X-Git-Url: https://git.openssl.org/gitweb/?p=openssl.git;a=blobdiff_plain;f=crypto%2Fprovider_core.c;h=6abada3c4bdf1c79d959b93e58b5839f40b42dc8;hp=837f4b5daf115232a377bc90a199a8f7925c0e92;hb=6a4f9cd113e7fc0734eb4b62e596488e71961040;hpb=24626a47fb5fbb8b120e0ba696c8f173b9ad5d3c diff --git a/crypto/provider_core.c b/crypto/provider_core.c index 837f4b5daf..6abada3c4b 100644 --- a/crypto/provider_core.c +++ b/crypto/provider_core.c @@ -11,7 +11,7 @@ #include #include #include -#include "internal/cryptlib.h" +#include "internal/cryptlib_int.h" #include "internal/nelem.h" #include "internal/thread_once.h" #include "internal/provider.h" @@ -47,11 +47,22 @@ struct ossl_provider_st { DSO *module; OSSL_provider_init_fn *init_function; STACK_OF(INFOPAIR) *parameters; + OPENSSL_CTX *libctx; /* The library context this instance is in */ struct provider_store_st *store; /* The store this instance belongs to */ +#ifndef FIPS_MODE + /* + * In the FIPS module inner provider, this isn't needed, since the + * error upcalls are always direct calls to the outer provider. + */ + int error_lib; /* ERR library number, one for each provider */ +# ifndef OPENSSL_NO_ERR + ERR_STRING_DATA *error_strings; /* Copy of what the provider gives us */ +# endif +#endif /* Provider side functions */ OSSL_provider_teardown_fn *teardown; - OSSL_provider_get_param_types_fn *get_param_types; + OSSL_provider_gettable_params_fn *gettable_params; OSSL_provider_get_params_fn *get_params; OSSL_provider_query_operation_fn *query_operation; @@ -120,7 +131,11 @@ static void *provider_store_new(OPENSSL_CTX *ctx) CRYPTOerr(CRYPTO_F_PROVIDER_STORE_NEW, ERR_R_INTERNAL_ERROR); return NULL; } + prov->libctx = ctx; prov->store = store; +#ifndef FIPS_MODE + prov->error_lib = ERR_get_next_error_library(); +#endif if(p->is_fallback) ossl_provider_set_fallback(prov); } @@ -144,7 +159,8 @@ static struct provider_store_st *get_provider_store(OPENSSL_CTX *libctx) return store; } -OSSL_PROVIDER *ossl_provider_find(OPENSSL_CTX *libctx, const char *name) +OSSL_PROVIDER *ossl_provider_find(OPENSSL_CTX *libctx, const char *name, + int noconfig) { struct provider_store_st *store = NULL; OSSL_PROVIDER *prov = NULL; @@ -153,11 +169,20 @@ OSSL_PROVIDER *ossl_provider_find(OPENSSL_CTX *libctx, const char *name) OSSL_PROVIDER tmpl = { 0, }; int i; +#ifndef FIPS_MODE + /* + * Make sure any providers are loaded from config before we try to find + * them. + */ + if (!noconfig) + OPENSSL_init_crypto(OPENSSL_INIT_LOAD_CONFIG, NULL); +#endif + tmpl.name = (char *)name; CRYPTO_THREAD_write_lock(store->lock); if ((i = sk_OSSL_PROVIDER_find(store->providers, &tmpl)) == -1 || (prov = sk_OSSL_PROVIDER_value(store->providers, i)) == NULL - || !ossl_provider_upref(prov)) + || !ossl_provider_up_ref(prov)) prov = NULL; CRYPTO_THREAD_unlock(store->lock); } @@ -179,7 +204,7 @@ static OSSL_PROVIDER *provider_new(const char *name, #ifndef HAVE_ATOMICS || (prov->refcnt_lock = CRYPTO_THREAD_lock_new()) == NULL #endif - || !ossl_provider_upref(prov) /* +1 One reference to be returned */ + || !ossl_provider_up_ref(prov) /* +1 One reference to be returned */ || (prov->name = OPENSSL_strdup(name)) == NULL) { ossl_provider_free(prov); CRYPTOerr(CRYPTO_F_PROVIDER_NEW, ERR_R_MALLOC_FAILURE); @@ -190,16 +215,18 @@ static OSSL_PROVIDER *provider_new(const char *name, return prov; } -int ossl_provider_upref(OSSL_PROVIDER *prov) +int ossl_provider_up_ref(OSSL_PROVIDER *prov) { int ref = 0; - CRYPTO_UP_REF(&prov->refcnt, &ref, prov->refcnt_lock); + if (CRYPTO_UP_REF(&prov->refcnt, &ref, prov->refcnt_lock) <= 0) + return 0; return ref; } OSSL_PROVIDER *ossl_provider_new(OPENSSL_CTX *libctx, const char *name, - OSSL_provider_init_fn *init_function) + OSSL_provider_init_fn *init_function, + int noconfig) { struct provider_store_st *store = NULL; OSSL_PROVIDER *prov = NULL; @@ -207,11 +234,11 @@ OSSL_PROVIDER *ossl_provider_new(OPENSSL_CTX *libctx, const char *name, if ((store = get_provider_store(libctx)) == NULL) return NULL; - if ((prov = ossl_provider_find(libctx, name)) != NULL) { /* refcount +1 */ + if ((prov = ossl_provider_find(libctx, name, + noconfig)) != NULL) { /* refcount +1 */ ossl_provider_free(prov); /* refcount -1 */ - CRYPTOerr(CRYPTO_F_OSSL_PROVIDER_NEW, - CRYPTO_R_PROVIDER_ALREADY_EXISTS); - ERR_add_error_data(2, "name=", name); + ERR_raise_data(ERR_LIB_CRYPTO, CRYPTO_R_PROVIDER_ALREADY_EXISTS, NULL, + "name=%s", name); return NULL; } @@ -220,7 +247,7 @@ OSSL_PROVIDER *ossl_provider_new(OPENSSL_CTX *libctx, const char *name, return NULL; CRYPTO_THREAD_write_lock(store->lock); - if (!ossl_provider_upref(prov)) { /* +1 One reference for the store */ + if (!ossl_provider_up_ref(prov)) { /* +1 One reference for the store */ ossl_provider_free(prov); /* -1 Reference that was to be returned */ prov = NULL; } else if (sk_OSSL_PROVIDER_push(store->providers, prov) == 0) { @@ -228,7 +255,11 @@ OSSL_PROVIDER *ossl_provider_new(OPENSSL_CTX *libctx, const char *name, ossl_provider_free(prov); /* -1 Reference that was to be returned */ prov = NULL; } else { + prov->libctx = libctx; prov->store = store; +#ifndef FIPS_MODE + prov->error_lib = ERR_get_next_error_library(); +#endif } CRYPTO_THREAD_unlock(store->lock); @@ -265,8 +296,20 @@ void ossl_provider_free(OSSL_PROVIDER *prov) * When that happens, the provider is inactivated. */ if (ref < 2 && prov->flag_initialized) { +#ifndef FIPS_MODE + ossl_init_thread_deregister(prov); +#endif if (prov->teardown != NULL) prov->teardown(prov->provctx); +#ifndef OPENSSL_NO_ERR +# ifndef FIPS_MODE + if (prov->error_strings != NULL) { + ERR_unload_strings(prov->error_lib, prov->error_strings); + OPENSSL_free(prov->error_strings); + prov->error_strings = NULL; + } +# endif +#endif prov->flag_initialized = 0; } @@ -340,13 +383,16 @@ static const OSSL_DISPATCH *core_dispatch; /* Define further down */ /* * Internal version that doesn't affect the store flags, and thereby avoid * locking. Direct callers must remember to set the store flags when - * appropriate. The libctx parameter is only necessary when FIPS_MODE is set - * (i.e. we are being called from inside the FIPS module) - it is ignored for - * other uses. + * appropriate. */ -static int provider_activate(OSSL_PROVIDER *prov, OPENSSL_CTX *libctx) +static int provider_activate(OSSL_PROVIDER *prov) { const OSSL_DISPATCH *provider_dispatch = NULL; +#ifndef OPENSSL_NO_ERR +# ifndef FIPS_MODE + OSSL_provider_get_reason_strings_fn *p_get_reason_strings = NULL; +# endif +#endif if (prov->flag_initialized) return 1; @@ -399,31 +445,12 @@ static int provider_activate(OSSL_PROVIDER *prov, OPENSSL_CTX *libctx) #endif } - /* - * We call the initialise function for the provider. - * - * If FIPS_MODE is defined then we are inside the FIPS module and are about - * to recursively initialise ourselves. We need to do this so that we can - * get all the provider callback functions set up in order for us to be able - * to make EVP calls from within the FIPS module itself. Only algorithms - * from the FIPS module itself are available via the FIPS module EVP - * interface, i.e. we only ever have one provider available inside the FIPS - * module - the FIPS provider itself. - * - * For modules in general we cannot know what value will be used for the - * provctx - it is a "black box". But for the FIPS module we know that the - * provctx is really a library context. We default the provctx value to the - * same library context as was used for the EVP call that caused this call - * to "provider_activate". - */ -#ifdef FIPS_MODE - prov->provctx = libctx; -#endif + /* Call the initialise function for the provider. */ if (prov->init_function == NULL || !prov->init_function(prov, core_dispatch, &provider_dispatch, &prov->provctx)) { - CRYPTOerr(CRYPTO_F_PROVIDER_ACTIVATE, ERR_R_INIT_FAIL); - ERR_add_error_data(2, "name=", prov->name); + ERR_raise_data(ERR_LIB_CRYPTO, ERR_R_INIT_FAIL, NULL, + "name=%s", prov->name); #ifndef FIPS_MODE DSO_free(prov->module); prov->module = NULL; @@ -437,9 +464,9 @@ static int provider_activate(OSSL_PROVIDER *prov, OPENSSL_CTX *libctx) prov->teardown = OSSL_get_provider_teardown(provider_dispatch); break; - case OSSL_FUNC_PROVIDER_GET_PARAM_TYPES: - prov->get_param_types = - OSSL_get_provider_get_param_types(provider_dispatch); + case OSSL_FUNC_PROVIDER_GETTABLE_PARAMS: + prov->gettable_params = + OSSL_get_provider_gettable_params(provider_dispatch); break; case OSSL_FUNC_PROVIDER_GET_PARAMS: prov->get_params = @@ -449,9 +476,62 @@ static int provider_activate(OSSL_PROVIDER *prov, OPENSSL_CTX *libctx) prov->query_operation = OSSL_get_provider_query_operation(provider_dispatch); break; +#ifndef OPENSSL_NO_ERR +# ifndef FIPS_MODE + case OSSL_FUNC_PROVIDER_GET_REASON_STRINGS: + p_get_reason_strings = + OSSL_get_provider_get_reason_strings(provider_dispatch); + break; +# endif +#endif } } +#ifndef OPENSSL_NO_ERR +# ifndef FIPS_MODE + if (p_get_reason_strings != NULL) { + const OSSL_ITEM *reasonstrings = p_get_reason_strings(prov->provctx); + size_t cnt, cnt2; + + /* + * ERR_load_strings() handles ERR_STRING_DATA rather than OSSL_ITEM, + * although they are essentially the same type. + * Furthermore, ERR_load_strings() patches the array's error number + * with the error library number, so we need to make a copy of that + * array either way. + */ + cnt = 1; /* One for the terminating item */ + while (reasonstrings[cnt].id != 0) { + if (ERR_GET_LIB(reasonstrings[cnt].id) != 0) + return 0; + cnt++; + } + + /* Allocate one extra item for the "library" name */ + prov->error_strings = + OPENSSL_zalloc(sizeof(ERR_STRING_DATA) * (cnt + 1)); + if (prov->error_strings == NULL) + return 0; + + /* + * Set the "library" name. + */ + prov->error_strings[0].error = ERR_PACK(prov->error_lib, 0, 0); + prov->error_strings[0].string = prov->name; + /* + * Copy reasonstrings item 0..cnt-1 to prov->error_trings positions + * 1..cnt. + */ + for (cnt2 = 1; cnt2 <= cnt; cnt2++) { + prov->error_strings[cnt2].error = (int)reasonstrings[cnt2-1].id; + prov->error_strings[cnt2].string = reasonstrings[cnt2-1].ptr; + } + + ERR_load_strings(prov->error_lib, prov->error_strings); + } +# endif +#endif + /* With this flag set, this provider has become fully "loaded". */ prov->flag_initialized = 1; @@ -460,7 +540,7 @@ static int provider_activate(OSSL_PROVIDER *prov, OPENSSL_CTX *libctx) int ossl_provider_activate(OSSL_PROVIDER *prov) { - if (provider_activate(prov, NULL)) { + if (provider_activate(prov)) { CRYPTO_THREAD_write_lock(prov->store->lock); prov->store->use_fallbacks = 0; CRYPTO_THREAD_unlock(prov->store->lock); @@ -484,7 +564,9 @@ static int provider_forall_loaded(struct provider_store_st *store, { int i; int ret = 1; - int num_provs = sk_OSSL_PROVIDER_num(store->providers); + int num_provs; + + num_provs = sk_OSSL_PROVIDER_num(store->providers); if (found_activated != NULL) *found_activated = 0; @@ -503,67 +585,87 @@ static int provider_forall_loaded(struct provider_store_st *store, return ret; } +/* + * This function only does something once when store->use_fallbacks == 1, + * and then sets store->use_fallbacks = 0, so the second call and so on is + * effectively a no-op. + */ +static void provider_activate_fallbacks(struct provider_store_st *store) +{ + if (store->use_fallbacks) { + int num_provs = sk_OSSL_PROVIDER_num(store->providers); + int activated_fallback_count = 0; + int i; + + for (i = 0; i < num_provs; i++) { + OSSL_PROVIDER *prov = sk_OSSL_PROVIDER_value(store->providers, i); + + /* + * Note that we don't care if the activation succeeds or not. + * If it doesn't succeed, then any attempt to use any of the + * fallback providers will fail anyway. + */ + if (prov->flag_fallback) { + activated_fallback_count++; + provider_activate(prov); + } + } + + /* + * We assume that all fallbacks have been added to the store before + * any fallback is activated. + * TODO: We may have to reconsider this, IF we find ourselves adding + * fallbacks after any previous fallback has been activated. + */ + if (activated_fallback_count > 0) + store->use_fallbacks = 0; + } +} + int ossl_provider_forall_loaded(OPENSSL_CTX *ctx, int (*cb)(OSSL_PROVIDER *provider, void *cbdata), void *cbdata) { int ret = 1; - int i; struct provider_store_st *store = get_provider_store(ctx); - if (store != NULL) { - int found_activated = 0; +#ifndef FIPS_MODE + /* + * Make sure any providers are loaded from config before we try to use + * them. + */ + OPENSSL_init_crypto(OPENSSL_INIT_LOAD_CONFIG, NULL); +#endif + if (store != NULL) { CRYPTO_THREAD_read_lock(store->lock); - ret = provider_forall_loaded(store, &found_activated, cb, cbdata); + + provider_activate_fallbacks(store); /* - * If there's nothing activated ever in this store, try to activate - * all fallbacks. + * Now, we sweep through all providers */ - if (!found_activated && store->use_fallbacks) { - int num_provs = sk_OSSL_PROVIDER_num(store->providers); - int activated_fallback_count = 0; - - for (i = 0; i < num_provs; i++) { - OSSL_PROVIDER *prov = - sk_OSSL_PROVIDER_value(store->providers, i); - - /* - * Note that we don't care if the activation succeeds or - * not. If it doesn't succeed, then the next loop will - * fail anyway. - */ - if (prov->flag_fallback) { - activated_fallback_count++; - provider_activate(prov, ctx); - } - } + ret = provider_forall_loaded(store, NULL, cb, cbdata); - if (activated_fallback_count > 0) { - /* - * We assume that all fallbacks have been added to the store - * before any fallback is activated. - * TODO: We may have to reconsider this, IF we find ourselves - * adding fallbacks after any previous fallback has been - * activated. - */ - store->use_fallbacks = 0; - - /* - * Now that we've activated available fallbacks, try a - * second sweep - */ - ret = provider_forall_loaded(store, NULL, cb, cbdata); - } - } CRYPTO_THREAD_unlock(store->lock); } return ret; } +int ossl_provider_available(OSSL_PROVIDER *prov) +{ + if (prov != NULL) { + CRYPTO_THREAD_read_lock(prov->store->lock); + provider_activate_fallbacks(prov->store); + CRYPTO_THREAD_unlock(prov->store->lock); + + return prov->flag_initialized; + } + return 0; +} + /* Setters of Provider Object data */ int ossl_provider_set_fallback(OSSL_PROVIDER *prov) { @@ -604,6 +706,11 @@ const char *ossl_provider_module_path(const OSSL_PROVIDER *prov) #endif } +OPENSSL_CTX *ossl_provider_library_context(const OSSL_PROVIDER *prov) +{ + return prov->libctx; +} + /* Wrappers around calls to the provider */ void ossl_provider_teardown(const OSSL_PROVIDER *prov) { @@ -611,14 +718,13 @@ void ossl_provider_teardown(const OSSL_PROVIDER *prov) prov->teardown(prov->provctx); } -const OSSL_ITEM *ossl_provider_get_param_types(const OSSL_PROVIDER *prov) +const OSSL_PARAM *ossl_provider_gettable_params(const OSSL_PROVIDER *prov) { - return prov->get_param_types == NULL - ? NULL : prov->get_param_types(prov->provctx); + return prov->gettable_params == NULL + ? NULL : prov->gettable_params(prov->provctx); } -int ossl_provider_get_params(const OSSL_PROVIDER *prov, - const OSSL_PARAM params[]) +int ossl_provider_get_params(const OSSL_PROVIDER *prov, OSSL_PARAM params[]) { return prov->get_params == NULL ? 0 : prov->get_params(prov->provctx, params); @@ -644,21 +750,41 @@ const OSSL_ALGORITHM *ossl_provider_query_operation(const OSSL_PROVIDER *prov, * discovery. We do not expect that many providers will use this, but one * never knows. */ -static const OSSL_ITEM param_types[] = { - { OSSL_PARAM_UTF8_PTR, "openssl-version" }, - { OSSL_PARAM_UTF8_PTR, "provider-name" }, - { 0, NULL } +static const OSSL_PARAM param_types[] = { + OSSL_PARAM_DEFN("openssl-verstion", OSSL_PARAM_UTF8_PTR, NULL, 0), + OSSL_PARAM_DEFN("provider-name", OSSL_PARAM_UTF8_PTR, NULL, 0), + OSSL_PARAM_END }; -static const OSSL_ITEM *core_get_param_types(const OSSL_PROVIDER *prov) +/* + * Forward declare all the functions that are provided aa dispatch. + * This ensures that the compiler will complain if they aren't defined + * with the correct signature. + */ +static OSSL_core_gettable_params_fn core_gettable_params; +static OSSL_core_get_params_fn core_get_params; +static OSSL_core_thread_start_fn core_thread_start; +static OSSL_core_get_library_context_fn core_get_libctx; +#ifndef FIPS_MODE +static OSSL_core_new_error_fn core_new_error; +static OSSL_core_set_error_debug_fn core_set_error_debug; +static OSSL_core_vset_error_fn core_vset_error; +#endif + +static const OSSL_PARAM *core_gettable_params(const OSSL_PROVIDER *prov) { return param_types; } -static int core_get_params(const OSSL_PROVIDER *prov, const OSSL_PARAM params[]) +static int core_get_params(const OSSL_PROVIDER *prov, OSSL_PARAM params[]) { int i; - const OSSL_PARAM *p; + OSSL_PARAM *p; + +#ifndef FIPS_MODE + /* Load config before we attempt to read any provider parameters */ + OPENSSL_init_crypto(OPENSSL_INIT_LOAD_CONFIG, NULL); +#endif if ((p = OSSL_PARAM_locate(params, "openssl-version")) != NULL) OSSL_PARAM_set_utf8_ptr(p, OPENSSL_VERSION_STR); @@ -678,11 +804,87 @@ static int core_get_params(const OSSL_PROVIDER *prov, const OSSL_PARAM params[]) return 1; } +static OPENSSL_CTX *core_get_libctx(const OSSL_PROVIDER *prov) +{ + return ossl_provider_library_context(prov); +} + +static int core_thread_start(const OSSL_PROVIDER *prov, + OSSL_thread_stop_handler_fn handfn) +{ + return ossl_init_thread_start(prov, prov->provctx, handfn); +} + +/* + * The FIPS module inner provider doesn't implement these. They aren't + * needed there, since the FIPS module upcalls are always the outer provider + * ones. + */ +#ifndef FIPS_MODE +/* + * TODO(3.0) These error functions should use |prov| to select the proper + * library context to report in the correct error stack, at least if error + * stacks become tied to the library context. + * We cannot currently do that since there's no support for it in the + * ERR subsystem. + */ +static void core_new_error(const OSSL_PROVIDER *prov) +{ + ERR_new(); +} + +static void core_set_error_debug(const OSSL_PROVIDER *prov, + const char *file, int line, const char *func) +{ + ERR_set_debug(file, line, func); +} + +static void core_vset_error(const OSSL_PROVIDER *prov, + uint32_t reason, const char *fmt, va_list args) +{ + /* + * If the uppermost 8 bits are non-zero, it's an OpenSSL library + * error and will be treated as such. Otherwise, it's a new style + * provider error and will be treated as such. + */ + if (ERR_GET_LIB(reason) != 0) { + ERR_vset_error(ERR_GET_LIB(reason), ERR_GET_REASON(reason), fmt, args); + } else { + ERR_vset_error(prov->error_lib, (int)reason, fmt, args); + } +} +#endif + +/* + * Functions provided by the core. Blank line separates "families" of related + * functions. + */ static const OSSL_DISPATCH core_dispatch_[] = { - { OSSL_FUNC_CORE_GET_PARAM_TYPES, (void (*)(void))core_get_param_types }, + { OSSL_FUNC_CORE_GETTABLE_PARAMS, (void (*)(void))core_gettable_params }, { OSSL_FUNC_CORE_GET_PARAMS, (void (*)(void))core_get_params }, - { OSSL_FUNC_CORE_PUT_ERROR, (void (*)(void))ERR_put_error }, - { OSSL_FUNC_CORE_ADD_ERROR_VDATA, (void (*)(void))ERR_add_error_vdata }, + { OSSL_FUNC_CORE_GET_LIBRARY_CONTEXT, (void (*)(void))core_get_libctx }, + { OSSL_FUNC_CORE_THREAD_START, (void (*)(void))core_thread_start }, +#ifndef FIPS_MODE + { OSSL_FUNC_CORE_NEW_ERROR, (void (*)(void))core_new_error }, + { OSSL_FUNC_CORE_SET_ERROR_DEBUG, (void (*)(void))core_set_error_debug }, + { OSSL_FUNC_CORE_VSET_ERROR, (void (*)(void))core_vset_error }, +#endif + + { OSSL_FUNC_CRYPTO_MALLOC, (void (*)(void))CRYPTO_malloc }, + { OSSL_FUNC_CRYPTO_ZALLOC, (void (*)(void))CRYPTO_zalloc }, + { OSSL_FUNC_CRYPTO_FREE, (void (*)(void))CRYPTO_free }, + { OSSL_FUNC_CRYPTO_CLEAR_FREE, (void (*)(void))CRYPTO_clear_free }, + { OSSL_FUNC_CRYPTO_REALLOC, (void (*)(void))CRYPTO_realloc }, + { OSSL_FUNC_CRYPTO_CLEAR_REALLOC, (void (*)(void))CRYPTO_clear_realloc }, + { OSSL_FUNC_CRYPTO_SECURE_MALLOC, (void (*)(void))CRYPTO_secure_malloc }, + { OSSL_FUNC_CRYPTO_SECURE_ZALLOC, (void (*)(void))CRYPTO_secure_zalloc }, + { OSSL_FUNC_CRYPTO_SECURE_FREE, (void (*)(void))CRYPTO_secure_free }, + { OSSL_FUNC_CRYPTO_SECURE_CLEAR_FREE, + (void (*)(void))CRYPTO_secure_clear_free }, + { OSSL_FUNC_CRYPTO_SECURE_ALLOCATED, + (void (*)(void))CRYPTO_secure_allocated }, + { OSSL_FUNC_OPENSSL_CLEANSE, (void (*)(void))OPENSSL_cleanse }, + { 0, NULL } }; static const OSSL_DISPATCH *core_dispatch = core_dispatch_;