mirror/openssl
2
0
Fork 0
mirror of https://github.com/openssl/openssl.git synced 2024-11-21 01:15:20 +08:00
Code Issues Packages Projects Releases Wiki Activity
73e044bd1a
openssl/crypto/provider_child.c

295 lines
8.8 KiB
C
Raw Normal View History

Add the concept of a child OSSL_LIB_CTX Add a child OSSL_LIB_CTX that will mirror the providers loaded into the parent libctx. This is useful for providers that want to use algorithms from other providers and just need to inherit the providers used by the application. Fixes #14925 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14991)
2021-04-21 23:51:41 +08:00
/*
* Copyright 2019-2021 The OpenSSL Project Authors. All Rights Reserved.
*
* Licensed under the Apache License 2.0 (the "License"). You may not use
* this file except in compliance with the License. You can obtain a copy
* in the file LICENSE in the source distribution or at
* https://www.openssl.org/source/license.html
*/
Add support for child provider to up_ref/free their parent If the ref counts on a child provider change, then this needs to be reflected in the parent so we add callbacks to do this. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14991)
2021-04-29 23:37:42 +08:00
#include <assert.h>
Add the concept of a child OSSL_LIB_CTX Add a child OSSL_LIB_CTX that will mirror the providers loaded into the parent libctx. This is useful for providers that want to use algorithms from other providers and just need to inherit the providers used by the application. Fixes #14925 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14991)
2021-04-21 23:51:41 +08:00
#include <openssl/crypto.h>
#include <openssl/core_dispatch.h>
#include <openssl/core_names.h>
#include <openssl/provider.h>
Add a callback for providers to know about global properties changes Where a child libctx is in use it needs to know what the current global properties are. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15242)
2021-05-08 00:59:47 +08:00
#include <openssl/evp.h>
Add the concept of a child OSSL_LIB_CTX Add a child OSSL_LIB_CTX that will mirror the providers loaded into the parent libctx. This is useful for providers that want to use algorithms from other providers and just need to inherit the providers used by the application. Fixes #14925 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14991)
2021-04-21 23:51:41 +08:00
#include "internal/provider.h"
#include "internal/cryptlib.h"
Ensure mirroring of properties works for subsequent updates If the global properties are updated after a provider with a child libctx has already started we need to make sure those updates are mirrored in that child. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15242)
2021-05-11 23:50:27 +08:00
#include "crypto/evp.h"
Refactor OSSL_LIB_CTX to avoid using CRYPTO_EX_DATA This refactors OSSL_LIB_CTX to avoid using CRYPTO_EX_DATA. The assorted objects to be managed by OSSL_LIB_CTX are hardcoded and are initialized eagerly rather than lazily, which avoids the need for locking on access in most cases. Fixes #17116. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17881)
2022-03-14 16:13:12 +08:00
#include "crypto/context.h"
Add the concept of a child OSSL_LIB_CTX Add a child OSSL_LIB_CTX that will mirror the providers loaded into the parent libctx. This is useful for providers that want to use algorithms from other providers and just need to inherit the providers used by the application. Fixes #14925 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14991)
2021-04-21 23:51:41 +08:00
DEFINE_STACK_OF(OSSL_PROVIDER)
struct child_prov_globals {
const OSSL_CORE_HANDLE *handle;
Register callbacks with core for child provider creation/deletion By adding callbacks to the core this will enable (in future commits) the ability to add/remove child providers as the providers are added/removed from the parent libctx. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14991)
2021-04-23 19:08:27 +08:00
const OSSL_CORE_HANDLE *curr_prov;
Add the concept of a child OSSL_LIB_CTX Add a child OSSL_LIB_CTX that will mirror the providers loaded into the parent libctx. This is useful for providers that want to use algorithms from other providers and just need to inherit the providers used by the application. Fixes #14925 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14991)
2021-04-21 23:51:41 +08:00
CRYPTO_RWLOCK *lock;
OSSL_FUNC_core_get_libctx_fn *c_get_libctx;
Register callbacks with core for child provider creation/deletion By adding callbacks to the core this will enable (in future commits) the ability to add/remove child providers as the providers are added/removed from the parent libctx. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14991)
2021-04-23 19:08:27 +08:00
OSSL_FUNC_provider_register_child_cb_fn *c_provider_register_child_cb;
OSSL_FUNC_provider_deregister_child_cb_fn *c_provider_deregister_child_cb;
OSSL_FUNC_provider_name_fn *c_prov_name;
OSSL_FUNC_provider_get0_provider_ctx_fn *c_prov_get0_provider_ctx;
OSSL_FUNC_provider_get0_dispatch_fn *c_prov_get0_dispatch;
Add support for child provider to up_ref/free their parent If the ref counts on a child provider change, then this needs to be reflected in the parent so we add callbacks to do this. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14991)
2021-04-29 23:37:42 +08:00
OSSL_FUNC_provider_up_ref_fn *c_prov_up_ref;
OSSL_FUNC_provider_free_fn *c_prov_free;
Add the concept of a child OSSL_LIB_CTX Add a child OSSL_LIB_CTX that will mirror the providers loaded into the parent libctx. This is useful for providers that want to use algorithms from other providers and just need to inherit the providers used by the application. Fixes #14925 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14991)
2021-04-21 23:51:41 +08:00
};
Refactor OSSL_LIB_CTX to avoid using CRYPTO_EX_DATA This refactors OSSL_LIB_CTX to avoid using CRYPTO_EX_DATA. The assorted objects to be managed by OSSL_LIB_CTX are hardcoded and are initialized eagerly rather than lazily, which avoids the need for locking on access in most cases. Fixes #17116. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17881)
2022-03-14 16:13:12 +08:00
void *ossl_child_prov_ctx_new(OSSL_LIB_CTX *libctx)
Add the concept of a child OSSL_LIB_CTX Add a child OSSL_LIB_CTX that will mirror the providers loaded into the parent libctx. This is useful for providers that want to use algorithms from other providers and just need to inherit the providers used by the application. Fixes #14925 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14991)
2021-04-21 23:51:41 +08:00
{
return OPENSSL_zalloc(sizeof(struct child_prov_globals));
}
Refactor OSSL_LIB_CTX to avoid using CRYPTO_EX_DATA This refactors OSSL_LIB_CTX to avoid using CRYPTO_EX_DATA. The assorted objects to be managed by OSSL_LIB_CTX are hardcoded and are initialized eagerly rather than lazily, which avoids the need for locking on access in most cases. Fixes #17116. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17881)
2022-03-14 16:13:12 +08:00
void ossl_child_prov_ctx_free(void *vgbl)
Add the concept of a child OSSL_LIB_CTX Add a child OSSL_LIB_CTX that will mirror the providers loaded into the parent libctx. This is useful for providers that want to use algorithms from other providers and just need to inherit the providers used by the application. Fixes #14925 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14991)
2021-04-21 23:51:41 +08:00
{
struct child_prov_globals *gbl = vgbl;
CRYPTO_THREAD_lock_free(gbl->lock);
OPENSSL_free(gbl);
}
static OSSL_provider_init_fn ossl_child_provider_init;
static int ossl_child_provider_init(const OSSL_CORE_HANDLE *handle,
const OSSL_DISPATCH *in,
const OSSL_DISPATCH **out,
void **provctx)
{
OSSL_FUNC_core_get_libctx_fn *c_get_libctx = NULL;
OSSL_LIB_CTX *ctx;
struct child_prov_globals *gbl;
for (; in->function_id != 0; in++) {
switch (in->function_id) {
case OSSL_FUNC_CORE_GET_LIBCTX:
c_get_libctx = OSSL_FUNC_core_get_libctx(in);
break;
default:
/* Just ignore anything we don't understand */
break;
}
}
if (c_get_libctx == NULL)
return 0;
/*
* We need an OSSL_LIB_CTX but c_get_libctx returns OPENSSL_CORE_CTX. We are
* a built-in provider and so we can get away with this cast. Normal
* providers can't do this.
*/
ctx = (OSSL_LIB_CTX *)c_get_libctx(handle);
Refactor OSSL_LIB_CTX to avoid using CRYPTO_EX_DATA This refactors OSSL_LIB_CTX to avoid using CRYPTO_EX_DATA. The assorted objects to be managed by OSSL_LIB_CTX are hardcoded and are initialized eagerly rather than lazily, which avoids the need for locking on access in most cases. Fixes #17116. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17881)
2022-03-14 16:13:12 +08:00
gbl = ossl_lib_ctx_get_data(ctx, OSSL_LIB_CTX_CHILD_PROVIDER_INDEX);
Add the concept of a child OSSL_LIB_CTX Add a child OSSL_LIB_CTX that will mirror the providers loaded into the parent libctx. This is useful for providers that want to use algorithms from other providers and just need to inherit the providers used by the application. Fixes #14925 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14991)
2021-04-21 23:51:41 +08:00
if (gbl == NULL)
return 0;
*provctx = gbl->c_prov_get0_provider_ctx(gbl->curr_prov);
*out = gbl->c_prov_get0_dispatch(gbl->curr_prov);
return 1;
}
Register callbacks with core for child provider creation/deletion By adding callbacks to the core this will enable (in future commits) the ability to add/remove child providers as the providers are added/removed from the parent libctx. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14991)
2021-04-23 19:08:27 +08:00
static int provider_create_child_cb(const OSSL_CORE_HANDLE *prov, void *cbdata)
Add the concept of a child OSSL_LIB_CTX Add a child OSSL_LIB_CTX that will mirror the providers loaded into the parent libctx. This is useful for providers that want to use algorithms from other providers and just need to inherit the providers used by the application. Fixes #14925 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14991)
2021-04-21 23:51:41 +08:00
{
OSSL_LIB_CTX *ctx = cbdata;
struct child_prov_globals *gbl;
const char *provname;
OSSL_PROVIDER *cprov;
Register callbacks with core for child provider creation/deletion By adding callbacks to the core this will enable (in future commits) the ability to add/remove child providers as the providers are added/removed from the parent libctx. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14991)
2021-04-23 19:08:27 +08:00
int ret = 0;
Add the concept of a child OSSL_LIB_CTX Add a child OSSL_LIB_CTX that will mirror the providers loaded into the parent libctx. This is useful for providers that want to use algorithms from other providers and just need to inherit the providers used by the application. Fixes #14925 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14991)
2021-04-21 23:51:41 +08:00
Refactor OSSL_LIB_CTX to avoid using CRYPTO_EX_DATA This refactors OSSL_LIB_CTX to avoid using CRYPTO_EX_DATA. The assorted objects to be managed by OSSL_LIB_CTX are hardcoded and are initialized eagerly rather than lazily, which avoids the need for locking on access in most cases. Fixes #17116. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17881)
2022-03-14 16:13:12 +08:00
gbl = ossl_lib_ctx_get_data(ctx, OSSL_LIB_CTX_CHILD_PROVIDER_INDEX);
Add the concept of a child OSSL_LIB_CTX Add a child OSSL_LIB_CTX that will mirror the providers loaded into the parent libctx. This is useful for providers that want to use algorithms from other providers and just need to inherit the providers used by the application. Fixes #14925 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14991)
2021-04-21 23:51:41 +08:00
if (gbl == NULL)
return 0;
Remove the isinited variable from child_prov_globals This variable might have made sense at some point but it not longer does so. It was being used to check whether we are still initing or not. If we are still initing then the assumption was that we already hold the lock. That assumption was untrue. We need to always take the lock. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16980)
2021-11-09 00:30:43 +08:00
if (!CRYPTO_THREAD_write_lock(gbl->lock))
Register callbacks with core for child provider creation/deletion By adding callbacks to the core this will enable (in future commits) the ability to add/remove child providers as the providers are added/removed from the parent libctx. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14991)
2021-04-23 19:08:27 +08:00
return 0;
Add the concept of a child OSSL_LIB_CTX Add a child OSSL_LIB_CTX that will mirror the providers loaded into the parent libctx. This is useful for providers that want to use algorithms from other providers and just need to inherit the providers used by the application. Fixes #14925 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14991)
2021-04-21 23:51:41 +08:00
provname = gbl->c_prov_name(prov);
/*
* We're operating under a lock so we can store the "current" provider in
* the global data.
*/
gbl->curr_prov = prov;
Don't convert pre-existing providers into children If a provider explicitly loads another provider into a child libctx where it wasn't previously loaded then we don't start treating it like a child if the parent libctx subsequently loads the same provider. Fixes #14925 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14991)
2021-05-04 23:23:31 +08:00
if ((cprov = ossl_provider_find(ctx, provname, 1)) != NULL) {
/*
Fix a race in ossl_provider_add_to_store() If two threads both attempt to load the same provider at the same time, they will first both check to see if the provider already exists. If it doesn't then they will both then create new provider objects and call the init function. However only one of the threads will be successful in adding the provider to the store. For the "losing" thread we should still return "success", but we should deinitialise and free the no longer required provider object, and return the object that exists in the store. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15854)
2021-06-22 22:39:40 +08:00
* We free the newly created ref. We rely on the provider sticking around
* in the provider store.
*/
Don't convert pre-existing providers into children If a provider explicitly loads another provider into a child libctx where it wasn't previously loaded then we don't start treating it like a child if the parent libctx subsequently loads the same provider. Fixes #14925 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14991)
2021-05-04 23:23:31 +08:00
ossl_provider_free(cprov);
/*
Remove flag_couldbechild Now that a provider is no longer put into the store until after it has been activated we don't need flag_couldbechild any more. This flag was used to indicate whether a provider was eligible for conversion into a child provider or not. This was only really interesting for predefined providers that were automatically created. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15854)
2021-06-21 18:06:12 +08:00
* The provider already exists. It could be a previously created child,
* or it could have been explicitly loaded. If explicitly loaded we
* ignore it - i.e. we don't start treating it like a child.
Don't convert pre-existing providers into children If a provider explicitly loads another provider into a child libctx where it wasn't previously loaded then we don't start treating it like a child if the parent libctx subsequently loads the same provider. Fixes #14925 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14991)
2021-05-04 23:23:31 +08:00
*/
Merge ossl_provider_activate() and ossl_provider_activate_child() These 2 functions have become so close to each other that they may as well be just one function. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15854)
2021-06-21 19:08:39 +08:00
if (!ossl_provider_activate(cprov, 0, 1))
Don't convert pre-existing providers into children If a provider explicitly loads another provider into a child libctx where it wasn't previously loaded then we don't start treating it like a child if the parent libctx subsequently loads the same provider. Fixes #14925 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14991)
2021-05-04 23:23:31 +08:00
goto err;
} else {
/*
* Create it - passing 1 as final param so we don't try and recursively
* init children
*/
if ((cprov = ossl_provider_new(ctx, provname, ossl_child_provider_init,
1)) == NULL)
goto err;
Merge ossl_provider_activate() and ossl_provider_activate_child() These 2 functions have become so close to each other that they may as well be just one function. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15854)
2021-06-21 19:08:39 +08:00
if (!ossl_provider_activate(cprov, 0, 0))
Don't convert pre-existing providers into children If a provider explicitly loads another provider into a child libctx where it wasn't previously loaded then we don't start treating it like a child if the parent libctx subsequently loads the same provider. Fixes #14925 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14991)
2021-05-04 23:23:31 +08:00
goto err;
Add a new provider to the store only after we activate it Rather than creating the provider, adding to the store and then activating it, we do things the other way around, i.e. activate first and then add to the store. This means that the activation should occur before other threads are aware of the provider. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15854)
2021-06-21 16:23:30 +08:00
if (!ossl_provider_set_child(cprov, prov)
Fix a race in ossl_provider_add_to_store() If two threads both attempt to load the same provider at the same time, they will first both check to see if the provider already exists. If it doesn't then they will both then create new provider objects and call the init function. However only one of the threads will be successful in adding the provider to the store. For the "losing" thread we should still return "success", but we should deinitialise and free the no longer required provider object, and return the object that exists in the store. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15854)
2021-06-22 22:39:40 +08:00
|| !ossl_provider_add_to_store(cprov, NULL, 0)) {
Don't attempt to deactive child providers if we don't need to If a provider doesn't have any child providers then there is no need to attempt to remove them - so we should not do so. This removes some potentialy thread races. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16980)
2021-11-05 21:42:40 +08:00
ossl_provider_deactivate(cprov, 0);
Add a new provider to the store only after we activate it Rather than creating the provider, adding to the store and then activating it, we do things the other way around, i.e. activate first and then add to the store. This means that the activation should occur before other threads are aware of the provider. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15854)
2021-06-21 16:23:30 +08:00
ossl_provider_free(cprov);
Don't convert pre-existing providers into children If a provider explicitly loads another provider into a child libctx where it wasn't previously loaded then we don't start treating it like a child if the parent libctx subsequently loads the same provider. Fixes #14925 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14991)
2021-05-04 23:23:31 +08:00
goto err;
}
Add the concept of a child OSSL_LIB_CTX Add a child OSSL_LIB_CTX that will mirror the providers loaded into the parent libctx. This is useful for providers that want to use algorithms from other providers and just need to inherit the providers used by the application. Fixes #14925 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14991)
2021-04-21 23:51:41 +08:00
}
Register callbacks with core for child provider creation/deletion By adding callbacks to the core this will enable (in future commits) the ability to add/remove child providers as the providers are added/removed from the parent libctx. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14991)
2021-04-23 19:08:27 +08:00
ret = 1;
err:
Remove the isinited variable from child_prov_globals This variable might have made sense at some point but it not longer does so. It was being used to check whether we are still initing or not. If we are still initing then the assumption was that we already hold the lock. That assumption was untrue. We need to always take the lock. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16980)
2021-11-09 00:30:43 +08:00
CRYPTO_THREAD_unlock(gbl->lock);
Register callbacks with core for child provider creation/deletion By adding callbacks to the core this will enable (in future commits) the ability to add/remove child providers as the providers are added/removed from the parent libctx. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14991)
2021-04-23 19:08:27 +08:00
return ret;
}
static int provider_remove_child_cb(const OSSL_CORE_HANDLE *prov, void *cbdata)
{
OSSL_LIB_CTX *ctx = cbdata;
struct child_prov_globals *gbl;
const char *provname;
OSSL_PROVIDER *cprov;
Refactor OSSL_LIB_CTX to avoid using CRYPTO_EX_DATA This refactors OSSL_LIB_CTX to avoid using CRYPTO_EX_DATA. The assorted objects to be managed by OSSL_LIB_CTX are hardcoded and are initialized eagerly rather than lazily, which avoids the need for locking on access in most cases. Fixes #17116. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17881)
2022-03-14 16:13:12 +08:00
gbl = ossl_lib_ctx_get_data(ctx, OSSL_LIB_CTX_CHILD_PROVIDER_INDEX);
Register callbacks with core for child provider creation/deletion By adding callbacks to the core this will enable (in future commits) the ability to add/remove child providers as the providers are added/removed from the parent libctx. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14991)
2021-04-23 19:08:27 +08:00
if (gbl == NULL)
return 0;
provname = gbl->c_prov_name(prov);
cprov = ossl_provider_find(ctx, provname, 1);
Don't convert pre-existing providers into children If a provider explicitly loads another provider into a child libctx where it wasn't previously loaded then we don't start treating it like a child if the parent libctx subsequently loads the same provider. Fixes #14925 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14991)
2021-05-04 23:23:31 +08:00
if (cprov == NULL)
Add support for child provider to up_ref/free their parent If the ref counts on a child provider change, then this needs to be reflected in the parent so we add callbacks to do this. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14991)
2021-04-29 23:37:42 +08:00
return 0;
Don't convert pre-existing providers into children If a provider explicitly loads another provider into a child libctx where it wasn't previously loaded then we don't start treating it like a child if the parent libctx subsequently loads the same provider. Fixes #14925 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14991)
2021-05-04 23:23:31 +08:00
/*
* ossl_provider_find ups the ref count, so we free it again here. We can
* rely on the provider store reference count.
*/
Add support for child provider to up_ref/free their parent If the ref counts on a child provider change, then this needs to be reflected in the parent so we add callbacks to do this. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14991)
2021-04-29 23:37:42 +08:00
ossl_provider_free(cprov);
Don't convert pre-existing providers into children If a provider explicitly loads another provider into a child libctx where it wasn't previously loaded then we don't start treating it like a child if the parent libctx subsequently loads the same provider. Fixes #14925 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14991)
2021-05-04 23:23:31 +08:00
if (ossl_provider_is_child(cprov)
Don't attempt to deactive child providers if we don't need to If a provider doesn't have any child providers then there is no need to attempt to remove them - so we should not do so. This removes some potentialy thread races. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16980)
2021-11-05 21:42:40 +08:00
&& !ossl_provider_deactivate(cprov, 1))
Don't convert pre-existing providers into children If a provider explicitly loads another provider into a child libctx where it wasn't previously loaded then we don't start treating it like a child if the parent libctx subsequently loads the same provider. Fixes #14925 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14991)
2021-05-04 23:23:31 +08:00
return 0;
Register callbacks with core for child provider creation/deletion By adding callbacks to the core this will enable (in future commits) the ability to add/remove child providers as the providers are added/removed from the parent libctx. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14991)
2021-04-23 19:08:27 +08:00
Add the concept of a child OSSL_LIB_CTX Add a child OSSL_LIB_CTX that will mirror the providers loaded into the parent libctx. This is useful for providers that want to use algorithms from other providers and just need to inherit the providers used by the application. Fixes #14925 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14991)
2021-04-21 23:51:41 +08:00
return 1;
}
Add a callback for providers to know about global properties changes Where a child libctx is in use it needs to know what the current global properties are. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15242)
2021-05-08 00:59:47 +08:00
static int provider_global_props_cb(const char *props, void *cbdata)
{
OSSL_LIB_CTX *ctx = cbdata;
return evp_set_default_properties_int(ctx, props, 0, 1);
}
Add the concept of a child OSSL_LIB_CTX Add a child OSSL_LIB_CTX that will mirror the providers loaded into the parent libctx. This is useful for providers that want to use algorithms from other providers and just need to inherit the providers used by the application. Fixes #14925 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14991)
2021-04-21 23:51:41 +08:00
int ossl_provider_init_as_child(OSSL_LIB_CTX *ctx,
const OSSL_CORE_HANDLE *handle,
const OSSL_DISPATCH *in)
{
struct child_prov_globals *gbl;
if (ctx == NULL)
return 0;
Refactor OSSL_LIB_CTX to avoid using CRYPTO_EX_DATA This refactors OSSL_LIB_CTX to avoid using CRYPTO_EX_DATA. The assorted objects to be managed by OSSL_LIB_CTX are hardcoded and are initialized eagerly rather than lazily, which avoids the need for locking on access in most cases. Fixes #17116. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17881)
2022-03-14 16:13:12 +08:00
gbl = ossl_lib_ctx_get_data(ctx, OSSL_LIB_CTX_CHILD_PROVIDER_INDEX);
Add the concept of a child OSSL_LIB_CTX Add a child OSSL_LIB_CTX that will mirror the providers loaded into the parent libctx. This is useful for providers that want to use algorithms from other providers and just need to inherit the providers used by the application. Fixes #14925 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14991)
2021-04-21 23:51:41 +08:00
if (gbl == NULL)
return 0;
gbl->handle = handle;
for (; in->function_id != 0; in++) {
switch (in->function_id) {
case OSSL_FUNC_CORE_GET_LIBCTX:
gbl->c_get_libctx = OSSL_FUNC_core_get_libctx(in);
break;
Register callbacks with core for child provider creation/deletion By adding callbacks to the core this will enable (in future commits) the ability to add/remove child providers as the providers are added/removed from the parent libctx. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14991)
2021-04-23 19:08:27 +08:00
case OSSL_FUNC_PROVIDER_REGISTER_CHILD_CB:
gbl->c_provider_register_child_cb
= OSSL_FUNC_provider_register_child_cb(in);
break;
case OSSL_FUNC_PROVIDER_DEREGISTER_CHILD_CB:
gbl->c_provider_deregister_child_cb
= OSSL_FUNC_provider_deregister_child_cb(in);
Add the concept of a child OSSL_LIB_CTX Add a child OSSL_LIB_CTX that will mirror the providers loaded into the parent libctx. This is useful for providers that want to use algorithms from other providers and just need to inherit the providers used by the application. Fixes #14925 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14991)
2021-04-21 23:51:41 +08:00
break;
Register callbacks with core for child provider creation/deletion By adding callbacks to the core this will enable (in future commits) the ability to add/remove child providers as the providers are added/removed from the parent libctx. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14991)
2021-04-23 19:08:27 +08:00
case OSSL_FUNC_PROVIDER_NAME:
gbl->c_prov_name = OSSL_FUNC_provider_name(in);
Add the concept of a child OSSL_LIB_CTX Add a child OSSL_LIB_CTX that will mirror the providers loaded into the parent libctx. This is useful for providers that want to use algorithms from other providers and just need to inherit the providers used by the application. Fixes #14925 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14991)
2021-04-21 23:51:41 +08:00
break;
Register callbacks with core for child provider creation/deletion By adding callbacks to the core this will enable (in future commits) the ability to add/remove child providers as the providers are added/removed from the parent libctx. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14991)
2021-04-23 19:08:27 +08:00
case OSSL_FUNC_PROVIDER_GET0_PROVIDER_CTX:
Add the concept of a child OSSL_LIB_CTX Add a child OSSL_LIB_CTX that will mirror the providers loaded into the parent libctx. This is useful for providers that want to use algorithms from other providers and just need to inherit the providers used by the application. Fixes #14925 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14991)
2021-04-21 23:51:41 +08:00
gbl->c_prov_get0_provider_ctx
Register callbacks with core for child provider creation/deletion By adding callbacks to the core this will enable (in future commits) the ability to add/remove child providers as the providers are added/removed from the parent libctx. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14991)
2021-04-23 19:08:27 +08:00
= OSSL_FUNC_provider_get0_provider_ctx(in);
Add the concept of a child OSSL_LIB_CTX Add a child OSSL_LIB_CTX that will mirror the providers loaded into the parent libctx. This is useful for providers that want to use algorithms from other providers and just need to inherit the providers used by the application. Fixes #14925 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14991)
2021-04-21 23:51:41 +08:00
break;
Register callbacks with core for child provider creation/deletion By adding callbacks to the core this will enable (in future commits) the ability to add/remove child providers as the providers are added/removed from the parent libctx. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14991)
2021-04-23 19:08:27 +08:00
case OSSL_FUNC_PROVIDER_GET0_DISPATCH:
gbl->c_prov_get0_dispatch = OSSL_FUNC_provider_get0_dispatch(in);
Add the concept of a child OSSL_LIB_CTX Add a child OSSL_LIB_CTX that will mirror the providers loaded into the parent libctx. This is useful for providers that want to use algorithms from other providers and just need to inherit the providers used by the application. Fixes #14925 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14991)
2021-04-21 23:51:41 +08:00
break;
Add support for child provider to up_ref/free their parent If the ref counts on a child provider change, then this needs to be reflected in the parent so we add callbacks to do this. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14991)
2021-04-29 23:37:42 +08:00
case OSSL_FUNC_PROVIDER_UP_REF:
gbl->c_prov_up_ref
= OSSL_FUNC_provider_up_ref(in);
break;
case OSSL_FUNC_PROVIDER_FREE:
gbl->c_prov_free = OSSL_FUNC_provider_free(in);
break;
Add the concept of a child OSSL_LIB_CTX Add a child OSSL_LIB_CTX that will mirror the providers loaded into the parent libctx. This is useful for providers that want to use algorithms from other providers and just need to inherit the providers used by the application. Fixes #14925 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14991)
2021-04-21 23:51:41 +08:00
default:
/* Just ignore anything we don't understand */
break;
}
}
Register callbacks with core for child provider creation/deletion By adding callbacks to the core this will enable (in future commits) the ability to add/remove child providers as the providers are added/removed from the parent libctx. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14991)
2021-04-23 19:08:27 +08:00
if (gbl->c_get_libctx == NULL
|| gbl->c_provider_register_child_cb == NULL
Add the concept of a child OSSL_LIB_CTX Add a child OSSL_LIB_CTX that will mirror the providers loaded into the parent libctx. This is useful for providers that want to use algorithms from other providers and just need to inherit the providers used by the application. Fixes #14925 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14991)
2021-04-21 23:51:41 +08:00
|| gbl->c_prov_name == NULL
|| gbl->c_prov_get0_provider_ctx == NULL
Add support for child provider to up_ref/free their parent If the ref counts on a child provider change, then this needs to be reflected in the parent so we add callbacks to do this. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14991)
2021-04-29 23:37:42 +08:00
|| gbl->c_prov_get0_dispatch == NULL
|| gbl->c_prov_up_ref == NULL
|| gbl->c_prov_free == NULL)
Add the concept of a child OSSL_LIB_CTX Add a child OSSL_LIB_CTX that will mirror the providers loaded into the parent libctx. This is useful for providers that want to use algorithms from other providers and just need to inherit the providers used by the application. Fixes #14925 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14991)
2021-04-21 23:51:41 +08:00
return 0;
gbl->lock = CRYPTO_THREAD_lock_new();
if (gbl->lock == NULL)
return 0;
Init the child providers immediately on creation of the child libctx We were deferring the initial creation of the child providers until the first fetch. This is a carry over from an earlier iteration of the child lib ctx development and is no longer necessary. In fact we need to init the child providers immediately otherwise not all providers quite init correctly. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15270)
2021-05-13 22:35:42 +08:00
if (!gbl->c_provider_register_child_cb(gbl->handle,
provider_create_child_cb,
provider_remove_child_cb,
Add a callback for providers to know about global properties changes Where a child libctx is in use it needs to know what the current global properties are. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15242)
2021-05-08 00:59:47 +08:00
provider_global_props_cb,
Init the child providers immediately on creation of the child libctx We were deferring the initial creation of the child providers until the first fetch. This is a carry over from an earlier iteration of the child lib ctx development and is no longer necessary. In fact we need to init the child providers immediately otherwise not all providers quite init correctly. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15270)
2021-05-13 22:35:42 +08:00
ctx))
return 0;
Add the concept of a child OSSL_LIB_CTX Add a child OSSL_LIB_CTX that will mirror the providers loaded into the parent libctx. This is useful for providers that want to use algorithms from other providers and just need to inherit the providers used by the application. Fixes #14925 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14991)
2021-04-21 23:51:41 +08:00
return 1;
}
Add support for child provider to up_ref/free their parent If the ref counts on a child provider change, then this needs to be reflected in the parent so we add callbacks to do this. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14991)
2021-04-29 23:37:42 +08:00
Stop receiving child callbacks in a child libctx when appropriate We should stop receiving child callbacks if we're about to free up the child libctx. Otherwise we can get callbacks when the libctx is half freed up. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16980)
2021-11-09 21:48:31 +08:00
void ossl_provider_deinit_child(OSSL_LIB_CTX *ctx)
{
struct child_prov_globals *gbl
Refactor OSSL_LIB_CTX to avoid using CRYPTO_EX_DATA This refactors OSSL_LIB_CTX to avoid using CRYPTO_EX_DATA. The assorted objects to be managed by OSSL_LIB_CTX are hardcoded and are initialized eagerly rather than lazily, which avoids the need for locking on access in most cases. Fixes #17116. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17881)
2022-03-14 16:13:12 +08:00
= ossl_lib_ctx_get_data(ctx, OSSL_LIB_CTX_CHILD_PROVIDER_INDEX);
Stop receiving child callbacks in a child libctx when appropriate We should stop receiving child callbacks if we're about to free up the child libctx. Otherwise we can get callbacks when the libctx is half freed up. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16980)
2021-11-09 21:48:31 +08:00
if (gbl == NULL)
return;
gbl->c_provider_deregister_child_cb(gbl->handle);
}
Add support for child provider to up_ref/free their parent If the ref counts on a child provider change, then this needs to be reflected in the parent so we add callbacks to do this. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14991)
2021-04-29 23:37:42 +08:00
int ossl_provider_up_ref_parent(OSSL_PROVIDER *prov, int activate)
{
struct child_prov_globals *gbl;
gbl = ossl_lib_ctx_get_data(ossl_provider_libctx(prov),
Refactor OSSL_LIB_CTX to avoid using CRYPTO_EX_DATA This refactors OSSL_LIB_CTX to avoid using CRYPTO_EX_DATA. The assorted objects to be managed by OSSL_LIB_CTX are hardcoded and are initialized eagerly rather than lazily, which avoids the need for locking on access in most cases. Fixes #17116. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17881)
2022-03-14 16:13:12 +08:00
OSSL_LIB_CTX_CHILD_PROVIDER_INDEX);
Add support for child provider to up_ref/free their parent If the ref counts on a child provider change, then this needs to be reflected in the parent so we add callbacks to do this. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14991)
2021-04-29 23:37:42 +08:00
if (gbl == NULL)
return 0;
return gbl->c_prov_up_ref(ossl_provider_get_parent(prov), activate);
}
int ossl_provider_free_parent(OSSL_PROVIDER *prov, int deactivate)
{
struct child_prov_globals *gbl;
gbl = ossl_lib_ctx_get_data(ossl_provider_libctx(prov),
Refactor OSSL_LIB_CTX to avoid using CRYPTO_EX_DATA This refactors OSSL_LIB_CTX to avoid using CRYPTO_EX_DATA. The assorted objects to be managed by OSSL_LIB_CTX are hardcoded and are initialized eagerly rather than lazily, which avoids the need for locking on access in most cases. Fixes #17116. Reviewed-by: Matt Caswell <matt@openssl.org> Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/17881)
2022-03-14 16:13:12 +08:00
OSSL_LIB_CTX_CHILD_PROVIDER_INDEX);
Add support for child provider to up_ref/free their parent If the ref counts on a child provider change, then this needs to be reflected in the parent so we add callbacks to do this. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14991)
2021-04-29 23:37:42 +08:00
if (gbl == NULL)
return 0;
return gbl->c_prov_free(ossl_provider_get_parent(prov), deactivate);
}
Reference in New Issue Copy Permalink