STORE: Add the possibility to specify an expected info type

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/2688)

diff --git a/crypto/err/openssl.txt b/crypto/err/openssl.txt
index 9b8a03ac21e5e30b3b47827d84abdd218e3cedd2..228cde532da9d0f78331ed1b4a59db81d18158ab 100644 (file)
--- a/crypto/err/openssl.txt
+++ b/crypto/err/openssl.txt
@@ -757,6 +757,7 @@ OSSL_STORE_F_FILE_LOAD_TRY_DECODE:124:file_load_try_decode
 OSSL_STORE_F_FILE_NAME_TO_URI:126:file_name_to_uri
 OSSL_STORE_F_FILE_OPEN:120:file_open
 OSSL_STORE_F_OSSL_STORE_ATTACH_PEM_BIO:127:ossl_store_attach_pem_bio
+OSSL_STORE_F_OSSL_STORE_EXPECT:130:OSSL_STORE_expect
 OSSL_STORE_F_OSSL_STORE_FILE_ATTACH_PEM_BIO_INT:128:\
        ossl_store_file_attach_pem_bio_int
 OSSL_STORE_F_OSSL_STORE_GET0_LOADER_INT:100:ossl_store_get0_loader_int
@@ -2149,6 +2150,7 @@ OSSL_STORE_R_ERROR_VERIFYING_PKCS12_MAC:113:error verifying pkcs12 mac
 OSSL_STORE_R_INVALID_SCHEME:106:invalid scheme
 OSSL_STORE_R_IS_NOT_A:112:is not a
 OSSL_STORE_R_LOADER_INCOMPLETE:116:loader incomplete
+OSSL_STORE_R_LOADING_STARTED:117:loading started
 OSSL_STORE_R_NOT_A_CERTIFICATE:100:not a certificate
 OSSL_STORE_R_NOT_A_CRL:101:not a crl
 OSSL_STORE_R_NOT_A_KEY:102:not a key

diff --git a/crypto/store/loader_file.c b/crypto/store/loader_file.c
index 588a5816321f5a776cf245fe53b406b4c2784dcf..048cbd3a69626d3b819009dd5a90031387c4e186 100644 (file)
--- a/crypto/store/loader_file.c
+++ b/crypto/store/loader_file.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2017 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2016-2018 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the OpenSSL license (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -1295,6 +1295,7 @@ static OSSL_STORE_LOADER file_loader =
         NULL,
         file_open,
         file_ctrl,
+        NULL,
         file_load,
         file_eof,
         file_error,

diff --git a/crypto/store/store_err.c b/crypto/store/store_err.c
index c78b3899f7a3e0969e7e6b463332114aea906c6b..89021956106f7667f1f65b2b13234290e0984cf2 100644 (file)
--- a/crypto/store/store_err.c
+++ b/crypto/store/store_err.c
@@ -25,6 +25,8 @@ static const ERR_STRING_DATA OSSL_STORE_str_functs[] = {
     {ERR_PACK(ERR_LIB_OSSL_STORE, OSSL_STORE_F_FILE_OPEN, 0), "file_open"},
     {ERR_PACK(ERR_LIB_OSSL_STORE, OSSL_STORE_F_OSSL_STORE_ATTACH_PEM_BIO, 0),
      "ossl_store_attach_pem_bio"},
+    {ERR_PACK(ERR_LIB_OSSL_STORE, OSSL_STORE_F_OSSL_STORE_EXPECT, 0),
+     "OSSL_STORE_expect"},
     {ERR_PACK(ERR_LIB_OSSL_STORE, OSSL_STORE_F_OSSL_STORE_FILE_ATTACH_PEM_BIO_INT, 0),
      "ossl_store_file_attach_pem_bio_int"},
     {ERR_PACK(ERR_LIB_OSSL_STORE, OSSL_STORE_F_OSSL_STORE_GET0_LOADER_INT, 0),
@@ -87,6 +89,8 @@ static const ERR_STRING_DATA OSSL_STORE_str_reasons[] = {
     {ERR_PACK(ERR_LIB_OSSL_STORE, 0, OSSL_STORE_R_IS_NOT_A), "is not a"},
     {ERR_PACK(ERR_LIB_OSSL_STORE, 0, OSSL_STORE_R_LOADER_INCOMPLETE),
     "loader incomplete"},
+    {ERR_PACK(ERR_LIB_OSSL_STORE, 0, OSSL_STORE_R_LOADING_STARTED),
+    "loading started"},
     {ERR_PACK(ERR_LIB_OSSL_STORE, 0, OSSL_STORE_R_NOT_A_CERTIFICATE),
     "not a certificate"},
     {ERR_PACK(ERR_LIB_OSSL_STORE, 0, OSSL_STORE_R_NOT_A_CRL), "not a crl"},

diff --git a/crypto/store/store_lib.c b/crypto/store/store_lib.c
index fce2dbc2e221ec9686b8090a61505d772d3e3404..bc619a306f76fd4fecf7bfede6955f92ab399f1a 100644 (file)
--- a/crypto/store/store_lib.c
+++ b/crypto/store/store_lib.c
@@ -10,6 +10,10 @@
 #include "e_os.h"
 #include <stdlib.h>
 #include <string.h>
+#include <assert.h>
+
+#include "e_os.h"
+
 #include <openssl/crypto.h>
 #include <openssl/err.h>
 #include <openssl/store.h>
@@ -24,6 +28,7 @@ struct ossl_store_ctx_st {
     void *ui_data;
     OSSL_STORE_post_process_info_fn post_process;
     void *post_process_data;
+    int expected_type;
 
     /* 0 before the first STORE_load(), 1 otherwise */
     int loading;
@@ -128,6 +133,20 @@ int OSSL_STORE_vctrl(OSSL_STORE_CTX *ctx, int cmd, va_list args)
     return 0;
 }
 
+int OSSL_STORE_expect(OSSL_STORE_CTX *ctx, int expected_type)
+{
+    if (ctx->loading) {
+        OSSL_STOREerr(OSSL_STORE_F_OSSL_STORE_EXPECT,
+                      OSSL_STORE_R_LOADING_STARTED);
+        return 0;
+    }
+
+    ctx->expected_type = expected_type;
+    if (ctx->loader->expect != NULL)
+        return ctx->loader->expect(ctx->loader_ctx, expected_type);
+    return 1;
+}
+
 OSSL_STORE_INFO *OSSL_STORE_load(OSSL_STORE_CTX *ctx)
 {
     OSSL_STORE_INFO *v = NULL;
@@ -150,6 +169,24 @@ OSSL_STORE_INFO *OSSL_STORE_load(OSSL_STORE_CTX *ctx)
             goto again;
     }
 
+    if (v != NULL && ctx->expected_type != 0) {
+        int returned_type = OSSL_STORE_INFO_get_type(v);
+
+        if (returned_type != OSSL_STORE_INFO_NAME && returned_type != 0) {
+            /*
+             * Soft assert here so those who want to harsly weed out faulty
+             * loaders can do so using a debugging version of libcrypto.
+             */
+            if (ctx->loader->expect != NULL)
+                assert(ctx->expected_type == returned_type);
+
+            if (ctx->expected_type != returned_type) {
+                OSSL_STORE_INFO_free(v);
+                goto again;
+            }
+        }
+    }
+
     return v;
 }
 

diff --git a/crypto/store/store_locl.h b/crypto/store/store_locl.h
index 789d3328101e6a34398a8e0410d0173b4ce0d756..68265f826a7586445df1871c3ecccfcd50a9e21f 100644 (file)
--- a/crypto/store/store_locl.h
+++ b/crypto/store/store_locl.h
@@ -1,5 +1,5 @@
 /*
- * Copyright 2016-2017 The OpenSSL Project Authors. All Rights Reserved.
+ * Copyright 2016-2018 The OpenSSL Project Authors. All Rights Reserved.
  *
  * Licensed under the OpenSSL license (the "License").  You may not use
  * this file except in compliance with the License.  You can obtain a copy
@@ -75,6 +75,7 @@ struct ossl_store_loader_st {
     ENGINE *engine;
     OSSL_STORE_open_fn open;
     OSSL_STORE_ctrl_fn ctrl;
+    OSSL_STORE_expect_fn expect;
     OSSL_STORE_load_fn load;
     OSSL_STORE_eof_fn eof;
     OSSL_STORE_error_fn error;

diff --git a/crypto/store/store_register.c b/crypto/store/store_register.c
index 855c28eda77e13d410483d6690ab357c92dd37b5..476cd7ac866005f6d79c96d949e456d7aa744b58 100644 (file)
--- a/crypto/store/store_register.c
+++ b/crypto/store/store_register.c
@@ -78,6 +78,13 @@ int OSSL_STORE_LOADER_set_ctrl(OSSL_STORE_LOADER *loader,
     return 1;
 }
 
+int OSSL_STORE_LOADER_set_expect(OSSL_STORE_LOADER *loader,
+                                 OSSL_STORE_expect_fn expect_function)
+{
+    loader->expect = expect_function;
+    return 1;
+}
+
 int OSSL_STORE_LOADER_set_load(OSSL_STORE_LOADER *loader,
                                OSSL_STORE_load_fn load_function)
 {

diff --git a/include/openssl/store.h b/include/openssl/store.h
index ff42953e6cb0dcb91b489f606ef734b28093a4f1..d4222512f7acf5978fdca6ef65f1c558f2bebe0e 100644 (file)
--- a/include/openssl/store.h
+++ b/include/openssl/store.h
@@ -151,6 +151,12 @@ const char *OSSL_STORE_INFO_type_string(int type);
  */
 void OSSL_STORE_INFO_free(OSSL_STORE_INFO *info);
 
+/*
+ * Add expected return type (which can be unspecified) to the loading channel.
+ *  This MUST happen before the first STORE_load().
+ */
+int OSSL_STORE_expect(OSSL_STORE_CTX *ctx, int expected_type);
+
 
 /*-
  *  Function to register a loader for the given URI scheme.
@@ -177,6 +183,9 @@ typedef int (*OSSL_STORE_ctrl_fn)(OSSL_STORE_LOADER_CTX *ctx, int cmd,
                                   va_list args);
 int OSSL_STORE_LOADER_set_ctrl(OSSL_STORE_LOADER *loader,
                                OSSL_STORE_ctrl_fn ctrl_function);
+typedef int (*OSSL_STORE_expect_fn)(OSSL_STORE_LOADER_CTX *ctx, int expected);
+int OSSL_STORE_LOADER_set_expect(OSSL_STORE_LOADER *loader,
+                                 OSSL_STORE_expect_fn expect_function);
 typedef OSSL_STORE_INFO *(*OSSL_STORE_load_fn)(OSSL_STORE_LOADER_CTX *ctx,
                                                const UI_METHOD *ui_method,
                                                void *ui_data);

diff --git a/include/openssl/storeerr.h b/include/openssl/storeerr.h
index 5476d007bddd09e0fec9c9e2ecd47921cd39ef07..864a9070e376f60df5f81d2ff467cccf32895c2e 100644 (file)
--- a/include/openssl/storeerr.h
+++ b/include/openssl/storeerr.h
@@ -26,6 +26,7 @@ int ERR_load_OSSL_STORE_strings(void);
 # define OSSL_STORE_F_FILE_NAME_TO_URI                    126
 # define OSSL_STORE_F_FILE_OPEN                           120
 # define OSSL_STORE_F_OSSL_STORE_ATTACH_PEM_BIO           127
+# define OSSL_STORE_F_OSSL_STORE_EXPECT                   130
 # define OSSL_STORE_F_OSSL_STORE_FILE_ATTACH_PEM_BIO_INT  128
 # define OSSL_STORE_F_OSSL_STORE_GET0_LOADER_INT          100
 # define OSSL_STORE_F_OSSL_STORE_INFO_GET1_CERT           101
@@ -60,6 +61,7 @@ int ERR_load_OSSL_STORE_strings(void);
 # define OSSL_STORE_R_INVALID_SCHEME                      106
 # define OSSL_STORE_R_IS_NOT_A                            112
 # define OSSL_STORE_R_LOADER_INCOMPLETE                   116
+# define OSSL_STORE_R_LOADING_STARTED                     117
 # define OSSL_STORE_R_NOT_A_CERTIFICATE                   100
 # define OSSL_STORE_R_NOT_A_CRL                           101
 # define OSSL_STORE_R_NOT_A_KEY                           102

diff --git a/util/libcrypto.num b/util/libcrypto.num
index 0049eabc06a1f2ad422926a160ad7aebef28846c..afba53cff510ed1f31a263564ede26e792d4cad1 100644 (file)
--- a/util/libcrypto.num
+++ b/util/libcrypto.num
@@ -4505,3 +4505,5 @@ RAND_DRBG_secure_new                    4446      1_1_1   EXIST::FUNCTION:
 OSSL_STORE_vctrl                        4447   1_1_1   EXIST::FUNCTION:
 X509_get0_authority_key_id              4448   1_1_0h  EXIST::FUNCTION:
 BIO_bind                                4449   1_1_1   EXIST::FUNCTION:SOCK
+OSSL_STORE_LOADER_set_expect            4450   1_1_1   EXIST::FUNCTION:
+OSSL_STORE_expect                       4451   1_1_1   EXIST::FUNCTION: