provider_core.c 67 KB

12345678910111213141516171819202122232425262728293031323334353637383940414243444546474849505152535455565758596061626364656667686970717273747576777879808182838485868788899091929394959697989910010110210310410510610710810911011111211311411511611711811912012112212312412512612712812913013113213313413513613713813914014114214314414514614714814915015115215315415515615715815916016116216316416516616716816917017117217317417517617717817918018118218318418518618718818919019119219319419519619719819920020120220320420520620720820921021121221321421521621721821922022122222322422522622722822923023123223323423523623723823924024124224324424524624724824925025125225325425525625725825926026126226326426526626726826927027127227327427527627727827928028128228328428528628728828929029129229329429529629729829930030130230330430530630730830931031131231331431531631731831932032132232332432532632732832933033133233333433533633733833934034134234334434534634734834935035135235335435535635735835936036136236336436536636736836937037137237337437537637737837938038138238338438538638738838939039139239339439539639739839940040140240340440540640740840941041141241341441541641741841942042142242342442542642742842943043143243343443543643743843944044144244344444544644744844945045145245345445545645745845946046146246346446546646746846947047147247347447547647747847948048148248348448548648748848949049149249349449549649749849950050150250350450550650750850951051151251351451551651751851952052152252352452552652752852953053153253353453553653753853954054154254354454554654754854955055155255355455555655755855956056156256356456556656756856957057157257357457557657757857958058158258358458558658758858959059159259359459559659759859960060160260360460560660760860961061161261361461561661761861962062162262362462562662762862963063163263363463563663763863964064164264364464564664764864965065165265365465565665765865966066166266366466566666766866967067167267367467567667767867968068168268368468568668768868969069169269369469569669769869970070170270370470570670770870971071171271371471571671771871972072172272372472572672772872973073173273373473573673773873974074174274374474574674774874975075175275375475575675775875976076176276376476576676776876977077177277377477577677777877978078178278378478578678778878979079179279379479579679779879980080180280380480580680780880981081181281381481581681781881982082182282382482582682782882983083183283383483583683783883984084184284384484584684784884985085185285385485585685785885986086186286386486586686786886987087187287387487587687787887988088188288388488588688788888989089189289389489589689789889990090190290390490590690790890991091191291391491591691791891992092192292392492592692792892993093193293393493593693793893994094194294394494594694794894995095195295395495595695795895996096196296396496596696796896997097197297397497597697797897998098198298398498598698798898999099199299399499599699799899910001001100210031004100510061007100810091010101110121013101410151016101710181019102010211022102310241025102610271028102910301031103210331034103510361037103810391040104110421043104410451046104710481049105010511052105310541055105610571058105910601061106210631064106510661067106810691070107110721073107410751076107710781079108010811082108310841085108610871088108910901091109210931094109510961097109810991100110111021103110411051106110711081109111011111112111311141115111611171118111911201121112211231124112511261127112811291130113111321133113411351136113711381139114011411142114311441145114611471148114911501151115211531154115511561157115811591160116111621163116411651166116711681169117011711172117311741175117611771178117911801181118211831184118511861187118811891190119111921193119411951196119711981199120012011202120312041205120612071208120912101211121212131214121512161217121812191220122112221223122412251226122712281229123012311232123312341235123612371238123912401241124212431244124512461247124812491250125112521253125412551256125712581259126012611262126312641265126612671268126912701271127212731274127512761277127812791280128112821283128412851286128712881289129012911292129312941295129612971298129913001301130213031304130513061307130813091310131113121313131413151316131713181319132013211322132313241325132613271328132913301331133213331334133513361337133813391340134113421343134413451346134713481349135013511352135313541355135613571358135913601361136213631364136513661367136813691370137113721373137413751376137713781379138013811382138313841385138613871388138913901391139213931394139513961397139813991400140114021403140414051406140714081409141014111412141314141415141614171418141914201421142214231424142514261427142814291430143114321433143414351436143714381439144014411442144314441445144614471448144914501451145214531454145514561457145814591460146114621463146414651466146714681469147014711472147314741475147614771478147914801481148214831484148514861487148814891490149114921493149414951496149714981499150015011502150315041505150615071508150915101511151215131514151515161517151815191520152115221523152415251526152715281529153015311532153315341535153615371538153915401541154215431544154515461547154815491550155115521553155415551556155715581559156015611562156315641565156615671568156915701571157215731574157515761577157815791580158115821583158415851586158715881589159015911592159315941595159615971598159916001601160216031604160516061607160816091610161116121613161416151616161716181619162016211622162316241625162616271628162916301631163216331634163516361637163816391640164116421643164416451646164716481649165016511652165316541655165616571658165916601661166216631664166516661667166816691670167116721673167416751676167716781679168016811682168316841685168616871688168916901691169216931694169516961697169816991700170117021703170417051706170717081709171017111712171317141715171617171718171917201721172217231724172517261727172817291730173117321733173417351736173717381739174017411742174317441745174617471748174917501751175217531754175517561757175817591760176117621763176417651766176717681769177017711772177317741775177617771778177917801781178217831784178517861787178817891790179117921793179417951796179717981799180018011802180318041805180618071808180918101811181218131814181518161817181818191820182118221823182418251826182718281829183018311832183318341835183618371838183918401841184218431844184518461847184818491850185118521853185418551856185718581859186018611862186318641865186618671868186918701871187218731874187518761877187818791880188118821883188418851886188718881889189018911892189318941895189618971898189919001901190219031904190519061907190819091910191119121913191419151916191719181919192019211922192319241925192619271928192919301931193219331934193519361937193819391940194119421943194419451946194719481949195019511952195319541955195619571958195919601961196219631964196519661967196819691970197119721973197419751976197719781979198019811982198319841985198619871988198919901991199219931994199519961997199819992000200120022003200420052006200720082009201020112012201320142015201620172018201920202021202220232024202520262027202820292030203120322033203420352036203720382039204020412042204320442045204620472048204920502051205220532054205520562057205820592060206120622063206420652066206720682069207020712072207320742075207620772078207920802081208220832084208520862087208820892090209120922093209420952096209720982099210021012102210321042105210621072108210921102111211221132114211521162117211821192120212121222123212421252126212721282129213021312132213321342135213621372138213921402141
  1. /*
  2. * Copyright 2019-2022 The OpenSSL Project Authors. All Rights Reserved.
  3. *
  4. * Licensed under the Apache License 2.0 (the "License"). You may not use
  5. * this file except in compliance with the License. You can obtain a copy
  6. * in the file LICENSE in the source distribution or at
  7. * https://www.openssl.org/source/license.html
  8. */
  9. #include <assert.h>
  10. #include <openssl/core.h>
  11. #include <openssl/core_dispatch.h>
  12. #include <openssl/core_names.h>
  13. #include <openssl/provider.h>
  14. #include <openssl/params.h>
  15. #include <openssl/opensslv.h>
  16. #include "crypto/cryptlib.h"
  17. #ifndef FIPS_MODULE
  18. #include "crypto/decoder.h" /* ossl_decoder_store_cache_flush */
  19. #include "crypto/encoder.h" /* ossl_encoder_store_cache_flush */
  20. #include "crypto/store.h" /* ossl_store_loader_store_cache_flush */
  21. #endif
  22. #include "crypto/evp.h" /* evp_method_store_cache_flush */
  23. #include "crypto/rand.h"
  24. #include "internal/nelem.h"
  25. #include "internal/thread_once.h"
  26. #include "internal/provider.h"
  27. #include "internal/refcount.h"
  28. #include "internal/bio.h"
  29. #include "internal/core.h"
  30. #include "provider_local.h"
  31. #include "crypto/context.h"
  32. #ifndef FIPS_MODULE
  33. # include <openssl/self_test.h>
  34. #endif
  35. /*
  36. * This file defines and uses a number of different structures:
  37. *
  38. * OSSL_PROVIDER (provider_st): Used to represent all information related to a
  39. * single instance of a provider.
  40. *
  41. * provider_store_st: Holds information about the collection of providers that
  42. * are available within the current library context (OSSL_LIB_CTX). It also
  43. * holds configuration information about providers that could be loaded at some
  44. * future point.
  45. *
  46. * OSSL_PROVIDER_CHILD_CB: An instance of this structure holds the callbacks
  47. * that have been registered for a child library context and the associated
  48. * provider that registered those callbacks.
  49. *
  50. * Where a child library context exists then it has its own instance of the
  51. * provider store. Each provider that exists in the parent provider store, has
  52. * an associated child provider in the child library context's provider store.
  53. * As providers get activated or deactivated this needs to be mirrored in the
  54. * associated child providers.
  55. *
  56. * LOCKING
  57. * =======
  58. *
  59. * There are a number of different locks used in this file and it is important
  60. * to understand how they should be used in order to avoid deadlocks.
  61. *
  62. * Fields within a structure can often be "write once" on creation, and then
  63. * "read many". Creation of a structure is done by a single thread, and
  64. * therefore no lock is required for the "write once/read many" fields. It is
  65. * safe for multiple threads to read these fields without a lock, because they
  66. * will never be changed.
  67. *
  68. * However some fields may be changed after a structure has been created and
  69. * shared between multiple threads. Where this is the case a lock is required.
  70. *
  71. * The locks available are:
  72. *
  73. * The provider flag_lock: Used to control updates to the various provider
  74. * "flags" (flag_initialized and flag_activated) and associated
  75. * "counts" (activatecnt).
  76. *
  77. * The provider refcnt_lock: Only ever used to control updates to the provider
  78. * refcnt value.
  79. *
  80. * The provider optbits_lock: Used to control access to the provider's
  81. * operation_bits and operation_bits_sz fields.
  82. *
  83. * The store default_path_lock: Used to control access to the provider store's
  84. * default search path value (default_path)
  85. *
  86. * The store lock: Used to control the stack of provider's held within the
  87. * provider store, as well as the stack of registered child provider callbacks.
  88. *
  89. * As a general rule-of-thumb it is best to:
  90. * - keep the scope of the code that is protected by a lock to the absolute
  91. * minimum possible;
  92. * - try to keep the scope of the lock to within a single function (i.e. avoid
  93. * making calls to other functions while holding a lock);
  94. * - try to only ever hold one lock at a time.
  95. *
  96. * Unfortunately, it is not always possible to stick to the above guidelines.
  97. * Where they are not adhered to there is always a danger of inadvertently
  98. * introducing the possibility of deadlock. The following rules MUST be adhered
  99. * to in order to avoid that:
  100. * - Holding multiple locks at the same time is only allowed for the
  101. * provider store lock, the provider flag_lock and the provider refcnt_lock.
  102. * - When holding multiple locks they must be acquired in the following order of
  103. * precedence:
  104. * 1) provider store lock
  105. * 2) provider flag_lock
  106. * 3) provider refcnt_lock
  107. * - When releasing locks they must be released in the reverse order to which
  108. * they were acquired
  109. * - No locks may be held when making an upcall. NOTE: Some common functions
  110. * can make upcalls as part of their normal operation. If you need to call
  111. * some other function while holding a lock make sure you know whether it
  112. * will make any upcalls or not. For example ossl_provider_up_ref() can call
  113. * ossl_provider_up_ref_parent() which can call the c_prov_up_ref() upcall.
  114. * - It is permissible to hold the store and flag locks when calling child
  115. * provider callbacks. No other locks may be held during such callbacks.
  116. */
  117. static OSSL_PROVIDER *provider_new(const char *name,
  118. OSSL_provider_init_fn *init_function,
  119. STACK_OF(INFOPAIR) *parameters);
  120. /*-
  121. * Provider Object structure
  122. * =========================
  123. */
  124. #ifndef FIPS_MODULE
  125. typedef struct {
  126. OSSL_PROVIDER *prov;
  127. int (*create_cb)(const OSSL_CORE_HANDLE *provider, void *cbdata);
  128. int (*remove_cb)(const OSSL_CORE_HANDLE *provider, void *cbdata);
  129. int (*global_props_cb)(const char *props, void *cbdata);
  130. void *cbdata;
  131. } OSSL_PROVIDER_CHILD_CB;
  132. DEFINE_STACK_OF(OSSL_PROVIDER_CHILD_CB)
  133. #endif
  134. struct provider_store_st; /* Forward declaration */
  135. struct ossl_provider_st {
  136. /* Flag bits */
  137. unsigned int flag_initialized:1;
  138. unsigned int flag_activated:1;
  139. /* Getting and setting the flags require synchronization */
  140. CRYPTO_RWLOCK *flag_lock;
  141. /* OpenSSL library side data */
  142. CRYPTO_REF_COUNT refcnt;
  143. CRYPTO_RWLOCK *refcnt_lock; /* For the ref counter */
  144. int activatecnt;
  145. char *name;
  146. char *path;
  147. DSO *module;
  148. OSSL_provider_init_fn *init_function;
  149. STACK_OF(INFOPAIR) *parameters;
  150. OSSL_LIB_CTX *libctx; /* The library context this instance is in */
  151. struct provider_store_st *store; /* The store this instance belongs to */
  152. #ifndef FIPS_MODULE
  153. /*
  154. * In the FIPS module inner provider, this isn't needed, since the
  155. * error upcalls are always direct calls to the outer provider.
  156. */
  157. int error_lib; /* ERR library number, one for each provider */
  158. # ifndef OPENSSL_NO_ERR
  159. ERR_STRING_DATA *error_strings; /* Copy of what the provider gives us */
  160. # endif
  161. #endif
  162. /* Provider side functions */
  163. OSSL_FUNC_provider_teardown_fn *teardown;
  164. OSSL_FUNC_provider_gettable_params_fn *gettable_params;
  165. OSSL_FUNC_provider_get_params_fn *get_params;
  166. OSSL_FUNC_provider_get_capabilities_fn *get_capabilities;
  167. OSSL_FUNC_provider_self_test_fn *self_test;
  168. OSSL_FUNC_provider_query_operation_fn *query_operation;
  169. OSSL_FUNC_provider_unquery_operation_fn *unquery_operation;
  170. /*
  171. * Cache of bit to indicate of query_operation() has been called on
  172. * a specific operation or not.
  173. */
  174. unsigned char *operation_bits;
  175. size_t operation_bits_sz;
  176. CRYPTO_RWLOCK *opbits_lock;
  177. #ifndef FIPS_MODULE
  178. /* Whether this provider is the child of some other provider */
  179. const OSSL_CORE_HANDLE *handle;
  180. unsigned int ischild:1;
  181. #endif
  182. /* Provider side data */
  183. void *provctx;
  184. const OSSL_DISPATCH *dispatch;
  185. };
  186. DEFINE_STACK_OF(OSSL_PROVIDER)
  187. static int ossl_provider_cmp(const OSSL_PROVIDER * const *a,
  188. const OSSL_PROVIDER * const *b)
  189. {
  190. return strcmp((*a)->name, (*b)->name);
  191. }
  192. /*-
  193. * Provider Object store
  194. * =====================
  195. *
  196. * The Provider Object store is a library context object, and therefore needs
  197. * an index.
  198. */
  199. struct provider_store_st {
  200. OSSL_LIB_CTX *libctx;
  201. STACK_OF(OSSL_PROVIDER) *providers;
  202. STACK_OF(OSSL_PROVIDER_CHILD_CB) *child_cbs;
  203. CRYPTO_RWLOCK *default_path_lock;
  204. CRYPTO_RWLOCK *lock;
  205. char *default_path;
  206. OSSL_PROVIDER_INFO *provinfo;
  207. size_t numprovinfo;
  208. size_t provinfosz;
  209. unsigned int use_fallbacks:1;
  210. unsigned int freeing:1;
  211. };
  212. /*
  213. * provider_deactivate_free() is a wrapper around ossl_provider_deactivate()
  214. * and ossl_provider_free(), called as needed.
  215. * Since this is only called when the provider store is being emptied, we
  216. * don't need to care about any lock.
  217. */
  218. static void provider_deactivate_free(OSSL_PROVIDER *prov)
  219. {
  220. if (prov->flag_activated)
  221. ossl_provider_deactivate(prov, 1);
  222. ossl_provider_free(prov);
  223. }
  224. #ifndef FIPS_MODULE
  225. static void ossl_provider_child_cb_free(OSSL_PROVIDER_CHILD_CB *cb)
  226. {
  227. OPENSSL_free(cb);
  228. }
  229. #endif
  230. static void infopair_free(INFOPAIR *pair)
  231. {
  232. OPENSSL_free(pair->name);
  233. OPENSSL_free(pair->value);
  234. OPENSSL_free(pair);
  235. }
  236. static INFOPAIR *infopair_copy(const INFOPAIR *src)
  237. {
  238. INFOPAIR *dest = OPENSSL_zalloc(sizeof(*dest));
  239. if (dest == NULL)
  240. return NULL;
  241. if (src->name != NULL) {
  242. dest->name = OPENSSL_strdup(src->name);
  243. if (dest->name == NULL)
  244. goto err;
  245. }
  246. if (src->value != NULL) {
  247. dest->value = OPENSSL_strdup(src->value);
  248. if (dest->value == NULL)
  249. goto err;
  250. }
  251. return dest;
  252. err:
  253. OPENSSL_free(dest->name);
  254. OPENSSL_free(dest);
  255. return NULL;
  256. }
  257. void ossl_provider_info_clear(OSSL_PROVIDER_INFO *info)
  258. {
  259. OPENSSL_free(info->name);
  260. OPENSSL_free(info->path);
  261. sk_INFOPAIR_pop_free(info->parameters, infopair_free);
  262. }
  263. void ossl_provider_store_free(void *vstore)
  264. {
  265. struct provider_store_st *store = vstore;
  266. size_t i;
  267. if (store == NULL)
  268. return;
  269. store->freeing = 1;
  270. OPENSSL_free(store->default_path);
  271. sk_OSSL_PROVIDER_pop_free(store->providers, provider_deactivate_free);
  272. #ifndef FIPS_MODULE
  273. sk_OSSL_PROVIDER_CHILD_CB_pop_free(store->child_cbs,
  274. ossl_provider_child_cb_free);
  275. #endif
  276. CRYPTO_THREAD_lock_free(store->default_path_lock);
  277. CRYPTO_THREAD_lock_free(store->lock);
  278. for (i = 0; i < store->numprovinfo; i++)
  279. ossl_provider_info_clear(&store->provinfo[i]);
  280. OPENSSL_free(store->provinfo);
  281. OPENSSL_free(store);
  282. }
  283. void *ossl_provider_store_new(OSSL_LIB_CTX *ctx)
  284. {
  285. struct provider_store_st *store = OPENSSL_zalloc(sizeof(*store));
  286. if (store == NULL
  287. || (store->providers = sk_OSSL_PROVIDER_new(ossl_provider_cmp)) == NULL
  288. || (store->default_path_lock = CRYPTO_THREAD_lock_new()) == NULL
  289. #ifndef FIPS_MODULE
  290. || (store->child_cbs = sk_OSSL_PROVIDER_CHILD_CB_new_null()) == NULL
  291. #endif
  292. || (store->lock = CRYPTO_THREAD_lock_new()) == NULL) {
  293. ossl_provider_store_free(store);
  294. return NULL;
  295. }
  296. store->libctx = ctx;
  297. store->use_fallbacks = 1;
  298. return store;
  299. }
  300. static struct provider_store_st *get_provider_store(OSSL_LIB_CTX *libctx)
  301. {
  302. struct provider_store_st *store = NULL;
  303. store = ossl_lib_ctx_get_data(libctx, OSSL_LIB_CTX_PROVIDER_STORE_INDEX);
  304. if (store == NULL)
  305. ERR_raise(ERR_LIB_CRYPTO, ERR_R_INTERNAL_ERROR);
  306. return store;
  307. }
  308. int ossl_provider_disable_fallback_loading(OSSL_LIB_CTX *libctx)
  309. {
  310. struct provider_store_st *store;
  311. if ((store = get_provider_store(libctx)) != NULL) {
  312. if (!CRYPTO_THREAD_write_lock(store->lock))
  313. return 0;
  314. store->use_fallbacks = 0;
  315. CRYPTO_THREAD_unlock(store->lock);
  316. return 1;
  317. }
  318. return 0;
  319. }
  320. #define BUILTINS_BLOCK_SIZE 10
  321. int ossl_provider_info_add_to_store(OSSL_LIB_CTX *libctx,
  322. OSSL_PROVIDER_INFO *entry)
  323. {
  324. struct provider_store_st *store = get_provider_store(libctx);
  325. int ret = 0;
  326. if (entry->name == NULL) {
  327. ERR_raise(ERR_LIB_CRYPTO, ERR_R_PASSED_NULL_PARAMETER);
  328. return 0;
  329. }
  330. if (store == NULL) {
  331. ERR_raise(ERR_LIB_CRYPTO, ERR_R_INTERNAL_ERROR);
  332. return 0;
  333. }
  334. if (!CRYPTO_THREAD_write_lock(store->lock))
  335. return 0;
  336. if (store->provinfosz == 0) {
  337. store->provinfo = OPENSSL_zalloc(sizeof(*store->provinfo)
  338. * BUILTINS_BLOCK_SIZE);
  339. if (store->provinfo == NULL) {
  340. ERR_raise(ERR_LIB_CRYPTO, ERR_R_MALLOC_FAILURE);
  341. goto err;
  342. }
  343. store->provinfosz = BUILTINS_BLOCK_SIZE;
  344. } else if (store->numprovinfo == store->provinfosz) {
  345. OSSL_PROVIDER_INFO *tmpbuiltins;
  346. size_t newsz = store->provinfosz + BUILTINS_BLOCK_SIZE;
  347. tmpbuiltins = OPENSSL_realloc(store->provinfo,
  348. sizeof(*store->provinfo) * newsz);
  349. if (tmpbuiltins == NULL) {
  350. ERR_raise(ERR_LIB_CRYPTO, ERR_R_MALLOC_FAILURE);
  351. goto err;
  352. }
  353. store->provinfo = tmpbuiltins;
  354. store->provinfosz = newsz;
  355. }
  356. store->provinfo[store->numprovinfo] = *entry;
  357. store->numprovinfo++;
  358. ret = 1;
  359. err:
  360. CRYPTO_THREAD_unlock(store->lock);
  361. return ret;
  362. }
  363. OSSL_PROVIDER *ossl_provider_find(OSSL_LIB_CTX *libctx, const char *name,
  364. int noconfig)
  365. {
  366. struct provider_store_st *store = NULL;
  367. OSSL_PROVIDER *prov = NULL;
  368. if ((store = get_provider_store(libctx)) != NULL) {
  369. OSSL_PROVIDER tmpl = { 0, };
  370. int i;
  371. #ifndef FIPS_MODULE
  372. /*
  373. * Make sure any providers are loaded from config before we try to find
  374. * them.
  375. */
  376. if (!noconfig) {
  377. if (ossl_lib_ctx_is_default(libctx))
  378. OPENSSL_init_crypto(OPENSSL_INIT_LOAD_CONFIG, NULL);
  379. }
  380. #endif
  381. tmpl.name = (char *)name;
  382. /*
  383. * A "find" operation can sort the stack, and therefore a write lock is
  384. * required.
  385. */
  386. if (!CRYPTO_THREAD_write_lock(store->lock))
  387. return NULL;
  388. if ((i = sk_OSSL_PROVIDER_find(store->providers, &tmpl)) != -1)
  389. prov = sk_OSSL_PROVIDER_value(store->providers, i);
  390. CRYPTO_THREAD_unlock(store->lock);
  391. if (prov != NULL && !ossl_provider_up_ref(prov))
  392. prov = NULL;
  393. }
  394. return prov;
  395. }
  396. /*-
  397. * Provider Object methods
  398. * =======================
  399. */
  400. static OSSL_PROVIDER *provider_new(const char *name,
  401. OSSL_provider_init_fn *init_function,
  402. STACK_OF(INFOPAIR) *parameters)
  403. {
  404. OSSL_PROVIDER *prov = NULL;
  405. if ((prov = OPENSSL_zalloc(sizeof(*prov))) == NULL
  406. #ifndef HAVE_ATOMICS
  407. || (prov->refcnt_lock = CRYPTO_THREAD_lock_new()) == NULL
  408. #endif
  409. ) {
  410. OPENSSL_free(prov);
  411. ERR_raise(ERR_LIB_CRYPTO, ERR_R_MALLOC_FAILURE);
  412. return NULL;
  413. }
  414. prov->refcnt = 1; /* 1 One reference to be returned */
  415. if ((prov->opbits_lock = CRYPTO_THREAD_lock_new()) == NULL
  416. || (prov->flag_lock = CRYPTO_THREAD_lock_new()) == NULL
  417. || (prov->name = OPENSSL_strdup(name)) == NULL
  418. || (prov->parameters = sk_INFOPAIR_deep_copy(parameters,
  419. infopair_copy,
  420. infopair_free)) == NULL) {
  421. ossl_provider_free(prov);
  422. ERR_raise(ERR_LIB_CRYPTO, ERR_R_MALLOC_FAILURE);
  423. return NULL;
  424. }
  425. prov->init_function = init_function;
  426. return prov;
  427. }
  428. int ossl_provider_up_ref(OSSL_PROVIDER *prov)
  429. {
  430. int ref = 0;
  431. if (CRYPTO_UP_REF(&prov->refcnt, &ref, prov->refcnt_lock) <= 0)
  432. return 0;
  433. #ifndef FIPS_MODULE
  434. if (prov->ischild) {
  435. if (!ossl_provider_up_ref_parent(prov, 0)) {
  436. ossl_provider_free(prov);
  437. return 0;
  438. }
  439. }
  440. #endif
  441. return ref;
  442. }
  443. #ifndef FIPS_MODULE
  444. static int provider_up_ref_intern(OSSL_PROVIDER *prov, int activate)
  445. {
  446. if (activate)
  447. return ossl_provider_activate(prov, 1, 0);
  448. return ossl_provider_up_ref(prov);
  449. }
  450. static int provider_free_intern(OSSL_PROVIDER *prov, int deactivate)
  451. {
  452. if (deactivate)
  453. return ossl_provider_deactivate(prov, 1);
  454. ossl_provider_free(prov);
  455. return 1;
  456. }
  457. #endif
  458. /*
  459. * We assume that the requested provider does not already exist in the store.
  460. * The caller should check. If it does exist then adding it to the store later
  461. * will fail.
  462. */
  463. OSSL_PROVIDER *ossl_provider_new(OSSL_LIB_CTX *libctx, const char *name,
  464. OSSL_provider_init_fn *init_function,
  465. int noconfig)
  466. {
  467. struct provider_store_st *store = NULL;
  468. OSSL_PROVIDER_INFO template;
  469. OSSL_PROVIDER *prov = NULL;
  470. if ((store = get_provider_store(libctx)) == NULL)
  471. return NULL;
  472. memset(&template, 0, sizeof(template));
  473. if (init_function == NULL) {
  474. const OSSL_PROVIDER_INFO *p;
  475. size_t i;
  476. /* Check if this is a predefined builtin provider */
  477. for (p = ossl_predefined_providers; p->name != NULL; p++) {
  478. if (strcmp(p->name, name) == 0) {
  479. template = *p;
  480. break;
  481. }
  482. }
  483. if (p->name == NULL) {
  484. /* Check if this is a user added builtin provider */
  485. if (!CRYPTO_THREAD_read_lock(store->lock))
  486. return NULL;
  487. for (i = 0, p = store->provinfo; i < store->numprovinfo; p++, i++) {
  488. if (strcmp(p->name, name) == 0) {
  489. template = *p;
  490. break;
  491. }
  492. }
  493. CRYPTO_THREAD_unlock(store->lock);
  494. }
  495. } else {
  496. template.init = init_function;
  497. }
  498. /* provider_new() generates an error, so no need here */
  499. if ((prov = provider_new(name, template.init, template.parameters)) == NULL)
  500. return NULL;
  501. prov->libctx = libctx;
  502. #ifndef FIPS_MODULE
  503. prov->error_lib = ERR_get_next_error_library();
  504. #endif
  505. /*
  506. * At this point, the provider is only partially "loaded". To be
  507. * fully "loaded", ossl_provider_activate() must also be called and it must
  508. * then be added to the provider store.
  509. */
  510. return prov;
  511. }
  512. /* Assumes that the store lock is held */
  513. static int create_provider_children(OSSL_PROVIDER *prov)
  514. {
  515. int ret = 1;
  516. #ifndef FIPS_MODULE
  517. struct provider_store_st *store = prov->store;
  518. OSSL_PROVIDER_CHILD_CB *child_cb;
  519. int i, max;
  520. max = sk_OSSL_PROVIDER_CHILD_CB_num(store->child_cbs);
  521. for (i = 0; i < max; i++) {
  522. /*
  523. * This is newly activated (activatecnt == 1), so we need to
  524. * create child providers as necessary.
  525. */
  526. child_cb = sk_OSSL_PROVIDER_CHILD_CB_value(store->child_cbs, i);
  527. ret &= child_cb->create_cb((OSSL_CORE_HANDLE *)prov, child_cb->cbdata);
  528. }
  529. #endif
  530. return ret;
  531. }
  532. int ossl_provider_add_to_store(OSSL_PROVIDER *prov, OSSL_PROVIDER **actualprov,
  533. int retain_fallbacks)
  534. {
  535. struct provider_store_st *store;
  536. int idx;
  537. OSSL_PROVIDER tmpl = { 0, };
  538. OSSL_PROVIDER *actualtmp = NULL;
  539. if (actualprov != NULL)
  540. *actualprov = NULL;
  541. if ((store = get_provider_store(prov->libctx)) == NULL)
  542. return 0;
  543. if (!CRYPTO_THREAD_write_lock(store->lock))
  544. return 0;
  545. tmpl.name = (char *)prov->name;
  546. idx = sk_OSSL_PROVIDER_find(store->providers, &tmpl);
  547. if (idx == -1)
  548. actualtmp = prov;
  549. else
  550. actualtmp = sk_OSSL_PROVIDER_value(store->providers, idx);
  551. if (idx == -1) {
  552. if (sk_OSSL_PROVIDER_push(store->providers, prov) == 0)
  553. goto err;
  554. prov->store = store;
  555. if (!create_provider_children(prov)) {
  556. sk_OSSL_PROVIDER_delete_ptr(store->providers, prov);
  557. goto err;
  558. }
  559. if (!retain_fallbacks)
  560. store->use_fallbacks = 0;
  561. }
  562. CRYPTO_THREAD_unlock(store->lock);
  563. if (actualprov != NULL) {
  564. if (!ossl_provider_up_ref(actualtmp)) {
  565. ERR_raise(ERR_LIB_CRYPTO, ERR_R_MALLOC_FAILURE);
  566. actualtmp = NULL;
  567. return 0;
  568. }
  569. *actualprov = actualtmp;
  570. }
  571. if (idx >= 0) {
  572. /*
  573. * The provider is already in the store. Probably two threads
  574. * independently initialised their own provider objects with the same
  575. * name and raced to put them in the store. This thread lost. We
  576. * deactivate the one we just created and use the one that already
  577. * exists instead.
  578. * If we get here then we know we did not create provider children
  579. * above, so we inform ossl_provider_deactivate not to attempt to remove
  580. * any.
  581. */
  582. ossl_provider_deactivate(prov, 0);
  583. ossl_provider_free(prov);
  584. }
  585. return 1;
  586. err:
  587. CRYPTO_THREAD_unlock(store->lock);
  588. return 0;
  589. }
  590. void ossl_provider_free(OSSL_PROVIDER *prov)
  591. {
  592. if (prov != NULL) {
  593. int ref = 0;
  594. CRYPTO_DOWN_REF(&prov->refcnt, &ref, prov->refcnt_lock);
  595. /*
  596. * When the refcount drops to zero, we clean up the provider.
  597. * Note that this also does teardown, which may seem late,
  598. * considering that init happens on first activation. However,
  599. * there may be other structures hanging on to the provider after
  600. * the last deactivation and may therefore need full access to the
  601. * provider's services. Therefore, we deinit late.
  602. */
  603. if (ref == 0) {
  604. if (prov->flag_initialized) {
  605. ossl_provider_teardown(prov);
  606. #ifndef OPENSSL_NO_ERR
  607. # ifndef FIPS_MODULE
  608. if (prov->error_strings != NULL) {
  609. ERR_unload_strings(prov->error_lib, prov->error_strings);
  610. OPENSSL_free(prov->error_strings);
  611. prov->error_strings = NULL;
  612. }
  613. # endif
  614. #endif
  615. OPENSSL_free(prov->operation_bits);
  616. prov->operation_bits = NULL;
  617. prov->operation_bits_sz = 0;
  618. prov->flag_initialized = 0;
  619. }
  620. #ifndef FIPS_MODULE
  621. /*
  622. * We deregister thread handling whether or not the provider was
  623. * initialized. If init was attempted but was not successful then
  624. * the provider may still have registered a thread handler.
  625. */
  626. ossl_init_thread_deregister(prov);
  627. DSO_free(prov->module);
  628. #endif
  629. OPENSSL_free(prov->name);
  630. OPENSSL_free(prov->path);
  631. sk_INFOPAIR_pop_free(prov->parameters, infopair_free);
  632. CRYPTO_THREAD_lock_free(prov->opbits_lock);
  633. CRYPTO_THREAD_lock_free(prov->flag_lock);
  634. #ifndef HAVE_ATOMICS
  635. CRYPTO_THREAD_lock_free(prov->refcnt_lock);
  636. #endif
  637. OPENSSL_free(prov);
  638. }
  639. #ifndef FIPS_MODULE
  640. else if (prov->ischild) {
  641. ossl_provider_free_parent(prov, 0);
  642. }
  643. #endif
  644. }
  645. }
  646. /* Setters */
  647. int ossl_provider_set_module_path(OSSL_PROVIDER *prov, const char *module_path)
  648. {
  649. OPENSSL_free(prov->path);
  650. prov->path = NULL;
  651. if (module_path == NULL)
  652. return 1;
  653. if ((prov->path = OPENSSL_strdup(module_path)) != NULL)
  654. return 1;
  655. ERR_raise(ERR_LIB_CRYPTO, ERR_R_MALLOC_FAILURE);
  656. return 0;
  657. }
  658. static int infopair_add(STACK_OF(INFOPAIR) **infopairsk, const char *name,
  659. const char *value)
  660. {
  661. INFOPAIR *pair = NULL;
  662. if ((pair = OPENSSL_zalloc(sizeof(*pair))) != NULL
  663. && (*infopairsk != NULL
  664. || (*infopairsk = sk_INFOPAIR_new_null()) != NULL)
  665. && (pair->name = OPENSSL_strdup(name)) != NULL
  666. && (pair->value = OPENSSL_strdup(value)) != NULL
  667. && sk_INFOPAIR_push(*infopairsk, pair) > 0)
  668. return 1;
  669. if (pair != NULL) {
  670. OPENSSL_free(pair->name);
  671. OPENSSL_free(pair->value);
  672. OPENSSL_free(pair);
  673. }
  674. ERR_raise(ERR_LIB_CRYPTO, ERR_R_MALLOC_FAILURE);
  675. return 0;
  676. }
  677. int ossl_provider_add_parameter(OSSL_PROVIDER *prov,
  678. const char *name, const char *value)
  679. {
  680. return infopair_add(&prov->parameters, name, value);
  681. }
  682. int ossl_provider_info_add_parameter(OSSL_PROVIDER_INFO *provinfo,
  683. const char *name,
  684. const char *value)
  685. {
  686. return infopair_add(&provinfo->parameters, name, value);
  687. }
  688. /*
  689. * Provider activation.
  690. *
  691. * What "activation" means depends on the provider form; for built in
  692. * providers (in the library or the application alike), the provider
  693. * can already be considered to be loaded, all that's needed is to
  694. * initialize it. However, for dynamically loadable provider modules,
  695. * we must first load that module.
  696. *
  697. * Built in modules are distinguished from dynamically loaded modules
  698. * with an already assigned init function.
  699. */
  700. static const OSSL_DISPATCH *core_dispatch; /* Define further down */
  701. int OSSL_PROVIDER_set_default_search_path(OSSL_LIB_CTX *libctx,
  702. const char *path)
  703. {
  704. struct provider_store_st *store;
  705. char *p = NULL;
  706. if (path != NULL) {
  707. p = OPENSSL_strdup(path);
  708. if (p == NULL) {
  709. ERR_raise(ERR_LIB_CRYPTO, ERR_R_MALLOC_FAILURE);
  710. return 0;
  711. }
  712. }
  713. if ((store = get_provider_store(libctx)) != NULL
  714. && CRYPTO_THREAD_write_lock(store->default_path_lock)) {
  715. OPENSSL_free(store->default_path);
  716. store->default_path = p;
  717. CRYPTO_THREAD_unlock(store->default_path_lock);
  718. return 1;
  719. }
  720. OPENSSL_free(p);
  721. return 0;
  722. }
  723. /*
  724. * Internal version that doesn't affect the store flags, and thereby avoid
  725. * locking. Direct callers must remember to set the store flags when
  726. * appropriate.
  727. */
  728. static int provider_init(OSSL_PROVIDER *prov)
  729. {
  730. const OSSL_DISPATCH *provider_dispatch = NULL;
  731. void *tmp_provctx = NULL; /* safety measure */
  732. #ifndef OPENSSL_NO_ERR
  733. # ifndef FIPS_MODULE
  734. OSSL_FUNC_provider_get_reason_strings_fn *p_get_reason_strings = NULL;
  735. # endif
  736. #endif
  737. int ok = 0;
  738. if (!ossl_assert(!prov->flag_initialized)) {
  739. ERR_raise(ERR_LIB_CRYPTO, ERR_R_INTERNAL_ERROR);
  740. goto end;
  741. }
  742. /*
  743. * If the init function isn't set, it indicates that this provider is
  744. * a loadable module.
  745. */
  746. if (prov->init_function == NULL) {
  747. #ifdef FIPS_MODULE
  748. goto end;
  749. #else
  750. if (prov->module == NULL) {
  751. char *allocated_path = NULL;
  752. const char *module_path = NULL;
  753. char *merged_path = NULL;
  754. const char *load_dir = NULL;
  755. char *allocated_load_dir = NULL;
  756. struct provider_store_st *store;
  757. if ((prov->module = DSO_new()) == NULL) {
  758. /* DSO_new() generates an error already */
  759. goto end;
  760. }
  761. if ((store = get_provider_store(prov->libctx)) == NULL
  762. || !CRYPTO_THREAD_read_lock(store->default_path_lock))
  763. goto end;
  764. if (store->default_path != NULL) {
  765. allocated_load_dir = OPENSSL_strdup(store->default_path);
  766. CRYPTO_THREAD_unlock(store->default_path_lock);
  767. if (allocated_load_dir == NULL) {
  768. ERR_raise(ERR_LIB_CRYPTO, ERR_R_MALLOC_FAILURE);
  769. goto end;
  770. }
  771. load_dir = allocated_load_dir;
  772. } else {
  773. CRYPTO_THREAD_unlock(store->default_path_lock);
  774. }
  775. if (load_dir == NULL) {
  776. load_dir = ossl_safe_getenv("OPENSSL_MODULES");
  777. if (load_dir == NULL)
  778. load_dir = MODULESDIR;
  779. }
  780. DSO_ctrl(prov->module, DSO_CTRL_SET_FLAGS,
  781. DSO_FLAG_NAME_TRANSLATION_EXT_ONLY, NULL);
  782. module_path = prov->path;
  783. if (module_path == NULL)
  784. module_path = allocated_path =
  785. DSO_convert_filename(prov->module, prov->name);
  786. if (module_path != NULL)
  787. merged_path = DSO_merge(prov->module, module_path, load_dir);
  788. if (merged_path == NULL
  789. || (DSO_load(prov->module, merged_path, NULL, 0)) == NULL) {
  790. DSO_free(prov->module);
  791. prov->module = NULL;
  792. }
  793. OPENSSL_free(merged_path);
  794. OPENSSL_free(allocated_path);
  795. OPENSSL_free(allocated_load_dir);
  796. }
  797. if (prov->module != NULL)
  798. prov->init_function = (OSSL_provider_init_fn *)
  799. DSO_bind_func(prov->module, "OSSL_provider_init");
  800. #endif
  801. }
  802. /* Call the initialise function for the provider. */
  803. if (prov->init_function == NULL
  804. || !prov->init_function((OSSL_CORE_HANDLE *)prov, core_dispatch,
  805. &provider_dispatch, &tmp_provctx)) {
  806. ERR_raise_data(ERR_LIB_CRYPTO, ERR_R_INIT_FAIL,
  807. "name=%s", prov->name);
  808. goto end;
  809. }
  810. prov->provctx = tmp_provctx;
  811. prov->dispatch = provider_dispatch;
  812. for (; provider_dispatch->function_id != 0; provider_dispatch++) {
  813. switch (provider_dispatch->function_id) {
  814. case OSSL_FUNC_PROVIDER_TEARDOWN:
  815. prov->teardown =
  816. OSSL_FUNC_provider_teardown(provider_dispatch);
  817. break;
  818. case OSSL_FUNC_PROVIDER_GETTABLE_PARAMS:
  819. prov->gettable_params =
  820. OSSL_FUNC_provider_gettable_params(provider_dispatch);
  821. break;
  822. case OSSL_FUNC_PROVIDER_GET_PARAMS:
  823. prov->get_params =
  824. OSSL_FUNC_provider_get_params(provider_dispatch);
  825. break;
  826. case OSSL_FUNC_PROVIDER_SELF_TEST:
  827. prov->self_test =
  828. OSSL_FUNC_provider_self_test(provider_dispatch);
  829. break;
  830. case OSSL_FUNC_PROVIDER_GET_CAPABILITIES:
  831. prov->get_capabilities =
  832. OSSL_FUNC_provider_get_capabilities(provider_dispatch);
  833. break;
  834. case OSSL_FUNC_PROVIDER_QUERY_OPERATION:
  835. prov->query_operation =
  836. OSSL_FUNC_provider_query_operation(provider_dispatch);
  837. break;
  838. case OSSL_FUNC_PROVIDER_UNQUERY_OPERATION:
  839. prov->unquery_operation =
  840. OSSL_FUNC_provider_unquery_operation(provider_dispatch);
  841. break;
  842. #ifndef OPENSSL_NO_ERR
  843. # ifndef FIPS_MODULE
  844. case OSSL_FUNC_PROVIDER_GET_REASON_STRINGS:
  845. p_get_reason_strings =
  846. OSSL_FUNC_provider_get_reason_strings(provider_dispatch);
  847. break;
  848. # endif
  849. #endif
  850. }
  851. }
  852. #ifndef OPENSSL_NO_ERR
  853. # ifndef FIPS_MODULE
  854. if (p_get_reason_strings != NULL) {
  855. const OSSL_ITEM *reasonstrings = p_get_reason_strings(prov->provctx);
  856. size_t cnt, cnt2;
  857. /*
  858. * ERR_load_strings() handles ERR_STRING_DATA rather than OSSL_ITEM,
  859. * although they are essentially the same type.
  860. * Furthermore, ERR_load_strings() patches the array's error number
  861. * with the error library number, so we need to make a copy of that
  862. * array either way.
  863. */
  864. cnt = 0;
  865. while (reasonstrings[cnt].id != 0) {
  866. if (ERR_GET_LIB(reasonstrings[cnt].id) != 0)
  867. goto end;
  868. cnt++;
  869. }
  870. cnt++; /* One for the terminating item */
  871. /* Allocate one extra item for the "library" name */
  872. prov->error_strings =
  873. OPENSSL_zalloc(sizeof(ERR_STRING_DATA) * (cnt + 1));
  874. if (prov->error_strings == NULL)
  875. goto end;
  876. /*
  877. * Set the "library" name.
  878. */
  879. prov->error_strings[0].error = ERR_PACK(prov->error_lib, 0, 0);
  880. prov->error_strings[0].string = prov->name;
  881. /*
  882. * Copy reasonstrings item 0..cnt-1 to prov->error_trings positions
  883. * 1..cnt.
  884. */
  885. for (cnt2 = 1; cnt2 <= cnt; cnt2++) {
  886. prov->error_strings[cnt2].error = (int)reasonstrings[cnt2-1].id;
  887. prov->error_strings[cnt2].string = reasonstrings[cnt2-1].ptr;
  888. }
  889. ERR_load_strings(prov->error_lib, prov->error_strings);
  890. }
  891. # endif
  892. #endif
  893. /* With this flag set, this provider has become fully "loaded". */
  894. prov->flag_initialized = 1;
  895. ok = 1;
  896. end:
  897. return ok;
  898. }
  899. /*
  900. * Deactivate a provider. If upcalls is 0 then we suppress any upcalls to a
  901. * parent provider. If removechildren is 0 then we suppress any calls to remove
  902. * child providers.
  903. * Return -1 on failure and the activation count on success
  904. */
  905. static int provider_deactivate(OSSL_PROVIDER *prov, int upcalls,
  906. int removechildren)
  907. {
  908. int count;
  909. struct provider_store_st *store;
  910. #ifndef FIPS_MODULE
  911. int freeparent = 0;
  912. #endif
  913. int lock = 1;
  914. if (!ossl_assert(prov != NULL))
  915. return -1;
  916. /*
  917. * No need to lock if we've got no store because we've not been shared with
  918. * other threads.
  919. */
  920. store = get_provider_store(prov->libctx);
  921. if (store == NULL)
  922. lock = 0;
  923. if (lock && !CRYPTO_THREAD_read_lock(store->lock))
  924. return -1;
  925. if (lock && !CRYPTO_THREAD_write_lock(prov->flag_lock)) {
  926. CRYPTO_THREAD_unlock(store->lock);
  927. return -1;
  928. }
  929. #ifndef FIPS_MODULE
  930. if (prov->activatecnt >= 2 && prov->ischild && upcalls) {
  931. /*
  932. * We have had a direct activation in this child libctx so we need to
  933. * now down the ref count in the parent provider. We do the actual down
  934. * ref outside of the flag_lock, since it could involve getting other
  935. * locks.
  936. */
  937. freeparent = 1;
  938. }
  939. #endif
  940. if ((count = --prov->activatecnt) < 1)
  941. prov->flag_activated = 0;
  942. #ifndef FIPS_MODULE
  943. else
  944. removechildren = 0;
  945. #endif
  946. #ifndef FIPS_MODULE
  947. if (removechildren && store != NULL) {
  948. int i, max = sk_OSSL_PROVIDER_CHILD_CB_num(store->child_cbs);
  949. OSSL_PROVIDER_CHILD_CB *child_cb;
  950. for (i = 0; i < max; i++) {
  951. child_cb = sk_OSSL_PROVIDER_CHILD_CB_value(store->child_cbs, i);
  952. child_cb->remove_cb((OSSL_CORE_HANDLE *)prov, child_cb->cbdata);
  953. }
  954. }
  955. #endif
  956. if (lock) {
  957. CRYPTO_THREAD_unlock(prov->flag_lock);
  958. CRYPTO_THREAD_unlock(store->lock);
  959. }
  960. #ifndef FIPS_MODULE
  961. if (freeparent)
  962. ossl_provider_free_parent(prov, 1);
  963. #endif
  964. /* We don't deinit here, that's done in ossl_provider_free() */
  965. return count;
  966. }
  967. /*
  968. * Activate a provider.
  969. * Return -1 on failure and the activation count on success
  970. */
  971. static int provider_activate(OSSL_PROVIDER *prov, int lock, int upcalls)
  972. {
  973. int count = -1;
  974. struct provider_store_st *store;
  975. int ret = 1;
  976. store = prov->store;
  977. /*
  978. * If the provider hasn't been added to the store, then we don't need
  979. * any locks because we've not shared it with other threads.
  980. */
  981. if (store == NULL) {
  982. lock = 0;
  983. if (!provider_init(prov))
  984. return -1;
  985. }
  986. #ifndef FIPS_MODULE
  987. if (prov->ischild && upcalls && !ossl_provider_up_ref_parent(prov, 1))
  988. return -1;
  989. #endif
  990. if (lock && !CRYPTO_THREAD_read_lock(store->lock)) {
  991. #ifndef FIPS_MODULE
  992. if (prov->ischild && upcalls)
  993. ossl_provider_free_parent(prov, 1);
  994. #endif
  995. return -1;
  996. }
  997. if (lock && !CRYPTO_THREAD_write_lock(prov->flag_lock)) {
  998. CRYPTO_THREAD_unlock(store->lock);
  999. #ifndef FIPS_MODULE
  1000. if (prov->ischild && upcalls)
  1001. ossl_provider_free_parent(prov, 1);
  1002. #endif
  1003. return -1;
  1004. }
  1005. count = ++prov->activatecnt;
  1006. prov->flag_activated = 1;
  1007. if (prov->activatecnt == 1 && store != NULL) {
  1008. ret = create_provider_children(prov);
  1009. }
  1010. if (lock) {
  1011. CRYPTO_THREAD_unlock(prov->flag_lock);
  1012. CRYPTO_THREAD_unlock(store->lock);
  1013. }
  1014. if (!ret)
  1015. return -1;
  1016. return count;
  1017. }
  1018. static int provider_flush_store_cache(const OSSL_PROVIDER *prov)
  1019. {
  1020. struct provider_store_st *store;
  1021. int freeing;
  1022. if ((store = get_provider_store(prov->libctx)) == NULL)
  1023. return 0;
  1024. if (!CRYPTO_THREAD_read_lock(store->lock))
  1025. return 0;
  1026. freeing = store->freeing;
  1027. CRYPTO_THREAD_unlock(store->lock);
  1028. if (!freeing) {
  1029. int acc
  1030. = evp_method_store_cache_flush(prov->libctx)
  1031. #ifndef FIPS_MODULE
  1032. + ossl_encoder_store_cache_flush(prov->libctx)
  1033. + ossl_decoder_store_cache_flush(prov->libctx)
  1034. + ossl_store_loader_store_cache_flush(prov->libctx)
  1035. #endif
  1036. ;
  1037. #ifndef FIPS_MODULE
  1038. return acc == 4;
  1039. #else
  1040. return acc == 1;
  1041. #endif
  1042. }
  1043. return 1;
  1044. }
  1045. static int provider_remove_store_methods(OSSL_PROVIDER *prov)
  1046. {
  1047. struct provider_store_st *store;
  1048. int freeing;
  1049. if ((store = get_provider_store(prov->libctx)) == NULL)
  1050. return 0;
  1051. if (!CRYPTO_THREAD_read_lock(store->lock))
  1052. return 0;
  1053. freeing = store->freeing;
  1054. CRYPTO_THREAD_unlock(store->lock);
  1055. if (!freeing) {
  1056. int acc;
  1057. if (!CRYPTO_THREAD_read_lock(prov->opbits_lock))
  1058. return 0;
  1059. OPENSSL_free(prov->operation_bits);
  1060. prov->operation_bits = NULL;
  1061. prov->operation_bits_sz = 0;
  1062. CRYPTO_THREAD_unlock(prov->opbits_lock);
  1063. acc = evp_method_store_remove_all_provided(prov)
  1064. #ifndef FIPS_MODULE
  1065. + ossl_encoder_store_remove_all_provided(prov)
  1066. + ossl_decoder_store_remove_all_provided(prov)
  1067. + ossl_store_loader_store_remove_all_provided(prov)
  1068. #endif
  1069. ;
  1070. #ifndef FIPS_MODULE
  1071. return acc == 4;
  1072. #else
  1073. return acc == 1;
  1074. #endif
  1075. }
  1076. return 1;
  1077. }
  1078. int ossl_provider_activate(OSSL_PROVIDER *prov, int upcalls, int aschild)
  1079. {
  1080. int count;
  1081. if (prov == NULL)
  1082. return 0;
  1083. #ifndef FIPS_MODULE
  1084. /*
  1085. * If aschild is true, then we only actually do the activation if the
  1086. * provider is a child. If its not, this is still success.
  1087. */
  1088. if (aschild && !prov->ischild)
  1089. return 1;
  1090. #endif
  1091. if ((count = provider_activate(prov, 1, upcalls)) > 0)
  1092. return count == 1 ? provider_flush_store_cache(prov) : 1;
  1093. return 0;
  1094. }
  1095. int ossl_provider_deactivate(OSSL_PROVIDER *prov, int removechildren)
  1096. {
  1097. int count;
  1098. if (prov == NULL
  1099. || (count = provider_deactivate(prov, 1, removechildren)) < 0)
  1100. return 0;
  1101. return count == 0 ? provider_remove_store_methods(prov) : 1;
  1102. }
  1103. void *ossl_provider_ctx(const OSSL_PROVIDER *prov)
  1104. {
  1105. return prov->provctx != NULL ? prov->provctx : NULL;
  1106. }
  1107. /*
  1108. * This function only does something once when store->use_fallbacks == 1,
  1109. * and then sets store->use_fallbacks = 0, so the second call and so on is
  1110. * effectively a no-op.
  1111. */
  1112. static int provider_activate_fallbacks(struct provider_store_st *store)
  1113. {
  1114. int use_fallbacks;
  1115. int activated_fallback_count = 0;
  1116. int ret = 0;
  1117. const OSSL_PROVIDER_INFO *p;
  1118. if (!CRYPTO_THREAD_read_lock(store->lock))
  1119. return 0;
  1120. use_fallbacks = store->use_fallbacks;
  1121. CRYPTO_THREAD_unlock(store->lock);
  1122. if (!use_fallbacks)
  1123. return 1;
  1124. if (!CRYPTO_THREAD_write_lock(store->lock))
  1125. return 0;
  1126. /* Check again, just in case another thread changed it */
  1127. use_fallbacks = store->use_fallbacks;
  1128. if (!use_fallbacks) {
  1129. CRYPTO_THREAD_unlock(store->lock);
  1130. return 1;
  1131. }
  1132. for (p = ossl_predefined_providers; p->name != NULL; p++) {
  1133. OSSL_PROVIDER *prov = NULL;
  1134. if (!p->is_fallback)
  1135. continue;
  1136. /*
  1137. * We use the internal constructor directly here,
  1138. * otherwise we get a call loop
  1139. */
  1140. prov = provider_new(p->name, p->init, NULL);
  1141. if (prov == NULL)
  1142. goto err;
  1143. prov->libctx = store->libctx;
  1144. #ifndef FIPS_MODULE
  1145. prov->error_lib = ERR_get_next_error_library();
  1146. #endif
  1147. /*
  1148. * We are calling provider_activate while holding the store lock. This
  1149. * means the init function will be called while holding a lock. Normally
  1150. * we try to avoid calling a user callback while holding a lock.
  1151. * However, fallbacks are never third party providers so we accept this.
  1152. */
  1153. if (provider_activate(prov, 0, 0) < 0) {
  1154. ossl_provider_free(prov);
  1155. goto err;
  1156. }
  1157. prov->store = store;
  1158. if (sk_OSSL_PROVIDER_push(store->providers, prov) == 0) {
  1159. ossl_provider_free(prov);
  1160. goto err;
  1161. }
  1162. activated_fallback_count++;
  1163. }
  1164. if (activated_fallback_count > 0) {
  1165. store->use_fallbacks = 0;
  1166. ret = 1;
  1167. }
  1168. err:
  1169. CRYPTO_THREAD_unlock(store->lock);
  1170. return ret;
  1171. }
  1172. int ossl_provider_doall_activated(OSSL_LIB_CTX *ctx,
  1173. int (*cb)(OSSL_PROVIDER *provider,
  1174. void *cbdata),
  1175. void *cbdata)
  1176. {
  1177. int ret = 0, curr, max, ref = 0;
  1178. struct provider_store_st *store = get_provider_store(ctx);
  1179. STACK_OF(OSSL_PROVIDER) *provs = NULL;
  1180. #ifndef FIPS_MODULE
  1181. /*
  1182. * Make sure any providers are loaded from config before we try to use
  1183. * them.
  1184. */
  1185. if (ossl_lib_ctx_is_default(ctx))
  1186. OPENSSL_init_crypto(OPENSSL_INIT_LOAD_CONFIG, NULL);
  1187. #endif
  1188. if (store == NULL)
  1189. return 1;
  1190. if (!provider_activate_fallbacks(store))
  1191. return 0;
  1192. /*
  1193. * Under lock, grab a copy of the provider list and up_ref each
  1194. * provider so that they don't disappear underneath us.
  1195. */
  1196. if (!CRYPTO_THREAD_read_lock(store->lock))
  1197. return 0;
  1198. provs = sk_OSSL_PROVIDER_dup(store->providers);
  1199. if (provs == NULL) {
  1200. CRYPTO_THREAD_unlock(store->lock);
  1201. return 0;
  1202. }
  1203. max = sk_OSSL_PROVIDER_num(provs);
  1204. /*
  1205. * We work backwards through the stack so that we can safely delete items
  1206. * as we go.
  1207. */
  1208. for (curr = max - 1; curr >= 0; curr--) {
  1209. OSSL_PROVIDER *prov = sk_OSSL_PROVIDER_value(provs, curr);
  1210. if (!CRYPTO_THREAD_write_lock(prov->flag_lock))
  1211. goto err_unlock;
  1212. if (prov->flag_activated) {
  1213. /*
  1214. * We call CRYPTO_UP_REF directly rather than ossl_provider_up_ref
  1215. * to avoid upping the ref count on the parent provider, which we
  1216. * must not do while holding locks.
  1217. */
  1218. if (CRYPTO_UP_REF(&prov->refcnt, &ref, prov->refcnt_lock) <= 0) {
  1219. CRYPTO_THREAD_unlock(prov->flag_lock);
  1220. goto err_unlock;
  1221. }
  1222. /*
  1223. * It's already activated, but we up the activated count to ensure
  1224. * it remains activated until after we've called the user callback.
  1225. * We do this with no locking (because we already hold the locks)
  1226. * and no upcalls (which must not be called when locks are held). In
  1227. * theory this could mean the parent provider goes inactive, whilst
  1228. * still activated in the child for a short period. That's ok.
  1229. */
  1230. if (provider_activate(prov, 0, 0) < 0) {
  1231. CRYPTO_DOWN_REF(&prov->refcnt, &ref, prov->refcnt_lock);
  1232. CRYPTO_THREAD_unlock(prov->flag_lock);
  1233. goto err_unlock;
  1234. }
  1235. } else {
  1236. sk_OSSL_PROVIDER_delete(provs, curr);
  1237. max--;
  1238. }
  1239. CRYPTO_THREAD_unlock(prov->flag_lock);
  1240. }
  1241. CRYPTO_THREAD_unlock(store->lock);
  1242. /*
  1243. * Now, we sweep through all providers not under lock
  1244. */
  1245. for (curr = 0; curr < max; curr++) {
  1246. OSSL_PROVIDER *prov = sk_OSSL_PROVIDER_value(provs, curr);
  1247. if (!cb(prov, cbdata)) {
  1248. curr = -1;
  1249. goto finish;
  1250. }
  1251. }
  1252. curr = -1;
  1253. ret = 1;
  1254. goto finish;
  1255. err_unlock:
  1256. CRYPTO_THREAD_unlock(store->lock);
  1257. finish:
  1258. /*
  1259. * The pop_free call doesn't do what we want on an error condition. We
  1260. * either start from the first item in the stack, or part way through if
  1261. * we only processed some of the items.
  1262. */
  1263. for (curr++; curr < max; curr++) {
  1264. OSSL_PROVIDER *prov = sk_OSSL_PROVIDER_value(provs, curr);
  1265. provider_deactivate(prov, 0, 1);
  1266. /*
  1267. * As above where we did the up-ref, we don't call ossl_provider_free
  1268. * to avoid making upcalls. There should always be at least one ref
  1269. * to the provider in the store, so this should never drop to 0.
  1270. */
  1271. CRYPTO_DOWN_REF(&prov->refcnt, &ref, prov->refcnt_lock);
  1272. /*
  1273. * Not much we can do if this assert ever fails. So we don't use
  1274. * ossl_assert here.
  1275. */
  1276. assert(ref > 0);
  1277. }
  1278. sk_OSSL_PROVIDER_free(provs);
  1279. return ret;
  1280. }
  1281. int OSSL_PROVIDER_available(OSSL_LIB_CTX *libctx, const char *name)
  1282. {
  1283. OSSL_PROVIDER *prov = NULL;
  1284. int available = 0;
  1285. struct provider_store_st *store = get_provider_store(libctx);
  1286. if (store == NULL || !provider_activate_fallbacks(store))
  1287. return 0;
  1288. prov = ossl_provider_find(libctx, name, 0);
  1289. if (prov != NULL) {
  1290. if (!CRYPTO_THREAD_read_lock(prov->flag_lock))
  1291. return 0;
  1292. available = prov->flag_activated;
  1293. CRYPTO_THREAD_unlock(prov->flag_lock);
  1294. ossl_provider_free(prov);
  1295. }
  1296. return available;
  1297. }
  1298. /* Getters of Provider Object data */
  1299. const char *ossl_provider_name(const OSSL_PROVIDER *prov)
  1300. {
  1301. return prov->name;
  1302. }
  1303. const DSO *ossl_provider_dso(const OSSL_PROVIDER *prov)
  1304. {
  1305. return prov->module;
  1306. }
  1307. const char *ossl_provider_module_name(const OSSL_PROVIDER *prov)
  1308. {
  1309. #ifdef FIPS_MODULE
  1310. return NULL;
  1311. #else
  1312. return DSO_get_filename(prov->module);
  1313. #endif
  1314. }
  1315. const char *ossl_provider_module_path(const OSSL_PROVIDER *prov)
  1316. {
  1317. #ifdef FIPS_MODULE
  1318. return NULL;
  1319. #else
  1320. /* FIXME: Ensure it's a full path */
  1321. return DSO_get_filename(prov->module);
  1322. #endif
  1323. }
  1324. void *ossl_provider_prov_ctx(const OSSL_PROVIDER *prov)
  1325. {
  1326. if (prov != NULL)
  1327. return prov->provctx;
  1328. return NULL;
  1329. }
  1330. const OSSL_DISPATCH *ossl_provider_get0_dispatch(const OSSL_PROVIDER *prov)
  1331. {
  1332. if (prov != NULL)
  1333. return prov->dispatch;
  1334. return NULL;
  1335. }
  1336. OSSL_LIB_CTX *ossl_provider_libctx(const OSSL_PROVIDER *prov)
  1337. {
  1338. return prov != NULL ? prov->libctx : NULL;
  1339. }
  1340. /* Wrappers around calls to the provider */
  1341. void ossl_provider_teardown(const OSSL_PROVIDER *prov)
  1342. {
  1343. if (prov->teardown != NULL
  1344. #ifndef FIPS_MODULE
  1345. && !prov->ischild
  1346. #endif
  1347. )
  1348. prov->teardown(prov->provctx);
  1349. }
  1350. const OSSL_PARAM *ossl_provider_gettable_params(const OSSL_PROVIDER *prov)
  1351. {
  1352. return prov->gettable_params == NULL
  1353. ? NULL : prov->gettable_params(prov->provctx);
  1354. }
  1355. int ossl_provider_get_params(const OSSL_PROVIDER *prov, OSSL_PARAM params[])
  1356. {
  1357. return prov->get_params == NULL
  1358. ? 0 : prov->get_params(prov->provctx, params);
  1359. }
  1360. int ossl_provider_self_test(const OSSL_PROVIDER *prov)
  1361. {
  1362. int ret;
  1363. if (prov->self_test == NULL)
  1364. return 1;
  1365. ret = prov->self_test(prov->provctx);
  1366. if (ret == 0)
  1367. (void)provider_remove_store_methods((OSSL_PROVIDER *)prov);
  1368. return ret;
  1369. }
  1370. int ossl_provider_get_capabilities(const OSSL_PROVIDER *prov,
  1371. const char *capability,
  1372. OSSL_CALLBACK *cb,
  1373. void *arg)
  1374. {
  1375. return prov->get_capabilities == NULL
  1376. ? 1 : prov->get_capabilities(prov->provctx, capability, cb, arg);
  1377. }
  1378. const OSSL_ALGORITHM *ossl_provider_query_operation(const OSSL_PROVIDER *prov,
  1379. int operation_id,
  1380. int *no_cache)
  1381. {
  1382. const OSSL_ALGORITHM *res;
  1383. if (prov->query_operation == NULL)
  1384. return NULL;
  1385. res = prov->query_operation(prov->provctx, operation_id, no_cache);
  1386. #if defined(OPENSSL_NO_CACHED_FETCH)
  1387. /* Forcing the non-caching of queries */
  1388. if (no_cache != NULL)
  1389. *no_cache = 1;
  1390. #endif
  1391. return res;
  1392. }
  1393. void ossl_provider_unquery_operation(const OSSL_PROVIDER *prov,
  1394. int operation_id,
  1395. const OSSL_ALGORITHM *algs)
  1396. {
  1397. if (prov->unquery_operation != NULL)
  1398. prov->unquery_operation(prov->provctx, operation_id, algs);
  1399. }
  1400. int ossl_provider_set_operation_bit(OSSL_PROVIDER *provider, size_t bitnum)
  1401. {
  1402. size_t byte = bitnum / 8;
  1403. unsigned char bit = (1 << (bitnum % 8)) & 0xFF;
  1404. if (!CRYPTO_THREAD_write_lock(provider->opbits_lock))
  1405. return 0;
  1406. if (provider->operation_bits_sz <= byte) {
  1407. unsigned char *tmp = OPENSSL_realloc(provider->operation_bits,
  1408. byte + 1);
  1409. if (tmp == NULL) {
  1410. CRYPTO_THREAD_unlock(provider->opbits_lock);
  1411. ERR_raise(ERR_LIB_CRYPTO, ERR_R_MALLOC_FAILURE);
  1412. return 0;
  1413. }
  1414. provider->operation_bits = tmp;
  1415. memset(provider->operation_bits + provider->operation_bits_sz,
  1416. '\0', byte + 1 - provider->operation_bits_sz);
  1417. provider->operation_bits_sz = byte + 1;
  1418. }
  1419. provider->operation_bits[byte] |= bit;
  1420. CRYPTO_THREAD_unlock(provider->opbits_lock);
  1421. return 1;
  1422. }
  1423. int ossl_provider_test_operation_bit(OSSL_PROVIDER *provider, size_t bitnum,
  1424. int *result)
  1425. {
  1426. size_t byte = bitnum / 8;
  1427. unsigned char bit = (1 << (bitnum % 8)) & 0xFF;
  1428. if (!ossl_assert(result != NULL)) {
  1429. ERR_raise(ERR_LIB_CRYPTO, ERR_R_PASSED_NULL_PARAMETER);
  1430. return 0;
  1431. }
  1432. *result = 0;
  1433. if (!CRYPTO_THREAD_read_lock(provider->opbits_lock))
  1434. return 0;
  1435. if (provider->operation_bits_sz > byte)
  1436. *result = ((provider->operation_bits[byte] & bit) != 0);
  1437. CRYPTO_THREAD_unlock(provider->opbits_lock);
  1438. return 1;
  1439. }
  1440. #ifndef FIPS_MODULE
  1441. const OSSL_CORE_HANDLE *ossl_provider_get_parent(OSSL_PROVIDER *prov)
  1442. {
  1443. return prov->handle;
  1444. }
  1445. int ossl_provider_is_child(const OSSL_PROVIDER *prov)
  1446. {
  1447. return prov->ischild;
  1448. }
  1449. int ossl_provider_set_child(OSSL_PROVIDER *prov, const OSSL_CORE_HANDLE *handle)
  1450. {
  1451. prov->handle = handle;
  1452. prov->ischild = 1;
  1453. return 1;
  1454. }
  1455. int ossl_provider_default_props_update(OSSL_LIB_CTX *libctx, const char *props)
  1456. {
  1457. #ifndef FIPS_MODULE
  1458. struct provider_store_st *store = NULL;
  1459. int i, max;
  1460. OSSL_PROVIDER_CHILD_CB *child_cb;
  1461. if ((store = get_provider_store(libctx)) == NULL)
  1462. return 0;
  1463. if (!CRYPTO_THREAD_read_lock(store->lock))
  1464. return 0;
  1465. max = sk_OSSL_PROVIDER_CHILD_CB_num(store->child_cbs);
  1466. for (i = 0; i < max; i++) {
  1467. child_cb = sk_OSSL_PROVIDER_CHILD_CB_value(store->child_cbs, i);
  1468. child_cb->global_props_cb(props, child_cb->cbdata);
  1469. }
  1470. CRYPTO_THREAD_unlock(store->lock);
  1471. #endif
  1472. return 1;
  1473. }
  1474. static int ossl_provider_register_child_cb(const OSSL_CORE_HANDLE *handle,
  1475. int (*create_cb)(
  1476. const OSSL_CORE_HANDLE *provider,
  1477. void *cbdata),
  1478. int (*remove_cb)(
  1479. const OSSL_CORE_HANDLE *provider,
  1480. void *cbdata),
  1481. int (*global_props_cb)(
  1482. const char *props,
  1483. void *cbdata),
  1484. void *cbdata)
  1485. {
  1486. /*
  1487. * This is really an OSSL_PROVIDER that we created and cast to
  1488. * OSSL_CORE_HANDLE originally. Therefore it is safe to cast it back.
  1489. */
  1490. OSSL_PROVIDER *thisprov = (OSSL_PROVIDER *)handle;
  1491. OSSL_PROVIDER *prov;
  1492. OSSL_LIB_CTX *libctx = thisprov->libctx;
  1493. struct provider_store_st *store = NULL;
  1494. int ret = 0, i, max;
  1495. OSSL_PROVIDER_CHILD_CB *child_cb;
  1496. char *propsstr = NULL;
  1497. if ((store = get_provider_store(libctx)) == NULL)
  1498. return 0;
  1499. child_cb = OPENSSL_malloc(sizeof(*child_cb));
  1500. if (child_cb == NULL)
  1501. return 0;
  1502. child_cb->prov = thisprov;
  1503. child_cb->create_cb = create_cb;
  1504. child_cb->remove_cb = remove_cb;
  1505. child_cb->global_props_cb = global_props_cb;
  1506. child_cb->cbdata = cbdata;
  1507. if (!CRYPTO_THREAD_write_lock(store->lock)) {
  1508. OPENSSL_free(child_cb);
  1509. return 0;
  1510. }
  1511. propsstr = evp_get_global_properties_str(libctx, 0);
  1512. if (propsstr != NULL) {
  1513. global_props_cb(propsstr, cbdata);
  1514. OPENSSL_free(propsstr);
  1515. }
  1516. max = sk_OSSL_PROVIDER_num(store->providers);
  1517. for (i = 0; i < max; i++) {
  1518. int activated;
  1519. prov = sk_OSSL_PROVIDER_value(store->providers, i);
  1520. if (!CRYPTO_THREAD_read_lock(prov->flag_lock))
  1521. break;
  1522. activated = prov->flag_activated;
  1523. CRYPTO_THREAD_unlock(prov->flag_lock);
  1524. /*
  1525. * We hold the store lock while calling the user callback. This means
  1526. * that the user callback must be short and simple and not do anything
  1527. * likely to cause a deadlock. We don't hold the flag_lock during this
  1528. * call. In theory this means that another thread could deactivate it
  1529. * while we are calling create. This is ok because the other thread
  1530. * will also call remove_cb, but won't be able to do so until we release
  1531. * the store lock.
  1532. */
  1533. if (activated && !create_cb((OSSL_CORE_HANDLE *)prov, cbdata))
  1534. break;
  1535. }
  1536. if (i == max) {
  1537. /* Success */
  1538. ret = sk_OSSL_PROVIDER_CHILD_CB_push(store->child_cbs, child_cb);
  1539. }
  1540. if (i != max || ret <= 0) {
  1541. /* Failed during creation. Remove everything we just added */
  1542. for (; i >= 0; i--) {
  1543. prov = sk_OSSL_PROVIDER_value(store->providers, i);
  1544. remove_cb((OSSL_CORE_HANDLE *)prov, cbdata);
  1545. }
  1546. OPENSSL_free(child_cb);
  1547. ret = 0;
  1548. }
  1549. CRYPTO_THREAD_unlock(store->lock);
  1550. return ret;
  1551. }
  1552. static void ossl_provider_deregister_child_cb(const OSSL_CORE_HANDLE *handle)
  1553. {
  1554. /*
  1555. * This is really an OSSL_PROVIDER that we created and cast to
  1556. * OSSL_CORE_HANDLE originally. Therefore it is safe to cast it back.
  1557. */
  1558. OSSL_PROVIDER *thisprov = (OSSL_PROVIDER *)handle;
  1559. OSSL_LIB_CTX *libctx = thisprov->libctx;
  1560. struct provider_store_st *store = NULL;
  1561. int i, max;
  1562. OSSL_PROVIDER_CHILD_CB *child_cb;
  1563. if ((store = get_provider_store(libctx)) == NULL)
  1564. return;
  1565. if (!CRYPTO_THREAD_write_lock(store->lock))
  1566. return;
  1567. max = sk_OSSL_PROVIDER_CHILD_CB_num(store->child_cbs);
  1568. for (i = 0; i < max; i++) {
  1569. child_cb = sk_OSSL_PROVIDER_CHILD_CB_value(store->child_cbs, i);
  1570. if (child_cb->prov == thisprov) {
  1571. /* Found an entry */
  1572. sk_OSSL_PROVIDER_CHILD_CB_delete(store->child_cbs, i);
  1573. OPENSSL_free(child_cb);
  1574. break;
  1575. }
  1576. }
  1577. CRYPTO_THREAD_unlock(store->lock);
  1578. }
  1579. #endif
  1580. /*-
  1581. * Core functions for the provider
  1582. * ===============================
  1583. *
  1584. * This is the set of functions that the core makes available to the provider
  1585. */
  1586. /*
  1587. * This returns a list of Provider Object parameters with their types, for
  1588. * discovery. We do not expect that many providers will use this, but one
  1589. * never knows.
  1590. */
  1591. static const OSSL_PARAM param_types[] = {
  1592. OSSL_PARAM_DEFN(OSSL_PROV_PARAM_CORE_VERSION, OSSL_PARAM_UTF8_PTR, NULL, 0),
  1593. OSSL_PARAM_DEFN(OSSL_PROV_PARAM_CORE_PROV_NAME, OSSL_PARAM_UTF8_PTR,
  1594. NULL, 0),
  1595. #ifndef FIPS_MODULE
  1596. OSSL_PARAM_DEFN(OSSL_PROV_PARAM_CORE_MODULE_FILENAME, OSSL_PARAM_UTF8_PTR,
  1597. NULL, 0),
  1598. #endif
  1599. OSSL_PARAM_END
  1600. };
  1601. /*
  1602. * Forward declare all the functions that are provided aa dispatch.
  1603. * This ensures that the compiler will complain if they aren't defined
  1604. * with the correct signature.
  1605. */
  1606. static OSSL_FUNC_core_gettable_params_fn core_gettable_params;
  1607. static OSSL_FUNC_core_get_params_fn core_get_params;
  1608. static OSSL_FUNC_core_get_libctx_fn core_get_libctx;
  1609. static OSSL_FUNC_core_thread_start_fn core_thread_start;
  1610. #ifndef FIPS_MODULE
  1611. static OSSL_FUNC_core_new_error_fn core_new_error;
  1612. static OSSL_FUNC_core_set_error_debug_fn core_set_error_debug;
  1613. static OSSL_FUNC_core_vset_error_fn core_vset_error;
  1614. static OSSL_FUNC_core_set_error_mark_fn core_set_error_mark;
  1615. static OSSL_FUNC_core_clear_last_error_mark_fn core_clear_last_error_mark;
  1616. static OSSL_FUNC_core_pop_error_to_mark_fn core_pop_error_to_mark;
  1617. OSSL_FUNC_BIO_new_file_fn ossl_core_bio_new_file;
  1618. OSSL_FUNC_BIO_new_membuf_fn ossl_core_bio_new_mem_buf;
  1619. OSSL_FUNC_BIO_read_ex_fn ossl_core_bio_read_ex;
  1620. OSSL_FUNC_BIO_write_ex_fn ossl_core_bio_write_ex;
  1621. OSSL_FUNC_BIO_gets_fn ossl_core_bio_gets;
  1622. OSSL_FUNC_BIO_puts_fn ossl_core_bio_puts;
  1623. OSSL_FUNC_BIO_up_ref_fn ossl_core_bio_up_ref;
  1624. OSSL_FUNC_BIO_free_fn ossl_core_bio_free;
  1625. OSSL_FUNC_BIO_vprintf_fn ossl_core_bio_vprintf;
  1626. OSSL_FUNC_BIO_vsnprintf_fn BIO_vsnprintf;
  1627. static OSSL_FUNC_self_test_cb_fn core_self_test_get_callback;
  1628. OSSL_FUNC_get_entropy_fn ossl_rand_get_entropy;
  1629. OSSL_FUNC_cleanup_entropy_fn ossl_rand_cleanup_entropy;
  1630. OSSL_FUNC_get_nonce_fn ossl_rand_get_nonce;
  1631. OSSL_FUNC_cleanup_nonce_fn ossl_rand_cleanup_nonce;
  1632. #endif
  1633. OSSL_FUNC_CRYPTO_malloc_fn CRYPTO_malloc;
  1634. OSSL_FUNC_CRYPTO_zalloc_fn CRYPTO_zalloc;
  1635. OSSL_FUNC_CRYPTO_free_fn CRYPTO_free;
  1636. OSSL_FUNC_CRYPTO_clear_free_fn CRYPTO_clear_free;
  1637. OSSL_FUNC_CRYPTO_realloc_fn CRYPTO_realloc;
  1638. OSSL_FUNC_CRYPTO_clear_realloc_fn CRYPTO_clear_realloc;
  1639. OSSL_FUNC_CRYPTO_secure_malloc_fn CRYPTO_secure_malloc;
  1640. OSSL_FUNC_CRYPTO_secure_zalloc_fn CRYPTO_secure_zalloc;
  1641. OSSL_FUNC_CRYPTO_secure_free_fn CRYPTO_secure_free;
  1642. OSSL_FUNC_CRYPTO_secure_clear_free_fn CRYPTO_secure_clear_free;
  1643. OSSL_FUNC_CRYPTO_secure_allocated_fn CRYPTO_secure_allocated;
  1644. OSSL_FUNC_OPENSSL_cleanse_fn OPENSSL_cleanse;
  1645. #ifndef FIPS_MODULE
  1646. OSSL_FUNC_provider_register_child_cb_fn ossl_provider_register_child_cb;
  1647. OSSL_FUNC_provider_deregister_child_cb_fn ossl_provider_deregister_child_cb;
  1648. static OSSL_FUNC_provider_name_fn core_provider_get0_name;
  1649. static OSSL_FUNC_provider_get0_provider_ctx_fn core_provider_get0_provider_ctx;
  1650. static OSSL_FUNC_provider_get0_dispatch_fn core_provider_get0_dispatch;
  1651. static OSSL_FUNC_provider_up_ref_fn core_provider_up_ref_intern;
  1652. static OSSL_FUNC_provider_free_fn core_provider_free_intern;
  1653. static OSSL_FUNC_core_obj_add_sigid_fn core_obj_add_sigid;
  1654. static OSSL_FUNC_core_obj_create_fn core_obj_create;
  1655. #endif
  1656. static const OSSL_PARAM *core_gettable_params(const OSSL_CORE_HANDLE *handle)
  1657. {
  1658. return param_types;
  1659. }
  1660. static int core_get_params(const OSSL_CORE_HANDLE *handle, OSSL_PARAM params[])
  1661. {
  1662. int i;
  1663. OSSL_PARAM *p;
  1664. /*
  1665. * We created this object originally and we know it is actually an
  1666. * OSSL_PROVIDER *, so the cast is safe
  1667. */
  1668. OSSL_PROVIDER *prov = (OSSL_PROVIDER *)handle;
  1669. if ((p = OSSL_PARAM_locate(params, OSSL_PROV_PARAM_CORE_VERSION)) != NULL)
  1670. OSSL_PARAM_set_utf8_ptr(p, OPENSSL_VERSION_STR);
  1671. if ((p = OSSL_PARAM_locate(params, OSSL_PROV_PARAM_CORE_PROV_NAME)) != NULL)
  1672. OSSL_PARAM_set_utf8_ptr(p, prov->name);
  1673. #ifndef FIPS_MODULE
  1674. if ((p = OSSL_PARAM_locate(params,
  1675. OSSL_PROV_PARAM_CORE_MODULE_FILENAME)) != NULL)
  1676. OSSL_PARAM_set_utf8_ptr(p, ossl_provider_module_path(prov));
  1677. #endif
  1678. if (prov->parameters == NULL)
  1679. return 1;
  1680. for (i = 0; i < sk_INFOPAIR_num(prov->parameters); i++) {
  1681. INFOPAIR *pair = sk_INFOPAIR_value(prov->parameters, i);
  1682. if ((p = OSSL_PARAM_locate(params, pair->name)) != NULL)
  1683. OSSL_PARAM_set_utf8_ptr(p, pair->value);
  1684. }
  1685. return 1;
  1686. }
  1687. static OPENSSL_CORE_CTX *core_get_libctx(const OSSL_CORE_HANDLE *handle)
  1688. {
  1689. /*
  1690. * We created this object originally and we know it is actually an
  1691. * OSSL_PROVIDER *, so the cast is safe
  1692. */
  1693. OSSL_PROVIDER *prov = (OSSL_PROVIDER *)handle;
  1694. /*
  1695. * Using ossl_provider_libctx would be wrong as that returns
  1696. * NULL for |prov| == NULL and NULL libctx has a special meaning
  1697. * that does not apply here. Here |prov| == NULL can happen only in
  1698. * case of a coding error.
  1699. */
  1700. assert(prov != NULL);
  1701. return (OPENSSL_CORE_CTX *)prov->libctx;
  1702. }
  1703. static int core_thread_start(const OSSL_CORE_HANDLE *handle,
  1704. OSSL_thread_stop_handler_fn handfn,
  1705. void *arg)
  1706. {
  1707. /*
  1708. * We created this object originally and we know it is actually an
  1709. * OSSL_PROVIDER *, so the cast is safe
  1710. */
  1711. OSSL_PROVIDER *prov = (OSSL_PROVIDER *)handle;
  1712. return ossl_init_thread_start(prov, arg, handfn);
  1713. }
  1714. /*
  1715. * The FIPS module inner provider doesn't implement these. They aren't
  1716. * needed there, since the FIPS module upcalls are always the outer provider
  1717. * ones.
  1718. */
  1719. #ifndef FIPS_MODULE
  1720. /*
  1721. * These error functions should use |handle| to select the proper
  1722. * library context to report in the correct error stack if error
  1723. * stacks become tied to the library context.
  1724. * We cannot currently do that since there's no support for it in the
  1725. * ERR subsystem.
  1726. */
  1727. static void core_new_error(const OSSL_CORE_HANDLE *handle)
  1728. {
  1729. ERR_new();
  1730. }
  1731. static void core_set_error_debug(const OSSL_CORE_HANDLE *handle,
  1732. const char *file, int line, const char *func)
  1733. {
  1734. ERR_set_debug(file, line, func);
  1735. }
  1736. static void core_vset_error(const OSSL_CORE_HANDLE *handle,
  1737. uint32_t reason, const char *fmt, va_list args)
  1738. {
  1739. /*
  1740. * We created this object originally and we know it is actually an
  1741. * OSSL_PROVIDER *, so the cast is safe
  1742. */
  1743. OSSL_PROVIDER *prov = (OSSL_PROVIDER *)handle;
  1744. /*
  1745. * If the uppermost 8 bits are non-zero, it's an OpenSSL library
  1746. * error and will be treated as such. Otherwise, it's a new style
  1747. * provider error and will be treated as such.
  1748. */
  1749. if (ERR_GET_LIB(reason) != 0) {
  1750. ERR_vset_error(ERR_GET_LIB(reason), ERR_GET_REASON(reason), fmt, args);
  1751. } else {
  1752. ERR_vset_error(prov->error_lib, (int)reason, fmt, args);
  1753. }
  1754. }
  1755. static int core_set_error_mark(const OSSL_CORE_HANDLE *handle)
  1756. {
  1757. return ERR_set_mark();
  1758. }
  1759. static int core_clear_last_error_mark(const OSSL_CORE_HANDLE *handle)
  1760. {
  1761. return ERR_clear_last_mark();
  1762. }
  1763. static int core_pop_error_to_mark(const OSSL_CORE_HANDLE *handle)
  1764. {
  1765. return ERR_pop_to_mark();
  1766. }
  1767. static void core_self_test_get_callback(OPENSSL_CORE_CTX *libctx,
  1768. OSSL_CALLBACK **cb, void **cbarg)
  1769. {
  1770. OSSL_SELF_TEST_get_callback((OSSL_LIB_CTX *)libctx, cb, cbarg);
  1771. }
  1772. static const char *core_provider_get0_name(const OSSL_CORE_HANDLE *prov)
  1773. {
  1774. return OSSL_PROVIDER_get0_name((const OSSL_PROVIDER *)prov);
  1775. }
  1776. static void *core_provider_get0_provider_ctx(const OSSL_CORE_HANDLE *prov)
  1777. {
  1778. return OSSL_PROVIDER_get0_provider_ctx((const OSSL_PROVIDER *)prov);
  1779. }
  1780. static const OSSL_DISPATCH *
  1781. core_provider_get0_dispatch(const OSSL_CORE_HANDLE *prov)
  1782. {
  1783. return OSSL_PROVIDER_get0_dispatch((const OSSL_PROVIDER *)prov);
  1784. }
  1785. static int core_provider_up_ref_intern(const OSSL_CORE_HANDLE *prov,
  1786. int activate)
  1787. {
  1788. return provider_up_ref_intern((OSSL_PROVIDER *)prov, activate);
  1789. }
  1790. static int core_provider_free_intern(const OSSL_CORE_HANDLE *prov,
  1791. int deactivate)
  1792. {
  1793. return provider_free_intern((OSSL_PROVIDER *)prov, deactivate);
  1794. }
  1795. static int core_obj_add_sigid(const OSSL_CORE_HANDLE *prov,
  1796. const char *sign_name, const char *digest_name,
  1797. const char *pkey_name)
  1798. {
  1799. int sign_nid = OBJ_txt2nid(sign_name);
  1800. int digest_nid = NID_undef;
  1801. int pkey_nid = OBJ_txt2nid(pkey_name);
  1802. if (digest_name != NULL && digest_name[0] != '\0'
  1803. && (digest_nid = OBJ_txt2nid(digest_name)) == NID_undef)
  1804. return 0;
  1805. if (sign_nid == NID_undef)
  1806. return 0;
  1807. /*
  1808. * Check if it already exists. This is a success if so (even if we don't
  1809. * have nids for the digest/pkey)
  1810. */
  1811. if (OBJ_find_sigid_algs(sign_nid, NULL, NULL))
  1812. return 1;
  1813. if (pkey_nid == NID_undef)
  1814. return 0;
  1815. return OBJ_add_sigid(sign_nid, digest_nid, pkey_nid);
  1816. }
  1817. static int core_obj_create(const OSSL_CORE_HANDLE *prov, const char *oid,
  1818. const char *sn, const char *ln)
  1819. {
  1820. /* Check if it already exists and create it if not */
  1821. return OBJ_txt2nid(oid) != NID_undef
  1822. || OBJ_create(oid, sn, ln) != NID_undef;
  1823. }
  1824. #endif /* FIPS_MODULE */
  1825. /*
  1826. * Functions provided by the core.
  1827. */
  1828. static const OSSL_DISPATCH core_dispatch_[] = {
  1829. { OSSL_FUNC_CORE_GETTABLE_PARAMS, (void (*)(void))core_gettable_params },
  1830. { OSSL_FUNC_CORE_GET_PARAMS, (void (*)(void))core_get_params },
  1831. { OSSL_FUNC_CORE_GET_LIBCTX, (void (*)(void))core_get_libctx },
  1832. { OSSL_FUNC_CORE_THREAD_START, (void (*)(void))core_thread_start },
  1833. #ifndef FIPS_MODULE
  1834. { OSSL_FUNC_CORE_NEW_ERROR, (void (*)(void))core_new_error },
  1835. { OSSL_FUNC_CORE_SET_ERROR_DEBUG, (void (*)(void))core_set_error_debug },
  1836. { OSSL_FUNC_CORE_VSET_ERROR, (void (*)(void))core_vset_error },
  1837. { OSSL_FUNC_CORE_SET_ERROR_MARK, (void (*)(void))core_set_error_mark },
  1838. { OSSL_FUNC_CORE_CLEAR_LAST_ERROR_MARK,
  1839. (void (*)(void))core_clear_last_error_mark },
  1840. { OSSL_FUNC_CORE_POP_ERROR_TO_MARK, (void (*)(void))core_pop_error_to_mark },
  1841. { OSSL_FUNC_BIO_NEW_FILE, (void (*)(void))ossl_core_bio_new_file },
  1842. { OSSL_FUNC_BIO_NEW_MEMBUF, (void (*)(void))ossl_core_bio_new_mem_buf },
  1843. { OSSL_FUNC_BIO_READ_EX, (void (*)(void))ossl_core_bio_read_ex },
  1844. { OSSL_FUNC_BIO_WRITE_EX, (void (*)(void))ossl_core_bio_write_ex },
  1845. { OSSL_FUNC_BIO_GETS, (void (*)(void))ossl_core_bio_gets },
  1846. { OSSL_FUNC_BIO_PUTS, (void (*)(void))ossl_core_bio_puts },
  1847. { OSSL_FUNC_BIO_CTRL, (void (*)(void))ossl_core_bio_ctrl },
  1848. { OSSL_FUNC_BIO_UP_REF, (void (*)(void))ossl_core_bio_up_ref },
  1849. { OSSL_FUNC_BIO_FREE, (void (*)(void))ossl_core_bio_free },
  1850. { OSSL_FUNC_BIO_VPRINTF, (void (*)(void))ossl_core_bio_vprintf },
  1851. { OSSL_FUNC_BIO_VSNPRINTF, (void (*)(void))BIO_vsnprintf },
  1852. { OSSL_FUNC_SELF_TEST_CB, (void (*)(void))core_self_test_get_callback },
  1853. { OSSL_FUNC_GET_ENTROPY, (void (*)(void))ossl_rand_get_entropy },
  1854. { OSSL_FUNC_CLEANUP_ENTROPY, (void (*)(void))ossl_rand_cleanup_entropy },
  1855. { OSSL_FUNC_GET_NONCE, (void (*)(void))ossl_rand_get_nonce },
  1856. { OSSL_FUNC_CLEANUP_NONCE, (void (*)(void))ossl_rand_cleanup_nonce },
  1857. #endif
  1858. { OSSL_FUNC_CRYPTO_MALLOC, (void (*)(void))CRYPTO_malloc },
  1859. { OSSL_FUNC_CRYPTO_ZALLOC, (void (*)(void))CRYPTO_zalloc },
  1860. { OSSL_FUNC_CRYPTO_FREE, (void (*)(void))CRYPTO_free },
  1861. { OSSL_FUNC_CRYPTO_CLEAR_FREE, (void (*)(void))CRYPTO_clear_free },
  1862. { OSSL_FUNC_CRYPTO_REALLOC, (void (*)(void))CRYPTO_realloc },
  1863. { OSSL_FUNC_CRYPTO_CLEAR_REALLOC, (void (*)(void))CRYPTO_clear_realloc },
  1864. { OSSL_FUNC_CRYPTO_SECURE_MALLOC, (void (*)(void))CRYPTO_secure_malloc },
  1865. { OSSL_FUNC_CRYPTO_SECURE_ZALLOC, (void (*)(void))CRYPTO_secure_zalloc },
  1866. { OSSL_FUNC_CRYPTO_SECURE_FREE, (void (*)(void))CRYPTO_secure_free },
  1867. { OSSL_FUNC_CRYPTO_SECURE_CLEAR_FREE,
  1868. (void (*)(void))CRYPTO_secure_clear_free },
  1869. { OSSL_FUNC_CRYPTO_SECURE_ALLOCATED,
  1870. (void (*)(void))CRYPTO_secure_allocated },
  1871. { OSSL_FUNC_OPENSSL_CLEANSE, (void (*)(void))OPENSSL_cleanse },
  1872. #ifndef FIPS_MODULE
  1873. { OSSL_FUNC_PROVIDER_REGISTER_CHILD_CB,
  1874. (void (*)(void))ossl_provider_register_child_cb },
  1875. { OSSL_FUNC_PROVIDER_DEREGISTER_CHILD_CB,
  1876. (void (*)(void))ossl_provider_deregister_child_cb },
  1877. { OSSL_FUNC_PROVIDER_NAME,
  1878. (void (*)(void))core_provider_get0_name },
  1879. { OSSL_FUNC_PROVIDER_GET0_PROVIDER_CTX,
  1880. (void (*)(void))core_provider_get0_provider_ctx },
  1881. { OSSL_FUNC_PROVIDER_GET0_DISPATCH,
  1882. (void (*)(void))core_provider_get0_dispatch },
  1883. { OSSL_FUNC_PROVIDER_UP_REF,
  1884. (void (*)(void))core_provider_up_ref_intern },
  1885. { OSSL_FUNC_PROVIDER_FREE,
  1886. (void (*)(void))core_provider_free_intern },
  1887. { OSSL_FUNC_CORE_OBJ_ADD_SIGID, (void (*)(void))core_obj_add_sigid },
  1888. { OSSL_FUNC_CORE_OBJ_CREATE, (void (*)(void))core_obj_create },
  1889. #endif
  1890. { 0, NULL }
  1891. };
  1892. static const OSSL_DISPATCH *core_dispatch = core_dispatch_;