EVP_set_default_properties(): New function to set global properties

EVP_MD_fetch() can be given a property query string.  However, there
are cases when it won't, for example in implicit fetches.  Therefore,
we also need a way to set a global property query string to be used in
all subsequent fetches.  This also applies to all future algorithm
fetching functions.

Reviewed-by: Paul Dale <paul.dale@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/8681)

diff --git a/crypto/err/openssl.txt b/crypto/err/openssl.txt
index 19a418fafc0fe6e993740fe770e90ac54a202929..a3d15c9a5f068b4e304720b3fd523a9aeb745c43 100644 (file)
--- a/crypto/err/openssl.txt
+++ b/crypto/err/openssl.txt
@@ -858,6 +858,7 @@ EVP_F_EVP_PKEY_VERIFY:142:EVP_PKEY_verify
 EVP_F_EVP_PKEY_VERIFY_INIT:143:EVP_PKEY_verify_init
 EVP_F_EVP_PKEY_VERIFY_RECOVER:144:EVP_PKEY_verify_recover
 EVP_F_EVP_PKEY_VERIFY_RECOVER_INIT:145:EVP_PKEY_verify_recover_init
+EVP_F_EVP_SET_DEFAULT_PROPERTIES:236:EVP_set_default_properties
 EVP_F_EVP_SIGNFINAL:107:EVP_SignFinal
 EVP_F_EVP_VERIFYFINAL:108:EVP_VerifyFinal
 EVP_F_GMAC_CTRL:215:gmac_ctrl

diff --git a/crypto/evp/evp_err.c b/crypto/evp/evp_err.c
index 1a4f3819b24dbccf9152c68e540085addd2edb9e..a9f8800b08d177a774c131e0d44f4f6da55b9d76 100644 (file)
--- a/crypto/evp/evp_err.c
+++ b/crypto/evp/evp_err.c
@@ -156,6 +156,8 @@ static const ERR_STRING_DATA EVP_str_functs[] = {
      "EVP_PKEY_verify_recover"},
     {ERR_PACK(ERR_LIB_EVP, EVP_F_EVP_PKEY_VERIFY_RECOVER_INIT, 0),
      "EVP_PKEY_verify_recover_init"},
+    {ERR_PACK(ERR_LIB_EVP, EVP_F_EVP_SET_DEFAULT_PROPERTIES, 0),
+     "EVP_set_default_properties"},
     {ERR_PACK(ERR_LIB_EVP, EVP_F_EVP_SIGNFINAL, 0), "EVP_SignFinal"},
     {ERR_PACK(ERR_LIB_EVP, EVP_F_EVP_VERIFYFINAL, 0), "EVP_VerifyFinal"},
     {ERR_PACK(ERR_LIB_EVP, EVP_F_GMAC_CTRL, 0), "gmac_ctrl"},

diff --git a/crypto/evp/evp_fetch.c b/crypto/evp/evp_fetch.c
index e50dd592db52052fc7fb8b76544cb9a4ba90f553..329129d1330ed4175f076c8ff15a39907e31cc9b 100644 (file)
--- a/crypto/evp/evp_fetch.c
+++ b/crypto/evp/evp_fetch.c
@@ -78,8 +78,7 @@ static void *alloc_tmp_method_store(void)
         ossl_method_store_free(store);
 }
 
-static
-struct OSSL_METHOD_STORE *get_default_method_store(OPENSSL_CTX *libctx)
+static OSSL_METHOD_STORE *get_default_method_store(OPENSSL_CTX *libctx)
 {
     if (!RUN_ONCE(&default_method_store_init_flag,
                   do_default_method_store_init))
@@ -195,3 +194,13 @@ void *evp_generic_fetch(OPENSSL_CTX *libctx, int operation_id,
 
     return method;
 }
+
+int EVP_set_default_properties(OPENSSL_CTX *libctx, const char *propq)
+{
+    OSSL_METHOD_STORE *store = get_default_method_store(libctx);
+
+    if (store != NULL)
+        return ossl_method_store_set_global_properties(store, propq);
+    EVPerr(EVP_F_EVP_SET_DEFAULT_PROPERTIES, ERR_R_INTERNAL_ERROR);
+    return 0;
+}

diff --git a/doc/man3/EVP_MD_fetch.pod b/doc/man3/EVP_MD_fetch.pod
index 96536048bcd178863a7774905a808fe6b36287eb..cba3bc4f0ba5693d170bcb704764e0221b5137a7 100644 (file)
--- a/doc/man3/EVP_MD_fetch.pod
+++ b/doc/man3/EVP_MD_fetch.pod
@@ -39,9 +39,11 @@ algorithm from the default provider.
 
 With explicit fetch an application uses the EVP_MD_fetch() function to obtain
 an algorithm implementation. An implementation with the given name and
-satisfying the search criteria specified in the B<properties> parameter will be
-looked for within the available providers and returned. See L<OSSL_PROVIDER(3)>
-for information about providers.
+satisfying the search criteria specified in the B<properties> parameter
+combined with the default search criteria will be looked for within the
+available providers and returned.
+See L<EVP_set_default_properties(3)> for information on default search criteria
+and L<OSSL_PROVIDER(3)> for information about providers.
 
 =item User defined
 
@@ -156,7 +158,8 @@ other providers:
 =head1 SEE ALSO
 
 L<EVP_DigestInit(3)>, L<EVP_MD_meth_new(3)>, L<EVP_MD_meth_free(3)>,
-L<EVP_MD_upref(3)>, L<OSSL_PROVIDER_load(3)>, L<OPENSSL_CTX(3)>
+L<EVP_MD_upref(3)>, L<OSSL_PROVIDER_load(3)>, L<OPENSSL_CTX(3)>,
+L<EVP_set_default_properties(3)>
 
 =head1 HISTORY
 

diff --git a/doc/man3/EVP_set_default_properties.pod b/doc/man3/EVP_set_default_properties.pod
new file mode 100644 (file)
index 0000000..077913c
--- /dev/null
+++ b/doc/man3/EVP_set_default_properties.pod
@@ -0,0 +1,52 @@
+=pod
+
+=head1 NAME
+
+EVP_set_default_properties
+- Set default properties for future algorithm fetches
+
+=head1 SYNOPSIS
+
+ #include <openssl/evp.h>
+
+ int EVP_set_default_properties(OPENSSL_CTX *libctx, const char *propq);
+
+=head1 DESCRIPTION
+
+EVP_set_default_properties() sets the default properties for all
+future EVP algorithm fetches, implicit as well as explicit.
+
+=for comment TODO(3.0) We should consider having an EVP document in
+section 7 that details everything about implicit vs explicit fetches
+and how they relate to properties.
+
+EVP_set_default_properties stores the properties given with the string
+I<propq> among the EVP data that's been stored in the library context
+given with I<libctx> (NULL signifies the default library context).
+
+Any previous default property for the specified library context will
+be dropped.
+
+=head1 RETURN VALUES
+
+EVP_set_default_properties() returns 1 on success, or 0 on failure.
+The latter adds an error on the error stack.
+
+=head1 SEE ALSO
+
+L<EVP_MD_fetch>
+
+=head1 HISTORY
+
+The functions described here were added in OpenSSL 3.0.
+
+=head1 COPYRIGHT
+
+Copyright 2019 The OpenSSL Project Authors. All Rights Reserved.
+
+Licensed under the Apache License 2.0 (the "License").  You may not use
+this file except in compliance with the License.  You can obtain a copy
+in the file LICENSE in the source distribution or at
+L<https://www.openssl.org/source/license.html>.
+
+=cut

diff --git a/include/openssl/evp.h b/include/openssl/evp.h
index db8eec12f2703c92d001d8823186fb538f7a3e51..a903b29ffeea76a91d1e0d84e94dc380daaf5eef 100644 (file)
--- a/include/openssl/evp.h
+++ b/include/openssl/evp.h
@@ -69,6 +69,8 @@
 extern "C" {
 #endif
 
+int EVP_set_default_properties(OPENSSL_CTX *libctx, const char *propq);
+
 # define EVP_PKEY_MO_SIGN        0x0001
 # define EVP_PKEY_MO_VERIFY      0x0002
 # define EVP_PKEY_MO_ENCRYPT     0x0004

diff --git a/include/openssl/evperr.h b/include/openssl/evperr.h
index 5d3c576cb0d27a70409e51f23f15969e284f35a3..e62cfb3b90814f3751fc412ce21b5b5aca4d3628 100644 (file)
--- a/include/openssl/evperr.h
+++ b/include/openssl/evperr.h
@@ -128,6 +128,7 @@ int ERR_load_EVP_strings(void);
 # define EVP_F_EVP_PKEY_VERIFY_INIT                       143
 # define EVP_F_EVP_PKEY_VERIFY_RECOVER                    144
 # define EVP_F_EVP_PKEY_VERIFY_RECOVER_INIT               145
+# define EVP_F_EVP_SET_DEFAULT_PROPERTIES                 236
 # define EVP_F_EVP_SIGNFINAL                              107
 # define EVP_F_EVP_VERIFYFINAL                            108
 # define EVP_F_GMAC_CTRL                                  215

diff --git a/util/libcrypto.num b/util/libcrypto.num
index 5b488d0e4d58eb3f6e46dcaf5b15720cf46d79d1..638897306654369e04e2591329e386f9d13f8222 100644 (file)
--- a/util/libcrypto.num
+++ b/util/libcrypto.num
@@ -4793,3 +4793,4 @@ X509_get0_sm2_id                        4740      3_0_0   EXIST::FUNCTION:SM2
 EVP_PKEY_get0_engine                    4741   3_0_0   EXIST::FUNCTION:ENGINE
 EVP_MD_upref                            4742   3_0_0   EXIST::FUNCTION:
 EVP_MD_fetch                            4743   3_0_0   EXIST::FUNCTION:
+EVP_set_default_properties              4744   3_0_0   EXIST::FUNCTION: