]> git.ipfire.org Git - thirdparty/openssl.git/blame - crypto/context.c
ossl_provider_add_to_store: Avoid use-after-free
[thirdparty/openssl.git] / crypto / context.c
CommitLineData
d64b6299 1/*
4333b89f 2 * Copyright 2019-2021 The OpenSSL Project Authors. All Rights Reserved.
d64b6299
RL
3 *
4 * Licensed under the Apache License 2.0 (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
8 */
9
25f2138b 10#include "crypto/cryptlib.h"
22e27978 11#include <openssl/conf.h>
d64b6299 12#include "internal/thread_once.h"
505f4660 13#include "internal/property.h"
4b1f34f1 14#include "internal/core.h"
b0ee1de9 15#include "internal/bio.h"
f12a5690 16#include "internal/provider.h"
d64b6299 17
b4250010
DMSP
18struct ossl_lib_ctx_onfree_list_st {
19 ossl_lib_ctx_onfree_fn *fn;
20 struct ossl_lib_ctx_onfree_list_st *next;
b8fe36fe
MC
21};
22
b4250010 23struct ossl_lib_ctx_st {
d64b6299
RL
24 CRYPTO_RWLOCK *lock;
25 CRYPTO_EX_DATA data;
1aedc35f
MC
26
27 /*
b4250010 28 * For most data in the OSSL_LIB_CTX we just use ex_data to store it. But
1aedc35f
MC
29 * that doesn't work for ex_data itself - so we store that directly.
30 */
31 OSSL_EX_DATA_GLOBAL global;
32
33 /* Map internal static indexes to dynamically created indexes */
b4250010 34 int dyn_indexes[OSSL_LIB_CTX_MAX_INDEXES];
1aedc35f 35
770de346 36 /* Keep a separate lock for each index */
b4250010 37 CRYPTO_RWLOCK *index_locks[OSSL_LIB_CTX_MAX_INDEXES];
770de346 38
1aedc35f 39 CRYPTO_RWLOCK *oncelock;
b4250010
DMSP
40 int run_once_done[OSSL_LIB_CTX_MAX_RUN_ONCE];
41 int run_once_ret[OSSL_LIB_CTX_MAX_RUN_ONCE];
42 struct ossl_lib_ctx_onfree_list_st *onfreelist;
f12a5690 43 unsigned int ischild:1;
d64b6299
RL
44};
45
4b1f34f1
P
46int ossl_lib_ctx_write_lock(OSSL_LIB_CTX *ctx)
47{
48 return CRYPTO_THREAD_write_lock(ossl_lib_ctx_get_concrete(ctx)->lock);
49}
50
51int ossl_lib_ctx_read_lock(OSSL_LIB_CTX *ctx)
52{
53 return CRYPTO_THREAD_read_lock(ossl_lib_ctx_get_concrete(ctx)->lock);
54}
55
56int ossl_lib_ctx_unlock(OSSL_LIB_CTX *ctx)
57{
58 return CRYPTO_THREAD_unlock(ossl_lib_ctx_get_concrete(ctx)->lock);
59}
60
f12a5690
MC
61int ossl_lib_ctx_is_child(OSSL_LIB_CTX *ctx)
62{
63 ctx = ossl_lib_ctx_get_concrete(ctx);
64
65 if (ctx == NULL)
66 return 0;
67 return ctx->ischild;
68}
69
b4250010 70static int context_init(OSSL_LIB_CTX *ctx)
d64b6299 71{
1aedc35f 72 size_t i;
505f4660 73 int exdata_done = 0;
1aedc35f
MC
74
75 ctx->lock = CRYPTO_THREAD_lock_new();
76 if (ctx->lock == NULL)
77 return 0;
78
79 ctx->oncelock = CRYPTO_THREAD_lock_new();
80 if (ctx->oncelock == NULL)
81 goto err;
82
b4250010 83 for (i = 0; i < OSSL_LIB_CTX_MAX_INDEXES; i++) {
770de346 84 ctx->index_locks[i] = CRYPTO_THREAD_lock_new();
1aedc35f 85 ctx->dyn_indexes[i] = -1;
770de346
MC
86 if (ctx->index_locks[i] == NULL)
87 goto err;
88 }
1aedc35f 89
b4250010 90 /* OSSL_LIB_CTX is built on top of ex_data so we initialise that directly */
e4bec869 91 if (!ossl_do_ex_data_init(ctx))
1aedc35f 92 goto err;
505f4660 93 exdata_done = 1;
1aedc35f 94
e4bec869
SL
95 if (!ossl_crypto_new_ex_data_ex(ctx, CRYPTO_EX_INDEX_OSSL_LIB_CTX, NULL,
96 &ctx->data)) {
97 ossl_crypto_cleanup_all_ex_data_int(ctx);
1aedc35f
MC
98 goto err;
99 }
100
505f4660
MC
101 /* Everything depends on properties, so we also pre-initialise that */
102 if (!ossl_property_parse_init(ctx))
103 goto err;
104
1aedc35f
MC
105 return 1;
106 err:
505f4660 107 if (exdata_done)
e4bec869 108 ossl_crypto_cleanup_all_ex_data_int(ctx);
1aedc35f
MC
109 CRYPTO_THREAD_lock_free(ctx->oncelock);
110 CRYPTO_THREAD_lock_free(ctx->lock);
111 ctx->lock = NULL;
112 return 0;
d64b6299
RL
113}
114
b4250010 115static int context_deinit(OSSL_LIB_CTX *ctx)
d64b6299 116{
b4250010 117 struct ossl_lib_ctx_onfree_list_st *tmp, *onfree;
770de346 118 int i;
1aedc35f
MC
119
120 if (ctx == NULL)
121 return 1;
b8fe36fe 122
da747958
MC
123 ossl_ctx_thread_stop(ctx);
124
1aedc35f 125 onfree = ctx->onfreelist;
b8fe36fe
MC
126 while (onfree != NULL) {
127 onfree->fn(ctx);
128 tmp = onfree;
129 onfree = onfree->next;
130 OPENSSL_free(tmp);
131 }
b4250010 132 CRYPTO_free_ex_data(CRYPTO_EX_INDEX_OSSL_LIB_CTX, NULL, &ctx->data);
e4bec869 133 ossl_crypto_cleanup_all_ex_data_int(ctx);
b4250010 134 for (i = 0; i < OSSL_LIB_CTX_MAX_INDEXES; i++)
770de346
MC
135 CRYPTO_THREAD_lock_free(ctx->index_locks[i]);
136
1aedc35f 137 CRYPTO_THREAD_lock_free(ctx->oncelock);
d64b6299 138 CRYPTO_THREAD_lock_free(ctx->lock);
1aedc35f 139 ctx->lock = NULL;
d64b6299
RL
140 return 1;
141}
142
f844f9eb 143#ifndef FIPS_MODULE
5a975275 144/* The default default context */
b4250010 145static OSSL_LIB_CTX default_context_int;
5a975275
RL
146
147static CRYPTO_ONCE default_context_init = CRYPTO_ONCE_STATIC_INIT;
148static CRYPTO_THREAD_LOCAL default_context_thread_local;
149
150DEFINE_RUN_ONCE_STATIC(default_context_do_init)
151{
152 return CRYPTO_THREAD_init_local(&default_context_thread_local, NULL)
153 && context_init(&default_context_int);
154}
155
b4250010 156void ossl_lib_ctx_default_deinit(void)
d64b6299 157{
5a975275 158 context_deinit(&default_context_int);
d64b6299 159}
1aedc35f 160
b4250010 161static OSSL_LIB_CTX *get_thread_default_context(void)
d64b6299 162{
5a975275
RL
163 if (!RUN_ONCE(&default_context_init, default_context_do_init))
164 return NULL;
1aedc35f 165
5a975275
RL
166 return CRYPTO_THREAD_get_local(&default_context_thread_local);
167}
168
b4250010 169static OSSL_LIB_CTX *get_default_context(void)
5a975275 170{
b4250010 171 OSSL_LIB_CTX *current_defctx = get_thread_default_context();
5a975275
RL
172
173 if (current_defctx == NULL)
174 current_defctx = &default_context_int;
175 return current_defctx;
176}
177
b4250010 178static int set_default_context(OSSL_LIB_CTX *defctx)
5a975275
RL
179{
180 if (defctx == &default_context_int)
181 defctx = NULL;
182
183 return CRYPTO_THREAD_set_local(&default_context_thread_local, defctx);
d64b6299 184}
1aedc35f 185#endif
d64b6299 186
b4250010 187OSSL_LIB_CTX *OSSL_LIB_CTX_new(void)
d64b6299 188{
b4250010 189 OSSL_LIB_CTX *ctx = OPENSSL_zalloc(sizeof(*ctx));
d64b6299
RL
190
191 if (ctx != NULL && !context_init(ctx)) {
b4250010 192 OSSL_LIB_CTX_free(ctx);
d64b6299
RL
193 ctx = NULL;
194 }
195 return ctx;
196}
197
f844f9eb 198#ifndef FIPS_MODULE
f12a5690
MC
199OSSL_LIB_CTX *OSSL_LIB_CTX_new_from_dispatch(const OSSL_CORE_HANDLE *handle,
200 const OSSL_DISPATCH *in)
b0ee1de9
MC
201{
202 OSSL_LIB_CTX *ctx = OSSL_LIB_CTX_new();
203
204 if (ctx == NULL)
205 return NULL;
206
207 if (!ossl_bio_init_core(ctx, in)) {
208 OSSL_LIB_CTX_free(ctx);
209 return NULL;
210 }
211
212 return ctx;
213}
214
f12a5690
MC
215OSSL_LIB_CTX *OSSL_LIB_CTX_new_child(const OSSL_CORE_HANDLE *handle,
216 const OSSL_DISPATCH *in)
217{
218 OSSL_LIB_CTX *ctx = OSSL_LIB_CTX_new_from_dispatch(handle, in);
219
220 if (ctx == NULL)
221 return NULL;
222
223 if (!ossl_provider_init_as_child(ctx, handle, in)) {
224 OSSL_LIB_CTX_free(ctx);
225 return NULL;
226 }
227 ctx->ischild = 1;
228
229 return ctx;
230}
231
b4250010 232int OSSL_LIB_CTX_load_config(OSSL_LIB_CTX *ctx, const char *config_file)
22e27978 233{
d8652be0 234 return CONF_modules_load_file_ex(ctx, config_file, NULL, 0) > 0;
22e27978
SL
235}
236#endif
237
b4250010 238void OSSL_LIB_CTX_free(OSSL_LIB_CTX *ctx)
d64b6299 239{
b4250010 240 if (ossl_lib_ctx_is_default(ctx))
5a975275
RL
241 return;
242
cad22202
MC
243#ifndef FIPS_MODULE
244 if (ctx->ischild)
245 ossl_provider_deinit_child(ctx);
246#endif
5a975275 247 context_deinit(ctx);
d64b6299
RL
248 OPENSSL_free(ctx);
249}
250
978e323a
MC
251#ifndef FIPS_MODULE
252OSSL_LIB_CTX *OSSL_LIB_CTX_get0_global_default(void)
253{
254 if (!RUN_ONCE(&default_context_init, default_context_do_init))
255 return NULL;
256
257 return &default_context_int;
258}
259
b4250010 260OSSL_LIB_CTX *OSSL_LIB_CTX_set0_default(OSSL_LIB_CTX *libctx)
5a975275 261{
b4250010 262 OSSL_LIB_CTX *current_defctx;
5a975275 263
92b20fb8
MC
264 if ((current_defctx = get_default_context()) != NULL) {
265 if (libctx != NULL)
266 set_default_context(libctx);
5a975275 267 return current_defctx;
92b20fb8 268 }
5a975275
RL
269
270 return NULL;
271}
978e323a 272#endif
5a975275 273
b4250010 274OSSL_LIB_CTX *ossl_lib_ctx_get_concrete(OSSL_LIB_CTX *ctx)
d4c051ce 275{
f844f9eb 276#ifndef FIPS_MODULE
5a975275
RL
277 if (ctx == NULL)
278 return get_default_context();
d4c051ce
MC
279#endif
280 return ctx;
281}
282
b4250010 283int ossl_lib_ctx_is_default(OSSL_LIB_CTX *ctx)
6b1e5fa4 284{
f844f9eb 285#ifndef FIPS_MODULE
5a975275 286 if (ctx == NULL || ctx == get_default_context())
6b1e5fa4 287 return 1;
cfbd76c1
RL
288#endif
289 return 0;
290}
291
b4250010 292int ossl_lib_ctx_is_global_default(OSSL_LIB_CTX *ctx)
cfbd76c1
RL
293{
294#ifndef FIPS_MODULE
b4250010 295 if (ossl_lib_ctx_get_concrete(ctx) == &default_context_int)
cfbd76c1 296 return 1;
6b1e5fa4
MC
297#endif
298 return 0;
299}
300
b4250010
DMSP
301static void ossl_lib_ctx_generic_new(void *parent_ign, void *ptr_ign,
302 CRYPTO_EX_DATA *ad, int index,
303 long argl_ign, void *argp)
d64b6299 304{
b4250010 305 const OSSL_LIB_CTX_METHOD *meth = argp;
e4bec869 306 OSSL_LIB_CTX *ctx = ossl_crypto_ex_data_get_ossl_lib_ctx(ad);
2c404214 307 void *ptr = meth->new_func(ctx);
d64b6299 308
2c404214 309 if (ptr != NULL) {
cd3f8c1b
RS
310 if (!CRYPTO_THREAD_write_lock(ctx->lock))
311 /*
312 * Can't return something, so best to hope that something will
313 * fail later. :(
314 */
315 return;
d64b6299 316 CRYPTO_set_ex_data(ad, index, ptr);
2c404214
MC
317 CRYPTO_THREAD_unlock(ctx->lock);
318 }
d64b6299 319}
b4250010
DMSP
320static void ossl_lib_ctx_generic_free(void *parent_ign, void *ptr,
321 CRYPTO_EX_DATA *ad, int index,
322 long argl_ign, void *argp)
d64b6299 323{
b4250010 324 const OSSL_LIB_CTX_METHOD *meth = argp;
d64b6299
RL
325
326 meth->free_func(ptr);
327}
1aedc35f 328
b4250010
DMSP
329static int ossl_lib_ctx_init_index(OSSL_LIB_CTX *ctx, int static_index,
330 const OSSL_LIB_CTX_METHOD *meth)
d64b6299 331{
1aedc35f
MC
332 int idx;
333
b4250010 334 ctx = ossl_lib_ctx_get_concrete(ctx);
1aedc35f
MC
335 if (ctx == NULL)
336 return 0;
337
e4bec869
SL
338 idx = ossl_crypto_get_ex_new_index_ex(ctx, CRYPTO_EX_INDEX_OSSL_LIB_CTX, 0,
339 (void *)meth,
340 ossl_lib_ctx_generic_new,
a16d2174
MC
341 NULL, ossl_lib_ctx_generic_free,
342 meth->priority);
1aedc35f
MC
343 if (idx < 0)
344 return 0;
345
346 ctx->dyn_indexes[static_index] = idx;
347 return 1;
d64b6299
RL
348}
349
b4250010
DMSP
350void *ossl_lib_ctx_get_data(OSSL_LIB_CTX *ctx, int index,
351 const OSSL_LIB_CTX_METHOD *meth)
d64b6299
RL
352{
353 void *data = NULL;
770de346 354 int dynidx;
d64b6299 355
b4250010 356 ctx = ossl_lib_ctx_get_concrete(ctx);
b8fe36fe
MC
357 if (ctx == NULL)
358 return NULL;
d64b6299 359
cd3f8c1b
RS
360 if (!CRYPTO_THREAD_read_lock(ctx->lock))
361 return NULL;
770de346
MC
362 dynidx = ctx->dyn_indexes[index];
363 CRYPTO_THREAD_unlock(ctx->lock);
364
365 if (dynidx != -1) {
cd3f8c1b
RS
366 if (!CRYPTO_THREAD_read_lock(ctx->index_locks[index]))
367 return NULL;
368 if (!CRYPTO_THREAD_read_lock(ctx->lock)) {
369 CRYPTO_THREAD_unlock(ctx->index_locks[index]);
370 return NULL;
371 }
770de346 372 data = CRYPTO_get_ex_data(&ctx->data, dynidx);
04b9435a 373 CRYPTO_THREAD_unlock(ctx->lock);
770de346
MC
374 CRYPTO_THREAD_unlock(ctx->index_locks[index]);
375 return data;
376 }
d64b6299 377
cd3f8c1b
RS
378 if (!CRYPTO_THREAD_write_lock(ctx->index_locks[index]))
379 return NULL;
380 if (!CRYPTO_THREAD_write_lock(ctx->lock)) {
381 CRYPTO_THREAD_unlock(ctx->index_locks[index]);
382 return NULL;
383 }
770de346
MC
384
385 dynidx = ctx->dyn_indexes[index];
386 if (dynidx != -1) {
770de346 387 data = CRYPTO_get_ex_data(&ctx->data, dynidx);
04b9435a 388 CRYPTO_THREAD_unlock(ctx->lock);
770de346
MC
389 CRYPTO_THREAD_unlock(ctx->index_locks[index]);
390 return data;
391 }
392
b4250010 393 if (!ossl_lib_ctx_init_index(ctx, index, meth)) {
1aedc35f 394 CRYPTO_THREAD_unlock(ctx->lock);
770de346 395 CRYPTO_THREAD_unlock(ctx->index_locks[index]);
1aedc35f
MC
396 return NULL;
397 }
398
770de346
MC
399 CRYPTO_THREAD_unlock(ctx->lock);
400
04b9435a
MC
401 /*
402 * The alloc call ensures there's a value there. We release the ctx->lock
403 * for this, because the allocation itself may recursively call
404 * ossl_lib_ctx_get_data for other indexes (never this one). The allocation
405 * will itself aquire the ctx->lock when it actually comes to store the
406 * allocated data (see ossl_lib_ctx_generic_new() above). We call
407 * ossl_crypto_alloc_ex_data_intern() here instead of CRYPTO_alloc_ex_data().
408 * They do the same thing except that the latter calls CRYPTO_get_ex_data()
409 * as well - which we must not do without holding the ctx->lock.
410 */
411 if (ossl_crypto_alloc_ex_data_intern(CRYPTO_EX_INDEX_OSSL_LIB_CTX, NULL,
412 &ctx->data, ctx->dyn_indexes[index])) {
cd3f8c1b
RS
413 if (!CRYPTO_THREAD_read_lock(ctx->lock))
414 goto end;
1aedc35f 415 data = CRYPTO_get_ex_data(&ctx->data, ctx->dyn_indexes[index]);
04b9435a
MC
416 CRYPTO_THREAD_unlock(ctx->lock);
417 }
d64b6299 418
cd3f8c1b 419end:
770de346 420 CRYPTO_THREAD_unlock(ctx->index_locks[index]);
d64b6299
RL
421 return data;
422}
423
b4250010 424OSSL_EX_DATA_GLOBAL *ossl_lib_ctx_get_ex_data_global(OSSL_LIB_CTX *ctx)
1aedc35f 425{
b4250010 426 ctx = ossl_lib_ctx_get_concrete(ctx);
1aedc35f
MC
427 if (ctx == NULL)
428 return NULL;
429 return &ctx->global;
430}
431
b4250010
DMSP
432int ossl_lib_ctx_run_once(OSSL_LIB_CTX *ctx, unsigned int idx,
433 ossl_lib_ctx_run_once_fn run_once_fn)
b8fe36fe
MC
434{
435 int done = 0, ret = 0;
436
b4250010 437 ctx = ossl_lib_ctx_get_concrete(ctx);
b8fe36fe
MC
438 if (ctx == NULL)
439 return 0;
440
cd3f8c1b
RS
441 if (!CRYPTO_THREAD_read_lock(ctx->oncelock))
442 return 0;
b8fe36fe
MC
443 done = ctx->run_once_done[idx];
444 if (done)
445 ret = ctx->run_once_ret[idx];
1aedc35f 446 CRYPTO_THREAD_unlock(ctx->oncelock);
b8fe36fe
MC
447
448 if (done)
449 return ret;
450
cd3f8c1b
RS
451 if (!CRYPTO_THREAD_write_lock(ctx->oncelock))
452 return 0;
b8fe36fe
MC
453 if (ctx->run_once_done[idx]) {
454 ret = ctx->run_once_ret[idx];
1aedc35f 455 CRYPTO_THREAD_unlock(ctx->oncelock);
b8fe36fe
MC
456 return ret;
457 }
458
459 ret = run_once_fn(ctx);
460 ctx->run_once_done[idx] = 1;
461 ctx->run_once_ret[idx] = ret;
1aedc35f 462 CRYPTO_THREAD_unlock(ctx->oncelock);
b8fe36fe
MC
463
464 return ret;
465}
466
b4250010 467int ossl_lib_ctx_onfree(OSSL_LIB_CTX *ctx, ossl_lib_ctx_onfree_fn onfreefn)
b8fe36fe 468{
b4250010 469 struct ossl_lib_ctx_onfree_list_st *newonfree
b8fe36fe
MC
470 = OPENSSL_malloc(sizeof(*newonfree));
471
472 if (newonfree == NULL)
473 return 0;
474
475 newonfree->fn = onfreefn;
476 newonfree->next = ctx->onfreelist;
477 ctx->onfreelist = newonfree;
478
479 return 1;
480}
d6d42cda
RL
481
482const char *ossl_lib_ctx_get_descriptor(OSSL_LIB_CTX *libctx)
483{
484#ifdef FIPS_MODULE
485 return "FIPS internal library context";
486#else
487 if (ossl_lib_ctx_is_global_default(libctx))
488 return "Global default library context";
489 if (ossl_lib_ctx_is_default(libctx))
490 return "Thread-local default library context";
491 return "Non-default library context";
492#endif
493}