X-Git-Url: https://git.openssl.org/?p=openssl.git;a=blobdiff_plain;f=crypto%2Fprovider_core.c;h=cfaa09ff7b661ae36efb356d598c74948f1672da;hp=58604487bd73ae131d5fcab3aaf42c1831ef707a;hb=82ec09ec6d4e35ef359a7cb22c0cb46662f18155;hpb=6592ab81d21fc01e05a01cd5b96c84b069bf8acf diff --git a/crypto/provider_core.c b/crypto/provider_core.c index 58604487bd..cfaa09ff7b 100644 --- a/crypto/provider_core.c +++ b/crypto/provider_core.c @@ -1,5 +1,5 @@ /* - * Copyright 2019 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2019-2020 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -9,14 +9,19 @@ #include #include +#include +#include #include #include -#include "internal/cryptlib_int.h" +#include "crypto/cryptlib.h" #include "internal/nelem.h" #include "internal/thread_once.h" #include "internal/provider.h" #include "internal/refcount.h" #include "provider_local.h" +#ifndef FIPS_MODULE +# include +#endif static OSSL_PROVIDER *provider_new(const char *name, OSSL_provider_init_fn *init_function); @@ -37,7 +42,8 @@ struct provider_store_st; /* Forward declaration */ struct ossl_provider_st { /* Flag bits */ unsigned int flag_initialized:1; - unsigned int flag_fallback:1; + unsigned int flag_fallback:1; /* Can be used as fallback */ + unsigned int flag_activated_as_fallback:1; /* OpenSSL library side data */ CRYPTO_REF_COUNT refcnt; @@ -49,7 +55,7 @@ struct ossl_provider_st { STACK_OF(INFOPAIR) *parameters; OPENSSL_CTX *libctx; /* The library context this instance is in */ struct provider_store_st *store; /* The store this instance belongs to */ -#ifndef FIPS_MODE +#ifndef FIPS_MODULE /* * In the FIPS module inner provider, this isn't needed, since the * error upcalls are always direct calls to the outer provider. @@ -62,10 +68,18 @@ struct ossl_provider_st { /* Provider side functions */ OSSL_provider_teardown_fn *teardown; - OSSL_provider_get_param_types_fn *get_param_types; + OSSL_provider_gettable_params_fn *gettable_params; OSSL_provider_get_params_fn *get_params; + OSSL_provider_get_capabilities_fn *get_capabilities; OSSL_provider_query_operation_fn *query_operation; + /* + * Cache of bit to indicate of query_operation() has been called on + * a specific operation or not. + */ + unsigned char *operation_bits; + size_t operation_bits_sz; + /* Provider side data */ void *provctx; }; @@ -88,16 +102,36 @@ static int ossl_provider_cmp(const OSSL_PROVIDER * const *a, struct provider_store_st { STACK_OF(OSSL_PROVIDER) *providers; CRYPTO_RWLOCK *lock; + char *default_path; unsigned int use_fallbacks:1; }; +/* + * provider_deactivate_free() is a wrapper around ossl_provider_free() + * that also makes sure that activated fallback providers are deactivated. + * This is simply done by freeing them an extra time, to compensate for the + * refcount that provider_activate_fallbacks() gives them. + * Since this is only called when the provider store is being emptied, we + * don't need to care about any lock. + */ +static void provider_deactivate_free(OSSL_PROVIDER *prov) +{ + int extra_free = (prov->flag_initialized + && prov->flag_activated_as_fallback); + + if (extra_free) + ossl_provider_free(prov); + ossl_provider_free(prov); +} + static void provider_store_free(void *vstore) { struct provider_store_st *store = vstore; if (store == NULL) return; - sk_OSSL_PROVIDER_pop_free(store->providers, ossl_provider_free); + OPENSSL_free(store->default_path); + sk_OSSL_PROVIDER_pop_free(store->providers, provider_deactivate_free); CRYPTO_THREAD_lock_free(store->lock); OPENSSL_free(store); } @@ -133,7 +167,7 @@ static void *provider_store_new(OPENSSL_CTX *ctx) } prov->libctx = ctx; prov->store = store; -#ifndef FIPS_MODE +#ifndef FIPS_MODULE prov->error_lib = ERR_get_next_error_library(); #endif if(p->is_fallback) @@ -159,7 +193,8 @@ static struct provider_store_st *get_provider_store(OPENSSL_CTX *libctx) return store; } -OSSL_PROVIDER *ossl_provider_find(OPENSSL_CTX *libctx, const char *name) +OSSL_PROVIDER *ossl_provider_find(OPENSSL_CTX *libctx, const char *name, + int noconfig) { struct provider_store_st *store = NULL; OSSL_PROVIDER *prov = NULL; @@ -168,6 +203,15 @@ OSSL_PROVIDER *ossl_provider_find(OPENSSL_CTX *libctx, const char *name) OSSL_PROVIDER tmpl = { 0, }; int i; +#ifndef FIPS_MODULE + /* + * Make sure any providers are loaded from config before we try to find + * them. + */ + if (!noconfig) + OPENSSL_init_crypto(OPENSSL_INIT_LOAD_CONFIG, NULL); +#endif + tmpl.name = (char *)name; CRYPTO_THREAD_write_lock(store->lock); if ((i = sk_OSSL_PROVIDER_find(store->providers, &tmpl)) == -1 @@ -215,7 +259,8 @@ int ossl_provider_up_ref(OSSL_PROVIDER *prov) } OSSL_PROVIDER *ossl_provider_new(OPENSSL_CTX *libctx, const char *name, - OSSL_provider_init_fn *init_function) + OSSL_provider_init_fn *init_function, + int noconfig) { struct provider_store_st *store = NULL; OSSL_PROVIDER *prov = NULL; @@ -223,11 +268,11 @@ OSSL_PROVIDER *ossl_provider_new(OPENSSL_CTX *libctx, const char *name, if ((store = get_provider_store(libctx)) == NULL) return NULL; - if ((prov = ossl_provider_find(libctx, name)) != NULL) { /* refcount +1 */ + if ((prov = ossl_provider_find(libctx, name, + noconfig)) != NULL) { /* refcount +1 */ ossl_provider_free(prov); /* refcount -1 */ - CRYPTOerr(CRYPTO_F_OSSL_PROVIDER_NEW, - CRYPTO_R_PROVIDER_ALREADY_EXISTS); - ERR_add_error_data(2, "name=", name); + ERR_raise_data(ERR_LIB_CRYPTO, CRYPTO_R_PROVIDER_ALREADY_EXISTS, NULL, + "name=%s", name); return NULL; } @@ -246,7 +291,7 @@ OSSL_PROVIDER *ossl_provider_new(OPENSSL_CTX *libctx, const char *name, } else { prov->libctx = libctx; prov->store = store; -#ifndef FIPS_MODE +#ifndef FIPS_MODULE prov->error_lib = ERR_get_next_error_library(); #endif } @@ -285,13 +330,13 @@ void ossl_provider_free(OSSL_PROVIDER *prov) * When that happens, the provider is inactivated. */ if (ref < 2 && prov->flag_initialized) { -#ifndef FIPS_MODE +#ifndef FIPS_MODULE ossl_init_thread_deregister(prov); #endif if (prov->teardown != NULL) prov->teardown(prov->provctx); #ifndef OPENSSL_NO_ERR -# ifndef FIPS_MODE +# ifndef FIPS_MODULE if (prov->error_strings != NULL) { ERR_unload_strings(prov->error_lib, prov->error_strings); OPENSSL_free(prov->error_strings); @@ -299,6 +344,9 @@ void ossl_provider_free(OSSL_PROVIDER *prov) } # endif #endif + OPENSSL_free(prov->operation_bits); + prov->operation_bits = NULL; + prov->operation_bits_sz = 0; prov->flag_initialized = 0; } @@ -307,7 +355,7 @@ void ossl_provider_free(OSSL_PROVIDER *prov) * the store. All we have to do here is clean it out. */ if (ref == 0) { -#ifndef FIPS_MODE +#ifndef FIPS_MODULE DSO_free(prov->module); #endif OPENSSL_free(prov->name); @@ -369,6 +417,29 @@ int ossl_provider_add_parameter(OSSL_PROVIDER *prov, */ static const OSSL_DISPATCH *core_dispatch; /* Define further down */ +int OSSL_PROVIDER_set_default_search_path(OPENSSL_CTX *libctx, const char *path) +{ + struct provider_store_st *store; + char *p = NULL; + + if (path != NULL) { + p = OPENSSL_strdup(path); + if (p == NULL) { + CRYPTOerr(0, ERR_R_MALLOC_FAILURE); + return 0; + } + } + if ((store = get_provider_store(libctx)) != NULL + && CRYPTO_THREAD_write_lock(store->lock)) { + OPENSSL_free(store->default_path); + store->default_path = p; + CRYPTO_THREAD_unlock(store->lock); + return 1; + } + OPENSSL_free(p); + return 0; +} + /* * Internal version that doesn't affect the store flags, and thereby avoid * locking. Direct callers must remember to set the store flags when @@ -377,8 +448,9 @@ static const OSSL_DISPATCH *core_dispatch; /* Define further down */ static int provider_activate(OSSL_PROVIDER *prov) { const OSSL_DISPATCH *provider_dispatch = NULL; + void *tmp_provctx = NULL; /* safety measure */ #ifndef OPENSSL_NO_ERR -# ifndef FIPS_MODE +# ifndef FIPS_MODULE OSSL_provider_get_reason_strings_fn *p_get_reason_strings = NULL; # endif #endif @@ -391,22 +463,31 @@ static int provider_activate(OSSL_PROVIDER *prov) * a loadable module. */ if (prov->init_function == NULL) { -#ifdef FIPS_MODE +#ifdef FIPS_MODULE return 0; #else if (prov->module == NULL) { char *allocated_path = NULL; const char *module_path = NULL; char *merged_path = NULL; - const char *load_dir = ossl_safe_getenv("OPENSSL_MODULES"); + const char *load_dir = NULL; + struct provider_store_st *store; if ((prov->module = DSO_new()) == NULL) { /* DSO_new() generates an error already */ return 0; } - if (load_dir == NULL) - load_dir = MODULESDIR; + if ((store = get_provider_store(prov->libctx)) == NULL + || !CRYPTO_THREAD_read_lock(store->lock)) + return 0; + load_dir = store->default_path; + + if (load_dir == NULL) { + load_dir = ossl_safe_getenv("OPENSSL_MODULES"); + if (load_dir == NULL) + load_dir = MODULESDIR; + } DSO_ctrl(prov->module, DSO_CTRL_SET_FLAGS, DSO_FLAG_NAME_TRANSLATION_EXT_ONLY, NULL); @@ -417,6 +498,7 @@ static int provider_activate(OSSL_PROVIDER *prov) DSO_convert_filename(prov->module, prov->name); if (module_path != NULL) merged_path = DSO_merge(prov->module, module_path, load_dir); + CRYPTO_THREAD_unlock(store->lock); if (merged_path == NULL || (DSO_load(prov->module, merged_path, NULL, 0)) == NULL) { @@ -436,16 +518,17 @@ static int provider_activate(OSSL_PROVIDER *prov) /* Call the initialise function for the provider. */ if (prov->init_function == NULL - || !prov->init_function(prov, core_dispatch, &provider_dispatch, - &prov->provctx)) { - CRYPTOerr(CRYPTO_F_PROVIDER_ACTIVATE, ERR_R_INIT_FAIL); - ERR_add_error_data(2, "name=", prov->name); -#ifndef FIPS_MODE + || !prov->init_function((OSSL_CORE_HANDLE *)prov, core_dispatch, + &provider_dispatch, &tmp_provctx)) { + ERR_raise_data(ERR_LIB_CRYPTO, ERR_R_INIT_FAIL, NULL, + "name=%s", prov->name); +#ifndef FIPS_MODULE DSO_free(prov->module); prov->module = NULL; #endif return 0; } + prov->provctx = tmp_provctx; for (; provider_dispatch->function_id != 0; provider_dispatch++) { switch (provider_dispatch->function_id) { @@ -453,20 +536,24 @@ static int provider_activate(OSSL_PROVIDER *prov) prov->teardown = OSSL_get_provider_teardown(provider_dispatch); break; - case OSSL_FUNC_PROVIDER_GET_PARAM_TYPES: - prov->get_param_types = - OSSL_get_provider_get_param_types(provider_dispatch); + case OSSL_FUNC_PROVIDER_GETTABLE_PARAMS: + prov->gettable_params = + OSSL_get_provider_gettable_params(provider_dispatch); break; case OSSL_FUNC_PROVIDER_GET_PARAMS: prov->get_params = OSSL_get_provider_get_params(provider_dispatch); break; + case OSSL_FUNC_PROVIDER_GET_CAPABILITIES: + prov->get_capabilities = + OSSL_get_provider_get_capabilities(provider_dispatch); + break; case OSSL_FUNC_PROVIDER_QUERY_OPERATION: prov->query_operation = OSSL_get_provider_query_operation(provider_dispatch); break; #ifndef OPENSSL_NO_ERR -# ifndef FIPS_MODE +# ifndef FIPS_MODULE case OSSL_FUNC_PROVIDER_GET_REASON_STRINGS: p_get_reason_strings = OSSL_get_provider_get_reason_strings(provider_dispatch); @@ -477,7 +564,7 @@ static int provider_activate(OSSL_PROVIDER *prov) } #ifndef OPENSSL_NO_ERR -# ifndef FIPS_MODE +# ifndef FIPS_MODULE if (p_get_reason_strings != NULL) { const OSSL_ITEM *reasonstrings = p_get_reason_strings(prov->provctx); size_t cnt, cnt2; @@ -489,12 +576,13 @@ static int provider_activate(OSSL_PROVIDER *prov) * with the error library number, so we need to make a copy of that * array either way. */ - cnt = 1; /* One for the terminating item */ + cnt = 0; while (reasonstrings[cnt].id != 0) { if (ERR_GET_LIB(reasonstrings[cnt].id) != 0) return 0; cnt++; } + cnt++; /* One for the terminating item */ /* Allocate one extra item for the "library" name */ prov->error_strings = @@ -553,7 +641,9 @@ static int provider_forall_loaded(struct provider_store_st *store, { int i; int ret = 1; - int num_provs = sk_OSSL_PROVIDER_num(store->providers); + int num_provs; + + num_provs = sk_OSSL_PROVIDER_num(store->providers); if (found_activated != NULL) *found_activated = 0; @@ -572,67 +662,96 @@ static int provider_forall_loaded(struct provider_store_st *store, return ret; } +/* + * This function only does something once when store->use_fallbacks == 1, + * and then sets store->use_fallbacks = 0, so the second call and so on is + * effectively a no-op. + */ +static void provider_activate_fallbacks(struct provider_store_st *store) +{ + if (store->use_fallbacks) { + int num_provs = sk_OSSL_PROVIDER_num(store->providers); + int activated_fallback_count = 0; + int i; + + for (i = 0; i < num_provs; i++) { + OSSL_PROVIDER *prov = sk_OSSL_PROVIDER_value(store->providers, i); + + /* + * Activated fallback providers get an extra refcount, to + * simulate a regular load. + * Note that we don't care if the activation succeeds or not, + * other than to maintain a correct refcount. If the activation + * doesn't succeed, then any future attempt to use the fallback + * provider will fail anyway. + */ + if (prov->flag_fallback) { + if (ossl_provider_up_ref(prov)) { + if (!provider_activate(prov)) { + ossl_provider_free(prov); + } else { + prov->flag_activated_as_fallback = 1; + activated_fallback_count++; + } + } + } + } + + /* + * We assume that all fallbacks have been added to the store before + * any fallback is activated. + * TODO: We may have to reconsider this, IF we find ourselves adding + * fallbacks after any previous fallback has been activated. + */ + if (activated_fallback_count > 0) + store->use_fallbacks = 0; + } +} + int ossl_provider_forall_loaded(OPENSSL_CTX *ctx, int (*cb)(OSSL_PROVIDER *provider, void *cbdata), void *cbdata) { int ret = 1; - int i; struct provider_store_st *store = get_provider_store(ctx); - if (store != NULL) { - int found_activated = 0; +#ifndef FIPS_MODULE + /* + * Make sure any providers are loaded from config before we try to use + * them. + */ + OPENSSL_init_crypto(OPENSSL_INIT_LOAD_CONFIG, NULL); +#endif + if (store != NULL) { CRYPTO_THREAD_read_lock(store->lock); - ret = provider_forall_loaded(store, &found_activated, cb, cbdata); + + provider_activate_fallbacks(store); /* - * If there's nothing activated ever in this store, try to activate - * all fallbacks. + * Now, we sweep through all providers */ - if (!found_activated && store->use_fallbacks) { - int num_provs = sk_OSSL_PROVIDER_num(store->providers); - int activated_fallback_count = 0; - - for (i = 0; i < num_provs; i++) { - OSSL_PROVIDER *prov = - sk_OSSL_PROVIDER_value(store->providers, i); - - /* - * Note that we don't care if the activation succeeds or - * not. If it doesn't succeed, then the next loop will - * fail anyway. - */ - if (prov->flag_fallback) { - activated_fallback_count++; - provider_activate(prov); - } - } + ret = provider_forall_loaded(store, NULL, cb, cbdata); - if (activated_fallback_count > 0) { - /* - * We assume that all fallbacks have been added to the store - * before any fallback is activated. - * TODO: We may have to reconsider this, IF we find ourselves - * adding fallbacks after any previous fallback has been - * activated. - */ - store->use_fallbacks = 0; - - /* - * Now that we've activated available fallbacks, try a - * second sweep - */ - ret = provider_forall_loaded(store, NULL, cb, cbdata); - } - } CRYPTO_THREAD_unlock(store->lock); } return ret; } +int ossl_provider_available(OSSL_PROVIDER *prov) +{ + if (prov != NULL) { + CRYPTO_THREAD_read_lock(prov->store->lock); + provider_activate_fallbacks(prov->store); + CRYPTO_THREAD_unlock(prov->store->lock); + + return prov->flag_initialized; + } + return 0; +} + /* Setters of Provider Object data */ int ossl_provider_set_fallback(OSSL_PROVIDER *prov) { @@ -656,7 +775,7 @@ const DSO *ossl_provider_dso(const OSSL_PROVIDER *prov) const char *ossl_provider_module_name(const OSSL_PROVIDER *prov) { -#ifdef FIPS_MODE +#ifdef FIPS_MODULE return NULL; #else return DSO_get_filename(prov->module); @@ -665,7 +784,7 @@ const char *ossl_provider_module_name(const OSSL_PROVIDER *prov) const char *ossl_provider_module_path(const OSSL_PROVIDER *prov) { -#ifdef FIPS_MODE +#ifdef FIPS_MODULE return NULL; #else /* FIXME: Ensure it's a full path */ @@ -673,6 +792,20 @@ const char *ossl_provider_module_path(const OSSL_PROVIDER *prov) #endif } +void *ossl_provider_prov_ctx(const OSSL_PROVIDER *prov) +{ + if (prov != NULL) + return prov->provctx; + + return NULL; +} + +OPENSSL_CTX *ossl_provider_library_context(const OSSL_PROVIDER *prov) +{ + /* TODO(3.0) just: return prov->libctx; */ + return prov != NULL ? prov->libctx : NULL; +} + /* Wrappers around calls to the provider */ void ossl_provider_teardown(const OSSL_PROVIDER *prov) { @@ -680,10 +813,10 @@ void ossl_provider_teardown(const OSSL_PROVIDER *prov) prov->teardown(prov->provctx); } -const OSSL_ITEM *ossl_provider_get_param_types(const OSSL_PROVIDER *prov) +const OSSL_PARAM *ossl_provider_gettable_params(const OSSL_PROVIDER *prov) { - return prov->get_param_types == NULL - ? NULL : prov->get_param_types(prov->provctx); + return prov->gettable_params == NULL + ? NULL : prov->gettable_params(prov->provctx); } int ossl_provider_get_params(const OSSL_PROVIDER *prov, OSSL_PARAM params[]) @@ -692,6 +825,15 @@ int ossl_provider_get_params(const OSSL_PROVIDER *prov, OSSL_PARAM params[]) ? 0 : prov->get_params(prov->provctx, params); } +int ossl_provider_get_capabilities(const OSSL_PROVIDER *prov, + const char *capability, + OSSL_CALLBACK *cb, + void *arg) +{ + return prov->get_capabilities == NULL + ? 0 : prov->get_capabilities(prov->provctx, capability, cb, arg); +} + const OSSL_ALGORITHM *ossl_provider_query_operation(const OSSL_PROVIDER *prov, int operation_id, @@ -700,6 +842,42 @@ const OSSL_ALGORITHM *ossl_provider_query_operation(const OSSL_PROVIDER *prov, return prov->query_operation(prov->provctx, operation_id, no_cache); } +int ossl_provider_set_operation_bit(OSSL_PROVIDER *provider, size_t bitnum) +{ + size_t byte = bitnum / 8; + unsigned char bit = (1 << (bitnum % 8)) & 0xFF; + + if (provider->operation_bits_sz <= byte) { + provider->operation_bits = OPENSSL_realloc(provider->operation_bits, + byte + 1); + if (provider->operation_bits == NULL) { + ERR_raise(ERR_LIB_CRYPTO, ERR_R_MALLOC_FAILURE); + return 0; + } + memset(provider->operation_bits + provider->operation_bits_sz, + '\0', byte + 1 - provider->operation_bits_sz); + } + provider->operation_bits[byte] |= bit; + return 1; +} + +int ossl_provider_test_operation_bit(OSSL_PROVIDER *provider, size_t bitnum, + int *result) +{ + size_t byte = bitnum / 8; + unsigned char bit = (1 << (bitnum % 8)) & 0xFF; + + if (!ossl_assert(result != NULL)) { + ERR_raise(ERR_LIB_CRYPTO, ERR_R_PASSED_NULL_PARAMETER); + return 0; + } + + *result = 0; + if (provider->operation_bits_sz > byte) + *result = ((provider->operation_bits[byte] & bit) != 0); + return 1; +} + /*- * Core functions for the provider * =============================== @@ -712,27 +890,61 @@ const OSSL_ALGORITHM *ossl_provider_query_operation(const OSSL_PROVIDER *prov, * discovery. We do not expect that many providers will use this, but one * never knows. */ -static const OSSL_ITEM param_types[] = { - { OSSL_PARAM_UTF8_PTR, "openssl-version" }, - { OSSL_PARAM_UTF8_PTR, "provider-name" }, - { 0, NULL } +static const OSSL_PARAM param_types[] = { + OSSL_PARAM_DEFN(OSSL_PROV_PARAM_CORE_VERSION, OSSL_PARAM_UTF8_PTR, NULL, 0), + OSSL_PARAM_DEFN(OSSL_PROV_PARAM_CORE_PROV_NAME, OSSL_PARAM_UTF8_PTR, + NULL, 0), +#ifndef FIPS_MODULE + OSSL_PARAM_DEFN(OSSL_PROV_PARAM_CORE_MODULE_FILENAME, OSSL_PARAM_UTF8_PTR, + NULL, 0), +#endif + OSSL_PARAM_END }; -static const OSSL_ITEM *core_get_param_types(const OSSL_PROVIDER *prov) +/* + * Forward declare all the functions that are provided aa dispatch. + * This ensures that the compiler will complain if they aren't defined + * with the correct signature. + */ +static OSSL_core_gettable_params_fn core_gettable_params; +static OSSL_core_get_params_fn core_get_params; +static OSSL_core_thread_start_fn core_thread_start; +static OSSL_core_get_library_context_fn core_get_libctx; +#ifndef FIPS_MODULE +static OSSL_core_new_error_fn core_new_error; +static OSSL_core_set_error_debug_fn core_set_error_debug; +static OSSL_core_vset_error_fn core_vset_error; +static OSSL_core_set_error_mark_fn core_set_error_mark; +static OSSL_core_clear_last_error_mark_fn core_clear_last_error_mark; +static OSSL_core_pop_error_to_mark_fn core_pop_error_to_mark; +#endif + +static const OSSL_PARAM *core_gettable_params(const OSSL_CORE_HANDLE *handle) { return param_types; } -static int core_get_params(const OSSL_PROVIDER *prov, OSSL_PARAM params[]) +static int core_get_params(const OSSL_CORE_HANDLE *handle, OSSL_PARAM params[]) { int i; OSSL_PARAM *p; + /* + * We created this object originally and we know it is actually an + * OSSL_PROVIDER *, so the cast is safe + */ + OSSL_PROVIDER *prov = (OSSL_PROVIDER *)handle; - if ((p = OSSL_PARAM_locate(params, "openssl-version")) != NULL) + if ((p = OSSL_PARAM_locate(params, OSSL_PROV_PARAM_CORE_VERSION)) != NULL) OSSL_PARAM_set_utf8_ptr(p, OPENSSL_VERSION_STR); - if ((p = OSSL_PARAM_locate(params, "provider-name")) != NULL) + if ((p = OSSL_PARAM_locate(params, OSSL_PROV_PARAM_CORE_PROV_NAME)) != NULL) OSSL_PARAM_set_utf8_ptr(p, prov->name); +#ifndef FIPS_MODULE + if ((p = OSSL_PARAM_locate(params, + OSSL_PROV_PARAM_CORE_MODULE_FILENAME)) != NULL) + OSSL_PARAM_set_utf8_ptr(p, ossl_provider_module_path(prov)); +#endif + if (prov->parameters == NULL) return 1; @@ -742,19 +954,29 @@ static int core_get_params(const OSSL_PROVIDER *prov, OSSL_PARAM params[]) if ((p = OSSL_PARAM_locate(params, pair->name)) != NULL) OSSL_PARAM_set_utf8_ptr(p, pair->value); } - return 1; } -static OSSL_core_get_library_context_fn core_get_libctx; /* Check */ -static OPENSSL_CTX *core_get_libctx(const OSSL_PROVIDER *prov) +static OPENSSL_CORE_CTX *core_get_libctx(const OSSL_CORE_HANDLE *handle) { - return prov->libctx; + /* + * We created this object originally and we know it is actually an + * OSSL_PROVIDER *, so the cast is safe + */ + OSSL_PROVIDER *prov = (OSSL_PROVIDER *)handle; + + return (OPENSSL_CORE_CTX *)ossl_provider_library_context(prov); } -static int core_thread_start(const OSSL_PROVIDER *prov, +static int core_thread_start(const OSSL_CORE_HANDLE *handle, OSSL_thread_stop_handler_fn handfn) { + /* + * We created this object originally and we know it is actually an + * OSSL_PROVIDER *, so the cast is safe + */ + OSSL_PROVIDER *prov = (OSSL_PROVIDER *)handle; + return ossl_init_thread_start(prov, prov->provctx, handfn); } @@ -763,48 +985,103 @@ static int core_thread_start(const OSSL_PROVIDER *prov, * needed there, since the FIPS module upcalls are always the outer provider * ones. */ -#ifndef FIPS_MODE -static void core_put_error(const OSSL_PROVIDER *prov, - uint32_t reason, const char *file, int line) +#ifndef FIPS_MODULE +/* + * TODO(3.0) These error functions should use |handle| to select the proper + * library context to report in the correct error stack, at least if error + * stacks become tied to the library context. + * We cannot currently do that since there's no support for it in the + * ERR subsystem. + */ +static void core_new_error(const OSSL_CORE_HANDLE *handle) +{ + ERR_new(); +} + +static void core_set_error_debug(const OSSL_CORE_HANDLE *handle, + const char *file, int line, const char *func) +{ + ERR_set_debug(file, line, func); +} + +static void core_vset_error(const OSSL_CORE_HANDLE *handle, + uint32_t reason, const char *fmt, va_list args) { + /* + * We created this object originally and we know it is actually an + * OSSL_PROVIDER *, so the cast is safe + */ + OSSL_PROVIDER *prov = (OSSL_PROVIDER *)handle; + /* * If the uppermost 8 bits are non-zero, it's an OpenSSL library * error and will be treated as such. Otherwise, it's a new style * provider error and will be treated as such. */ if (ERR_GET_LIB(reason) != 0) { - ERR_PUT_error(ERR_GET_LIB(reason), - ERR_GET_FUNC(reason), - ERR_GET_REASON(reason), - file, line); + ERR_vset_error(ERR_GET_LIB(reason), ERR_GET_REASON(reason), fmt, args); } else { - ERR_PUT_error(prov->error_lib, 0, (int)reason, file, line); + ERR_vset_error(prov->error_lib, (int)reason, fmt, args); } } -/* - * TODO(3.0) This, as well as core_put_error above, should use |prov| - * to select the proper library context to report in the correct error - * stack, at least if error stacks become tied to the library context. - * We cannot currently do that since there's no support for it in the - * ERR subsystem. - */ -static void core_add_error_vdata(const OSSL_PROVIDER *prov, - int num, va_list args) +static int core_set_error_mark(const OSSL_CORE_HANDLE *handle) { - ERR_add_error_vdata(num, args); + return ERR_set_mark(); } -#endif +static int core_clear_last_error_mark(const OSSL_CORE_HANDLE *handle) +{ + return ERR_clear_last_mark(); +} + +static int core_pop_error_to_mark(const OSSL_CORE_HANDLE *handle) +{ + return ERR_pop_to_mark(); +} +#endif /* FIPS_MODULE */ + +/* + * Functions provided by the core. Blank line separates "families" of related + * functions. + */ static const OSSL_DISPATCH core_dispatch_[] = { - { OSSL_FUNC_CORE_GET_PARAM_TYPES, (void (*)(void))core_get_param_types }, + { OSSL_FUNC_CORE_GETTABLE_PARAMS, (void (*)(void))core_gettable_params }, { OSSL_FUNC_CORE_GET_PARAMS, (void (*)(void))core_get_params }, { OSSL_FUNC_CORE_GET_LIBRARY_CONTEXT, (void (*)(void))core_get_libctx }, { OSSL_FUNC_CORE_THREAD_START, (void (*)(void))core_thread_start }, -#ifndef FIPS_MODE - { OSSL_FUNC_CORE_PUT_ERROR, (void (*)(void))core_put_error }, - { OSSL_FUNC_CORE_ADD_ERROR_VDATA, (void (*)(void))core_add_error_vdata }, +#ifndef FIPS_MODULE + { OSSL_FUNC_CORE_NEW_ERROR, (void (*)(void))core_new_error }, + { OSSL_FUNC_CORE_SET_ERROR_DEBUG, (void (*)(void))core_set_error_debug }, + { OSSL_FUNC_CORE_VSET_ERROR, (void (*)(void))core_vset_error }, + { OSSL_FUNC_CORE_SET_ERROR_MARK, (void (*)(void))core_set_error_mark }, + { OSSL_FUNC_CORE_CLEAR_LAST_ERROR_MARK, + (void (*)(void))core_clear_last_error_mark }, + { OSSL_FUNC_CORE_POP_ERROR_TO_MARK, (void (*)(void))core_pop_error_to_mark }, + { OSSL_FUNC_BIO_NEW_FILE, (void (*)(void))BIO_new_file }, + { OSSL_FUNC_BIO_NEW_MEMBUF, (void (*)(void))BIO_new_mem_buf }, + { OSSL_FUNC_BIO_READ_EX, (void (*)(void))BIO_read_ex }, + { OSSL_FUNC_BIO_WRITE_EX, (void (*)(void))BIO_write_ex }, + { OSSL_FUNC_BIO_FREE, (void (*)(void))BIO_free }, + { OSSL_FUNC_BIO_VPRINTF, (void (*)(void))BIO_vprintf }, + { OSSL_FUNC_BIO_VSNPRINTF, (void (*)(void))BIO_vsnprintf }, + { OSSL_FUNC_SELF_TEST_CB, (void (*)(void))OSSL_SELF_TEST_get_callback }, #endif + { OSSL_FUNC_CRYPTO_MALLOC, (void (*)(void))CRYPTO_malloc }, + { OSSL_FUNC_CRYPTO_ZALLOC, (void (*)(void))CRYPTO_zalloc }, + { OSSL_FUNC_CRYPTO_FREE, (void (*)(void))CRYPTO_free }, + { OSSL_FUNC_CRYPTO_CLEAR_FREE, (void (*)(void))CRYPTO_clear_free }, + { OSSL_FUNC_CRYPTO_REALLOC, (void (*)(void))CRYPTO_realloc }, + { OSSL_FUNC_CRYPTO_CLEAR_REALLOC, (void (*)(void))CRYPTO_clear_realloc }, + { OSSL_FUNC_CRYPTO_SECURE_MALLOC, (void (*)(void))CRYPTO_secure_malloc }, + { OSSL_FUNC_CRYPTO_SECURE_ZALLOC, (void (*)(void))CRYPTO_secure_zalloc }, + { OSSL_FUNC_CRYPTO_SECURE_FREE, (void (*)(void))CRYPTO_secure_free }, + { OSSL_FUNC_CRYPTO_SECURE_CLEAR_FREE, + (void (*)(void))CRYPTO_secure_clear_free }, + { OSSL_FUNC_CRYPTO_SECURE_ALLOCATED, + (void (*)(void))CRYPTO_secure_allocated }, + { OSSL_FUNC_OPENSSL_CLEANSE, (void (*)(void))OPENSSL_cleanse }, + { 0, NULL } }; static const OSSL_DISPATCH *core_dispatch = core_dispatch_;