crypto/store/store_lib.c

   1 /*
   2  * Copyright 2016-2020 The OpenSSL Project Authors. All Rights Reserved.
   3  *
   4  * Licensed under the Apache License 2.0 (the "License").  You may not use
   5  * this file except in compliance with the License.  You can obtain a copy
   6  * in the file LICENSE in the source distribution or at
   7  * https://www.openssl.org/source/license.html
   8  */
   9
  10 #include <stdlib.h>
  11 #include <string.h>
  12 #include <assert.h>
  13
  14 /* We need to use some STORE deprecated APIs */
  15 #define OPENSSL_SUPPRESS_DEPRECATED
  16
  17 #include "e_os.h"
  18
  19 #include <openssl/crypto.h>
  20 #include <openssl/err.h>
  21 #include <openssl/trace.h>
  22 #include <openssl/core_names.h>
  23 #include <openssl/provider.h>
  24 #include <openssl/param_build.h>
  25 #include <openssl/store.h>
  26 #include "internal/thread_once.h"
  27 #include "internal/cryptlib.h"
  28 #include "internal/provider.h"
  29 #include "crypto/store.h"
  30 #include "store_local.h"
  31
  32 static int ossl_store_close_it(OSSL_STORE_CTX *ctx);
  33
  34 OSSL_STORE_CTX *
  35 OSSL_STORE_open_with_libctx(const char *uri,
  36                             OPENSSL_CTX *libctx, const char *propq,
  37                             const UI_METHOD *ui_method, void *ui_data,
  38                             OSSL_STORE_post_process_info_fn post_process,
  39                             void *post_process_data)
  40 {
  41     const OSSL_STORE_LOADER *loader = NULL;
  42     OSSL_STORE_LOADER *fetched_loader = NULL;
  43     OSSL_STORE_LOADER_CTX *loader_ctx = NULL;
  44     OSSL_STORE_CTX *ctx = NULL;
  45     char *propq_copy = NULL;
  46     char scheme_copy[256], *p, *schemes[2];
  47     size_t schemes_n = 0;
  48     size_t i;
  49
  50     /*
  51      * Put the file scheme first.  If the uri does represent an existing file,
  52      * possible device name and all, then it should be loaded.  Only a failed
  53      * attempt at loading a local file should have us try something else.
  54      */
  55     schemes[schemes_n++] = "file";
  56
  57     /*
  58      * Now, check if we have something that looks like a scheme, and add it
  59      * as a second scheme.  However, also check if there's an authority start
  60      * (://), because that will invalidate the previous file scheme.  Also,
  61      * check that this isn't actually the file scheme, as there's no point
  62      * going through that one twice!
  63      */
  64     OPENSSL_strlcpy(scheme_copy, uri, sizeof(scheme_copy));
  65     if ((p = strchr(scheme_copy, ':')) != NULL) {
  66         *p++ = '\0';
  67         if (strcasecmp(scheme_copy, "file") != 0) {
  68             if (strncmp(p, "//", 2) == 0)
  69                 schemes_n--;         /* Invalidate the file scheme */
  70             schemes[schemes_n++] = scheme_copy;
  71         }
  72     }
  73
  74     ERR_set_mark();
  75
  76     /*
  77      * Try each scheme until we find one that could open the URI.
  78      *
  79      * For each scheme, we look for the engine implementation first, and
  80      * failing that, we then try to fetch a provided implementation.
  81      * This is consistent with how we handle legacy / engine implementations
  82      * elsewhere.
  83      */
  84     for (i = 0; loader_ctx == NULL && i < schemes_n; i++) {
  85         OSSL_TRACE1(STORE, "Looking up scheme %s\n", schemes[i]);
  86 #ifndef OPENSSL_NO_DEPRECATED_3_0
  87         if ((loader = ossl_store_get0_loader_int(schemes[i])) != NULL) {
  88             if (loader->open_with_libctx != NULL)
  89                 loader_ctx = loader->open_with_libctx(loader, uri, libctx, propq,
  90                                                       ui_method, ui_data);
  91             else
  92                 loader_ctx = loader->open(loader, uri, ui_method, ui_data);
  93         }
  94 #endif
  95         if (loader == NULL
  96             && (fetched_loader =
  97                 OSSL_STORE_LOADER_fetch(schemes[i], libctx, propq)) != NULL) {
  98             const OSSL_PROVIDER *provider =
  99                 OSSL_STORE_LOADER_provider(fetched_loader);
 100             void *provctx = OSSL_PROVIDER_get0_provider_ctx(provider);
 101
 102             loader_ctx = fetched_loader->p_open(provctx, uri);
 103             if (loader_ctx == NULL) {
 104                 OSSL_STORE_LOADER_free(fetched_loader);
 105                 fetched_loader = NULL;
 106             } else if (propq != NULL) {
 107                 OSSL_PARAM params[] = {
 108                     OSSL_PARAM_utf8_string(OSSL_STORE_PARAM_PROPERTIES,
 109                                            NULL, 0),
 110                     OSSL_PARAM_END
 111                 };
 112
 113                 params[0].data = (void *)propq;
 114                 if (!fetched_loader->p_set_ctx_params(loader_ctx, params)) {
 115                     (void)fetched_loader->p_close(loader_ctx);
 116                     OSSL_STORE_LOADER_free(fetched_loader);
 117                     fetched_loader = NULL;
 118                 }
 119             }
 120             loader = fetched_loader;
 121         }
 122     }
 123
 124     if (loader != NULL)
 125         OSSL_TRACE1(STORE, "Found loader for scheme %s\n", schemes[i]);
 126
 127     if (loader_ctx == NULL)
 128         goto err;
 129
 130     OSSL_TRACE2(STORE, "Opened %s => %p\n", uri, (void *)loader_ctx);
 131
 132     if ((propq != NULL && (propq_copy = OPENSSL_strdup(propq)) == NULL)
 133         || (ctx = OPENSSL_zalloc(sizeof(*ctx))) == NULL) {
 134         ERR_raise(ERR_LIB_OSSL_STORE, ERR_R_MALLOC_FAILURE);
 135         goto err;
 136     }
 137
 138     if (ui_method != NULL
 139         && !ossl_pw_set_ui_method(&ctx->pwdata, ui_method, ui_data)) {
 140         ERR_raise(ERR_LIB_OSSL_STORE, ERR_R_CRYPTO_LIB);
 141         goto err;
 142     }
 143     ctx->properties = propq_copy;
 144     ctx->fetched_loader = fetched_loader;
 145     ctx->loader = loader;
 146     ctx->loader_ctx = loader_ctx;
 147     ctx->post_process = post_process;
 148     ctx->post_process_data = post_process_data;
 149
 150     /*
 151      * If the attempt to open with the 'file' scheme loader failed and the
 152      * other scheme loader succeeded, the failure to open with the 'file'
 153      * scheme loader leaves an error on the error stack.  Let's remove it.
 154      */
 155     ERR_pop_to_mark();
 156
 157     return ctx;
 158
 159  err:
 160     ERR_clear_last_mark();
 161     if (loader_ctx != NULL) {
 162         /*
 163          * Temporary structure so OSSL_STORE_close() can work even when
 164          * |ctx| couldn't be allocated properly
 165          */
 166         OSSL_STORE_CTX tmpctx = { NULL, };
 167
 168         tmpctx.fetched_loader = fetched_loader;
 169         tmpctx.loader = loader;
 170         tmpctx.loader_ctx = loader_ctx;
 171
 172         /*
 173          * We ignore a returned error because we will return NULL anyway in
 174          * this case, so if something goes wrong when closing, that'll simply
 175          * just add another entry on the error stack.
 176          */
 177         (void)ossl_store_close_it(&tmpctx);
 178     }
 179     OSSL_STORE_LOADER_free(fetched_loader);
 180     OPENSSL_free(propq_copy);
 181     return NULL;
 182 }
 183
 184 OSSL_STORE_CTX *OSSL_STORE_open(const char *uri,
 185                                 const UI_METHOD *ui_method, void *ui_data,
 186                                 OSSL_STORE_post_process_info_fn post_process,
 187                                 void *post_process_data)
 188 {
 189     return OSSL_STORE_open_with_libctx(uri, NULL, NULL, ui_method, ui_data,
 190                                        post_process, post_process_data);
 191 }
 192
 193 #ifndef OPENSSL_NO_DEPRECATED_3_0
 194 int OSSL_STORE_ctrl(OSSL_STORE_CTX *ctx, int cmd, ...)
 195 {
 196     va_list args;
 197     int ret;
 198
 199     va_start(args, cmd);
 200     ret = OSSL_STORE_vctrl(ctx, cmd, args);
 201     va_end(args);
 202
 203     return ret;
 204 }
 205
 206 int OSSL_STORE_vctrl(OSSL_STORE_CTX *ctx, int cmd, va_list args)
 207 {
 208     if (ctx->fetched_loader != NULL) {
 209         if (ctx->fetched_loader->p_set_ctx_params != NULL) {
 210             OSSL_PARAM params[2] = { OSSL_PARAM_END, OSSL_PARAM_END };
 211
 212             switch (cmd) {
 213             case OSSL_STORE_C_USE_SECMEM:
 214                 {
 215                     int on = *(va_arg(args, int *));
 216
 217                     params[0] = OSSL_PARAM_construct_int("use_secmem", &on);
 218                 }
 219                 break;
 220             default:
 221                 break;
 222             }
 223
 224             return ctx->fetched_loader->p_set_ctx_params(ctx->loader_ctx,
 225                                                          params);
 226         }
 227     } else if (ctx->loader->ctrl != NULL) {
 228         return ctx->loader->ctrl(ctx->loader_ctx, cmd, args);
 229     }
 230
 231     /*
 232      * If the fetched loader doesn't have a set_ctx_params or a ctrl, it's as
 233      * if there was one that ignored our params, which usually returns 1.
 234      */
 235     return 1;
 236 }
 237 #endif
 238
 239 int OSSL_STORE_expect(OSSL_STORE_CTX *ctx, int expected_type)
 240 {
 241     int ret = 1;
 242
 243     if (ctx->loading) {
 244         ERR_raise(ERR_LIB_OSSL_STORE, OSSL_STORE_R_LOADING_STARTED);
 245         return 0;
 246     }
 247
 248     ctx->expected_type = expected_type;
 249     if (ctx->fetched_loader != NULL
 250         && ctx->fetched_loader->p_set_ctx_params != NULL) {
 251         OSSL_PARAM params[2] = { OSSL_PARAM_END, OSSL_PARAM_END };
 252
 253         params[0] =
 254             OSSL_PARAM_construct_int(OSSL_STORE_PARAM_EXPECT, &expected_type);
 255         ret = ctx->fetched_loader->p_set_ctx_params(ctx->loader_ctx, params);
 256     }
 257 #ifndef OPENSSL_NO_DEPRECATED_3_0
 258     if (ctx->fetched_loader == NULL
 259         && ctx->loader->expect != NULL) {
 260         ret = ctx->loader->expect(ctx->loader_ctx, expected_type);
 261     }
 262 #endif
 263     return ret;
 264 }
 265
 266 int OSSL_STORE_find(OSSL_STORE_CTX *ctx, const OSSL_STORE_SEARCH *search)
 267 {
 268     int ret = 1;
 269
 270     if (ctx->loading) {
 271         ERR_raise(ERR_LIB_OSSL_STORE, OSSL_STORE_R_LOADING_STARTED);
 272         return 0;
 273     }
 274
 275     if (ctx->fetched_loader != NULL) {
 276         OSSL_PARAM_BLD *bld;
 277         OSSL_PARAM *params;
 278         /* OSSL_STORE_SEARCH_BY_NAME, OSSL_STORE_SEARCH_BY_ISSUER_SERIAL*/
 279         void *name_der = NULL;
 280         int name_der_sz;
 281         /* OSSL_STORE_SEARCH_BY_ISSUER_SERIAL */
 282         BIGNUM *number = NULL;
 283
 284         if (ctx->fetched_loader->p_set_ctx_params == NULL) {
 285             ERR_raise(ERR_LIB_OSSL_STORE, OSSL_STORE_R_UNSUPPORTED_OPERATION);
 286             return 0;
 287         }
 288
 289         if ((bld = OSSL_PARAM_BLD_new()) == NULL) {
 290             ERR_raise(ERR_LIB_OSSL_STORE, ERR_R_MALLOC_FAILURE);
 291             return 0;
 292         }
 293
 294         ret = 0;                 /* Assume the worst */
 295
 296         switch (search->search_type) {
 297         case OSSL_STORE_SEARCH_BY_NAME:
 298             if ((name_der_sz = i2d_X509_NAME(search->name,
 299                                              (unsigned char **)&name_der)) > 0
 300                 && OSSL_PARAM_BLD_push_octet_string(bld,
 301                                                     OSSL_STORE_PARAM_SUBJECT,
 302                                                     name_der, name_der_sz))
 303                 ret = 1;
 304             break;
 305         case OSSL_STORE_SEARCH_BY_ISSUER_SERIAL:
 306             if ((name_der_sz = i2d_X509_NAME(search->name,
 307                                              (unsigned char **)&name_der)) > 0
 308                 && (number = ASN1_INTEGER_to_BN(search->serial, NULL)) != NULL
 309                 && OSSL_PARAM_BLD_push_octet_string(bld,
 310                                                     OSSL_STORE_PARAM_ISSUER,
 311                                                     name_der, name_der_sz)
 312                 && OSSL_PARAM_BLD_push_BN(bld, OSSL_STORE_PARAM_SERIAL,
 313                                           number))
 314                 ret = 1;
 315             break;
 316         case OSSL_STORE_SEARCH_BY_KEY_FINGERPRINT:
 317             if (OSSL_PARAM_BLD_push_utf8_string(bld, OSSL_STORE_PARAM_DIGEST,
 318                                                 EVP_MD_name(search->digest), 0)
 319                 && OSSL_PARAM_BLD_push_octet_string(bld,
 320                                                     OSSL_STORE_PARAM_FINGERPRINT,
 321                                                     search->string,
 322                                                     search->stringlength))
 323                 ret = 1;
 324             break;
 325         case OSSL_STORE_SEARCH_BY_ALIAS:
 326             if (OSSL_PARAM_BLD_push_utf8_string(bld, OSSL_STORE_PARAM_ALIAS,
 327                                                 (char *)search->string,
 328                                                 search->stringlength))
 329                 ret = 1;
 330             break;
 331         }
 332         if (ret) {
 333             params = OSSL_PARAM_BLD_to_param(bld);
 334             ret = ctx->fetched_loader->p_set_ctx_params(ctx->loader_ctx,
 335                                                         params);
 336             OSSL_PARAM_BLD_free_params(params);
 337         }
 338         OSSL_PARAM_BLD_free(bld);
 339         OPENSSL_free(name_der);
 340         BN_free(number);
 341     } else {
 342 #ifndef OPENSSL_NO_DEPRECATED_3_0
 343         /* legacy loader section */
 344         if (ctx->loader->find == NULL) {
 345             ERR_raise(ERR_LIB_OSSL_STORE, OSSL_STORE_R_UNSUPPORTED_OPERATION);
 346             return 0;
 347         }
 348         ret = ctx->loader->find(ctx->loader_ctx, search);
 349 #endif
 350     }
 351
 352     return ret;
 353 }
 354
 355 OSSL_STORE_INFO *OSSL_STORE_load(OSSL_STORE_CTX *ctx)
 356 {
 357     OSSL_STORE_INFO *v = NULL;
 358
 359     ctx->loading = 1;
 360  again:
 361     if (OSSL_STORE_eof(ctx))
 362         return NULL;
 363
 364     if (ctx->loader != NULL)
 365         OSSL_TRACE(STORE, "Loading next object\n");
 366
 367     if (ctx->cached_info != NULL
 368         && sk_OSSL_STORE_INFO_num(ctx->cached_info) == 0) {
 369         sk_OSSL_STORE_INFO_free(ctx->cached_info);
 370         ctx->cached_info = NULL;
 371     }
 372
 373     if (ctx->cached_info != NULL) {
 374         v = sk_OSSL_STORE_INFO_shift(ctx->cached_info);
 375     } else {
 376         if (ctx->fetched_loader != NULL) {
 377             struct ossl_load_result_data_st load_data;
 378
 379             load_data.v = NULL;
 380             load_data.ctx = ctx;
 381
 382             if (!ctx->fetched_loader->p_load(ctx->loader_ctx,
 383                                              ossl_store_handle_load_result,
 384                                              &load_data,
 385                                              ossl_pw_passphrase_callback_dec,
 386                                              &ctx->pwdata)) {
 387                 if (!OSSL_STORE_eof(ctx))
 388                     ctx->error_flag = 1;
 389                 return NULL;
 390             }
 391             v = load_data.v;
 392         }
 393 #ifndef OPENSSL_NO_DEPRECATED_3_0
 394         if (ctx->fetched_loader == NULL)
 395             v = ctx->loader->load(ctx->loader_ctx,
 396                                   ctx->pwdata._.ui_method.ui_method,
 397                                   ctx->pwdata._.ui_method.ui_method_data);
 398 #endif
 399     }
 400
 401     if (ctx->post_process != NULL && v != NULL) {
 402         v = ctx->post_process(v, ctx->post_process_data);
 403
 404         /*
 405          * By returning NULL, the callback decides that this object should
 406          * be ignored.
 407          */
 408         if (v == NULL)
 409             goto again;
 410     }
 411
 412     if (v != NULL && ctx->expected_type != 0) {
 413         int returned_type = OSSL_STORE_INFO_get_type(v);
 414
 415         if (returned_type != OSSL_STORE_INFO_NAME && returned_type != 0) {
 416             if (ctx->expected_type != returned_type) {
 417                 OSSL_STORE_INFO_free(v);
 418                 goto again;
 419             }
 420         }
 421     }
 422
 423     if (v != NULL)
 424         OSSL_TRACE1(STORE, "Got a %s\n",
 425                     OSSL_STORE_INFO_type_string(OSSL_STORE_INFO_get_type(v)));
 426
 427     return v;
 428 }
 429
 430 int OSSL_STORE_error(OSSL_STORE_CTX *ctx)
 431 {
 432     int ret = 1;
 433
 434     if (ctx->fetched_loader != NULL)
 435         ret = ctx->error_flag;
 436 #ifndef OPENSSL_NO_DEPRECATED_3_0
 437     if (ctx->fetched_loader == NULL)
 438         ret = ctx->loader->error(ctx->loader_ctx);
 439 #endif
 440     return ret;
 441 }
 442
 443 int OSSL_STORE_eof(OSSL_STORE_CTX *ctx)
 444 {
 445     int ret = 1;
 446
 447     if (ctx->fetched_loader != NULL)
 448         ret = ctx->loader->p_eof(ctx->loader_ctx);
 449 #ifndef OPENSSL_NO_DEPRECATED_3_0
 450     if (ctx->fetched_loader == NULL)
 451         ret = ctx->loader->eof(ctx->loader_ctx);
 452 #endif
 453     return ret;
 454 }
 455
 456 static int ossl_store_close_it(OSSL_STORE_CTX *ctx)
 457 {
 458     int ret = 0;
 459
 460     if (ctx == NULL)
 461         return 1;
 462     OSSL_TRACE1(STORE, "Closing %p\n", (void *)ctx->loader_ctx);
 463
 464     if (ctx->fetched_loader != NULL)
 465         ret = ctx->loader->p_close(ctx->loader_ctx);
 466 #ifndef OPENSSL_NO_DEPRECATED_3_0
 467     if (ctx->fetched_loader == NULL)
 468         ret = ctx->loader->close(ctx->loader_ctx);
 469 #endif
 470
 471     sk_OSSL_STORE_INFO_pop_free(ctx->cached_info, OSSL_STORE_INFO_free);
 472     OSSL_STORE_LOADER_free(ctx->fetched_loader);
 473     OPENSSL_free(ctx->properties);
 474     ossl_pw_clear_passphrase_data(&ctx->pwdata);
 475     return ret;
 476 }
 477
 478 int OSSL_STORE_close(OSSL_STORE_CTX *ctx)
 479 {
 480     int ret = ossl_store_close_it(ctx);
 481
 482     OPENSSL_free(ctx);
 483     return ret;
 484 }
 485
 486 /*
 487  * Functions to generate OSSL_STORE_INFOs, one function for each type we
 488  * support having in them as well as a generic constructor.
 489  *
 490  * In all cases, ownership of the object is transferred to the OSSL_STORE_INFO
 491  * and will therefore be freed when the OSSL_STORE_INFO is freed.
 492  */
 493 OSSL_STORE_INFO *OSSL_STORE_INFO_new(int type, void *data)
 494 {
 495     OSSL_STORE_INFO *info = OPENSSL_zalloc(sizeof(*info));
 496
 497     if (info == NULL)
 498         return NULL;
 499
 500     info->type = type;
 501     info->_.data = data;
 502     return info;
 503 }
 504
 505 OSSL_STORE_INFO *OSSL_STORE_INFO_new_NAME(char *name)
 506 {
 507     OSSL_STORE_INFO *info = OSSL_STORE_INFO_new(OSSL_STORE_INFO_NAME, NULL);
 508
 509     if (info == NULL) {
 510         ERR_raise(ERR_LIB_OSSL_STORE, ERR_R_MALLOC_FAILURE);
 511         return NULL;
 512     }
 513
 514     info->_.name.name = name;
 515     info->_.name.desc = NULL;
 516
 517     return info;
 518 }
 519
 520 int OSSL_STORE_INFO_set0_NAME_description(OSSL_STORE_INFO *info, char *desc)
 521 {
 522     if (info->type != OSSL_STORE_INFO_NAME) {
 523         ERR_raise(ERR_LIB_OSSL_STORE, ERR_R_PASSED_INVALID_ARGUMENT);
 524         return 0;
 525     }
 526
 527     info->_.name.desc = desc;
 528
 529     return 1;
 530 }
 531 OSSL_STORE_INFO *OSSL_STORE_INFO_new_PARAMS(EVP_PKEY *params)
 532 {
 533     OSSL_STORE_INFO *info = OSSL_STORE_INFO_new(OSSL_STORE_INFO_PARAMS, params);
 534
 535     if (info == NULL)
 536         ERR_raise(ERR_LIB_OSSL_STORE, ERR_R_MALLOC_FAILURE);
 537     return info;
 538 }
 539
 540 OSSL_STORE_INFO *OSSL_STORE_INFO_new_PUBKEY(EVP_PKEY *pkey)
 541 {
 542     OSSL_STORE_INFO *info = OSSL_STORE_INFO_new(OSSL_STORE_INFO_PUBKEY, pkey);
 543
 544     if (info == NULL)
 545         ERR_raise(ERR_LIB_OSSL_STORE, ERR_R_MALLOC_FAILURE);
 546     return info;
 547 }
 548
 549 OSSL_STORE_INFO *OSSL_STORE_INFO_new_PKEY(EVP_PKEY *pkey)
 550 {
 551     OSSL_STORE_INFO *info = OSSL_STORE_INFO_new(OSSL_STORE_INFO_PKEY, pkey);
 552
 553     if (info == NULL)
 554         ERR_raise(ERR_LIB_OSSL_STORE, ERR_R_MALLOC_FAILURE);
 555     return info;
 556 }
 557
 558 OSSL_STORE_INFO *OSSL_STORE_INFO_new_CERT(X509 *x509)
 559 {
 560     OSSL_STORE_INFO *info = OSSL_STORE_INFO_new(OSSL_STORE_INFO_CERT, x509);
 561
 562     if (info == NULL)
 563         ERR_raise(ERR_LIB_OSSL_STORE, ERR_R_MALLOC_FAILURE);
 564     return info;
 565 }
 566
 567 OSSL_STORE_INFO *OSSL_STORE_INFO_new_CRL(X509_CRL *crl)
 568 {
 569     OSSL_STORE_INFO *info = OSSL_STORE_INFO_new(OSSL_STORE_INFO_CRL, crl);
 570
 571     if (info == NULL)
 572         ERR_raise(ERR_LIB_OSSL_STORE, ERR_R_MALLOC_FAILURE);
 573     return info;
 574 }
 575
 576 /*
 577  * Functions to try to extract data from a OSSL_STORE_INFO.
 578  */
 579 int OSSL_STORE_INFO_get_type(const OSSL_STORE_INFO *info)
 580 {
 581     return info->type;
 582 }
 583
 584 void *OSSL_STORE_INFO_get0_data(int type, const OSSL_STORE_INFO *info)
 585 {
 586     if (info->type == type)
 587         return info->_.data;
 588     return NULL;
 589 }
 590
 591 const char *OSSL_STORE_INFO_get0_NAME(const OSSL_STORE_INFO *info)
 592 {
 593     if (info->type == OSSL_STORE_INFO_NAME)
 594         return info->_.name.name;
 595     return NULL;
 596 }
 597
 598 char *OSSL_STORE_INFO_get1_NAME(const OSSL_STORE_INFO *info)
 599 {
 600     if (info->type == OSSL_STORE_INFO_NAME) {
 601         char *ret = OPENSSL_strdup(info->_.name.name);
 602
 603         if (ret == NULL)
 604             ERR_raise(ERR_LIB_OSSL_STORE, ERR_R_MALLOC_FAILURE);
 605         return ret;
 606     }
 607     ERR_raise(ERR_LIB_OSSL_STORE, OSSL_STORE_R_NOT_A_NAME);
 608     return NULL;
 609 }
 610
 611 const char *OSSL_STORE_INFO_get0_NAME_description(const OSSL_STORE_INFO *info)
 612 {
 613     if (info->type == OSSL_STORE_INFO_NAME)
 614         return info->_.name.desc;
 615     return NULL;
 616 }
 617
 618 char *OSSL_STORE_INFO_get1_NAME_description(const OSSL_STORE_INFO *info)
 619 {
 620     if (info->type == OSSL_STORE_INFO_NAME) {
 621         char *ret = OPENSSL_strdup(info->_.name.desc
 622                                    ? info->_.name.desc : "");
 623
 624         if (ret == NULL)
 625             ERR_raise(ERR_LIB_OSSL_STORE, ERR_R_MALLOC_FAILURE);
 626         return ret;
 627     }
 628     ERR_raise(ERR_LIB_OSSL_STORE, OSSL_STORE_R_NOT_A_NAME);
 629     return NULL;
 630 }
 631
 632 EVP_PKEY *OSSL_STORE_INFO_get0_PARAMS(const OSSL_STORE_INFO *info)
 633 {
 634     if (info->type == OSSL_STORE_INFO_PARAMS)
 635         return info->_.params;
 636     return NULL;
 637 }
 638
 639 EVP_PKEY *OSSL_STORE_INFO_get1_PARAMS(const OSSL_STORE_INFO *info)
 640 {
 641     if (info->type == OSSL_STORE_INFO_PARAMS) {
 642         EVP_PKEY_up_ref(info->_.params);
 643         return info->_.params;
 644     }
 645     ERR_raise(ERR_LIB_OSSL_STORE, OSSL_STORE_R_NOT_PARAMETERS);
 646     return NULL;
 647 }
 648
 649 EVP_PKEY *OSSL_STORE_INFO_get0_PUBKEY(const OSSL_STORE_INFO *info)
 650 {
 651     if (info->type == OSSL_STORE_INFO_PUBKEY)
 652         return info->_.pubkey;
 653     return NULL;
 654 }
 655
 656 EVP_PKEY *OSSL_STORE_INFO_get1_PUBKEY(const OSSL_STORE_INFO *info)
 657 {
 658     if (info->type == OSSL_STORE_INFO_PUBKEY) {
 659         EVP_PKEY_up_ref(info->_.pubkey);
 660         return info->_.pubkey;
 661     }
 662     OSSL_STOREerr(0, OSSL_STORE_R_NOT_A_PUBLIC_KEY);
 663     return NULL;
 664 }
 665
 666 EVP_PKEY *OSSL_STORE_INFO_get0_PKEY(const OSSL_STORE_INFO *info)
 667 {
 668     if (info->type == OSSL_STORE_INFO_PKEY)
 669         return info->_.pkey;
 670     return NULL;
 671 }
 672
 673 EVP_PKEY *OSSL_STORE_INFO_get1_PKEY(const OSSL_STORE_INFO *info)
 674 {
 675     if (info->type == OSSL_STORE_INFO_PKEY) {
 676         EVP_PKEY_up_ref(info->_.pkey);
 677         return info->_.pkey;
 678     }
 679     ERR_raise(ERR_LIB_OSSL_STORE, OSSL_STORE_R_NOT_A_PRIVATE_KEY);
 680     return NULL;
 681 }
 682
 683 X509 *OSSL_STORE_INFO_get0_CERT(const OSSL_STORE_INFO *info)
 684 {
 685     if (info->type == OSSL_STORE_INFO_CERT)
 686         return info->_.x509;
 687     return NULL;
 688 }
 689
 690 X509 *OSSL_STORE_INFO_get1_CERT(const OSSL_STORE_INFO *info)
 691 {
 692     if (info->type == OSSL_STORE_INFO_CERT) {
 693         X509_up_ref(info->_.x509);
 694         return info->_.x509;
 695     }
 696     ERR_raise(ERR_LIB_OSSL_STORE, OSSL_STORE_R_NOT_A_CERTIFICATE);
 697     return NULL;
 698 }
 699
 700 X509_CRL *OSSL_STORE_INFO_get0_CRL(const OSSL_STORE_INFO *info)
 701 {
 702     if (info->type == OSSL_STORE_INFO_CRL)
 703         return info->_.crl;
 704     return NULL;
 705 }
 706
 707 X509_CRL *OSSL_STORE_INFO_get1_CRL(const OSSL_STORE_INFO *info)
 708 {
 709     if (info->type == OSSL_STORE_INFO_CRL) {
 710         X509_CRL_up_ref(info->_.crl);
 711         return info->_.crl;
 712     }
 713     ERR_raise(ERR_LIB_OSSL_STORE, OSSL_STORE_R_NOT_A_CRL);
 714     return NULL;
 715 }
 716
 717 /*
 718  * Free the OSSL_STORE_INFO
 719  */
 720 void OSSL_STORE_INFO_free(OSSL_STORE_INFO *info)
 721 {
 722     if (info != NULL) {
 723         switch (info->type) {
 724         case OSSL_STORE_INFO_NAME:
 725             OPENSSL_free(info->_.name.name);
 726             OPENSSL_free(info->_.name.desc);
 727             break;
 728         case OSSL_STORE_INFO_PARAMS:
 729             EVP_PKEY_free(info->_.params);
 730             break;
 731         case OSSL_STORE_INFO_PUBKEY:
 732             EVP_PKEY_free(info->_.pubkey);
 733             break;
 734         case OSSL_STORE_INFO_PKEY:
 735             EVP_PKEY_free(info->_.pkey);
 736             break;
 737         case OSSL_STORE_INFO_CERT:
 738             X509_free(info->_.x509);
 739             break;
 740         case OSSL_STORE_INFO_CRL:
 741             X509_CRL_free(info->_.crl);
 742             break;
 743         }
 744         OPENSSL_free(info);
 745     }
 746 }
 747
 748 int OSSL_STORE_supports_search(OSSL_STORE_CTX *ctx, int search_type)
 749 {
 750     int ret = 0;
 751
 752     if (ctx->fetched_loader != NULL) {
 753         void *provctx =
 754             ossl_provider_ctx(OSSL_STORE_LOADER_provider(ctx->fetched_loader));
 755         const OSSL_PARAM *params;
 756         const OSSL_PARAM *p_subject = NULL;
 757         const OSSL_PARAM *p_issuer = NULL;
 758         const OSSL_PARAM *p_serial = NULL;
 759         const OSSL_PARAM *p_fingerprint = NULL;
 760         const OSSL_PARAM *p_alias = NULL;
 761
 762         if (ctx->fetched_loader->p_settable_ctx_params == NULL)
 763             return 0;
 764
 765         params = ctx->fetched_loader->p_settable_ctx_params(provctx);
 766         p_subject = OSSL_PARAM_locate_const(params, OSSL_STORE_PARAM_SUBJECT);
 767         p_issuer = OSSL_PARAM_locate_const(params, OSSL_STORE_PARAM_ISSUER);
 768         p_serial = OSSL_PARAM_locate_const(params, OSSL_STORE_PARAM_SERIAL);
 769         p_fingerprint =
 770             OSSL_PARAM_locate_const(params, OSSL_STORE_PARAM_FINGERPRINT);
 771         p_alias = OSSL_PARAM_locate_const(params, OSSL_STORE_PARAM_ALIAS);
 772
 773         switch (search_type) {
 774         case OSSL_STORE_SEARCH_BY_NAME:
 775             ret = (p_subject != NULL);
 776             break;
 777         case OSSL_STORE_SEARCH_BY_ISSUER_SERIAL:
 778             ret = (p_issuer != NULL && p_serial != NULL);
 779             break;
 780         case OSSL_STORE_SEARCH_BY_KEY_FINGERPRINT:
 781             ret = (p_fingerprint != NULL);
 782             break;
 783         case OSSL_STORE_SEARCH_BY_ALIAS:
 784             ret = (p_alias != NULL);
 785             break;
 786         }
 787     }
 788 #ifndef OPENSSL_NO_DEPRECATED_3_0
 789     if (ctx->fetched_loader == NULL) {
 790         OSSL_STORE_SEARCH tmp_search;
 791
 792         if (ctx->loader->find == NULL)
 793             return 0;
 794         tmp_search.search_type = search_type;
 795         ret = ctx->loader->find(NULL, &tmp_search);
 796     }
 797 #endif
 798     return ret;
 799 }
 800
 801 /* Search term constructors */
 802 OSSL_STORE_SEARCH *OSSL_STORE_SEARCH_by_name(X509_NAME *name)
 803 {
 804     OSSL_STORE_SEARCH *search = OPENSSL_zalloc(sizeof(*search));
 805
 806     if (search == NULL) {
 807         ERR_raise(ERR_LIB_OSSL_STORE, ERR_R_MALLOC_FAILURE);
 808         return NULL;
 809     }
 810
 811     search->search_type = OSSL_STORE_SEARCH_BY_NAME;
 812     search->name = name;
 813     return search;
 814 }
 815
 816 OSSL_STORE_SEARCH *OSSL_STORE_SEARCH_by_issuer_serial(X509_NAME *name,
 817                                                       const ASN1_INTEGER *serial)
 818 {
 819     OSSL_STORE_SEARCH *search = OPENSSL_zalloc(sizeof(*search));
 820
 821     if (search == NULL) {
 822         ERR_raise(ERR_LIB_OSSL_STORE, ERR_R_MALLOC_FAILURE);
 823         return NULL;
 824     }
 825
 826     search->search_type = OSSL_STORE_SEARCH_BY_ISSUER_SERIAL;
 827     search->name = name;
 828     search->serial = serial;
 829     return search;
 830 }
 831
 832 OSSL_STORE_SEARCH *OSSL_STORE_SEARCH_by_key_fingerprint(const EVP_MD *digest,
 833                                                         const unsigned char
 834                                                         *bytes, size_t len)
 835 {
 836     OSSL_STORE_SEARCH *search = OPENSSL_zalloc(sizeof(*search));
 837
 838     if (search == NULL) {
 839         ERR_raise(ERR_LIB_OSSL_STORE, ERR_R_MALLOC_FAILURE);
 840         return NULL;
 841     }
 842
 843     if (digest != NULL && len != (size_t)EVP_MD_size(digest)) {
 844         ERR_raise_data(ERR_LIB_OSSL_STORE,
 845                        OSSL_STORE_R_FINGERPRINT_SIZE_DOES_NOT_MATCH_DIGEST,
 846                        "%s size is %d, fingerprint size is %zu",
 847                        EVP_MD_name(digest), EVP_MD_size(digest), len);
 848         return NULL;
 849     }
 850
 851     search->search_type = OSSL_STORE_SEARCH_BY_KEY_FINGERPRINT;
 852     search->digest = digest;
 853     search->string = bytes;
 854     search->stringlength = len;
 855     return search;
 856 }
 857
 858 OSSL_STORE_SEARCH *OSSL_STORE_SEARCH_by_alias(const char *alias)
 859 {
 860     OSSL_STORE_SEARCH *search = OPENSSL_zalloc(sizeof(*search));
 861
 862     if (search == NULL) {
 863         ERR_raise(ERR_LIB_OSSL_STORE, ERR_R_MALLOC_FAILURE);
 864         return NULL;
 865     }
 866
 867     search->search_type = OSSL_STORE_SEARCH_BY_ALIAS;
 868     search->string = (const unsigned char *)alias;
 869     search->stringlength = strlen(alias);
 870     return search;
 871 }
 872
 873 /* Search term destructor */
 874 void OSSL_STORE_SEARCH_free(OSSL_STORE_SEARCH *search)
 875 {
 876     OPENSSL_free(search);
 877 }
 878
 879 /* Search term accessors */
 880 int OSSL_STORE_SEARCH_get_type(const OSSL_STORE_SEARCH *criterion)
 881 {
 882     return criterion->search_type;
 883 }
 884
 885 X509_NAME *OSSL_STORE_SEARCH_get0_name(const OSSL_STORE_SEARCH *criterion)
 886 {
 887     return criterion->name;
 888 }
 889
 890 const ASN1_INTEGER *OSSL_STORE_SEARCH_get0_serial(const OSSL_STORE_SEARCH
 891                                                   *criterion)
 892 {
 893     return criterion->serial;
 894 }
 895
 896 const unsigned char *OSSL_STORE_SEARCH_get0_bytes(const OSSL_STORE_SEARCH
 897                                                   *criterion, size_t *length)
 898 {
 899     *length = criterion->stringlength;
 900     return criterion->string;
 901 }
 902
 903 const char *OSSL_STORE_SEARCH_get0_string(const OSSL_STORE_SEARCH *criterion)
 904 {
 905     return (const char *)criterion->string;
 906 }
 907
 908 const EVP_MD *OSSL_STORE_SEARCH_get0_digest(const OSSL_STORE_SEARCH *criterion)
 909 {
 910     return criterion->digest;
 911 }
 912
 913 OSSL_STORE_CTX *OSSL_STORE_attach(BIO *bp, const char *scheme,
 914                                   OPENSSL_CTX *libctx, const char *propq,
 915                                   const UI_METHOD *ui_method, void *ui_data,
 916                                   OSSL_STORE_post_process_info_fn post_process,
 917                                   void *post_process_data)
 918 {
 919     const OSSL_STORE_LOADER *loader = NULL;
 920     OSSL_STORE_LOADER *fetched_loader = NULL;
 921     OSSL_STORE_LOADER_CTX *loader_ctx = NULL;
 922     OSSL_STORE_CTX *ctx = NULL;
 923
 924     if (scheme == NULL)
 925         scheme = "file";
 926
 927     OSSL_TRACE1(STORE, "Looking up scheme %s\n", scheme);
 928 #ifndef OPENSSL_NO_DEPRECATED_3_0
 929     if ((loader = ossl_store_get0_loader_int(scheme)) != NULL)
 930         loader_ctx = loader->attach(loader, bp, libctx, propq,
 931                                     ui_method, ui_data);
 932 #endif
 933     if (loader == NULL
 934         && (fetched_loader =
 935             OSSL_STORE_LOADER_fetch(scheme, libctx, propq)) != NULL) {
 936         const OSSL_PROVIDER *provider =
 937             OSSL_STORE_LOADER_provider(fetched_loader);
 938         void *provctx = OSSL_PROVIDER_get0_provider_ctx(provider);
 939
 940         if ((loader_ctx =
 941              fetched_loader->p_attach(provctx, (OSSL_CORE_BIO *)bp)) == NULL) {
 942             OSSL_STORE_LOADER_free(fetched_loader);
 943             fetched_loader = NULL;
 944         } else if (propq != NULL) {
 945             OSSL_PARAM params[] = {
 946                 OSSL_PARAM_utf8_string(OSSL_STORE_PARAM_PROPERTIES,
 947                                        NULL, 0),
 948                 OSSL_PARAM_END
 949             };
 950
 951             params[0].data = (void *)propq;
 952             if (!fetched_loader->p_set_ctx_params(loader_ctx, params)) {
 953                 (void)fetched_loader->p_close(loader_ctx);
 954                 OSSL_STORE_LOADER_free(fetched_loader);
 955                 fetched_loader = NULL;
 956             }
 957         }
 958         loader = fetched_loader;
 959     }
 960
 961     if (loader_ctx == NULL)
 962         return NULL;
 963
 964     if ((ctx = OPENSSL_zalloc(sizeof(*ctx))) == NULL) {
 965         ERR_raise(ERR_LIB_OSSL_STORE, ERR_R_MALLOC_FAILURE);
 966         return NULL;
 967     }
 968
 969     if (ui_method != NULL
 970         && !ossl_pw_set_ui_method(&ctx->pwdata, ui_method, ui_data)) {
 971         OPENSSL_free(ctx);
 972         return NULL;
 973     }
 974     ctx->fetched_loader = fetched_loader;
 975     ctx->loader = loader;
 976     ctx->loader_ctx = loader_ctx;
 977     ctx->post_process = post_process;
 978     ctx->post_process_data = post_process_data;
 979
 980     return ctx;
 981 }