providers/fips/fipsprov.c

   1 /*
   2  * Copyright 2019 The OpenSSL Project Authors. All Rights Reserved.
   3  *
   4  * Licensed under the Apache License 2.0 (the "License").  You may not use
   5  * this file except in compliance with the License.  You can obtain a copy
   6  * in the file LICENSE in the source distribution or at
   7  * https://www.openssl.org/source/license.html
   8  */
   9
  10 #include <string.h>
  11 #include <stdio.h>
  12 #include <openssl/core.h>
  13 #include <openssl/core_numbers.h>
  14 #include <openssl/core_names.h>
  15 #include <openssl/params.h>
  16 #include <openssl/err.h>
  17 #include <openssl/evp.h>
  18 #include <openssl/kdf.h>
  19
  20 /* TODO(3.0): Needed for dummy_evp_call(). To be removed */
  21 #include <openssl/sha.h>
  22 #include <openssl/rand_drbg.h>
  23 #include <openssl/ec.h>
  24 #include <openssl/fips_names.h>
  25
  26 #include "internal/cryptlib.h"
  27 #include "internal/property.h"
  28 #include "internal/evp_int.h"
  29 #include "internal/provider_algs.h"
  30 #include "internal/provider_ctx.h"
  31 #include "internal/providercommon.h"
  32 #include "selftest.h"
  33
  34 extern OSSL_core_thread_start_fn *c_thread_start;
  35
  36 /*
  37  * TODO(3.0): Should these be stored in the provider side provctx? Could they
  38  * ever be different from one init to the next? Unfortunately we can't do this
  39  * at the moment because c_put_error/c_add_error_vdata do not provide
  40  * us with the OPENSSL_CTX as a parameter.
  41  */
  42
  43 static SELF_TEST_POST_PARAMS selftest_params;
  44
  45 /* Functions provided by the core */
  46 static OSSL_core_gettable_params_fn *c_gettable_params;
  47 static OSSL_core_get_params_fn *c_get_params;
  48 OSSL_core_thread_start_fn *c_thread_start;
  49 static OSSL_core_new_error_fn *c_new_error;
  50 static OSSL_core_set_error_debug_fn *c_set_error_debug;
  51 static OSSL_core_vset_error_fn *c_vset_error;
  52 static OSSL_CRYPTO_malloc_fn *c_CRYPTO_malloc;
  53 static OSSL_CRYPTO_zalloc_fn *c_CRYPTO_zalloc;
  54 static OSSL_CRYPTO_free_fn *c_CRYPTO_free;
  55 static OSSL_CRYPTO_clear_free_fn *c_CRYPTO_clear_free;
  56 static OSSL_CRYPTO_realloc_fn *c_CRYPTO_realloc;
  57 static OSSL_CRYPTO_clear_realloc_fn *c_CRYPTO_clear_realloc;
  58 static OSSL_CRYPTO_secure_malloc_fn *c_CRYPTO_secure_malloc;
  59 static OSSL_CRYPTO_secure_zalloc_fn *c_CRYPTO_secure_zalloc;
  60 static OSSL_CRYPTO_secure_free_fn *c_CRYPTO_secure_free;
  61 static OSSL_CRYPTO_secure_clear_free_fn *c_CRYPTO_secure_clear_free;
  62 static OSSL_CRYPTO_secure_allocated_fn *c_CRYPTO_secure_allocated;
  63
  64 typedef struct fips_global_st {
  65     const OSSL_PROVIDER *prov;
  66 } FIPS_GLOBAL;
  67
  68 static void *fips_prov_ossl_ctx_new(OPENSSL_CTX *libctx)
  69 {
  70     FIPS_GLOBAL *fgbl = OPENSSL_zalloc(sizeof(*fgbl));
  71
  72     return fgbl;
  73 }
  74
  75 static void fips_prov_ossl_ctx_free(void *fgbl)
  76 {
  77     OPENSSL_free(fgbl);
  78 }
  79
  80 static const OPENSSL_CTX_METHOD fips_prov_ossl_ctx_method = {
  81     fips_prov_ossl_ctx_new,
  82     fips_prov_ossl_ctx_free,
  83 };
  84
  85
  86 /* Parameters we provide to the core */
  87 static const OSSL_PARAM fips_param_types[] = {
  88     OSSL_PARAM_DEFN(OSSL_PROV_PARAM_NAME, OSSL_PARAM_UTF8_PTR, NULL, 0),
  89     OSSL_PARAM_DEFN(OSSL_PROV_PARAM_VERSION, OSSL_PARAM_UTF8_PTR, NULL, 0),
  90     OSSL_PARAM_DEFN(OSSL_PROV_PARAM_BUILDINFO, OSSL_PARAM_UTF8_PTR, NULL, 0),
  91     OSSL_PARAM_END
  92 };
  93
  94 /*
  95  * Parameters to retrieve from the core provider - required for self testing.
  96  * NOTE: inside core_get_params() these will be loaded from config items
  97  * stored inside prov->parameters (except for OSSL_PROV_PARAM_MODULE_FILENAME).
  98  */
  99 static OSSL_PARAM core_params[] =
 100 {
 101     OSSL_PARAM_utf8_ptr(OSSL_PROV_PARAM_MODULE_FILENAME,
 102                         selftest_params.module_filename,
 103                         sizeof(selftest_params.module_filename)),
 104     OSSL_PARAM_utf8_ptr(OSSL_PROV_FIPS_PARAM_MODULE_MAC,
 105                         selftest_params.module_checksum_data,
 106                         sizeof(selftest_params.module_checksum_data)),
 107     OSSL_PARAM_utf8_ptr(OSSL_PROV_FIPS_PARAM_INSTALL_MAC,
 108                         selftest_params.indicator_checksum_data,
 109                         sizeof(selftest_params.indicator_checksum_data)),
 110     OSSL_PARAM_utf8_ptr(OSSL_PROV_FIPS_PARAM_INSTALL_STATUS,
 111                         selftest_params.indicator_data,
 112                         sizeof(selftest_params.indicator_data)),
 113     OSSL_PARAM_utf8_ptr(OSSL_PROV_FIPS_PARAM_INSTALL_VERSION,
 114                         selftest_params.indicator_version,
 115                         sizeof(selftest_params.indicator_version)),
 116     OSSL_PARAM_END
 117 };
 118
 119 /* TODO(3.0): To be removed */
 120 static int dummy_evp_call(void *provctx)
 121 {
 122     OPENSSL_CTX *libctx = PROV_LIBRARY_CONTEXT_OF(provctx);
 123     EVP_MD_CTX *ctx = EVP_MD_CTX_new();
 124     EVP_MD *sha256 = EVP_MD_fetch(libctx, "SHA256", NULL);
 125     EVP_KDF *kdf = EVP_KDF_fetch(libctx, "pbkdf2", NULL);
 126     char msg[] = "Hello World!";
 127     const unsigned char exptd[] = {
 128         0x7f, 0x83, 0xb1, 0x65, 0x7f, 0xf1, 0xfc, 0x53, 0xb9, 0x2d, 0xc1, 0x81,
 129         0x48, 0xa1, 0xd6, 0x5d, 0xfc, 0x2d, 0x4b, 0x1f, 0xa3, 0xd6, 0x77, 0x28,
 130         0x4a, 0xdd, 0xd2, 0x00, 0x12, 0x6d, 0x90, 0x69
 131     };
 132     unsigned int dgstlen = 0;
 133     unsigned char dgst[SHA256_DIGEST_LENGTH];
 134     int ret = 0;
 135     BN_CTX *bnctx = NULL;
 136     BIGNUM *a = NULL, *b = NULL;
 137     unsigned char randbuf[128];
 138     RAND_DRBG *drbg = OPENSSL_CTX_get0_public_drbg(libctx);
 139 #ifndef OPENSSL_NO_EC
 140     EC_KEY *key = NULL;
 141 #endif
 142
 143     if (ctx == NULL || sha256 == NULL || drbg == NULL || kdf == NULL)
 144         goto err;
 145
 146     if (!EVP_DigestInit_ex(ctx, sha256, NULL))
 147         goto err;
 148     if (!EVP_DigestUpdate(ctx, msg, sizeof(msg) - 1))
 149         goto err;
 150     if (!EVP_DigestFinal(ctx, dgst, &dgstlen))
 151         goto err;
 152     if (dgstlen != sizeof(exptd) || memcmp(dgst, exptd, sizeof(exptd)) != 0)
 153         goto err;
 154
 155     bnctx = BN_CTX_new_ex(libctx);
 156     if (bnctx == NULL)
 157         goto err;
 158     BN_CTX_start(bnctx);
 159     a = BN_CTX_get(bnctx);
 160     b = BN_CTX_get(bnctx);
 161     if (b == NULL)
 162         goto err;
 163     BN_zero(a);
 164     if (!BN_one(b)
 165         || !BN_add(a, a, b)
 166         || BN_cmp(a, b) != 0)
 167         goto err;
 168
 169     if (RAND_DRBG_bytes(drbg, randbuf, sizeof(randbuf)) <= 0)
 170         goto err;
 171
 172     if (!BN_rand_ex(a, 256, BN_RAND_TOP_ANY, BN_RAND_BOTTOM_ANY, bnctx))
 173         goto err;
 174
 175 #ifndef OPENSSL_NO_EC
 176     /* Do some dummy EC calls */
 177     key = EC_KEY_new_by_curve_name_ex(libctx, NID_X9_62_prime256v1);
 178     if (key == NULL)
 179         goto err;
 180
 181     if (!EC_KEY_generate_key(key))
 182         goto err;
 183 #endif
 184
 185     ret = 1;
 186  err:
 187     BN_CTX_end(bnctx);
 188     BN_CTX_free(bnctx);
 189
 190     EVP_KDF_free(kdf);
 191     EVP_MD_CTX_free(ctx);
 192     EVP_MD_free(sha256);
 193
 194 #ifndef OPENSSL_NO_EC
 195     EC_KEY_free(key);
 196 #endif
 197     return ret;
 198 }
 199
 200 static const OSSL_PARAM *fips_gettable_params(const OSSL_PROVIDER *prov)
 201 {
 202     return fips_param_types;
 203 }
 204
 205 static int fips_get_params(const OSSL_PROVIDER *prov, OSSL_PARAM params[])
 206 {
 207     OSSL_PARAM *p;
 208
 209     p = OSSL_PARAM_locate(params, OSSL_PROV_PARAM_NAME);
 210     if (p != NULL && !OSSL_PARAM_set_utf8_ptr(p, "OpenSSL FIPS Provider"))
 211         return 0;
 212     p = OSSL_PARAM_locate(params, OSSL_PROV_PARAM_VERSION);
 213     if (p != NULL && !OSSL_PARAM_set_utf8_ptr(p, OPENSSL_VERSION_STR))
 214         return 0;
 215     p = OSSL_PARAM_locate(params, OSSL_PROV_PARAM_BUILDINFO);
 216     if (p != NULL && !OSSL_PARAM_set_utf8_ptr(p, OPENSSL_FULL_VERSION_STR))
 217         return 0;
 218
 219     return 1;
 220 }
 221
 222 /* FIPS specific version of the function of the same name in provlib.c */
 223 const char *ossl_prov_util_nid_to_name(int nid)
 224 {
 225     /* We don't have OBJ_nid2n() in FIPS_MODE so we have an explicit list */
 226
 227     switch (nid) {
 228     /* Digests */
 229     case NID_sha1:
 230         return "SHA224";
 231     case NID_sha224:
 232         return "SHA224";
 233     case NID_sha256:
 234         return "SHA256";
 235     case NID_sha384:
 236         return "SHA384";
 237     case NID_sha512:
 238         return "SHA512";
 239     case NID_sha512_224:
 240         return "SHA512-224";
 241     case NID_sha512_256:
 242         return "SHA512-256";
 243     case NID_sha3_224:
 244         return "SHA3-224";
 245     case NID_sha3_256:
 246         return "SHA3-256";
 247     case NID_sha3_384:
 248         return "SHA3-384";
 249     case NID_sha3_512:
 250         return "SHA3-512";
 251
 252     /* Ciphers */
 253     case NID_aes_256_ecb:
 254         return "AES-256-ECB";
 255     case NID_aes_192_ecb:
 256         return "AES-192-ECB";
 257     case NID_aes_128_ecb:
 258         return "AES-128-ECB";
 259     case NID_aes_256_cbc:
 260         return "AES-256-CBC";
 261     case NID_aes_192_cbc:
 262         return "AES-192-CBC";
 263     case NID_aes_128_cbc:
 264         return "AES-128-CBC";
 265     case NID_aes_256_ctr:
 266         return "AES-256-CTR";
 267     case NID_aes_192_ctr:
 268         return "AES-192-CTR";
 269     case NID_aes_128_ctr:
 270         return "AES-128-CTR";
 271     /* TODO(3.0) Change these when we have aliases */
 272     case NID_aes_256_gcm:
 273         return "id-aes256-GCM";
 274     case NID_aes_192_gcm:
 275         return "id-aes192-GCM";
 276     case NID_aes_128_gcm:
 277         return "id-aes128-GCM";
 278     case NID_aes_256_ccm:
 279         return "id-aes256-CCM";
 280     case NID_aes_192_ccm:
 281         return "id-aes192-CCM";
 282     case NID_aes_128_ccm:
 283         return "id-aes128-CCM";
 284     default:
 285         break;
 286     }
 287
 288     return NULL;
 289 }
 290
 291 static const OSSL_ALGORITHM fips_digests[] = {
 292     { "SHA1", "fips=yes", sha1_functions },
 293     { "SHA224", "fips=yes", sha224_functions },
 294     { "SHA256", "fips=yes", sha256_functions },
 295     { "SHA384", "fips=yes", sha384_functions },
 296     { "SHA512", "fips=yes", sha512_functions },
 297     { "SHA512-224", "fips=yes", sha512_224_functions },
 298     { "SHA512-256", "fips=yes", sha512_256_functions },
 299     { "SHA3-224", "fips=yes", sha3_224_functions },
 300     { "SHA3-256", "fips=yes", sha3_256_functions },
 301     { "SHA3-384", "fips=yes", sha3_384_functions },
 302     { "SHA3-512", "fips=yes", sha3_512_functions },
 303     /*
 304      * KECCAK_KMAC128 and KECCAK_KMAC256 as hashes are mostly useful for
 305      * the KMAC128 and KMAC256.
 306      */
 307     { "KECCAK_KMAC128", "fips=yes", keccak_kmac_128_functions },
 308     { "KECCAK_KMAC256", "fips=yes", keccak_kmac_256_functions },
 309
 310     { NULL, NULL, NULL }
 311 };
 312
 313 static const OSSL_ALGORITHM fips_ciphers[] = {
 314     { "AES-256-ECB", "fips=yes", aes256ecb_functions },
 315     { "AES-192-ECB", "fips=yes", aes192ecb_functions },
 316     { "AES-128-ECB", "fips=yes", aes128ecb_functions },
 317     { "AES-256-CBC", "fips=yes", aes256cbc_functions },
 318     { "AES-192-CBC", "fips=yes", aes192cbc_functions },
 319     { "AES-128-CBC", "fips=yes", aes128cbc_functions },
 320     { "AES-256-CTR", "fips=yes", aes256ctr_functions },
 321     { "AES-192-CTR", "fips=yes", aes192ctr_functions },
 322     { "AES-128-CTR", "fips=yes", aes128ctr_functions },
 323     /* TODO(3.0) Add aliases for these ciphers */
 324     { "id-aes256-GCM", "fips=yes", aes256gcm_functions },
 325     { "id-aes192-GCM", "fips=yes", aes192gcm_functions },
 326     { "id-aes128-GCM", "fips=yes", aes128gcm_functions },
 327     { "id-aes256-CCM", "fips=yes", aes256ccm_functions },
 328     { "id-aes192-CCM", "fips=yes", aes192ccm_functions },
 329     { "id-aes128-CCM", "fips=yes", aes128ccm_functions },
 330 #ifndef OPENSSL_NO_DES
 331     { "DES-EDE3", "fips=yes", tdes_ede3_ecb_functions },
 332     { "DES-EDE3-CBC", "fips=yes", tdes_ede3_cbc_functions },
 333 #endif  /* OPENSSL_NO_DES */
 334     { NULL, NULL, NULL }
 335 };
 336
 337 static const OSSL_ALGORITHM fips_macs[] = {
 338 #ifndef OPENSSL_NO_CMAC
 339     { "CMAC", "fips=yes", cmac_functions },
 340 #endif
 341     { "GMAC", "fips=yes", gmac_functions },
 342     { "HMAC", "fips=yes", hmac_functions },
 343     { "KMAC128", "fips=yes", kmac128_functions },
 344     { "KMAC256", "fips=yes", kmac256_functions },
 345     { NULL, NULL, NULL }
 346 };
 347
 348 static const OSSL_ALGORITHM fips_kdfs[] = {
 349     { "HKDF", "fips=yes", kdf_hkdf_functions },
 350     { "SSKDF", "fips=yes", kdf_sskdf_functions },
 351     { "PBKDF2", "fips=yes", kdf_pbkdf2_functions },
 352     { "TLS1-PRF", "fips=yes", kdf_tls1_prf_functions },
 353    { NULL, NULL, NULL }
 354 };
 355
 356 static const OSSL_ALGORITHM *fips_query(OSSL_PROVIDER *prov,
 357                                          int operation_id,
 358                                          int *no_cache)
 359 {
 360     *no_cache = 0;
 361     switch (operation_id) {
 362     case OSSL_OP_DIGEST:
 363         return fips_digests;
 364     case OSSL_OP_CIPHER:
 365         return fips_ciphers;
 366     case OSSL_OP_MAC:
 367         return fips_macs;
 368     case OSSL_OP_KDF:
 369         return fips_kdfs;
 370     }
 371     return NULL;
 372 }
 373
 374 /* Functions we provide to the core */
 375 static const OSSL_DISPATCH fips_dispatch_table[] = {
 376     /*
 377      * To release our resources we just need to free the OPENSSL_CTX so we just
 378      * use OPENSSL_CTX_free directly as our teardown function
 379      */
 380     { OSSL_FUNC_PROVIDER_TEARDOWN, (void (*)(void))OPENSSL_CTX_free },
 381     { OSSL_FUNC_PROVIDER_GETTABLE_PARAMS, (void (*)(void))fips_gettable_params },
 382     { OSSL_FUNC_PROVIDER_GET_PARAMS, (void (*)(void))fips_get_params },
 383     { OSSL_FUNC_PROVIDER_QUERY_OPERATION, (void (*)(void))fips_query },
 384     { 0, NULL }
 385 };
 386
 387 /* Functions we provide to ourself */
 388 static const OSSL_DISPATCH intern_dispatch_table[] = {
 389     { OSSL_FUNC_PROVIDER_QUERY_OPERATION, (void (*)(void))fips_query },
 390     { 0, NULL }
 391 };
 392
 393
 394 int OSSL_provider_init(const OSSL_PROVIDER *provider,
 395                        const OSSL_DISPATCH *in,
 396                        const OSSL_DISPATCH **out,
 397                        void **provctx)
 398 {
 399     FIPS_GLOBAL *fgbl;
 400     OPENSSL_CTX *ctx;
 401
 402     for (; in->function_id != 0; in++) {
 403         switch (in->function_id) {
 404         case OSSL_FUNC_CORE_GETTABLE_PARAMS:
 405             c_gettable_params = OSSL_get_core_gettable_params(in);
 406             break;
 407         case OSSL_FUNC_CORE_GET_PARAMS:
 408             c_get_params = OSSL_get_core_get_params(in);
 409             break;
 410         case OSSL_FUNC_CORE_THREAD_START:
 411             c_thread_start = OSSL_get_core_thread_start(in);
 412             break;
 413         case OSSL_FUNC_CORE_NEW_ERROR:
 414             c_new_error = OSSL_get_core_new_error(in);
 415             break;
 416         case OSSL_FUNC_CORE_SET_ERROR_DEBUG:
 417             c_set_error_debug = OSSL_get_core_set_error_debug(in);
 418             break;
 419         case OSSL_FUNC_CORE_VSET_ERROR:
 420             c_vset_error = OSSL_get_core_vset_error(in);
 421             break;
 422         case OSSL_FUNC_CRYPTO_MALLOC:
 423             c_CRYPTO_malloc = OSSL_get_CRYPTO_malloc(in);
 424             break;
 425         case OSSL_FUNC_CRYPTO_ZALLOC:
 426             c_CRYPTO_zalloc = OSSL_get_CRYPTO_zalloc(in);
 427             break;
 428         case OSSL_FUNC_CRYPTO_FREE:
 429             c_CRYPTO_free = OSSL_get_CRYPTO_free(in);
 430             break;
 431         case OSSL_FUNC_CRYPTO_CLEAR_FREE:
 432             c_CRYPTO_clear_free = OSSL_get_CRYPTO_clear_free(in);
 433             break;
 434         case OSSL_FUNC_CRYPTO_REALLOC:
 435             c_CRYPTO_realloc = OSSL_get_CRYPTO_realloc(in);
 436             break;
 437         case OSSL_FUNC_CRYPTO_CLEAR_REALLOC:
 438             c_CRYPTO_clear_realloc = OSSL_get_CRYPTO_clear_realloc(in);
 439             break;
 440         case OSSL_FUNC_CRYPTO_SECURE_MALLOC:
 441             c_CRYPTO_secure_malloc = OSSL_get_CRYPTO_secure_malloc(in);
 442             break;
 443         case OSSL_FUNC_CRYPTO_SECURE_ZALLOC:
 444             c_CRYPTO_secure_zalloc = OSSL_get_CRYPTO_secure_zalloc(in);
 445             break;
 446         case OSSL_FUNC_CRYPTO_SECURE_FREE:
 447             c_CRYPTO_secure_free = OSSL_get_CRYPTO_secure_free(in);
 448             break;
 449         case OSSL_FUNC_CRYPTO_SECURE_CLEAR_FREE:
 450             c_CRYPTO_secure_clear_free = OSSL_get_CRYPTO_secure_clear_free(in);
 451             break;
 452         case OSSL_FUNC_CRYPTO_SECURE_ALLOCATED:
 453             c_CRYPTO_secure_allocated = OSSL_get_CRYPTO_secure_allocated(in);
 454             break;
 455         case OSSL_FUNC_BIO_NEW_FILE:
 456             selftest_params.bio_new_file_cb = OSSL_get_BIO_new_file(in);
 457             break;
 458         case OSSL_FUNC_BIO_NEW_MEMBUF:
 459             selftest_params.bio_new_buffer_cb = OSSL_get_BIO_new_membuf(in);
 460             break;
 461         case OSSL_FUNC_BIO_READ:
 462             selftest_params.bio_read_cb = OSSL_get_BIO_read(in);
 463             break;
 464         case OSSL_FUNC_BIO_FREE:
 465             selftest_params.bio_free_cb = OSSL_get_BIO_free(in);
 466             break;
 467         default:
 468             /* Just ignore anything we don't understand */
 469             break;
 470         }
 471     }
 472
 473     if (!c_get_params(provider, core_params))
 474         return 0;
 475
 476     /*  Create a context. */
 477     if ((ctx = OPENSSL_CTX_new()) == NULL)
 478         return 0;
 479     if ((fgbl = openssl_ctx_get_data(ctx, OPENSSL_CTX_FIPS_PROV_INDEX,
 480                                      &fips_prov_ossl_ctx_method)) == NULL) {
 481         OPENSSL_CTX_free(ctx);
 482         return 0;
 483     }
 484     fgbl->prov = provider;
 485     *out = fips_dispatch_table;
 486     *provctx = ctx;
 487
 488     /*
 489      * TODO(3.0): Remove me. This is just a dummy call to demonstrate making
 490      * EVP calls from within the FIPS module.
 491      */
 492     if (!dummy_evp_call(*provctx)) {
 493         OPENSSL_CTX_free(*provctx);
 494         *provctx = NULL;
 495         return 0;
 496     }
 497
 498     return 1;
 499 }
 500
 501 /*
 502  * The internal init function used when the FIPS module uses EVP to call
 503  * another algorithm also in the FIPS module. This is a recursive call that has
 504  * been made from within the FIPS module itself. To make this work, we populate
 505  * the provider context of this inner instance with the same library context
 506  * that was used in the EVP call that initiated this recursive call.
 507  */
 508 OSSL_provider_init_fn fips_intern_provider_init;
 509 int fips_intern_provider_init(const OSSL_PROVIDER *provider,
 510                               const OSSL_DISPATCH *in,
 511                               const OSSL_DISPATCH **out,
 512                               void **provctx)
 513 {
 514     OSSL_core_get_library_context_fn *c_get_libctx = NULL;
 515
 516     for (; in->function_id != 0; in++) {
 517         switch (in->function_id) {
 518         case OSSL_FUNC_CORE_GET_LIBRARY_CONTEXT:
 519             c_get_libctx = OSSL_get_core_get_library_context(in);
 520             break;
 521         default:
 522             break;
 523         }
 524     }
 525
 526     if (c_get_libctx == NULL)
 527         return 0;
 528
 529     *provctx = c_get_libctx(provider);
 530
 531     /*
 532      * Safety measure...  we should get the library context that was
 533      * created up in OSSL_provider_init().
 534      */
 535     if (*provctx == NULL)
 536         return 0;
 537
 538     *out = intern_dispatch_table;
 539     return 1;
 540 }
 541
 542 void ERR_new(void)
 543 {
 544     c_new_error(NULL);
 545 }
 546
 547 void ERR_set_debug(const char *file, int line, const char *func)
 548 {
 549     c_set_error_debug(NULL, file, line, func);
 550 }
 551
 552 void ERR_set_error(int lib, int reason, const char *fmt, ...)
 553 {
 554     va_list args;
 555
 556     va_start(args, fmt);
 557     c_vset_error(NULL, ERR_PACK(lib, 0, reason), fmt, args);
 558     va_end(args);
 559 }
 560
 561 void ERR_vset_error(int lib, int reason, const char *fmt, va_list args)
 562 {
 563     c_vset_error(NULL, ERR_PACK(lib, 0, reason), fmt, args);
 564 }
 565
 566 const OSSL_PROVIDER *FIPS_get_provider(OPENSSL_CTX *ctx)
 567 {
 568     FIPS_GLOBAL *fgbl = openssl_ctx_get_data(ctx, OPENSSL_CTX_FIPS_PROV_INDEX,
 569                                              &fips_prov_ossl_ctx_method);
 570
 571     if (fgbl == NULL)
 572         return NULL;
 573
 574     return fgbl->prov;
 575 }
 576
 577 void *CRYPTO_malloc(size_t num, const char *file, int line)
 578 {
 579     return c_CRYPTO_malloc(num, file, line);
 580 }
 581
 582 void *CRYPTO_zalloc(size_t num, const char *file, int line)
 583 {
 584     return c_CRYPTO_zalloc(num, file, line);
 585 }
 586
 587 void CRYPTO_free(void *ptr, const char *file, int line)
 588 {
 589     c_CRYPTO_free(ptr, file, line);
 590 }
 591
 592 void CRYPTO_clear_free(void *ptr, size_t num, const char *file, int line)
 593 {
 594     c_CRYPTO_clear_free(ptr, num, file, line);
 595 }
 596
 597 void *CRYPTO_realloc(void *addr, size_t num, const char *file, int line)
 598 {
 599     return c_CRYPTO_realloc(addr, num, file, line);
 600 }
 601
 602 void *CRYPTO_clear_realloc(void *addr, size_t old_num, size_t num,
 603                            const char *file, int line)
 604 {
 605     return c_CRYPTO_clear_realloc(addr, old_num, num, file, line);
 606 }
 607
 608 void *CRYPTO_secure_malloc(size_t num, const char *file, int line)
 609 {
 610     return c_CRYPTO_secure_malloc(num, file, line);
 611 }
 612
 613 void *CRYPTO_secure_zalloc(size_t num, const char *file, int line)
 614 {
 615     return c_CRYPTO_secure_zalloc(num, file, line);
 616 }
 617
 618 void CRYPTO_secure_free(void *ptr, const char *file, int line)
 619 {
 620     c_CRYPTO_secure_free(ptr, file, line);
 621 }
 622
 623 void CRYPTO_secure_clear_free(void *ptr, size_t num, const char *file, int line)
 624 {
 625     c_CRYPTO_secure_clear_free(ptr, num, file, line);
 626 }
 627
 628 int CRYPTO_secure_allocated(const void *ptr)
 629 {
 630     return c_CRYPTO_secure_allocated(ptr);
 631 }