mirror/openssl
2
0
Fork 0
mirror of https://github.com/openssl/openssl.git synced 2025-01-18 13:44:20 +08:00
Code Issues Packages Projects Releases Wiki Activity

Sanity check provider up-calls

Browse Source 
When we store references to up-calls for future reference we run a sanity
check to make sure we either previously haven't set these values or they
are the same as last time. We don't support the scenario where an
application is linked against multiple versions of libcrypto but using a
shared fips.so file. This would result in different up-calls for different
calls to OSSL_provider_init(), which we currently can't handle.

Reviewed-by: Tomas Mraz <tomas@openssl.org>
Reviewed-by: Paul Dale <pauli@openssl.org>
(Merged from https://github.com/openssl/openssl/pull/14814)
This commit is contained in:
Matt Caswell 2021-04-12 15:22:56 +01:00
parent 6ce58488bd
commit 7b9f02798f
3 changed files with 57 additions and 60 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
providers/common/provider_seeding.c
View File

@ -18,22 +18,24 @@ static OSSL_FUNC_cleanup_nonce_fn *c_cleanup_nonce = NULL;
int ossl_prov_seeding_from_dispatch(const OSSL_DISPATCH *fns)
{
for (; fns->function_id != 0; fns++) {
/*
* We do not support the scenario of an application linked against
* multiple versions of libcrypto (e.g. one static and one dynamic), but
* sharing a single fips.so. We do a simple sanity check here.
*/
#define set_func(c, f) if (c == NULL) c = f; else if (c != f) return 0;
switch (fns->function_id) {
case OSSL_FUNC_GET_ENTROPY:
if (c_get_entropy == NULL)
c_get_entropy = OSSL_FUNC_get_entropy(fns);
set_func(c_get_entropy, OSSL_FUNC_get_entropy(fns));
break;
case OSSL_FUNC_CLEANUP_ENTROPY:
if (c_cleanup_entropy == NULL)
c_cleanup_entropy = OSSL_FUNC_cleanup_entropy(fns);
set_func(c_cleanup_entropy, OSSL_FUNC_cleanup_entropy(fns));
break;
case OSSL_FUNC_GET_NONCE:
if (c_get_nonce == NULL)
c_get_nonce = OSSL_FUNC_get_nonce(fns);
set_func(c_get_nonce, OSSL_FUNC_get_nonce(fns));
break;
case OSSL_FUNC_CLEANUP_NONCE:
if (c_cleanup_nonce == NULL)
c_cleanup_nonce = OSSL_FUNC_cleanup_nonce(fns);
set_func(c_cleanup_nonce, OSSL_FUNC_cleanup_nonce(fns));
break;
}
}

71
providers/fips/fipsprov.c
View File

@ -542,88 +542,103 @@ int OSSL_provider_init(const OSSL_CORE_HANDLE *handle,
if (!ossl_prov_seeding_from_dispatch(in))
return 0;
for (; in->function_id != 0; in++) {
/*
* We do not support the scenario of an application linked against
* multiple versions of libcrypto (e.g. one static and one dynamic), but
* sharing a single fips.so. We do a simple sanity check here.
*/
#define set_func(c, f) if (c == NULL) c = f; else if (c != f) return 0;
switch (in->function_id) {
case OSSL_FUNC_CORE_GET_LIBCTX:
c_get_libctx = OSSL_FUNC_core_get_libctx(in);
set_func(c_get_libctx, OSSL_FUNC_core_get_libctx(in));
break;
case OSSL_FUNC_CORE_GETTABLE_PARAMS:
c_gettable_params = OSSL_FUNC_core_gettable_params(in);
set_func(c_gettable_params, OSSL_FUNC_core_gettable_params(in));
break;
case OSSL_FUNC_CORE_GET_PARAMS:
c_get_params = OSSL_FUNC_core_get_params(in);
set_func(c_get_params, OSSL_FUNC_core_get_params(in));
break;
case OSSL_FUNC_CORE_THREAD_START:
c_thread_start = OSSL_FUNC_core_thread_start(in);
set_func(c_thread_start, OSSL_FUNC_core_thread_start(in));
break;
case OSSL_FUNC_CORE_NEW_ERROR:
c_new_error = OSSL_FUNC_core_new_error(in);
set_func(c_new_error, OSSL_FUNC_core_new_error(in));
break;
case OSSL_FUNC_CORE_SET_ERROR_DEBUG:
c_set_error_debug = OSSL_FUNC_core_set_error_debug(in);
set_func(c_set_error_debug, OSSL_FUNC_core_set_error_debug(in));
break;
case OSSL_FUNC_CORE_VSET_ERROR:
c_vset_error = OSSL_FUNC_core_vset_error(in);
set_func(c_vset_error, OSSL_FUNC_core_vset_error(in));
break;
case OSSL_FUNC_CORE_SET_ERROR_MARK:
c_set_error_mark = OSSL_FUNC_core_set_error_mark(in);
set_func(c_set_error_mark, OSSL_FUNC_core_set_error_mark(in));
break;
case OSSL_FUNC_CORE_CLEAR_LAST_ERROR_MARK:
c_clear_last_error_mark = OSSL_FUNC_core_clear_last_error_mark(in);
set_func(c_clear_last_error_mark,
OSSL_FUNC_core_clear_last_error_mark(in));
break;
case OSSL_FUNC_CORE_POP_ERROR_TO_MARK:
c_pop_error_to_mark = OSSL_FUNC_core_pop_error_to_mark(in);
set_func(c_pop_error_to_mark, OSSL_FUNC_core_pop_error_to_mark(in));
break;
case OSSL_FUNC_CRYPTO_MALLOC:
c_CRYPTO_malloc = OSSL_FUNC_CRYPTO_malloc(in);
set_func(c_CRYPTO_malloc, OSSL_FUNC_CRYPTO_malloc(in));
break;
case OSSL_FUNC_CRYPTO_ZALLOC:
c_CRYPTO_zalloc = OSSL_FUNC_CRYPTO_zalloc(in);
set_func(c_CRYPTO_zalloc, OSSL_FUNC_CRYPTO_zalloc(in));
break;
case OSSL_FUNC_CRYPTO_FREE:
c_CRYPTO_free = OSSL_FUNC_CRYPTO_free(in);
set_func(c_CRYPTO_free, OSSL_FUNC_CRYPTO_free(in));
break;
case OSSL_FUNC_CRYPTO_CLEAR_FREE:
c_CRYPTO_clear_free = OSSL_FUNC_CRYPTO_clear_free(in);
set_func(c_CRYPTO_clear_free, OSSL_FUNC_CRYPTO_clear_free(in));
break;
case OSSL_FUNC_CRYPTO_REALLOC:
c_CRYPTO_realloc = OSSL_FUNC_CRYPTO_realloc(in);
set_func(c_CRYPTO_realloc, OSSL_FUNC_CRYPTO_realloc(in));
break;
case OSSL_FUNC_CRYPTO_CLEAR_REALLOC:
c_CRYPTO_clear_realloc = OSSL_FUNC_CRYPTO_clear_realloc(in);
set_func(c_CRYPTO_clear_realloc,
OSSL_FUNC_CRYPTO_clear_realloc(in));
break;
case OSSL_FUNC_CRYPTO_SECURE_MALLOC:
c_CRYPTO_secure_malloc = OSSL_FUNC_CRYPTO_secure_malloc(in);
set_func(c_CRYPTO_secure_malloc,
OSSL_FUNC_CRYPTO_secure_malloc(in));
break;
case OSSL_FUNC_CRYPTO_SECURE_ZALLOC:
c_CRYPTO_secure_zalloc = OSSL_FUNC_CRYPTO_secure_zalloc(in);
set_func(c_CRYPTO_secure_zalloc,
OSSL_FUNC_CRYPTO_secure_zalloc(in));
break;
case OSSL_FUNC_CRYPTO_SECURE_FREE:
c_CRYPTO_secure_free = OSSL_FUNC_CRYPTO_secure_free(in);
set_func(c_CRYPTO_secure_free,
OSSL_FUNC_CRYPTO_secure_free(in));
break;
case OSSL_FUNC_CRYPTO_SECURE_CLEAR_FREE:
c_CRYPTO_secure_clear_free = OSSL_FUNC_CRYPTO_secure_clear_free(in);
set_func(c_CRYPTO_secure_clear_free,
OSSL_FUNC_CRYPTO_secure_clear_free(in));
break;
case OSSL_FUNC_CRYPTO_SECURE_ALLOCATED:
c_CRYPTO_secure_allocated = OSSL_FUNC_CRYPTO_secure_allocated(in);
set_func(c_CRYPTO_secure_allocated,
OSSL_FUNC_CRYPTO_secure_allocated(in));
break;
case OSSL_FUNC_BIO_NEW_FILE:
selftest_params.bio_new_file_cb = OSSL_FUNC_BIO_new_file(in);
set_func(selftest_params.bio_new_file_cb,
OSSL_FUNC_BIO_new_file(in));
break;
case OSSL_FUNC_BIO_NEW_MEMBUF:
selftest_params.bio_new_buffer_cb
= OSSL_FUNC_BIO_new_membuf(in);
set_func(selftest_params.bio_new_buffer_cb,
OSSL_FUNC_BIO_new_membuf(in));
break;
case OSSL_FUNC_BIO_READ_EX:
selftest_params.bio_read_ex_cb = OSSL_FUNC_BIO_read_ex(in);
set_func(selftest_params.bio_read_ex_cb,
OSSL_FUNC_BIO_read_ex(in));
break;
case OSSL_FUNC_BIO_FREE:
selftest_params.bio_free_cb = OSSL_FUNC_BIO_free(in);
set_func(selftest_params.bio_free_cb, OSSL_FUNC_BIO_free(in));
break;
case OSSL_FUNC_BIO_VSNPRINTF:
c_BIO_vsnprintf = OSSL_FUNC_BIO_vsnprintf(in);
set_func(c_BIO_vsnprintf, OSSL_FUNC_BIO_vsnprintf(in));
break;
case OSSL_FUNC_SELF_TEST_CB:
c_stcbfn = OSSL_FUNC_self_test_cb(in);
set_func(c_stcbfn, OSSL_FUNC_self_test_cb(in));
break;
default:
/* Just ignore anything we don't understand */

28
providers/legacyprov.c
View File

@ -32,10 +32,6 @@ OSSL_provider_init_fn ossl_legacy_provider_init;
# define OSSL_provider_init ossl_legacy_provider_init
#endif
/* Functions provided by the core */
static OSSL_FUNC_core_gettable_params_fn *c_gettable_params = NULL;
static OSSL_FUNC_core_get_params_fn *c_get_params = NULL;
/* Parameters we provide to the core */
static const OSSL_PARAM legacy_param_types[] = {
OSSL_PARAM_DEFN(OSSL_PROV_PARAM_NAME, OSSL_PARAM_UTF8_PTR, NULL, 0),
@ -179,28 +175,12 @@ int OSSL_provider_init(const OSSL_CORE_HANDLE *handle,
const OSSL_DISPATCH **out,
void **provctx)
{
OSSL_FUNC_core_get_libctx_fn *c_get_libctx = NULL;
OSSL_LIB_CTX *libctx = NULL;
for (; in->function_id != 0; in++) {
switch (in->function_id) {
case OSSL_FUNC_CORE_GETTABLE_PARAMS:
c_gettable_params = OSSL_FUNC_core_gettable_params(in);
break;
case OSSL_FUNC_CORE_GET_PARAMS:
c_get_params = OSSL_FUNC_core_get_params(in);
break;
case OSSL_FUNC_CORE_GET_LIBCTX:
c_get_libctx = OSSL_FUNC_core_get_libctx(in);
break;
/* Just ignore anything we don't understand */
default:
break;
}
}
if (c_get_libctx == NULL)
return 0;
/*
* We do not need to use any up-calls provided by libcrypto, so we ignore
* the "in" dispatch table.
*/
if ((*provctx = ossl_prov_ctx_new()) == NULL
|| (libctx = OSSL_LIB_CTX_new()) == NULL) {