crypto/provider_child.c

   1 /*
   2  * Copyright 2019-2021 The OpenSSL Project Authors. All Rights Reserved.
   3  *
   4  * Licensed under the Apache License 2.0 (the "License").  You may not use
   5  * this file except in compliance with the License.  You can obtain a copy
   6  * in the file LICENSE in the source distribution or at
   7  * https://www.openssl.org/source/license.html
   8  */
   9
  10 #include <assert.h>
  11 #include <openssl/crypto.h>
  12 #include <openssl/core_dispatch.h>
  13 #include <openssl/core_names.h>
  14 #include <openssl/provider.h>
  15 #include <openssl/evp.h>
  16 #include "internal/provider.h"
  17 #include "internal/cryptlib.h"
  18 #include "crypto/evp.h"
  19
  20 DEFINE_STACK_OF(OSSL_PROVIDER)
  21
  22 struct child_prov_globals {
  23     const OSSL_CORE_HANDLE *handle;
  24     const OSSL_CORE_HANDLE *curr_prov;
  25     unsigned int isinited:1;
  26     CRYPTO_RWLOCK *lock;
  27     OSSL_FUNC_core_get_libctx_fn *c_get_libctx;
  28     OSSL_FUNC_provider_register_child_cb_fn *c_provider_register_child_cb;
  29     OSSL_FUNC_provider_deregister_child_cb_fn *c_provider_deregister_child_cb;
  30     OSSL_FUNC_provider_name_fn *c_prov_name;
  31     OSSL_FUNC_provider_get0_provider_ctx_fn *c_prov_get0_provider_ctx;
  32     OSSL_FUNC_provider_get0_dispatch_fn *c_prov_get0_dispatch;
  33     OSSL_FUNC_provider_up_ref_fn *c_prov_up_ref;
  34     OSSL_FUNC_provider_free_fn *c_prov_free;
  35 };
  36
  37 static void *child_prov_ossl_ctx_new(OSSL_LIB_CTX *libctx)
  38 {
  39     return OPENSSL_zalloc(sizeof(struct child_prov_globals));
  40 }
  41
  42 static void child_prov_ossl_ctx_free(void *vgbl)
  43 {
  44     struct child_prov_globals *gbl = vgbl;
  45
  46     gbl->c_provider_deregister_child_cb(gbl->handle);
  47     CRYPTO_THREAD_lock_free(gbl->lock);
  48     OPENSSL_free(gbl);
  49 }
  50
  51 static const OSSL_LIB_CTX_METHOD child_prov_ossl_ctx_method = {
  52     OSSL_LIB_CTX_METHOD_LOW_PRIORITY,
  53     child_prov_ossl_ctx_new,
  54     child_prov_ossl_ctx_free,
  55 };
  56
  57 static OSSL_provider_init_fn ossl_child_provider_init;
  58
  59 static int ossl_child_provider_init(const OSSL_CORE_HANDLE *handle,
  60                                     const OSSL_DISPATCH *in,
  61                                     const OSSL_DISPATCH **out,
  62                                     void **provctx)
  63 {
  64     OSSL_FUNC_core_get_libctx_fn *c_get_libctx = NULL;
  65     OSSL_LIB_CTX *ctx;
  66     struct child_prov_globals *gbl;
  67
  68     for (; in->function_id != 0; in++) {
  69         switch (in->function_id) {
  70         case OSSL_FUNC_CORE_GET_LIBCTX:
  71             c_get_libctx = OSSL_FUNC_core_get_libctx(in);
  72             break;
  73         default:
  74             /* Just ignore anything we don't understand */
  75             break;
  76         }
  77     }
  78
  79     if (c_get_libctx == NULL)
  80         return 0;
  81
  82     /*
  83      * We need an OSSL_LIB_CTX but c_get_libctx returns OPENSSL_CORE_CTX. We are
  84      * a built-in provider and so we can get away with this cast. Normal
  85      * providers can't do this.
  86      */
  87     ctx = (OSSL_LIB_CTX *)c_get_libctx(handle);
  88
  89     gbl = ossl_lib_ctx_get_data(ctx, OSSL_LIB_CTX_CHILD_PROVIDER_INDEX,
  90                                 &child_prov_ossl_ctx_method);
  91     if (gbl == NULL)
  92         return 0;
  93
  94     *provctx = gbl->c_prov_get0_provider_ctx(gbl->curr_prov);
  95     *out = gbl->c_prov_get0_dispatch(gbl->curr_prov);
  96
  97     return 1;
  98 }
  99
 100 static int provider_create_child_cb(const OSSL_CORE_HANDLE *prov, void *cbdata)
 101 {
 102     OSSL_LIB_CTX *ctx = cbdata;
 103     struct child_prov_globals *gbl;
 104     const char *provname;
 105     OSSL_PROVIDER *cprov;
 106     int ret = 0;
 107
 108     gbl = ossl_lib_ctx_get_data(ctx, OSSL_LIB_CTX_CHILD_PROVIDER_INDEX,
 109                                 &child_prov_ossl_ctx_method);
 110     if (gbl == NULL)
 111         return 0;
 112
 113     /*
 114      * If !gbl->isinited, then we are still initing and we already hold the
 115      * lock - so don't take it again.
 116      */
 117     if (gbl->isinited && !CRYPTO_THREAD_write_lock(gbl->lock))
 118         return 0;
 119
 120     provname = gbl->c_prov_name(prov);
 121
 122     /*
 123      * We're operating under a lock so we can store the "current" provider in
 124      * the global data.
 125      */
 126     gbl->curr_prov = prov;
 127
 128     if ((cprov = ossl_provider_find(ctx, provname, 1)) != NULL) {
 129         /*
 130         * We free the newly created ref. We rely on the provider sticking around
 131         * in the provider store.
 132         */
 133         ossl_provider_free(cprov);
 134
 135         /*
 136          * The provider already exists. It could be an unused built-in, or a
 137          * previously created child, or it could have been explicitly loaded. If
 138          * explicitly loaded it cannot be converted to a child and we ignore it
 139          * - i.e. we don't start treating it like a child.
 140          */
 141         if (!ossl_provider_convert_to_child(cprov, prov,
 142                                             ossl_child_provider_init))
 143             goto err;
 144     } else {
 145         /*
 146          * Create it - passing 1 as final param so we don't try and recursively
 147          * init children
 148          */
 149         if ((cprov = ossl_provider_new(ctx, provname, ossl_child_provider_init,
 150                                        1)) == NULL)
 151             goto err;
 152
 153         /*
 154         * We free the newly created ref. We rely on the provider sticking around
 155         * in the provider store.
 156         */
 157         ossl_provider_free(cprov);
 158
 159         if (!ossl_provider_activate(cprov, 0, 0))
 160             goto err;
 161
 162         if (!ossl_provider_set_child(cprov, prov)) {
 163             ossl_provider_deactivate(cprov);
 164             goto err;
 165         }
 166     }
 167
 168     ret = 1;
 169  err:
 170     if (gbl->isinited)
 171         CRYPTO_THREAD_unlock(gbl->lock);
 172     return ret;
 173 }
 174
 175 static int provider_remove_child_cb(const OSSL_CORE_HANDLE *prov, void *cbdata)
 176 {
 177     OSSL_LIB_CTX *ctx = cbdata;
 178     struct child_prov_globals *gbl;
 179     const char *provname;
 180     OSSL_PROVIDER *cprov;
 181
 182     gbl = ossl_lib_ctx_get_data(ctx, OSSL_LIB_CTX_CHILD_PROVIDER_INDEX,
 183                                 &child_prov_ossl_ctx_method);
 184     if (gbl == NULL)
 185         return 0;
 186
 187     provname = gbl->c_prov_name(prov);
 188     cprov = ossl_provider_find(ctx, provname, 1);
 189     if (cprov == NULL)
 190         return 0;
 191     /*
 192      * ossl_provider_find ups the ref count, so we free it again here. We can
 193      * rely on the provider store reference count.
 194      */
 195     ossl_provider_free(cprov);
 196     if (ossl_provider_is_child(cprov)
 197             && !ossl_provider_deactivate(cprov))
 198         return 0;
 199
 200     return 1;
 201 }
 202
 203 static int provider_global_props_cb(const char *props, void *cbdata)
 204 {
 205     OSSL_LIB_CTX *ctx = cbdata;
 206
 207     return evp_set_default_properties_int(ctx, props, 0, 1);
 208 }
 209
 210 int ossl_provider_init_as_child(OSSL_LIB_CTX *ctx,
 211                                 const OSSL_CORE_HANDLE *handle,
 212                                 const OSSL_DISPATCH *in)
 213 {
 214     struct child_prov_globals *gbl;
 215
 216     if (ctx == NULL)
 217         return 0;
 218
 219     gbl = ossl_lib_ctx_get_data(ctx, OSSL_LIB_CTX_CHILD_PROVIDER_INDEX,
 220                                 &child_prov_ossl_ctx_method);
 221     if (gbl == NULL)
 222         return 0;
 223
 224     gbl->handle = handle;
 225     for (; in->function_id != 0; in++) {
 226         switch (in->function_id) {
 227         case OSSL_FUNC_CORE_GET_LIBCTX:
 228             gbl->c_get_libctx = OSSL_FUNC_core_get_libctx(in);
 229             break;
 230         case OSSL_FUNC_PROVIDER_REGISTER_CHILD_CB:
 231             gbl->c_provider_register_child_cb
 232                 = OSSL_FUNC_provider_register_child_cb(in);
 233             break;
 234         case OSSL_FUNC_PROVIDER_DEREGISTER_CHILD_CB:
 235             gbl->c_provider_deregister_child_cb
 236                 = OSSL_FUNC_provider_deregister_child_cb(in);
 237             break;
 238         case OSSL_FUNC_PROVIDER_NAME:
 239             gbl->c_prov_name = OSSL_FUNC_provider_name(in);
 240             break;
 241         case OSSL_FUNC_PROVIDER_GET0_PROVIDER_CTX:
 242             gbl->c_prov_get0_provider_ctx
 243                 = OSSL_FUNC_provider_get0_provider_ctx(in);
 244             break;
 245         case OSSL_FUNC_PROVIDER_GET0_DISPATCH:
 246             gbl->c_prov_get0_dispatch = OSSL_FUNC_provider_get0_dispatch(in);
 247             break;
 248         case OSSL_FUNC_PROVIDER_UP_REF:
 249             gbl->c_prov_up_ref
 250                 = OSSL_FUNC_provider_up_ref(in);
 251             break;
 252         case OSSL_FUNC_PROVIDER_FREE:
 253             gbl->c_prov_free = OSSL_FUNC_provider_free(in);
 254             break;
 255         default:
 256             /* Just ignore anything we don't understand */
 257             break;
 258         }
 259     }
 260
 261     if (gbl->c_get_libctx == NULL
 262             || gbl->c_provider_register_child_cb == NULL
 263             || gbl->c_prov_name == NULL
 264             || gbl->c_prov_get0_provider_ctx == NULL
 265             || gbl->c_prov_get0_dispatch == NULL
 266             || gbl->c_prov_up_ref == NULL
 267             || gbl->c_prov_free == NULL)
 268         return 0;
 269
 270     gbl->lock = CRYPTO_THREAD_lock_new();
 271     if (gbl->lock == NULL)
 272         return 0;
 273
 274     if (!gbl->c_provider_register_child_cb(gbl->handle,
 275                                            provider_create_child_cb,
 276                                            provider_remove_child_cb,
 277                                            provider_global_props_cb,
 278                                            ctx))
 279         return 0;
 280
 281     gbl->isinited = 1;
 282
 283     return 1;
 284 }
 285
 286 int ossl_provider_up_ref_parent(OSSL_PROVIDER *prov, int activate)
 287 {
 288     struct child_prov_globals *gbl;
 289
 290     gbl = ossl_lib_ctx_get_data(ossl_provider_libctx(prov),
 291                                 OSSL_LIB_CTX_CHILD_PROVIDER_INDEX,
 292                                 &child_prov_ossl_ctx_method);
 293     if (gbl == NULL)
 294         return 0;
 295
 296     return gbl->c_prov_up_ref(ossl_provider_get_parent(prov), activate);
 297 }
 298
 299 int ossl_provider_free_parent(OSSL_PROVIDER *prov, int deactivate)
 300 {
 301     struct child_prov_globals *gbl;
 302
 303     gbl = ossl_lib_ctx_get_data(ossl_provider_libctx(prov),
 304                                 OSSL_LIB_CTX_CHILD_PROVIDER_INDEX,
 305                                 &child_prov_ossl_ctx_method);
 306     if (gbl == NULL)
 307         return 0;
 308
 309     return gbl->c_prov_free(ossl_provider_get_parent(prov), deactivate);
 310 }