1 /* 2 * Copyright 2019-2022 The OpenSSL Project Authors. All Rights Reserved. 3 * 4 * Licensed under the Apache License 2.0 (the "License"). You may not use 5 * this file except in compliance with the License. You can obtain a copy 6 * in the file LICENSE in the source distribution or at 7 * https://www.openssl.org/source/license.html 8 */ 9 10 #include <assert.h> 11 #include <openssl/core.h> 12 #include <openssl/core_dispatch.h> 13 #include <openssl/core_names.h> 14 #include <openssl/provider.h> 15 #include <openssl/params.h> 16 #include <openssl/opensslv.h> 17 #include "crypto/cryptlib.h" 18 #ifndef FIPS_MODULE 19 #include "crypto/decoder.h" /* ossl_decoder_store_cache_flush */ 20 #include "crypto/encoder.h" /* ossl_encoder_store_cache_flush */ 21 #include "crypto/store.h" /* ossl_store_loader_store_cache_flush */ 22 #endif 23 #include "crypto/evp.h" /* evp_method_store_cache_flush */ 24 #include "crypto/rand.h" 25 #include "internal/nelem.h" 26 #include "internal/thread_once.h" 27 #include "internal/provider.h" 28 #include "internal/refcount.h" 29 #include "internal/bio.h" 30 #include "internal/core.h" 31 #include "provider_local.h" 32 #ifndef FIPS_MODULE 33 # include <openssl/self_test.h> 34 #endif 35 36 /* 37 * This file defines and uses a number of different structures: 38 * 39 * OSSL_PROVIDER (provider_st): Used to represent all information related to a 40 * single instance of a provider. 41 * 42 * provider_store_st: Holds information about the collection of providers that 43 * are available within the current library context (OSSL_LIB_CTX). It also 44 * holds configuration information about providers that could be loaded at some 45 * future point. 46 * 47 * OSSL_PROVIDER_CHILD_CB: An instance of this structure holds the callbacks 48 * that have been registered for a child library context and the associated 49 * provider that registered those callbacks. 50 * 51 * Where a child library context exists then it has its own instance of the 52 * provider store. Each provider that exists in the parent provider store, has 53 * an associated child provider in the child library context's provider store. 54 * As providers get activated or deactivated this needs to be mirrored in the 55 * associated child providers. 56 * 57 * LOCKING 58 * ======= 59 * 60 * There are a number of different locks used in this file and it is important 61 * to understand how they should be used in order to avoid deadlocks. 62 * 63 * Fields within a structure can often be "write once" on creation, and then 64 * "read many". Creation of a structure is done by a single thread, and 65 * therefore no lock is required for the "write once/read many" fields. It is 66 * safe for multiple threads to read these fields without a lock, because they 67 * will never be changed. 68 * 69 * However some fields may be changed after a structure has been created and 70 * shared between multiple threads. Where this is the case a lock is required. 71 * 72 * The locks available are: 73 * 74 * The provider flag_lock: Used to control updates to the various provider 75 * "flags" (flag_initialized, flag_activated, flag_fallback) and associated 76 * "counts" (activatecnt). 77 * 78 * The provider refcnt_lock: Only ever used to control updates to the provider 79 * refcnt value. 80 * 81 * The provider optbits_lock: Used to control access to the provider's 82 * operation_bits and operation_bits_sz fields. 83 * 84 * The store default_path_lock: Used to control access to the provider store's 85 * default search path value (default_path) 86 * 87 * The store lock: Used to control the stack of provider's held within the 88 * provider store, as well as the stack of registered child provider callbacks. 89 * 90 * As a general rule-of-thumb it is best to: 91 * - keep the scope of the code that is protected by a lock to the absolute 92 * minimum possible; 93 * - try to keep the scope of the lock to within a single function (i.e. avoid 94 * making calls to other functions while holding a lock); 95 * - try to only ever hold one lock at a time. 96 * 97 * Unfortunately, it is not always possible to stick to the above guidelines. 98 * Where they are not adhered to there is always a danger of inadvertently 99 * introducing the possibility of deadlock. The following rules MUST be adhered 100 * to in order to avoid that: 101 * - Holding multiple locks at the same time is only allowed for the 102 * provider store lock, the provider flag_lock and the provider refcnt_lock. 103 * - When holding multiple locks they must be acquired in the following order of 104 * precedence: 105 * 1) provider store lock 106 * 2) provider flag_lock 107 * 3) provider refcnt_lock 108 * - When releasing locks they must be released in the reverse order to which 109 * they were acquired 110 * - No locks may be held when making an upcall. NOTE: Some common functions 111 * can make upcalls as part of their normal operation. If you need to call 112 * some other function while holding a lock make sure you know whether it 113 * will make any upcalls or not. For example ossl_provider_up_ref() can call 114 * ossl_provider_up_ref_parent() which can call the c_prov_up_ref() upcall. 115 * - It is permissible to hold the store and flag locks when calling child 116 * provider callbacks. No other locks may be held during such callbacks. 117 */ 118 119 static OSSL_PROVIDER *provider_new(const char *name, 120 OSSL_provider_init_fn *init_function, 121 STACK_OF(INFOPAIR) *parameters); 122 123 /*- 124 * Provider Object structure 125 * ========================= 126 */ 127 128 #ifndef FIPS_MODULE 129 typedef struct { 130 OSSL_PROVIDER *prov; 131 int (*create_cb)(const OSSL_CORE_HANDLE *provider, void *cbdata); 132 int (*remove_cb)(const OSSL_CORE_HANDLE *provider, void *cbdata); 133 int (*global_props_cb)(const char *props, void *cbdata); 134 void *cbdata; 135 } OSSL_PROVIDER_CHILD_CB; 136 DEFINE_STACK_OF(OSSL_PROVIDER_CHILD_CB) 137 #endif 138 139 struct provider_store_st; /* Forward declaration */ 140 141 struct ossl_provider_st { 142 /* Flag bits */ 143 unsigned int flag_initialized:1; 144 unsigned int flag_activated:1; 145 unsigned int flag_fallback:1; /* Can be used as fallback */ 146 147 /* Getting and setting the flags require synchronization */ 148 CRYPTO_RWLOCK *flag_lock; 149 150 /* OpenSSL library side data */ 151 CRYPTO_REF_COUNT refcnt; 152 CRYPTO_RWLOCK *refcnt_lock; /* For the ref counter */ 153 int activatecnt; 154 char *name; 155 char *path; 156 DSO *module; 157 OSSL_provider_init_fn *init_function; 158 STACK_OF(INFOPAIR) *parameters; 159 OSSL_LIB_CTX *libctx; /* The library context this instance is in */ 160 struct provider_store_st *store; /* The store this instance belongs to */ 161 #ifndef FIPS_MODULE 162 /* 163 * In the FIPS module inner provider, this isn't needed, since the 164 * error upcalls are always direct calls to the outer provider. 165 */ 166 int error_lib; /* ERR library number, one for each provider */ 167 # ifndef OPENSSL_NO_ERR 168 ERR_STRING_DATA *error_strings; /* Copy of what the provider gives us */ 169 # endif 170 #endif 171 172 /* Provider side functions */ 173 OSSL_FUNC_provider_teardown_fn *teardown; 174 OSSL_FUNC_provider_gettable_params_fn *gettable_params; 175 OSSL_FUNC_provider_get_params_fn *get_params; 176 OSSL_FUNC_provider_get_capabilities_fn *get_capabilities; 177 OSSL_FUNC_provider_self_test_fn *self_test; 178 OSSL_FUNC_provider_query_operation_fn *query_operation; 179 OSSL_FUNC_provider_unquery_operation_fn *unquery_operation; 180 181 /* 182 * Cache of bit to indicate of query_operation() has been called on 183 * a specific operation or not. 184 */ 185 unsigned char *operation_bits; 186 size_t operation_bits_sz; 187 CRYPTO_RWLOCK *opbits_lock; 188 189 #ifndef FIPS_MODULE 190 /* Whether this provider is the child of some other provider */ 191 const OSSL_CORE_HANDLE *handle; 192 unsigned int ischild:1; 193 #endif 194 195 /* Provider side data */ 196 void *provctx; 197 const OSSL_DISPATCH *dispatch; 198 }; 199 DEFINE_STACK_OF(OSSL_PROVIDER) 200 201 static int ossl_provider_cmp(const OSSL_PROVIDER * const *a, 202 const OSSL_PROVIDER * const *b) 203 { 204 return strcmp((*a)->name, (*b)->name); 205 } 206 207 /*- 208 * Provider Object store 209 * ===================== 210 * 211 * The Provider Object store is a library context object, and therefore needs 212 * an index. 213 */ 214 215 struct provider_store_st { 216 OSSL_LIB_CTX *libctx; 217 STACK_OF(OSSL_PROVIDER) *providers; 218 STACK_OF(OSSL_PROVIDER_CHILD_CB) *child_cbs; 219 CRYPTO_RWLOCK *default_path_lock; 220 CRYPTO_RWLOCK *lock; 221 char *default_path; 222 OSSL_PROVIDER_INFO *provinfo; 223 size_t numprovinfo; 224 size_t provinfosz; 225 unsigned int use_fallbacks:1; 226 unsigned int freeing:1; 227 }; 228 229 /* 230 * provider_deactivate_free() is a wrapper around ossl_provider_deactivate() 231 * and ossl_provider_free(), called as needed. 232 * Since this is only called when the provider store is being emptied, we 233 * don't need to care about any lock. 234 */ 235 static void provider_deactivate_free(OSSL_PROVIDER *prov) 236 { 237 if (prov->flag_activated) 238 ossl_provider_deactivate(prov, 1); 239 ossl_provider_free(prov); 240 } 241 242 #ifndef FIPS_MODULE 243 static void ossl_provider_child_cb_free(OSSL_PROVIDER_CHILD_CB *cb) 244 { 245 OPENSSL_free(cb); 246 } 247 #endif 248 249 static void infopair_free(INFOPAIR *pair) 250 { 251 OPENSSL_free(pair->name); 252 OPENSSL_free(pair->value); 253 OPENSSL_free(pair); 254 } 255 256 static INFOPAIR *infopair_copy(const INFOPAIR *src) 257 { 258 INFOPAIR *dest = OPENSSL_zalloc(sizeof(*dest)); 259 260 if (dest == NULL) 261 return NULL; 262 if (src->name != NULL) { 263 dest->name = OPENSSL_strdup(src->name); 264 if (dest->name == NULL) 265 goto err; 266 } 267 if (src->value != NULL) { 268 dest->value = OPENSSL_strdup(src->value); 269 if (dest->value == NULL) 270 goto err; 271 } 272 return dest; 273 err: 274 OPENSSL_free(dest->name); 275 OPENSSL_free(dest); 276 return NULL; 277 } 278 279 void ossl_provider_info_clear(OSSL_PROVIDER_INFO *info) 280 { 281 OPENSSL_free(info->name); 282 OPENSSL_free(info->path); 283 sk_INFOPAIR_pop_free(info->parameters, infopair_free); 284 } 285 286 static void provider_store_free(void *vstore) 287 { 288 struct provider_store_st *store = vstore; 289 size_t i; 290 291 if (store == NULL) 292 return; 293 store->freeing = 1; 294 OPENSSL_free(store->default_path); 295 sk_OSSL_PROVIDER_pop_free(store->providers, provider_deactivate_free); 296 #ifndef FIPS_MODULE 297 sk_OSSL_PROVIDER_CHILD_CB_pop_free(store->child_cbs, 298 ossl_provider_child_cb_free); 299 #endif 300 CRYPTO_THREAD_lock_free(store->default_path_lock); 301 CRYPTO_THREAD_lock_free(store->lock); 302 for (i = 0; i < store->numprovinfo; i++) 303 ossl_provider_info_clear(&store->provinfo[i]); 304 OPENSSL_free(store->provinfo); 305 OPENSSL_free(store); 306 } 307 308 static void *provider_store_new(OSSL_LIB_CTX *ctx) 309 { 310 struct provider_store_st *store = OPENSSL_zalloc(sizeof(*store)); 311 312 if (store == NULL 313 || (store->providers = sk_OSSL_PROVIDER_new(ossl_provider_cmp)) == NULL 314 || (store->default_path_lock = CRYPTO_THREAD_lock_new()) == NULL 315 #ifndef FIPS_MODULE 316 || (store->child_cbs = sk_OSSL_PROVIDER_CHILD_CB_new_null()) == NULL 317 #endif 318 || (store->lock = CRYPTO_THREAD_lock_new()) == NULL) { 319 provider_store_free(store); 320 return NULL; 321 } 322 store->libctx = ctx; 323 store->use_fallbacks = 1; 324 325 return store; 326 } 327 328 static const OSSL_LIB_CTX_METHOD provider_store_method = { 329 /* Needs to be freed before the child provider data is freed */ 330 OSSL_LIB_CTX_METHOD_PRIORITY_1, 331 provider_store_new, 332 provider_store_free, 333 }; 334 335 static struct provider_store_st *get_provider_store(OSSL_LIB_CTX *libctx) 336 { 337 struct provider_store_st *store = NULL; 338 339 store = ossl_lib_ctx_get_data(libctx, OSSL_LIB_CTX_PROVIDER_STORE_INDEX, 340 &provider_store_method); 341 if (store == NULL) 342 ERR_raise(ERR_LIB_CRYPTO, ERR_R_INTERNAL_ERROR); 343 return store; 344 } 345 346 int ossl_provider_disable_fallback_loading(OSSL_LIB_CTX *libctx) 347 { 348 struct provider_store_st *store; 349 350 if ((store = get_provider_store(libctx)) != NULL) { 351 if (!CRYPTO_THREAD_write_lock(store->lock)) 352 return 0; 353 store->use_fallbacks = 0; 354 CRYPTO_THREAD_unlock(store->lock); 355 return 1; 356 } 357 return 0; 358 } 359 360 #define BUILTINS_BLOCK_SIZE 10 361 362 int ossl_provider_info_add_to_store(OSSL_LIB_CTX *libctx, 363 OSSL_PROVIDER_INFO *entry) 364 { 365 struct provider_store_st *store = get_provider_store(libctx); 366 int ret = 0; 367 368 if (entry->name == NULL) { 369 ERR_raise(ERR_LIB_CRYPTO, ERR_R_PASSED_NULL_PARAMETER); 370 return 0; 371 } 372 373 if (store == NULL) { 374 ERR_raise(ERR_LIB_CRYPTO, ERR_R_INTERNAL_ERROR); 375 return 0; 376 } 377 378 if (!CRYPTO_THREAD_write_lock(store->lock)) 379 return 0; 380 if (store->provinfosz == 0) { 381 store->provinfo = OPENSSL_zalloc(sizeof(*store->provinfo) 382 * BUILTINS_BLOCK_SIZE); 383 if (store->provinfo == NULL) { 384 ERR_raise(ERR_LIB_CRYPTO, ERR_R_MALLOC_FAILURE); 385 goto err; 386 } 387 store->provinfosz = BUILTINS_BLOCK_SIZE; 388 } else if (store->numprovinfo == store->provinfosz) { 389 OSSL_PROVIDER_INFO *tmpbuiltins; 390 size_t newsz = store->provinfosz + BUILTINS_BLOCK_SIZE; 391 392 tmpbuiltins = OPENSSL_realloc(store->provinfo, 393 sizeof(*store->provinfo) * newsz); 394 if (tmpbuiltins == NULL) { 395 ERR_raise(ERR_LIB_CRYPTO, ERR_R_MALLOC_FAILURE); 396 goto err; 397 } 398 store->provinfo = tmpbuiltins; 399 store->provinfosz = newsz; 400 } 401 store->provinfo[store->numprovinfo] = *entry; 402 store->numprovinfo++; 403 404 ret = 1; 405 err: 406 CRYPTO_THREAD_unlock(store->lock); 407 return ret; 408 } 409 410 OSSL_PROVIDER *ossl_provider_find(OSSL_LIB_CTX *libctx, const char *name, 411 int noconfig) 412 { 413 struct provider_store_st *store = NULL; 414 OSSL_PROVIDER *prov = NULL; 415 416 if ((store = get_provider_store(libctx)) != NULL) { 417 OSSL_PROVIDER tmpl = { 0, }; 418 int i; 419 420 #ifndef FIPS_MODULE 421 /* 422 * Make sure any providers are loaded from config before we try to find 423 * them. 424 */ 425 if (!noconfig) { 426 if (ossl_lib_ctx_is_default(libctx)) 427 OPENSSL_init_crypto(OPENSSL_INIT_LOAD_CONFIG, NULL); 428 } 429 #endif 430 431 tmpl.name = (char *)name; 432 /* 433 * A "find" operation can sort the stack, and therefore a write lock is 434 * required. 435 */ 436 if (!CRYPTO_THREAD_write_lock(store->lock)) 437 return NULL; 438 if ((i = sk_OSSL_PROVIDER_find(store->providers, &tmpl)) != -1) 439 prov = sk_OSSL_PROVIDER_value(store->providers, i); 440 CRYPTO_THREAD_unlock(store->lock); 441 if (prov != NULL && !ossl_provider_up_ref(prov)) 442 prov = NULL; 443 } 444 445 return prov; 446 } 447 448 /*- 449 * Provider Object methods 450 * ======================= 451 */ 452 453 static OSSL_PROVIDER *provider_new(const char *name, 454 OSSL_provider_init_fn *init_function, 455 STACK_OF(INFOPAIR) *parameters) 456 { 457 OSSL_PROVIDER *prov = NULL; 458 459 if ((prov = OPENSSL_zalloc(sizeof(*prov))) == NULL 460 #ifndef HAVE_ATOMICS 461 || (prov->refcnt_lock = CRYPTO_THREAD_lock_new()) == NULL 462 #endif 463 ) { 464 OPENSSL_free(prov); 465 ERR_raise(ERR_LIB_CRYPTO, ERR_R_MALLOC_FAILURE); 466 return NULL; 467 } 468 469 prov->refcnt = 1; /* 1 One reference to be returned */ 470 471 if ((prov->opbits_lock = CRYPTO_THREAD_lock_new()) == NULL 472 || (prov->flag_lock = CRYPTO_THREAD_lock_new()) == NULL 473 || (prov->name = OPENSSL_strdup(name)) == NULL 474 || (prov->parameters = sk_INFOPAIR_deep_copy(parameters, 475 infopair_copy, 476 infopair_free)) == NULL) { 477 ossl_provider_free(prov); 478 ERR_raise(ERR_LIB_CRYPTO, ERR_R_MALLOC_FAILURE); 479 return NULL; 480 } 481 482 prov->init_function = init_function; 483 484 return prov; 485 } 486 487 int ossl_provider_up_ref(OSSL_PROVIDER *prov) 488 { 489 int ref = 0; 490 491 if (CRYPTO_UP_REF(&prov->refcnt, &ref, prov->refcnt_lock) <= 0) 492 return 0; 493 494 #ifndef FIPS_MODULE 495 if (prov->ischild) { 496 if (!ossl_provider_up_ref_parent(prov, 0)) { 497 ossl_provider_free(prov); 498 return 0; 499 } 500 } 501 #endif 502 503 return ref; 504 } 505 506 #ifndef FIPS_MODULE 507 static int provider_up_ref_intern(OSSL_PROVIDER *prov, int activate) 508 { 509 if (activate) 510 return ossl_provider_activate(prov, 1, 0); 511 512 return ossl_provider_up_ref(prov); 513 } 514 515 static int provider_free_intern(OSSL_PROVIDER *prov, int deactivate) 516 { 517 if (deactivate) 518 return ossl_provider_deactivate(prov, 1); 519 520 ossl_provider_free(prov); 521 return 1; 522 } 523 #endif 524 525 /* 526 * We assume that the requested provider does not already exist in the store. 527 * The caller should check. If it does exist then adding it to the store later 528 * will fail. 529 */ 530 OSSL_PROVIDER *ossl_provider_new(OSSL_LIB_CTX *libctx, const char *name, 531 OSSL_provider_init_fn *init_function, 532 int noconfig) 533 { 534 struct provider_store_st *store = NULL; 535 OSSL_PROVIDER_INFO template; 536 OSSL_PROVIDER *prov = NULL; 537 538 if ((store = get_provider_store(libctx)) == NULL) 539 return NULL; 540 541 memset(&template, 0, sizeof(template)); 542 if (init_function == NULL) { 543 const OSSL_PROVIDER_INFO *p; 544 size_t i; 545 546 /* Check if this is a predefined builtin provider */ 547 for (p = ossl_predefined_providers; p->name != NULL; p++) { 548 if (strcmp(p->name, name) == 0) { 549 template = *p; 550 break; 551 } 552 } 553 if (p->name == NULL) { 554 /* Check if this is a user added builtin provider */ 555 if (!CRYPTO_THREAD_read_lock(store->lock)) 556 return NULL; 557 for (i = 0, p = store->provinfo; i < store->numprovinfo; p++, i++) { 558 if (strcmp(p->name, name) == 0) { 559 template = *p; 560 break; 561 } 562 } 563 CRYPTO_THREAD_unlock(store->lock); 564 } 565 } else { 566 template.init = init_function; 567 } 568 569 /* provider_new() generates an error, so no need here */ 570 if ((prov = provider_new(name, template.init, template.parameters)) == NULL) 571 return NULL; 572 573 prov->libctx = libctx; 574 #ifndef FIPS_MODULE 575 prov->error_lib = ERR_get_next_error_library(); 576 #endif 577 578 /* 579 * At this point, the provider is only partially "loaded". To be 580 * fully "loaded", ossl_provider_activate() must also be called and it must 581 * then be added to the provider store. 582 */ 583 584 return prov; 585 } 586 587 /* Assumes that the store lock is held */ 588 static int create_provider_children(OSSL_PROVIDER *prov) 589 { 590 int ret = 1; 591 #ifndef FIPS_MODULE 592 struct provider_store_st *store = prov->store; 593 OSSL_PROVIDER_CHILD_CB *child_cb; 594 int i, max; 595 596 max = sk_OSSL_PROVIDER_CHILD_CB_num(store->child_cbs); 597 for (i = 0; i < max; i++) { 598 /* 599 * This is newly activated (activatecnt == 1), so we need to 600 * create child providers as necessary. 601 */ 602 child_cb = sk_OSSL_PROVIDER_CHILD_CB_value(store->child_cbs, i); 603 ret &= child_cb->create_cb((OSSL_CORE_HANDLE *)prov, child_cb->cbdata); 604 } 605 #endif 606 607 return ret; 608 } 609 610 int ossl_provider_add_to_store(OSSL_PROVIDER *prov, OSSL_PROVIDER **actualprov, 611 int retain_fallbacks) 612 { 613 struct provider_store_st *store; 614 int idx; 615 OSSL_PROVIDER tmpl = { 0, }; 616 OSSL_PROVIDER *actualtmp = NULL; 617 618 if (actualprov != NULL) 619 *actualprov = NULL; 620 621 if ((store = get_provider_store(prov->libctx)) == NULL) 622 return 0; 623 624 if (!CRYPTO_THREAD_write_lock(store->lock)) 625 return 0; 626 627 tmpl.name = (char *)prov->name; 628 idx = sk_OSSL_PROVIDER_find(store->providers, &tmpl); 629 if (idx == -1) 630 actualtmp = prov; 631 else 632 actualtmp = sk_OSSL_PROVIDER_value(store->providers, idx); 633 634 if (idx == -1) { 635 if (sk_OSSL_PROVIDER_push(store->providers, prov) == 0) 636 goto err; 637 prov->store = store; 638 if (!create_provider_children(prov)) { 639 sk_OSSL_PROVIDER_delete_ptr(store->providers, prov); 640 goto err; 641 } 642 if (!retain_fallbacks) 643 store->use_fallbacks = 0; 644 } 645 646 CRYPTO_THREAD_unlock(store->lock); 647 648 if (actualprov != NULL) { 649 if (!ossl_provider_up_ref(actualtmp)) { 650 ERR_raise(ERR_LIB_CRYPTO, ERR_R_MALLOC_FAILURE); 651 actualtmp = NULL; 652 return 0; 653 } 654 *actualprov = actualtmp; 655 } 656 657 if (idx >= 0) { 658 /* 659 * The provider is already in the store. Probably two threads 660 * independently initialised their own provider objects with the same 661 * name and raced to put them in the store. This thread lost. We 662 * deactivate the one we just created and use the one that already 663 * exists instead. 664 * If we get here then we know we did not create provider children 665 * above, so we inform ossl_provider_deactivate not to attempt to remove 666 * any. 667 */ 668 ossl_provider_deactivate(prov, 0); 669 ossl_provider_free(prov); 670 } 671 672 return 1; 673 674 err: 675 CRYPTO_THREAD_unlock(store->lock); 676 return 0; 677 } 678 679 void ossl_provider_free(OSSL_PROVIDER *prov) 680 { 681 if (prov != NULL) { 682 int ref = 0; 683 684 CRYPTO_DOWN_REF(&prov->refcnt, &ref, prov->refcnt_lock); 685 686 /* 687 * When the refcount drops to zero, we clean up the provider. 688 * Note that this also does teardown, which may seem late, 689 * considering that init happens on first activation. However, 690 * there may be other structures hanging on to the provider after 691 * the last deactivation and may therefore need full access to the 692 * provider's services. Therefore, we deinit late. 693 */ 694 if (ref == 0) { 695 if (prov->flag_initialized) { 696 ossl_provider_teardown(prov); 697 #ifndef OPENSSL_NO_ERR 698 # ifndef FIPS_MODULE 699 if (prov->error_strings != NULL) { 700 ERR_unload_strings(prov->error_lib, prov->error_strings); 701 OPENSSL_free(prov->error_strings); 702 prov->error_strings = NULL; 703 } 704 # endif 705 #endif 706 OPENSSL_free(prov->operation_bits); 707 prov->operation_bits = NULL; 708 prov->operation_bits_sz = 0; 709 prov->flag_initialized = 0; 710 } 711 712 #ifndef FIPS_MODULE 713 /* 714 * We deregister thread handling whether or not the provider was 715 * initialized. If init was attempted but was not successful then 716 * the provider may still have registered a thread handler. 717 */ 718 ossl_init_thread_deregister(prov); 719 DSO_free(prov->module); 720 #endif 721 OPENSSL_free(prov->name); 722 OPENSSL_free(prov->path); 723 sk_INFOPAIR_pop_free(prov->parameters, infopair_free); 724 CRYPTO_THREAD_lock_free(prov->opbits_lock); 725 CRYPTO_THREAD_lock_free(prov->flag_lock); 726 #ifndef HAVE_ATOMICS 727 CRYPTO_THREAD_lock_free(prov->refcnt_lock); 728 #endif 729 OPENSSL_free(prov); 730 } 731 #ifndef FIPS_MODULE 732 else if (prov->ischild) { 733 ossl_provider_free_parent(prov, 0); 734 } 735 #endif 736 } 737 } 738 739 /* Setters */ 740 int ossl_provider_set_module_path(OSSL_PROVIDER *prov, const char *module_path) 741 { 742 OPENSSL_free(prov->path); 743 prov->path = NULL; 744 if (module_path == NULL) 745 return 1; 746 if ((prov->path = OPENSSL_strdup(module_path)) != NULL) 747 return 1; 748 ERR_raise(ERR_LIB_CRYPTO, ERR_R_MALLOC_FAILURE); 749 return 0; 750 } 751 752 static int infopair_add(STACK_OF(INFOPAIR) **infopairsk, const char *name, 753 const char *value) 754 { 755 INFOPAIR *pair = NULL; 756 757 if ((pair = OPENSSL_zalloc(sizeof(*pair))) != NULL 758 && (*infopairsk != NULL 759 || (*infopairsk = sk_INFOPAIR_new_null()) != NULL) 760 && (pair->name = OPENSSL_strdup(name)) != NULL 761 && (pair->value = OPENSSL_strdup(value)) != NULL 762 && sk_INFOPAIR_push(*infopairsk, pair) > 0) 763 return 1; 764 765 if (pair != NULL) { 766 OPENSSL_free(pair->name); 767 OPENSSL_free(pair->value); 768 OPENSSL_free(pair); 769 } 770 ERR_raise(ERR_LIB_CRYPTO, ERR_R_MALLOC_FAILURE); 771 return 0; 772 } 773 774 int ossl_provider_add_parameter(OSSL_PROVIDER *prov, 775 const char *name, const char *value) 776 { 777 return infopair_add(&prov->parameters, name, value); 778 } 779 780 int ossl_provider_info_add_parameter(OSSL_PROVIDER_INFO *provinfo, 781 const char *name, 782 const char *value) 783 { 784 return infopair_add(&provinfo->parameters, name, value); 785 } 786 787 /* 788 * Provider activation. 789 * 790 * What "activation" means depends on the provider form; for built in 791 * providers (in the library or the application alike), the provider 792 * can already be considered to be loaded, all that's needed is to 793 * initialize it. However, for dynamically loadable provider modules, 794 * we must first load that module. 795 * 796 * Built in modules are distinguished from dynamically loaded modules 797 * with an already assigned init function. 798 */ 799 static const OSSL_DISPATCH *core_dispatch; /* Define further down */ 800 801 int OSSL_PROVIDER_set_default_search_path(OSSL_LIB_CTX *libctx, 802 const char *path) 803 { 804 struct provider_store_st *store; 805 char *p = NULL; 806 807 if (path != NULL) { 808 p = OPENSSL_strdup(path); 809 if (p == NULL) { 810 ERR_raise(ERR_LIB_CRYPTO, ERR_R_MALLOC_FAILURE); 811 return 0; 812 } 813 } 814 if ((store = get_provider_store(libctx)) != NULL 815 && CRYPTO_THREAD_write_lock(store->default_path_lock)) { 816 OPENSSL_free(store->default_path); 817 store->default_path = p; 818 CRYPTO_THREAD_unlock(store->default_path_lock); 819 return 1; 820 } 821 OPENSSL_free(p); 822 return 0; 823 } 824 825 /* 826 * Internal version that doesn't affect the store flags, and thereby avoid 827 * locking. Direct callers must remember to set the store flags when 828 * appropriate. 829 */ 830 static int provider_init(OSSL_PROVIDER *prov) 831 { 832 const OSSL_DISPATCH *provider_dispatch = NULL; 833 void *tmp_provctx = NULL; /* safety measure */ 834 #ifndef OPENSSL_NO_ERR 835 # ifndef FIPS_MODULE 836 OSSL_FUNC_provider_get_reason_strings_fn *p_get_reason_strings = NULL; 837 # endif 838 #endif 839 int ok = 0; 840 841 if (!ossl_assert(!prov->flag_initialized)) { 842 ERR_raise(ERR_LIB_CRYPTO, ERR_R_INTERNAL_ERROR); 843 goto end; 844 } 845 846 /* 847 * If the init function isn't set, it indicates that this provider is 848 * a loadable module. 849 */ 850 if (prov->init_function == NULL) { 851 #ifdef FIPS_MODULE 852 goto end; 853 #else 854 if (prov->module == NULL) { 855 char *allocated_path = NULL; 856 const char *module_path = NULL; 857 char *merged_path = NULL; 858 const char *load_dir = NULL; 859 char *allocated_load_dir = NULL; 860 struct provider_store_st *store; 861 862 if ((prov->module = DSO_new()) == NULL) { 863 /* DSO_new() generates an error already */ 864 goto end; 865 } 866 867 if ((store = get_provider_store(prov->libctx)) == NULL 868 || !CRYPTO_THREAD_read_lock(store->default_path_lock)) 869 goto end; 870 871 if (store->default_path != NULL) { 872 allocated_load_dir = OPENSSL_strdup(store->default_path); 873 CRYPTO_THREAD_unlock(store->default_path_lock); 874 if (allocated_load_dir == NULL) { 875 ERR_raise(ERR_LIB_CRYPTO, ERR_R_MALLOC_FAILURE); 876 goto end; 877 } 878 load_dir = allocated_load_dir; 879 } else { 880 CRYPTO_THREAD_unlock(store->default_path_lock); 881 } 882 883 if (load_dir == NULL) { 884 load_dir = ossl_safe_getenv("OPENSSL_MODULES"); 885 if (load_dir == NULL) 886 load_dir = MODULESDIR; 887 } 888 889 DSO_ctrl(prov->module, DSO_CTRL_SET_FLAGS, 890 DSO_FLAG_NAME_TRANSLATION_EXT_ONLY, NULL); 891 892 module_path = prov->path; 893 if (module_path == NULL) 894 module_path = allocated_path = 895 DSO_convert_filename(prov->module, prov->name); 896 if (module_path != NULL) 897 merged_path = DSO_merge(prov->module, module_path, load_dir); 898 899 if (merged_path == NULL 900 || (DSO_load(prov->module, merged_path, NULL, 0)) == NULL) { 901 DSO_free(prov->module); 902 prov->module = NULL; 903 } 904 905 OPENSSL_free(merged_path); 906 OPENSSL_free(allocated_path); 907 OPENSSL_free(allocated_load_dir); 908 } 909 910 if (prov->module == NULL) { 911 /* DSO has already recorded errors, this is just a tracepoint */ 912 ERR_raise_data(ERR_LIB_CRYPTO, ERR_R_DSO_LIB, 913 "name=%s", prov->name); 914 goto end; 915 } 916 917 prov->init_function = (OSSL_provider_init_fn *) 918 DSO_bind_func(prov->module, "OSSL_provider_init"); 919 #endif 920 } 921 922 /* Check for and call the initialise function for the provider. */ 923 if (prov->init_function == NULL) { 924 ERR_raise_data(ERR_LIB_CRYPTO, ERR_R_UNSUPPORTED, 925 "name=%s, provider has no provider init function", 926 prov->name); 927 goto end; 928 } 929 930 if (!prov->init_function((OSSL_CORE_HANDLE *)prov, core_dispatch, 931 &provider_dispatch, &tmp_provctx)) { 932 ERR_raise_data(ERR_LIB_CRYPTO, ERR_R_INIT_FAIL, 933 "name=%s", prov->name); 934 goto end; 935 } 936 prov->provctx = tmp_provctx; 937 prov->dispatch = provider_dispatch; 938 939 for (; provider_dispatch->function_id != 0; provider_dispatch++) { 940 switch (provider_dispatch->function_id) { 941 case OSSL_FUNC_PROVIDER_TEARDOWN: 942 prov->teardown = 943 OSSL_FUNC_provider_teardown(provider_dispatch); 944 break; 945 case OSSL_FUNC_PROVIDER_GETTABLE_PARAMS: 946 prov->gettable_params = 947 OSSL_FUNC_provider_gettable_params(provider_dispatch); 948 break; 949 case OSSL_FUNC_PROVIDER_GET_PARAMS: 950 prov->get_params = 951 OSSL_FUNC_provider_get_params(provider_dispatch); 952 break; 953 case OSSL_FUNC_PROVIDER_SELF_TEST: 954 prov->self_test = 955 OSSL_FUNC_provider_self_test(provider_dispatch); 956 break; 957 case OSSL_FUNC_PROVIDER_GET_CAPABILITIES: 958 prov->get_capabilities = 959 OSSL_FUNC_provider_get_capabilities(provider_dispatch); 960 break; 961 case OSSL_FUNC_PROVIDER_QUERY_OPERATION: 962 prov->query_operation = 963 OSSL_FUNC_provider_query_operation(provider_dispatch); 964 break; 965 case OSSL_FUNC_PROVIDER_UNQUERY_OPERATION: 966 prov->unquery_operation = 967 OSSL_FUNC_provider_unquery_operation(provider_dispatch); 968 break; 969 #ifndef OPENSSL_NO_ERR 970 # ifndef FIPS_MODULE 971 case OSSL_FUNC_PROVIDER_GET_REASON_STRINGS: 972 p_get_reason_strings = 973 OSSL_FUNC_provider_get_reason_strings(provider_dispatch); 974 break; 975 # endif 976 #endif 977 } 978 } 979 980 #ifndef OPENSSL_NO_ERR 981 # ifndef FIPS_MODULE 982 if (p_get_reason_strings != NULL) { 983 const OSSL_ITEM *reasonstrings = p_get_reason_strings(prov->provctx); 984 size_t cnt, cnt2; 985 986 /* 987 * ERR_load_strings() handles ERR_STRING_DATA rather than OSSL_ITEM, 988 * although they are essentially the same type. 989 * Furthermore, ERR_load_strings() patches the array's error number 990 * with the error library number, so we need to make a copy of that 991 * array either way. 992 */ 993 cnt = 0; 994 while (reasonstrings[cnt].id != 0) { 995 if (ERR_GET_LIB(reasonstrings[cnt].id) != 0) 996 goto end; 997 cnt++; 998 } 999 cnt++; /* One for the terminating item */ 1000 1001 /* Allocate one extra item for the "library" name */ 1002 prov->error_strings = 1003 OPENSSL_zalloc(sizeof(ERR_STRING_DATA) * (cnt + 1)); 1004 if (prov->error_strings == NULL) 1005 goto end; 1006 1007 /* 1008 * Set the "library" name. 1009 */ 1010 prov->error_strings[0].error = ERR_PACK(prov->error_lib, 0, 0); 1011 prov->error_strings[0].string = prov->name; 1012 /* 1013 * Copy reasonstrings item 0..cnt-1 to prov->error_trings positions 1014 * 1..cnt. 1015 */ 1016 for (cnt2 = 1; cnt2 <= cnt; cnt2++) { 1017 prov->error_strings[cnt2].error = (int)reasonstrings[cnt2-1].id; 1018 prov->error_strings[cnt2].string = reasonstrings[cnt2-1].ptr; 1019 } 1020 1021 ERR_load_strings(prov->error_lib, prov->error_strings); 1022 } 1023 # endif 1024 #endif 1025 1026 /* With this flag set, this provider has become fully "loaded". */ 1027 prov->flag_initialized = 1; 1028 ok = 1; 1029 1030 end: 1031 return ok; 1032 } 1033 1034 /* 1035 * Deactivate a provider. If upcalls is 0 then we suppress any upcalls to a 1036 * parent provider. If removechildren is 0 then we suppress any calls to remove 1037 * child providers. 1038 * Return -1 on failure and the activation count on success 1039 */ 1040 static int provider_deactivate(OSSL_PROVIDER *prov, int upcalls, 1041 int removechildren) 1042 { 1043 int count; 1044 struct provider_store_st *store; 1045 #ifndef FIPS_MODULE 1046 int freeparent = 0; 1047 #endif 1048 int lock = 1; 1049 1050 if (!ossl_assert(prov != NULL)) 1051 return -1; 1052 1053 /* 1054 * No need to lock if we've got no store because we've not been shared with 1055 * other threads. 1056 */ 1057 store = get_provider_store(prov->libctx); 1058 if (store == NULL) 1059 lock = 0; 1060 1061 if (lock && !CRYPTO_THREAD_read_lock(store->lock)) 1062 return -1; 1063 if (lock && !CRYPTO_THREAD_write_lock(prov->flag_lock)) { 1064 CRYPTO_THREAD_unlock(store->lock); 1065 return -1; 1066 } 1067 1068 #ifndef FIPS_MODULE 1069 if (prov->activatecnt >= 2 && prov->ischild && upcalls) { 1070 /* 1071 * We have had a direct activation in this child libctx so we need to 1072 * now down the ref count in the parent provider. We do the actual down 1073 * ref outside of the flag_lock, since it could involve getting other 1074 * locks. 1075 */ 1076 freeparent = 1; 1077 } 1078 #endif 1079 1080 if ((count = --prov->activatecnt) < 1) 1081 prov->flag_activated = 0; 1082 #ifndef FIPS_MODULE 1083 else 1084 removechildren = 0; 1085 #endif 1086 1087 #ifndef FIPS_MODULE 1088 if (removechildren && store != NULL) { 1089 int i, max = sk_OSSL_PROVIDER_CHILD_CB_num(store->child_cbs); 1090 OSSL_PROVIDER_CHILD_CB *child_cb; 1091 1092 for (i = 0; i < max; i++) { 1093 child_cb = sk_OSSL_PROVIDER_CHILD_CB_value(store->child_cbs, i); 1094 child_cb->remove_cb((OSSL_CORE_HANDLE *)prov, child_cb->cbdata); 1095 } 1096 } 1097 #endif 1098 if (lock) { 1099 CRYPTO_THREAD_unlock(prov->flag_lock); 1100 CRYPTO_THREAD_unlock(store->lock); 1101 } 1102 #ifndef FIPS_MODULE 1103 if (freeparent) 1104 ossl_provider_free_parent(prov, 1); 1105 #endif 1106 1107 /* We don't deinit here, that's done in ossl_provider_free() */ 1108 return count; 1109 } 1110 1111 /* 1112 * Activate a provider. 1113 * Return -1 on failure and the activation count on success 1114 */ 1115 static int provider_activate(OSSL_PROVIDER *prov, int lock, int upcalls) 1116 { 1117 int count = -1; 1118 struct provider_store_st *store; 1119 int ret = 1; 1120 1121 store = prov->store; 1122 /* 1123 * If the provider hasn't been added to the store, then we don't need 1124 * any locks because we've not shared it with other threads. 1125 */ 1126 if (store == NULL) { 1127 lock = 0; 1128 if (!provider_init(prov)) 1129 return -1; 1130 } 1131 1132 #ifndef FIPS_MODULE 1133 if (prov->ischild && upcalls && !ossl_provider_up_ref_parent(prov, 1)) 1134 return -1; 1135 #endif 1136 1137 if (lock && !CRYPTO_THREAD_read_lock(store->lock)) { 1138 #ifndef FIPS_MODULE 1139 if (prov->ischild && upcalls) 1140 ossl_provider_free_parent(prov, 1); 1141 #endif 1142 return -1; 1143 } 1144 1145 if (lock && !CRYPTO_THREAD_write_lock(prov->flag_lock)) { 1146 CRYPTO_THREAD_unlock(store->lock); 1147 #ifndef FIPS_MODULE 1148 if (prov->ischild && upcalls) 1149 ossl_provider_free_parent(prov, 1); 1150 #endif 1151 return -1; 1152 } 1153 1154 count = ++prov->activatecnt; 1155 prov->flag_activated = 1; 1156 1157 if (prov->activatecnt == 1 && store != NULL) { 1158 ret = create_provider_children(prov); 1159 } 1160 if (lock) { 1161 CRYPTO_THREAD_unlock(prov->flag_lock); 1162 CRYPTO_THREAD_unlock(store->lock); 1163 } 1164 1165 if (!ret) 1166 return -1; 1167 1168 return count; 1169 } 1170 1171 static int provider_flush_store_cache(const OSSL_PROVIDER *prov) 1172 { 1173 struct provider_store_st *store; 1174 int freeing; 1175 1176 if ((store = get_provider_store(prov->libctx)) == NULL) 1177 return 0; 1178 1179 if (!CRYPTO_THREAD_read_lock(store->lock)) 1180 return 0; 1181 freeing = store->freeing; 1182 CRYPTO_THREAD_unlock(store->lock); 1183 1184 if (!freeing) { 1185 int acc 1186 = evp_method_store_cache_flush(prov->libctx) 1187 #ifndef FIPS_MODULE 1188 + ossl_encoder_store_cache_flush(prov->libctx) 1189 + ossl_decoder_store_cache_flush(prov->libctx) 1190 + ossl_store_loader_store_cache_flush(prov->libctx) 1191 #endif 1192 ; 1193 1194 #ifndef FIPS_MODULE 1195 return acc == 4; 1196 #else 1197 return acc == 1; 1198 #endif 1199 } 1200 return 1; 1201 } 1202 1203 static int provider_remove_store_methods(OSSL_PROVIDER *prov) 1204 { 1205 struct provider_store_st *store; 1206 int freeing; 1207 1208 if ((store = get_provider_store(prov->libctx)) == NULL) 1209 return 0; 1210 1211 if (!CRYPTO_THREAD_read_lock(store->lock)) 1212 return 0; 1213 freeing = store->freeing; 1214 CRYPTO_THREAD_unlock(store->lock); 1215 1216 if (!freeing) { 1217 int acc; 1218 1219 if (!CRYPTO_THREAD_write_lock(prov->opbits_lock)) 1220 return 0; 1221 OPENSSL_free(prov->operation_bits); 1222 prov->operation_bits = NULL; 1223 prov->operation_bits_sz = 0; 1224 CRYPTO_THREAD_unlock(prov->opbits_lock); 1225 1226 acc = evp_method_store_remove_all_provided(prov) 1227 #ifndef FIPS_MODULE 1228 + ossl_encoder_store_remove_all_provided(prov) 1229 + ossl_decoder_store_remove_all_provided(prov) 1230 + ossl_store_loader_store_remove_all_provided(prov) 1231 #endif 1232 ; 1233 1234 #ifndef FIPS_MODULE 1235 return acc == 4; 1236 #else 1237 return acc == 1; 1238 #endif 1239 } 1240 return 1; 1241 } 1242 1243 int ossl_provider_activate(OSSL_PROVIDER *prov, int upcalls, int aschild) 1244 { 1245 int count; 1246 1247 if (prov == NULL) 1248 return 0; 1249 #ifndef FIPS_MODULE 1250 /* 1251 * If aschild is true, then we only actually do the activation if the 1252 * provider is a child. If its not, this is still success. 1253 */ 1254 if (aschild && !prov->ischild) 1255 return 1; 1256 #endif 1257 if ((count = provider_activate(prov, 1, upcalls)) > 0) 1258 return count == 1 ? provider_flush_store_cache(prov) : 1; 1259 1260 return 0; 1261 } 1262 1263 int ossl_provider_deactivate(OSSL_PROVIDER *prov, int removechildren) 1264 { 1265 int count; 1266 1267 if (prov == NULL 1268 || (count = provider_deactivate(prov, 1, removechildren)) < 0) 1269 return 0; 1270 return count == 0 ? provider_remove_store_methods(prov) : 1; 1271 } 1272 1273 void *ossl_provider_ctx(const OSSL_PROVIDER *prov) 1274 { 1275 return prov != NULL ? prov->provctx : NULL; 1276 } 1277 1278 /* 1279 * This function only does something once when store->use_fallbacks == 1, 1280 * and then sets store->use_fallbacks = 0, so the second call and so on is 1281 * effectively a no-op. 1282 */ 1283 static int provider_activate_fallbacks(struct provider_store_st *store) 1284 { 1285 int use_fallbacks; 1286 int activated_fallback_count = 0; 1287 int ret = 0; 1288 const OSSL_PROVIDER_INFO *p; 1289 1290 if (!CRYPTO_THREAD_read_lock(store->lock)) 1291 return 0; 1292 use_fallbacks = store->use_fallbacks; 1293 CRYPTO_THREAD_unlock(store->lock); 1294 if (!use_fallbacks) 1295 return 1; 1296 1297 if (!CRYPTO_THREAD_write_lock(store->lock)) 1298 return 0; 1299 /* Check again, just in case another thread changed it */ 1300 use_fallbacks = store->use_fallbacks; 1301 if (!use_fallbacks) { 1302 CRYPTO_THREAD_unlock(store->lock); 1303 return 1; 1304 } 1305 1306 for (p = ossl_predefined_providers; p->name != NULL; p++) { 1307 OSSL_PROVIDER *prov = NULL; 1308 1309 if (!p->is_fallback) 1310 continue; 1311 /* 1312 * We use the internal constructor directly here, 1313 * otherwise we get a call loop 1314 */ 1315 prov = provider_new(p->name, p->init, NULL); 1316 if (prov == NULL) 1317 goto err; 1318 prov->libctx = store->libctx; 1319 #ifndef FIPS_MODULE 1320 prov->error_lib = ERR_get_next_error_library(); 1321 #endif 1322 1323 /* 1324 * We are calling provider_activate while holding the store lock. This 1325 * means the init function will be called while holding a lock. Normally 1326 * we try to avoid calling a user callback while holding a lock. 1327 * However, fallbacks are never third party providers so we accept this. 1328 */ 1329 if (provider_activate(prov, 0, 0) < 0) { 1330 ossl_provider_free(prov); 1331 goto err; 1332 } 1333 prov->store = store; 1334 if (sk_OSSL_PROVIDER_push(store->providers, prov) == 0) { 1335 ossl_provider_free(prov); 1336 goto err; 1337 } 1338 activated_fallback_count++; 1339 } 1340 1341 if (activated_fallback_count > 0) { 1342 store->use_fallbacks = 0; 1343 ret = 1; 1344 } 1345 err: 1346 CRYPTO_THREAD_unlock(store->lock); 1347 return ret; 1348 } 1349 1350 int ossl_provider_doall_activated(OSSL_LIB_CTX *ctx, 1351 int (*cb)(OSSL_PROVIDER *provider, 1352 void *cbdata), 1353 void *cbdata) 1354 { 1355 int ret = 0, curr, max, ref = 0; 1356 struct provider_store_st *store = get_provider_store(ctx); 1357 STACK_OF(OSSL_PROVIDER) *provs = NULL; 1358 1359 #ifndef FIPS_MODULE 1360 /* 1361 * Make sure any providers are loaded from config before we try to use 1362 * them. 1363 */ 1364 if (ossl_lib_ctx_is_default(ctx)) 1365 OPENSSL_init_crypto(OPENSSL_INIT_LOAD_CONFIG, NULL); 1366 #endif 1367 1368 if (store == NULL) 1369 return 1; 1370 if (!provider_activate_fallbacks(store)) 1371 return 0; 1372 1373 /* 1374 * Under lock, grab a copy of the provider list and up_ref each 1375 * provider so that they don't disappear underneath us. 1376 */ 1377 if (!CRYPTO_THREAD_read_lock(store->lock)) 1378 return 0; 1379 provs = sk_OSSL_PROVIDER_dup(store->providers); 1380 if (provs == NULL) { 1381 CRYPTO_THREAD_unlock(store->lock); 1382 return 0; 1383 } 1384 max = sk_OSSL_PROVIDER_num(provs); 1385 /* 1386 * We work backwards through the stack so that we can safely delete items 1387 * as we go. 1388 */ 1389 for (curr = max - 1; curr >= 0; curr--) { 1390 OSSL_PROVIDER *prov = sk_OSSL_PROVIDER_value(provs, curr); 1391 1392 if (!CRYPTO_THREAD_write_lock(prov->flag_lock)) 1393 goto err_unlock; 1394 if (prov->flag_activated) { 1395 /* 1396 * We call CRYPTO_UP_REF directly rather than ossl_provider_up_ref 1397 * to avoid upping the ref count on the parent provider, which we 1398 * must not do while holding locks. 1399 */ 1400 if (CRYPTO_UP_REF(&prov->refcnt, &ref, prov->refcnt_lock) <= 0) { 1401 CRYPTO_THREAD_unlock(prov->flag_lock); 1402 goto err_unlock; 1403 } 1404 /* 1405 * It's already activated, but we up the activated count to ensure 1406 * it remains activated until after we've called the user callback. 1407 * We do this with no locking (because we already hold the locks) 1408 * and no upcalls (which must not be called when locks are held). In 1409 * theory this could mean the parent provider goes inactive, whilst 1410 * still activated in the child for a short period. That's ok. 1411 */ 1412 if (provider_activate(prov, 0, 0) < 0) { 1413 CRYPTO_DOWN_REF(&prov->refcnt, &ref, prov->refcnt_lock); 1414 CRYPTO_THREAD_unlock(prov->flag_lock); 1415 goto err_unlock; 1416 } 1417 } else { 1418 sk_OSSL_PROVIDER_delete(provs, curr); 1419 max--; 1420 } 1421 CRYPTO_THREAD_unlock(prov->flag_lock); 1422 } 1423 CRYPTO_THREAD_unlock(store->lock); 1424 1425 /* 1426 * Now, we sweep through all providers not under lock 1427 */ 1428 for (curr = 0; curr < max; curr++) { 1429 OSSL_PROVIDER *prov = sk_OSSL_PROVIDER_value(provs, curr); 1430 1431 if (!cb(prov, cbdata)) { 1432 curr = -1; 1433 goto finish; 1434 } 1435 } 1436 curr = -1; 1437 1438 ret = 1; 1439 goto finish; 1440 1441 err_unlock: 1442 CRYPTO_THREAD_unlock(store->lock); 1443 finish: 1444 /* 1445 * The pop_free call doesn't do what we want on an error condition. We 1446 * either start from the first item in the stack, or part way through if 1447 * we only processed some of the items. 1448 */ 1449 for (curr++; curr < max; curr++) { 1450 OSSL_PROVIDER *prov = sk_OSSL_PROVIDER_value(provs, curr); 1451 1452 provider_deactivate(prov, 0, 1); 1453 /* 1454 * As above where we did the up-ref, we don't call ossl_provider_free 1455 * to avoid making upcalls. There should always be at least one ref 1456 * to the provider in the store, so this should never drop to 0. 1457 */ 1458 CRYPTO_DOWN_REF(&prov->refcnt, &ref, prov->refcnt_lock); 1459 /* 1460 * Not much we can do if this assert ever fails. So we don't use 1461 * ossl_assert here. 1462 */ 1463 assert(ref > 0); 1464 } 1465 sk_OSSL_PROVIDER_free(provs); 1466 return ret; 1467 } 1468 1469 int OSSL_PROVIDER_available(OSSL_LIB_CTX *libctx, const char *name) 1470 { 1471 OSSL_PROVIDER *prov = NULL; 1472 int available = 0; 1473 struct provider_store_st *store = get_provider_store(libctx); 1474 1475 if (store == NULL || !provider_activate_fallbacks(store)) 1476 return 0; 1477 1478 prov = ossl_provider_find(libctx, name, 0); 1479 if (prov != NULL) { 1480 if (!CRYPTO_THREAD_read_lock(prov->flag_lock)) 1481 return 0; 1482 available = prov->flag_activated; 1483 CRYPTO_THREAD_unlock(prov->flag_lock); 1484 ossl_provider_free(prov); 1485 } 1486 return available; 1487 } 1488 1489 /* Setters of Provider Object data */ 1490 int ossl_provider_set_fallback(OSSL_PROVIDER *prov) 1491 { 1492 if (prov == NULL) 1493 return 0; 1494 1495 prov->flag_fallback = 1; 1496 return 1; 1497 } 1498 1499 /* Getters of Provider Object data */ 1500 const char *ossl_provider_name(const OSSL_PROVIDER *prov) 1501 { 1502 return prov->name; 1503 } 1504 1505 const DSO *ossl_provider_dso(const OSSL_PROVIDER *prov) 1506 { 1507 return prov->module; 1508 } 1509 1510 const char *ossl_provider_module_name(const OSSL_PROVIDER *prov) 1511 { 1512 #ifdef FIPS_MODULE 1513 return NULL; 1514 #else 1515 return DSO_get_filename(prov->module); 1516 #endif 1517 } 1518 1519 const char *ossl_provider_module_path(const OSSL_PROVIDER *prov) 1520 { 1521 #ifdef FIPS_MODULE 1522 return NULL; 1523 #else 1524 /* FIXME: Ensure it's a full path */ 1525 return DSO_get_filename(prov->module); 1526 #endif 1527 } 1528 1529 void *ossl_provider_prov_ctx(const OSSL_PROVIDER *prov) 1530 { 1531 if (prov != NULL) 1532 return prov->provctx; 1533 1534 return NULL; 1535 } 1536 1537 const OSSL_DISPATCH *ossl_provider_get0_dispatch(const OSSL_PROVIDER *prov) 1538 { 1539 if (prov != NULL) 1540 return prov->dispatch; 1541 1542 return NULL; 1543 } 1544 1545 OSSL_LIB_CTX *ossl_provider_libctx(const OSSL_PROVIDER *prov) 1546 { 1547 return prov != NULL ? prov->libctx : NULL; 1548 } 1549 1550 /* Wrappers around calls to the provider */ 1551 void ossl_provider_teardown(const OSSL_PROVIDER *prov) 1552 { 1553 if (prov->teardown != NULL 1554 #ifndef FIPS_MODULE 1555 && !prov->ischild 1556 #endif 1557 ) 1558 prov->teardown(prov->provctx); 1559 } 1560 1561 const OSSL_PARAM *ossl_provider_gettable_params(const OSSL_PROVIDER *prov) 1562 { 1563 return prov->gettable_params == NULL 1564 ? NULL : prov->gettable_params(prov->provctx); 1565 } 1566 1567 int ossl_provider_get_params(const OSSL_PROVIDER *prov, OSSL_PARAM params[]) 1568 { 1569 return prov->get_params == NULL 1570 ? 0 : prov->get_params(prov->provctx, params); 1571 } 1572 1573 int ossl_provider_self_test(const OSSL_PROVIDER *prov) 1574 { 1575 int ret; 1576 1577 if (prov->self_test == NULL) 1578 return 1; 1579 ret = prov->self_test(prov->provctx); 1580 if (ret == 0) 1581 (void)provider_remove_store_methods((OSSL_PROVIDER *)prov); 1582 return ret; 1583 } 1584 1585 int ossl_provider_get_capabilities(const OSSL_PROVIDER *prov, 1586 const char *capability, 1587 OSSL_CALLBACK *cb, 1588 void *arg) 1589 { 1590 return prov->get_capabilities == NULL 1591 ? 1 : prov->get_capabilities(prov->provctx, capability, cb, arg); 1592 } 1593 1594 const OSSL_ALGORITHM *ossl_provider_query_operation(const OSSL_PROVIDER *prov, 1595 int operation_id, 1596 int *no_cache) 1597 { 1598 const OSSL_ALGORITHM *res; 1599 1600 if (prov->query_operation == NULL) 1601 return NULL; 1602 res = prov->query_operation(prov->provctx, operation_id, no_cache); 1603 #if defined(OPENSSL_NO_CACHED_FETCH) 1604 /* Forcing the non-caching of queries */ 1605 if (no_cache != NULL) 1606 *no_cache = 1; 1607 #endif 1608 return res; 1609 } 1610 1611 void ossl_provider_unquery_operation(const OSSL_PROVIDER *prov, 1612 int operation_id, 1613 const OSSL_ALGORITHM *algs) 1614 { 1615 if (prov->unquery_operation != NULL) 1616 prov->unquery_operation(prov->provctx, operation_id, algs); 1617 } 1618 1619 int ossl_provider_set_operation_bit(OSSL_PROVIDER *provider, size_t bitnum) 1620 { 1621 size_t byte = bitnum / 8; 1622 unsigned char bit = (1 << (bitnum % 8)) & 0xFF; 1623 1624 if (!CRYPTO_THREAD_write_lock(provider->opbits_lock)) 1625 return 0; 1626 if (provider->operation_bits_sz <= byte) { 1627 unsigned char *tmp = OPENSSL_realloc(provider->operation_bits, 1628 byte + 1); 1629 1630 if (tmp == NULL) { 1631 CRYPTO_THREAD_unlock(provider->opbits_lock); 1632 ERR_raise(ERR_LIB_CRYPTO, ERR_R_MALLOC_FAILURE); 1633 return 0; 1634 } 1635 provider->operation_bits = tmp; 1636 memset(provider->operation_bits + provider->operation_bits_sz, 1637 '\0', byte + 1 - provider->operation_bits_sz); 1638 provider->operation_bits_sz = byte + 1; 1639 } 1640 provider->operation_bits[byte] |= bit; 1641 CRYPTO_THREAD_unlock(provider->opbits_lock); 1642 return 1; 1643 } 1644 1645 int ossl_provider_test_operation_bit(OSSL_PROVIDER *provider, size_t bitnum, 1646 int *result) 1647 { 1648 size_t byte = bitnum / 8; 1649 unsigned char bit = (1 << (bitnum % 8)) & 0xFF; 1650 1651 if (!ossl_assert(result != NULL)) { 1652 ERR_raise(ERR_LIB_CRYPTO, ERR_R_PASSED_NULL_PARAMETER); 1653 return 0; 1654 } 1655 1656 *result = 0; 1657 if (!CRYPTO_THREAD_read_lock(provider->opbits_lock)) 1658 return 0; 1659 if (provider->operation_bits_sz > byte) 1660 *result = ((provider->operation_bits[byte] & bit) != 0); 1661 CRYPTO_THREAD_unlock(provider->opbits_lock); 1662 return 1; 1663 } 1664 1665 #ifndef FIPS_MODULE 1666 const OSSL_CORE_HANDLE *ossl_provider_get_parent(OSSL_PROVIDER *prov) 1667 { 1668 return prov->handle; 1669 } 1670 1671 int ossl_provider_is_child(const OSSL_PROVIDER *prov) 1672 { 1673 return prov->ischild; 1674 } 1675 1676 int ossl_provider_set_child(OSSL_PROVIDER *prov, const OSSL_CORE_HANDLE *handle) 1677 { 1678 prov->handle = handle; 1679 prov->ischild = 1; 1680 1681 return 1; 1682 } 1683 1684 int ossl_provider_default_props_update(OSSL_LIB_CTX *libctx, const char *props) 1685 { 1686 #ifndef FIPS_MODULE 1687 struct provider_store_st *store = NULL; 1688 int i, max; 1689 OSSL_PROVIDER_CHILD_CB *child_cb; 1690 1691 if ((store = get_provider_store(libctx)) == NULL) 1692 return 0; 1693 1694 if (!CRYPTO_THREAD_read_lock(store->lock)) 1695 return 0; 1696 1697 max = sk_OSSL_PROVIDER_CHILD_CB_num(store->child_cbs); 1698 for (i = 0; i < max; i++) { 1699 child_cb = sk_OSSL_PROVIDER_CHILD_CB_value(store->child_cbs, i); 1700 child_cb->global_props_cb(props, child_cb->cbdata); 1701 } 1702 1703 CRYPTO_THREAD_unlock(store->lock); 1704 #endif 1705 return 1; 1706 } 1707 1708 static int ossl_provider_register_child_cb(const OSSL_CORE_HANDLE *handle, 1709 int (*create_cb)( 1710 const OSSL_CORE_HANDLE *provider, 1711 void *cbdata), 1712 int (*remove_cb)( 1713 const OSSL_CORE_HANDLE *provider, 1714 void *cbdata), 1715 int (*global_props_cb)( 1716 const char *props, 1717 void *cbdata), 1718 void *cbdata) 1719 { 1720 /* 1721 * This is really an OSSL_PROVIDER that we created and cast to 1722 * OSSL_CORE_HANDLE originally. Therefore it is safe to cast it back. 1723 */ 1724 OSSL_PROVIDER *thisprov = (OSSL_PROVIDER *)handle; 1725 OSSL_PROVIDER *prov; 1726 OSSL_LIB_CTX *libctx = thisprov->libctx; 1727 struct provider_store_st *store = NULL; 1728 int ret = 0, i, max; 1729 OSSL_PROVIDER_CHILD_CB *child_cb; 1730 char *propsstr = NULL; 1731 1732 if ((store = get_provider_store(libctx)) == NULL) 1733 return 0; 1734 1735 child_cb = OPENSSL_malloc(sizeof(*child_cb)); 1736 if (child_cb == NULL) 1737 return 0; 1738 child_cb->prov = thisprov; 1739 child_cb->create_cb = create_cb; 1740 child_cb->remove_cb = remove_cb; 1741 child_cb->global_props_cb = global_props_cb; 1742 child_cb->cbdata = cbdata; 1743 1744 if (!CRYPTO_THREAD_write_lock(store->lock)) { 1745 OPENSSL_free(child_cb); 1746 return 0; 1747 } 1748 propsstr = evp_get_global_properties_str(libctx, 0); 1749 1750 if (propsstr != NULL) { 1751 global_props_cb(propsstr, cbdata); 1752 OPENSSL_free(propsstr); 1753 } 1754 max = sk_OSSL_PROVIDER_num(store->providers); 1755 for (i = 0; i < max; i++) { 1756 int activated; 1757 1758 prov = sk_OSSL_PROVIDER_value(store->providers, i); 1759 1760 if (!CRYPTO_THREAD_read_lock(prov->flag_lock)) 1761 break; 1762 activated = prov->flag_activated; 1763 CRYPTO_THREAD_unlock(prov->flag_lock); 1764 /* 1765 * We hold the store lock while calling the user callback. This means 1766 * that the user callback must be short and simple and not do anything 1767 * likely to cause a deadlock. We don't hold the flag_lock during this 1768 * call. In theory this means that another thread could deactivate it 1769 * while we are calling create. This is ok because the other thread 1770 * will also call remove_cb, but won't be able to do so until we release 1771 * the store lock. 1772 */ 1773 if (activated && !create_cb((OSSL_CORE_HANDLE *)prov, cbdata)) 1774 break; 1775 } 1776 if (i == max) { 1777 /* Success */ 1778 ret = sk_OSSL_PROVIDER_CHILD_CB_push(store->child_cbs, child_cb); 1779 } 1780 if (i != max || ret <= 0) { 1781 /* Failed during creation. Remove everything we just added */ 1782 for (; i >= 0; i--) { 1783 prov = sk_OSSL_PROVIDER_value(store->providers, i); 1784 remove_cb((OSSL_CORE_HANDLE *)prov, cbdata); 1785 } 1786 OPENSSL_free(child_cb); 1787 ret = 0; 1788 } 1789 CRYPTO_THREAD_unlock(store->lock); 1790 1791 return ret; 1792 } 1793 1794 static void ossl_provider_deregister_child_cb(const OSSL_CORE_HANDLE *handle) 1795 { 1796 /* 1797 * This is really an OSSL_PROVIDER that we created and cast to 1798 * OSSL_CORE_HANDLE originally. Therefore it is safe to cast it back. 1799 */ 1800 OSSL_PROVIDER *thisprov = (OSSL_PROVIDER *)handle; 1801 OSSL_LIB_CTX *libctx = thisprov->libctx; 1802 struct provider_store_st *store = NULL; 1803 int i, max; 1804 OSSL_PROVIDER_CHILD_CB *child_cb; 1805 1806 if ((store = get_provider_store(libctx)) == NULL) 1807 return; 1808 1809 if (!CRYPTO_THREAD_write_lock(store->lock)) 1810 return; 1811 max = sk_OSSL_PROVIDER_CHILD_CB_num(store->child_cbs); 1812 for (i = 0; i < max; i++) { 1813 child_cb = sk_OSSL_PROVIDER_CHILD_CB_value(store->child_cbs, i); 1814 if (child_cb->prov == thisprov) { 1815 /* Found an entry */ 1816 sk_OSSL_PROVIDER_CHILD_CB_delete(store->child_cbs, i); 1817 OPENSSL_free(child_cb); 1818 break; 1819 } 1820 } 1821 CRYPTO_THREAD_unlock(store->lock); 1822 } 1823 #endif 1824 1825 /*- 1826 * Core functions for the provider 1827 * =============================== 1828 * 1829 * This is the set of functions that the core makes available to the provider 1830 */ 1831 1832 /* 1833 * This returns a list of Provider Object parameters with their types, for 1834 * discovery. We do not expect that many providers will use this, but one 1835 * never knows. 1836 */ 1837 static const OSSL_PARAM param_types[] = { 1838 OSSL_PARAM_DEFN(OSSL_PROV_PARAM_CORE_VERSION, OSSL_PARAM_UTF8_PTR, NULL, 0), 1839 OSSL_PARAM_DEFN(OSSL_PROV_PARAM_CORE_PROV_NAME, OSSL_PARAM_UTF8_PTR, 1840 NULL, 0), 1841 #ifndef FIPS_MODULE 1842 OSSL_PARAM_DEFN(OSSL_PROV_PARAM_CORE_MODULE_FILENAME, OSSL_PARAM_UTF8_PTR, 1843 NULL, 0), 1844 #endif 1845 OSSL_PARAM_END 1846 }; 1847 1848 /* 1849 * Forward declare all the functions that are provided aa dispatch. 1850 * This ensures that the compiler will complain if they aren't defined 1851 * with the correct signature. 1852 */ 1853 static OSSL_FUNC_core_gettable_params_fn core_gettable_params; 1854 static OSSL_FUNC_core_get_params_fn core_get_params; 1855 static OSSL_FUNC_core_get_libctx_fn core_get_libctx; 1856 static OSSL_FUNC_core_thread_start_fn core_thread_start; 1857 #ifndef FIPS_MODULE 1858 static OSSL_FUNC_core_new_error_fn core_new_error; 1859 static OSSL_FUNC_core_set_error_debug_fn core_set_error_debug; 1860 static OSSL_FUNC_core_vset_error_fn core_vset_error; 1861 static OSSL_FUNC_core_set_error_mark_fn core_set_error_mark; 1862 static OSSL_FUNC_core_clear_last_error_mark_fn core_clear_last_error_mark; 1863 static OSSL_FUNC_core_pop_error_to_mark_fn core_pop_error_to_mark; 1864 OSSL_FUNC_BIO_new_file_fn ossl_core_bio_new_file; 1865 OSSL_FUNC_BIO_new_membuf_fn ossl_core_bio_new_mem_buf; 1866 OSSL_FUNC_BIO_read_ex_fn ossl_core_bio_read_ex; 1867 OSSL_FUNC_BIO_write_ex_fn ossl_core_bio_write_ex; 1868 OSSL_FUNC_BIO_gets_fn ossl_core_bio_gets; 1869 OSSL_FUNC_BIO_puts_fn ossl_core_bio_puts; 1870 OSSL_FUNC_BIO_up_ref_fn ossl_core_bio_up_ref; 1871 OSSL_FUNC_BIO_free_fn ossl_core_bio_free; 1872 OSSL_FUNC_BIO_vprintf_fn ossl_core_bio_vprintf; 1873 OSSL_FUNC_BIO_vsnprintf_fn BIO_vsnprintf; 1874 static OSSL_FUNC_self_test_cb_fn core_self_test_get_callback; 1875 OSSL_FUNC_get_entropy_fn ossl_rand_get_entropy; 1876 OSSL_FUNC_cleanup_entropy_fn ossl_rand_cleanup_entropy; 1877 OSSL_FUNC_get_nonce_fn ossl_rand_get_nonce; 1878 OSSL_FUNC_cleanup_nonce_fn ossl_rand_cleanup_nonce; 1879 #endif 1880 OSSL_FUNC_CRYPTO_malloc_fn CRYPTO_malloc; 1881 OSSL_FUNC_CRYPTO_zalloc_fn CRYPTO_zalloc; 1882 OSSL_FUNC_CRYPTO_free_fn CRYPTO_free; 1883 OSSL_FUNC_CRYPTO_clear_free_fn CRYPTO_clear_free; 1884 OSSL_FUNC_CRYPTO_realloc_fn CRYPTO_realloc; 1885 OSSL_FUNC_CRYPTO_clear_realloc_fn CRYPTO_clear_realloc; 1886 OSSL_FUNC_CRYPTO_secure_malloc_fn CRYPTO_secure_malloc; 1887 OSSL_FUNC_CRYPTO_secure_zalloc_fn CRYPTO_secure_zalloc; 1888 OSSL_FUNC_CRYPTO_secure_free_fn CRYPTO_secure_free; 1889 OSSL_FUNC_CRYPTO_secure_clear_free_fn CRYPTO_secure_clear_free; 1890 OSSL_FUNC_CRYPTO_secure_allocated_fn CRYPTO_secure_allocated; 1891 OSSL_FUNC_OPENSSL_cleanse_fn OPENSSL_cleanse; 1892 #ifndef FIPS_MODULE 1893 OSSL_FUNC_provider_register_child_cb_fn ossl_provider_register_child_cb; 1894 OSSL_FUNC_provider_deregister_child_cb_fn ossl_provider_deregister_child_cb; 1895 static OSSL_FUNC_provider_name_fn core_provider_get0_name; 1896 static OSSL_FUNC_provider_get0_provider_ctx_fn core_provider_get0_provider_ctx; 1897 static OSSL_FUNC_provider_get0_dispatch_fn core_provider_get0_dispatch; 1898 static OSSL_FUNC_provider_up_ref_fn core_provider_up_ref_intern; 1899 static OSSL_FUNC_provider_free_fn core_provider_free_intern; 1900 static OSSL_FUNC_core_obj_add_sigid_fn core_obj_add_sigid; 1901 static OSSL_FUNC_core_obj_create_fn core_obj_create; 1902 #endif 1903 1904 static const OSSL_PARAM *core_gettable_params(const OSSL_CORE_HANDLE *handle) 1905 { 1906 return param_types; 1907 } 1908 1909 static int core_get_params(const OSSL_CORE_HANDLE *handle, OSSL_PARAM params[]) 1910 { 1911 int i; 1912 OSSL_PARAM *p; 1913 /* 1914 * We created this object originally and we know it is actually an 1915 * OSSL_PROVIDER *, so the cast is safe 1916 */ 1917 OSSL_PROVIDER *prov = (OSSL_PROVIDER *)handle; 1918 1919 if ((p = OSSL_PARAM_locate(params, OSSL_PROV_PARAM_CORE_VERSION)) != NULL) 1920 OSSL_PARAM_set_utf8_ptr(p, OPENSSL_VERSION_STR); 1921 if ((p = OSSL_PARAM_locate(params, OSSL_PROV_PARAM_CORE_PROV_NAME)) != NULL) 1922 OSSL_PARAM_set_utf8_ptr(p, prov->name); 1923 1924 #ifndef FIPS_MODULE 1925 if ((p = OSSL_PARAM_locate(params, 1926 OSSL_PROV_PARAM_CORE_MODULE_FILENAME)) != NULL) 1927 OSSL_PARAM_set_utf8_ptr(p, ossl_provider_module_path(prov)); 1928 #endif 1929 1930 if (prov->parameters == NULL) 1931 return 1; 1932 1933 for (i = 0; i < sk_INFOPAIR_num(prov->parameters); i++) { 1934 INFOPAIR *pair = sk_INFOPAIR_value(prov->parameters, i); 1935 1936 if ((p = OSSL_PARAM_locate(params, pair->name)) != NULL) 1937 OSSL_PARAM_set_utf8_ptr(p, pair->value); 1938 } 1939 return 1; 1940 } 1941 1942 static OPENSSL_CORE_CTX *core_get_libctx(const OSSL_CORE_HANDLE *handle) 1943 { 1944 /* 1945 * We created this object originally and we know it is actually an 1946 * OSSL_PROVIDER *, so the cast is safe 1947 */ 1948 OSSL_PROVIDER *prov = (OSSL_PROVIDER *)handle; 1949 1950 /* 1951 * Using ossl_provider_libctx would be wrong as that returns 1952 * NULL for |prov| == NULL and NULL libctx has a special meaning 1953 * that does not apply here. Here |prov| == NULL can happen only in 1954 * case of a coding error. 1955 */ 1956 assert(prov != NULL); 1957 return (OPENSSL_CORE_CTX *)prov->libctx; 1958 } 1959 1960 static int core_thread_start(const OSSL_CORE_HANDLE *handle, 1961 OSSL_thread_stop_handler_fn handfn, 1962 void *arg) 1963 { 1964 /* 1965 * We created this object originally and we know it is actually an 1966 * OSSL_PROVIDER *, so the cast is safe 1967 */ 1968 OSSL_PROVIDER *prov = (OSSL_PROVIDER *)handle; 1969 1970 return ossl_init_thread_start(prov, arg, handfn); 1971 } 1972 1973 /* 1974 * The FIPS module inner provider doesn't implement these. They aren't 1975 * needed there, since the FIPS module upcalls are always the outer provider 1976 * ones. 1977 */ 1978 #ifndef FIPS_MODULE 1979 /* 1980 * These error functions should use |handle| to select the proper 1981 * library context to report in the correct error stack if error 1982 * stacks become tied to the library context. 1983 * We cannot currently do that since there's no support for it in the 1984 * ERR subsystem. 1985 */ 1986 static void core_new_error(const OSSL_CORE_HANDLE *handle) 1987 { 1988 ERR_new(); 1989 } 1990 1991 static void core_set_error_debug(const OSSL_CORE_HANDLE *handle, 1992 const char *file, int line, const char *func) 1993 { 1994 ERR_set_debug(file, line, func); 1995 } 1996 1997 static void core_vset_error(const OSSL_CORE_HANDLE *handle, 1998 uint32_t reason, const char *fmt, va_list args) 1999 { 2000 /* 2001 * We created this object originally and we know it is actually an 2002 * OSSL_PROVIDER *, so the cast is safe 2003 */ 2004 OSSL_PROVIDER *prov = (OSSL_PROVIDER *)handle; 2005 2006 /* 2007 * If the uppermost 8 bits are non-zero, it's an OpenSSL library 2008 * error and will be treated as such. Otherwise, it's a new style 2009 * provider error and will be treated as such. 2010 */ 2011 if (ERR_GET_LIB(reason) != 0) { 2012 ERR_vset_error(ERR_GET_LIB(reason), ERR_GET_REASON(reason), fmt, args); 2013 } else { 2014 ERR_vset_error(prov->error_lib, (int)reason, fmt, args); 2015 } 2016 } 2017 2018 static int core_set_error_mark(const OSSL_CORE_HANDLE *handle) 2019 { 2020 return ERR_set_mark(); 2021 } 2022 2023 static int core_clear_last_error_mark(const OSSL_CORE_HANDLE *handle) 2024 { 2025 return ERR_clear_last_mark(); 2026 } 2027 2028 static int core_pop_error_to_mark(const OSSL_CORE_HANDLE *handle) 2029 { 2030 return ERR_pop_to_mark(); 2031 } 2032 2033 static void core_self_test_get_callback(OPENSSL_CORE_CTX *libctx, 2034 OSSL_CALLBACK **cb, void **cbarg) 2035 { 2036 OSSL_SELF_TEST_get_callback((OSSL_LIB_CTX *)libctx, cb, cbarg); 2037 } 2038 2039 static const char *core_provider_get0_name(const OSSL_CORE_HANDLE *prov) 2040 { 2041 return OSSL_PROVIDER_get0_name((const OSSL_PROVIDER *)prov); 2042 } 2043 2044 static void *core_provider_get0_provider_ctx(const OSSL_CORE_HANDLE *prov) 2045 { 2046 return OSSL_PROVIDER_get0_provider_ctx((const OSSL_PROVIDER *)prov); 2047 } 2048 2049 static const OSSL_DISPATCH * 2050 core_provider_get0_dispatch(const OSSL_CORE_HANDLE *prov) 2051 { 2052 return OSSL_PROVIDER_get0_dispatch((const OSSL_PROVIDER *)prov); 2053 } 2054 2055 static int core_provider_up_ref_intern(const OSSL_CORE_HANDLE *prov, 2056 int activate) 2057 { 2058 return provider_up_ref_intern((OSSL_PROVIDER *)prov, activate); 2059 } 2060 2061 static int core_provider_free_intern(const OSSL_CORE_HANDLE *prov, 2062 int deactivate) 2063 { 2064 return provider_free_intern((OSSL_PROVIDER *)prov, deactivate); 2065 } 2066 2067 static int core_obj_add_sigid(const OSSL_CORE_HANDLE *prov, 2068 const char *sign_name, const char *digest_name, 2069 const char *pkey_name) 2070 { 2071 int sign_nid = OBJ_txt2nid(sign_name); 2072 int digest_nid = NID_undef; 2073 int pkey_nid = OBJ_txt2nid(pkey_name); 2074 2075 if (digest_name != NULL && digest_name[0] != '\0' 2076 && (digest_nid = OBJ_txt2nid(digest_name)) == NID_undef) 2077 return 0; 2078 2079 if (sign_nid == NID_undef) 2080 return 0; 2081 2082 /* 2083 * Check if it already exists. This is a success if so (even if we don't 2084 * have nids for the digest/pkey) 2085 */ 2086 if (OBJ_find_sigid_algs(sign_nid, NULL, NULL)) 2087 return 1; 2088 2089 if (pkey_nid == NID_undef) 2090 return 0; 2091 2092 return OBJ_add_sigid(sign_nid, digest_nid, pkey_nid); 2093 } 2094 2095 static int core_obj_create(const OSSL_CORE_HANDLE *prov, const char *oid, 2096 const char *sn, const char *ln) 2097 { 2098 /* Check if it already exists and create it if not */ 2099 return OBJ_txt2nid(oid) != NID_undef 2100 || OBJ_create(oid, sn, ln) != NID_undef; 2101 } 2102 #endif /* FIPS_MODULE */ 2103 2104 /* 2105 * Functions provided by the core. 2106 */ 2107 static const OSSL_DISPATCH core_dispatch_[] = { 2108 { OSSL_FUNC_CORE_GETTABLE_PARAMS, (void (*)(void))core_gettable_params }, 2109 { OSSL_FUNC_CORE_GET_PARAMS, (void (*)(void))core_get_params }, 2110 { OSSL_FUNC_CORE_GET_LIBCTX, (void (*)(void))core_get_libctx }, 2111 { OSSL_FUNC_CORE_THREAD_START, (void (*)(void))core_thread_start }, 2112 #ifndef FIPS_MODULE 2113 { OSSL_FUNC_CORE_NEW_ERROR, (void (*)(void))core_new_error }, 2114 { OSSL_FUNC_CORE_SET_ERROR_DEBUG, (void (*)(void))core_set_error_debug }, 2115 { OSSL_FUNC_CORE_VSET_ERROR, (void (*)(void))core_vset_error }, 2116 { OSSL_FUNC_CORE_SET_ERROR_MARK, (void (*)(void))core_set_error_mark }, 2117 { OSSL_FUNC_CORE_CLEAR_LAST_ERROR_MARK, 2118 (void (*)(void))core_clear_last_error_mark }, 2119 { OSSL_FUNC_CORE_POP_ERROR_TO_MARK, (void (*)(void))core_pop_error_to_mark }, 2120 { OSSL_FUNC_BIO_NEW_FILE, (void (*)(void))ossl_core_bio_new_file }, 2121 { OSSL_FUNC_BIO_NEW_MEMBUF, (void (*)(void))ossl_core_bio_new_mem_buf }, 2122 { OSSL_FUNC_BIO_READ_EX, (void (*)(void))ossl_core_bio_read_ex }, 2123 { OSSL_FUNC_BIO_WRITE_EX, (void (*)(void))ossl_core_bio_write_ex }, 2124 { OSSL_FUNC_BIO_GETS, (void (*)(void))ossl_core_bio_gets }, 2125 { OSSL_FUNC_BIO_PUTS, (void (*)(void))ossl_core_bio_puts }, 2126 { OSSL_FUNC_BIO_CTRL, (void (*)(void))ossl_core_bio_ctrl }, 2127 { OSSL_FUNC_BIO_UP_REF, (void (*)(void))ossl_core_bio_up_ref }, 2128 { OSSL_FUNC_BIO_FREE, (void (*)(void))ossl_core_bio_free }, 2129 { OSSL_FUNC_BIO_VPRINTF, (void (*)(void))ossl_core_bio_vprintf }, 2130 { OSSL_FUNC_BIO_VSNPRINTF, (void (*)(void))BIO_vsnprintf }, 2131 { OSSL_FUNC_SELF_TEST_CB, (void (*)(void))core_self_test_get_callback }, 2132 { OSSL_FUNC_GET_ENTROPY, (void (*)(void))ossl_rand_get_entropy }, 2133 { OSSL_FUNC_CLEANUP_ENTROPY, (void (*)(void))ossl_rand_cleanup_entropy }, 2134 { OSSL_FUNC_GET_NONCE, (void (*)(void))ossl_rand_get_nonce }, 2135 { OSSL_FUNC_CLEANUP_NONCE, (void (*)(void))ossl_rand_cleanup_nonce }, 2136 #endif 2137 { OSSL_FUNC_CRYPTO_MALLOC, (void (*)(void))CRYPTO_malloc }, 2138 { OSSL_FUNC_CRYPTO_ZALLOC, (void (*)(void))CRYPTO_zalloc }, 2139 { OSSL_FUNC_CRYPTO_FREE, (void (*)(void))CRYPTO_free }, 2140 { OSSL_FUNC_CRYPTO_CLEAR_FREE, (void (*)(void))CRYPTO_clear_free }, 2141 { OSSL_FUNC_CRYPTO_REALLOC, (void (*)(void))CRYPTO_realloc }, 2142 { OSSL_FUNC_CRYPTO_CLEAR_REALLOC, (void (*)(void))CRYPTO_clear_realloc }, 2143 { OSSL_FUNC_CRYPTO_SECURE_MALLOC, (void (*)(void))CRYPTO_secure_malloc }, 2144 { OSSL_FUNC_CRYPTO_SECURE_ZALLOC, (void (*)(void))CRYPTO_secure_zalloc }, 2145 { OSSL_FUNC_CRYPTO_SECURE_FREE, (void (*)(void))CRYPTO_secure_free }, 2146 { OSSL_FUNC_CRYPTO_SECURE_CLEAR_FREE, 2147 (void (*)(void))CRYPTO_secure_clear_free }, 2148 { OSSL_FUNC_CRYPTO_SECURE_ALLOCATED, 2149 (void (*)(void))CRYPTO_secure_allocated }, 2150 { OSSL_FUNC_OPENSSL_CLEANSE, (void (*)(void))OPENSSL_cleanse }, 2151 #ifndef FIPS_MODULE 2152 { OSSL_FUNC_PROVIDER_REGISTER_CHILD_CB, 2153 (void (*)(void))ossl_provider_register_child_cb }, 2154 { OSSL_FUNC_PROVIDER_DEREGISTER_CHILD_CB, 2155 (void (*)(void))ossl_provider_deregister_child_cb }, 2156 { OSSL_FUNC_PROVIDER_NAME, 2157 (void (*)(void))core_provider_get0_name }, 2158 { OSSL_FUNC_PROVIDER_GET0_PROVIDER_CTX, 2159 (void (*)(void))core_provider_get0_provider_ctx }, 2160 { OSSL_FUNC_PROVIDER_GET0_DISPATCH, 2161 (void (*)(void))core_provider_get0_dispatch }, 2162 { OSSL_FUNC_PROVIDER_UP_REF, 2163 (void (*)(void))core_provider_up_ref_intern }, 2164 { OSSL_FUNC_PROVIDER_FREE, 2165 (void (*)(void))core_provider_free_intern }, 2166 { OSSL_FUNC_CORE_OBJ_ADD_SIGID, (void (*)(void))core_obj_add_sigid }, 2167 { OSSL_FUNC_CORE_OBJ_CREATE, (void (*)(void))core_obj_create }, 2168 #endif 2169 { 0, NULL } 2170 }; 2171 static const OSSL_DISPATCH *core_dispatch = core_dispatch_; 2172