X-Git-Url: https://git.openssl.org/gitweb/?a=blobdiff_plain;f=crypto%2Fprovider_core.c;h=b100e5a15d542b9fa568ad9bb005a9126e26beb2;hb=2b5e12f5096e1fba7dd91a682f4c34759469c34b;hp=a821d17e46afedc8505dcb7147a4f342a2dee306;hpb=5c5cdcd8157c0ce0fdf3793217883c435cdf57bb;p=openssl.git diff --git a/crypto/provider_core.c b/crypto/provider_core.c index a821d17e46..b100e5a15d 100644 --- a/crypto/provider_core.c +++ b/crypto/provider_core.c @@ -1,5 +1,5 @@ /* - * Copyright 2019 The OpenSSL Project Authors. All Rights Reserved. + * Copyright 2019-2020 The OpenSSL Project Authors. All Rights Reserved. * * Licensed under the Apache License 2.0 (the "License"). You may not use * this file except in compliance with the License. You can obtain a copy @@ -9,14 +9,19 @@ #include #include +#include +#include #include #include -#include "internal/cryptlib_int.h" +#include "crypto/cryptlib.h" #include "internal/nelem.h" #include "internal/thread_once.h" #include "internal/provider.h" #include "internal/refcount.h" #include "provider_local.h" +#ifndef FIPS_MODULE +# include +#endif static OSSL_PROVIDER *provider_new(const char *name, OSSL_provider_init_fn *init_function); @@ -49,7 +54,7 @@ struct ossl_provider_st { STACK_OF(INFOPAIR) *parameters; OPENSSL_CTX *libctx; /* The library context this instance is in */ struct provider_store_st *store; /* The store this instance belongs to */ -#ifndef FIPS_MODE +#ifndef FIPS_MODULE /* * In the FIPS module inner provider, this isn't needed, since the * error upcalls are always direct calls to the outer provider. @@ -62,7 +67,7 @@ struct ossl_provider_st { /* Provider side functions */ OSSL_provider_teardown_fn *teardown; - OSSL_provider_get_param_types_fn *get_param_types; + OSSL_provider_gettable_params_fn *gettable_params; OSSL_provider_get_params_fn *get_params; OSSL_provider_query_operation_fn *query_operation; @@ -88,6 +93,7 @@ static int ossl_provider_cmp(const OSSL_PROVIDER * const *a, struct provider_store_st { STACK_OF(OSSL_PROVIDER) *providers; CRYPTO_RWLOCK *lock; + char *default_path; unsigned int use_fallbacks:1; }; @@ -97,6 +103,7 @@ static void provider_store_free(void *vstore) if (store == NULL) return; + OPENSSL_free(store->default_path); sk_OSSL_PROVIDER_pop_free(store->providers, ossl_provider_free); CRYPTO_THREAD_lock_free(store->lock); OPENSSL_free(store); @@ -133,7 +140,7 @@ static void *provider_store_new(OPENSSL_CTX *ctx) } prov->libctx = ctx; prov->store = store; -#ifndef FIPS_MODE +#ifndef FIPS_MODULE prov->error_lib = ERR_get_next_error_library(); #endif if(p->is_fallback) @@ -169,7 +176,7 @@ OSSL_PROVIDER *ossl_provider_find(OPENSSL_CTX *libctx, const char *name, OSSL_PROVIDER tmpl = { 0, }; int i; -#ifndef FIPS_MODE +#ifndef FIPS_MODULE /* * Make sure any providers are loaded from config before we try to find * them. @@ -257,7 +264,7 @@ OSSL_PROVIDER *ossl_provider_new(OPENSSL_CTX *libctx, const char *name, } else { prov->libctx = libctx; prov->store = store; -#ifndef FIPS_MODE +#ifndef FIPS_MODULE prov->error_lib = ERR_get_next_error_library(); #endif } @@ -296,13 +303,13 @@ void ossl_provider_free(OSSL_PROVIDER *prov) * When that happens, the provider is inactivated. */ if (ref < 2 && prov->flag_initialized) { -#ifndef FIPS_MODE +#ifndef FIPS_MODULE ossl_init_thread_deregister(prov); #endif if (prov->teardown != NULL) prov->teardown(prov->provctx); #ifndef OPENSSL_NO_ERR -# ifndef FIPS_MODE +# ifndef FIPS_MODULE if (prov->error_strings != NULL) { ERR_unload_strings(prov->error_lib, prov->error_strings); OPENSSL_free(prov->error_strings); @@ -318,7 +325,7 @@ void ossl_provider_free(OSSL_PROVIDER *prov) * the store. All we have to do here is clean it out. */ if (ref == 0) { -#ifndef FIPS_MODE +#ifndef FIPS_MODULE DSO_free(prov->module); #endif OPENSSL_free(prov->name); @@ -380,6 +387,29 @@ int ossl_provider_add_parameter(OSSL_PROVIDER *prov, */ static const OSSL_DISPATCH *core_dispatch; /* Define further down */ +int OSSL_PROVIDER_set_default_search_path(OPENSSL_CTX *libctx, const char *path) +{ + struct provider_store_st *store; + char *p = NULL; + + if (path != NULL) { + p = OPENSSL_strdup(path); + if (p == NULL) { + CRYPTOerr(0, ERR_R_MALLOC_FAILURE); + return 0; + } + } + if ((store = get_provider_store(libctx)) != NULL + && CRYPTO_THREAD_write_lock(store->lock)) { + OPENSSL_free(store->default_path); + store->default_path = p; + CRYPTO_THREAD_unlock(store->lock); + return 1; + } + OPENSSL_free(p); + return 0; +} + /* * Internal version that doesn't affect the store flags, and thereby avoid * locking. Direct callers must remember to set the store flags when @@ -389,7 +419,7 @@ static int provider_activate(OSSL_PROVIDER *prov) { const OSSL_DISPATCH *provider_dispatch = NULL; #ifndef OPENSSL_NO_ERR -# ifndef FIPS_MODE +# ifndef FIPS_MODULE OSSL_provider_get_reason_strings_fn *p_get_reason_strings = NULL; # endif #endif @@ -402,22 +432,31 @@ static int provider_activate(OSSL_PROVIDER *prov) * a loadable module. */ if (prov->init_function == NULL) { -#ifdef FIPS_MODE +#ifdef FIPS_MODULE return 0; #else if (prov->module == NULL) { char *allocated_path = NULL; const char *module_path = NULL; char *merged_path = NULL; - const char *load_dir = ossl_safe_getenv("OPENSSL_MODULES"); + const char *load_dir = NULL; + struct provider_store_st *store; if ((prov->module = DSO_new()) == NULL) { /* DSO_new() generates an error already */ return 0; } - if (load_dir == NULL) - load_dir = MODULESDIR; + if ((store = get_provider_store(prov->libctx)) == NULL + || !CRYPTO_THREAD_read_lock(store->lock)) + return 0; + load_dir = store->default_path; + + if (load_dir == NULL) { + load_dir = ossl_safe_getenv("OPENSSL_MODULES"); + if (load_dir == NULL) + load_dir = MODULESDIR; + } DSO_ctrl(prov->module, DSO_CTRL_SET_FLAGS, DSO_FLAG_NAME_TRANSLATION_EXT_ONLY, NULL); @@ -428,6 +467,7 @@ static int provider_activate(OSSL_PROVIDER *prov) DSO_convert_filename(prov->module, prov->name); if (module_path != NULL) merged_path = DSO_merge(prov->module, module_path, load_dir); + CRYPTO_THREAD_unlock(store->lock); if (merged_path == NULL || (DSO_load(prov->module, merged_path, NULL, 0)) == NULL) { @@ -451,7 +491,7 @@ static int provider_activate(OSSL_PROVIDER *prov) &prov->provctx)) { ERR_raise_data(ERR_LIB_CRYPTO, ERR_R_INIT_FAIL, NULL, "name=%s", prov->name); -#ifndef FIPS_MODE +#ifndef FIPS_MODULE DSO_free(prov->module); prov->module = NULL; #endif @@ -464,9 +504,9 @@ static int provider_activate(OSSL_PROVIDER *prov) prov->teardown = OSSL_get_provider_teardown(provider_dispatch); break; - case OSSL_FUNC_PROVIDER_GET_PARAM_TYPES: - prov->get_param_types = - OSSL_get_provider_get_param_types(provider_dispatch); + case OSSL_FUNC_PROVIDER_GETTABLE_PARAMS: + prov->gettable_params = + OSSL_get_provider_gettable_params(provider_dispatch); break; case OSSL_FUNC_PROVIDER_GET_PARAMS: prov->get_params = @@ -477,7 +517,7 @@ static int provider_activate(OSSL_PROVIDER *prov) OSSL_get_provider_query_operation(provider_dispatch); break; #ifndef OPENSSL_NO_ERR -# ifndef FIPS_MODE +# ifndef FIPS_MODULE case OSSL_FUNC_PROVIDER_GET_REASON_STRINGS: p_get_reason_strings = OSSL_get_provider_get_reason_strings(provider_dispatch); @@ -488,7 +528,7 @@ static int provider_activate(OSSL_PROVIDER *prov) } #ifndef OPENSSL_NO_ERR -# ifndef FIPS_MODE +# ifndef FIPS_MODULE if (p_get_reason_strings != NULL) { const OSSL_ITEM *reasonstrings = p_get_reason_strings(prov->provctx); size_t cnt, cnt2; @@ -500,12 +540,13 @@ static int provider_activate(OSSL_PROVIDER *prov) * with the error library number, so we need to make a copy of that * array either way. */ - cnt = 1; /* One for the terminating item */ + cnt = 0; while (reasonstrings[cnt].id != 0) { if (ERR_GET_LIB(reasonstrings[cnt].id) != 0) return 0; cnt++; } + cnt++; /* One for the terminating item */ /* Allocate one extra item for the "library" name */ prov->error_strings = @@ -630,7 +671,7 @@ int ossl_provider_forall_loaded(OPENSSL_CTX *ctx, int ret = 1; struct provider_store_st *store = get_provider_store(ctx); -#ifndef FIPS_MODE +#ifndef FIPS_MODULE /* * Make sure any providers are loaded from config before we try to use * them. @@ -689,7 +730,7 @@ const DSO *ossl_provider_dso(const OSSL_PROVIDER *prov) const char *ossl_provider_module_name(const OSSL_PROVIDER *prov) { -#ifdef FIPS_MODE +#ifdef FIPS_MODULE return NULL; #else return DSO_get_filename(prov->module); @@ -698,7 +739,7 @@ const char *ossl_provider_module_name(const OSSL_PROVIDER *prov) const char *ossl_provider_module_path(const OSSL_PROVIDER *prov) { -#ifdef FIPS_MODE +#ifdef FIPS_MODULE return NULL; #else /* FIXME: Ensure it's a full path */ @@ -706,6 +747,12 @@ const char *ossl_provider_module_path(const OSSL_PROVIDER *prov) #endif } +OPENSSL_CTX *ossl_provider_library_context(const OSSL_PROVIDER *prov) +{ + /* TODO(3.0) just: return prov->libctx; */ + return prov != NULL ? prov->libctx : NULL; +} + /* Wrappers around calls to the provider */ void ossl_provider_teardown(const OSSL_PROVIDER *prov) { @@ -713,10 +760,10 @@ void ossl_provider_teardown(const OSSL_PROVIDER *prov) prov->teardown(prov->provctx); } -const OSSL_PARAM *ossl_provider_get_param_types(const OSSL_PROVIDER *prov) +const OSSL_PARAM *ossl_provider_gettable_params(const OSSL_PROVIDER *prov) { - return prov->get_param_types == NULL - ? NULL : prov->get_param_types(prov->provctx); + return prov->gettable_params == NULL + ? NULL : prov->gettable_params(prov->provctx); } int ossl_provider_get_params(const OSSL_PROVIDER *prov, OSSL_PARAM params[]) @@ -746,7 +793,7 @@ const OSSL_ALGORITHM *ossl_provider_query_operation(const OSSL_PROVIDER *prov, * never knows. */ static const OSSL_PARAM param_types[] = { - OSSL_PARAM_DEFN("openssl-verstion", OSSL_PARAM_UTF8_PTR, NULL, 0), + OSSL_PARAM_DEFN("openssl-version", OSSL_PARAM_UTF8_PTR, NULL, 0), OSSL_PARAM_DEFN("provider-name", OSSL_PARAM_UTF8_PTR, NULL, 0), OSSL_PARAM_END }; @@ -756,17 +803,20 @@ static const OSSL_PARAM param_types[] = { * This ensures that the compiler will complain if they aren't defined * with the correct signature. */ -static OSSL_core_get_param_types_fn core_get_param_types; +static OSSL_core_gettable_params_fn core_gettable_params; static OSSL_core_get_params_fn core_get_params; static OSSL_core_thread_start_fn core_thread_start; static OSSL_core_get_library_context_fn core_get_libctx; -#ifndef FIPS_MODE +#ifndef FIPS_MODULE static OSSL_core_new_error_fn core_new_error; static OSSL_core_set_error_debug_fn core_set_error_debug; static OSSL_core_vset_error_fn core_vset_error; +static OSSL_core_set_error_mark_fn core_set_error_mark; +static OSSL_core_clear_last_error_mark_fn core_clear_last_error_mark; +static OSSL_core_pop_error_to_mark_fn core_pop_error_to_mark; #endif -static const OSSL_PARAM *core_get_param_types(const OSSL_PROVIDER *prov) +static const OSSL_PARAM *core_gettable_params(const OSSL_PROVIDER *prov) { return param_types; } @@ -776,16 +826,16 @@ static int core_get_params(const OSSL_PROVIDER *prov, OSSL_PARAM params[]) int i; OSSL_PARAM *p; -#ifndef FIPS_MODE - /* Load config before we attempt to read any provider parameters */ - OPENSSL_init_crypto(OPENSSL_INIT_LOAD_CONFIG, NULL); -#endif - if ((p = OSSL_PARAM_locate(params, "openssl-version")) != NULL) OSSL_PARAM_set_utf8_ptr(p, OPENSSL_VERSION_STR); if ((p = OSSL_PARAM_locate(params, "provider-name")) != NULL) OSSL_PARAM_set_utf8_ptr(p, prov->name); +#ifndef FIPS_MODULE + if ((p = OSSL_PARAM_locate(params, OSSL_PROV_PARAM_MODULE_FILENAME)) != NULL) + OSSL_PARAM_set_utf8_ptr(p, ossl_provider_module_path(prov)); +#endif + if (prov->parameters == NULL) return 1; @@ -795,13 +845,12 @@ static int core_get_params(const OSSL_PROVIDER *prov, OSSL_PARAM params[]) if ((p = OSSL_PARAM_locate(params, pair->name)) != NULL) OSSL_PARAM_set_utf8_ptr(p, pair->value); } - return 1; } static OPENSSL_CTX *core_get_libctx(const OSSL_PROVIDER *prov) { - return prov->libctx; + return ossl_provider_library_context(prov); } static int core_thread_start(const OSSL_PROVIDER *prov, @@ -815,7 +864,7 @@ static int core_thread_start(const OSSL_PROVIDER *prov, * needed there, since the FIPS module upcalls are always the outer provider * ones. */ -#ifndef FIPS_MODE +#ifndef FIPS_MODULE /* * TODO(3.0) These error functions should use |prov| to select the proper * library context to report in the correct error stack, at least if error @@ -848,23 +897,48 @@ static void core_vset_error(const OSSL_PROVIDER *prov, ERR_vset_error(prov->error_lib, (int)reason, fmt, args); } } -#endif + +static int core_set_error_mark(const OSSL_PROVIDER *prov) +{ + return ERR_set_mark(); +} + +static int core_clear_last_error_mark(const OSSL_PROVIDER *prov) +{ + return ERR_clear_last_mark(); +} + +static int core_pop_error_to_mark(const OSSL_PROVIDER *prov) +{ + return ERR_pop_to_mark(); +} +#endif /* FIPS_MODULE */ /* * Functions provided by the core. Blank line separates "families" of related * functions. */ static const OSSL_DISPATCH core_dispatch_[] = { - { OSSL_FUNC_CORE_GET_PARAM_TYPES, (void (*)(void))core_get_param_types }, + { OSSL_FUNC_CORE_GETTABLE_PARAMS, (void (*)(void))core_gettable_params }, { OSSL_FUNC_CORE_GET_PARAMS, (void (*)(void))core_get_params }, { OSSL_FUNC_CORE_GET_LIBRARY_CONTEXT, (void (*)(void))core_get_libctx }, { OSSL_FUNC_CORE_THREAD_START, (void (*)(void))core_thread_start }, -#ifndef FIPS_MODE +#ifndef FIPS_MODULE { OSSL_FUNC_CORE_NEW_ERROR, (void (*)(void))core_new_error }, { OSSL_FUNC_CORE_SET_ERROR_DEBUG, (void (*)(void))core_set_error_debug }, { OSSL_FUNC_CORE_VSET_ERROR, (void (*)(void))core_vset_error }, + { OSSL_FUNC_CORE_SET_ERROR_MARK, (void (*)(void))core_set_error_mark }, + { OSSL_FUNC_CORE_CLEAR_LAST_ERROR_MARK, + (void (*)(void))core_clear_last_error_mark }, + { OSSL_FUNC_CORE_POP_ERROR_TO_MARK, (void (*)(void))core_pop_error_to_mark }, + { OSSL_FUNC_BIO_NEW_FILE, (void (*)(void))BIO_new_file }, + { OSSL_FUNC_BIO_NEW_MEMBUF, (void (*)(void))BIO_new_mem_buf }, + { OSSL_FUNC_BIO_READ_EX, (void (*)(void))BIO_read_ex }, + { OSSL_FUNC_BIO_FREE, (void (*)(void))BIO_free }, + { OSSL_FUNC_BIO_VPRINTF, (void (*)(void))BIO_vprintf }, + { OSSL_FUNC_BIO_VSNPRINTF, (void (*)(void))BIO_vsnprintf }, + { OSSL_FUNC_SELF_TEST_CB, (void (*)(void))OSSL_SELF_TEST_get_callback }, #endif - { OSSL_FUNC_CRYPTO_MALLOC, (void (*)(void))CRYPTO_malloc }, { OSSL_FUNC_CRYPTO_ZALLOC, (void (*)(void))CRYPTO_zalloc }, { OSSL_FUNC_CRYPTO_FREE, (void (*)(void))CRYPTO_free },