QuasarApp/openssl
4
0
Fork 0
mirror of https://github.com/QuasarApp/openssl.git synced 2025-04-28 10:44:38 +00:00
Code Issues Projects Releases Wiki Activity

STORE: Add a built-in 'file:' storemgmt implementation (loader)

Browse Source 
This replaces the older 'file:' loader that is now an engine.

It's still possible to use the older 'file:' loader by explicitly
using the engine, and tests will remain for it as long as ENGINEs are
still supported (even through deprecated).

To support this storemgmt implementation, a few internal OSSL_DECODER
modifications are needed:

-   An internal function that implements most of
    OSSL_DECODER_CTX_new_by_EVP_PKEY(), but operates on an already
    existing OSSL_DECODER_CTX instead of allocating a new one.
-   Allow direct creation of a OSSL_DECODER from an OSSL_ALGORITHM.
    It isn't attached to any provider, and is only used internally, to
    simply catch any DER encoded object to be passed back to the
    object callback with no further checking.  This implementation
    becomes the last resort decoder, when all "normal"
    decodation attempts (i.e. those that are supposed to result
    in an OpenSSL object of some sort) have failed.

Because file_store_attach() uses BIO_tell(), we must also support
BIO_ctrl() as a libcrypto upcall.

Reviewed-by: Matt Caswell <matt@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/12587)
This commit is contained in:
Richard Levitte 2020-08-02 12:46:00 +02:00
parent 16feca7154
commit 63f187cfed
21 changed files with 1268 additions and 52 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

89
crypto/encode_decode/decoder_lib.c
View File

@ -12,6 +12,7 @@
#include <openssl/params.h>
#include <openssl/provider.h>
#include "internal/passphrase.h"
#include "crypto/decoder.h"
#include "encoder_local.h"
#include "e_os.h"
@ -89,14 +90,13 @@ int OSSL_DECODER_CTX_set_input_type(OSSL_DECODER_CTX *ctx,
return 1;
}
int OSSL_DECODER_CTX_add_decoder(OSSL_DECODER_CTX *ctx, OSSL_DECODER *decoder)
OSSL_DECODER_INSTANCE *ossl_decoder_instance_new(OSSL_DECODER *decoder,
void *decoderctx)
{
OSSL_DECODER_INSTANCE *decoder_inst = NULL;
const OSSL_PROVIDER *prov = NULL;
OSSL_PARAM params[2];
void *provctx = NULL;
if (!ossl_assert(ctx != NULL) || !ossl_assert(decoder != NULL)) {
if (!ossl_assert(decoder != NULL)) {
ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_PASSED_NULL_PARAMETER);
return 0;
}
@ -107,12 +107,6 @@ int OSSL_DECODER_CTX_add_decoder(OSSL_DECODER_CTX *ctx, OSSL_DECODER *decoder)
return 0;
}
if (ctx->decoder_insts == NULL
&& (ctx->decoder_insts =
sk_OSSL_DECODER_INSTANCE_new_null()) == NULL) {
ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_MALLOC_FAILURE);
return 0;
}
if ((decoder_inst = OPENSSL_zalloc(sizeof(*decoder_inst))) == NULL) {
ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_MALLOC_FAILURE);
return 0;
@ -121,10 +115,6 @@ int OSSL_DECODER_CTX_add_decoder(OSSL_DECODER_CTX *ctx, OSSL_DECODER *decoder)
ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_INTERNAL_ERROR);
goto err;
}
decoder_inst->decoder = decoder;
prov = OSSL_DECODER_provider(decoder_inst->decoder);
provctx = OSSL_PROVIDER_get0_provider_ctx(prov);
/* Cache the input type for this encoder */
params[0] =
@ -132,25 +122,74 @@ int OSSL_DECODER_CTX_add_decoder(OSSL_DECODER_CTX *ctx, OSSL_DECODER *decoder)
(char **)&decoder_inst->input_type, 0);
params[1] = OSSL_PARAM_construct_end();
if (!decoder_inst->decoder->get_params(params)
if (!decoder->get_params(params)
|| !OSSL_PARAM_modified(&params[0]))
goto err;
if ((decoder_inst->decoderctx = decoder_inst->decoder->newctx(provctx))
== NULL)
goto err;
decoder_inst->decoder = decoder;
decoder_inst->decoderctx = decoderctx;
return decoder_inst;
err:
ossl_decoder_instance_free(decoder_inst);
return NULL;
}
if (sk_OSSL_DECODER_INSTANCE_push(ctx->decoder_insts, decoder_inst) <= 0)
void ossl_decoder_instance_free(OSSL_DECODER_INSTANCE *decoder_inst)
{
if (decoder_inst != NULL) {
if (decoder_inst->decoder != NULL)
decoder_inst->decoder->freectx(decoder_inst->decoderctx);
decoder_inst->decoderctx = NULL;
OSSL_DECODER_free(decoder_inst->decoder);
decoder_inst->decoder = NULL;
OPENSSL_free(decoder_inst);
}
}
int ossl_decoder_ctx_add_decoder_inst(OSSL_DECODER_CTX *ctx,
OSSL_DECODER_INSTANCE *di)
{
if (ctx->decoder_insts == NULL
&& (ctx->decoder_insts =
sk_OSSL_DECODER_INSTANCE_new_null()) == NULL) {
ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_MALLOC_FAILURE);
return 0;
}
return (sk_OSSL_DECODER_INSTANCE_push(ctx->decoder_insts, di) > 0);
}
int OSSL_DECODER_CTX_add_decoder(OSSL_DECODER_CTX *ctx,
OSSL_DECODER *decoder)
{
OSSL_DECODER_INSTANCE *decoder_inst = NULL;
const OSSL_PROVIDER *prov = NULL;
void *decoderctx = NULL;
void *provctx = NULL;
if (!ossl_assert(ctx != NULL) || !ossl_assert(decoder != NULL)) {
ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_PASSED_NULL_PARAMETER);
return 0;
}
prov = OSSL_DECODER_provider(decoder);
provctx = OSSL_PROVIDER_get0_provider_ctx(prov);
if ((decoderctx = decoder->newctx(provctx)) == NULL
|| (decoder_inst =
ossl_decoder_instance_new(decoder, decoderctx)) == NULL)
goto err;
/* Avoid double free of decoderctx on further errors */
decoderctx = NULL;
if (!ossl_decoder_ctx_add_decoder_inst(ctx, decoder_inst))
goto err;
return 1;
err:
if (decoder_inst != NULL) {
if (decoder_inst->decoder != NULL)
decoder_inst->decoder->freectx(decoder_inst->decoderctx);
OSSL_DECODER_free(decoder_inst->decoder);
OPENSSL_free(decoder_inst);
}
ossl_decoder_instance_free(decoder_inst);
if (decoderctx != NULL)
decoder->freectx(decoderctx);
return 0;
}

15
crypto/encode_decode/decoder_meth.c
View File

@ -15,11 +15,9 @@
#include "internal/namemap.h"
#include "internal/property.h"
#include "internal/provider.h"
#include "crypto/encoder.h"
#include "crypto/decoder.h"
#include "encoder_local.h"
static void OSSL_DECODER_INSTANCE_free(OSSL_DECODER_INSTANCE *instance);
/*
* Decoder can have multiple names, separated with colons in a name string
*/
@ -159,8 +157,8 @@ static int put_decoder_in_store(OPENSSL_CTX *libctx, void *store,
}
/* Create and populate a decoder method */
static void *decoder_from_dispatch(int id, const OSSL_ALGORITHM *algodef,
OSSL_PROVIDER *prov)
void *ossl_decoder_from_dispatch(int id, const OSSL_ALGORITHM *algodef,
OSSL_PROVIDER *prov)
{
OSSL_DECODER *decoder = NULL;
const OSSL_DISPATCH *fns = algodef->implementation;
@ -236,7 +234,7 @@ static void *decoder_from_dispatch(int id, const OSSL_ALGORITHM *algodef,
/*
* The core fetching functionality passes the names of the implementation.
* This function is responsible to getting an identity number for them,
* then call decoder_from_dispatch() with that identity number.
* then call ossl_decoder_from_dispatch() with that identity number.
*/
static void *construct_decoder(const OSSL_ALGORITHM *algodef,
OSSL_PROVIDER *prov, void *unused)
@ -254,7 +252,7 @@ static void *construct_decoder(const OSSL_ALGORITHM *algodef,
void *method = NULL;
if (id != 0)
method = decoder_from_dispatch(id, algodef, prov);
method = ossl_decoder_from_dispatch(id, algodef, prov);
return method;
}
@ -407,8 +405,7 @@ static void decoder_do_one(OSSL_PROVIDER *provider,
void *method = NULL;
if (id != 0)
method =
decoder_from_dispatch(id, algodef, provider);
method = ossl_decoder_from_dispatch(id, algodef, provider);
if (method != NULL) {
data->user_fn(method, data->user_arg);

41
crypto/encode_decode/decoder_pkey.c
View File

@ -14,6 +14,7 @@
#include <openssl/decoder.h>
#include <openssl/safestack.h>
#include "crypto/evp.h"
#include "crypto/decoder.h"
#include "encoder_local.h"
int OSSL_DECODER_CTX_set_passphrase(OSSL_DECODER_CTX *ctx,
@ -254,17 +255,16 @@ static void collect_decoder(OSSL_DECODER *decoder, void *arg)
data->error_occured = 0; /* All is good now */
}
OSSL_DECODER_CTX *OSSL_DECODER_CTX_new_by_EVP_PKEY(EVP_PKEY **pkey,
const char *input_type,
OPENSSL_CTX *libctx,
const char *propquery)
int ossl_decoder_ctx_setup_for_EVP_PKEY(OSSL_DECODER_CTX *ctx,
EVP_PKEY **pkey,
OPENSSL_CTX *libctx,
const char *propquery)
{
OSSL_DECODER_CTX *ctx = NULL;
struct collected_data_st *data = NULL;
size_t i, end_i;
int ok = 0;
if ((ctx = OSSL_DECODER_CTX_new()) == NULL
|| (data = OPENSSL_zalloc(sizeof(*data))) == NULL
if ((data = OPENSSL_zalloc(sizeof(*data))) == NULL
|| (data->process_data =
OPENSSL_zalloc(sizeof(*data->process_data))) == NULL
|| (data->process_data->keymgmts
@ -275,7 +275,6 @@ OSSL_DECODER_CTX *OSSL_DECODER_CTX_new_by_EVP_PKEY(EVP_PKEY **pkey,
}
data->process_data->object = (void **)pkey;
data->ctx = ctx;
OSSL_DECODER_CTX_set_input_type(ctx, input_type);
/* First, find all keymgmts to form goals */
EVP_KEYMGMT_do_all_provided(libctx, collect_keymgmt, data);
@ -308,9 +307,6 @@ OSSL_DECODER_CTX *OSSL_DECODER_CTX_new_by_EVP_PKEY(EVP_PKEY **pkey,
if (OSSL_DECODER_CTX_num_decoders(ctx) == 0)
goto err;
/* Finally, collect extra decoders based on what we already have */
(void)OSSL_DECODER_CTX_add_extra(ctx, libctx, propquery);
if (!OSSL_DECODER_CTX_set_construct(ctx, decoder_construct_EVP_PKEY)
|| !OSSL_DECODER_CTX_set_construct_data(ctx, data->process_data)
|| !OSSL_DECODER_CTX_set_cleanup(ctx,
@ -318,11 +314,32 @@ OSSL_DECODER_CTX *OSSL_DECODER_CTX_new_by_EVP_PKEY(EVP_PKEY **pkey,
goto err;
data->process_data = NULL;
ok = 1;
err:
if (data != NULL) {
decoder_clean_EVP_PKEY_construct_arg(data->process_data);
sk_OPENSSL_CSTRING_free(data->names);
OPENSSL_free(data);
}
return ctx;
return ok;
}
OSSL_DECODER_CTX *OSSL_DECODER_CTX_new_by_EVP_PKEY(EVP_PKEY **pkey,
const char *input_type,
OPENSSL_CTX *libctx,
const char *propquery)
{
OSSL_DECODER_CTX *ctx = NULL;
if ((ctx = OSSL_DECODER_CTX_new()) == NULL) {
ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_MALLOC_FAILURE);
return NULL;
}
if (OSSL_DECODER_CTX_set_input_type(ctx, input_type)
&& ossl_decoder_ctx_setup_for_EVP_PKEY(ctx, pkey, libctx, propquery)
&& OSSL_DECODER_CTX_add_extra(ctx, libctx, propquery))
return ctx;
OSSL_DECODER_CTX_free(ctx);
return NULL;
}

4
crypto/err/openssl.txt
View File

@ -2936,12 +2936,15 @@ PROV_R_OPERATION_NOT_SUPPORTED_FOR_THIS_KEYTYPE:178:\
PROV_R_OUTPUT_BUFFER_TOO_SMALL:106:output buffer too small
PROV_R_PARENT_LOCKING_NOT_ENABLED:182:parent locking not enabled
PROV_R_PARENT_STRENGTH_TOO_WEAK:194:parent strength too weak
PROV_R_PATH_MUST_BE_ABSOLUTE:219:path must be absolute
PROV_R_PERSONALISATION_STRING_TOO_LONG:195:personalisation string too long
PROV_R_PSS_SALTLEN_TOO_SMALL:172:pss saltlen too small
PROV_R_READ_KEY:159:read key
PROV_R_REQUEST_TOO_LARGE_FOR_DRBG:196:request too large for drbg
PROV_R_REQUIRE_CTR_MODE_CIPHER:206:require ctr mode cipher
PROV_R_RESEED_ERROR:197:reseed error
PROV_R_SEARCH_ONLY_SUPPORTED_FOR_DIRECTORIES:222:\
search only supported for directories
PROV_R_SELF_TEST_KAT_FAILURE:215:self test kat failure
PROV_R_SELF_TEST_POST_FAILURE:216:self test post failure
PROV_R_TAG_NOTSET:119:tag notset
@ -2963,6 +2966,7 @@ PROV_R_UNSUPPORTED_CEK_ALG:145:unsupported cek alg
PROV_R_UNSUPPORTED_KEY_SIZE:153:unsupported key size
PROV_R_UNSUPPORTED_MAC_TYPE:137:unsupported mac type
PROV_R_UNSUPPORTED_NUMBER_OF_ROUNDS:152:unsupported number of rounds
PROV_R_URI_AUTHORITY_UNSUPPORTED:223:uri authority unsupported
PROV_R_VALUE_ERROR:138:value error
PROV_R_WRONG_FINAL_BLOCK_LENGTH:107:wrong final block length
PROV_R_WRONG_OUTPUT_BUFFER_SIZE:139:wrong output buffer size

1
crypto/provider_core.c
View File

@ -1094,6 +1094,7 @@ static const OSSL_DISPATCH core_dispatch_[] = {
{ OSSL_FUNC_BIO_WRITE_EX, (void (*)(void))BIO_write_ex },
{ OSSL_FUNC_BIO_GETS, (void (*)(void))BIO_gets },
{ OSSL_FUNC_BIO_PUTS, (void (*)(void))BIO_puts },
{ OSSL_FUNC_BIO_CTRL, (void (*)(void))BIO_ctrl },
{ OSSL_FUNC_BIO_FREE, (void (*)(void))BIO_free },
{ OSSL_FUNC_BIO_VPRINTF, (void (*)(void))BIO_vprintf },
{ OSSL_FUNC_BIO_VSNPRINTF, (void (*)(void))BIO_vsnprintf },

40
include/crypto/decoder.h Normal file
View File

@ -0,0 +1,40 @@
/*
* Copyright 2020 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
* in the file LICENSE in the source distribution or at
* https://www.openssl.org/source/license.html
*/
#ifndef OSSL_CRYPTO_DECODER_H
# define OSSL_CRYPTO_DECODER_H
# include <openssl/decoder.h>
OSSL_DECODER *ossl_decoder_fetch_by_number(OPENSSL_CTX *libctx,
int id,
const char *properties);
/*
* These are specially made for the 'file:' provider-native loader, which
* uses this to install a DER to anything decoder, which doesn't do much
* except read a DER blob and pass it on as a provider object abstraction
* (provider-object(7)).
*/
void *ossl_decoder_from_dispatch(int id, const OSSL_ALGORITHM *algodef,
OSSL_PROVIDER *prov);
OSSL_DECODER_INSTANCE *
ossl_decoder_instance_new(OSSL_DECODER *decoder, void *decoderctx);
void ossl_decoder_instance_free(OSSL_DECODER_INSTANCE *decoder_inst);
int ossl_decoder_ctx_add_decoder_inst(OSSL_DECODER_CTX *ctx,
OSSL_DECODER_INSTANCE *di);
int ossl_decoder_ctx_setup_for_EVP_PKEY(OSSL_DECODER_CTX *ctx,
EVP_PKEY **pkey,
OPENSSL_CTX *libctx,
const char *propquery);
#endif

3
include/openssl/core_dispatch.h
View File

@ -137,6 +137,7 @@ OSSL_CORE_MAKE_FUNC(void,
#define OSSL_FUNC_BIO_VSNPRINTF 46
#define OSSL_FUNC_BIO_PUTS 47
#define OSSL_FUNC_BIO_GETS 48
#define OSSL_FUNC_BIO_CTRL 49
OSSL_CORE_MAKE_FUNC(OSSL_CORE_BIO *, BIO_new_file, (const char *filename,
@ -153,6 +154,8 @@ OSSL_CORE_MAKE_FUNC(int, BIO_vprintf, (OSSL_CORE_BIO *bio, const char *format,
va_list args))
OSSL_CORE_MAKE_FUNC(int, BIO_vsnprintf,
(char *buf, size_t n, const char *fmt, va_list args))
OSSL_CORE_MAKE_FUNC(int, BIO_ctrl, (OSSL_CORE_BIO *bio,
int cmd, long num, void *ptr))
#define OSSL_FUNC_SELF_TEST_CB 100
OSSL_CORE_MAKE_FUNC(void, self_test_cb, (OPENSSL_CORE_CTX *ctx, OSSL_CALLBACK **cb,

5
include/openssl/err.h
View File

@ -113,8 +113,8 @@ struct err_state_st {
# define ERR_LIB_CRMF 56
# define ERR_LIB_PROV 57
# define ERR_LIB_CMP 58
# define ERR_LIB_OSSL_ENCODER 59
# define ERR_LIB_OSSL_DECODER 60
# define ERR_LIB_OSSL_ENCODER 59
# define ERR_LIB_OSSL_DECODER 60
# define ERR_LIB_HTTP 61
# define ERR_LIB_USER 128
@ -304,6 +304,7 @@ static ossl_inline int ERR_FATAL_ERROR(unsigned long errcode)
# define ERR_R_UI_LIB ERR_LIB_UI/* 40 */
# define ERR_R_ECDSA_LIB ERR_LIB_ECDSA/* 42 */
# define ERR_R_OSSL_STORE_LIB ERR_LIB_OSSL_STORE/* 44 */
# define ERR_R_OSSL_DECODER_LIB ERR_LIB_OSSL_DECODER/* 60 */
/*
* global reason codes, range 64..99 (sub-system specific codes start at 100)

11
providers/baseprov.c
View File

@ -86,6 +86,15 @@ static const OSSL_ALGORITHM base_decoder[] = {
};
#undef DECODER
static const OSSL_ALGORITHM base_store[] = {
#define STORE(name, fips, func_table) \
{ name, "provider=base,fips=" fips, (func_table) },
#include "stores.inc"
{ NULL, NULL, NULL }
#undef STORE
};
static const OSSL_ALGORITHM *base_query(void *provctx, int operation_id,
int *no_cache)
{
@ -95,6 +104,8 @@ static const OSSL_ALGORITHM *base_query(void *provctx, int operation_id,
return base_encoder;
case OSSL_OP_DECODER:
return base_decoder;
case OSSL_OP_STORE:
return base_store;
}
return NULL;
}

16
providers/common/bio_prov.c
View File

@ -18,6 +18,7 @@ static OSSL_FUNC_BIO_read_ex_fn *c_bio_read_ex = NULL;
static OSSL_FUNC_BIO_write_ex_fn *c_bio_write_ex = NULL;
static OSSL_FUNC_BIO_gets_fn *c_bio_gets = NULL;
static OSSL_FUNC_BIO_puts_fn *c_bio_puts = NULL;
static OSSL_FUNC_BIO_ctrl_fn *c_bio_ctrl = NULL;
static OSSL_FUNC_BIO_free_fn *c_bio_free = NULL;
static OSSL_FUNC_BIO_vprintf_fn *c_bio_vprintf = NULL;
@ -49,6 +50,10 @@ int ossl_prov_bio_from_dispatch(const OSSL_DISPATCH *fns)
if (c_bio_puts == NULL)
c_bio_puts = OSSL_FUNC_BIO_puts(fns);
break;
case OSSL_FUNC_BIO_CTRL:
if (c_bio_ctrl == NULL)
c_bio_ctrl = OSSL_FUNC_BIO_ctrl(fns);
break;
case OSSL_FUNC_BIO_FREE:
if (c_bio_free == NULL)
c_bio_free = OSSL_FUNC_BIO_free(fns);
@ -107,6 +112,13 @@ int ossl_prov_bio_puts(OSSL_CORE_BIO *bio, const char *str)
return c_bio_puts(bio, str);
}
int ossl_prov_bio_ctrl(OSSL_CORE_BIO *bio, int cmd, long num, void *ptr)
{
if (c_bio_ctrl == NULL)
return -1;
return c_bio_ctrl(bio, cmd, num, ptr);
}
int ossl_prov_bio_free(OSSL_CORE_BIO *bio)
{
if (c_bio_free == NULL)
@ -151,9 +163,7 @@ static int bio_core_write_ex(BIO *bio, const char *data, size_t data_len,
static long bio_core_ctrl(BIO *bio, int cmd, long num, void *ptr)
{
/* We don't support this */
assert(0);
return 0;
return ossl_prov_bio_ctrl(BIO_get_data(bio), cmd, num, ptr);
}
static int bio_core_gets(BIO *bio, char *buf, int size)

1
providers/common/include/prov/bio.h
View File

@ -22,6 +22,7 @@ int ossl_prov_bio_write_ex(OSSL_CORE_BIO *bio, const void *data, size_t data_len
size_t *written);
int ossl_prov_bio_gets(OSSL_CORE_BIO *bio, char *buf, int size);
int ossl_prov_bio_puts(OSSL_CORE_BIO *bio, const char *str);
int ossl_prov_bio_ctrl(OSSL_CORE_BIO *bio, int cmd, long num, void *ptr);
int ossl_prov_bio_free(OSSL_CORE_BIO *bio);
int ossl_prov_bio_vprintf(OSSL_CORE_BIO *bio, const char *format, va_list ap);
int ossl_prov_bio_printf(OSSL_CORE_BIO *bio, const char *format, ...);

3
providers/common/include/prov/providercommonerr.h
View File

@ -139,12 +139,14 @@ int ERR_load_PROV_strings(void);
# define PROV_R_OUTPUT_BUFFER_TOO_SMALL 106
# define PROV_R_PARENT_LOCKING_NOT_ENABLED 182
# define PROV_R_PARENT_STRENGTH_TOO_WEAK 194
# define PROV_R_PATH_MUST_BE_ABSOLUTE 219
# define PROV_R_PERSONALISATION_STRING_TOO_LONG 195
# define PROV_R_PSS_SALTLEN_TOO_SMALL 172
# define PROV_R_READ_KEY 159
# define PROV_R_REQUEST_TOO_LARGE_FOR_DRBG 196
# define PROV_R_REQUIRE_CTR_MODE_CIPHER 206
# define PROV_R_RESEED_ERROR 197
# define PROV_R_SEARCH_ONLY_SUPPORTED_FOR_DIRECTORIES 222
# define PROV_R_SELF_TEST_KAT_FAILURE 215
# define PROV_R_SELF_TEST_POST_FAILURE 216
# define PROV_R_TAG_NOTSET 119
@ -165,6 +167,7 @@ int ERR_load_PROV_strings(void);
# define PROV_R_UNSUPPORTED_KEY_SIZE 153
# define PROV_R_UNSUPPORTED_MAC_TYPE 137
# define PROV_R_UNSUPPORTED_NUMBER_OF_ROUNDS 152
# define PROV_R_URI_AUTHORITY_UNSUPPORTED 223
# define PROV_R_VALUE_ERROR 138
# define PROV_R_WRONG_FINAL_BLOCK_LENGTH 107
# define PROV_R_WRONG_OUTPUT_BUFFER_SIZE 139

6
providers/common/provider_err.c
View File

@ -149,6 +149,8 @@ static const ERR_STRING_DATA PROV_str_reasons[] = {
"parent locking not enabled"},
{ERR_PACK(ERR_LIB_PROV, 0, PROV_R_PARENT_STRENGTH_TOO_WEAK),
"parent strength too weak"},
{ERR_PACK(ERR_LIB_PROV, 0, PROV_R_PATH_MUST_BE_ABSOLUTE),
"path must be absolute"},
{ERR_PACK(ERR_LIB_PROV, 0, PROV_R_PERSONALISATION_STRING_TOO_LONG),
"personalisation string too long"},
{ERR_PACK(ERR_LIB_PROV, 0, PROV_R_PSS_SALTLEN_TOO_SMALL),
@ -159,6 +161,8 @@ static const ERR_STRING_DATA PROV_str_reasons[] = {
{ERR_PACK(ERR_LIB_PROV, 0, PROV_R_REQUIRE_CTR_MODE_CIPHER),
"require ctr mode cipher"},
{ERR_PACK(ERR_LIB_PROV, 0, PROV_R_RESEED_ERROR), "reseed error"},
{ERR_PACK(ERR_LIB_PROV, 0, PROV_R_SEARCH_ONLY_SUPPORTED_FOR_DIRECTORIES),
"search only supported for directories"},
{ERR_PACK(ERR_LIB_PROV, 0, PROV_R_SELF_TEST_KAT_FAILURE),
"self test kat failure"},
{ERR_PACK(ERR_LIB_PROV, 0, PROV_R_SELF_TEST_POST_FAILURE),
@ -196,6 +200,8 @@ static const ERR_STRING_DATA PROV_str_reasons[] = {
"unsupported mac type"},
{ERR_PACK(ERR_LIB_PROV, 0, PROV_R_UNSUPPORTED_NUMBER_OF_ROUNDS),
"unsupported number of rounds"},
{ERR_PACK(ERR_LIB_PROV, 0, PROV_R_URI_AUTHORITY_UNSUPPORTED),
"uri authority unsupported"},
{ERR_PACK(ERR_LIB_PROV, 0, PROV_R_VALUE_ERROR), "value error"},
{ERR_PACK(ERR_LIB_PROV, 0, PROV_R_WRONG_FINAL_BLOCK_LENGTH),
"wrong final block length"},

11
providers/defltprov.c
View File

@ -433,6 +433,15 @@ static const OSSL_ALGORITHM deflt_decoder[] = {
};
#undef DECODER
static const OSSL_ALGORITHM deflt_store[] = {
#define STORE(name, fips, func_table) \
{ name, "provider=default,fips=" fips, (func_table) },
#include "stores.inc"
{ NULL, NULL, NULL }
#undef STORE
};
static const OSSL_ALGORITHM *deflt_query(void *provctx, int operation_id,
int *no_cache)
{
@ -461,6 +470,8 @@ static const OSSL_ALGORITHM *deflt_query(void *provctx, int operation_id,
return deflt_encoder;
case OSSL_OP_DECODER:
return deflt_decoder;
case OSSL_OP_STORE:
return deflt_store;
}
return NULL;
}

2
providers/implementations/build.info
View File

@ -1,2 +1,2 @@
SUBDIRS=digests ciphers rands macs kdfs exchange keymgmt signature asymciphers \
encode_decode
encode_decode storemgmt

2
providers/implementations/include/prov/implementations.h
View File

@ -385,3 +385,5 @@ extern const OSSL_DISPATCH der_to_rsapss_decoder_functions[];
extern const OSSL_DISPATCH msblob_to_rsa_decoder_functions[];
extern const OSSL_DISPATCH pvk_to_rsa_decoder_functions[];
extern const OSSL_DISPATCH pem_to_der_decoder_functions[];
extern const OSSL_DISPATCH file_store_functions[];

6
providers/implementations/storemgmt/build.info Normal file
View File

@ -0,0 +1,6 @@
# We make separate GOAL variables for each algorithm, to make it easy to
# switch each to the Legacy provider when needed.
$STORE_GOAL=../../libimplementations.a
SOURCE[$STORE_GOAL]=file_store.c file_store_der2obj.c

920
providers/implementations/storemgmt/file_store.c Normal file
View File

@ -0,0 +1,920 @@
/*
* Copyright 2020 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
* in the file LICENSE in the source distribution or at
* https://www.openssl.org/source/license.html
*/
#include "e_os.h" /* To get strncasecmp() on Windows */
#include <string.h>
#include <sys/stat.h>
#include <ctype.h>
#include <assert.h>
#include <openssl/core.h>
#include <openssl/core_dispatch.h>
#include <openssl/core_names.h>
#include <openssl/core_object.h>
#include <openssl/crypto.h>
#include <openssl/bio.h>
#include <openssl/err.h>
#include <openssl/buffer.h>
#include <openssl/params.h>
#include <openssl/decoder.h>
#include <openssl/store.h> /* The OSSL_STORE_INFO type numbers */
#include "internal/o_dir.h"
#include "internal/pem.h" /* For PVK and "blob" PEM headers */
#include "crypto/decoder.h"
#include "prov/implementations.h"
#include "prov/bio.h"
#include "prov/provider_ctx.h"
#include "prov/providercommonerr.h"
#include "file_store_local.h"
DEFINE_STACK_OF(X509)
DEFINE_STACK_OF(OSSL_STORE_INFO)
#ifdef _WIN32
# define stat _stat
#endif
#ifndef S_ISDIR
# define S_ISDIR(a) (((a) & S_IFMT) == S_IFDIR)
#endif
static OSSL_FUNC_store_open_fn file_open;
static OSSL_FUNC_store_attach_fn file_attach;
static OSSL_FUNC_store_settable_ctx_params_fn file_settable_ctx_params;
static OSSL_FUNC_store_set_ctx_params_fn file_set_ctx_params;
static OSSL_FUNC_store_load_fn file_load;
static OSSL_FUNC_store_eof_fn file_eof;
static OSSL_FUNC_store_close_fn file_close;
/*
* This implementation makes full use of OSSL_DECODER, and then some.
* It uses its own internal decoder implementation that reads DER and
* passes that on to the data callback; this decoder is created with
* internal OpenSSL functions, thereby bypassing the need for a surrounding
* provider. This is ok, since this is a local decoder, not meant for
* public consumption. It also uses the libcrypto internal decoder
* setup function ossl_decoder_ctx_setup_for_EVP_PKEY(), to allow the
* last resort decoder to be added first (and thereby be executed last).
* Finally, it sets up its own construct and cleanup functions.
*
* Essentially, that makes this implementation a kind of glorified decoder.
*/
struct file_ctx_st {
void *provctx;
char *uri; /* The URI we currently try to load */
enum {
IS_FILE = 0, /* Read file and pass results */
IS_DIR /* Pass directory entry names */
} type;
/* Flag bits */
unsigned int flag_attached:1;
unsigned int flag_buffered:1;
union {
/* Used with |IS_FILE| */
struct {
BIO *file;
OSSL_DECODER_CTX *decoderctx;
char *input_type;
char *propq; /* The properties we got as a parameter */
} file;
/* Used with |IS_DIR| */
struct {
OPENSSL_DIR_CTX *ctx;
int end_reached;
/*
* When a search expression is given, these are filled in.
* |search_name| contains the file basename to look for.
* The string is exactly 8 characters long.
*/
char search_name[9];
/*
* The directory reading utility we have combines opening with
* reading the first name. To make sure we can detect the end
* at the right time, we read early and cache the name.
*/
const char *last_entry;
int last_errno;
} dir;
} _;
/* Expected object type. May be unspecified */
int expected_type;
};
static void free_file_ctx(struct file_ctx_st *ctx)
{
if (ctx == NULL)
return;
OPENSSL_free(ctx->uri);
if (ctx->type != IS_DIR) {
OSSL_DECODER_CTX_free(ctx->_.file.decoderctx);
OPENSSL_free(ctx->_.file.propq);
OPENSSL_free(ctx->_.file.input_type);
}
OPENSSL_free(ctx);
}
static struct file_ctx_st *new_file_ctx(int type, const char *uri,
void *provctx)
{
struct file_ctx_st *ctx = NULL;
if ((ctx = OPENSSL_zalloc(sizeof(*ctx))) != NULL
&& (uri == NULL || (ctx->uri = OPENSSL_strdup(uri)) != NULL)) {
ctx->type = type;
ctx->provctx = provctx;
return ctx;
}
free_file_ctx(ctx);
return NULL;
}
static OSSL_DECODER_CONSTRUCT file_load_construct;
static OSSL_DECODER_CLEANUP file_load_cleanup;
/*-
* Opening / attaching streams and directories
* -------------------------------------------
*/
/*
* Function to service both file_open() and file_attach()
*
*
*/
static struct file_ctx_st *file_open_stream(BIO *source, const char *uri,
const char *input_type,
void *provctx)
{
struct file_ctx_st *ctx;
if ((ctx = new_file_ctx(IS_FILE, uri, provctx)) == NULL
|| (input_type != NULL
&& (ctx->_.file.input_type =
OPENSSL_strdup(input_type)) == NULL)) {
ERR_raise(ERR_LIB_PROV, ERR_R_MALLOC_FAILURE);
goto err;
}
ctx->_.file.file = source;
return ctx;
err:
free_file_ctx(ctx);
return NULL;
}
static void *file_open_dir(const char *path, const char *uri, void *provctx)
{
struct file_ctx_st *ctx;
if ((ctx = new_file_ctx(IS_DIR, uri, provctx)) == NULL) {
ERR_raise(ERR_LIB_PROV, ERR_R_MALLOC_FAILURE);
goto err;
}
ctx->_.dir.last_entry = OPENSSL_DIR_read(&ctx->_.dir.ctx, path);
ctx->_.dir.last_errno = errno;
if (ctx->_.dir.last_entry == NULL) {
if (ctx->_.dir.last_errno != 0) {
ERR_raise_data(ERR_LIB_SYS, ctx->_.dir.last_errno,
"Calling OPENSSL_DIR_read(\"%s\")", path);
goto err;
}
ctx->_.dir.end_reached = 1;
}
return ctx;
err:
file_close(ctx);
return NULL;
}
static void *file_open(void *provctx, const char *uri)
{
struct file_ctx_st *ctx = NULL;
struct stat st;
struct {
const char *path;
unsigned int check_absolute:1;
} path_data[2];
size_t path_data_n = 0, i;
const char *path;
BIO *bio;
ERR_set_mark();
/*
* First step, just take the URI as is.
*/
path_data[path_data_n].check_absolute = 0;
path_data[path_data_n++].path = uri;
/*
* Second step, if the URI appears to start with the 'file' scheme,
* extract the path and make that the second path to check.
* There's a special case if the URI also contains an authority, then
* the full URI shouldn't be used as a path anywhere.
*/
if (strncasecmp(uri, "file:", 5) == 0) {
const char *p = &uri[5];
if (strncmp(&uri[5], "//", 2) == 0) {
path_data_n--; /* Invalidate using the full URI */
if (strncasecmp(&uri[7], "localhost/", 10) == 0) {
p = &uri[16];
} else if (uri[7] == '/') {
p = &uri[7];
} else {
ERR_clear_last_mark();
ERR_raise(ERR_LIB_PROV, PROV_R_URI_AUTHORITY_UNSUPPORTED);
return NULL;
}
}
path_data[path_data_n].check_absolute = 1;
#ifdef _WIN32
/* Windows file: URIs with a drive letter start with a / */
if (p[0] == '/' && p[2] == ':' && p[3] == '/') {
char c = tolower(p[1]);
if (c >= 'a' && c <= 'z') {
p++;
/* We know it's absolute, so no need to check */
path_data[path_data_n].check_absolute = 0;
}
}
#endif
path_data[path_data_n++].path = p;
}
for (i = 0, path = NULL; path == NULL && i < path_data_n; i++) {
/*
* If the scheme "file" was an explicit part of the URI, the path must
* be absolute. So says RFC 8089
*/
if (path_data[i].check_absolute && path_data[i].path[0] != '/') {
ERR_clear_last_mark();
ERR_raise_data(ERR_LIB_PROV, PROV_R_PATH_MUST_BE_ABSOLUTE,
"Given path=%s", path_data[i].path);
return NULL;
}
if (stat(path_data[i].path, &st) < 0) {
ERR_raise_data(ERR_LIB_SYS, errno,
"calling stat(%s)",
path_data[i].path);
} else {
path = path_data[i].path;
}
}
if (path == NULL) {
ERR_clear_last_mark();
return NULL;
}
/* Successfully found a working path, clear possible collected errors */
ERR_pop_to_mark();
if (S_ISDIR(st.st_mode))
ctx = file_open_dir(path, uri, provctx);
else if ((bio = BIO_new_file(path, "rb")) == NULL
|| (ctx = file_open_stream(bio, uri, NULL, provctx)) == NULL)
BIO_free_all(bio);
return ctx;
}
/*
* Attached input streams must be treated very very carefully to avoid
* nasty surprises.
*
* This implementation tries to support input streams that can't be reset,
* such as standard input. However, OSSL_DECODER assumes resettable streams,
* and because the PEM decoder may read quite a bit of the input file to skip
* past any non-PEM text that precedes the PEM block, we may need to detect
* if the input stream is a PEM file early.
*
* If the input stream supports BIO_tell(), we assume that it also supports
* BIO_seek(), making it a resettable stream and therefore safe to fully
* unleash OSSL_DECODER.
*
* If the input stream doesn't support BIO_tell(), we must assume that we
* have a non-resettable stream, and must tread carefully. We do so by
* trying to detect if the input is PEM, MSBLOB or PVK, and if not, we
* assume that it's DER.
*
* To detect if an input stream is PEM, MSBLOB or PVK, we use the buffer BIO
* filter, which allows us a 4KiB resettable read-ahead. We *hope* that 4KiB
* will be enough to find the start of the PEM block.
*
* It should be possible to use this same technique to detect other file
* types as well.
*
* An alternative technique would be to have an endlessly caching BIO filter.
* That would take away the need for all the detection here, and simply leave
* it for OSSL_DECODER to find out on its own while supporting its demand for
* resettable input streams.
* That's a possible future development.
*/
# define INPUT_TYPE_ANY NULL
# define INPUT_TYPE_DER "DER"
# define INPUT_TYPE_PEM "PEM"
# define INPUT_TYPE_MSBLOB "MSBLOB"
# define INPUT_TYPE_PVK "PVK"
void *file_attach(void *provctx, OSSL_CORE_BIO *cin)
{
BIO *new_bio = bio_new_from_core_bio(provctx, cin);
BIO *new_bio_tmp = NULL;
BIO *buff = NULL;
char peekbuf[4096] = { 0, };
int loc;
const char *input_type = NULL;
unsigned int flag_attached = 1;
unsigned int flag_buffered = 0;
struct file_ctx_st *ctx = NULL;
if (new_bio == NULL)
return 0;
/* Try to get the current position */
loc = BIO_tell(new_bio);
if ((buff = BIO_new(BIO_f_buffer())) == NULL
|| (new_bio_tmp = BIO_push(buff, new_bio)) == NULL)
goto err;
/* Assumption, if we can't detect PEM */
input_type = INPUT_TYPE_DER;
flag_buffered = 1;
new_bio = new_bio_tmp;
if (BIO_buffer_peek(new_bio, peekbuf, sizeof(peekbuf) - 1) > 0) {
#ifndef OPENSSL_NO_DSA
const unsigned char *p = NULL;
unsigned int magic = 0, bitlen = 0;
int isdss = 0, ispub = -1;
# ifndef OPENSSL_NO_RC4
unsigned int saltlen = 0, keylen = 0;
# endif
#endif
peekbuf[sizeof(peekbuf) - 1] = '\0';
if (strstr(peekbuf, "-----BEGIN ") != NULL)
input_type = INPUT_TYPE_PEM;
#ifndef OPENSSL_NO_DSA
else if (p = (unsigned char *)peekbuf,
ossl_do_blob_header(&p, sizeof(peekbuf), &magic, &bitlen,
&isdss, &ispub))
input_type = INPUT_TYPE_MSBLOB;
# ifndef OPENSSL_NO_RC4
else if (p = (unsigned char *)peekbuf,
ossl_do_PVK_header(&p, sizeof(peekbuf), 0, &saltlen, &keylen))
input_type = INPUT_TYPE_PVK;
# endif
#endif
}
/*
* After peeking, we know that the underlying source BIO has moved ahead
* from its earlier position and that if it supports BIO_tell(), that
* should be a number that differs from |loc|. Otherwise, we will get
* the same value, which may one of:
*
* - zero (the source BIO doesn't support BIO_tell() / BIO_seek() /
* BIO_reset())
* - -1 (the underlying operating system / C library routines do not
* support BIO_tell() / BIO_seek() / BIO_reset())
*
* If it turns out that the source BIO does support BIO_tell(), we pop
* the buffer BIO filter and mark this input as |INPUT_TYPE_ANY|, which
* fully unleashes OSSL_DECODER to do its thing.
*/
if (BIO_tell(new_bio) != loc) {
/* In this case, anything goes */
input_type = INPUT_TYPE_ANY;
/* Restore the source BIO like it was when entering this function */
new_bio = BIO_pop(buff);
BIO_free(buff);
(void)BIO_seek(new_bio, loc);
flag_buffered = 0;
}
if ((ctx = file_open_stream(new_bio, NULL, input_type, provctx)) == NULL)
goto err;
ctx->flag_attached = flag_attached;
ctx->flag_buffered = flag_buffered;
return ctx;
err:
if (flag_buffered) {
new_bio = BIO_pop(buff);
BIO_free(buff);
}
BIO_free(new_bio); /* Removes the provider BIO filter */
return NULL;
}
/*-
* Setting parameters
* ------------------
*/
static const OSSL_PARAM *file_settable_ctx_params(void *provctx)
{
static const OSSL_PARAM known_settable_ctx_params[] = {
OSSL_PARAM_utf8_string(OSSL_STORE_PARAM_PROPERTIES, NULL, 0),
OSSL_PARAM_int(OSSL_STORE_PARAM_EXPECT, NULL),
OSSL_PARAM_octet_string(OSSL_STORE_PARAM_SUBJECT, NULL, 0),
OSSL_PARAM_END
};
return known_settable_ctx_params;
}
static int file_set_ctx_params(void *loaderctx, const OSSL_PARAM params[])
{
struct file_ctx_st *ctx = loaderctx;
const OSSL_PARAM *p;
p = OSSL_PARAM_locate_const(params, OSSL_STORE_PARAM_PROPERTIES);
if (p != NULL) {
OPENSSL_free(ctx->_.file.propq);
ctx->_.file.propq = NULL;
if (!OSSL_PARAM_get_utf8_string(p, &ctx->_.file.propq, 0))
return 0;
}
p = OSSL_PARAM_locate_const(params, OSSL_STORE_PARAM_EXPECT);
if (p != NULL && !OSSL_PARAM_get_int(p, &ctx->expected_type))
return 0;
p = OSSL_PARAM_locate_const(params, OSSL_STORE_PARAM_SUBJECT);
if (p != NULL) {
const unsigned char *der = NULL;
size_t der_len = 0;
X509_NAME *x509_name;
unsigned long hash;
if (ctx->type != IS_DIR) {
ERR_raise(ERR_LIB_PROV,
PROV_R_SEARCH_ONLY_SUPPORTED_FOR_DIRECTORIES);
return 0;
}
if (!OSSL_PARAM_get_octet_string_ptr(p, (const void **)&der, &der_len)
|| (x509_name = d2i_X509_NAME(NULL, &der, der_len)) == NULL)
return 0;
hash = X509_NAME_hash(x509_name);
BIO_snprintf(ctx->_.dir.search_name, sizeof(ctx->_.dir.search_name),
"%08lx", hash);
X509_NAME_free(x509_name);
}
return 1;
}
/*-
* Loading an object from a stream
* -------------------------------
*/
struct file_load_data_st {
OSSL_CALLBACK *object_cb;
void *object_cbarg;
};
static int file_load_construct(OSSL_DECODER_INSTANCE *decoder_inst,
const OSSL_PARAM *params, void *construct_data)
{
struct file_load_data_st *data = construct_data;
/*
* At some point, we may find it justifiable to recognise PKCS#12 and
* handle it specially here, making |file_load()| return pass its
* contents one piece at ta time, like |e_loader_attic.c| does.
*
* However, that currently means parsing them out, which converts the
* DER encoded PKCS#12 into a bunch of EVP_PKEYs and X509s, just to
* have to re-encode them into DER to create an object abstraction for
* each of them.
* It's much simpler (less churn) to pass on the object abstraction we
* get to the load_result callback and leave it to that one to do the
* work. If that's libcrypto code, we know that it has much better
* possibilities to handle the EVP_PKEYs and X509s without the extra
* churn.
*/
return data->object_cb(params, data->object_cbarg);
}
void file_load_cleanup(void *construct_data)
{
/* Nothing to do */
}
static int file_setup_decoders(struct file_ctx_st *ctx)
{
EVP_PKEY *dummy; /* for OSSL_DECODER_CTX_new_by_EVP_PKEY() */
OPENSSL_CTX *libctx = PROV_CTX_get0_library_context(ctx->provctx);
OSSL_DECODER *to_obj = NULL; /* Last resort decoder */
OSSL_DECODER_INSTANCE *to_obj_inst = NULL;
OSSL_DECODER_CLEANUP *old_cleanup = NULL;
void *old_construct_data = NULL;
int ok = 0;
/* Setup for this session, so only if not already done */
if (ctx->_.file.decoderctx == NULL) {
if ((ctx->_.file.decoderctx = OSSL_DECODER_CTX_new()) == NULL) {
ERR_raise(ERR_LIB_PROV, ERR_R_MALLOC_FAILURE);
goto err;
}
/* Make sure the input type is set */
if (!OSSL_DECODER_CTX_set_input_type(ctx->_.file.decoderctx,
ctx->_.file.input_type)) {
ERR_raise(ERR_LIB_PROV, ERR_R_OSSL_DECODER_LIB);
goto err;
}
/*
* Create the internal last resort decoder implementation together
* with a "decoder instance".
* The decoder doesn't need any identification or to be attached to
* any provider, since it's only used locally.
*/
to_obj = ossl_decoder_from_dispatch(0, &der_to_obj_algorithm, NULL);
if (to_obj == NULL)
goto err;
to_obj_inst = ossl_decoder_instance_new(to_obj, ctx->provctx);
if (to_obj_inst == NULL)
goto err;
if (!ossl_decoder_ctx_add_decoder_inst(ctx->_.file.decoderctx,
to_obj_inst)) {
ERR_raise(ERR_LIB_PROV, ERR_R_OSSL_DECODER_LIB);
goto err;
}
/*
* OSSL_DECODER_INSTANCE shouldn't be freed from this point on.
* That's going to happen whenever the OSSL_DECODER_CTX is freed.
*/
to_obj_inst = NULL;
/*
* Add on the usual decoder context for keys, with a dummy object.
* Since we're setting up our own constructor, we don't need to care
* more than that...
*/
if (!ossl_decoder_ctx_setup_for_EVP_PKEY(ctx->_.file.decoderctx, &dummy,
libctx, ctx->_.file.propq)
|| !OSSL_DECODER_CTX_add_extra(ctx->_.file.decoderctx,
libctx, ctx->_.file.propq)) {
ERR_raise(ERR_LIB_PROV, ERR_R_OSSL_DECODER_LIB);
goto err;
}
/*
* Then we throw away the installed finalizer data, and install our
* own instead.
*/
old_cleanup = OSSL_DECODER_CTX_get_cleanup(ctx->_.file.decoderctx);
old_construct_data =
OSSL_DECODER_CTX_get_construct_data(ctx->_.file.decoderctx);
if (old_cleanup != NULL)
old_cleanup(old_construct_data);
/*
* Set the hooks.
*/
if (!OSSL_DECODER_CTX_set_construct(ctx->_.file.decoderctx,
file_load_construct)
|| !OSSL_DECODER_CTX_set_cleanup(ctx->_.file.decoderctx,
file_load_cleanup)) {
ERR_raise(ERR_LIB_PROV, ERR_R_OSSL_DECODER_LIB);
goto err;
}
}
ok = 1;
err:
OSSL_DECODER_free(to_obj);
return ok;
}
static int file_load_file(struct file_ctx_st *ctx,
OSSL_CALLBACK *object_cb, void *object_cbarg,
OSSL_PASSPHRASE_CALLBACK *pw_cb, void *pw_cbarg)
{
struct file_load_data_st data;
/* Setup the decoders (one time shot per session */
if (!file_setup_decoders(ctx))
return 0;
/* Setup for this object */
data.object_cb = object_cb;
data.object_cbarg = object_cbarg;
OSSL_DECODER_CTX_set_construct_data(ctx->_.file.decoderctx, &data);
OSSL_DECODER_CTX_set_passphrase_cb(ctx->_.file.decoderctx, pw_cb, pw_cbarg);
/* Launch */
return OSSL_DECODER_from_bio(ctx->_.file.decoderctx, ctx->_.file.file);
}
/*-
* Loading a name object from a directory
* --------------------------------------
*/
static int ends_with_dirsep(const char *uri)
{
if (*uri != '\0')
uri += strlen(uri) - 1;
#if defined(__VMS)
if (*uri == ']' || *uri == '>' || *uri == ':')
return 1;
#elif defined(_WIN32)
if (*uri == '\\')
return 1;
#endif
return *uri == '/';
}
static char *file_name_to_uri(struct file_ctx_st *ctx, const char *name)
{
char *data = NULL;
assert(name != NULL);
{
const char *pathsep = ends_with_dirsep(ctx->uri) ? "" : "/";
long calculated_length = strlen(ctx->uri) + strlen(pathsep)
+ strlen(name) + 1 /* \0 */;
data = OPENSSL_zalloc(calculated_length);
if (data == NULL) {
ERR_raise(ERR_LIB_PROV, ERR_R_MALLOC_FAILURE);
return NULL;
}
OPENSSL_strlcat(data, ctx->uri, calculated_length);
OPENSSL_strlcat(data, pathsep, calculated_length);
OPENSSL_strlcat(data, name, calculated_length);
}
return data;
}
static int file_name_check(struct file_ctx_st *ctx, const char *name)
{
const char *p = NULL;
/* If there are no search criteria, all names are accepted */
if (ctx->_.dir.search_name[0] == '\0')
return 1;
/* If the expected type isn't supported, no name is accepted */
if (ctx->expected_type != 0
&& ctx->expected_type != OSSL_STORE_INFO_CERT
&& ctx->expected_type != OSSL_STORE_INFO_CRL)
return 0;
/*
* First, check the basename
*/
if (strncasecmp(name, ctx->_.dir.search_name,
sizeof(ctx->_.dir.search_name) - 1) != 0
|| name[sizeof(ctx->_.dir.search_name) - 1] != '.')
return 0;
p = &name[sizeof(ctx->_.dir.search_name)];
/*
* Then, if the expected type is a CRL, check that the extension starts
* with 'r'
*/
if (*p == 'r') {
p++;
if (ctx->expected_type != 0
&& ctx->expected_type != OSSL_STORE_INFO_CRL)
return 0;
} else if (ctx->expected_type == OSSL_STORE_INFO_CRL) {
return 0;
}
/*
* Last, check that the rest of the extension is a decimal number, at
* least one digit long.
*/
if (!isdigit(*p))
return 0;
while (isdigit(*p))
p++;
#ifdef __VMS
/*
* One extra step here, check for a possible generation number.
*/
if (*p == ';')
for (p++; *p != '\0'; p++)
if (!ossl_isdigit(*p))
break;
#endif
/*
* If we've reached the end of the string at this point, we've successfully
* found a fitting file name.
*/
return *p == '\0';
}
static int file_load_dir_entry(struct file_ctx_st *ctx,
OSSL_CALLBACK *object_cb, void *object_cbarg,
OSSL_PASSPHRASE_CALLBACK *pw_cb, void *pw_cbarg)
{
/* Prepare as much as possible in advance */
static const int object_type = OSSL_OBJECT_NAME;
OSSL_PARAM object[] = {
OSSL_PARAM_int(OSSL_OBJECT_PARAM_TYPE, (int *)&object_type),
OSSL_PARAM_utf8_string(OSSL_OBJECT_PARAM_DATA, NULL, 0),
OSSL_PARAM_END
};
char *newname = NULL;
int ok;
/* Loop until we get an error or until we have a suitable name */
do {
if (ctx->_.dir.last_entry == NULL) {
if (!ctx->_.dir.end_reached) {
assert(ctx->_.dir.last_errno != 0);
ERR_raise(ERR_LIB_SYS, ctx->_.dir.last_errno);
}
/* file_eof() will tell if EOF was reached */
return 0;
}
/* flag acceptable names */
if (ctx->_.dir.last_entry[0] != '.'
&& file_name_check(ctx, ctx->_.dir.last_entry)) {
/* If we can't allocate the new name, we fail */
if ((newname =
file_name_to_uri(ctx, ctx->_.dir.last_entry)) == NULL)
return 0;
}
/*
* On the first call (with a NULL context), OPENSSL_DIR_read()
* cares about the second argument. On the following calls, it
* only cares that it isn't NULL. Therefore, we can safely give
* it our URI here.
*/
ctx->_.dir.last_entry = OPENSSL_DIR_read(&ctx->_.dir.ctx, ctx->uri);
ctx->_.dir.last_errno = errno;
if (ctx->_.dir.last_entry == NULL && ctx->_.dir.last_errno == 0)
ctx->_.dir.end_reached = 1;
} while (newname == NULL);
object[1].data = newname;
object[1].data_size = strlen(newname);
ok = object_cb(object, object_cbarg);
OPENSSL_free(newname);
return ok;
}
/*-
* Loading, local dispatcher
* -------------------------
*/
static int file_load(void *loaderctx,
OSSL_CALLBACK *object_cb, void *object_cbarg,
OSSL_PASSPHRASE_CALLBACK *pw_cb, void *pw_cbarg)
{
struct file_ctx_st *ctx = loaderctx;
switch (ctx->type) {
case IS_FILE:
return file_load_file(ctx, object_cb, object_cbarg, pw_cb, pw_cbarg);
case IS_DIR:
return
file_load_dir_entry(ctx, object_cb, object_cbarg, pw_cb, pw_cbarg);
default:
break;
}
/* ctx->type has an unexpected value */
assert(0);
return 0;
}
/*-
* Eof detection and closing
* -------------------------
*/
static int file_eof(void *loaderctx)
{
struct file_ctx_st *ctx = loaderctx;
switch (ctx->type) {
case IS_DIR:
return ctx->_.dir.end_reached;
case IS_FILE:
/*
* BIO_pending() checks any filter BIO.
* BIO_eof() checks the source BIO.
*/
return !BIO_pending(ctx->_.file.file)
&& BIO_eof(ctx->_.file.file);
}
/* ctx->type has an unexpected value */
assert(0);
return 1;
}
static int file_close_dir(struct file_ctx_st *ctx)
{
if (ctx->_.dir.ctx != NULL)
OPENSSL_DIR_end(&ctx->_.dir.ctx);
free_file_ctx(ctx);
return 1;
}
static int file_close_stream(struct file_ctx_st *ctx)
{
if (ctx->flag_buffered) {
/*
* file_attach() pushed a BIO_f_buffer() on top of the regular BIO.
* Drop it.
*/
BIO *buff = ctx->_.file.file;
/* Detach buff */
ctx->_.file.file = BIO_pop(ctx->_.file.file);
BIO_free(buff);
}
/*
* If it was attached, we only free the top, as that's the provider BIO
* filter. Otherwise, it was entirely allocated by this implementation,
* and can safely be completely freed.
*/
if (ctx->flag_attached)
BIO_free(ctx->_.file.file);
else
BIO_free_all(ctx->_.file.file);
/* To avoid double free */
ctx->_.file.file = NULL;
free_file_ctx(ctx);
return 1;
}
static int file_close(void *loaderctx)
{
struct file_ctx_st *ctx = loaderctx;
switch (ctx->type) {
case IS_DIR:
return file_close_dir(ctx);
case IS_FILE:
return file_close_stream(ctx);
}
/* ctx->type has an unexpected value */
assert(0);
return 1;
}
const OSSL_DISPATCH file_store_functions[] = {
{ OSSL_FUNC_STORE_OPEN, (void (*)(void))file_open },
{ OSSL_FUNC_STORE_ATTACH, (void (*)(void))file_attach },
{ OSSL_FUNC_STORE_SETTABLE_CTX_PARAMS,
(void (*)(void))file_settable_ctx_params },
{ OSSL_FUNC_STORE_SET_CTX_PARAMS, (void (*)(void))file_set_ctx_params },
{ OSSL_FUNC_STORE_LOAD, (void (*)(void))file_load },
{ OSSL_FUNC_STORE_EOF, (void (*)(void))file_eof },
{ OSSL_FUNC_STORE_CLOSE, (void (*)(void))file_close },
{ 0, NULL },
};

119
providers/implementations/storemgmt/file_store_der2obj.c Normal file
View File

@ -0,0 +1,119 @@
/*
* Copyright 2020 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
* in the file LICENSE in the source distribution or at
* https://www.openssl.org/source/license.html
*/
/*
* This is a decoder that's completely internal to the 'file:' store
* implementation. Only code in file_store.c know about this one. Because
* of this close relationship, we can cut certain corners, such as making
* assumptions about the "provider context", which is currently simply the
* provider context that the file_store.c code operates within.
*
* All this does is to read DER from the input if it can, and passes it on
* to the data callback as an object abstraction, leaving it to the callback
* to figure out what it actually is.
*
* This MUST be made the last decoder in a chain, leaving it to other more
* specialized decoders to recognise and process their stuff first.
*/
#include <openssl/core_dispatch.h>
#include <openssl/core_names.h>
#include <openssl/core_object.h>
#include <openssl/bio.h>
#include <openssl/buffer.h>
#include <openssl/params.h>
#include "internal/asn1.h"
#include "prov/bio.h"
#include "file_store_local.h"
/*
* newctx and freectx are not strictly necessary. However, the method creator,
* ossl_decoder_from_dispatch(), demands that they exist, so we make sure to
* oblige.
*/
static OSSL_FUNC_decoder_newctx_fn der2obj_newctx;
static OSSL_FUNC_decoder_freectx_fn der2obj_freectx;
static void *der2obj_newctx(void *provctx)
{
return provctx;
}
static void der2obj_freectx(void *vctx)
{
}
static OSSL_FUNC_decoder_gettable_params_fn der2obj_gettable_params;
static OSSL_FUNC_decoder_get_params_fn der2obj_get_params;
static OSSL_FUNC_decoder_decode_fn der2obj_decode;
static const OSSL_PARAM *der2obj_gettable_params(void *provctx)
{
static const OSSL_PARAM gettables[] = {
{ OSSL_DECODER_PARAM_INPUT_TYPE, OSSL_PARAM_UTF8_PTR, NULL, 0, 0 },
OSSL_PARAM_END,
};
return gettables;
}
static int der2obj_get_params(OSSL_PARAM params[])
{
OSSL_PARAM *p;
p = OSSL_PARAM_locate(params, OSSL_DECODER_PARAM_INPUT_TYPE);
if (p != NULL && !OSSL_PARAM_set_utf8_ptr(p, "DER"))
return 0;
return 1;
}
static int der2obj_decode(void *provctx, OSSL_CORE_BIO *cin,
OSSL_CALLBACK *data_cb, void *data_cbarg,
OSSL_PASSPHRASE_CALLBACK *pw_cb, void *pw_cbarg)
{
/*
* We're called from file_store.c, so we know that OSSL_CORE_BIO is a
* BIO in this case.
*/
BIO *in = (BIO *)cin;
BUF_MEM *mem = NULL;
int ok = (asn1_d2i_read_bio(in, &mem) >= 0);
if (ok) {
OSSL_PARAM params[3];
int object_type = OSSL_OBJECT_UNKNOWN;
params[0] =
OSSL_PARAM_construct_int(OSSL_OBJECT_PARAM_TYPE, &object_type);
params[1] =
OSSL_PARAM_construct_octet_string(OSSL_OBJECT_PARAM_DATA,
mem->data, mem->length);
params[2] = OSSL_PARAM_construct_end();
ok = data_cb(params, data_cbarg);
OPENSSL_free(mem->data);
OPENSSL_free(mem);
}
return ok;
}
static const OSSL_DISPATCH der_to_obj_decoder_functions[] = {
{ OSSL_FUNC_DECODER_NEWCTX, (void (*)(void))der2obj_newctx },
{ OSSL_FUNC_DECODER_FREECTX, (void (*)(void))der2obj_freectx },
{ OSSL_FUNC_DECODER_GETTABLE_PARAMS,
(void (*)(void))der2obj_gettable_params },
{ OSSL_FUNC_DECODER_GET_PARAMS, (void (*)(void))der2obj_get_params },
{ OSSL_FUNC_DECODER_DECODE, (void (*)(void))der2obj_decode },
{ 0, NULL }
};
const OSSL_ALGORITHM der_to_obj_algorithm =
{ "obj", NULL, der_to_obj_decoder_functions };

11
providers/implementations/storemgmt/file_store_local.h Normal file
View File

@ -0,0 +1,11 @@
/*
* Copyright 2020 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
* in the file LICENSE in the source distribution or at
* https://www.openssl.org/source/license.html
*/
extern const OSSL_ALGORITHM der_to_obj_algorithm;

14
providers/stores.inc Normal file
View File

@ -0,0 +1,14 @@
/*
* Copyright 2020 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
* in the file LICENSE in the source distribution or at
* https://www.openssl.org/source/license.html
*/
#ifndef STORE
# error Macro STORE undefined
#endif
STORE("file", "yes", file_store_functions)