crypto/encode_decode/decoder_lib.c

   1 /*
   2  * Copyright 2020-2025 The OpenSSL Project Authors. All Rights Reserved.
   3  *
   4  * Licensed under the Apache License 2.0 (the "License").  You may not use
   5  * this file except in compliance with the License.  You can obtain a copy
   6  * in the file LICENSE in the source distribution or at
   7  * https://www.openssl.org/source/license.html
   8  */
   9
  10 #include <openssl/core_names.h>
  11 #include <openssl/bio.h>
  12 #include <openssl/params.h>
  13 #include <openssl/provider.h>
  14 #include <openssl/evperr.h>
  15 #include <openssl/ecerr.h>
  16 #include <openssl/pkcs12err.h>
  17 #include <openssl/x509err.h>
  18 #include <openssl/trace.h>
  19 #include "internal/bio.h"
  20 #include "internal/provider.h"
  21 #include "internal/namemap.h"
  22 #include "crypto/decoder.h"
  23 #include "encoder_local.h"
  24 #include "internal/e_os.h"
  25
  26 struct decoder_process_data_st {
  27     OSSL_DECODER_CTX *ctx;
  28
  29     /* Current BIO */
  30     BIO *bio;
  31
  32     /* Index of the current decoder instance to be processed */
  33     int current_decoder_inst_index;
  34     /* For tracing, count recursion level */
  35     int recursion;
  36
  37     /*-
  38      * Flags
  39      */
  40     unsigned int flag_next_level_called : 1;
  41     unsigned int flag_construct_called : 1;
  42     unsigned int flag_input_structure_checked : 1;
  43 };
  44
  45 static int decoder_process(const OSSL_PARAM params[], void *arg);
  46
  47 int OSSL_DECODER_from_bio(OSSL_DECODER_CTX *ctx, BIO *in)
  48 {
  49     struct decoder_process_data_st data;
  50     int ok = 0;
  51     BIO *new_bio = NULL;
  52     unsigned long lasterr;
  53
  54     if (in == NULL) {
  55         ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_PASSED_NULL_PARAMETER);
  56         return 0;
  57     }
  58
  59     if (OSSL_DECODER_CTX_get_num_decoders(ctx) == 0) {
  60         ERR_raise_data(ERR_LIB_OSSL_DECODER, OSSL_DECODER_R_DECODER_NOT_FOUND,
  61                        "No decoders were found. For standard decoders you need "
  62                        "at least one of the default or base providers "
  63                        "available. Did you forget to load them?");
  64         return 0;
  65     }
  66
  67     lasterr = ERR_peek_last_error();
  68
  69     if (BIO_tell(in) < 0) {
  70         new_bio = BIO_new(BIO_f_readbuffer());
  71         if (new_bio == NULL)
  72             return 0;
  73         in = BIO_push(new_bio, in);
  74     }
  75     memset(&data, 0, sizeof(data));
  76     data.ctx = ctx;
  77     data.bio = in;
  78
  79     /* Enable passphrase caching */
  80     (void)ossl_pw_enable_passphrase_caching(&ctx->pwdata);
  81
  82     ok = decoder_process(NULL, &data);
  83
  84     if (!data.flag_construct_called) {
  85         const char *spaces
  86             = ctx->start_input_type != NULL && ctx->input_structure != NULL
  87             ? " " : "";
  88         const char *input_type_label
  89             = ctx->start_input_type != NULL ? "Input type: " : "";
  90         const char *input_structure_label
  91             = ctx->input_structure != NULL ? "Input structure: " : "";
  92         const char *comma
  93             = ctx->start_input_type != NULL && ctx->input_structure != NULL
  94             ? ", " : "";
  95         const char *input_type
  96             = ctx->start_input_type != NULL ? ctx->start_input_type : "";
  97         const char *input_structure
  98             = ctx->input_structure != NULL ? ctx->input_structure : "";
  99
 100         if (ERR_peek_last_error() == lasterr || ERR_peek_error() == 0)
 101             /* Prevent spurious decoding error but add at least something */
 102             ERR_raise_data(ERR_LIB_OSSL_DECODER, ERR_R_UNSUPPORTED,
 103                            "No supported data to decode. %s%s%s%s%s%s",
 104                            spaces, input_type_label, input_type, comma,
 105                            input_structure_label, input_structure);
 106         ok = 0;
 107     }
 108
 109     /* Clear any internally cached passphrase */
 110     (void)ossl_pw_clear_passphrase_cache(&ctx->pwdata);
 111
 112     if (new_bio != NULL) {
 113         BIO_pop(new_bio);
 114         BIO_free(new_bio);
 115     }
 116     return ok;
 117 }
 118
 119 #ifndef OPENSSL_NO_STDIO
 120 static BIO *bio_from_file(FILE *fp)
 121 {
 122     BIO *b;
 123
 124     if ((b = BIO_new(BIO_s_file())) == NULL) {
 125         ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_BIO_LIB);
 126         return NULL;
 127     }
 128     BIO_set_fp(b, fp, BIO_NOCLOSE);
 129     return b;
 130 }
 131
 132 int OSSL_DECODER_from_fp(OSSL_DECODER_CTX *ctx, FILE *fp)
 133 {
 134     BIO *b = bio_from_file(fp);
 135     int ret = 0;
 136
 137     if (b != NULL)
 138         ret = OSSL_DECODER_from_bio(ctx, b);
 139
 140     BIO_free(b);
 141     return ret;
 142 }
 143 #endif
 144
 145 int OSSL_DECODER_from_data(OSSL_DECODER_CTX *ctx, const unsigned char **pdata,
 146                            size_t *pdata_len)
 147 {
 148     BIO *membio;
 149     int ret = 0;
 150
 151     if (pdata == NULL || *pdata == NULL || pdata_len == NULL) {
 152         ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_PASSED_NULL_PARAMETER);
 153         return 0;
 154     }
 155
 156     membio = BIO_new_mem_buf(*pdata, (int)*pdata_len);
 157     if (OSSL_DECODER_from_bio(ctx, membio)) {
 158         *pdata_len = (size_t)BIO_get_mem_data(membio, pdata);
 159         ret = 1;
 160     }
 161     BIO_free(membio);
 162
 163     return ret;
 164 }
 165
 166 int OSSL_DECODER_CTX_set_selection(OSSL_DECODER_CTX *ctx, int selection)
 167 {
 168     if (!ossl_assert(ctx != NULL)) {
 169         ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_PASSED_NULL_PARAMETER);
 170         return 0;
 171     }
 172
 173     /*
 174      * 0 is a valid selection, and means that the caller leaves
 175      * it to code to discover what the selection is.
 176      */
 177     ctx->selection = selection;
 178     return 1;
 179 }
 180
 181 int OSSL_DECODER_CTX_set_input_type(OSSL_DECODER_CTX *ctx,
 182                                     const char *input_type)
 183 {
 184     if (!ossl_assert(ctx != NULL)) {
 185         ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_PASSED_NULL_PARAMETER);
 186         return 0;
 187     }
 188
 189     /*
 190      * NULL is a valid starting input type, and means that the caller leaves
 191      * it to code to discover what the starting input type is.
 192      */
 193     ctx->start_input_type = input_type;
 194     return 1;
 195 }
 196
 197 int OSSL_DECODER_CTX_set_input_structure(OSSL_DECODER_CTX *ctx,
 198                                          const char *input_structure)
 199 {
 200     if (!ossl_assert(ctx != NULL)) {
 201         ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_PASSED_NULL_PARAMETER);
 202         return 0;
 203     }
 204
 205     /*
 206      * NULL is a valid starting input structure, and means that the caller
 207      * leaves it to code to discover what the starting input structure is.
 208      */
 209     ctx->input_structure = input_structure;
 210     return 1;
 211 }
 212
 213 OSSL_DECODER_INSTANCE *
 214 ossl_decoder_instance_new_forprov(OSSL_DECODER *decoder, void *provctx,
 215                                   const char *input_structure)
 216 {
 217     void *decoderctx;
 218
 219     if (!ossl_assert(decoder != NULL)) {
 220         ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_PASSED_NULL_PARAMETER);
 221         return 0;
 222     }
 223
 224     decoderctx = decoder->newctx(provctx);
 225     if (decoderctx == NULL)
 226         return 0;
 227     if (input_structure != NULL && decoder->set_ctx_params != NULL) {
 228         OSSL_PARAM params[] = { OSSL_PARAM_END, OSSL_PARAM_END };
 229
 230         params[0] =
 231             OSSL_PARAM_construct_utf8_string(OSSL_OBJECT_PARAM_DATA_STRUCTURE,
 232                                              (char *)input_structure, 0);
 233         if (!decoder->set_ctx_params(decoderctx, params)) {
 234             decoder->freectx(decoderctx);
 235             return 0;
 236         }
 237     }
 238     return ossl_decoder_instance_new(decoder, decoderctx);
 239 }
 240
 241 OSSL_DECODER_INSTANCE *ossl_decoder_instance_new(OSSL_DECODER *decoder,
 242                                                  void *decoderctx)
 243 {
 244     OSSL_DECODER_INSTANCE *decoder_inst = NULL;
 245     const OSSL_PROVIDER *prov;
 246     OSSL_LIB_CTX *libctx;
 247     const OSSL_PROPERTY_LIST *props;
 248     const OSSL_PROPERTY_DEFINITION *prop;
 249
 250     if (!ossl_assert(decoder != NULL)) {
 251         ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_PASSED_NULL_PARAMETER);
 252         return 0;
 253     }
 254
 255     if ((decoder_inst = OPENSSL_zalloc(sizeof(*decoder_inst))) == NULL)
 256         return 0;
 257
 258     prov = OSSL_DECODER_get0_provider(decoder);
 259     libctx = ossl_provider_libctx(prov);
 260     props = ossl_decoder_parsed_properties(decoder);
 261     if (props == NULL) {
 262         ERR_raise_data(ERR_LIB_OSSL_DECODER, ERR_R_INVALID_PROPERTY_DEFINITION,
 263                        "there are no property definitions with decoder %s",
 264                        OSSL_DECODER_get0_name(decoder));
 265         goto err;
 266     }
 267
 268     /* The "input" property is mandatory */
 269     prop = ossl_property_find_property(props, libctx, "input");
 270     decoder_inst->input_type = ossl_property_get_string_value(libctx, prop);
 271     decoder_inst->input_type_id = 0;
 272     if (decoder_inst->input_type == NULL) {
 273         ERR_raise_data(ERR_LIB_OSSL_DECODER, ERR_R_INVALID_PROPERTY_DEFINITION,
 274                        "the mandatory 'input' property is missing "
 275                        "for decoder %s (properties: %s)",
 276                        OSSL_DECODER_get0_name(decoder),
 277                        OSSL_DECODER_get0_properties(decoder));
 278         goto err;
 279     }
 280
 281     /* The "structure" property is optional */
 282     prop = ossl_property_find_property(props, libctx, "structure");
 283     if (prop != NULL) {
 284         decoder_inst->input_structure
 285             = ossl_property_get_string_value(libctx, prop);
 286     }
 287
 288     if (!OSSL_DECODER_up_ref(decoder)) {
 289         ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_INTERNAL_ERROR);
 290         goto err;
 291     }
 292     decoder_inst->decoder = decoder;
 293     decoder_inst->decoderctx = decoderctx;
 294     return decoder_inst;
 295  err:
 296     ossl_decoder_instance_free(decoder_inst);
 297     return NULL;
 298 }
 299
 300 void ossl_decoder_instance_free(OSSL_DECODER_INSTANCE *decoder_inst)
 301 {
 302     if (decoder_inst != NULL) {
 303         if (decoder_inst->decoder != NULL)
 304             decoder_inst->decoder->freectx(decoder_inst->decoderctx);
 305         decoder_inst->decoderctx = NULL;
 306         OSSL_DECODER_free(decoder_inst->decoder);
 307         decoder_inst->decoder = NULL;
 308         OPENSSL_free(decoder_inst);
 309     }
 310 }
 311
 312 OSSL_DECODER_INSTANCE *ossl_decoder_instance_dup(const OSSL_DECODER_INSTANCE *src)
 313 {
 314     OSSL_DECODER_INSTANCE *dest;
 315     const OSSL_PROVIDER *prov;
 316     void *provctx;
 317
 318     if ((dest = OPENSSL_zalloc(sizeof(*dest))) == NULL)
 319         return NULL;
 320
 321     *dest = *src;
 322     if (!OSSL_DECODER_up_ref(dest->decoder)) {
 323         ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_INTERNAL_ERROR);
 324         goto err;
 325     }
 326     prov = OSSL_DECODER_get0_provider(dest->decoder);
 327     provctx = OSSL_PROVIDER_get0_provider_ctx(prov);
 328
 329     dest->decoderctx = dest->decoder->newctx(provctx);
 330     if (dest->decoderctx == NULL) {
 331         ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_INTERNAL_ERROR);
 332         OSSL_DECODER_free(dest->decoder);
 333         goto err;
 334     }
 335
 336     return dest;
 337
 338  err:
 339     OPENSSL_free(dest);
 340     return NULL;
 341 }
 342
 343 void ossl_decoder_ctx_set_harderr(OSSL_DECODER_CTX *ctx)
 344 {
 345     ctx->harderr = 1;
 346 }
 347
 348 int ossl_decoder_ctx_get_harderr(const OSSL_DECODER_CTX *ctx)
 349 {
 350     return ctx->harderr;
 351 }
 352
 353 int ossl_decoder_ctx_add_decoder_inst(OSSL_DECODER_CTX *ctx,
 354                                       OSSL_DECODER_INSTANCE *di)
 355 {
 356     int ok;
 357
 358     if (ctx->decoder_insts == NULL
 359         && (ctx->decoder_insts =
 360             sk_OSSL_DECODER_INSTANCE_new_null()) == NULL) {
 361         ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_CRYPTO_LIB);
 362         return 0;
 363     }
 364
 365     ok = (sk_OSSL_DECODER_INSTANCE_push(ctx->decoder_insts, di) > 0);
 366     if (ok) {
 367         OSSL_TRACE_BEGIN(DECODER) {
 368             BIO_printf(trc_out,
 369                        "(ctx %p) Added decoder instance %p for decoder %p\n"
 370                        "    %s with %s\n",
 371                        (void *)ctx, (void *)di, (void *)di->decoder,
 372                        OSSL_DECODER_get0_name(di->decoder),
 373                        OSSL_DECODER_get0_properties(di->decoder));
 374         } OSSL_TRACE_END(DECODER);
 375     }
 376     return ok;
 377 }
 378
 379 int OSSL_DECODER_CTX_add_decoder(OSSL_DECODER_CTX *ctx, OSSL_DECODER *decoder)
 380 {
 381     OSSL_DECODER_INSTANCE *decoder_inst = NULL;
 382     const OSSL_PROVIDER *prov = NULL;
 383     void *decoderctx = NULL;
 384     void *provctx = NULL;
 385
 386     if (!ossl_assert(ctx != NULL) || !ossl_assert(decoder != NULL)) {
 387         ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_PASSED_NULL_PARAMETER);
 388         return 0;
 389     }
 390
 391     prov = OSSL_DECODER_get0_provider(decoder);
 392     provctx = OSSL_PROVIDER_get0_provider_ctx(prov);
 393
 394     if ((decoderctx = decoder->newctx(provctx)) == NULL
 395         || (decoder_inst =
 396             ossl_decoder_instance_new(decoder, decoderctx)) == NULL)
 397         goto err;
 398     /* Avoid double free of decoderctx on further errors */
 399     decoderctx = NULL;
 400
 401     if (!ossl_decoder_ctx_add_decoder_inst(ctx, decoder_inst))
 402         goto err;
 403
 404     return 1;
 405  err:
 406     ossl_decoder_instance_free(decoder_inst);
 407     if (decoderctx != NULL)
 408         decoder->freectx(decoderctx);
 409     return 0;
 410 }
 411
 412 struct collect_extra_decoder_data_st {
 413     OSSL_DECODER_CTX *ctx;
 414     const char *output_type;
 415     int output_type_id;
 416
 417     /*
 418      * 0 to check that the decoder's input type is the same as the decoder name
 419      * 1 to check that the decoder's input type differs from the decoder name
 420      */
 421     enum { IS_SAME = 0, IS_DIFFERENT = 1 } type_check;
 422     int w_prev_start, w_prev_end; /* "previous" decoders */
 423     int w_new_start, w_new_end;   /* "new" decoders */
 424 };
 425
 426 DEFINE_STACK_OF(OSSL_DECODER)
 427
 428 static void collect_all_decoders(OSSL_DECODER *decoder, void *arg)
 429 {
 430     STACK_OF(OSSL_DECODER) *skdecoders = arg;
 431
 432     if (OSSL_DECODER_up_ref(decoder)
 433             && !sk_OSSL_DECODER_push(skdecoders, decoder))
 434         OSSL_DECODER_free(decoder);
 435 }
 436
 437 static void collect_extra_decoder(OSSL_DECODER *decoder, void *arg)
 438 {
 439     struct collect_extra_decoder_data_st *data = arg;
 440     int j;
 441     const OSSL_PROVIDER *prov = OSSL_DECODER_get0_provider(decoder);
 442     void *provctx = OSSL_PROVIDER_get0_provider_ctx(prov);
 443
 444     if (ossl_decoder_fast_is_a(decoder, data->output_type, &data->output_type_id)) {
 445         void *decoderctx = NULL;
 446         OSSL_DECODER_INSTANCE *di = NULL;
 447
 448         OSSL_TRACE_BEGIN(DECODER) {
 449             BIO_printf(trc_out,
 450                        "(ctx %p) [%d] Checking out decoder %p:\n"
 451                        "    %s with %s\n",
 452                        (void *)data->ctx, data->type_check, (void *)decoder,
 453                        OSSL_DECODER_get0_name(decoder),
 454                        OSSL_DECODER_get0_properties(decoder));
 455         } OSSL_TRACE_END(DECODER);
 456
 457         /*
 458          * Check that we don't already have this decoder in our stack,
 459          * starting with the previous windows but also looking at what
 460          * we have added in the current window.
 461          */
 462         for (j = data->w_prev_start; j < data->w_new_end; j++) {
 463             OSSL_DECODER_INSTANCE *check_inst =
 464                 sk_OSSL_DECODER_INSTANCE_value(data->ctx->decoder_insts, j);
 465
 466             if (decoder->base.algodef == check_inst->decoder->base.algodef) {
 467                 /* We found it, so don't do anything more */
 468                 OSSL_TRACE_BEGIN(DECODER) {
 469                     BIO_printf(trc_out,
 470                                "    REJECTED: already exists in the chain\n");
 471                 } OSSL_TRACE_END(DECODER);
 472                 return;
 473             }
 474         }
 475
 476         if ((decoderctx = decoder->newctx(provctx)) == NULL)
 477             return;
 478
 479         if (decoder->set_ctx_params != NULL
 480             && data->ctx->input_structure != NULL) {
 481             OSSL_PARAM params[] = { OSSL_PARAM_END, OSSL_PARAM_END };
 482             const char *str = data->ctx->input_structure;
 483
 484             params[0] =
 485                 OSSL_PARAM_construct_utf8_string(OSSL_OBJECT_PARAM_DATA_STRUCTURE,
 486                                                  (char *)str, 0);
 487             if (!decoder->set_ctx_params(decoderctx, params)) {
 488                 decoder->freectx(decoderctx);
 489                 return;
 490             }
 491         }
 492
 493         if ((di = ossl_decoder_instance_new(decoder, decoderctx)) == NULL) {
 494             decoder->freectx(decoderctx);
 495             return;
 496         }
 497
 498         switch (data->type_check) {
 499         case IS_SAME:
 500             /* If it differs, this is not a decoder to add for now. */
 501             if (!ossl_decoder_fast_is_a(decoder,
 502                                         OSSL_DECODER_INSTANCE_get_input_type(di),
 503                                         &di->input_type_id)) {
 504                 ossl_decoder_instance_free(di);
 505                 OSSL_TRACE_BEGIN(DECODER) {
 506                     BIO_printf(trc_out,
 507                                "    REJECTED: input type doesn't match output type\n");
 508                 } OSSL_TRACE_END(DECODER);
 509                 return;
 510             }
 511             break;
 512         case IS_DIFFERENT:
 513             /* If it's the same, this is not a decoder to add for now. */
 514             if (ossl_decoder_fast_is_a(decoder,
 515                                        OSSL_DECODER_INSTANCE_get_input_type(di),
 516                                        &di->input_type_id)) {
 517                 ossl_decoder_instance_free(di);
 518                 OSSL_TRACE_BEGIN(DECODER) {
 519                     BIO_printf(trc_out,
 520                                "    REJECTED: input type matches output type\n");
 521                 } OSSL_TRACE_END(DECODER);
 522                 return;
 523             }
 524             break;
 525         }
 526
 527         /*
 528          * Apart from keeping w_new_end up to date, We don't care about
 529          * errors here.  If it doesn't collect, then it doesn't...
 530          */
 531         if (!ossl_decoder_ctx_add_decoder_inst(data->ctx, di)) {
 532             ossl_decoder_instance_free(di);
 533             return;
 534         }
 535
 536         data->w_new_end++;
 537     }
 538 }
 539
 540 static int decoder_sk_cmp(const OSSL_DECODER_INSTANCE *const *a,
 541                           const OSSL_DECODER_INSTANCE *const *b)
 542 {
 543     if ((*a)->score == (*b)->score)
 544         return (*a)->order - (*b)->order;
 545     return (*a)->score - (*b)->score;
 546 }
 547
 548 int OSSL_DECODER_CTX_add_extra(OSSL_DECODER_CTX *ctx,
 549                                OSSL_LIB_CTX *libctx, const char *propq)
 550 {
 551     /*
 552      * This function goes through existing decoder methods in
 553      * |ctx->decoder_insts|, and tries to fetch new decoders that produce
 554      * what the existing ones want as input, and push those newly fetched
 555      * decoders on top of the same stack.
 556      * Then it does the same again, but looping over the newly fetched
 557      * decoders, until there are no more decoders to be fetched, or
 558      * when we have done this 10 times.
 559      *
 560      * we do this with sliding windows on the stack by keeping track of indexes
 561      * and of the end.
 562      *
 563      * +----------------+
 564      * |   DER to RSA   | <--- w_prev_start
 565      * +----------------+
 566      * |   DER to DSA   |
 567      * +----------------+
 568      * |   DER to DH    |
 569      * +----------------+
 570      * |   PEM to DER   | <--- w_prev_end, w_new_start
 571      * +----------------+
 572      *                    <--- w_new_end
 573      */
 574     struct collect_extra_decoder_data_st data;
 575     size_t depth = 0; /* Counts the number of iterations */
 576     size_t count; /* Calculates how many were added in each iteration */
 577     int numdecoders;
 578     STACK_OF(OSSL_DECODER) *skdecoders;
 579
 580     if (!ossl_assert(ctx != NULL)) {
 581         ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_PASSED_NULL_PARAMETER);
 582         return 0;
 583     }
 584
 585     /*
 586      * If there is no stack of OSSL_DECODER_INSTANCE, we have nothing
 587      * more to add.  That's fine.
 588      */
 589     if (ctx->decoder_insts == NULL)
 590         return 1;
 591
 592     OSSL_TRACE_BEGIN(DECODER) {
 593         BIO_printf(trc_out, "(ctx %p) Looking for extra decoders\n",
 594                    (void *)ctx);
 595     } OSSL_TRACE_END(DECODER);
 596
 597
 598     skdecoders = sk_OSSL_DECODER_new_null();
 599     if (skdecoders == NULL) {
 600         ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_CRYPTO_LIB);
 601         return 0;
 602     }
 603     OSSL_DECODER_do_all_provided(libctx, collect_all_decoders, skdecoders);
 604     numdecoders = sk_OSSL_DECODER_num(skdecoders);
 605
 606     /*
 607      * If there are provided or default properties, sort the initial decoder list
 608      * by property matching score so that the highest scored provider is selected
 609      * first.
 610      */
 611     if (propq != NULL || ossl_ctx_global_properties(libctx, 0) != NULL) {
 612         int num_decoder_insts = sk_OSSL_DECODER_INSTANCE_num(ctx->decoder_insts);
 613         int i;
 614         OSSL_DECODER_INSTANCE *di;
 615         sk_OSSL_DECODER_INSTANCE_compfunc old_cmp =
 616             sk_OSSL_DECODER_INSTANCE_set_cmp_func(ctx->decoder_insts, decoder_sk_cmp);
 617
 618         for (i = 0; i < num_decoder_insts; i++) {
 619             di = sk_OSSL_DECODER_INSTANCE_value(ctx->decoder_insts, i);
 620             di->order = i;
 621         }
 622         sk_OSSL_DECODER_INSTANCE_sort(ctx->decoder_insts);
 623         sk_OSSL_DECODER_INSTANCE_set_cmp_func(ctx->decoder_insts, old_cmp);
 624     }
 625
 626     memset(&data, 0, sizeof(data));
 627     data.ctx = ctx;
 628     data.w_prev_start = 0;
 629     data.w_prev_end = sk_OSSL_DECODER_INSTANCE_num(ctx->decoder_insts);
 630     do {
 631         int i, j;
 632
 633         data.w_new_start = data.w_new_end = data.w_prev_end;
 634
 635         /*
 636          * Two iterations:
 637          * 0.  All decoders that have the same name as their input type.
 638          *     This allows for decoders that unwrap some data in a specific
 639          *     encoding, and pass the result on with the same encoding.
 640          * 1.  All decoders that a different name than their input type.
 641          */
 642         for (data.type_check = IS_SAME;
 643              data.type_check <= IS_DIFFERENT;
 644              data.type_check++) {
 645             for (i = data.w_prev_start; i < data.w_prev_end; i++) {
 646                 OSSL_DECODER_INSTANCE *decoder_inst =
 647                     sk_OSSL_DECODER_INSTANCE_value(ctx->decoder_insts, i);
 648
 649                 data.output_type
 650                     = OSSL_DECODER_INSTANCE_get_input_type(decoder_inst);
 651
 652                 data.output_type_id = 0;
 653
 654                 for (j = 0; j < numdecoders; j++)
 655                     collect_extra_decoder(sk_OSSL_DECODER_value(skdecoders, j),
 656                                           &data);
 657             }
 658         }
 659         /* How many were added in this iteration */
 660         count = data.w_new_end - data.w_new_start;
 661
 662         /* Slide the "previous decoder" windows */
 663         data.w_prev_start = data.w_new_start;
 664         data.w_prev_end = data.w_new_end;
 665
 666         depth++;
 667     } while (count != 0 && depth <= 10);
 668
 669     sk_OSSL_DECODER_pop_free(skdecoders, OSSL_DECODER_free);
 670     return 1;
 671 }
 672
 673 int OSSL_DECODER_CTX_get_num_decoders(OSSL_DECODER_CTX *ctx)
 674 {
 675     if (ctx == NULL || ctx->decoder_insts == NULL)
 676         return 0;
 677     return sk_OSSL_DECODER_INSTANCE_num(ctx->decoder_insts);
 678 }
 679
 680 int OSSL_DECODER_CTX_set_construct(OSSL_DECODER_CTX *ctx,
 681                                    OSSL_DECODER_CONSTRUCT *construct)
 682 {
 683     if (!ossl_assert(ctx != NULL)) {
 684         ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_PASSED_NULL_PARAMETER);
 685         return 0;
 686     }
 687     ctx->construct = construct;
 688     return 1;
 689 }
 690
 691 int OSSL_DECODER_CTX_set_construct_data(OSSL_DECODER_CTX *ctx,
 692                                         void *construct_data)
 693 {
 694     if (!ossl_assert(ctx != NULL)) {
 695         ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_PASSED_NULL_PARAMETER);
 696         return 0;
 697     }
 698     ctx->construct_data = construct_data;
 699     return 1;
 700 }
 701
 702 int OSSL_DECODER_CTX_set_cleanup(OSSL_DECODER_CTX *ctx,
 703                                  OSSL_DECODER_CLEANUP *cleanup)
 704 {
 705     if (!ossl_assert(ctx != NULL)) {
 706         ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_PASSED_NULL_PARAMETER);
 707         return 0;
 708     }
 709     ctx->cleanup = cleanup;
 710     return 1;
 711 }
 712
 713 OSSL_DECODER_CONSTRUCT *
 714 OSSL_DECODER_CTX_get_construct(OSSL_DECODER_CTX *ctx)
 715 {
 716     if (ctx == NULL)
 717         return NULL;
 718     return ctx->construct;
 719 }
 720
 721 void *OSSL_DECODER_CTX_get_construct_data(OSSL_DECODER_CTX *ctx)
 722 {
 723     if (ctx == NULL)
 724         return NULL;
 725     return ctx->construct_data;
 726 }
 727
 728 OSSL_DECODER_CLEANUP *
 729 OSSL_DECODER_CTX_get_cleanup(OSSL_DECODER_CTX *ctx)
 730 {
 731     if (ctx == NULL)
 732         return NULL;
 733     return ctx->cleanup;
 734 }
 735
 736 int OSSL_DECODER_export(OSSL_DECODER_INSTANCE *decoder_inst,
 737                         void *reference, size_t reference_sz,
 738                         OSSL_CALLBACK *export_cb, void *export_cbarg)
 739 {
 740     OSSL_DECODER *decoder = NULL;
 741     void *decoderctx = NULL;
 742
 743     if (!(ossl_assert(decoder_inst != NULL)
 744           && ossl_assert(reference != NULL)
 745           && ossl_assert(export_cb != NULL)
 746           && ossl_assert(export_cbarg != NULL))) {
 747         ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_PASSED_NULL_PARAMETER);
 748         return 0;
 749     }
 750
 751     decoder = OSSL_DECODER_INSTANCE_get_decoder(decoder_inst);
 752     decoderctx = OSSL_DECODER_INSTANCE_get_decoder_ctx(decoder_inst);
 753     return decoder->export_object(decoderctx, reference, reference_sz,
 754                                   export_cb, export_cbarg);
 755 }
 756
 757 OSSL_DECODER *
 758 OSSL_DECODER_INSTANCE_get_decoder(OSSL_DECODER_INSTANCE *decoder_inst)
 759 {
 760     if (decoder_inst == NULL)
 761         return NULL;
 762     return decoder_inst->decoder;
 763 }
 764
 765 void *
 766 OSSL_DECODER_INSTANCE_get_decoder_ctx(OSSL_DECODER_INSTANCE *decoder_inst)
 767 {
 768     if (decoder_inst == NULL)
 769         return NULL;
 770     return decoder_inst->decoderctx;
 771 }
 772
 773 const char *
 774 OSSL_DECODER_INSTANCE_get_input_type(OSSL_DECODER_INSTANCE *decoder_inst)
 775 {
 776     if (decoder_inst == NULL)
 777         return NULL;
 778     return decoder_inst->input_type;
 779 }
 780
 781 const char *
 782 OSSL_DECODER_INSTANCE_get_input_structure(OSSL_DECODER_INSTANCE *decoder_inst,
 783                                           int *was_set)
 784 {
 785     if (decoder_inst == NULL)
 786         return NULL;
 787     *was_set = decoder_inst->flag_input_structure_was_set;
 788     return decoder_inst->input_structure;
 789 }
 790
 791 static int decoder_process(const OSSL_PARAM params[], void *arg)
 792 {
 793     struct decoder_process_data_st *data = arg;
 794     OSSL_DECODER_CTX *ctx = data->ctx;
 795     OSSL_DECODER_INSTANCE *decoder_inst = NULL;
 796     OSSL_DECODER *decoder = NULL;
 797     OSSL_CORE_BIO *cbio = NULL;
 798     BIO *bio = data->bio;
 799     long loc;
 800     int i;
 801     int ok = 0;
 802     /* For recursions */
 803     struct decoder_process_data_st new_data;
 804     const char *data_type = NULL;
 805     const char *data_structure = NULL;
 806     /* Saved to restore on return, mutated in PEM->DER transition. */
 807     const char *start_input_type = ctx->start_input_type;
 808
 809     /*
 810      * This is an indicator up the call stack that something was indeed
 811      * decoded, leading to a recursive call of this function.
 812      */
 813     data->flag_next_level_called = 1;
 814
 815     memset(&new_data, 0, sizeof(new_data));
 816     new_data.ctx = data->ctx;
 817     new_data.recursion = data->recursion + 1;
 818
 819 #define LEVEL_STR ">>>>>>>>>>>>>>>>"
 820 #define LEVEL ((size_t)new_data.recursion < sizeof(LEVEL_STR)           \
 821                ? &LEVEL_STR[sizeof(LEVEL_STR) - new_data.recursion - 1] \
 822                : LEVEL_STR "...")
 823
 824     if (params == NULL) {
 825         /* First iteration, where we prepare for what is to come */
 826
 827         OSSL_TRACE_BEGIN(DECODER) {
 828             BIO_printf(trc_out,
 829                        "(ctx %p) starting to walk the decoder chain\n",
 830                        (void *)new_data.ctx);
 831         } OSSL_TRACE_END(DECODER);
 832
 833         data->current_decoder_inst_index =
 834             OSSL_DECODER_CTX_get_num_decoders(ctx);
 835
 836         bio = data->bio;
 837     } else {
 838         const OSSL_PARAM *p;
 839         const char *trace_data_structure;
 840
 841         decoder_inst =
 842             sk_OSSL_DECODER_INSTANCE_value(ctx->decoder_insts,
 843                                            data->current_decoder_inst_index);
 844         decoder = OSSL_DECODER_INSTANCE_get_decoder(decoder_inst);
 845
 846         data->flag_construct_called = 0;
 847         if (ctx->construct != NULL) {
 848             int rv;
 849
 850             OSSL_TRACE_BEGIN(DECODER) {
 851                 BIO_printf(trc_out,
 852                            "(ctx %p) %s Running constructor\n",
 853                            (void *)new_data.ctx, LEVEL);
 854             } OSSL_TRACE_END(DECODER);
 855
 856             rv = ctx->construct(decoder_inst, params, ctx->construct_data);
 857
 858             OSSL_TRACE_BEGIN(DECODER) {
 859                 BIO_printf(trc_out,
 860                            "(ctx %p) %s Running constructor => %d\n",
 861                            (void *)new_data.ctx, LEVEL, rv);
 862             } OSSL_TRACE_END(DECODER);
 863
 864             ok = (rv > 0);
 865             if (ok) {
 866                 data->flag_construct_called = 1;
 867                 goto end;
 868             }
 869         }
 870
 871         /* The constructor didn't return success */
 872
 873         /*
 874          * so we try to use the object we got and feed it to any next
 875          * decoder that will take it.  Object references are not
 876          * allowed for this.
 877          * If this data isn't present, decoding has failed.
 878          */
 879
 880         p = OSSL_PARAM_locate_const(params, OSSL_OBJECT_PARAM_DATA);
 881         if (p == NULL || p->data_type != OSSL_PARAM_OCTET_STRING)
 882             goto end;
 883         new_data.bio = BIO_new_mem_buf(p->data, (int)p->data_size);
 884         if (new_data.bio == NULL)
 885             goto end;
 886         bio = new_data.bio;
 887
 888         /* Get the data type if there is one */
 889         p = OSSL_PARAM_locate_const(params, OSSL_OBJECT_PARAM_DATA_TYPE);
 890         if (p != NULL && !OSSL_PARAM_get_utf8_string_ptr(p, &data_type))
 891             goto end;
 892
 893         /* Get the data structure if there is one */
 894         p = OSSL_PARAM_locate_const(params, OSSL_OBJECT_PARAM_DATA_STRUCTURE);
 895         if (p != NULL && !OSSL_PARAM_get_utf8_string_ptr(p, &data_structure))
 896             goto end;
 897
 898         /* Get the new input type if there is one */
 899         p = OSSL_PARAM_locate_const(params, OSSL_OBJECT_PARAM_INPUT_TYPE);
 900         if (p != NULL) {
 901             if (!OSSL_PARAM_get_utf8_string_ptr(p, &ctx->start_input_type))
 902                 goto end;
 903             /*
 904              * When switching PKCS8 from PEM to DER we decrypt the data if needed
 905              * and then determine the algorithm OID.  Likewise, with SPKI, only
 906              * this time sans decryption.
 907              */
 908             if (ctx->input_structure != NULL
 909                 && (OPENSSL_strcasecmp(ctx->input_structure, "SubjectPublicKeyInfo") == 0
 910                     || OPENSSL_strcasecmp(data_structure, "PrivateKeyInfo") == 0
 911                     || OPENSSL_strcasecmp(ctx->input_structure, "PrivateKeyInfo") == 0))
 912                 data->flag_input_structure_checked = 1;
 913         }
 914
 915         /*
 916          * If the data structure is "type-specific" and the data type is
 917          * given, we drop the data structure.  The reasoning is that the
 918          * data type is already enough to find the applicable next decoder,
 919          * so an additional "type-specific" data structure is extraneous.
 920          *
 921          * Furthermore, if the OSSL_DECODER caller asked for a type specific
 922          * structure under another name, such as "DH", we get a mismatch
 923          * if the data structure we just received is "type-specific".
 924          * There's only so much you can do without infusing this code with
 925          * too special knowledge.
 926          */
 927         trace_data_structure = data_structure;
 928         if (data_type != NULL && data_structure != NULL
 929             && OPENSSL_strcasecmp(data_structure, "type-specific") == 0)
 930             data_structure = NULL;
 931
 932         OSSL_TRACE_BEGIN(DECODER) {
 933             BIO_printf(trc_out,
 934                        "(ctx %p) %s incoming from previous decoder (%p):\n"
 935                        "    data type: %s, data structure: %s%s\n",
 936                        (void *)new_data.ctx, LEVEL, (void *)decoder,
 937                        data_type, trace_data_structure,
 938                        (trace_data_structure == data_structure
 939                         ? "" : " (dropped)"));
 940         } OSSL_TRACE_END(DECODER);
 941     }
 942
 943     /*
 944      * If we have no more decoders to look through at this point,
 945      * we failed
 946      */
 947     if (data->current_decoder_inst_index == 0)
 948         goto end;
 949
 950     if ((loc = BIO_tell(bio)) < 0) {
 951         ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_BIO_LIB);
 952         goto end;
 953     }
 954
 955     if ((cbio = ossl_core_bio_new_from_bio(bio)) == NULL) {
 956         ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_BIO_LIB);
 957         goto end;
 958     }
 959
 960     for (i = data->current_decoder_inst_index; i-- > 0;) {
 961         OSSL_DECODER_INSTANCE *new_decoder_inst =
 962             sk_OSSL_DECODER_INSTANCE_value(ctx->decoder_insts, i);
 963         OSSL_DECODER *new_decoder =
 964             OSSL_DECODER_INSTANCE_get_decoder(new_decoder_inst);
 965         const char *new_decoder_name = NULL;
 966         void *new_decoderctx =
 967             OSSL_DECODER_INSTANCE_get_decoder_ctx(new_decoder_inst);
 968         const char *new_input_type =
 969             OSSL_DECODER_INSTANCE_get_input_type(new_decoder_inst);
 970         int n_i_s_was_set = 0;   /* We don't care here */
 971         const char *new_input_structure =
 972             OSSL_DECODER_INSTANCE_get_input_structure(new_decoder_inst,
 973                                                       &n_i_s_was_set);
 974
 975         OSSL_TRACE_BEGIN(DECODER) {
 976             new_decoder_name = OSSL_DECODER_get0_name(new_decoder);
 977             BIO_printf(trc_out,
 978                        "(ctx %p) %s [%u] Considering decoder instance %p (decoder %p):\n"
 979                        "    %s with %s\n",
 980                        (void *)new_data.ctx, LEVEL, (unsigned int)i,
 981                        (void *)new_decoder_inst, (void *)new_decoder,
 982                        new_decoder_name,
 983                        OSSL_DECODER_get0_properties(new_decoder));
 984         } OSSL_TRACE_END(DECODER);
 985
 986         /*
 987          * If |decoder| is NULL, it means we've just started, and the caller
 988          * may have specified what it expects the initial input to be.  If
 989          * that's the case, we do this extra check.
 990          */
 991         if (decoder == NULL && ctx->start_input_type != NULL
 992             && OPENSSL_strcasecmp(ctx->start_input_type, new_input_type) != 0) {
 993             OSSL_TRACE_BEGIN(DECODER) {
 994                 BIO_printf(trc_out,
 995                            "(ctx %p) %s [%u] the start input type '%s' doesn't match the input type of the considered decoder, skipping...\n",
 996                            (void *)new_data.ctx, LEVEL, (unsigned int)i,
 997                            ctx->start_input_type);
 998             } OSSL_TRACE_END(DECODER);
 999             continue;
1000         }
1001
1002         /*
1003          * If we have a previous decoder, we check that the input type
1004          * of the next to be used matches the type of this previous one.
1005          * |new_input_type| holds the value of the "input-type" parameter
1006          * for the decoder we're currently considering.
1007          */
1008         if (decoder != NULL && !ossl_decoder_fast_is_a(decoder, new_input_type,
1009                                                        &new_decoder_inst->input_type_id)) {
1010             OSSL_TRACE_BEGIN(DECODER) {
1011                 BIO_printf(trc_out,
1012                            "(ctx %p) %s [%u] the input type doesn't match the name of the previous decoder (%p), skipping...\n",
1013                            (void *)new_data.ctx, LEVEL, (unsigned int)i,
1014                            (void *)decoder);
1015             } OSSL_TRACE_END(DECODER);
1016             continue;
1017         }
1018
1019         /*
1020          * If the previous decoder gave us a data type, we check to see
1021          * if that matches the decoder we're currently considering.
1022          */
1023         if (data_type != NULL && !OSSL_DECODER_is_a(new_decoder, data_type)) {
1024             OSSL_TRACE_BEGIN(DECODER) {
1025                 BIO_printf(trc_out,
1026                            "(ctx %p) %s [%u] the previous decoder's data type doesn't match the name of the considered decoder, skipping...\n",
1027                            (void *)new_data.ctx, LEVEL, (unsigned int)i);
1028             } OSSL_TRACE_END(DECODER);
1029             continue;
1030         }
1031
1032         /*
1033          * If the previous decoder gave us a data structure name, we check
1034          * to see that it matches the input data structure of the decoder
1035          * we're currently considering.
1036          */
1037         if (data_structure != NULL
1038             && (new_input_structure == NULL
1039                 || OPENSSL_strcasecmp(data_structure,
1040                                       new_input_structure) != 0)) {
1041             OSSL_TRACE_BEGIN(DECODER) {
1042                 BIO_printf(trc_out,
1043                            "(ctx %p) %s [%u] the previous decoder's data structure doesn't match the input structure of the considered decoder, skipping...\n",
1044                            (void *)new_data.ctx, LEVEL, (unsigned int)i);
1045             } OSSL_TRACE_END(DECODER);
1046             continue;
1047         }
1048
1049         /*
1050          * If the decoder we're currently considering specifies a structure,
1051          * and this check hasn't already been done earlier in this chain of
1052          * decoder_process() calls, check that it matches the user provided
1053          * input structure, if one is given.
1054          */
1055         if (!data->flag_input_structure_checked
1056             && ctx->input_structure != NULL
1057             && new_input_structure != NULL) {
1058             data->flag_input_structure_checked = 1;
1059             if (OPENSSL_strcasecmp(new_input_structure,
1060                                    ctx->input_structure) != 0) {
1061                 OSSL_TRACE_BEGIN(DECODER) {
1062                     BIO_printf(trc_out,
1063                                "(ctx %p) %s [%u] the previous decoder's data structure doesn't match the input structure given by the user, skipping...\n",
1064                                (void *)new_data.ctx, LEVEL, (unsigned int)i);
1065                 } OSSL_TRACE_END(DECODER);
1066                 continue;
1067             }
1068         }
1069
1070         /*
1071          * Checking the return value of BIO_reset() or BIO_seek() is unsafe.
1072          * Furthermore, BIO_reset() is unsafe to use if the source BIO happens
1073          * to be a BIO_s_mem(), because the earlier BIO_tell() gives us zero
1074          * no matter where we are in the underlying buffer we're reading from.
1075          *
1076          * So, we simply do a BIO_seek(), and use BIO_tell() that we're back
1077          * at the same position.  This is a best effort attempt, but BIO_seek()
1078          * and BIO_tell() should come as a pair...
1079          */
1080         (void)BIO_seek(bio, loc);
1081         if (BIO_tell(bio) != loc)
1082             goto end;
1083
1084         /* Recurse */
1085         OSSL_TRACE_BEGIN(DECODER) {
1086             BIO_printf(trc_out,
1087                        "(ctx %p) %s [%u] Running decoder instance %s (%p)\n",
1088                        (void *)new_data.ctx, LEVEL, (unsigned int)i,
1089                        new_decoder_name, (void *)new_decoder_inst);
1090         } OSSL_TRACE_END(DECODER);
1091
1092         /*
1093          * We only care about errors reported from decoder implementations
1094          * if it returns false (i.e. there was a fatal error).
1095          */
1096         ERR_set_mark();
1097
1098         new_data.current_decoder_inst_index = i;
1099         new_data.flag_input_structure_checked
1100             = data->flag_input_structure_checked;
1101         ok = new_decoder->decode(new_decoderctx, cbio,
1102                                  new_data.ctx->selection,
1103                                  decoder_process, &new_data,
1104                                  ossl_pw_passphrase_callback_dec,
1105                                  &new_data.ctx->pwdata);
1106
1107         OSSL_TRACE_BEGIN(DECODER) {
1108             BIO_printf(trc_out,
1109                        "(ctx %p) %s [%u] Running decoder instance %s (%p) => %d"
1110                        " (recursed further: %s, construct called: %s)\n",
1111                        (void *)new_data.ctx, LEVEL, (unsigned int)i,
1112                        new_decoder_name, (void *)new_decoder_inst, ok,
1113                        new_data.flag_next_level_called ? "yes" : "no",
1114                        new_data.flag_construct_called ? "yes" : "no");
1115         } OSSL_TRACE_END(DECODER);
1116
1117         data->flag_construct_called = new_data.flag_construct_called;
1118
1119         /* Break on error or if we tried to construct an object already */
1120         if (!ok || data->flag_construct_called) {
1121             ERR_clear_last_mark();
1122             break;
1123         }
1124         ERR_pop_to_mark();
1125
1126         /*
1127          * Break if the decoder implementation that we called recursed, since
1128          * that indicates that it successfully decoded something.
1129          */
1130         if (new_data.flag_next_level_called)
1131             break;
1132     }
1133
1134  end:
1135     ossl_core_bio_free(cbio);
1136     BIO_free(new_data.bio);
1137     ctx->start_input_type = start_input_type;
1138     return ok;
1139 }