1 /*
2 * Copyright 2019-2021 The OpenSSL Project Authors. All Rights Reserved.
3 *
4 * Licensed under the Apache License 2.0 (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
8 */
9
10 #include <assert.h>
11 #include <openssl/crypto.h>
12 #include <openssl/core_dispatch.h>
13 #include <openssl/core_names.h>
14 #include <openssl/provider.h>
15 #include <openssl/evp.h>
16 #include "internal/provider.h"
17 #include "internal/cryptlib.h"
18 #include "crypto/evp.h"
19
20 DEFINE_STACK_OF(OSSL_PROVIDER)
21
22 struct child_prov_globals {
23 const OSSL_CORE_HANDLE *handle;
24 const OSSL_CORE_HANDLE *curr_prov;
25 unsigned int isinited:1;
26 CRYPTO_RWLOCK *lock;
27 OSSL_FUNC_core_get_libctx_fn *c_get_libctx;
28 OSSL_FUNC_provider_register_child_cb_fn *c_provider_register_child_cb;
29 OSSL_FUNC_provider_deregister_child_cb_fn *c_provider_deregister_child_cb;
30 OSSL_FUNC_provider_name_fn *c_prov_name;
31 OSSL_FUNC_provider_get0_provider_ctx_fn *c_prov_get0_provider_ctx;
32 OSSL_FUNC_provider_get0_dispatch_fn *c_prov_get0_dispatch;
33 OSSL_FUNC_provider_up_ref_fn *c_prov_up_ref;
34 OSSL_FUNC_provider_free_fn *c_prov_free;
35 };
36
child_prov_ossl_ctx_new(OSSL_LIB_CTX * libctx)37 static void *child_prov_ossl_ctx_new(OSSL_LIB_CTX *libctx)
38 {
39 return OPENSSL_zalloc(sizeof(struct child_prov_globals));
40 }
41
child_prov_ossl_ctx_free(void * vgbl)42 static void child_prov_ossl_ctx_free(void *vgbl)
43 {
44 struct child_prov_globals *gbl = vgbl;
45
46 gbl->c_provider_deregister_child_cb(gbl->handle);
47 CRYPTO_THREAD_lock_free(gbl->lock);
48 OPENSSL_free(gbl);
49 }
50
51 static const OSSL_LIB_CTX_METHOD child_prov_ossl_ctx_method = {
52 OSSL_LIB_CTX_METHOD_LOW_PRIORITY,
53 child_prov_ossl_ctx_new,
54 child_prov_ossl_ctx_free,
55 };
56
57 static OSSL_provider_init_fn ossl_child_provider_init;
58
ossl_child_provider_init(const OSSL_CORE_HANDLE * handle,const OSSL_DISPATCH * in,const OSSL_DISPATCH ** out,void ** provctx)59 static int ossl_child_provider_init(const OSSL_CORE_HANDLE *handle,
60 const OSSL_DISPATCH *in,
61 const OSSL_DISPATCH **out,
62 void **provctx)
63 {
64 OSSL_FUNC_core_get_libctx_fn *c_get_libctx = NULL;
65 OSSL_LIB_CTX *ctx;
66 struct child_prov_globals *gbl;
67
68 for (; in->function_id != 0; in++) {
69 switch (in->function_id) {
70 case OSSL_FUNC_CORE_GET_LIBCTX:
71 c_get_libctx = OSSL_FUNC_core_get_libctx(in);
72 break;
73 default:
74 /* Just ignore anything we don't understand */
75 break;
76 }
77 }
78
79 if (c_get_libctx == NULL)
80 return 0;
81
82 /*
83 * We need an OSSL_LIB_CTX but c_get_libctx returns OPENSSL_CORE_CTX. We are
84 * a built-in provider and so we can get away with this cast. Normal
85 * providers can't do this.
86 */
87 ctx = (OSSL_LIB_CTX *)c_get_libctx(handle);
88
89 gbl = ossl_lib_ctx_get_data(ctx, OSSL_LIB_CTX_CHILD_PROVIDER_INDEX,
90 &child_prov_ossl_ctx_method);
91 if (gbl == NULL)
92 return 0;
93
94 *provctx = gbl->c_prov_get0_provider_ctx(gbl->curr_prov);
95 *out = gbl->c_prov_get0_dispatch(gbl->curr_prov);
96
97 return 1;
98 }
99
provider_create_child_cb(const OSSL_CORE_HANDLE * prov,void * cbdata)100 static int provider_create_child_cb(const OSSL_CORE_HANDLE *prov, void *cbdata)
101 {
102 OSSL_LIB_CTX *ctx = cbdata;
103 struct child_prov_globals *gbl;
104 const char *provname;
105 OSSL_PROVIDER *cprov;
106 int ret = 0;
107
108 gbl = ossl_lib_ctx_get_data(ctx, OSSL_LIB_CTX_CHILD_PROVIDER_INDEX,
109 &child_prov_ossl_ctx_method);
110 if (gbl == NULL)
111 return 0;
112
113 /*
114 * If !gbl->isinited, then we are still initing and we already hold the
115 * lock - so don't take it again.
116 */
117 if (gbl->isinited && !CRYPTO_THREAD_write_lock(gbl->lock))
118 return 0;
119
120 provname = gbl->c_prov_name(prov);
121
122 /*
123 * We're operating under a lock so we can store the "current" provider in
124 * the global data.
125 */
126 gbl->curr_prov = prov;
127
128 if ((cprov = ossl_provider_find(ctx, provname, 1)) != NULL) {
129 /*
130 * We free the newly created ref. We rely on the provider sticking around
131 * in the provider store.
132 */
133 ossl_provider_free(cprov);
134
135 /*
136 * The provider already exists. It could be a previously created child,
137 * or it could have been explicitly loaded. If explicitly loaded we
138 * ignore it - i.e. we don't start treating it like a child.
139 */
140 if (!ossl_provider_activate(cprov, 0, 1))
141 goto err;
142 } else {
143 /*
144 * Create it - passing 1 as final param so we don't try and recursively
145 * init children
146 */
147 if ((cprov = ossl_provider_new(ctx, provname, ossl_child_provider_init,
148 1)) == NULL)
149 goto err;
150
151 if (!ossl_provider_activate(cprov, 0, 0))
152 goto err;
153
154 if (!ossl_provider_set_child(cprov, prov)
155 || !ossl_provider_add_to_store(cprov, NULL, 0)) {
156 ossl_provider_deactivate(cprov);
157 ossl_provider_free(cprov);
158 goto err;
159 }
160 }
161
162 ret = 1;
163 err:
164 if (gbl->isinited)
165 CRYPTO_THREAD_unlock(gbl->lock);
166 return ret;
167 }
168
provider_remove_child_cb(const OSSL_CORE_HANDLE * prov,void * cbdata)169 static int provider_remove_child_cb(const OSSL_CORE_HANDLE *prov, void *cbdata)
170 {
171 OSSL_LIB_CTX *ctx = cbdata;
172 struct child_prov_globals *gbl;
173 const char *provname;
174 OSSL_PROVIDER *cprov;
175
176 gbl = ossl_lib_ctx_get_data(ctx, OSSL_LIB_CTX_CHILD_PROVIDER_INDEX,
177 &child_prov_ossl_ctx_method);
178 if (gbl == NULL)
179 return 0;
180
181 provname = gbl->c_prov_name(prov);
182 cprov = ossl_provider_find(ctx, provname, 1);
183 if (cprov == NULL)
184 return 0;
185 /*
186 * ossl_provider_find ups the ref count, so we free it again here. We can
187 * rely on the provider store reference count.
188 */
189 ossl_provider_free(cprov);
190 if (ossl_provider_is_child(cprov)
191 && !ossl_provider_deactivate(cprov))
192 return 0;
193
194 return 1;
195 }
196
provider_global_props_cb(const char * props,void * cbdata)197 static int provider_global_props_cb(const char *props, void *cbdata)
198 {
199 OSSL_LIB_CTX *ctx = cbdata;
200
201 return evp_set_default_properties_int(ctx, props, 0, 1);
202 }
203
ossl_provider_init_as_child(OSSL_LIB_CTX * ctx,const OSSL_CORE_HANDLE * handle,const OSSL_DISPATCH * in)204 int ossl_provider_init_as_child(OSSL_LIB_CTX *ctx,
205 const OSSL_CORE_HANDLE *handle,
206 const OSSL_DISPATCH *in)
207 {
208 struct child_prov_globals *gbl;
209
210 if (ctx == NULL)
211 return 0;
212
213 gbl = ossl_lib_ctx_get_data(ctx, OSSL_LIB_CTX_CHILD_PROVIDER_INDEX,
214 &child_prov_ossl_ctx_method);
215 if (gbl == NULL)
216 return 0;
217
218 gbl->handle = handle;
219 for (; in->function_id != 0; in++) {
220 switch (in->function_id) {
221 case OSSL_FUNC_CORE_GET_LIBCTX:
222 gbl->c_get_libctx = OSSL_FUNC_core_get_libctx(in);
223 break;
224 case OSSL_FUNC_PROVIDER_REGISTER_CHILD_CB:
225 gbl->c_provider_register_child_cb
226 = OSSL_FUNC_provider_register_child_cb(in);
227 break;
228 case OSSL_FUNC_PROVIDER_DEREGISTER_CHILD_CB:
229 gbl->c_provider_deregister_child_cb
230 = OSSL_FUNC_provider_deregister_child_cb(in);
231 break;
232 case OSSL_FUNC_PROVIDER_NAME:
233 gbl->c_prov_name = OSSL_FUNC_provider_name(in);
234 break;
235 case OSSL_FUNC_PROVIDER_GET0_PROVIDER_CTX:
236 gbl->c_prov_get0_provider_ctx
237 = OSSL_FUNC_provider_get0_provider_ctx(in);
238 break;
239 case OSSL_FUNC_PROVIDER_GET0_DISPATCH:
240 gbl->c_prov_get0_dispatch = OSSL_FUNC_provider_get0_dispatch(in);
241 break;
242 case OSSL_FUNC_PROVIDER_UP_REF:
243 gbl->c_prov_up_ref
244 = OSSL_FUNC_provider_up_ref(in);
245 break;
246 case OSSL_FUNC_PROVIDER_FREE:
247 gbl->c_prov_free = OSSL_FUNC_provider_free(in);
248 break;
249 default:
250 /* Just ignore anything we don't understand */
251 break;
252 }
253 }
254
255 if (gbl->c_get_libctx == NULL
256 || gbl->c_provider_register_child_cb == NULL
257 || gbl->c_prov_name == NULL
258 || gbl->c_prov_get0_provider_ctx == NULL
259 || gbl->c_prov_get0_dispatch == NULL
260 || gbl->c_prov_up_ref == NULL
261 || gbl->c_prov_free == NULL)
262 return 0;
263
264 gbl->lock = CRYPTO_THREAD_lock_new();
265 if (gbl->lock == NULL)
266 return 0;
267
268 if (!gbl->c_provider_register_child_cb(gbl->handle,
269 provider_create_child_cb,
270 provider_remove_child_cb,
271 provider_global_props_cb,
272 ctx))
273 return 0;
274
275 gbl->isinited = 1;
276
277 return 1;
278 }
279
ossl_provider_up_ref_parent(OSSL_PROVIDER * prov,int activate)280 int ossl_provider_up_ref_parent(OSSL_PROVIDER *prov, int activate)
281 {
282 struct child_prov_globals *gbl;
283
284 gbl = ossl_lib_ctx_get_data(ossl_provider_libctx(prov),
285 OSSL_LIB_CTX_CHILD_PROVIDER_INDEX,
286 &child_prov_ossl_ctx_method);
287 if (gbl == NULL)
288 return 0;
289
290 return gbl->c_prov_up_ref(ossl_provider_get_parent(prov), activate);
291 }
292
ossl_provider_free_parent(OSSL_PROVIDER * prov,int deactivate)293 int ossl_provider_free_parent(OSSL_PROVIDER *prov, int deactivate)
294 {
295 struct child_prov_globals *gbl;
296
297 gbl = ossl_lib_ctx_get_data(ossl_provider_libctx(prov),
298 OSSL_LIB_CTX_CHILD_PROVIDER_INDEX,
299 &child_prov_ossl_ctx_method);
300 if (gbl == NULL)
301 return 0;
302
303 return gbl->c_prov_free(ossl_provider_get_parent(prov), deactivate);
304 }
305