crypto/provider_child.c

   1 /*
   2  * Copyright 2019-2021 The OpenSSL Project Authors. All Rights Reserved.
   3  *
   4  * Licensed under the Apache License 2.0 (the "License").  You may not use
   5  * this file except in compliance with the License.  You can obtain a copy
   6  * in the file LICENSE in the source distribution or at
   7  * https://www.openssl.org/source/license.html
   8  */
   9
  10 #include <assert.h>
  11 #include <openssl/crypto.h>
  12 #include <openssl/core_dispatch.h>
  13 #include <openssl/core_names.h>
  14 #include <openssl/provider.h>
  15 #include "internal/provider.h"
  16 #include "internal/cryptlib.h"
  17
  18 DEFINE_STACK_OF(OSSL_PROVIDER)
  19
  20 struct child_prov_globals {
  21     const OSSL_CORE_HANDLE *handle;
  22     const OSSL_CORE_HANDLE *curr_prov;
  23     unsigned int isinited:1;
  24     CRYPTO_RWLOCK *lock;
  25     OSSL_FUNC_core_get_libctx_fn *c_get_libctx;
  26     OSSL_FUNC_provider_register_child_cb_fn *c_provider_register_child_cb;
  27     OSSL_FUNC_provider_deregister_child_cb_fn *c_provider_deregister_child_cb;
  28     OSSL_FUNC_provider_name_fn *c_prov_name;
  29     OSSL_FUNC_provider_get0_provider_ctx_fn *c_prov_get0_provider_ctx;
  30     OSSL_FUNC_provider_get0_dispatch_fn *c_prov_get0_dispatch;
  31     OSSL_FUNC_provider_up_ref_fn *c_prov_up_ref;
  32     OSSL_FUNC_provider_free_fn *c_prov_free;
  33 };
  34
  35 static void *child_prov_ossl_ctx_new(OSSL_LIB_CTX *libctx)
  36 {
  37     return OPENSSL_zalloc(sizeof(struct child_prov_globals));
  38 }
  39
  40 static void child_prov_ossl_ctx_free(void *vgbl)
  41 {
  42     struct child_prov_globals *gbl = vgbl;
  43
  44     gbl->c_provider_deregister_child_cb(gbl->handle);
  45     CRYPTO_THREAD_lock_free(gbl->lock);
  46     OPENSSL_free(gbl);
  47 }
  48
  49 static const OSSL_LIB_CTX_METHOD child_prov_ossl_ctx_method = {
  50     OSSL_LIB_CTX_METHOD_DEFAULT_PRIORITY,
  51     child_prov_ossl_ctx_new,
  52     child_prov_ossl_ctx_free,
  53 };
  54
  55 static OSSL_provider_init_fn ossl_child_provider_init;
  56
  57 static int ossl_child_provider_init(const OSSL_CORE_HANDLE *handle,
  58                                     const OSSL_DISPATCH *in,
  59                                     const OSSL_DISPATCH **out,
  60                                     void **provctx)
  61 {
  62     OSSL_FUNC_core_get_libctx_fn *c_get_libctx = NULL;
  63     OSSL_LIB_CTX *ctx;
  64     struct child_prov_globals *gbl;
  65
  66     for (; in->function_id != 0; in++) {
  67         switch (in->function_id) {
  68         case OSSL_FUNC_CORE_GET_LIBCTX:
  69             c_get_libctx = OSSL_FUNC_core_get_libctx(in);
  70             break;
  71         default:
  72             /* Just ignore anything we don't understand */
  73             break;
  74         }
  75     }
  76
  77     if (c_get_libctx == NULL)
  78         return 0;
  79
  80     /*
  81      * We need an OSSL_LIB_CTX but c_get_libctx returns OPENSSL_CORE_CTX. We are
  82      * a built-in provider and so we can get away with this cast. Normal
  83      * providers can't do this.
  84      */
  85     ctx = (OSSL_LIB_CTX *)c_get_libctx(handle);
  86
  87     gbl = ossl_lib_ctx_get_data(ctx, OSSL_LIB_CTX_CHILD_PROVIDER_INDEX,
  88                                 &child_prov_ossl_ctx_method);
  89     if (gbl == NULL)
  90         return 0;
  91
  92     *provctx = gbl->c_prov_get0_provider_ctx(gbl->curr_prov);
  93     *out = gbl->c_prov_get0_dispatch(gbl->curr_prov);
  94
  95     return 1;
  96 }
  97
  98 static int provider_create_child_cb(const OSSL_CORE_HANDLE *prov, void *cbdata)
  99 {
 100     OSSL_LIB_CTX *ctx = cbdata;
 101     struct child_prov_globals *gbl;
 102     const char *provname;
 103     OSSL_PROVIDER *cprov;
 104     int ret = 0;
 105
 106     gbl = ossl_lib_ctx_get_data(ctx, OSSL_LIB_CTX_CHILD_PROVIDER_INDEX,
 107                                 &child_prov_ossl_ctx_method);
 108     if (gbl == NULL)
 109         return 0;
 110
 111     /*
 112      * If !gbl->isinited, then we are still initing and we already hold the
 113      * lock - so don't take it again.
 114      */
 115     if (gbl->isinited && !CRYPTO_THREAD_write_lock(gbl->lock))
 116         return 0;
 117
 118     provname = gbl->c_prov_name(prov);
 119
 120     /*
 121      * We're operating under a lock so we can store the "current" provider in
 122      * the global data.
 123      */
 124     gbl->curr_prov = prov;
 125
 126     if ((cprov = ossl_provider_find(ctx, provname, 1)) != NULL) {
 127         /*
 128         * We free the newly created ref. We rely on the provider sticking around
 129         * in the provider store.
 130         */
 131         ossl_provider_free(cprov);
 132
 133         /*
 134          * The provider already exists. It could be an unused built-in, or a
 135          * previously created child, or it could have been explicitly loaded. If
 136          * explicitly loaded it cannot be converted to a child and we ignore it
 137          * - i.e. we don't start treating it like a child.
 138          */
 139         if (!ossl_provider_convert_to_child(cprov, prov,
 140                                             ossl_child_provider_init))
 141             goto err;
 142     } else {
 143         /*
 144          * Create it - passing 1 as final param so we don't try and recursively
 145          * init children
 146          */
 147         if ((cprov = ossl_provider_new(ctx, provname, ossl_child_provider_init,
 148                                        1)) == NULL)
 149             goto err;
 150
 151         /*
 152         * We free the newly created ref. We rely on the provider sticking around
 153         * in the provider store.
 154         */
 155         ossl_provider_free(cprov);
 156
 157         if (!ossl_provider_activate(cprov, 0, 0))
 158             goto err;
 159
 160         if (!ossl_provider_set_child(cprov, prov)) {
 161             ossl_provider_deactivate(cprov);
 162             goto err;
 163         }
 164     }
 165
 166     ret = 1;
 167  err:
 168     if (gbl->isinited)
 169         CRYPTO_THREAD_unlock(gbl->lock);
 170     return ret;
 171 }
 172
 173 static int provider_remove_child_cb(const OSSL_CORE_HANDLE *prov, void *cbdata)
 174 {
 175     OSSL_LIB_CTX *ctx = cbdata;
 176     struct child_prov_globals *gbl;
 177     const char *provname;
 178     OSSL_PROVIDER *cprov;
 179
 180     gbl = ossl_lib_ctx_get_data(ctx, OSSL_LIB_CTX_CHILD_PROVIDER_INDEX,
 181                                 &child_prov_ossl_ctx_method);
 182     if (gbl == NULL)
 183         return 0;
 184
 185     provname = gbl->c_prov_name(prov);
 186     cprov = ossl_provider_find(ctx, provname, 1);
 187     if (cprov == NULL)
 188         return 0;
 189     /*
 190      * ossl_provider_find ups the ref count, so we free it again here. We can
 191      * rely on the provider store reference count.
 192      */
 193     ossl_provider_free(cprov);
 194     if (ossl_provider_is_child(cprov)
 195             && !ossl_provider_deactivate(cprov))
 196         return 0;
 197
 198     return 1;
 199 }
 200
 201 int ossl_provider_init_child_providers(OSSL_LIB_CTX *ctx)
 202 {
 203     struct child_prov_globals *gbl;
 204
 205     /* Should never happen */
 206     if (ctx == NULL)
 207         return 0;
 208
 209     gbl = ossl_lib_ctx_get_data(ctx, OSSL_LIB_CTX_CHILD_PROVIDER_INDEX,
 210                                 &child_prov_ossl_ctx_method);
 211     if (gbl == NULL)
 212         return 0;
 213
 214     if (!CRYPTO_THREAD_read_lock(gbl->lock))
 215         return 0;
 216     if (gbl->isinited) {
 217         CRYPTO_THREAD_unlock(gbl->lock);
 218         return 1;
 219     }
 220     CRYPTO_THREAD_unlock(gbl->lock);
 221
 222     if (!CRYPTO_THREAD_write_lock(gbl->lock))
 223         return 0;
 224     if (!gbl->isinited) {
 225         if (!gbl->c_provider_register_child_cb(gbl->handle,
 226                                                provider_create_child_cb,
 227                                                provider_remove_child_cb,
 228                                                ctx)) {
 229             CRYPTO_THREAD_unlock(gbl->lock);
 230             return 0;
 231         }
 232         gbl->isinited = 1;
 233     }
 234     CRYPTO_THREAD_unlock(gbl->lock);
 235
 236     return 1;
 237 }
 238
 239 int ossl_provider_init_as_child(OSSL_LIB_CTX *ctx,
 240                                 const OSSL_CORE_HANDLE *handle,
 241                                 const OSSL_DISPATCH *in)
 242 {
 243     struct child_prov_globals *gbl;
 244
 245     if (ctx == NULL)
 246         return 0;
 247
 248     gbl = ossl_lib_ctx_get_data(ctx, OSSL_LIB_CTX_CHILD_PROVIDER_INDEX,
 249                                 &child_prov_ossl_ctx_method);
 250     if (gbl == NULL)
 251         return 0;
 252
 253     gbl->handle = handle;
 254     for (; in->function_id != 0; in++) {
 255         switch (in->function_id) {
 256         case OSSL_FUNC_CORE_GET_LIBCTX:
 257             gbl->c_get_libctx = OSSL_FUNC_core_get_libctx(in);
 258             break;
 259         case OSSL_FUNC_PROVIDER_REGISTER_CHILD_CB:
 260             gbl->c_provider_register_child_cb
 261                 = OSSL_FUNC_provider_register_child_cb(in);
 262             break;
 263         case OSSL_FUNC_PROVIDER_DEREGISTER_CHILD_CB:
 264             gbl->c_provider_deregister_child_cb
 265                 = OSSL_FUNC_provider_deregister_child_cb(in);
 266             break;
 267         case OSSL_FUNC_PROVIDER_NAME:
 268             gbl->c_prov_name = OSSL_FUNC_provider_name(in);
 269             break;
 270         case OSSL_FUNC_PROVIDER_GET0_PROVIDER_CTX:
 271             gbl->c_prov_get0_provider_ctx
 272                 = OSSL_FUNC_provider_get0_provider_ctx(in);
 273             break;
 274         case OSSL_FUNC_PROVIDER_GET0_DISPATCH:
 275             gbl->c_prov_get0_dispatch = OSSL_FUNC_provider_get0_dispatch(in);
 276             break;
 277         case OSSL_FUNC_PROVIDER_UP_REF:
 278             gbl->c_prov_up_ref
 279                 = OSSL_FUNC_provider_up_ref(in);
 280             break;
 281         case OSSL_FUNC_PROVIDER_FREE:
 282             gbl->c_prov_free = OSSL_FUNC_provider_free(in);
 283             break;
 284         default:
 285             /* Just ignore anything we don't understand */
 286             break;
 287         }
 288     }
 289
 290     if (gbl->c_get_libctx == NULL
 291             || gbl->c_provider_register_child_cb == NULL
 292             || gbl->c_prov_name == NULL
 293             || gbl->c_prov_get0_provider_ctx == NULL
 294             || gbl->c_prov_get0_dispatch == NULL
 295             || gbl->c_prov_up_ref == NULL
 296             || gbl->c_prov_free == NULL)
 297         return 0;
 298
 299     gbl->lock = CRYPTO_THREAD_lock_new();
 300     if (gbl->lock == NULL)
 301         return 0;
 302
 303     return 1;
 304 }
 305
 306 int ossl_provider_up_ref_parent(OSSL_PROVIDER *prov, int activate)
 307 {
 308     struct child_prov_globals *gbl;
 309
 310     gbl = ossl_lib_ctx_get_data(ossl_provider_libctx(prov),
 311                                 OSSL_LIB_CTX_CHILD_PROVIDER_INDEX,
 312                                 &child_prov_ossl_ctx_method);
 313     if (gbl == NULL)
 314         return 0;
 315
 316     return gbl->c_prov_up_ref(ossl_provider_get_parent(prov), activate);
 317 }
 318
 319 int ossl_provider_free_parent(OSSL_PROVIDER *prov, int deactivate)
 320 {
 321     struct child_prov_globals *gbl;
 322
 323     gbl = ossl_lib_ctx_get_data(ossl_provider_libctx(prov),
 324                                 OSSL_LIB_CTX_CHILD_PROVIDER_INDEX,
 325                                 &child_prov_ossl_ctx_method);
 326     if (gbl == NULL)
 327         return 0;
 328
 329     return gbl->c_prov_free(ossl_provider_get_parent(prov), deactivate);
 330 }