+static OSSL_STORE_LOADER_CTX *file_attach(const OSSL_STORE_LOADER *loader,
+ BIO *bp, OPENSSL_CTX *libctx,
+ const char *propq,
+ const UI_METHOD *ui_method,
+ void *ui_data)
+{
+ OSSL_STORE_LOADER_CTX *ctx;
+
+ if ((ctx = OPENSSL_zalloc(sizeof(*ctx))) == NULL
+ || (propq != NULL && (ctx->propq = OPENSSL_strdup(propq)) == NULL)) {
+ OSSL_STOREerr(OSSL_STORE_F_FILE_ATTACH, ERR_R_MALLOC_FAILURE);
+ OSSL_STORE_LOADER_CTX_free(ctx);
+ return NULL;
+ }
+
+ ctx->libctx = libctx;
+ ctx->flags |= FILE_FLAG_ATTACHED;
+ ctx->_.file.file = bp;
+ if (!file_find_type(ctx)) {
+ /* Safety measure */
+ ctx->_.file.file = NULL;
+ OSSL_STORE_LOADER_CTX_free(ctx);
+ ctx = NULL;
+ }
+
+ return ctx;
+}
+
+static int file_ctrl(OSSL_STORE_LOADER_CTX *ctx, int cmd, va_list args)
+{
+ int ret = 1;
+
+ switch (cmd) {
+ case OSSL_STORE_C_USE_SECMEM:
+ {
+ int on = *(va_arg(args, int *));
+
+ switch (on) {
+ case 0:
+ ctx->flags &= ~FILE_FLAG_SECMEM;
+ break;
+ case 1:
+ ctx->flags |= FILE_FLAG_SECMEM;
+ break;
+ default:
+ OSSL_STOREerr(OSSL_STORE_F_FILE_CTRL,
+ ERR_R_PASSED_INVALID_ARGUMENT);
+ ret = 0;
+ break;
+ }
+ }
+ break;
+ default:
+ break;
+ }
+
+ return ret;
+}
+
+static int file_expect(OSSL_STORE_LOADER_CTX *ctx, int expected)
+{
+ ctx->expected_type = expected;
+ return 1;
+}
+
+static int file_find(OSSL_STORE_LOADER_CTX *ctx,
+ const OSSL_STORE_SEARCH *search)
+{
+ /*
+ * If ctx == NULL, the library is looking to know if this loader supports
+ * the given search type.
+ */
+
+ if (OSSL_STORE_SEARCH_get_type(search) == OSSL_STORE_SEARCH_BY_NAME) {
+ unsigned long hash = 0;
+
+ if (ctx == NULL)
+ return 1;
+
+ if (ctx->type != is_dir) {
+ OSSL_STOREerr(OSSL_STORE_F_FILE_FIND,
+ OSSL_STORE_R_SEARCH_ONLY_SUPPORTED_FOR_DIRECTORIES);
+ return 0;
+ }
+
+ hash = X509_NAME_hash(OSSL_STORE_SEARCH_get0_name(search));
+ BIO_snprintf(ctx->_.dir.search_name, sizeof(ctx->_.dir.search_name),
+ "%08lx", hash);
+ return 1;
+ }
+
+ if (ctx != NULL)
+ OSSL_STOREerr(OSSL_STORE_F_FILE_FIND,
+ OSSL_STORE_R_UNSUPPORTED_SEARCH_TYPE);
+ return 0;
+}
+
+static OSSL_STORE_INFO *file_load_try_decode(OSSL_STORE_LOADER_CTX *ctx,
+ const char *pem_name,
+ const char *pem_header,
+ unsigned char *data, size_t len,
+ const UI_METHOD *ui_method,
+ void *ui_data, int *matchcount)
+{
+ OSSL_STORE_INFO *result = NULL;
+ BUF_MEM *new_mem = NULL;
+ char *new_pem_name = NULL;
+ int t = 0;
+
+ again:
+ {
+ size_t i = 0;
+ void *handler_ctx = NULL;
+ const FILE_HANDLER **matching_handlers =
+ OPENSSL_zalloc(sizeof(*matching_handlers)
+ * OSSL_NELEM(file_handlers));
+
+ if (matching_handlers == NULL) {
+ OSSL_STOREerr(OSSL_STORE_F_FILE_LOAD_TRY_DECODE,
+ ERR_R_MALLOC_FAILURE);
+ goto err;
+ }
+
+ *matchcount = 0;
+ for (i = 0; i < OSSL_NELEM(file_handlers); i++) {
+ const FILE_HANDLER *handler = file_handlers[i];
+ int try_matchcount = 0;
+ void *tmp_handler_ctx = NULL;
+ OSSL_STORE_INFO *tmp_result =
+ handler->try_decode(pem_name, pem_header, data, len,
+ &tmp_handler_ctx, &try_matchcount,
+ ui_method, ui_data, ctx->libctx, ctx->propq);
+
+ if (try_matchcount > 0) {
+
+ matching_handlers[*matchcount] = handler;
+
+ if (handler_ctx)
+ handler->destroy_ctx(&handler_ctx);
+ handler_ctx = tmp_handler_ctx;
+
+ if ((*matchcount += try_matchcount) > 1) {
+ /* more than one match => ambiguous, kill any result */
+ OSSL_STORE_INFO_free(result);
+ OSSL_STORE_INFO_free(tmp_result);
+ if (handler->destroy_ctx != NULL)
+ handler->destroy_ctx(&handler_ctx);
+ handler_ctx = NULL;
+ tmp_result = NULL;
+ result = NULL;
+ }
+ if (result == NULL)
+ result = tmp_result;
+ }
+ }
+
+ if (*matchcount == 1 && matching_handlers[0]->repeatable) {
+ ctx->_.file.last_handler = matching_handlers[0];
+ ctx->_.file.last_handler_ctx = handler_ctx;
+ }
+
+ OPENSSL_free(matching_handlers);
+ }
+
+ err:
+ OPENSSL_free(new_pem_name);
+ BUF_MEM_free(new_mem);
+
+ if (result != NULL
+ && (t = OSSL_STORE_INFO_get_type(result)) == OSSL_STORE_INFO_EMBEDDED) {
+ pem_name = new_pem_name =
+ ossl_store_info_get0_EMBEDDED_pem_name(result);
+ new_mem = ossl_store_info_get0_EMBEDDED_buffer(result);
+ data = (unsigned char *)new_mem->data;
+ len = new_mem->length;
+ OPENSSL_free(result);
+ result = NULL;
+ goto again;
+ }
+
+ if (result != NULL)
+ ERR_clear_error();
+
+ return result;
+}
+
+static OSSL_STORE_INFO *file_load_try_repeat(OSSL_STORE_LOADER_CTX *ctx,
+ const UI_METHOD *ui_method,
+ void *ui_data)
+{
+ OSSL_STORE_INFO *result = NULL;
+ int try_matchcount = 0;
+
+ if (ctx->_.file.last_handler != NULL) {
+ result =
+ ctx->_.file.last_handler->try_decode(NULL, NULL, NULL, 0,
+ &ctx->_.file.last_handler_ctx,
+ &try_matchcount,
+ ui_method, ui_data,
+ ctx->libctx, ctx->propq);
+
+ if (result == NULL) {
+ ctx->_.file.last_handler->destroy_ctx(&ctx->_.file.last_handler_ctx);
+ ctx->_.file.last_handler_ctx = NULL;
+ ctx->_.file.last_handler = NULL;
+ }
+ }
+ return result;
+}
+
+static void pem_free_flag(void *pem_data, int secure, size_t num)
+{
+ if (secure)
+ OPENSSL_secure_clear_free(pem_data, num);
+ else
+ OPENSSL_free(pem_data);
+}
+static int file_read_pem(BIO *bp, char **pem_name, char **pem_header,
+ unsigned char **data, long *len,
+ const UI_METHOD *ui_method,
+ void *ui_data, int secure)
+{
+ int i = secure
+ ? PEM_read_bio_ex(bp, pem_name, pem_header, data, len,
+ PEM_FLAG_SECURE | PEM_FLAG_EAY_COMPATIBLE)
+ : PEM_read_bio(bp, pem_name, pem_header, data, len);
+
+ if (i <= 0)
+ return 0;
+
+ /*
+ * 10 is the number of characters in "Proc-Type:", which
+ * PEM_get_EVP_CIPHER_INFO() requires to be present.
+ * If the PEM header has less characters than that, it's
+ * not worth spending cycles on it.
+ */
+ if (strlen(*pem_header) > 10) {
+ EVP_CIPHER_INFO cipher;
+ struct pem_pass_data pass_data;
+
+ if (!PEM_get_EVP_CIPHER_INFO(*pem_header, &cipher)
+ || !file_fill_pem_pass_data(&pass_data, "PEM", ui_method, ui_data)
+ || !PEM_do_header(&cipher, *data, len, file_get_pem_pass,
+ &pass_data)) {
+ return 0;
+ }
+ }
+ return 1;
+}
+
+static int file_read_asn1(BIO *bp, unsigned char **data, long *len)
+{
+ BUF_MEM *mem = NULL;
+
+ if (asn1_d2i_read_bio(bp, &mem) < 0)
+ return 0;
+
+ *data = (unsigned char *)mem->data;
+ *len = (long)mem->length;
+ OPENSSL_free(mem);
+
+ return 1;
+}
+
+static int ends_with_dirsep(const char *uri)
+{
+ if (*uri != '\0')
+ uri += strlen(uri) - 1;
+#if defined __VMS
+ if (*uri == ']' || *uri == '>' || *uri == ':')
+ return 1;
+#elif defined _WIN32
+ if (*uri == '\\')
+ return 1;
+#endif
+ return *uri == '/';
+}
+
+static int file_name_to_uri(OSSL_STORE_LOADER_CTX *ctx, const char *name,
+ char **data)
+{
+ assert(name != NULL);
+ assert(data != NULL);
+ {
+ const char *pathsep = ends_with_dirsep(ctx->_.dir.uri) ? "" : "/";
+ long calculated_length = strlen(ctx->_.dir.uri) + strlen(pathsep)
+ + strlen(name) + 1 /* \0 */;
+
+ *data = OPENSSL_zalloc(calculated_length);
+ if (*data == NULL) {
+ OSSL_STOREerr(OSSL_STORE_F_FILE_NAME_TO_URI, ERR_R_MALLOC_FAILURE);
+ return 0;
+ }
+
+ OPENSSL_strlcat(*data, ctx->_.dir.uri, calculated_length);
+ OPENSSL_strlcat(*data, pathsep, calculated_length);
+ OPENSSL_strlcat(*data, name, calculated_length);
+ }
+ return 1;
+}
+
+static int file_name_check(OSSL_STORE_LOADER_CTX *ctx, const char *name)
+{
+ const char *p = NULL;
+
+ /* If there are no search criteria, all names are accepted */
+ if (ctx->_.dir.search_name[0] == '\0')
+ return 1;
+
+ /* If the expected type isn't supported, no name is accepted */
+ if (ctx->expected_type != 0
+ && ctx->expected_type != OSSL_STORE_INFO_CERT
+ && ctx->expected_type != OSSL_STORE_INFO_CRL)
+ return 0;
+
+ /*
+ * First, check the basename
+ */
+ if (strncasecmp(name, ctx->_.dir.search_name,
+ sizeof(ctx->_.dir.search_name) - 1) != 0
+ || name[sizeof(ctx->_.dir.search_name) - 1] != '.')
+ return 0;
+ p = &name[sizeof(ctx->_.dir.search_name)];
+
+ /*
+ * Then, if the expected type is a CRL, check that the extension starts
+ * with 'r'
+ */
+ if (*p == 'r') {
+ p++;
+ if (ctx->expected_type != 0
+ && ctx->expected_type != OSSL_STORE_INFO_CRL)
+ return 0;
+ } else if (ctx->expected_type == OSSL_STORE_INFO_CRL) {
+ return 0;
+ }
+
+ /*
+ * Last, check that the rest of the extension is a decimal number, at
+ * least one digit long.
+ */
+ if (!ossl_isdigit(*p))
+ return 0;
+ while (ossl_isdigit(*p))
+ p++;
+
+# ifdef __VMS
+ /*
+ * One extra step here, check for a possible generation number.
+ */
+ if (*p == ';')
+ for (p++; *p != '\0'; p++)
+ if (!ossl_isdigit(*p))
+ break;
+# endif
+
+ /*
+ * If we've reached the end of the string at this point, we've successfully
+ * found a fitting file name.
+ */
+ return *p == '\0';
+}
+