providers/fips/fipsprov.c

   1 /*
   2  * Copyright 2019 The OpenSSL Project Authors. All Rights Reserved.
   3  *
   4  * Licensed under the Apache License 2.0 (the "License").  You may not use
   5  * this file except in compliance with the License.  You can obtain a copy
   6  * in the file LICENSE in the source distribution or at
   7  * https://www.openssl.org/source/license.html
   8  */
   9
  10 #include <string.h>
  11 #include <stdio.h>
  12 #include <openssl/core.h>
  13 #include <openssl/core_numbers.h>
  14 #include <openssl/core_names.h>
  15 #include <openssl/params.h>
  16 #include <openssl/err.h>
  17 #include <openssl/evp.h>
  18 /* TODO(3.0): Needed for dummy_evp_call(). To be removed */
  19 #include <openssl/sha.h>
  20 #include "internal/cryptlib.h"
  21 #include "internal/property.h"
  22 #include "internal/evp_int.h"
  23 #include "internal/provider_algs.h"
  24 #include "internal/provider_ctx.h"
  25
  26 /* Functions provided by the core */
  27 static OSSL_core_get_param_types_fn *c_get_param_types = NULL;
  28 static OSSL_core_get_params_fn *c_get_params = NULL;
  29 static OSSL_core_put_error_fn *c_put_error = NULL;
  30 static OSSL_core_add_error_vdata_fn *c_add_error_vdata = NULL;
  31
  32 /* Parameters we provide to the core */
  33 static const OSSL_ITEM fips_param_types[] = {
  34     { OSSL_PARAM_UTF8_PTR, OSSL_PROV_PARAM_NAME },
  35     { OSSL_PARAM_UTF8_PTR, OSSL_PROV_PARAM_VERSION },
  36     { OSSL_PARAM_UTF8_PTR, OSSL_PROV_PARAM_BUILDINFO },
  37     { 0, NULL }
  38 };
  39
  40 /* TODO(3.0): To be removed */
  41 static int dummy_evp_call(void *provctx)
  42 {
  43     OPENSSL_CTX *libctx = PROV_LIBRARY_CONTEXT_OF(provctx);
  44     EVP_MD_CTX *ctx = EVP_MD_CTX_new();
  45     EVP_MD *sha256 = EVP_MD_fetch(libctx, "SHA256", NULL);
  46     char msg[] = "Hello World!";
  47     const unsigned char exptd[] = {
  48         0x7f, 0x83, 0xb1, 0x65, 0x7f, 0xf1, 0xfc, 0x53, 0xb9, 0x2d, 0xc1, 0x81,
  49         0x48, 0xa1, 0xd6, 0x5d, 0xfc, 0x2d, 0x4b, 0x1f, 0xa3, 0xd6, 0x77, 0x28,
  50         0x4a, 0xdd, 0xd2, 0x00, 0x12, 0x6d, 0x90, 0x69
  51     };
  52     unsigned int dgstlen = 0;
  53     unsigned char dgst[SHA256_DIGEST_LENGTH];
  54     int ret = 0;
  55     BN_CTX *bnctx = NULL;
  56     BIGNUM *a = NULL, *b = NULL;
  57
  58     if (ctx == NULL || sha256 == NULL)
  59         goto err;
  60
  61     if (!EVP_DigestInit_ex(ctx, sha256, NULL))
  62         goto err;
  63     if (!EVP_DigestUpdate(ctx, msg, sizeof(msg) - 1))
  64         goto err;
  65     if (!EVP_DigestFinal(ctx, dgst, &dgstlen))
  66         goto err;
  67     if (dgstlen != sizeof(exptd) || memcmp(dgst, exptd, sizeof(exptd)) != 0)
  68         goto err;
  69
  70     bnctx = BN_CTX_new_ex(libctx);
  71     if (bnctx == NULL)
  72         goto err;
  73     BN_CTX_start(bnctx);
  74     a = BN_CTX_get(bnctx);
  75     b = BN_CTX_get(bnctx);
  76     if (b == NULL)
  77         goto err;
  78     BN_zero(a);
  79     if (!BN_one(b)
  80         || !BN_add(a, a, b)
  81         || BN_cmp(a, b) != 0)
  82         goto err;
  83
  84     ret = 1;
  85  err:
  86     BN_CTX_end(bnctx);
  87     BN_CTX_free(bnctx);
  88
  89     EVP_MD_CTX_free(ctx);
  90     EVP_MD_meth_free(sha256);
  91     return ret;
  92 }
  93
  94 static const OSSL_ITEM *fips_get_param_types(const OSSL_PROVIDER *prov)
  95 {
  96     return fips_param_types;
  97 }
  98
  99 static int fips_get_params(const OSSL_PROVIDER *prov,
 100                             const OSSL_PARAM params[])
 101 {
 102     const OSSL_PARAM *p;
 103
 104     p = OSSL_PARAM_locate(params, OSSL_PROV_PARAM_NAME);
 105     if (p != NULL && !OSSL_PARAM_set_utf8_ptr(p, "OpenSSL FIPS Provider"))
 106         return 0;
 107     p = OSSL_PARAM_locate(params, OSSL_PROV_PARAM_VERSION);
 108     if (p != NULL && !OSSL_PARAM_set_utf8_ptr(p, OPENSSL_VERSION_STR))
 109         return 0;
 110     p = OSSL_PARAM_locate(params, OSSL_PROV_PARAM_BUILDINFO);
 111     if (p != NULL && !OSSL_PARAM_set_utf8_ptr(p, OPENSSL_FULL_VERSION_STR))
 112         return 0;
 113
 114     return 1;
 115 }
 116
 117 static const OSSL_ALGORITHM fips_digests[] = {
 118     { "SHA1", "fips=yes", sha1_functions },
 119     { "SHA224", "fips=yes", sha224_functions },
 120     { "SHA256", "fips=yes", sha256_functions },
 121     { "SHA384", "fips=yes", sha384_functions },
 122     { "SHA512", "fips=yes", sha512_functions },
 123     { "SHA512-224", "fips=yes", sha512_224_functions },
 124     { "SHA512-256", "fips=yes", sha512_256_functions },
 125     { "SHA3-224", "fips=yes", sha3_224_functions },
 126     { "SHA3-256", "fips=yes", sha3_256_functions },
 127     { "SHA3-384", "fips=yes", sha3_384_functions },
 128     { "SHA3-512", "fips=yes", sha3_512_functions },
 129     { "KMAC128", "fips=yes", keccak_kmac_128_functions },
 130     { "KMAC256", "fips=yes", keccak_kmac_256_functions },
 131
 132     { NULL, NULL, NULL }
 133 };
 134
 135 static const OSSL_ALGORITHM fips_ciphers[] = {
 136     { "AES-256-ECB", "fips=yes", aes256ecb_functions },
 137     { "AES-192-ECB", "fips=yes", aes192ecb_functions },
 138     { "AES-128-ECB", "fips=yes", aes128ecb_functions },
 139     { "AES-256-CBC", "fips=yes", aes256cbc_functions },
 140     { "AES-192-CBC", "fips=yes", aes192cbc_functions },
 141     { "AES-128-CBC", "fips=yes", aes128cbc_functions },
 142     { "AES-256-CTR", "fips=yes", aes256ctr_functions },
 143     { "AES-192-CTR", "fips=yes", aes192ctr_functions },
 144     { "AES-128-CTR", "fips=yes", aes128ctr_functions },
 145     { NULL, NULL, NULL }
 146 };
 147
 148 static const OSSL_ALGORITHM *fips_query(OSSL_PROVIDER *prov,
 149                                          int operation_id,
 150                                          int *no_cache)
 151 {
 152     *no_cache = 0;
 153     switch (operation_id) {
 154     case OSSL_OP_DIGEST:
 155         return fips_digests;
 156     case OSSL_OP_CIPHER:
 157         return fips_ciphers;
 158     }
 159     return NULL;
 160 }
 161
 162 /* Functions we provide to the core */
 163 static const OSSL_DISPATCH fips_dispatch_table[] = {
 164     /*
 165      * To release our resources we just need to free the OPENSSL_CTX so we just
 166      * use OPENSSL_CTX_free directly as our teardown function
 167      */
 168     { OSSL_FUNC_PROVIDER_TEARDOWN, (void (*)(void))OPENSSL_CTX_free },
 169     { OSSL_FUNC_PROVIDER_GET_PARAM_TYPES, (void (*)(void))fips_get_param_types },
 170     { OSSL_FUNC_PROVIDER_GET_PARAMS, (void (*)(void))fips_get_params },
 171     { OSSL_FUNC_PROVIDER_QUERY_OPERATION, (void (*)(void))fips_query },
 172     { 0, NULL }
 173 };
 174
 175 /* Functions we provide to ourself */
 176 static const OSSL_DISPATCH intern_dispatch_table[] = {
 177     { OSSL_FUNC_PROVIDER_QUERY_OPERATION, (void (*)(void))fips_query },
 178     { 0, NULL }
 179 };
 180
 181
 182 int OSSL_provider_init(const OSSL_PROVIDER *provider,
 183                        const OSSL_DISPATCH *in,
 184                        const OSSL_DISPATCH **out,
 185                        void **provctx)
 186 {
 187     OPENSSL_CTX *ctx;
 188
 189     for (; in->function_id != 0; in++) {
 190         switch (in->function_id) {
 191         case OSSL_FUNC_CORE_GET_PARAM_TYPES:
 192             c_get_param_types = OSSL_get_core_get_param_types(in);
 193             break;
 194         case OSSL_FUNC_CORE_GET_PARAMS:
 195             c_get_params = OSSL_get_core_get_params(in);
 196             break;
 197         case OSSL_FUNC_CORE_PUT_ERROR:
 198             c_put_error = OSSL_get_core_put_error(in);
 199             break;
 200         case OSSL_FUNC_CORE_ADD_ERROR_VDATA:
 201             c_add_error_vdata = OSSL_get_core_add_error_vdata(in);
 202             break;
 203         /* Just ignore anything we don't understand */
 204         default:
 205             break;
 206         }
 207     }
 208
 209     ctx = OPENSSL_CTX_new();
 210     if (ctx == NULL)
 211         return 0;
 212
 213     *out = fips_dispatch_table;
 214     *provctx = ctx;
 215
 216     /*
 217      * TODO(3.0): Remove me. This is just a dummy call to demonstrate making
 218      * EVP calls from within the FIPS module.
 219      */
 220     if (!dummy_evp_call(*provctx)) {
 221         OPENSSL_CTX_free(*provctx);
 222         *provctx = NULL;
 223         return 0;
 224     }
 225
 226     return 1;
 227 }
 228
 229 /*
 230  * The internal init function used when the FIPS module uses EVP to call
 231  * another algorithm also in the FIPS module. This is a recursive call that has
 232  * been made from within the FIPS module itself. To make this work, we populate
 233  * the provider context of this inner instance with the same library context
 234  * that was used in the EVP call that initiated this recursive call.
 235  */
 236 OSSL_provider_init_fn fips_intern_provider_init;
 237 int fips_intern_provider_init(const OSSL_PROVIDER *provider,
 238                               const OSSL_DISPATCH *in,
 239                               const OSSL_DISPATCH **out,
 240                               void **provctx)
 241 {
 242     OSSL_core_get_library_context_fn *c_get_libctx = NULL;
 243
 244     for (; in->function_id != 0; in++) {
 245         switch (in->function_id) {
 246         case OSSL_FUNC_CORE_GET_LIBRARY_CONTEXT:
 247             c_get_libctx = OSSL_get_core_get_library_context(in);
 248             break;
 249         default:
 250             break;
 251         }
 252     }
 253
 254     if (c_get_libctx == NULL)
 255         return 0;
 256
 257     *provctx = c_get_libctx(provider);
 258
 259     /*
 260      * Safety measure...  we should get the library context that was
 261      * created up in OSSL_provider_init().
 262      */
 263     if (*provctx == NULL)
 264         return 0;
 265
 266     *out = intern_dispatch_table;
 267     return 1;
 268 }
 269
 270 void ERR_put_error(int lib, int func, int reason, const char *file, int line)
 271 {
 272     /*
 273      * TODO(3.0): This works for the FIPS module because we're going to be
 274      * using lib/func/reason codes that libcrypto already knows about. This
 275      * won't work for third party providers that have their own error mechanisms,
 276      * so we'll need to come up with something else for them.
 277      */
 278     c_put_error(lib, func, reason, file, line);
 279 }
 280
 281 void ERR_add_error_data(int num, ...)
 282 {
 283     va_list args;
 284     va_start(args, num);
 285     ERR_add_error_vdata(num, args);
 286     va_end(args);
 287 }
 288
 289 void ERR_add_error_vdata(int num, va_list args)
 290 {
 291     c_add_error_vdata(num, args);
 292 }