crypto/store/store_lib.c

   1 /*
   2  * Copyright 2016-2020 The OpenSSL Project Authors. All Rights Reserved.
   3  *
   4  * Licensed under the Apache License 2.0 (the "License").  You may not use
   5  * this file except in compliance with the License.  You can obtain a copy
   6  * in the file LICENSE in the source distribution or at
   7  * https://www.openssl.org/source/license.html
   8  */
   9
  10 #include <stdlib.h>
  11 #include <string.h>
  12 #include <assert.h>
  13
  14 /* We need to use some STORE deprecated APIs */
  15 #define OPENSSL_SUPPRESS_DEPRECATED
  16
  17 #include "e_os.h"
  18
  19 #include <openssl/crypto.h>
  20 #include <openssl/err.h>
  21 #include <openssl/trace.h>
  22 #include <openssl/core_names.h>
  23 #include <openssl/provider.h>
  24 #include <openssl/param_build.h>
  25 #include <openssl/store.h>
  26 #include "internal/thread_once.h"
  27 #include "internal/cryptlib.h"
  28 #include "internal/provider.h"
  29 #include "crypto/store.h"
  30 #include "store_local.h"
  31
  32 static int ossl_store_close_it(OSSL_STORE_CTX *ctx);
  33
  34 OSSL_STORE_CTX *
  35 OSSL_STORE_open_with_libctx(const char *uri,
  36                             OPENSSL_CTX *libctx, const char *propq,
  37                             const UI_METHOD *ui_method, void *ui_data,
  38                             OSSL_STORE_post_process_info_fn post_process,
  39                             void *post_process_data)
  40 {
  41     const OSSL_STORE_LOADER *loader = NULL;
  42     OSSL_STORE_LOADER *fetched_loader = NULL;
  43     OSSL_STORE_LOADER_CTX *loader_ctx = NULL;
  44     OSSL_STORE_CTX *ctx = NULL;
  45     char *propq_copy = NULL;
  46     char scheme_copy[256], *p, *schemes[2];
  47     size_t schemes_n = 0;
  48     size_t i;
  49
  50     /*
  51      * Put the file scheme first.  If the uri does represent an existing file,
  52      * possible device name and all, then it should be loaded.  Only a failed
  53      * attempt at loading a local file should have us try something else.
  54      */
  55     schemes[schemes_n++] = "file";
  56
  57     /*
  58      * Now, check if we have something that looks like a scheme, and add it
  59      * as a second scheme.  However, also check if there's an authority start
  60      * (://), because that will invalidate the previous file scheme.  Also,
  61      * check that this isn't actually the file scheme, as there's no point
  62      * going through that one twice!
  63      */
  64     OPENSSL_strlcpy(scheme_copy, uri, sizeof(scheme_copy));
  65     if ((p = strchr(scheme_copy, ':')) != NULL) {
  66         *p++ = '\0';
  67         if (strcasecmp(scheme_copy, "file") != 0) {
  68             if (strncmp(p, "//", 2) == 0)
  69                 schemes_n--;         /* Invalidate the file scheme */
  70             schemes[schemes_n++] = scheme_copy;
  71         }
  72     }
  73
  74     ERR_set_mark();
  75
  76     /*
  77      * Try each scheme until we find one that could open the URI.
  78      *
  79      * For each scheme, we look for the engine implementation first, and
  80      * failing that, we then try to fetch a provided implementation.
  81      * This is consistent with how we handle legacy / engine implementations
  82      * elsewhere.
  83      */
  84     for (i = 0; loader_ctx == NULL && i < schemes_n; i++) {
  85         OSSL_TRACE1(STORE, "Looking up scheme %s\n", schemes[i]);
  86 #ifndef OPENSSL_NO_DEPRECATED_3_0
  87         if ((loader = ossl_store_get0_loader_int(schemes[i])) != NULL) {
  88             if (loader->open_with_libctx != NULL)
  89                 loader_ctx = loader->open_with_libctx(loader, uri, libctx, propq,
  90                                                       ui_method, ui_data);
  91             else
  92                 loader_ctx = loader->open(loader, uri, ui_method, ui_data);
  93         }
  94 #endif
  95         if (loader == NULL
  96             && (fetched_loader =
  97                 OSSL_STORE_LOADER_fetch(schemes[i], libctx, propq)) != NULL) {
  98             const OSSL_PROVIDER *provider =
  99                 OSSL_STORE_LOADER_provider(fetched_loader);
 100             void *provctx = OSSL_PROVIDER_get0_provider_ctx(provider);
 101
 102             loader_ctx = fetched_loader->p_open(provctx, uri);
 103             if (loader_ctx == NULL) {
 104                 OSSL_STORE_LOADER_free(fetched_loader);
 105                 fetched_loader = NULL;
 106             } else if (propq != NULL) {
 107                 OSSL_PARAM params[] = {
 108                     OSSL_PARAM_utf8_string(OSSL_STORE_PARAM_PROPERTIES,
 109                                            NULL, 0),
 110                     OSSL_PARAM_END
 111                 };
 112
 113                 params[0].data = (void *)propq;
 114                 if (!fetched_loader->p_set_ctx_params(loader_ctx, params)) {
 115                     (void)fetched_loader->p_close(loader_ctx);
 116                     OSSL_STORE_LOADER_free(fetched_loader);
 117                     fetched_loader = NULL;
 118                 }
 119             }
 120             loader = fetched_loader;
 121         }
 122     }
 123
 124     if (loader != NULL)
 125         OSSL_TRACE1(STORE, "Found loader for scheme %s\n", schemes[i]);
 126
 127     if (loader_ctx == NULL)
 128         goto err;
 129
 130     OSSL_TRACE2(STORE, "Opened %s => %p\n", uri, (void *)loader_ctx);
 131
 132     if ((propq != NULL && (propq_copy = OPENSSL_strdup(propq)) == NULL)
 133         || (ctx = OPENSSL_zalloc(sizeof(*ctx))) == NULL) {
 134         ERR_raise(ERR_LIB_OSSL_STORE, ERR_R_MALLOC_FAILURE);
 135         goto err;
 136     }
 137
 138     if ((ui_method != NULL
 139          && !ossl_pw_set_ui_method(&ctx->pwdata, ui_method, ui_data))
 140         || !ossl_pw_enable_passphrase_caching(&ctx->pwdata)) {
 141         ERR_raise(ERR_LIB_OSSL_STORE, ERR_R_CRYPTO_LIB);
 142         goto err;
 143     }
 144     ctx->properties = propq_copy;
 145     ctx->fetched_loader = fetched_loader;
 146     ctx->loader = loader;
 147     ctx->loader_ctx = loader_ctx;
 148     ctx->post_process = post_process;
 149     ctx->post_process_data = post_process_data;
 150
 151     /*
 152      * If the attempt to open with the 'file' scheme loader failed and the
 153      * other scheme loader succeeded, the failure to open with the 'file'
 154      * scheme loader leaves an error on the error stack.  Let's remove it.
 155      */
 156     ERR_pop_to_mark();
 157
 158     return ctx;
 159
 160  err:
 161     ERR_clear_last_mark();
 162     if (loader_ctx != NULL) {
 163         /*
 164          * Temporary structure so OSSL_STORE_close() can work even when
 165          * |ctx| couldn't be allocated properly
 166          */
 167         OSSL_STORE_CTX tmpctx = { NULL, };
 168
 169         tmpctx.fetched_loader = fetched_loader;
 170         tmpctx.loader = loader;
 171         tmpctx.loader_ctx = loader_ctx;
 172
 173         /*
 174          * We ignore a returned error because we will return NULL anyway in
 175          * this case, so if something goes wrong when closing, that'll simply
 176          * just add another entry on the error stack.
 177          */
 178         (void)ossl_store_close_it(&tmpctx);
 179     }
 180     OSSL_STORE_LOADER_free(fetched_loader);
 181     OPENSSL_free(propq_copy);
 182     return NULL;
 183 }
 184
 185 OSSL_STORE_CTX *OSSL_STORE_open(const char *uri,
 186                                 const UI_METHOD *ui_method, void *ui_data,
 187                                 OSSL_STORE_post_process_info_fn post_process,
 188                                 void *post_process_data)
 189 {
 190     return OSSL_STORE_open_with_libctx(uri, NULL, NULL, ui_method, ui_data,
 191                                        post_process, post_process_data);
 192 }
 193
 194 #ifndef OPENSSL_NO_DEPRECATED_3_0
 195 int OSSL_STORE_ctrl(OSSL_STORE_CTX *ctx, int cmd, ...)
 196 {
 197     va_list args;
 198     int ret;
 199
 200     va_start(args, cmd);
 201     ret = OSSL_STORE_vctrl(ctx, cmd, args);
 202     va_end(args);
 203
 204     return ret;
 205 }
 206
 207 int OSSL_STORE_vctrl(OSSL_STORE_CTX *ctx, int cmd, va_list args)
 208 {
 209     if (ctx->fetched_loader != NULL) {
 210         if (ctx->fetched_loader->p_set_ctx_params != NULL) {
 211             OSSL_PARAM params[2] = { OSSL_PARAM_END, OSSL_PARAM_END };
 212
 213             switch (cmd) {
 214             case OSSL_STORE_C_USE_SECMEM:
 215                 {
 216                     int on = *(va_arg(args, int *));
 217
 218                     params[0] = OSSL_PARAM_construct_int("use_secmem", &on);
 219                 }
 220                 break;
 221             default:
 222                 break;
 223             }
 224
 225             return ctx->fetched_loader->p_set_ctx_params(ctx->loader_ctx,
 226                                                          params);
 227         }
 228     } else if (ctx->loader->ctrl != NULL) {
 229         return ctx->loader->ctrl(ctx->loader_ctx, cmd, args);
 230     }
 231
 232     /*
 233      * If the fetched loader doesn't have a set_ctx_params or a ctrl, it's as
 234      * if there was one that ignored our params, which usually returns 1.
 235      */
 236     return 1;
 237 }
 238 #endif
 239
 240 int OSSL_STORE_expect(OSSL_STORE_CTX *ctx, int expected_type)
 241 {
 242     int ret = 1;
 243
 244     if (ctx->loading) {
 245         ERR_raise(ERR_LIB_OSSL_STORE, OSSL_STORE_R_LOADING_STARTED);
 246         return 0;
 247     }
 248
 249     ctx->expected_type = expected_type;
 250     if (ctx->fetched_loader != NULL
 251         && ctx->fetched_loader->p_set_ctx_params != NULL) {
 252         OSSL_PARAM params[2] = { OSSL_PARAM_END, OSSL_PARAM_END };
 253
 254         params[0] =
 255             OSSL_PARAM_construct_int(OSSL_STORE_PARAM_EXPECT, &expected_type);
 256         ret = ctx->fetched_loader->p_set_ctx_params(ctx->loader_ctx, params);
 257     }
 258 #ifndef OPENSSL_NO_DEPRECATED_3_0
 259     if (ctx->fetched_loader == NULL
 260         && ctx->loader->expect != NULL) {
 261         ret = ctx->loader->expect(ctx->loader_ctx, expected_type);
 262     }
 263 #endif
 264     return ret;
 265 }
 266
 267 int OSSL_STORE_find(OSSL_STORE_CTX *ctx, const OSSL_STORE_SEARCH *search)
 268 {
 269     int ret = 1;
 270
 271     if (ctx->loading) {
 272         ERR_raise(ERR_LIB_OSSL_STORE, OSSL_STORE_R_LOADING_STARTED);
 273         return 0;
 274     }
 275
 276     if (ctx->fetched_loader != NULL) {
 277         OSSL_PARAM_BLD *bld;
 278         OSSL_PARAM *params;
 279         /* OSSL_STORE_SEARCH_BY_NAME, OSSL_STORE_SEARCH_BY_ISSUER_SERIAL*/
 280         void *name_der = NULL;
 281         int name_der_sz;
 282         /* OSSL_STORE_SEARCH_BY_ISSUER_SERIAL */
 283         BIGNUM *number = NULL;
 284
 285         if (ctx->fetched_loader->p_set_ctx_params == NULL) {
 286             ERR_raise(ERR_LIB_OSSL_STORE, OSSL_STORE_R_UNSUPPORTED_OPERATION);
 287             return 0;
 288         }
 289
 290         if ((bld = OSSL_PARAM_BLD_new()) == NULL) {
 291             ERR_raise(ERR_LIB_OSSL_STORE, ERR_R_MALLOC_FAILURE);
 292             return 0;
 293         }
 294
 295         ret = 0;                 /* Assume the worst */
 296
 297         switch (search->search_type) {
 298         case OSSL_STORE_SEARCH_BY_NAME:
 299             if ((name_der_sz = i2d_X509_NAME(search->name,
 300                                              (unsigned char **)&name_der)) > 0
 301                 && OSSL_PARAM_BLD_push_octet_string(bld,
 302                                                     OSSL_STORE_PARAM_SUBJECT,
 303                                                     name_der, name_der_sz))
 304                 ret = 1;
 305             break;
 306         case OSSL_STORE_SEARCH_BY_ISSUER_SERIAL:
 307             if ((name_der_sz = i2d_X509_NAME(search->name,
 308                                              (unsigned char **)&name_der)) > 0
 309                 && (number = ASN1_INTEGER_to_BN(search->serial, NULL)) != NULL
 310                 && OSSL_PARAM_BLD_push_octet_string(bld,
 311                                                     OSSL_STORE_PARAM_ISSUER,
 312                                                     name_der, name_der_sz)
 313                 && OSSL_PARAM_BLD_push_BN(bld, OSSL_STORE_PARAM_SERIAL,
 314                                           number))
 315                 ret = 1;
 316             break;
 317         case OSSL_STORE_SEARCH_BY_KEY_FINGERPRINT:
 318             if (OSSL_PARAM_BLD_push_utf8_string(bld, OSSL_STORE_PARAM_DIGEST,
 319                                                 EVP_MD_name(search->digest), 0)
 320                 && OSSL_PARAM_BLD_push_octet_string(bld,
 321                                                     OSSL_STORE_PARAM_FINGERPRINT,
 322                                                     search->string,
 323                                                     search->stringlength))
 324                 ret = 1;
 325             break;
 326         case OSSL_STORE_SEARCH_BY_ALIAS:
 327             if (OSSL_PARAM_BLD_push_utf8_string(bld, OSSL_STORE_PARAM_ALIAS,
 328                                                 (char *)search->string,
 329                                                 search->stringlength))
 330                 ret = 1;
 331             break;
 332         }
 333         if (ret) {
 334             params = OSSL_PARAM_BLD_to_param(bld);
 335             ret = ctx->fetched_loader->p_set_ctx_params(ctx->loader_ctx,
 336                                                         params);
 337             OSSL_PARAM_BLD_free_params(params);
 338         }
 339         OSSL_PARAM_BLD_free(bld);
 340         OPENSSL_free(name_der);
 341         BN_free(number);
 342     } else {
 343 #ifndef OPENSSL_NO_DEPRECATED_3_0
 344         /* legacy loader section */
 345         if (ctx->loader->find == NULL) {
 346             ERR_raise(ERR_LIB_OSSL_STORE, OSSL_STORE_R_UNSUPPORTED_OPERATION);
 347             return 0;
 348         }
 349         ret = ctx->loader->find(ctx->loader_ctx, search);
 350 #endif
 351     }
 352
 353     return ret;
 354 }
 355
 356 OSSL_STORE_INFO *OSSL_STORE_load(OSSL_STORE_CTX *ctx)
 357 {
 358     OSSL_STORE_INFO *v = NULL;
 359
 360     ctx->loading = 1;
 361  again:
 362     if (OSSL_STORE_eof(ctx))
 363         return NULL;
 364
 365     if (ctx->loader != NULL)
 366         OSSL_TRACE(STORE, "Loading next object\n");
 367
 368     if (ctx->cached_info != NULL
 369         && sk_OSSL_STORE_INFO_num(ctx->cached_info) == 0) {
 370         sk_OSSL_STORE_INFO_free(ctx->cached_info);
 371         ctx->cached_info = NULL;
 372     }
 373
 374     if (ctx->cached_info != NULL) {
 375         v = sk_OSSL_STORE_INFO_shift(ctx->cached_info);
 376     } else {
 377         if (ctx->fetched_loader != NULL) {
 378             struct ossl_load_result_data_st load_data;
 379
 380             load_data.v = NULL;
 381             load_data.ctx = ctx;
 382
 383             if (!ctx->fetched_loader->p_load(ctx->loader_ctx,
 384                                              ossl_store_handle_load_result,
 385                                              &load_data,
 386                                              ossl_pw_passphrase_callback_dec,
 387                                              &ctx->pwdata)) {
 388                 if (!OSSL_STORE_eof(ctx))
 389                     ctx->error_flag = 1;
 390                 return NULL;
 391             }
 392             v = load_data.v;
 393         }
 394 #ifndef OPENSSL_NO_DEPRECATED_3_0
 395         if (ctx->fetched_loader == NULL)
 396             v = ctx->loader->load(ctx->loader_ctx,
 397                                   ctx->pwdata._.ui_method.ui_method,
 398                                   ctx->pwdata._.ui_method.ui_method_data);
 399 #endif
 400     }
 401
 402     if (ctx->post_process != NULL && v != NULL) {
 403         v = ctx->post_process(v, ctx->post_process_data);
 404
 405         /*
 406          * By returning NULL, the callback decides that this object should
 407          * be ignored.
 408          */
 409         if (v == NULL)
 410             goto again;
 411     }
 412
 413     if (v != NULL && ctx->expected_type != 0) {
 414         int returned_type = OSSL_STORE_INFO_get_type(v);
 415
 416         if (returned_type != OSSL_STORE_INFO_NAME && returned_type != 0) {
 417             if (ctx->expected_type != returned_type) {
 418                 OSSL_STORE_INFO_free(v);
 419                 goto again;
 420             }
 421         }
 422     }
 423
 424     ossl_pw_clear_passphrase_cache(&ctx->pwdata);
 425     if (v != NULL)
 426         OSSL_TRACE1(STORE, "Got a %s\n",
 427                     OSSL_STORE_INFO_type_string(OSSL_STORE_INFO_get_type(v)));
 428
 429     return v;
 430 }
 431
 432 int OSSL_STORE_error(OSSL_STORE_CTX *ctx)
 433 {
 434     int ret = 1;
 435
 436     if (ctx->fetched_loader != NULL)
 437         ret = ctx->error_flag;
 438 #ifndef OPENSSL_NO_DEPRECATED_3_0
 439     if (ctx->fetched_loader == NULL)
 440         ret = ctx->loader->error(ctx->loader_ctx);
 441 #endif
 442     return ret;
 443 }
 444
 445 int OSSL_STORE_eof(OSSL_STORE_CTX *ctx)
 446 {
 447     int ret = 1;
 448
 449     if (ctx->fetched_loader != NULL)
 450         ret = ctx->loader->p_eof(ctx->loader_ctx);
 451 #ifndef OPENSSL_NO_DEPRECATED_3_0
 452     if (ctx->fetched_loader == NULL)
 453         ret = ctx->loader->eof(ctx->loader_ctx);
 454 #endif
 455     return ret;
 456 }
 457
 458 static int ossl_store_close_it(OSSL_STORE_CTX *ctx)
 459 {
 460     int ret = 0;
 461
 462     if (ctx == NULL)
 463         return 1;
 464     OSSL_TRACE1(STORE, "Closing %p\n", (void *)ctx->loader_ctx);
 465
 466     if (ctx->fetched_loader != NULL)
 467         ret = ctx->loader->p_close(ctx->loader_ctx);
 468 #ifndef OPENSSL_NO_DEPRECATED_3_0
 469     if (ctx->fetched_loader == NULL)
 470         ret = ctx->loader->close(ctx->loader_ctx);
 471 #endif
 472
 473     sk_OSSL_STORE_INFO_pop_free(ctx->cached_info, OSSL_STORE_INFO_free);
 474     OSSL_STORE_LOADER_free(ctx->fetched_loader);
 475     OPENSSL_free(ctx->properties);
 476     ossl_pw_clear_passphrase_data(&ctx->pwdata);
 477     return ret;
 478 }
 479
 480 int OSSL_STORE_close(OSSL_STORE_CTX *ctx)
 481 {
 482     int ret = ossl_store_close_it(ctx);
 483
 484     OPENSSL_free(ctx);
 485     return ret;
 486 }
 487
 488 /*
 489  * Functions to generate OSSL_STORE_INFOs, one function for each type we
 490  * support having in them as well as a generic constructor.
 491  *
 492  * In all cases, ownership of the object is transferred to the OSSL_STORE_INFO
 493  * and will therefore be freed when the OSSL_STORE_INFO is freed.
 494  */
 495 OSSL_STORE_INFO *OSSL_STORE_INFO_new(int type, void *data)
 496 {
 497     OSSL_STORE_INFO *info = OPENSSL_zalloc(sizeof(*info));
 498
 499     if (info == NULL)
 500         return NULL;
 501
 502     info->type = type;
 503     info->_.data = data;
 504     return info;
 505 }
 506
 507 OSSL_STORE_INFO *OSSL_STORE_INFO_new_NAME(char *name)
 508 {
 509     OSSL_STORE_INFO *info = OSSL_STORE_INFO_new(OSSL_STORE_INFO_NAME, NULL);
 510
 511     if (info == NULL) {
 512         ERR_raise(ERR_LIB_OSSL_STORE, ERR_R_MALLOC_FAILURE);
 513         return NULL;
 514     }
 515
 516     info->_.name.name = name;
 517     info->_.name.desc = NULL;
 518
 519     return info;
 520 }
 521
 522 int OSSL_STORE_INFO_set0_NAME_description(OSSL_STORE_INFO *info, char *desc)
 523 {
 524     if (info->type != OSSL_STORE_INFO_NAME) {
 525         ERR_raise(ERR_LIB_OSSL_STORE, ERR_R_PASSED_INVALID_ARGUMENT);
 526         return 0;
 527     }
 528
 529     info->_.name.desc = desc;
 530
 531     return 1;
 532 }
 533 OSSL_STORE_INFO *OSSL_STORE_INFO_new_PARAMS(EVP_PKEY *params)
 534 {
 535     OSSL_STORE_INFO *info = OSSL_STORE_INFO_new(OSSL_STORE_INFO_PARAMS, params);
 536
 537     if (info == NULL)
 538         ERR_raise(ERR_LIB_OSSL_STORE, ERR_R_MALLOC_FAILURE);
 539     return info;
 540 }
 541
 542 OSSL_STORE_INFO *OSSL_STORE_INFO_new_PUBKEY(EVP_PKEY *pkey)
 543 {
 544     OSSL_STORE_INFO *info = OSSL_STORE_INFO_new(OSSL_STORE_INFO_PUBKEY, pkey);
 545
 546     if (info == NULL)
 547         ERR_raise(ERR_LIB_OSSL_STORE, ERR_R_MALLOC_FAILURE);
 548     return info;
 549 }
 550
 551 OSSL_STORE_INFO *OSSL_STORE_INFO_new_PKEY(EVP_PKEY *pkey)
 552 {
 553     OSSL_STORE_INFO *info = OSSL_STORE_INFO_new(OSSL_STORE_INFO_PKEY, pkey);
 554
 555     if (info == NULL)
 556         ERR_raise(ERR_LIB_OSSL_STORE, ERR_R_MALLOC_FAILURE);
 557     return info;
 558 }
 559
 560 OSSL_STORE_INFO *OSSL_STORE_INFO_new_CERT(X509 *x509)
 561 {
 562     OSSL_STORE_INFO *info = OSSL_STORE_INFO_new(OSSL_STORE_INFO_CERT, x509);
 563
 564     if (info == NULL)
 565         ERR_raise(ERR_LIB_OSSL_STORE, ERR_R_MALLOC_FAILURE);
 566     return info;
 567 }
 568
 569 OSSL_STORE_INFO *OSSL_STORE_INFO_new_CRL(X509_CRL *crl)
 570 {
 571     OSSL_STORE_INFO *info = OSSL_STORE_INFO_new(OSSL_STORE_INFO_CRL, crl);
 572
 573     if (info == NULL)
 574         ERR_raise(ERR_LIB_OSSL_STORE, ERR_R_MALLOC_FAILURE);
 575     return info;
 576 }
 577
 578 /*
 579  * Functions to try to extract data from a OSSL_STORE_INFO.
 580  */
 581 int OSSL_STORE_INFO_get_type(const OSSL_STORE_INFO *info)
 582 {
 583     return info->type;
 584 }
 585
 586 void *OSSL_STORE_INFO_get0_data(int type, const OSSL_STORE_INFO *info)
 587 {
 588     if (info->type == type)
 589         return info->_.data;
 590     return NULL;
 591 }
 592
 593 const char *OSSL_STORE_INFO_get0_NAME(const OSSL_STORE_INFO *info)
 594 {
 595     if (info->type == OSSL_STORE_INFO_NAME)
 596         return info->_.name.name;
 597     return NULL;
 598 }
 599
 600 char *OSSL_STORE_INFO_get1_NAME(const OSSL_STORE_INFO *info)
 601 {
 602     if (info->type == OSSL_STORE_INFO_NAME) {
 603         char *ret = OPENSSL_strdup(info->_.name.name);
 604
 605         if (ret == NULL)
 606             ERR_raise(ERR_LIB_OSSL_STORE, ERR_R_MALLOC_FAILURE);
 607         return ret;
 608     }
 609     ERR_raise(ERR_LIB_OSSL_STORE, OSSL_STORE_R_NOT_A_NAME);
 610     return NULL;
 611 }
 612
 613 const char *OSSL_STORE_INFO_get0_NAME_description(const OSSL_STORE_INFO *info)
 614 {
 615     if (info->type == OSSL_STORE_INFO_NAME)
 616         return info->_.name.desc;
 617     return NULL;
 618 }
 619
 620 char *OSSL_STORE_INFO_get1_NAME_description(const OSSL_STORE_INFO *info)
 621 {
 622     if (info->type == OSSL_STORE_INFO_NAME) {
 623         char *ret = OPENSSL_strdup(info->_.name.desc
 624                                    ? info->_.name.desc : "");
 625
 626         if (ret == NULL)
 627             ERR_raise(ERR_LIB_OSSL_STORE, ERR_R_MALLOC_FAILURE);
 628         return ret;
 629     }
 630     ERR_raise(ERR_LIB_OSSL_STORE, OSSL_STORE_R_NOT_A_NAME);
 631     return NULL;
 632 }
 633
 634 EVP_PKEY *OSSL_STORE_INFO_get0_PARAMS(const OSSL_STORE_INFO *info)
 635 {
 636     if (info->type == OSSL_STORE_INFO_PARAMS)
 637         return info->_.params;
 638     return NULL;
 639 }
 640
 641 EVP_PKEY *OSSL_STORE_INFO_get1_PARAMS(const OSSL_STORE_INFO *info)
 642 {
 643     if (info->type == OSSL_STORE_INFO_PARAMS) {
 644         EVP_PKEY_up_ref(info->_.params);
 645         return info->_.params;
 646     }
 647     ERR_raise(ERR_LIB_OSSL_STORE, OSSL_STORE_R_NOT_PARAMETERS);
 648     return NULL;
 649 }
 650
 651 EVP_PKEY *OSSL_STORE_INFO_get0_PUBKEY(const OSSL_STORE_INFO *info)
 652 {
 653     if (info->type == OSSL_STORE_INFO_PUBKEY)
 654         return info->_.pubkey;
 655     return NULL;
 656 }
 657
 658 EVP_PKEY *OSSL_STORE_INFO_get1_PUBKEY(const OSSL_STORE_INFO *info)
 659 {
 660     if (info->type == OSSL_STORE_INFO_PUBKEY) {
 661         EVP_PKEY_up_ref(info->_.pubkey);
 662         return info->_.pubkey;
 663     }
 664     OSSL_STOREerr(0, OSSL_STORE_R_NOT_A_PUBLIC_KEY);
 665     return NULL;
 666 }
 667
 668 EVP_PKEY *OSSL_STORE_INFO_get0_PKEY(const OSSL_STORE_INFO *info)
 669 {
 670     if (info->type == OSSL_STORE_INFO_PKEY)
 671         return info->_.pkey;
 672     return NULL;
 673 }
 674
 675 EVP_PKEY *OSSL_STORE_INFO_get1_PKEY(const OSSL_STORE_INFO *info)
 676 {
 677     if (info->type == OSSL_STORE_INFO_PKEY) {
 678         EVP_PKEY_up_ref(info->_.pkey);
 679         return info->_.pkey;
 680     }
 681     ERR_raise(ERR_LIB_OSSL_STORE, OSSL_STORE_R_NOT_A_PRIVATE_KEY);
 682     return NULL;
 683 }
 684
 685 X509 *OSSL_STORE_INFO_get0_CERT(const OSSL_STORE_INFO *info)
 686 {
 687     if (info->type == OSSL_STORE_INFO_CERT)
 688         return info->_.x509;
 689     return NULL;
 690 }
 691
 692 X509 *OSSL_STORE_INFO_get1_CERT(const OSSL_STORE_INFO *info)
 693 {
 694     if (info->type == OSSL_STORE_INFO_CERT) {
 695         X509_up_ref(info->_.x509);
 696         return info->_.x509;
 697     }
 698     ERR_raise(ERR_LIB_OSSL_STORE, OSSL_STORE_R_NOT_A_CERTIFICATE);
 699     return NULL;
 700 }
 701
 702 X509_CRL *OSSL_STORE_INFO_get0_CRL(const OSSL_STORE_INFO *info)
 703 {
 704     if (info->type == OSSL_STORE_INFO_CRL)
 705         return info->_.crl;
 706     return NULL;
 707 }
 708
 709 X509_CRL *OSSL_STORE_INFO_get1_CRL(const OSSL_STORE_INFO *info)
 710 {
 711     if (info->type == OSSL_STORE_INFO_CRL) {
 712         X509_CRL_up_ref(info->_.crl);
 713         return info->_.crl;
 714     }
 715     ERR_raise(ERR_LIB_OSSL_STORE, OSSL_STORE_R_NOT_A_CRL);
 716     return NULL;
 717 }
 718
 719 /*
 720  * Free the OSSL_STORE_INFO
 721  */
 722 void OSSL_STORE_INFO_free(OSSL_STORE_INFO *info)
 723 {
 724     if (info != NULL) {
 725         switch (info->type) {
 726         case OSSL_STORE_INFO_NAME:
 727             OPENSSL_free(info->_.name.name);
 728             OPENSSL_free(info->_.name.desc);
 729             break;
 730         case OSSL_STORE_INFO_PARAMS:
 731             EVP_PKEY_free(info->_.params);
 732             break;
 733         case OSSL_STORE_INFO_PUBKEY:
 734             EVP_PKEY_free(info->_.pubkey);
 735             break;
 736         case OSSL_STORE_INFO_PKEY:
 737             EVP_PKEY_free(info->_.pkey);
 738             break;
 739         case OSSL_STORE_INFO_CERT:
 740             X509_free(info->_.x509);
 741             break;
 742         case OSSL_STORE_INFO_CRL:
 743             X509_CRL_free(info->_.crl);
 744             break;
 745         }
 746         OPENSSL_free(info);
 747     }
 748 }
 749
 750 int OSSL_STORE_supports_search(OSSL_STORE_CTX *ctx, int search_type)
 751 {
 752     int ret = 0;
 753
 754     if (ctx->fetched_loader != NULL) {
 755         void *provctx =
 756             ossl_provider_ctx(OSSL_STORE_LOADER_provider(ctx->fetched_loader));
 757         const OSSL_PARAM *params;
 758         const OSSL_PARAM *p_subject = NULL;
 759         const OSSL_PARAM *p_issuer = NULL;
 760         const OSSL_PARAM *p_serial = NULL;
 761         const OSSL_PARAM *p_fingerprint = NULL;
 762         const OSSL_PARAM *p_alias = NULL;
 763
 764         if (ctx->fetched_loader->p_settable_ctx_params == NULL)
 765             return 0;
 766
 767         params = ctx->fetched_loader->p_settable_ctx_params(provctx);
 768         p_subject = OSSL_PARAM_locate_const(params, OSSL_STORE_PARAM_SUBJECT);
 769         p_issuer = OSSL_PARAM_locate_const(params, OSSL_STORE_PARAM_ISSUER);
 770         p_serial = OSSL_PARAM_locate_const(params, OSSL_STORE_PARAM_SERIAL);
 771         p_fingerprint =
 772             OSSL_PARAM_locate_const(params, OSSL_STORE_PARAM_FINGERPRINT);
 773         p_alias = OSSL_PARAM_locate_const(params, OSSL_STORE_PARAM_ALIAS);
 774
 775         switch (search_type) {
 776         case OSSL_STORE_SEARCH_BY_NAME:
 777             ret = (p_subject != NULL);
 778             break;
 779         case OSSL_STORE_SEARCH_BY_ISSUER_SERIAL:
 780             ret = (p_issuer != NULL && p_serial != NULL);
 781             break;
 782         case OSSL_STORE_SEARCH_BY_KEY_FINGERPRINT:
 783             ret = (p_fingerprint != NULL);
 784             break;
 785         case OSSL_STORE_SEARCH_BY_ALIAS:
 786             ret = (p_alias != NULL);
 787             break;
 788         }
 789     }
 790 #ifndef OPENSSL_NO_DEPRECATED_3_0
 791     if (ctx->fetched_loader == NULL) {
 792         OSSL_STORE_SEARCH tmp_search;
 793
 794         if (ctx->loader->find == NULL)
 795             return 0;
 796         tmp_search.search_type = search_type;
 797         ret = ctx->loader->find(NULL, &tmp_search);
 798     }
 799 #endif
 800     return ret;
 801 }
 802
 803 /* Search term constructors */
 804 OSSL_STORE_SEARCH *OSSL_STORE_SEARCH_by_name(X509_NAME *name)
 805 {
 806     OSSL_STORE_SEARCH *search = OPENSSL_zalloc(sizeof(*search));
 807
 808     if (search == NULL) {
 809         ERR_raise(ERR_LIB_OSSL_STORE, ERR_R_MALLOC_FAILURE);
 810         return NULL;
 811     }
 812
 813     search->search_type = OSSL_STORE_SEARCH_BY_NAME;
 814     search->name = name;
 815     return search;
 816 }
 817
 818 OSSL_STORE_SEARCH *OSSL_STORE_SEARCH_by_issuer_serial(X509_NAME *name,
 819                                                       const ASN1_INTEGER *serial)
 820 {
 821     OSSL_STORE_SEARCH *search = OPENSSL_zalloc(sizeof(*search));
 822
 823     if (search == NULL) {
 824         ERR_raise(ERR_LIB_OSSL_STORE, ERR_R_MALLOC_FAILURE);
 825         return NULL;
 826     }
 827
 828     search->search_type = OSSL_STORE_SEARCH_BY_ISSUER_SERIAL;
 829     search->name = name;
 830     search->serial = serial;
 831     return search;
 832 }
 833
 834 OSSL_STORE_SEARCH *OSSL_STORE_SEARCH_by_key_fingerprint(const EVP_MD *digest,
 835                                                         const unsigned char
 836                                                         *bytes, size_t len)
 837 {
 838     OSSL_STORE_SEARCH *search = OPENSSL_zalloc(sizeof(*search));
 839
 840     if (search == NULL) {
 841         ERR_raise(ERR_LIB_OSSL_STORE, ERR_R_MALLOC_FAILURE);
 842         return NULL;
 843     }
 844
 845     if (digest != NULL && len != (size_t)EVP_MD_size(digest)) {
 846         ERR_raise_data(ERR_LIB_OSSL_STORE,
 847                        OSSL_STORE_R_FINGERPRINT_SIZE_DOES_NOT_MATCH_DIGEST,
 848                        "%s size is %d, fingerprint size is %zu",
 849                        EVP_MD_name(digest), EVP_MD_size(digest), len);
 850         return NULL;
 851     }
 852
 853     search->search_type = OSSL_STORE_SEARCH_BY_KEY_FINGERPRINT;
 854     search->digest = digest;
 855     search->string = bytes;
 856     search->stringlength = len;
 857     return search;
 858 }
 859
 860 OSSL_STORE_SEARCH *OSSL_STORE_SEARCH_by_alias(const char *alias)
 861 {
 862     OSSL_STORE_SEARCH *search = OPENSSL_zalloc(sizeof(*search));
 863
 864     if (search == NULL) {
 865         ERR_raise(ERR_LIB_OSSL_STORE, ERR_R_MALLOC_FAILURE);
 866         return NULL;
 867     }
 868
 869     search->search_type = OSSL_STORE_SEARCH_BY_ALIAS;
 870     search->string = (const unsigned char *)alias;
 871     search->stringlength = strlen(alias);
 872     return search;
 873 }
 874
 875 /* Search term destructor */
 876 void OSSL_STORE_SEARCH_free(OSSL_STORE_SEARCH *search)
 877 {
 878     OPENSSL_free(search);
 879 }
 880
 881 /* Search term accessors */
 882 int OSSL_STORE_SEARCH_get_type(const OSSL_STORE_SEARCH *criterion)
 883 {
 884     return criterion->search_type;
 885 }
 886
 887 X509_NAME *OSSL_STORE_SEARCH_get0_name(const OSSL_STORE_SEARCH *criterion)
 888 {
 889     return criterion->name;
 890 }
 891
 892 const ASN1_INTEGER *OSSL_STORE_SEARCH_get0_serial(const OSSL_STORE_SEARCH
 893                                                   *criterion)
 894 {
 895     return criterion->serial;
 896 }
 897
 898 const unsigned char *OSSL_STORE_SEARCH_get0_bytes(const OSSL_STORE_SEARCH
 899                                                   *criterion, size_t *length)
 900 {
 901     *length = criterion->stringlength;
 902     return criterion->string;
 903 }
 904
 905 const char *OSSL_STORE_SEARCH_get0_string(const OSSL_STORE_SEARCH *criterion)
 906 {
 907     return (const char *)criterion->string;
 908 }
 909
 910 const EVP_MD *OSSL_STORE_SEARCH_get0_digest(const OSSL_STORE_SEARCH *criterion)
 911 {
 912     return criterion->digest;
 913 }
 914
 915 OSSL_STORE_CTX *OSSL_STORE_attach(BIO *bp, const char *scheme,
 916                                   OPENSSL_CTX *libctx, const char *propq,
 917                                   const UI_METHOD *ui_method, void *ui_data,
 918                                   OSSL_STORE_post_process_info_fn post_process,
 919                                   void *post_process_data)
 920 {
 921     const OSSL_STORE_LOADER *loader = NULL;
 922     OSSL_STORE_LOADER *fetched_loader = NULL;
 923     OSSL_STORE_LOADER_CTX *loader_ctx = NULL;
 924     OSSL_STORE_CTX *ctx = NULL;
 925
 926     if (scheme == NULL)
 927         scheme = "file";
 928
 929     OSSL_TRACE1(STORE, "Looking up scheme %s\n", scheme);
 930 #ifndef OPENSSL_NO_DEPRECATED_3_0
 931     if ((loader = ossl_store_get0_loader_int(scheme)) != NULL)
 932         loader_ctx = loader->attach(loader, bp, libctx, propq,
 933                                     ui_method, ui_data);
 934 #endif
 935     if (loader == NULL
 936         && (fetched_loader =
 937             OSSL_STORE_LOADER_fetch(scheme, libctx, propq)) != NULL) {
 938         const OSSL_PROVIDER *provider =
 939             OSSL_STORE_LOADER_provider(fetched_loader);
 940         void *provctx = OSSL_PROVIDER_get0_provider_ctx(provider);
 941
 942         if ((loader_ctx =
 943              fetched_loader->p_attach(provctx, (OSSL_CORE_BIO *)bp)) == NULL) {
 944             OSSL_STORE_LOADER_free(fetched_loader);
 945             fetched_loader = NULL;
 946         } else if (propq != NULL) {
 947             OSSL_PARAM params[] = {
 948                 OSSL_PARAM_utf8_string(OSSL_STORE_PARAM_PROPERTIES,
 949                                        NULL, 0),
 950                 OSSL_PARAM_END
 951             };
 952
 953             params[0].data = (void *)propq;
 954             if (!fetched_loader->p_set_ctx_params(loader_ctx, params)) {
 955                 (void)fetched_loader->p_close(loader_ctx);
 956                 OSSL_STORE_LOADER_free(fetched_loader);
 957                 fetched_loader = NULL;
 958             }
 959         }
 960         loader = fetched_loader;
 961     }
 962
 963     if (loader_ctx == NULL)
 964         return NULL;
 965
 966     if ((ctx = OPENSSL_zalloc(sizeof(*ctx))) == NULL) {
 967         ERR_raise(ERR_LIB_OSSL_STORE, ERR_R_MALLOC_FAILURE);
 968         return NULL;
 969     }
 970
 971     (void)ossl_pw_set_ui_method(&ctx->pwdata, ui_method, ui_data);
 972     ctx->fetched_loader = fetched_loader;
 973     ctx->loader = loader;
 974     ctx->loader_ctx = loader_ctx;
 975     ctx->post_process = post_process;
 976     ctx->post_process_data = post_process_data;
 977
 978     return ctx;
 979 }