | static OSSL_FUNC_get_entropy_fn rand_get_entropy; |
1867 | | static OSSL_FUNC_get_user_entropy_fn rand_get_user_entropy; |
1868 | | static OSSL_FUNC_cleanup_entropy_fn rand_cleanup_entropy; |
1869 | | static OSSL_FUNC_cleanup_user_entropy_fn rand_cleanup_user_entropy; |
1870 | | static OSSL_FUNC_get_nonce_fn rand_get_nonce; |
1871 | | static OSSL_FUNC_get_user_nonce_fn rand_get_user_nonce; |
1872 | | static OSSL_FUNC_cleanup_nonce_fn rand_cleanup_nonce; |
1873 | | static OSSL_FUNC_cleanup_user_nonce_fn rand_cleanup_user_nonce; |
1874 | | #endif |
1875 | | OSSL_FUNC_CRYPTO_malloc_fn CRYPTO_malloc; |
1876 | | OSSL_FUNC_CRYPTO_zalloc_fn CRYPTO_zalloc; |
1877 | | OSSL_FUNC_CRYPTO_free_fn CRYPTO_free; |
1878 | | OSSL_FUNC_CRYPTO_clear_free_fn CRYPTO_clear_free; |
1879 | | OSSL_FUNC_CRYPTO_realloc_fn CRYPTO_realloc; |
1880 | | OSSL_FUNC_CRYPTO_clear_realloc_fn CRYPTO_clear_realloc; |
1881 | | OSSL_FUNC_CRYPTO_secure_malloc_fn CRYPTO_secure_malloc; |
1882 | | OSSL_FUNC_CRYPTO_secure_zalloc_fn CRYPTO_secure_zalloc; |
1883 | | OSSL_FUNC_CRYPTO_secure_free_fn CRYPTO_secure_free; |
1884 | | OSSL_FUNC_CRYPTO_secure_clear_free_fn CRYPTO_secure_clear_free; |
1885 | | OSSL_FUNC_CRYPTO_secure_allocated_fn CRYPTO_secure_allocated; |
1886 | | OSSL_FUNC_OPENSSL_cleanse_fn OPENSSL_cleanse; |
1887 | | #ifndef FIPS_MODULE |
1888 | | OSSL_FUNC_provider_register_child_cb_fn ossl_provider_register_child_cb; |
1889 | | OSSL_FUNC_provider_deregister_child_cb_fn ossl_provider_deregister_child_cb; |
1890 | | static OSSL_FUNC_provider_name_fn core_provider_get0_name; |
1891 | | static OSSL_FUNC_provider_get0_provider_ctx_fn core_provider_get0_provider_ctx; |
1892 | | static OSSL_FUNC_provider_get0_dispatch_fn core_provider_get0_dispatch; |
1893 | | static OSSL_FUNC_provider_up_ref_fn core_provider_up_ref_intern; |
1894 | | static OSSL_FUNC_provider_free_fn core_provider_free_intern; |
1895 | | static OSSL_FUNC_core_obj_add_sigid_fn core_obj_add_sigid; |
1896 | | static OSSL_FUNC_core_obj_create_fn core_obj_create; |
1897 | | #endif |
1898 | | |
1899 | | static const OSSL_PARAM *core_gettable_params(const OSSL_CORE_HANDLE *handle) |
1900 | 0 | { |
1901 | 0 | return param_types; |
1902 | 0 | } |
1903 | | |
1904 | | static int core_get_params(const OSSL_CORE_HANDLE *handle, OSSL_PARAM params[]) |
1905 | 0 | { |
1906 | 0 | int i; |
1907 | 0 | OSSL_PARAM *p; |
1908 | | /* |
1909 | | * We created this object originally and we know it is actually an |
1910 | | * OSSL_PROVIDER *, so the cast is safe |
1911 | | */ |
1912 | 0 | OSSL_PROVIDER *prov = (OSSL_PROVIDER *)handle; |
1913 | |
|
1914 | 0 | if ((p = OSSL_PARAM_locate(params, OSSL_PROV_PARAM_CORE_VERSION)) != NULL) |
1915 | 0 | OSSL_PARAM_set_utf8_ptr(p, OPENSSL_VERSION_STR); |
1916 | 0 | if ((p = OSSL_PARAM_locate(params, OSSL_PROV_PARAM_CORE_PROV_NAME)) != NULL) |
1917 | 0 | OSSL_PARAM_set_utf8_ptr(p, prov->name); |
1918 | |
|
1919 | 0 | #ifndef FIPS_MODULE |
1920 | 0 | if ((p = OSSL_PARAM_locate(params, |
1921 | 0 | OSSL_PROV_PARAM_CORE_MODULE_FILENAME)) != NULL) |
1922 | 0 | OSSL_PARAM_set_utf8_ptr(p, ossl_provider_module_path(prov)); |
1923 | 0 | #endif |
1924 | |
|
1925 | 0 | if (prov->parameters == NULL) |
1926 | 0 | return 1; |
1927 | | |
1928 | 0 | for (i = 0; i < sk_INFOPAIR_num(prov->parameters); i++) { |
1929 | 0 | INFOPAIR *pair = sk_INFOPAIR_value(prov->parameters, i); |
1930 | |
|
1931 | 0 | if ((p = OSSL_PARAM_locate(params, pair->name)) != NULL) |
1932 | 0 | OSSL_PARAM_set_utf8_ptr(p, pair->value); |
1933 | 0 | } |
1934 | 0 | return 1; |
1935 | 0 | } |
1936 | | |
1937 | | static OPENSSL_CORE_CTX *core_get_libctx(const OSSL_CORE_HANDLE *handle) |
1938 | 661 | { |
1939 | | /* |
1940 | | * We created this object originally and we know it is actually an |
1941 | | * OSSL_PROVIDER *, so the cast is safe |
1942 | | */ |
1943 | 661 | OSSL_PROVIDER *prov = (OSSL_PROVIDER *)handle; |
1944 | | |
1945 | | /* |
1946 | | * Using ossl_provider_libctx would be wrong as that returns |
1947 | | * NULL for |prov| == NULL and NULL libctx has a special meaning |
1948 | | * that does not apply here. Here |prov| == NULL can happen only in |
1949 | | * case of a coding error. |
1950 | | */ |
1951 | 661 | assert(prov != NULL); |
1952 | 661 | return (OPENSSL_CORE_CTX *)prov->libctx; |
1953 | 661 | } |
1954 | | |
1955 | | static int core_thread_start(const OSSL_CORE_HANDLE *handle, |
1956 | | OSSL_thread_stop_handler_fn handfn, |
1957 | | void *arg) |
1958 | 0 | { |
1959 | | /* |
1960 | | * We created this object originally and we know it is actually an |
1961 | | * OSSL_PROVIDER *, so the cast is safe |
1962 | | */ |
1963 | 0 | OSSL_PROVIDER *prov = (OSSL_PROVIDER *)handle; |
1964 | |
|
1965 | 0 | return ossl_init_thread_start(prov, arg, handfn); |
1966 | 0 | } |
1967 | | |
1968 | | /* |
1969 | | * The FIPS module inner provider doesn't implement these. They aren't |
1970 | | * needed there, since the FIPS module upcalls are always the outer provider |
1971 | | * ones. |
1972 | | */ |
1973 | | #ifndef FIPS_MODULE |
1974 | | /* |
1975 | | * These error functions should use |handle| to select the proper |
1976 | | * library context to report in the correct error stack if error |
1977 | | * stacks become tied to the library context. |
1978 | | * We cannot currently do that since there's no support for it in the |
1979 | | * ERR subsystem. |
1980 | | */ |
1981 | | static void core_new_error(const OSSL_CORE_HANDLE *handle) |
1982 | 0 | { |
1983 | 0 | ERR_new(); |
1984 | 0 | } |
1985 | | |
1986 | | static void core_set_error_debug(const OSSL_CORE_HANDLE *handle, |
1987 | | const char *file, int line, const char *func) |
1988 | 0 | { |
1989 | 0 | ERR_set_debug(file, line, func); |
1990 | 0 | } |
1991 | | |
1992 | | static void core_vset_error(const OSSL_CORE_HANDLE *handle, |
1993 | | uint32_t reason, const char *fmt, va_list args) |
1994 | 0 | { |
1995 | | /* |
1996 | | * We created this object originally and we know it is actually an |
1997 | | * OSSL_PROVIDER *, so the cast is safe |
1998 | | */ |
1999 | 0 | OSSL_PROVIDER *prov = (OSSL_PROVIDER *)handle; |
2000 | | |
2001 | | /* |
2002 | | * If the uppermost 8 bits are non-zero, it's an OpenSSL library |
2003 | | * error and will be treated as such. Otherwise, it's a new style |
2004 | | * provider error and will be treated as such. |
2005 | | */ |
2006 | 0 | if (ERR_GET_LIB(reason) != 0) { |
2007 | 0 | ERR_vset_error(ERR_GET_LIB(reason), ERR_GET_REASON(reason), fmt, args); |
2008 | 0 | } else { |
2009 | 0 | ERR_vset_error(prov->error_lib, (int)reason, fmt, args); |
2010 | 0 | } |
2011 | 0 | } |
2012 | | |
2013 | | static int core_set_error_mark(const OSSL_CORE_HANDLE *handle) |
2014 | 0 | { |
2015 | 0 | return ERR_set_mark(); |
2016 | 0 | } |
2017 | | |
2018 | | static int core_clear_last_error_mark(const OSSL_CORE_HANDLE *handle) |
2019 | 0 | { |
2020 | 0 | return ERR_clear_last_mark(); |
2021 | 0 | } |
2022 | | |
2023 | | static int core_pop_error_to_mark(const OSSL_CORE_HANDLE *handle) |
2024 | 0 | { |
2025 | 0 | return ERR_pop_to_mark(); |
2026 | 0 | } |
2027 | | |
2028 | | static void core_self_test_get_callback(OPENSSL_CORE_CTX *libctx, |
2029 | | OSSL_CALLBACK **cb, void **cbarg) |
2030 | 0 | { |
2031 | 0 | OSSL_SELF_TEST_get_callback((OSSL_LIB_CTX *)libctx, cb, cbarg); |
2032 | 0 | } |
2033 | | |
2034 | | static size_t rand_get_entropy(const OSSL_CORE_HANDLE *handle, |
2035 | | unsigned char **pout, int entropy, |
2036 | | size_t min_len, size_t max_len) |
2037 | 0 | { |
2038 | 0 | return ossl_rand_get_entropy((OSSL_LIB_CTX *)core_get_libctx(handle), |
2039 | 0 | pout, entropy, min_len, max_len); |
2040 | 0 | } |
2041 | | |
2042 | | static size_t rand_get_user_entropy(const OSSL_CORE_HANDLE *handle, |
2043 | | unsigned char **pout, int entropy, |
2044 | | size_t min_len, size_t max_len) |
2045 | 208 | { |
2046 | 208 | return ossl_rand_get_user_entropy((OSSL_LIB_CTX *)core_get_libctx(handle), |
2047 | 208 | pout, entropy, min_len, max_len); |
2048 | 208 | } |
2049 | | |
2050 | | static void rand_cleanup_entropy(const OSSL_CORE_HANDLE *handle, |
2051 | | unsigned char *buf, size_t len) |
2052 | 0 | { |
2053 | 0 | ossl_rand_cleanup_entropy((OSSL_LIB_CTX *)core_get_libctx(handle), |
2054 | 0 | buf, len); |
2055 | 0 | } |
2056 | | |
2057 | | static void rand_cleanup_user_entropy(const OSSL_CORE_HANDLE *handle, |
2058 | | unsigned char *buf, size_t len) |
2059 | 208 | { |
2060 | 208 | ossl_rand_cleanup_user_entropy((OSSL_LIB_CTX *)core_get_libctx(handle), |
2061 | 208 | buf, len); |
2062 | 208 | } |
2063 | | |
2064 | | static size_t rand_get_nonce(const OSSL_CORE_HANDLE *handle, |
2065 | | unsigned char **pout, |
2066 | | size_t min_len, size_t max_len, |
2067 | | const void *salt, size_t salt_len) |
2068 | 0 | { |
2069 | 0 | return ossl_rand_get_nonce((OSSL_LIB_CTX *)core_get_libctx(handle), |
2070 | 0 | pout, min_len, max_len, salt, salt_len); |
2071 | 0 | } |
2072 | | |
2073 | | static size_t rand_get_user_nonce(const OSSL_CORE_HANDLE *handle, |
2074 | | unsigned char **pout, |
2075 | | size_t min_len, size_t max_len, |
2076 | | const void *salt, size_t salt_len) |
2077 | 100 | { |
2078 | 100 | return ossl_rand_get_user_nonce((OSSL_LIB_CTX *)core_get_libctx(handle), |
2079 | 100 | pout, min_len, max_len, salt, salt_len); |
2080 | 100 | } |
2081 | | |
2082 | | static void rand_cleanup_nonce(const OSSL_CORE_HANDLE *handle, |
2083 | | unsigned char *buf, size_t len) |
2084 | 0 | { |
2085 | 0 | ossl_rand_cleanup_nonce((OSSL_LIB_CTX *)core_get_libctx(handle), |
2086 | 0 | buf, len); |
2087 | 0 | } |
2088 | | |
2089 | | static void rand_cleanup_user_nonce(const OSSL_CORE_HANDLE *handle, |
2090 | | unsigned char *buf, size_t len) |
2091 | 100 | { |
2092 | 100 | ossl_rand_cleanup_user_nonce((OSSL_LIB_CTX *)core_get_libctx(handle), |
2093 | 100 | buf, len); |
2094 | 100 | } |
2095 | | |
2096 | | static const char *core_provider_get0_name(const OSSL_CORE_HANDLE *prov) |
2097 | 0 | { |
2098 | 0 | return OSSL_PROVIDER_get0_name((const OSSL_PROVIDER *)prov); |
2099 | 0 | } |
2100 | | |
2101 | | static void *core_provider_get0_provider_ctx(const OSSL_CORE_HANDLE *prov) |
2102 | 0 | { |
2103 | 0 | return OSSL_PROVIDER_get0_provider_ctx((const OSSL_PROVIDER *)prov); |
2104 | 0 | } |
2105 | | |
2106 | | static const OSSL_DISPATCH * |
2107 | | core_provider_get0_dispatch(const OSSL_CORE_HANDLE *prov) |
2108 | 0 | { |
2109 | 0 | return OSSL_PROVIDER_get0_dispatch((const OSSL_PROVIDER *)prov); |
2110 | 0 | } |
2111 | | |
2112 | | static int core_provider_up_ref_intern(const OSSL_CORE_HANDLE *prov, |
2113 | | int activate) |
2114 | 0 | { |
2115 | 0 | return provider_up_ref_intern((OSSL_PROVIDER *)prov, activate); |
2116 | 0 | } |
2117 | | |
2118 | | static int core_provider_free_intern(const OSSL_CORE_HANDLE *prov, |
2119 | | int deactivate) |
2120 | 0 | { |
2121 | 0 | return provider_free_intern((OSSL_PROVIDER *)prov, deactivate); |
2122 | 0 | } |
2123 | | |
2124 | | static int core_obj_add_sigid(const OSSL_CORE_HANDLE *prov, |
2125 | | const char *sign_name, const char *digest_name, |
2126 | | const char *pkey_name) |
2127 | 0 | { |
2128 | 0 | int sign_nid = OBJ_txt2nid(sign_name); |
2129 | 0 | int digest_nid = NID_undef; |
2130 | 0 | int pkey_nid = OBJ_txt2nid(pkey_name); |
2131 | |
|
2132 | 0 | if (digest_name != NULL && digest_name[0] != '\0' |
2133 | 0 | && (digest_nid = OBJ_txt2nid(digest_name)) == NID_undef) |
2134 | 0 | return 0; |
2135 | | |
2136 | 0 | if (sign_nid == NID_undef) |
2137 | 0 | return 0; |
2138 | | |
2139 | | /* |
2140 | | * Check if it already exists. This is a success if so (even if we don't |
2141 | | * have nids for the digest/pkey) |
2142 | | */ |
2143 | 0 | if (OBJ_find_sigid_algs(sign_nid, NULL, NULL)) |
2144 | 0 | return 1; |
2145 | | |
2146 | 0 | if (pkey_nid == NID_undef) |
2147 | 0 | return 0; |
2148 | | |
2149 | 0 | return OBJ_add_sigid(sign_nid, digest_nid, pkey_nid); |
2150 | 0 | } |
2151 | | |
2152 | | static int core_obj_create(const OSSL_CORE_HANDLE *prov, const char *oid, |
2153 | | const char *sn, const char *ln) |
2154 | 0 | { |
2155 | | /* Check if it already exists and create it if not */ |
2156 | 0 | return OBJ_txt2nid(oid) != NID_undef |
2157 | 0 | || OBJ_create(oid, sn, ln) != NID_undef; |
2158 | 0 | } |
2159 | | #endif /* FIPS_MODULE */ |
2160 | | |
2161 | | /* |
2162 | | * Functions provided by the core. |
2163 | | */ |
2164 | | static const OSSL_DISPATCH core_dispatch_[] = { |
2165 | | { OSSL_FUNC_CORE_GETTABLE_PARAMS, (void (*)(void))core_gettable_params }, |
2166 | | { OSSL_FUNC_CORE_GET_PARAMS, (void (*)(void))core_get_params }, |
2167 | | { OSSL_FUNC_CORE_GET_LIBCTX, (void (*)(void))core_get_libctx }, |
2168 | | { OSSL_FUNC_CORE_THREAD_START, (void (*)(void))core_thread_start }, |
2169 | | #ifndef FIPS_MODULE |
2170 | | { OSSL_FUNC_CORE_NEW_ERROR, (void (*)(void))core_new_error }, |
2171 | | { OSSL_FUNC_CORE_SET_ERROR_DEBUG, (void (*)(void))core_set_error_debug }, |
2172 | | { OSSL_FUNC_CORE_VSET_ERROR, (void (*)(void))core_vset_error }, |
2173 | | { OSSL_FUNC_CORE_SET_ERROR_MARK, (void (*)(void))core_set_error_mark }, |
2174 | | { OSSL_FUNC_CORE_CLEAR_LAST_ERROR_MARK, |
2175 | | (void (*)(void))core_clear_last_error_mark }, |
2176 | | { OSSL_FUNC_CORE_POP_ERROR_TO_MARK, (void (*)(void))core_pop_error_to_mark }, |
2177 | | { OSSL_FUNC_BIO_NEW_FILE, (void (*)(void))ossl_core_bio_new_file }, |
2178 | | { OSSL_FUNC_BIO_NEW_MEMBUF, (void (*)(void))ossl_core_bio_new_mem_buf }, |
2179 | | { OSSL_FUNC_BIO_READ_EX, (void (*)(void))ossl_core_bio_read_ex }, |
2180 | | { OSSL_FUNC_BIO_WRITE_EX, (void (*)(void))ossl_core_bio_write_ex }, |
2181 | | { OSSL_FUNC_BIO_GETS, (void (*)(void))ossl_core_bio_gets }, |
2182 | | { OSSL_FUNC_BIO_PUTS, (void (*)(void))ossl_core_bio_puts }, |
2183 | | { OSSL_FUNC_BIO_CTRL, (void (*)(void))ossl_core_bio_ctrl }, |
2184 | | { OSSL_FUNC_BIO_UP_REF, (void (*)(void))ossl_core_bio_up_ref }, |
2185 | | { OSSL_FUNC_BIO_FREE, (void (*)(void))ossl_core_bio_free }, |
2186 | | { OSSL_FUNC_BIO_VPRINTF, (void (*)(void))ossl_core_bio_vprintf }, |
2187 | | { OSSL_FUNC_BIO_VSNPRINTF, (void (*)(void))BIO_vsnprintf }, |
2188 | | { OSSL_FUNC_SELF_TEST_CB, (void (*)(void))core_self_test_get_callback }, |
2189 | | { OSSL_FUNC_GET_ENTROPY, (void (*)(void))rand_get_entropy }, |
2190 | | { OSSL_FUNC_GET_USER_ENTROPY, (void (*)(void))rand_get_user_entropy }, |
2191 | | { OSSL_FUNC_CLEANUP_ENTROPY, (void (*)(void))rand_cleanup_entropy }, |
2192 | | { OSSL_FUNC_CLEANUP_USER_ENTROPY, (void (*)(void))rand_cleanup_user_entropy }, |
2193 | | { OSSL_FUNC_GET_NONCE, (void (*)(void))rand_get_nonce }, |
2194 | | { OSSL_FUNC_GET_USER_NONCE, (void (*)(void))rand_get_user_nonce }, |
2195 | | { OSSL_FUNC_CLEANUP_NONCE, (void (*)(void))rand_cleanup_nonce }, |
2196 | | { OSSL_FUNC_CLEANUP_USER_NONCE, (void (*)(void))rand_cleanup_user_nonce }, |
2197 | | #endif |
2198 | | { OSSL_FUNC_CRYPTO_MALLOC, (void (*)(void))CRYPTO_malloc }, |
2199 | | { OSSL_FUNC_CRYPTO_ZALLOC, (void (*)(void))CRYPTO_zalloc }, |
2200 | | { OSSL_FUNC_CRYPTO_FREE, (void (*)(void))CRYPTO_free }, |
2201 | | { OSSL_FUNC_CRYPTO_CLEAR_FREE, (void (*)(void))CRYPTO_clear_free }, |
2202 | | { OSSL_FUNC_CRYPTO_REALLOC, (void (*)(void))CRYPTO_realloc }, |
2203 | | { OSSL_FUNC_CRYPTO_CLEAR_REALLOC, (void (*)(void))CRYPTO_clear_realloc }, |
2204 | | { OSSL_FUNC_CRYPTO_SECURE_MALLOC, (void (*)(void))CRYPTO_secure_malloc }, |
2205 | | { OSSL_FUNC_CRYPTO_SECURE_ZALLOC, (void (*)(void))CRYPTO_secure_zalloc }, |
2206 | | { OSSL_FUNC_CRYPTO_SECURE_FREE, (void (*)(void))CRYPTO_secure_free }, |
2207 | | { OSSL_FUNC_CRYPTO_SECURE_CLEAR_FREE, |
2208 | | (void (*)(void))CRYPTO_secure_clear_free }, |
2209 | | { OSSL_FUNC_CRYPTO_SECURE_ALLOCATED, |
2210 | | (void (*)(void))CRYPTO_secure_allocated }, |
2211 | | { OSSL_FUNC_OPENSSL_CLEANSE, (void (*)(void))OPENSSL_cleanse }, |
2212 | | #ifndef FIPS_MODULE |
2213 | | { OSSL_FUNC_PROVIDER_REGISTER_CHILD_CB, |
2214 | | (void (*)(void))ossl_provider_register_child_cb }, |
2215 | | { OSSL_FUNC_PROVIDER_DEREGISTER_CHILD_CB, |
2216 | | (void (*)(void))ossl_provider_deregister_child_cb }, |
2217 | | { OSSL_FUNC_PROVIDER_NAME, |
2218 | | (void (*)(void))core_provider_get0_name }, |
2219 | | { OSSL_FUNC_PROVIDER_GET0_PROVIDER_CTX, |
2220 | | (void (*)(void))core_provider_get0_provider_ctx }, |
2221 | | { OSSL_FUNC_PROVIDER_GET0_DISPATCH, |
2222 | | (void (*)(void))core_provider_get0_dispatch }, |
2223 | | { OSSL_FUNC_PROVIDER_UP_REF, |
2224 | | (void (*)(void))core_provider_up_ref_intern }, |
2225 | | { OSSL_FUNC_PROVIDER_FREE, |
2226 | | (void (*)(void))core_provider_free_intern }, |
2227 | | { OSSL_FUNC_CORE_OBJ_ADD_SIGID, (void (*)(void))core_obj_add_sigid }, |
2228 | | { OSSL_FUNC_CORE_OBJ_CREATE, (void (*)(void))core_obj_create }, |
2229 | | #endif |
2230 | | { 0, NULL } |
2231 | | }; |
2232 | | static const OSSL_DISPATCH *core_dispatch = core_dispatch_; |