1/* 2 * Copyright 2019-2023 The OpenSSL Project Authors. All Rights Reserved. 3 * 4 * Licensed under the Apache License 2.0 (the "License"). You may not use 5 * this file except in compliance with the License. You can obtain a copy 6 * in the file LICENSE in the source distribution or at 7 * https://www.openssl.org/source/license.html 8 */ 9 10#include <assert.h> 11#include <openssl/core.h> 12#include <openssl/core_dispatch.h> 13#include <openssl/core_names.h> 14#include <openssl/provider.h> 15#include <openssl/params.h> 16#include <openssl/opensslv.h> 17#include "crypto/cryptlib.h" 18#ifndef FIPS_MODULE 19#include "crypto/decoder.h" /* ossl_decoder_store_cache_flush */ 20#include "crypto/encoder.h" /* ossl_encoder_store_cache_flush */ 21#include "crypto/store.h" /* ossl_store_loader_store_cache_flush */ 22#endif 23#include "crypto/evp.h" /* evp_method_store_cache_flush */ 24#include "crypto/rand.h" 25#include "internal/nelem.h" 26#include "internal/thread_once.h" 27#include "internal/provider.h" 28#include "internal/refcount.h" 29#include "internal/bio.h" 30#include "internal/core.h" 31#include "provider_local.h" 32#ifndef FIPS_MODULE 33# include <openssl/self_test.h> 34#endif 35 36/* 37 * This file defines and uses a number of different structures: 38 * 39 * OSSL_PROVIDER (provider_st): Used to represent all information related to a 40 * single instance of a provider. 41 * 42 * provider_store_st: Holds information about the collection of providers that 43 * are available within the current library context (OSSL_LIB_CTX). It also 44 * holds configuration information about providers that could be loaded at some 45 * future point. 46 * 47 * OSSL_PROVIDER_CHILD_CB: An instance of this structure holds the callbacks 48 * that have been registered for a child library context and the associated 49 * provider that registered those callbacks. 50 * 51 * Where a child library context exists then it has its own instance of the 52 * provider store. Each provider that exists in the parent provider store, has 53 * an associated child provider in the child library context's provider store. 54 * As providers get activated or deactivated this needs to be mirrored in the 55 * associated child providers. 56 * 57 * LOCKING 58 * ======= 59 * 60 * There are a number of different locks used in this file and it is important 61 * to understand how they should be used in order to avoid deadlocks. 62 * 63 * Fields within a structure can often be "write once" on creation, and then 64 * "read many". Creation of a structure is done by a single thread, and 65 * therefore no lock is required for the "write once/read many" fields. It is 66 * safe for multiple threads to read these fields without a lock, because they 67 * will never be changed. 68 * 69 * However some fields may be changed after a structure has been created and 70 * shared between multiple threads. Where this is the case a lock is required. 71 * 72 * The locks available are: 73 * 74 * The provider flag_lock: Used to control updates to the various provider 75 * "flags" (flag_initialized, flag_activated, flag_fallback) and associated 76 * "counts" (activatecnt). 77 * 78 * The provider refcnt_lock: Only ever used to control updates to the provider 79 * refcnt value. 80 * 81 * The provider optbits_lock: Used to control access to the provider's 82 * operation_bits and operation_bits_sz fields. 83 * 84 * The store default_path_lock: Used to control access to the provider store's 85 * default search path value (default_path) 86 * 87 * The store lock: Used to control the stack of provider's held within the 88 * provider store, as well as the stack of registered child provider callbacks. 89 * 90 * As a general rule-of-thumb it is best to: 91 * - keep the scope of the code that is protected by a lock to the absolute 92 * minimum possible; 93 * - try to keep the scope of the lock to within a single function (i.e. avoid 94 * making calls to other functions while holding a lock); 95 * - try to only ever hold one lock at a time. 96 * 97 * Unfortunately, it is not always possible to stick to the above guidelines. 98 * Where they are not adhered to there is always a danger of inadvertently 99 * introducing the possibility of deadlock. The following rules MUST be adhered 100 * to in order to avoid that: 101 * - Holding multiple locks at the same time is only allowed for the 102 * provider store lock, the provider flag_lock and the provider refcnt_lock. 103 * - When holding multiple locks they must be acquired in the following order of 104 * precedence: 105 * 1) provider store lock 106 * 2) provider flag_lock 107 * 3) provider refcnt_lock 108 * - When releasing locks they must be released in the reverse order to which 109 * they were acquired 110 * - No locks may be held when making an upcall. NOTE: Some common functions 111 * can make upcalls as part of their normal operation. If you need to call 112 * some other function while holding a lock make sure you know whether it 113 * will make any upcalls or not. For example ossl_provider_up_ref() can call 114 * ossl_provider_up_ref_parent() which can call the c_prov_up_ref() upcall. 115 * - It is permissible to hold the store and flag locks when calling child 116 * provider callbacks. No other locks may be held during such callbacks. 117 */ 118 119static OSSL_PROVIDER *provider_new(const char *name, 120 OSSL_provider_init_fn *init_function, 121 STACK_OF(INFOPAIR) *parameters); 122 123/*- 124 * Provider Object structure 125 * ========================= 126 */ 127 128#ifndef FIPS_MODULE 129typedef struct { 130 OSSL_PROVIDER *prov; 131 int (*create_cb)(const OSSL_CORE_HANDLE *provider, void *cbdata); 132 int (*remove_cb)(const OSSL_CORE_HANDLE *provider, void *cbdata); 133 int (*global_props_cb)(const char *props, void *cbdata); 134 void *cbdata; 135} OSSL_PROVIDER_CHILD_CB; 136DEFINE_STACK_OF(OSSL_PROVIDER_CHILD_CB) 137#endif 138 139struct provider_store_st; /* Forward declaration */ 140 141struct ossl_provider_st { 142 /* Flag bits */ 143 unsigned int flag_initialized:1; 144 unsigned int flag_activated:1; 145 unsigned int flag_fallback:1; /* Can be used as fallback */ 146 147 /* Getting and setting the flags require synchronization */ 148 CRYPTO_RWLOCK *flag_lock; 149 150 /* OpenSSL library side data */ 151 CRYPTO_REF_COUNT refcnt; 152 CRYPTO_RWLOCK *refcnt_lock; /* For the ref counter */ 153 int activatecnt; 154 char *name; 155 char *path; 156 DSO *module; 157 OSSL_provider_init_fn *init_function; 158 STACK_OF(INFOPAIR) *parameters; 159 OSSL_LIB_CTX *libctx; /* The library context this instance is in */ 160 struct provider_store_st *store; /* The store this instance belongs to */ 161#ifndef FIPS_MODULE 162 /* 163 * In the FIPS module inner provider, this isn't needed, since the 164 * error upcalls are always direct calls to the outer provider. 165 */ 166 int error_lib; /* ERR library number, one for each provider */ 167# ifndef OPENSSL_NO_ERR 168 ERR_STRING_DATA *error_strings; /* Copy of what the provider gives us */ 169# endif 170#endif 171 172 /* Provider side functions */ 173 OSSL_FUNC_provider_teardown_fn *teardown; 174 OSSL_FUNC_provider_gettable_params_fn *gettable_params; 175 OSSL_FUNC_provider_get_params_fn *get_params; 176 OSSL_FUNC_provider_get_capabilities_fn *get_capabilities; 177 OSSL_FUNC_provider_self_test_fn *self_test; 178 OSSL_FUNC_provider_query_operation_fn *query_operation; 179 OSSL_FUNC_provider_unquery_operation_fn *unquery_operation; 180 181 /* 182 * Cache of bit to indicate of query_operation() has been called on 183 * a specific operation or not. 184 */ 185 unsigned char *operation_bits; 186 size_t operation_bits_sz; 187 CRYPTO_RWLOCK *opbits_lock; 188 189#ifndef FIPS_MODULE 190 /* Whether this provider is the child of some other provider */ 191 const OSSL_CORE_HANDLE *handle; 192 unsigned int ischild:1; 193#endif 194 195 /* Provider side data */ 196 void *provctx; 197 const OSSL_DISPATCH *dispatch; 198}; 199DEFINE_STACK_OF(OSSL_PROVIDER) 200 201static int ossl_provider_cmp(const OSSL_PROVIDER * const *a, 202 const OSSL_PROVIDER * const *b) 203{ 204 return strcmp((*a)->name, (*b)->name); 205} 206 207/*- 208 * Provider Object store 209 * ===================== 210 * 211 * The Provider Object store is a library context object, and therefore needs 212 * an index. 213 */ 214 215struct provider_store_st { 216 OSSL_LIB_CTX *libctx; 217 STACK_OF(OSSL_PROVIDER) *providers; 218 STACK_OF(OSSL_PROVIDER_CHILD_CB) *child_cbs; 219 CRYPTO_RWLOCK *default_path_lock; 220 CRYPTO_RWLOCK *lock; 221 char *default_path; 222 OSSL_PROVIDER_INFO *provinfo; 223 size_t numprovinfo; 224 size_t provinfosz; 225 unsigned int use_fallbacks:1; 226 unsigned int freeing:1; 227}; 228 229/* 230 * provider_deactivate_free() is a wrapper around ossl_provider_deactivate() 231 * and ossl_provider_free(), called as needed. 232 * Since this is only called when the provider store is being emptied, we 233 * don't need to care about any lock. 234 */ 235static void provider_deactivate_free(OSSL_PROVIDER *prov) 236{ 237 if (prov->flag_activated) 238 ossl_provider_deactivate(prov, 1); 239 ossl_provider_free(prov); 240} 241 242#ifndef FIPS_MODULE 243static void ossl_provider_child_cb_free(OSSL_PROVIDER_CHILD_CB *cb) 244{ 245 OPENSSL_free(cb); 246} 247#endif 248 249static void infopair_free(INFOPAIR *pair) 250{ 251 OPENSSL_free(pair->name); 252 OPENSSL_free(pair->value); 253 OPENSSL_free(pair); 254} 255 256static INFOPAIR *infopair_copy(const INFOPAIR *src) 257{ 258 INFOPAIR *dest = OPENSSL_zalloc(sizeof(*dest)); 259 260 if (dest == NULL) 261 return NULL; 262 if (src->name != NULL) { 263 dest->name = OPENSSL_strdup(src->name); 264 if (dest->name == NULL) 265 goto err; 266 } 267 if (src->value != NULL) { 268 dest->value = OPENSSL_strdup(src->value); 269 if (dest->value == NULL) 270 goto err; 271 } 272 return dest; 273 err: 274 OPENSSL_free(dest->name); 275 OPENSSL_free(dest); 276 return NULL; 277} 278 279void ossl_provider_info_clear(OSSL_PROVIDER_INFO *info) 280{ 281 OPENSSL_free(info->name); 282 OPENSSL_free(info->path); 283 sk_INFOPAIR_pop_free(info->parameters, infopair_free); 284} 285 286static void provider_store_free(void *vstore) 287{ 288 struct provider_store_st *store = vstore; 289 size_t i; 290 291 if (store == NULL) 292 return; 293 store->freeing = 1; 294 OPENSSL_free(store->default_path); 295 sk_OSSL_PROVIDER_pop_free(store->providers, provider_deactivate_free); 296#ifndef FIPS_MODULE 297 sk_OSSL_PROVIDER_CHILD_CB_pop_free(store->child_cbs, 298 ossl_provider_child_cb_free); 299#endif 300 CRYPTO_THREAD_lock_free(store->default_path_lock); 301 CRYPTO_THREAD_lock_free(store->lock); 302 for (i = 0; i < store->numprovinfo; i++) 303 ossl_provider_info_clear(&store->provinfo[i]); 304 OPENSSL_free(store->provinfo); 305 OPENSSL_free(store); 306} 307 308static void *provider_store_new(OSSL_LIB_CTX *ctx) 309{ 310 struct provider_store_st *store = OPENSSL_zalloc(sizeof(*store)); 311 312 if (store == NULL 313 || (store->providers = sk_OSSL_PROVIDER_new(ossl_provider_cmp)) == NULL 314 || (store->default_path_lock = CRYPTO_THREAD_lock_new()) == NULL 315#ifndef FIPS_MODULE 316 || (store->child_cbs = sk_OSSL_PROVIDER_CHILD_CB_new_null()) == NULL 317#endif 318 || (store->lock = CRYPTO_THREAD_lock_new()) == NULL) { 319 provider_store_free(store); 320 return NULL; 321 } 322 store->libctx = ctx; 323 store->use_fallbacks = 1; 324 325 return store; 326} 327 328static const OSSL_LIB_CTX_METHOD provider_store_method = { 329 /* Needs to be freed before the child provider data is freed */ 330 OSSL_LIB_CTX_METHOD_PRIORITY_1, 331 provider_store_new, 332 provider_store_free, 333}; 334 335static struct provider_store_st *get_provider_store(OSSL_LIB_CTX *libctx) 336{ 337 struct provider_store_st *store = NULL; 338 339 store = ossl_lib_ctx_get_data(libctx, OSSL_LIB_CTX_PROVIDER_STORE_INDEX, 340 &provider_store_method); 341 if (store == NULL) 342 ERR_raise(ERR_LIB_CRYPTO, ERR_R_INTERNAL_ERROR); 343 return store; 344} 345 346int ossl_provider_disable_fallback_loading(OSSL_LIB_CTX *libctx) 347{ 348 struct provider_store_st *store; 349 350 if ((store = get_provider_store(libctx)) != NULL) { 351 if (!CRYPTO_THREAD_write_lock(store->lock)) 352 return 0; 353 store->use_fallbacks = 0; 354 CRYPTO_THREAD_unlock(store->lock); 355 return 1; 356 } 357 return 0; 358} 359 360#define BUILTINS_BLOCK_SIZE 10 361 362int ossl_provider_info_add_to_store(OSSL_LIB_CTX *libctx, 363 OSSL_PROVIDER_INFO *entry) 364{ 365 struct provider_store_st *store = get_provider_store(libctx); 366 int ret = 0; 367 368 if (entry->name == NULL) { 369 ERR_raise(ERR_LIB_CRYPTO, ERR_R_PASSED_NULL_PARAMETER); 370 return 0; 371 } 372 373 if (store == NULL) { 374 ERR_raise(ERR_LIB_CRYPTO, ERR_R_INTERNAL_ERROR); 375 return 0; 376 } 377 378 if (!CRYPTO_THREAD_write_lock(store->lock)) 379 return 0; 380 if (store->provinfosz == 0) { 381 store->provinfo = OPENSSL_zalloc(sizeof(*store->provinfo) 382 * BUILTINS_BLOCK_SIZE); 383 if (store->provinfo == NULL) { 384 ERR_raise(ERR_LIB_CRYPTO, ERR_R_MALLOC_FAILURE); 385 goto err; 386 } 387 store->provinfosz = BUILTINS_BLOCK_SIZE; 388 } else if (store->numprovinfo == store->provinfosz) { 389 OSSL_PROVIDER_INFO *tmpbuiltins; 390 size_t newsz = store->provinfosz + BUILTINS_BLOCK_SIZE; 391 392 tmpbuiltins = OPENSSL_realloc(store->provinfo, 393 sizeof(*store->provinfo) * newsz); 394 if (tmpbuiltins == NULL) { 395 ERR_raise(ERR_LIB_CRYPTO, ERR_R_MALLOC_FAILURE); 396 goto err; 397 } 398 store->provinfo = tmpbuiltins; 399 store->provinfosz = newsz; 400 } 401 store->provinfo[store->numprovinfo] = *entry; 402 store->numprovinfo++; 403 404 ret = 1; 405 err: 406 CRYPTO_THREAD_unlock(store->lock); 407 return ret; 408} 409 410OSSL_PROVIDER *ossl_provider_find(OSSL_LIB_CTX *libctx, const char *name, 411 ossl_unused int noconfig) 412{ 413 struct provider_store_st *store = NULL; 414 OSSL_PROVIDER *prov = NULL; 415 416 if ((store = get_provider_store(libctx)) != NULL) { 417 OSSL_PROVIDER tmpl = { 0, }; 418 int i; 419 420#if !defined(FIPS_MODULE) && !defined(OPENSSL_NO_AUTOLOAD_CONFIG) 421 /* 422 * Make sure any providers are loaded from config before we try to find 423 * them. 424 */ 425 if (!noconfig) { 426 if (ossl_lib_ctx_is_default(libctx)) 427 OPENSSL_init_crypto(OPENSSL_INIT_LOAD_CONFIG, NULL); 428 } 429#endif 430 431 tmpl.name = (char *)name; 432 /* 433 * A "find" operation can sort the stack, and therefore a write lock is 434 * required. 435 */ 436 if (!CRYPTO_THREAD_write_lock(store->lock)) 437 return NULL; 438 if ((i = sk_OSSL_PROVIDER_find(store->providers, &tmpl)) != -1) 439 prov = sk_OSSL_PROVIDER_value(store->providers, i); 440 CRYPTO_THREAD_unlock(store->lock); 441 if (prov != NULL && !ossl_provider_up_ref(prov)) 442 prov = NULL; 443 } 444 445 return prov; 446} 447 448/*- 449 * Provider Object methods 450 * ======================= 451 */ 452 453static OSSL_PROVIDER *provider_new(const char *name, 454 OSSL_provider_init_fn *init_function, 455 STACK_OF(INFOPAIR) *parameters) 456{ 457 OSSL_PROVIDER *prov = NULL; 458 459 if ((prov = OPENSSL_zalloc(sizeof(*prov))) == NULL 460#ifndef HAVE_ATOMICS 461 || (prov->refcnt_lock = CRYPTO_THREAD_lock_new()) == NULL 462#endif 463 ) { 464 OPENSSL_free(prov); 465 ERR_raise(ERR_LIB_CRYPTO, ERR_R_MALLOC_FAILURE); 466 return NULL; 467 } 468 469 prov->refcnt = 1; /* 1 One reference to be returned */ 470 471 if ((prov->opbits_lock = CRYPTO_THREAD_lock_new()) == NULL 472 || (prov->flag_lock = CRYPTO_THREAD_lock_new()) == NULL 473 || (prov->name = OPENSSL_strdup(name)) == NULL 474 || (prov->parameters = sk_INFOPAIR_deep_copy(parameters, 475 infopair_copy, 476 infopair_free)) == NULL) { 477 ossl_provider_free(prov); 478 ERR_raise(ERR_LIB_CRYPTO, ERR_R_MALLOC_FAILURE); 479 return NULL; 480 } 481 482 prov->init_function = init_function; 483 484 return prov; 485} 486 487int ossl_provider_up_ref(OSSL_PROVIDER *prov) 488{ 489 int ref = 0; 490 491 if (CRYPTO_UP_REF(&prov->refcnt, &ref, prov->refcnt_lock) <= 0) 492 return 0; 493 494#ifndef FIPS_MODULE 495 if (prov->ischild) { 496 if (!ossl_provider_up_ref_parent(prov, 0)) { 497 ossl_provider_free(prov); 498 return 0; 499 } 500 } 501#endif 502 503 return ref; 504} 505 506#ifndef FIPS_MODULE 507static int provider_up_ref_intern(OSSL_PROVIDER *prov, int activate) 508{ 509 if (activate) 510 return ossl_provider_activate(prov, 1, 0); 511 512 return ossl_provider_up_ref(prov); 513} 514 515static int provider_free_intern(OSSL_PROVIDER *prov, int deactivate) 516{ 517 if (deactivate) 518 return ossl_provider_deactivate(prov, 1); 519 520 ossl_provider_free(prov); 521 return 1; 522} 523#endif 524 525/* 526 * We assume that the requested provider does not already exist in the store. 527 * The caller should check. If it does exist then adding it to the store later 528 * will fail. 529 */ 530OSSL_PROVIDER *ossl_provider_new(OSSL_LIB_CTX *libctx, const char *name, 531 OSSL_provider_init_fn *init_function, 532 int noconfig) 533{ 534 struct provider_store_st *store = NULL; 535 OSSL_PROVIDER_INFO template; 536 OSSL_PROVIDER *prov = NULL; 537 538 if ((store = get_provider_store(libctx)) == NULL) 539 return NULL; 540 541 memset(&template, 0, sizeof(template)); 542 if (init_function == NULL) { 543 const OSSL_PROVIDER_INFO *p; 544 size_t i; 545 546 /* Check if this is a predefined builtin provider */ 547 for (p = ossl_predefined_providers; p->name != NULL; p++) { 548 if (strcmp(p->name, name) == 0) { 549 template = *p; 550 break; 551 } 552 } 553 if (p->name == NULL) { 554 /* Check if this is a user added builtin provider */ 555 if (!CRYPTO_THREAD_read_lock(store->lock)) 556 return NULL; 557 for (i = 0, p = store->provinfo; i < store->numprovinfo; p++, i++) { 558 if (strcmp(p->name, name) == 0) { 559 template = *p; 560 break; 561 } 562 } 563 CRYPTO_THREAD_unlock(store->lock); 564 } 565 } else { 566 template.init = init_function; 567 } 568 569 /* provider_new() generates an error, so no need here */ 570 if ((prov = provider_new(name, template.init, template.parameters)) == NULL) 571 return NULL; 572 573 prov->libctx = libctx; 574#ifndef FIPS_MODULE 575 prov->error_lib = ERR_get_next_error_library(); 576#endif 577 578 /* 579 * At this point, the provider is only partially "loaded". To be 580 * fully "loaded", ossl_provider_activate() must also be called and it must 581 * then be added to the provider store. 582 */ 583 584 return prov; 585} 586 587/* Assumes that the store lock is held */ 588static int create_provider_children(OSSL_PROVIDER *prov) 589{ 590 int ret = 1; 591#ifndef FIPS_MODULE 592 struct provider_store_st *store = prov->store; 593 OSSL_PROVIDER_CHILD_CB *child_cb; 594 int i, max; 595 596 max = sk_OSSL_PROVIDER_CHILD_CB_num(store->child_cbs); 597 for (i = 0; i < max; i++) { 598 /* 599 * This is newly activated (activatecnt == 1), so we need to 600 * create child providers as necessary. 601 */ 602 child_cb = sk_OSSL_PROVIDER_CHILD_CB_value(store->child_cbs, i); 603 ret &= child_cb->create_cb((OSSL_CORE_HANDLE *)prov, child_cb->cbdata); 604 } 605#endif 606 607 return ret; 608} 609 610int ossl_provider_add_to_store(OSSL_PROVIDER *prov, OSSL_PROVIDER **actualprov, 611 int retain_fallbacks) 612{ 613 struct provider_store_st *store; 614 int idx; 615 OSSL_PROVIDER tmpl = { 0, }; 616 OSSL_PROVIDER *actualtmp = NULL; 617 618 if (actualprov != NULL) 619 *actualprov = NULL; 620 621 if ((store = get_provider_store(prov->libctx)) == NULL) 622 return 0; 623 624 if (!CRYPTO_THREAD_write_lock(store->lock)) 625 return 0; 626 627 tmpl.name = (char *)prov->name; 628 idx = sk_OSSL_PROVIDER_find(store->providers, &tmpl); 629 if (idx == -1) 630 actualtmp = prov; 631 else 632 actualtmp = sk_OSSL_PROVIDER_value(store->providers, idx); 633 634 if (idx == -1) { 635 if (sk_OSSL_PROVIDER_push(store->providers, prov) == 0) 636 goto err; 637 prov->store = store; 638 if (!create_provider_children(prov)) { 639 sk_OSSL_PROVIDER_delete_ptr(store->providers, prov); 640 goto err; 641 } 642 if (!retain_fallbacks) 643 store->use_fallbacks = 0; 644 } 645 646 CRYPTO_THREAD_unlock(store->lock); 647 648 if (actualprov != NULL) { 649 if (!ossl_provider_up_ref(actualtmp)) { 650 ERR_raise(ERR_LIB_CRYPTO, ERR_R_MALLOC_FAILURE); 651 actualtmp = NULL; 652 return 0; 653 } 654 *actualprov = actualtmp; 655 } 656 657 if (idx >= 0) { 658 /* 659 * The provider is already in the store. Probably two threads 660 * independently initialised their own provider objects with the same 661 * name and raced to put them in the store. This thread lost. We 662 * deactivate the one we just created and use the one that already 663 * exists instead. 664 * If we get here then we know we did not create provider children 665 * above, so we inform ossl_provider_deactivate not to attempt to remove 666 * any. 667 */ 668 ossl_provider_deactivate(prov, 0); 669 ossl_provider_free(prov); 670 } 671 672 return 1; 673 674 err: 675 CRYPTO_THREAD_unlock(store->lock); 676 return 0; 677} 678 679void ossl_provider_free(OSSL_PROVIDER *prov) 680{ 681 if (prov != NULL) { 682 int ref = 0; 683 684 CRYPTO_DOWN_REF(&prov->refcnt, &ref, prov->refcnt_lock); 685 686 /* 687 * When the refcount drops to zero, we clean up the provider. 688 * Note that this also does teardown, which may seem late, 689 * considering that init happens on first activation. However, 690 * there may be other structures hanging on to the provider after 691 * the last deactivation and may therefore need full access to the 692 * provider's services. Therefore, we deinit late. 693 */ 694 if (ref == 0) { 695 if (prov->flag_initialized) { 696 ossl_provider_teardown(prov); 697#ifndef OPENSSL_NO_ERR 698# ifndef FIPS_MODULE 699 if (prov->error_strings != NULL) { 700 ERR_unload_strings(prov->error_lib, prov->error_strings); 701 OPENSSL_free(prov->error_strings); 702 prov->error_strings = NULL; 703 } 704# endif 705#endif 706 OPENSSL_free(prov->operation_bits); 707 prov->operation_bits = NULL; 708 prov->operation_bits_sz = 0; 709 prov->flag_initialized = 0; 710 } 711 712#ifndef FIPS_MODULE 713 /* 714 * We deregister thread handling whether or not the provider was 715 * initialized. If init was attempted but was not successful then 716 * the provider may still have registered a thread handler. 717 */ 718 ossl_init_thread_deregister(prov); 719 DSO_free(prov->module); 720#endif 721 OPENSSL_free(prov->name); 722 OPENSSL_free(prov->path); 723 sk_INFOPAIR_pop_free(prov->parameters, infopair_free); 724 CRYPTO_THREAD_lock_free(prov->opbits_lock); 725 CRYPTO_THREAD_lock_free(prov->flag_lock); 726#ifndef HAVE_ATOMICS 727 CRYPTO_THREAD_lock_free(prov->refcnt_lock); 728#endif 729 OPENSSL_free(prov); 730 } 731#ifndef FIPS_MODULE 732 else if (prov->ischild) { 733 ossl_provider_free_parent(prov, 0); 734 } 735#endif 736 } 737} 738 739/* Setters */ 740int ossl_provider_set_module_path(OSSL_PROVIDER *prov, const char *module_path) 741{ 742 OPENSSL_free(prov->path); 743 prov->path = NULL; 744 if (module_path == NULL) 745 return 1; 746 if ((prov->path = OPENSSL_strdup(module_path)) != NULL) 747 return 1; 748 ERR_raise(ERR_LIB_CRYPTO, ERR_R_MALLOC_FAILURE); 749 return 0; 750} 751 752static int infopair_add(STACK_OF(INFOPAIR) **infopairsk, const char *name, 753 const char *value) 754{ 755 INFOPAIR *pair = NULL; 756 757 if ((pair = OPENSSL_zalloc(sizeof(*pair))) != NULL 758 && (*infopairsk != NULL 759 || (*infopairsk = sk_INFOPAIR_new_null()) != NULL) 760 && (pair->name = OPENSSL_strdup(name)) != NULL 761 && (pair->value = OPENSSL_strdup(value)) != NULL 762 && sk_INFOPAIR_push(*infopairsk, pair) > 0) 763 return 1; 764 765 if (pair != NULL) { 766 OPENSSL_free(pair->name); 767 OPENSSL_free(pair->value); 768 OPENSSL_free(pair); 769 } 770 ERR_raise(ERR_LIB_CRYPTO, ERR_R_MALLOC_FAILURE); 771 return 0; 772} 773 774int ossl_provider_add_parameter(OSSL_PROVIDER *prov, 775 const char *name, const char *value) 776{ 777 return infopair_add(&prov->parameters, name, value); 778} 779 780int ossl_provider_info_add_parameter(OSSL_PROVIDER_INFO *provinfo, 781 const char *name, 782 const char *value) 783{ 784 return infopair_add(&provinfo->parameters, name, value); 785} 786 787/* 788 * Provider activation. 789 * 790 * What "activation" means depends on the provider form; for built in 791 * providers (in the library or the application alike), the provider 792 * can already be considered to be loaded, all that's needed is to 793 * initialize it. However, for dynamically loadable provider modules, 794 * we must first load that module. 795 * 796 * Built in modules are distinguished from dynamically loaded modules 797 * with an already assigned init function. 798 */ 799static const OSSL_DISPATCH *core_dispatch; /* Define further down */ 800 801int OSSL_PROVIDER_set_default_search_path(OSSL_LIB_CTX *libctx, 802 const char *path) 803{ 804 struct provider_store_st *store; 805 char *p = NULL; 806 807 if (path != NULL) { 808 p = OPENSSL_strdup(path); 809 if (p == NULL) { 810 ERR_raise(ERR_LIB_CRYPTO, ERR_R_MALLOC_FAILURE); 811 return 0; 812 } 813 } 814 if ((store = get_provider_store(libctx)) != NULL 815 && CRYPTO_THREAD_write_lock(store->default_path_lock)) { 816 OPENSSL_free(store->default_path); 817 store->default_path = p; 818 CRYPTO_THREAD_unlock(store->default_path_lock); 819 return 1; 820 } 821 OPENSSL_free(p); 822 return 0; 823} 824 825/* 826 * Internal version that doesn't affect the store flags, and thereby avoid 827 * locking. Direct callers must remember to set the store flags when 828 * appropriate. 829 */ 830static int provider_init(OSSL_PROVIDER *prov) 831{ 832 const OSSL_DISPATCH *provider_dispatch = NULL; 833 void *tmp_provctx = NULL; /* safety measure */ 834#ifndef OPENSSL_NO_ERR 835# ifndef FIPS_MODULE 836 OSSL_FUNC_provider_get_reason_strings_fn *p_get_reason_strings = NULL; 837# endif 838#endif 839 int ok = 0; 840 841 if (!ossl_assert(!prov->flag_initialized)) { 842 ERR_raise(ERR_LIB_CRYPTO, ERR_R_INTERNAL_ERROR); 843 goto end; 844 } 845 846 /* 847 * If the init function isn't set, it indicates that this provider is 848 * a loadable module. 849 */ 850 if (prov->init_function == NULL) { 851#ifdef FIPS_MODULE 852 goto end; 853#else 854 if (prov->module == NULL) { 855 char *allocated_path = NULL; 856 const char *module_path = NULL; 857 char *merged_path = NULL; 858 const char *load_dir = NULL; 859 char *allocated_load_dir = NULL; 860 struct provider_store_st *store; 861 862 if ((prov->module = DSO_new()) == NULL) { 863 /* DSO_new() generates an error already */ 864 goto end; 865 } 866 867 if ((store = get_provider_store(prov->libctx)) == NULL 868 || !CRYPTO_THREAD_read_lock(store->default_path_lock)) 869 goto end; 870 871 if (store->default_path != NULL) { 872 allocated_load_dir = OPENSSL_strdup(store->default_path); 873 CRYPTO_THREAD_unlock(store->default_path_lock); 874 if (allocated_load_dir == NULL) { 875 ERR_raise(ERR_LIB_CRYPTO, ERR_R_MALLOC_FAILURE); 876 goto end; 877 } 878 load_dir = allocated_load_dir; 879 } else { 880 CRYPTO_THREAD_unlock(store->default_path_lock); 881 } 882 883 if (load_dir == NULL) { 884 load_dir = ossl_safe_getenv("OPENSSL_MODULES"); 885 if (load_dir == NULL) 886 load_dir = MODULESDIR; 887 } 888 889 DSO_ctrl(prov->module, DSO_CTRL_SET_FLAGS, 890 DSO_FLAG_NAME_TRANSLATION_EXT_ONLY, NULL); 891 892 module_path = prov->path; 893 if (module_path == NULL) 894 module_path = allocated_path = 895 DSO_convert_filename(prov->module, prov->name); 896 if (module_path != NULL) 897 merged_path = DSO_merge(prov->module, module_path, load_dir); 898 899 if (merged_path == NULL 900 || (DSO_load(prov->module, merged_path, NULL, 0)) == NULL) { 901 DSO_free(prov->module); 902 prov->module = NULL; 903 } 904 905 OPENSSL_free(merged_path); 906 OPENSSL_free(allocated_path); 907 OPENSSL_free(allocated_load_dir); 908 } 909 910 if (prov->module == NULL) { 911 /* DSO has already recorded errors, this is just a tracepoint */ 912 ERR_raise_data(ERR_LIB_CRYPTO, ERR_R_DSO_LIB, 913 "name=%s", prov->name); 914 goto end; 915 } 916 917 prov->init_function = (OSSL_provider_init_fn *) 918 DSO_bind_func(prov->module, "OSSL_provider_init"); 919#endif 920 } 921 922 /* Check for and call the initialise function for the provider. */ 923 if (prov->init_function == NULL) { 924 ERR_raise_data(ERR_LIB_CRYPTO, ERR_R_UNSUPPORTED, 925 "name=%s, provider has no provider init function", 926 prov->name); 927 goto end; 928 } 929 930 if (!prov->init_function((OSSL_CORE_HANDLE *)prov, core_dispatch, 931 &provider_dispatch, &tmp_provctx)) { 932 ERR_raise_data(ERR_LIB_CRYPTO, ERR_R_INIT_FAIL, 933 "name=%s", prov->name); 934 goto end; 935 } 936 prov->provctx = tmp_provctx; 937 prov->dispatch = provider_dispatch; 938 939 if (provider_dispatch != NULL) { 940 for (; provider_dispatch->function_id != 0; provider_dispatch++) { 941 switch (provider_dispatch->function_id) { 942 case OSSL_FUNC_PROVIDER_TEARDOWN: 943 prov->teardown = 944 OSSL_FUNC_provider_teardown(provider_dispatch); 945 break; 946 case OSSL_FUNC_PROVIDER_GETTABLE_PARAMS: 947 prov->gettable_params = 948 OSSL_FUNC_provider_gettable_params(provider_dispatch); 949 break; 950 case OSSL_FUNC_PROVIDER_GET_PARAMS: 951 prov->get_params = 952 OSSL_FUNC_provider_get_params(provider_dispatch); 953 break; 954 case OSSL_FUNC_PROVIDER_SELF_TEST: 955 prov->self_test = 956 OSSL_FUNC_provider_self_test(provider_dispatch); 957 break; 958 case OSSL_FUNC_PROVIDER_GET_CAPABILITIES: 959 prov->get_capabilities = 960 OSSL_FUNC_provider_get_capabilities(provider_dispatch); 961 break; 962 case OSSL_FUNC_PROVIDER_QUERY_OPERATION: 963 prov->query_operation = 964 OSSL_FUNC_provider_query_operation(provider_dispatch); 965 break; 966 case OSSL_FUNC_PROVIDER_UNQUERY_OPERATION: 967 prov->unquery_operation = 968 OSSL_FUNC_provider_unquery_operation(provider_dispatch); 969 break; 970#ifndef OPENSSL_NO_ERR 971# ifndef FIPS_MODULE 972 case OSSL_FUNC_PROVIDER_GET_REASON_STRINGS: 973 p_get_reason_strings = 974 OSSL_FUNC_provider_get_reason_strings(provider_dispatch); 975 break; 976# endif 977#endif 978 } 979 } 980 } 981 982#ifndef OPENSSL_NO_ERR 983# ifndef FIPS_MODULE 984 if (p_get_reason_strings != NULL) { 985 const OSSL_ITEM *reasonstrings = p_get_reason_strings(prov->provctx); 986 size_t cnt, cnt2; 987 988 /* 989 * ERR_load_strings() handles ERR_STRING_DATA rather than OSSL_ITEM, 990 * although they are essentially the same type. 991 * Furthermore, ERR_load_strings() patches the array's error number 992 * with the error library number, so we need to make a copy of that 993 * array either way. 994 */ 995 cnt = 0; 996 while (reasonstrings[cnt].id != 0) { 997 if (ERR_GET_LIB(reasonstrings[cnt].id) != 0) 998 goto end; 999 cnt++; 1000 } 1001 cnt++; /* One for the terminating item */ 1002 1003 /* Allocate one extra item for the "library" name */ 1004 prov->error_strings = 1005 OPENSSL_zalloc(sizeof(ERR_STRING_DATA) * (cnt + 1)); 1006 if (prov->error_strings == NULL) 1007 goto end; 1008 1009 /* 1010 * Set the "library" name. 1011 */ 1012 prov->error_strings[0].error = ERR_PACK(prov->error_lib, 0, 0); 1013 prov->error_strings[0].string = prov->name; 1014 /* 1015 * Copy reasonstrings item 0..cnt-1 to prov->error_trings positions 1016 * 1..cnt. 1017 */ 1018 for (cnt2 = 1; cnt2 <= cnt; cnt2++) { 1019 prov->error_strings[cnt2].error = (int)reasonstrings[cnt2-1].id; 1020 prov->error_strings[cnt2].string = reasonstrings[cnt2-1].ptr; 1021 } 1022 1023 ERR_load_strings(prov->error_lib, prov->error_strings); 1024 } 1025# endif 1026#endif 1027 1028 /* With this flag set, this provider has become fully "loaded". */ 1029 prov->flag_initialized = 1; 1030 ok = 1; 1031 1032 end: 1033 return ok; 1034} 1035 1036/* 1037 * Deactivate a provider. If upcalls is 0 then we suppress any upcalls to a 1038 * parent provider. If removechildren is 0 then we suppress any calls to remove 1039 * child providers. 1040 * Return -1 on failure and the activation count on success 1041 */ 1042static int provider_deactivate(OSSL_PROVIDER *prov, int upcalls, 1043 int removechildren) 1044{ 1045 int count; 1046 struct provider_store_st *store; 1047#ifndef FIPS_MODULE 1048 int freeparent = 0; 1049#endif 1050 int lock = 1; 1051 1052 if (!ossl_assert(prov != NULL)) 1053 return -1; 1054 1055 /* 1056 * No need to lock if we've got no store because we've not been shared with 1057 * other threads. 1058 */ 1059 store = get_provider_store(prov->libctx); 1060 if (store == NULL) 1061 lock = 0; 1062 1063 if (lock && !CRYPTO_THREAD_read_lock(store->lock)) 1064 return -1; 1065 if (lock && !CRYPTO_THREAD_write_lock(prov->flag_lock)) { 1066 CRYPTO_THREAD_unlock(store->lock); 1067 return -1; 1068 } 1069 1070#ifndef FIPS_MODULE 1071 if (prov->activatecnt >= 2 && prov->ischild && upcalls) { 1072 /* 1073 * We have had a direct activation in this child libctx so we need to 1074 * now down the ref count in the parent provider. We do the actual down 1075 * ref outside of the flag_lock, since it could involve getting other 1076 * locks. 1077 */ 1078 freeparent = 1; 1079 } 1080#endif 1081 1082 if ((count = --prov->activatecnt) < 1) 1083 prov->flag_activated = 0; 1084#ifndef FIPS_MODULE 1085 else 1086 removechildren = 0; 1087#endif 1088 1089#ifndef FIPS_MODULE 1090 if (removechildren && store != NULL) { 1091 int i, max = sk_OSSL_PROVIDER_CHILD_CB_num(store->child_cbs); 1092 OSSL_PROVIDER_CHILD_CB *child_cb; 1093 1094 for (i = 0; i < max; i++) { 1095 child_cb = sk_OSSL_PROVIDER_CHILD_CB_value(store->child_cbs, i); 1096 child_cb->remove_cb((OSSL_CORE_HANDLE *)prov, child_cb->cbdata); 1097 } 1098 } 1099#endif 1100 if (lock) { 1101 CRYPTO_THREAD_unlock(prov->flag_lock); 1102 CRYPTO_THREAD_unlock(store->lock); 1103 } 1104#ifndef FIPS_MODULE 1105 if (freeparent) 1106 ossl_provider_free_parent(prov, 1); 1107#endif 1108 1109 /* We don't deinit here, that's done in ossl_provider_free() */ 1110 return count; 1111} 1112 1113/* 1114 * Activate a provider. 1115 * Return -1 on failure and the activation count on success 1116 */ 1117static int provider_activate(OSSL_PROVIDER *prov, int lock, int upcalls) 1118{ 1119 int count = -1; 1120 struct provider_store_st *store; 1121 int ret = 1; 1122 1123 store = prov->store; 1124 /* 1125 * If the provider hasn't been added to the store, then we don't need 1126 * any locks because we've not shared it with other threads. 1127 */ 1128 if (store == NULL) { 1129 lock = 0; 1130 if (!provider_init(prov)) 1131 return -1; 1132 } 1133 1134#ifndef FIPS_MODULE 1135 if (prov->ischild && upcalls && !ossl_provider_up_ref_parent(prov, 1)) 1136 return -1; 1137#endif 1138 1139 if (lock && !CRYPTO_THREAD_read_lock(store->lock)) { 1140#ifndef FIPS_MODULE 1141 if (prov->ischild && upcalls) 1142 ossl_provider_free_parent(prov, 1); 1143#endif 1144 return -1; 1145 } 1146 1147 if (lock && !CRYPTO_THREAD_write_lock(prov->flag_lock)) { 1148 CRYPTO_THREAD_unlock(store->lock); 1149#ifndef FIPS_MODULE 1150 if (prov->ischild && upcalls) 1151 ossl_provider_free_parent(prov, 1); 1152#endif 1153 return -1; 1154 } 1155 1156 count = ++prov->activatecnt; 1157 prov->flag_activated = 1; 1158 1159 if (prov->activatecnt == 1 && store != NULL) { 1160 ret = create_provider_children(prov); 1161 } 1162 if (lock) { 1163 CRYPTO_THREAD_unlock(prov->flag_lock); 1164 CRYPTO_THREAD_unlock(store->lock); 1165 } 1166 1167 if (!ret) 1168 return -1; 1169 1170 return count; 1171} 1172 1173static int provider_flush_store_cache(const OSSL_PROVIDER *prov) 1174{ 1175 struct provider_store_st *store; 1176 int freeing; 1177 1178 if ((store = get_provider_store(prov->libctx)) == NULL) 1179 return 0; 1180 1181 if (!CRYPTO_THREAD_read_lock(store->lock)) 1182 return 0; 1183 freeing = store->freeing; 1184 CRYPTO_THREAD_unlock(store->lock); 1185 1186 if (!freeing) { 1187 int acc 1188 = evp_method_store_cache_flush(prov->libctx) 1189#ifndef FIPS_MODULE 1190 + ossl_encoder_store_cache_flush(prov->libctx) 1191 + ossl_decoder_store_cache_flush(prov->libctx) 1192 + ossl_store_loader_store_cache_flush(prov->libctx) 1193#endif 1194 ; 1195 1196#ifndef FIPS_MODULE 1197 return acc == 4; 1198#else 1199 return acc == 1; 1200#endif 1201 } 1202 return 1; 1203} 1204 1205static int provider_remove_store_methods(OSSL_PROVIDER *prov) 1206{ 1207 struct provider_store_st *store; 1208 int freeing; 1209 1210 if ((store = get_provider_store(prov->libctx)) == NULL) 1211 return 0; 1212 1213 if (!CRYPTO_THREAD_read_lock(store->lock)) 1214 return 0; 1215 freeing = store->freeing; 1216 CRYPTO_THREAD_unlock(store->lock); 1217 1218 if (!freeing) { 1219 int acc; 1220 1221 if (!CRYPTO_THREAD_write_lock(prov->opbits_lock)) 1222 return 0; 1223 OPENSSL_free(prov->operation_bits); 1224 prov->operation_bits = NULL; 1225 prov->operation_bits_sz = 0; 1226 CRYPTO_THREAD_unlock(prov->opbits_lock); 1227 1228 acc = evp_method_store_remove_all_provided(prov) 1229#ifndef FIPS_MODULE 1230 + ossl_encoder_store_remove_all_provided(prov) 1231 + ossl_decoder_store_remove_all_provided(prov) 1232 + ossl_store_loader_store_remove_all_provided(prov) 1233#endif 1234 ; 1235 1236#ifndef FIPS_MODULE 1237 return acc == 4; 1238#else 1239 return acc == 1; 1240#endif 1241 } 1242 return 1; 1243} 1244 1245int ossl_provider_activate(OSSL_PROVIDER *prov, int upcalls, int aschild) 1246{ 1247 int count; 1248 1249 if (prov == NULL) 1250 return 0; 1251#ifndef FIPS_MODULE 1252 /* 1253 * If aschild is true, then we only actually do the activation if the 1254 * provider is a child. If its not, this is still success. 1255 */ 1256 if (aschild && !prov->ischild) 1257 return 1; 1258#endif 1259 if ((count = provider_activate(prov, 1, upcalls)) > 0) 1260 return count == 1 ? provider_flush_store_cache(prov) : 1; 1261 1262 return 0; 1263} 1264 1265int ossl_provider_deactivate(OSSL_PROVIDER *prov, int removechildren) 1266{ 1267 int count; 1268 1269 if (prov == NULL 1270 || (count = provider_deactivate(prov, 1, removechildren)) < 0) 1271 return 0; 1272 return count == 0 ? provider_remove_store_methods(prov) : 1; 1273} 1274 1275void *ossl_provider_ctx(const OSSL_PROVIDER *prov) 1276{ 1277 return prov != NULL ? prov->provctx : NULL; 1278} 1279 1280/* 1281 * This function only does something once when store->use_fallbacks == 1, 1282 * and then sets store->use_fallbacks = 0, so the second call and so on is 1283 * effectively a no-op. 1284 */ 1285static int provider_activate_fallbacks(struct provider_store_st *store) 1286{ 1287 int use_fallbacks; 1288 int activated_fallback_count = 0; 1289 int ret = 0; 1290 const OSSL_PROVIDER_INFO *p; 1291 1292 if (!CRYPTO_THREAD_read_lock(store->lock)) 1293 return 0; 1294 use_fallbacks = store->use_fallbacks; 1295 CRYPTO_THREAD_unlock(store->lock); 1296 if (!use_fallbacks) 1297 return 1; 1298 1299 if (!CRYPTO_THREAD_write_lock(store->lock)) 1300 return 0; 1301 /* Check again, just in case another thread changed it */ 1302 use_fallbacks = store->use_fallbacks; 1303 if (!use_fallbacks) { 1304 CRYPTO_THREAD_unlock(store->lock); 1305 return 1; 1306 } 1307 1308 for (p = ossl_predefined_providers; p->name != NULL; p++) { 1309 OSSL_PROVIDER *prov = NULL; 1310 1311 if (!p->is_fallback) 1312 continue; 1313 /* 1314 * We use the internal constructor directly here, 1315 * otherwise we get a call loop 1316 */ 1317 prov = provider_new(p->name, p->init, NULL); 1318 if (prov == NULL) 1319 goto err; 1320 prov->libctx = store->libctx; 1321#ifndef FIPS_MODULE 1322 prov->error_lib = ERR_get_next_error_library(); 1323#endif 1324 1325 /* 1326 * We are calling provider_activate while holding the store lock. This 1327 * means the init function will be called while holding a lock. Normally 1328 * we try to avoid calling a user callback while holding a lock. 1329 * However, fallbacks are never third party providers so we accept this. 1330 */ 1331 if (provider_activate(prov, 0, 0) < 0) { 1332 ossl_provider_free(prov); 1333 goto err; 1334 } 1335 prov->store = store; 1336 if (sk_OSSL_PROVIDER_push(store->providers, prov) == 0) { 1337 ossl_provider_free(prov); 1338 goto err; 1339 } 1340 activated_fallback_count++; 1341 } 1342 1343 if (activated_fallback_count > 0) { 1344 store->use_fallbacks = 0; 1345 ret = 1; 1346 } 1347 err: 1348 CRYPTO_THREAD_unlock(store->lock); 1349 return ret; 1350} 1351 1352int ossl_provider_doall_activated(OSSL_LIB_CTX *ctx, 1353 int (*cb)(OSSL_PROVIDER *provider, 1354 void *cbdata), 1355 void *cbdata) 1356{ 1357 int ret = 0, curr, max, ref = 0; 1358 struct provider_store_st *store = get_provider_store(ctx); 1359 STACK_OF(OSSL_PROVIDER) *provs = NULL; 1360 1361#if !defined(FIPS_MODULE) && !defined(OPENSSL_NO_AUTOLOAD_CONFIG) 1362 /* 1363 * Make sure any providers are loaded from config before we try to use 1364 * them. 1365 */ 1366 if (ossl_lib_ctx_is_default(ctx)) 1367 OPENSSL_init_crypto(OPENSSL_INIT_LOAD_CONFIG, NULL); 1368#endif 1369 1370 if (store == NULL) 1371 return 1; 1372 if (!provider_activate_fallbacks(store)) 1373 return 0; 1374 1375 /* 1376 * Under lock, grab a copy of the provider list and up_ref each 1377 * provider so that they don't disappear underneath us. 1378 */ 1379 if (!CRYPTO_THREAD_read_lock(store->lock)) 1380 return 0; 1381 provs = sk_OSSL_PROVIDER_dup(store->providers); 1382 if (provs == NULL) { 1383 CRYPTO_THREAD_unlock(store->lock); 1384 return 0; 1385 } 1386 max = sk_OSSL_PROVIDER_num(provs); 1387 /* 1388 * We work backwards through the stack so that we can safely delete items 1389 * as we go. 1390 */ 1391 for (curr = max - 1; curr >= 0; curr--) { 1392 OSSL_PROVIDER *prov = sk_OSSL_PROVIDER_value(provs, curr); 1393 1394 if (!CRYPTO_THREAD_write_lock(prov->flag_lock)) 1395 goto err_unlock; 1396 if (prov->flag_activated) { 1397 /* 1398 * We call CRYPTO_UP_REF directly rather than ossl_provider_up_ref 1399 * to avoid upping the ref count on the parent provider, which we 1400 * must not do while holding locks. 1401 */ 1402 if (CRYPTO_UP_REF(&prov->refcnt, &ref, prov->refcnt_lock) <= 0) { 1403 CRYPTO_THREAD_unlock(prov->flag_lock); 1404 goto err_unlock; 1405 } 1406 /* 1407 * It's already activated, but we up the activated count to ensure 1408 * it remains activated until after we've called the user callback. 1409 * We do this with no locking (because we already hold the locks) 1410 * and no upcalls (which must not be called when locks are held). In 1411 * theory this could mean the parent provider goes inactive, whilst 1412 * still activated in the child for a short period. That's ok. 1413 */ 1414 if (provider_activate(prov, 0, 0) < 0) { 1415 CRYPTO_DOWN_REF(&prov->refcnt, &ref, prov->refcnt_lock); 1416 CRYPTO_THREAD_unlock(prov->flag_lock); 1417 goto err_unlock; 1418 } 1419 } else { 1420 sk_OSSL_PROVIDER_delete(provs, curr); 1421 max--; 1422 } 1423 CRYPTO_THREAD_unlock(prov->flag_lock); 1424 } 1425 CRYPTO_THREAD_unlock(store->lock); 1426 1427 /* 1428 * Now, we sweep through all providers not under lock 1429 */ 1430 for (curr = 0; curr < max; curr++) { 1431 OSSL_PROVIDER *prov = sk_OSSL_PROVIDER_value(provs, curr); 1432 1433 if (!cb(prov, cbdata)) { 1434 curr = -1; 1435 goto finish; 1436 } 1437 } 1438 curr = -1; 1439 1440 ret = 1; 1441 goto finish; 1442 1443 err_unlock: 1444 CRYPTO_THREAD_unlock(store->lock); 1445 finish: 1446 /* 1447 * The pop_free call doesn't do what we want on an error condition. We 1448 * either start from the first item in the stack, or part way through if 1449 * we only processed some of the items. 1450 */ 1451 for (curr++; curr < max; curr++) { 1452 OSSL_PROVIDER *prov = sk_OSSL_PROVIDER_value(provs, curr); 1453 1454 provider_deactivate(prov, 0, 1); 1455 /* 1456 * As above where we did the up-ref, we don't call ossl_provider_free 1457 * to avoid making upcalls. There should always be at least one ref 1458 * to the provider in the store, so this should never drop to 0. 1459 */ 1460 CRYPTO_DOWN_REF(&prov->refcnt, &ref, prov->refcnt_lock); 1461 /* 1462 * Not much we can do if this assert ever fails. So we don't use 1463 * ossl_assert here. 1464 */ 1465 assert(ref > 0); 1466 } 1467 sk_OSSL_PROVIDER_free(provs); 1468 return ret; 1469} 1470 1471int OSSL_PROVIDER_available(OSSL_LIB_CTX *libctx, const char *name) 1472{ 1473 OSSL_PROVIDER *prov = NULL; 1474 int available = 0; 1475 struct provider_store_st *store = get_provider_store(libctx); 1476 1477 if (store == NULL || !provider_activate_fallbacks(store)) 1478 return 0; 1479 1480 prov = ossl_provider_find(libctx, name, 0); 1481 if (prov != NULL) { 1482 if (!CRYPTO_THREAD_read_lock(prov->flag_lock)) 1483 return 0; 1484 available = prov->flag_activated; 1485 CRYPTO_THREAD_unlock(prov->flag_lock); 1486 ossl_provider_free(prov); 1487 } 1488 return available; 1489} 1490 1491/* Setters of Provider Object data */ 1492int ossl_provider_set_fallback(OSSL_PROVIDER *prov) 1493{ 1494 if (prov == NULL) 1495 return 0; 1496 1497 prov->flag_fallback = 1; 1498 return 1; 1499} 1500 1501/* Getters of Provider Object data */ 1502const char *ossl_provider_name(const OSSL_PROVIDER *prov) 1503{ 1504 return prov->name; 1505} 1506 1507const DSO *ossl_provider_dso(const OSSL_PROVIDER *prov) 1508{ 1509 return prov->module; 1510} 1511 1512const char *ossl_provider_module_name(const OSSL_PROVIDER *prov) 1513{ 1514#ifdef FIPS_MODULE 1515 return NULL; 1516#else 1517 return DSO_get_filename(prov->module); 1518#endif 1519} 1520 1521const char *ossl_provider_module_path(const OSSL_PROVIDER *prov) 1522{ 1523#ifdef FIPS_MODULE 1524 return NULL; 1525#else 1526 /* FIXME: Ensure it's a full path */ 1527 return DSO_get_filename(prov->module); 1528#endif 1529} 1530 1531void *ossl_provider_prov_ctx(const OSSL_PROVIDER *prov) 1532{ 1533 if (prov != NULL) 1534 return prov->provctx; 1535 1536 return NULL; 1537} 1538 1539const OSSL_DISPATCH *ossl_provider_get0_dispatch(const OSSL_PROVIDER *prov) 1540{ 1541 if (prov != NULL) 1542 return prov->dispatch; 1543 1544 return NULL; 1545} 1546 1547OSSL_LIB_CTX *ossl_provider_libctx(const OSSL_PROVIDER *prov) 1548{ 1549 return prov != NULL ? prov->libctx : NULL; 1550} 1551 1552/* Wrappers around calls to the provider */ 1553void ossl_provider_teardown(const OSSL_PROVIDER *prov) 1554{ 1555 if (prov->teardown != NULL 1556#ifndef FIPS_MODULE 1557 && !prov->ischild 1558#endif 1559 ) 1560 prov->teardown(prov->provctx); 1561} 1562 1563const OSSL_PARAM *ossl_provider_gettable_params(const OSSL_PROVIDER *prov) 1564{ 1565 return prov->gettable_params == NULL 1566 ? NULL : prov->gettable_params(prov->provctx); 1567} 1568 1569int ossl_provider_get_params(const OSSL_PROVIDER *prov, OSSL_PARAM params[]) 1570{ 1571 return prov->get_params == NULL 1572 ? 0 : prov->get_params(prov->provctx, params); 1573} 1574 1575int ossl_provider_self_test(const OSSL_PROVIDER *prov) 1576{ 1577 int ret; 1578 1579 if (prov->self_test == NULL) 1580 return 1; 1581 ret = prov->self_test(prov->provctx); 1582 if (ret == 0) 1583 (void)provider_remove_store_methods((OSSL_PROVIDER *)prov); 1584 return ret; 1585} 1586 1587int ossl_provider_get_capabilities(const OSSL_PROVIDER *prov, 1588 const char *capability, 1589 OSSL_CALLBACK *cb, 1590 void *arg) 1591{ 1592 return prov->get_capabilities == NULL 1593 ? 1 : prov->get_capabilities(prov->provctx, capability, cb, arg); 1594} 1595 1596const OSSL_ALGORITHM *ossl_provider_query_operation(const OSSL_PROVIDER *prov, 1597 int operation_id, 1598 int *no_cache) 1599{ 1600 const OSSL_ALGORITHM *res; 1601 1602 if (prov->query_operation == NULL) 1603 return NULL; 1604 res = prov->query_operation(prov->provctx, operation_id, no_cache); 1605#if defined(OPENSSL_NO_CACHED_FETCH) 1606 /* Forcing the non-caching of queries */ 1607 if (no_cache != NULL) 1608 *no_cache = 1; 1609#endif 1610 return res; 1611} 1612 1613void ossl_provider_unquery_operation(const OSSL_PROVIDER *prov, 1614 int operation_id, 1615 const OSSL_ALGORITHM *algs) 1616{ 1617 if (prov->unquery_operation != NULL) 1618 prov->unquery_operation(prov->provctx, operation_id, algs); 1619} 1620 1621int ossl_provider_set_operation_bit(OSSL_PROVIDER *provider, size_t bitnum) 1622{ 1623 size_t byte = bitnum / 8; 1624 unsigned char bit = (1 << (bitnum % 8)) & 0xFF; 1625 1626 if (!CRYPTO_THREAD_write_lock(provider->opbits_lock)) 1627 return 0; 1628 if (provider->operation_bits_sz <= byte) { 1629 unsigned char *tmp = OPENSSL_realloc(provider->operation_bits, 1630 byte + 1); 1631 1632 if (tmp == NULL) { 1633 CRYPTO_THREAD_unlock(provider->opbits_lock); 1634 ERR_raise(ERR_LIB_CRYPTO, ERR_R_MALLOC_FAILURE); 1635 return 0; 1636 } 1637 provider->operation_bits = tmp; 1638 memset(provider->operation_bits + provider->operation_bits_sz, 1639 '\0', byte + 1 - provider->operation_bits_sz); 1640 provider->operation_bits_sz = byte + 1; 1641 } 1642 provider->operation_bits[byte] |= bit; 1643 CRYPTO_THREAD_unlock(provider->opbits_lock); 1644 return 1; 1645} 1646 1647int ossl_provider_test_operation_bit(OSSL_PROVIDER *provider, size_t bitnum, 1648 int *result) 1649{ 1650 size_t byte = bitnum / 8; 1651 unsigned char bit = (1 << (bitnum % 8)) & 0xFF; 1652 1653 if (!ossl_assert(result != NULL)) { 1654 ERR_raise(ERR_LIB_CRYPTO, ERR_R_PASSED_NULL_PARAMETER); 1655 return 0; 1656 } 1657 1658 *result = 0; 1659 if (!CRYPTO_THREAD_read_lock(provider->opbits_lock)) 1660 return 0; 1661 if (provider->operation_bits_sz > byte) 1662 *result = ((provider->operation_bits[byte] & bit) != 0); 1663 CRYPTO_THREAD_unlock(provider->opbits_lock); 1664 return 1; 1665} 1666 1667#ifndef FIPS_MODULE 1668const OSSL_CORE_HANDLE *ossl_provider_get_parent(OSSL_PROVIDER *prov) 1669{ 1670 return prov->handle; 1671} 1672 1673int ossl_provider_is_child(const OSSL_PROVIDER *prov) 1674{ 1675 return prov->ischild; 1676} 1677 1678int ossl_provider_set_child(OSSL_PROVIDER *prov, const OSSL_CORE_HANDLE *handle) 1679{ 1680 prov->handle = handle; 1681 prov->ischild = 1; 1682 1683 return 1; 1684} 1685 1686int ossl_provider_default_props_update(OSSL_LIB_CTX *libctx, const char *props) 1687{ 1688#ifndef FIPS_MODULE 1689 struct provider_store_st *store = NULL; 1690 int i, max; 1691 OSSL_PROVIDER_CHILD_CB *child_cb; 1692 1693 if ((store = get_provider_store(libctx)) == NULL) 1694 return 0; 1695 1696 if (!CRYPTO_THREAD_read_lock(store->lock)) 1697 return 0; 1698 1699 max = sk_OSSL_PROVIDER_CHILD_CB_num(store->child_cbs); 1700 for (i = 0; i < max; i++) { 1701 child_cb = sk_OSSL_PROVIDER_CHILD_CB_value(store->child_cbs, i); 1702 child_cb->global_props_cb(props, child_cb->cbdata); 1703 } 1704 1705 CRYPTO_THREAD_unlock(store->lock); 1706#endif 1707 return 1; 1708} 1709 1710static int ossl_provider_register_child_cb(const OSSL_CORE_HANDLE *handle, 1711 int (*create_cb)( 1712 const OSSL_CORE_HANDLE *provider, 1713 void *cbdata), 1714 int (*remove_cb)( 1715 const OSSL_CORE_HANDLE *provider, 1716 void *cbdata), 1717 int (*global_props_cb)( 1718 const char *props, 1719 void *cbdata), 1720 void *cbdata) 1721{ 1722 /* 1723 * This is really an OSSL_PROVIDER that we created and cast to 1724 * OSSL_CORE_HANDLE originally. Therefore it is safe to cast it back. 1725 */ 1726 OSSL_PROVIDER *thisprov = (OSSL_PROVIDER *)handle; 1727 OSSL_PROVIDER *prov; 1728 OSSL_LIB_CTX *libctx = thisprov->libctx; 1729 struct provider_store_st *store = NULL; 1730 int ret = 0, i, max; 1731 OSSL_PROVIDER_CHILD_CB *child_cb; 1732 char *propsstr = NULL; 1733 1734 if ((store = get_provider_store(libctx)) == NULL) 1735 return 0; 1736 1737 child_cb = OPENSSL_malloc(sizeof(*child_cb)); 1738 if (child_cb == NULL) 1739 return 0; 1740 child_cb->prov = thisprov; 1741 child_cb->create_cb = create_cb; 1742 child_cb->remove_cb = remove_cb; 1743 child_cb->global_props_cb = global_props_cb; 1744 child_cb->cbdata = cbdata; 1745 1746 if (!CRYPTO_THREAD_write_lock(store->lock)) { 1747 OPENSSL_free(child_cb); 1748 return 0; 1749 } 1750 propsstr = evp_get_global_properties_str(libctx, 0); 1751 1752 if (propsstr != NULL) { 1753 global_props_cb(propsstr, cbdata); 1754 OPENSSL_free(propsstr); 1755 } 1756 max = sk_OSSL_PROVIDER_num(store->providers); 1757 for (i = 0; i < max; i++) { 1758 int activated; 1759 1760 prov = sk_OSSL_PROVIDER_value(store->providers, i); 1761 1762 if (!CRYPTO_THREAD_read_lock(prov->flag_lock)) 1763 break; 1764 activated = prov->flag_activated; 1765 CRYPTO_THREAD_unlock(prov->flag_lock); 1766 /* 1767 * We hold the store lock while calling the user callback. This means 1768 * that the user callback must be short and simple and not do anything 1769 * likely to cause a deadlock. We don't hold the flag_lock during this 1770 * call. In theory this means that another thread could deactivate it 1771 * while we are calling create. This is ok because the other thread 1772 * will also call remove_cb, but won't be able to do so until we release 1773 * the store lock. 1774 */ 1775 if (activated && !create_cb((OSSL_CORE_HANDLE *)prov, cbdata)) 1776 break; 1777 } 1778 if (i == max) { 1779 /* Success */ 1780 ret = sk_OSSL_PROVIDER_CHILD_CB_push(store->child_cbs, child_cb); 1781 } 1782 if (i != max || ret <= 0) { 1783 /* Failed during creation. Remove everything we just added */ 1784 for (; i >= 0; i--) { 1785 prov = sk_OSSL_PROVIDER_value(store->providers, i); 1786 remove_cb((OSSL_CORE_HANDLE *)prov, cbdata); 1787 } 1788 OPENSSL_free(child_cb); 1789 ret = 0; 1790 } 1791 CRYPTO_THREAD_unlock(store->lock); 1792 1793 return ret; 1794} 1795 1796static void ossl_provider_deregister_child_cb(const OSSL_CORE_HANDLE *handle) 1797{ 1798 /* 1799 * This is really an OSSL_PROVIDER that we created and cast to 1800 * OSSL_CORE_HANDLE originally. Therefore it is safe to cast it back. 1801 */ 1802 OSSL_PROVIDER *thisprov = (OSSL_PROVIDER *)handle; 1803 OSSL_LIB_CTX *libctx = thisprov->libctx; 1804 struct provider_store_st *store = NULL; 1805 int i, max; 1806 OSSL_PROVIDER_CHILD_CB *child_cb; 1807 1808 if ((store = get_provider_store(libctx)) == NULL) 1809 return; 1810 1811 if (!CRYPTO_THREAD_write_lock(store->lock)) 1812 return; 1813 max = sk_OSSL_PROVIDER_CHILD_CB_num(store->child_cbs); 1814 for (i = 0; i < max; i++) { 1815 child_cb = sk_OSSL_PROVIDER_CHILD_CB_value(store->child_cbs, i); 1816 if (child_cb->prov == thisprov) { 1817 /* Found an entry */ 1818 sk_OSSL_PROVIDER_CHILD_CB_delete(store->child_cbs, i); 1819 OPENSSL_free(child_cb); 1820 break; 1821 } 1822 } 1823 CRYPTO_THREAD_unlock(store->lock); 1824} 1825#endif 1826 1827/*- 1828 * Core functions for the provider 1829 * =============================== 1830 * 1831 * This is the set of functions that the core makes available to the provider 1832 */ 1833 1834/* 1835 * This returns a list of Provider Object parameters with their types, for 1836 * discovery. We do not expect that many providers will use this, but one 1837 * never knows. 1838 */ 1839static const OSSL_PARAM param_types[] = { 1840 OSSL_PARAM_DEFN(OSSL_PROV_PARAM_CORE_VERSION, OSSL_PARAM_UTF8_PTR, NULL, 0), 1841 OSSL_PARAM_DEFN(OSSL_PROV_PARAM_CORE_PROV_NAME, OSSL_PARAM_UTF8_PTR, 1842 NULL, 0), 1843#ifndef FIPS_MODULE 1844 OSSL_PARAM_DEFN(OSSL_PROV_PARAM_CORE_MODULE_FILENAME, OSSL_PARAM_UTF8_PTR, 1845 NULL, 0), 1846#endif 1847 OSSL_PARAM_END 1848}; 1849 1850/* 1851 * Forward declare all the functions that are provided aa dispatch. 1852 * This ensures that the compiler will complain if they aren't defined 1853 * with the correct signature. 1854 */ 1855static OSSL_FUNC_core_gettable_params_fn core_gettable_params; 1856static OSSL_FUNC_core_get_params_fn core_get_params; 1857static OSSL_FUNC_core_get_libctx_fn core_get_libctx; 1858static OSSL_FUNC_core_thread_start_fn core_thread_start; 1859#ifndef FIPS_MODULE 1860static OSSL_FUNC_core_new_error_fn core_new_error; 1861static OSSL_FUNC_core_set_error_debug_fn core_set_error_debug; 1862static OSSL_FUNC_core_vset_error_fn core_vset_error; 1863static OSSL_FUNC_core_set_error_mark_fn core_set_error_mark; 1864static OSSL_FUNC_core_clear_last_error_mark_fn core_clear_last_error_mark; 1865static OSSL_FUNC_core_pop_error_to_mark_fn core_pop_error_to_mark; 1866OSSL_FUNC_BIO_new_file_fn ossl_core_bio_new_file; 1867OSSL_FUNC_BIO_new_membuf_fn ossl_core_bio_new_mem_buf; 1868OSSL_FUNC_BIO_read_ex_fn ossl_core_bio_read_ex; 1869OSSL_FUNC_BIO_write_ex_fn ossl_core_bio_write_ex; 1870OSSL_FUNC_BIO_gets_fn ossl_core_bio_gets; 1871OSSL_FUNC_BIO_puts_fn ossl_core_bio_puts; 1872OSSL_FUNC_BIO_up_ref_fn ossl_core_bio_up_ref; 1873OSSL_FUNC_BIO_free_fn ossl_core_bio_free; 1874OSSL_FUNC_BIO_vprintf_fn ossl_core_bio_vprintf; 1875OSSL_FUNC_BIO_vsnprintf_fn BIO_vsnprintf; 1876static OSSL_FUNC_self_test_cb_fn core_self_test_get_callback; 1877OSSL_FUNC_get_entropy_fn ossl_rand_get_entropy; 1878OSSL_FUNC_cleanup_entropy_fn ossl_rand_cleanup_entropy; 1879OSSL_FUNC_get_nonce_fn ossl_rand_get_nonce; 1880OSSL_FUNC_cleanup_nonce_fn ossl_rand_cleanup_nonce; 1881#endif 1882OSSL_FUNC_CRYPTO_malloc_fn CRYPTO_malloc; 1883OSSL_FUNC_CRYPTO_zalloc_fn CRYPTO_zalloc; 1884OSSL_FUNC_CRYPTO_free_fn CRYPTO_free; 1885OSSL_FUNC_CRYPTO_clear_free_fn CRYPTO_clear_free; 1886OSSL_FUNC_CRYPTO_realloc_fn CRYPTO_realloc; 1887OSSL_FUNC_CRYPTO_clear_realloc_fn CRYPTO_clear_realloc; 1888OSSL_FUNC_CRYPTO_secure_malloc_fn CRYPTO_secure_malloc; 1889OSSL_FUNC_CRYPTO_secure_zalloc_fn CRYPTO_secure_zalloc; 1890OSSL_FUNC_CRYPTO_secure_free_fn CRYPTO_secure_free; 1891OSSL_FUNC_CRYPTO_secure_clear_free_fn CRYPTO_secure_clear_free; 1892OSSL_FUNC_CRYPTO_secure_allocated_fn CRYPTO_secure_allocated; 1893OSSL_FUNC_OPENSSL_cleanse_fn OPENSSL_cleanse; 1894#ifndef FIPS_MODULE 1895OSSL_FUNC_provider_register_child_cb_fn ossl_provider_register_child_cb; 1896OSSL_FUNC_provider_deregister_child_cb_fn ossl_provider_deregister_child_cb; 1897static OSSL_FUNC_provider_name_fn core_provider_get0_name; 1898static OSSL_FUNC_provider_get0_provider_ctx_fn core_provider_get0_provider_ctx; 1899static OSSL_FUNC_provider_get0_dispatch_fn core_provider_get0_dispatch; 1900static OSSL_FUNC_provider_up_ref_fn core_provider_up_ref_intern; 1901static OSSL_FUNC_provider_free_fn core_provider_free_intern; 1902static OSSL_FUNC_core_obj_add_sigid_fn core_obj_add_sigid; 1903static OSSL_FUNC_core_obj_create_fn core_obj_create; 1904#endif 1905 1906static const OSSL_PARAM *core_gettable_params(const OSSL_CORE_HANDLE *handle) 1907{ 1908 return param_types; 1909} 1910 1911static int core_get_params(const OSSL_CORE_HANDLE *handle, OSSL_PARAM params[]) 1912{ 1913 int i; 1914 OSSL_PARAM *p; 1915 /* 1916 * We created this object originally and we know it is actually an 1917 * OSSL_PROVIDER *, so the cast is safe 1918 */ 1919 OSSL_PROVIDER *prov = (OSSL_PROVIDER *)handle; 1920 1921 if ((p = OSSL_PARAM_locate(params, OSSL_PROV_PARAM_CORE_VERSION)) != NULL) 1922 OSSL_PARAM_set_utf8_ptr(p, OPENSSL_VERSION_STR); 1923 if ((p = OSSL_PARAM_locate(params, OSSL_PROV_PARAM_CORE_PROV_NAME)) != NULL) 1924 OSSL_PARAM_set_utf8_ptr(p, prov->name); 1925 1926#ifndef FIPS_MODULE 1927 if ((p = OSSL_PARAM_locate(params, 1928 OSSL_PROV_PARAM_CORE_MODULE_FILENAME)) != NULL) 1929 OSSL_PARAM_set_utf8_ptr(p, ossl_provider_module_path(prov)); 1930#endif 1931 1932 if (prov->parameters == NULL) 1933 return 1; 1934 1935 for (i = 0; i < sk_INFOPAIR_num(prov->parameters); i++) { 1936 INFOPAIR *pair = sk_INFOPAIR_value(prov->parameters, i); 1937 1938 if ((p = OSSL_PARAM_locate(params, pair->name)) != NULL) 1939 OSSL_PARAM_set_utf8_ptr(p, pair->value); 1940 } 1941 return 1; 1942} 1943 1944static OPENSSL_CORE_CTX *core_get_libctx(const OSSL_CORE_HANDLE *handle) 1945{ 1946 /* 1947 * We created this object originally and we know it is actually an 1948 * OSSL_PROVIDER *, so the cast is safe 1949 */ 1950 OSSL_PROVIDER *prov = (OSSL_PROVIDER *)handle; 1951 1952 /* 1953 * Using ossl_provider_libctx would be wrong as that returns 1954 * NULL for |prov| == NULL and NULL libctx has a special meaning 1955 * that does not apply here. Here |prov| == NULL can happen only in 1956 * case of a coding error. 1957 */ 1958 assert(prov != NULL); 1959 return (OPENSSL_CORE_CTX *)prov->libctx; 1960} 1961 1962static int core_thread_start(const OSSL_CORE_HANDLE *handle, 1963 OSSL_thread_stop_handler_fn handfn, 1964 void *arg) 1965{ 1966 /* 1967 * We created this object originally and we know it is actually an 1968 * OSSL_PROVIDER *, so the cast is safe 1969 */ 1970 OSSL_PROVIDER *prov = (OSSL_PROVIDER *)handle; 1971 1972 return ossl_init_thread_start(prov, arg, handfn); 1973} 1974 1975/* 1976 * The FIPS module inner provider doesn't implement these. They aren't 1977 * needed there, since the FIPS module upcalls are always the outer provider 1978 * ones. 1979 */ 1980#ifndef FIPS_MODULE 1981/* 1982 * These error functions should use |handle| to select the proper 1983 * library context to report in the correct error stack if error 1984 * stacks become tied to the library context. 1985 * We cannot currently do that since there's no support for it in the 1986 * ERR subsystem. 1987 */ 1988static void core_new_error(const OSSL_CORE_HANDLE *handle) 1989{ 1990 ERR_new(); 1991} 1992 1993static void core_set_error_debug(const OSSL_CORE_HANDLE *handle, 1994 const char *file, int line, const char *func) 1995{ 1996 ERR_set_debug(file, line, func); 1997} 1998 1999static void core_vset_error(const OSSL_CORE_HANDLE *handle, 2000 uint32_t reason, const char *fmt, va_list args) 2001{ 2002 /* 2003 * We created this object originally and we know it is actually an 2004 * OSSL_PROVIDER *, so the cast is safe 2005 */ 2006 OSSL_PROVIDER *prov = (OSSL_PROVIDER *)handle; 2007 2008 /* 2009 * If the uppermost 8 bits are non-zero, it's an OpenSSL library 2010 * error and will be treated as such. Otherwise, it's a new style 2011 * provider error and will be treated as such. 2012 */ 2013 if (ERR_GET_LIB(reason) != 0) { 2014 ERR_vset_error(ERR_GET_LIB(reason), ERR_GET_REASON(reason), fmt, args); 2015 } else { 2016 ERR_vset_error(prov->error_lib, (int)reason, fmt, args); 2017 } 2018} 2019 2020static int core_set_error_mark(const OSSL_CORE_HANDLE *handle) 2021{ 2022 return ERR_set_mark(); 2023} 2024 2025static int core_clear_last_error_mark(const OSSL_CORE_HANDLE *handle) 2026{ 2027 return ERR_clear_last_mark(); 2028} 2029 2030static int core_pop_error_to_mark(const OSSL_CORE_HANDLE *handle) 2031{ 2032 return ERR_pop_to_mark(); 2033} 2034 2035static void core_self_test_get_callback(OPENSSL_CORE_CTX *libctx, 2036 OSSL_CALLBACK **cb, void **cbarg) 2037{ 2038 OSSL_SELF_TEST_get_callback((OSSL_LIB_CTX *)libctx, cb, cbarg); 2039} 2040 2041static const char *core_provider_get0_name(const OSSL_CORE_HANDLE *prov) 2042{ 2043 return OSSL_PROVIDER_get0_name((const OSSL_PROVIDER *)prov); 2044} 2045 2046static void *core_provider_get0_provider_ctx(const OSSL_CORE_HANDLE *prov) 2047{ 2048 return OSSL_PROVIDER_get0_provider_ctx((const OSSL_PROVIDER *)prov); 2049} 2050 2051static const OSSL_DISPATCH * 2052core_provider_get0_dispatch(const OSSL_CORE_HANDLE *prov) 2053{ 2054 return OSSL_PROVIDER_get0_dispatch((const OSSL_PROVIDER *)prov); 2055} 2056 2057static int core_provider_up_ref_intern(const OSSL_CORE_HANDLE *prov, 2058 int activate) 2059{ 2060 return provider_up_ref_intern((OSSL_PROVIDER *)prov, activate); 2061} 2062 2063static int core_provider_free_intern(const OSSL_CORE_HANDLE *prov, 2064 int deactivate) 2065{ 2066 return provider_free_intern((OSSL_PROVIDER *)prov, deactivate); 2067} 2068 2069static int core_obj_add_sigid(const OSSL_CORE_HANDLE *prov, 2070 const char *sign_name, const char *digest_name, 2071 const char *pkey_name) 2072{ 2073 int sign_nid = OBJ_txt2nid(sign_name); 2074 int digest_nid = NID_undef; 2075 int pkey_nid = OBJ_txt2nid(pkey_name); 2076 2077 if (digest_name != NULL && digest_name[0] != '\0' 2078 && (digest_nid = OBJ_txt2nid(digest_name)) == NID_undef) 2079 return 0; 2080 2081 if (sign_nid == NID_undef) 2082 return 0; 2083 2084 /* 2085 * Check if it already exists. This is a success if so (even if we don't 2086 * have nids for the digest/pkey) 2087 */ 2088 if (OBJ_find_sigid_algs(sign_nid, NULL, NULL)) 2089 return 1; 2090 2091 if (pkey_nid == NID_undef) 2092 return 0; 2093 2094 return OBJ_add_sigid(sign_nid, digest_nid, pkey_nid); 2095} 2096 2097static int core_obj_create(const OSSL_CORE_HANDLE *prov, const char *oid, 2098 const char *sn, const char *ln) 2099{ 2100 /* Check if it already exists and create it if not */ 2101 return OBJ_txt2nid(oid) != NID_undef 2102 || OBJ_create(oid, sn, ln) != NID_undef; 2103} 2104#endif /* FIPS_MODULE */ 2105 2106/* 2107 * Functions provided by the core. 2108 */ 2109static const OSSL_DISPATCH core_dispatch_[] = { 2110 { OSSL_FUNC_CORE_GETTABLE_PARAMS, (void (*)(void))core_gettable_params }, 2111 { OSSL_FUNC_CORE_GET_PARAMS, (void (*)(void))core_get_params }, 2112 { OSSL_FUNC_CORE_GET_LIBCTX, (void (*)(void))core_get_libctx }, 2113 { OSSL_FUNC_CORE_THREAD_START, (void (*)(void))core_thread_start }, 2114#ifndef FIPS_MODULE 2115 { OSSL_FUNC_CORE_NEW_ERROR, (void (*)(void))core_new_error }, 2116 { OSSL_FUNC_CORE_SET_ERROR_DEBUG, (void (*)(void))core_set_error_debug }, 2117 { OSSL_FUNC_CORE_VSET_ERROR, (void (*)(void))core_vset_error }, 2118 { OSSL_FUNC_CORE_SET_ERROR_MARK, (void (*)(void))core_set_error_mark }, 2119 { OSSL_FUNC_CORE_CLEAR_LAST_ERROR_MARK, 2120 (void (*)(void))core_clear_last_error_mark }, 2121 { OSSL_FUNC_CORE_POP_ERROR_TO_MARK, (void (*)(void))core_pop_error_to_mark }, 2122 { OSSL_FUNC_BIO_NEW_FILE, (void (*)(void))ossl_core_bio_new_file }, 2123 { OSSL_FUNC_BIO_NEW_MEMBUF, (void (*)(void))ossl_core_bio_new_mem_buf }, 2124 { OSSL_FUNC_BIO_READ_EX, (void (*)(void))ossl_core_bio_read_ex }, 2125 { OSSL_FUNC_BIO_WRITE_EX, (void (*)(void))ossl_core_bio_write_ex }, 2126 { OSSL_FUNC_BIO_GETS, (void (*)(void))ossl_core_bio_gets }, 2127 { OSSL_FUNC_BIO_PUTS, (void (*)(void))ossl_core_bio_puts }, 2128 { OSSL_FUNC_BIO_CTRL, (void (*)(void))ossl_core_bio_ctrl }, 2129 { OSSL_FUNC_BIO_UP_REF, (void (*)(void))ossl_core_bio_up_ref }, 2130 { OSSL_FUNC_BIO_FREE, (void (*)(void))ossl_core_bio_free }, 2131 { OSSL_FUNC_BIO_VPRINTF, (void (*)(void))ossl_core_bio_vprintf }, 2132 { OSSL_FUNC_BIO_VSNPRINTF, (void (*)(void))BIO_vsnprintf }, 2133 { OSSL_FUNC_SELF_TEST_CB, (void (*)(void))core_self_test_get_callback }, 2134 { OSSL_FUNC_GET_ENTROPY, (void (*)(void))ossl_rand_get_entropy }, 2135 { OSSL_FUNC_CLEANUP_ENTROPY, (void (*)(void))ossl_rand_cleanup_entropy }, 2136 { OSSL_FUNC_GET_NONCE, (void (*)(void))ossl_rand_get_nonce }, 2137 { OSSL_FUNC_CLEANUP_NONCE, (void (*)(void))ossl_rand_cleanup_nonce }, 2138#endif 2139 { OSSL_FUNC_CRYPTO_MALLOC, (void (*)(void))CRYPTO_malloc }, 2140 { OSSL_FUNC_CRYPTO_ZALLOC, (void (*)(void))CRYPTO_zalloc }, 2141 { OSSL_FUNC_CRYPTO_FREE, (void (*)(void))CRYPTO_free }, 2142 { OSSL_FUNC_CRYPTO_CLEAR_FREE, (void (*)(void))CRYPTO_clear_free }, 2143 { OSSL_FUNC_CRYPTO_REALLOC, (void (*)(void))CRYPTO_realloc }, 2144 { OSSL_FUNC_CRYPTO_CLEAR_REALLOC, (void (*)(void))CRYPTO_clear_realloc }, 2145 { OSSL_FUNC_CRYPTO_SECURE_MALLOC, (void (*)(void))CRYPTO_secure_malloc }, 2146 { OSSL_FUNC_CRYPTO_SECURE_ZALLOC, (void (*)(void))CRYPTO_secure_zalloc }, 2147 { OSSL_FUNC_CRYPTO_SECURE_FREE, (void (*)(void))CRYPTO_secure_free }, 2148 { OSSL_FUNC_CRYPTO_SECURE_CLEAR_FREE, 2149 (void (*)(void))CRYPTO_secure_clear_free }, 2150 { OSSL_FUNC_CRYPTO_SECURE_ALLOCATED, 2151 (void (*)(void))CRYPTO_secure_allocated }, 2152 { OSSL_FUNC_OPENSSL_CLEANSE, (void (*)(void))OPENSSL_cleanse }, 2153#ifndef FIPS_MODULE 2154 { OSSL_FUNC_PROVIDER_REGISTER_CHILD_CB, 2155 (void (*)(void))ossl_provider_register_child_cb }, 2156 { OSSL_FUNC_PROVIDER_DEREGISTER_CHILD_CB, 2157 (void (*)(void))ossl_provider_deregister_child_cb }, 2158 { OSSL_FUNC_PROVIDER_NAME, 2159 (void (*)(void))core_provider_get0_name }, 2160 { OSSL_FUNC_PROVIDER_GET0_PROVIDER_CTX, 2161 (void (*)(void))core_provider_get0_provider_ctx }, 2162 { OSSL_FUNC_PROVIDER_GET0_DISPATCH, 2163 (void (*)(void))core_provider_get0_dispatch }, 2164 { OSSL_FUNC_PROVIDER_UP_REF, 2165 (void (*)(void))core_provider_up_ref_intern }, 2166 { OSSL_FUNC_PROVIDER_FREE, 2167 (void (*)(void))core_provider_free_intern }, 2168 { OSSL_FUNC_CORE_OBJ_ADD_SIGID, (void (*)(void))core_obj_add_sigid }, 2169 { OSSL_FUNC_CORE_OBJ_CREATE, (void (*)(void))core_obj_create }, 2170#endif 2171 { 0, NULL } 2172}; 2173static const OSSL_DISPATCH *core_dispatch = core_dispatch_; 2174