aboutsummaryrefslogtreecommitdiffstats
path: root/crypto/provider.c
Commit message (Collapse)AuthorAgeFilesLines
* Correctly activate the provider in OSSL_PROVIDER_try_loadMatt Caswell2021-11-121-0/+6
| | | | | | | | | If during OSSL_PROVIDER_try_load() we attempt to load a provider, but adding to the store gives back a different provider, then we need to ensure this different provider has its activation count increased. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16980)
* Don't attempt to deactive child providers if we don't need toMatt Caswell2021-11-121-2/+2
| | | | | | | | | If a provider doesn't have any child providers then there is no need to attempt to remove them - so we should not do so. This removes some potentialy thread races. Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/16980)
* Fix a race in ossl_provider_add_to_store()Matt Caswell2021-06-241-3/+4
| | | | | | | | | | | | | | If two threads both attempt to load the same provider at the same time, they will first both check to see if the provider already exists. If it doesn't then they will both then create new provider objects and call the init function. However only one of the threads will be successful in adding the provider to the store. For the "losing" thread we should still return "success", but we should deinitialise and free the no longer required provider object, and return the object that exists in the store. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15854)
* Move OPENSSL_add_builtin back into provider.cMatt Caswell2021-06-241-0/+25
| | | | | | | | | | | An earlier stage of the refactor in the last few commits moved this function out of provider.c because it needed access to the provider structure internals. The final version however no longer needs this so it is moved back again. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15854)
* Merge ossl_provider_activate() and ossl_provider_activate_child()Matt Caswell2021-06-241-1/+1
| | | | | | | | | These 2 functions have become so close to each other that they may as well be just one function. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15854)
* Set use_fallbacks to zero when we add a provider to the storeMatt Caswell2021-06-241-2/+2
| | | | | | | | | | Update use_fallbacks to zero when we add a provider to the store rather than when we activate it. Its only at the point that we add it to the store that it is actually usable and visible to other threads. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15854)
* Add a new provider to the store only after we activate itMatt Caswell2021-06-241-3/+12
| | | | | | | | | | | Rather than creating the provider, adding to the store and then activating it, we do things the other way around, i.e. activate first and then add to the store. This means that the activation should occur before other threads are aware of the provider. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15854)
* Instantiate user-added builtin providers when we need themMatt Caswell2021-06-241-23/+0
| | | | | | | | | | Previously we created the provider object for builtin providers at the point that OPENSSL_add_builtin() was called. Instead we delay that until the provider is actually loaded. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15854)
* Instantiate predefined providers just-in-timeMatt Caswell2021-06-241-12/+0
| | | | | | | | | | Previously we instantiated all the predefined providers at the point that we create the provider store. Instead we move them to be instantiated as we need them. Reviewed-by: Paul Dale <pauli@openssl.org> Reviewed-by: Tomas Mraz <tomas@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15854)
* Rename also the OSSL_PROVIDER_name() functionTomas Mraz2021-06-011-1/+1
| | | | | Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/15405)
* Add support for child provider to up_ref/free their parentMatt Caswell2021-05-111-1/+1
| | | | | | | | If the ref counts on a child provider change, then this needs to be reflected in the parent so we add callbacks to do this. Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14991)
* Add the concept of a child OSSL_LIB_CTXMatt Caswell2021-05-111-0/+5
| | | | | | | | | | | | Add a child OSSL_LIB_CTX that will mirror the providers loaded into the parent libctx. This is useful for providers that want to use algorithms from other providers and just need to inherit the providers used by the application. Fixes #14925 Reviewed-by: Paul Dale <pauli@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14991)
* rename ossl_provider_forall_loaded to ossl_provider_doall_activatedPauli2021-03-121-1/+1
| | | | | Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/14489)
* Update copyright yearMatt Caswell2021-03-111-1/+1
| | | | | Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/14512)
* provider: add an unquery function to allow providers to clean up.Pauli2021-02-241-0/+7
| | | | | | | | | | | Without this, a provider has no way to know that an application has finished with the array it returned earlier. A non-caching provider requires this information. Fixes #12974 Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/12974)
* provider: add option to load a provider without disabling the fallbacks.Pauli2021-02-231-3/+4
| | | | | | | | | | Add an argument to PROVIDER_try_load() that permits a provider to be loaded without changing the fallback status. This is useful when an additional provider needs to be loaded without perturbing any other setup. E.g. adding mock providers as part of unit testing. Reviewed-by: Tim Hudson <tjh@openssl.org> (Merged from https://github.com/openssl/openssl/pull/13652)
* CORE: Separate OSSL_PROVIDER activation from OSSL_PROVIDER referenceRichard Levitte2020-12-171-0/+2
| | | | | | | | | | | | | | | | | | | | This introduces a separate activation counter, and the function ossl_provider_deactivate() for provider deactivation. Something to be noted is that if the reference count goes down to zero, we don't care if the activation count is non-zero (i.e. someone forgot to call ossl_provider_deactivate()). Since there are no more references to the provider, it doesn't matter. The important thing is that deactivation doesn't remove the provider as long as there are references to it, for example because there are live methods associated with that provider, but still makes the provider unavailable to create new methods from. Fixes #13503 Fixes #12157 Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/13661)
* Convert all {NAME}err() in crypto/ to their corresponding ERR_raise() callRichard Levitte2020-11-131-2/+1
| | | | | | | | | | This includes error reporting for libcrypto sub-libraries in surprising places. This was done using util/err-to-raise Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/13318)
* Rename OPENSSL_CTX prefix to OSSL_LIB_CTXDr. Matthias St. Pierre2020-10-151-5/+5
| | | | | | | | | | | | Many of the new types introduced by OpenSSL 3.0 have an OSSL_ prefix, e.g., OSSL_CALLBACK, OSSL_PARAM, OSSL_ALGORITHM, OSSL_SERIALIZER. The OPENSSL_CTX type stands out a little by using a different prefix. For consistency reasons, this type is renamed to OSSL_LIB_CTX. Reviewed-by: Paul Dale <paul.dale@oracle.com> Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/12621)
* provider: disable fall-backs if OSSL_PROVIDER_load() fails.Pauli2020-08-141-1/+9
| | | | | | | | | | | | | If an attempt is made to load a provider and it fails, the fall-back mechanism should be disabled to prevent the user getting some weird happening. E.g. a failure to load the FIPS provider should not allow the default to load as a fall-back. The OSSL_PROVIDER_try_load() call has been added, to allow a provider to be loaded without disabling the fall-back mechanism if it fails. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12625)
* Add 'on demand self test' and status test to providersShane Lontis2020-08-091-0/+6
| | | | | | | | | | | | | | | The default and legacy providers currently return 1 for status and self test checks. Added test to show the 3 different stages the self test can be run (for installation, loading and on demand). For the fips provider: - If the on demand self test fails, then any subsequent fetches should also fail. To implement this the cached algorithms are flushed on failure. - getting the self test callback in the fips provider is a bit complicated since the callback hangs off the core libctx (as it is set by the application) not the actual fips library context. Also the callback can be set at any time not just during the OSSL_provider_init() so it is calculated each time before doing any self test. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11752)
* Add the OSSL_PROVIDER_get_capabilities() API functionMatt Caswell2020-06-191-1/+8
| | | | | | | | Provide a function to applications to query the capabilities that a provider can perform. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11914)
* Implement OSSL_PROVIDER_get0_provider_ctx()Matt Caswell2020-06-051-0/+4
| | | | | | | | Implement a function which enables us to get hold of the provider ctx for a loaded provider. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11834)
* Enable applications to directly call a provider's query operationMatt Caswell2020-06-051-0/+9
| | | | | | | | This is useful to get hold of the low-level dispatch tables. This could be used to create a new provider based on an existing one. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> (Merged from https://github.com/openssl/openssl/pull/11834)
* Update copyright yearMatt Caswell2020-06-041-1/+1
| | | | | Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/12043)
* Add OSSL_PROVIDER_do_all()Richard Levitte2020-05-201-0/+8
| | | | | | | This allows applications to iterate over all loaded providers. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/11858)
* Rename provider and core get_param_types functionsRichard Levitte2019-08-151-2/+2
| | | | | | | | | | | | | | It was argued that names like SOMETHING_set_param_types were confusing, and a rename has been proposed to SOMETHING_settable_params, and by consequence, SOMETHING_get_param_types is renamed SOMETHING_gettable_params. This changes implements this change for the dispatched provider and core functions. Reviewed-by: Shane Lontis <shane.lontis@oracle.com> Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/9591)
* Load the config file by defaultMatt Caswell2019-08-011-4/+4
| | | | | | | | Previously we only loaded the config file by default for libssl. Now we do it for libcrypto too. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9492)
* Add functions to see if a provider is available for use.Richard Levitte2019-07-261-0/+12
| | | | | | | | | | | | | | | Public function OSSL_PROVIDER_available() takes a library context and a provider name, and returns 1 if it's available for use, i.e. if it's possible to fetch implementations from it, otherwise 0. Internal function ossl_provider_activated() returns 1 if the given OSSL_PROVIDER is activated, otherwise 0. To make this possible, the activation of fallbacks got refactored out to a separate function, which ended up simplifying the code. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9398)
* Replace OSSL_ITEM with OSSL_PARAM as parameter descriptor, everywhereRichard Levitte2019-07-231-1/+1
| | | | | Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/9346)
* Add OSSL_PROVIDER_name()Richard Levitte2019-07-231-0/+5
| | | | | Reviewed-by: Paul Dale <paul.dale@oracle.com> (Merged from https://github.com/openssl/openssl/pull/9356)
* Change OSSL_PARAM return size to not be a pointer.Pauli2019-06-241-2/+1
| | | | | | | | Instead of referencing the return size from the OSSL_PARAM structure, make the size a field within the structure. Reviewed-by: Richard Levitte <levitte@openssl.org> (Merged from https://github.com/openssl/openssl/pull/9135)
* Constify OSSL_PROVIDER getter input parametersRichard Levitte2019-05-311-2/+3
| | | | | | | | Some OSSL_PROVIDER getters took a non-const OSSL_PROVIDER parameter. There's no reason to do so. Reviewed-by: Tomas Mraz <tmraz@fedoraproject.org> (Merged from https://github.com/openssl/openssl/pull/9054)
* Replumbing: New public API to load or add providersRichard Levitte2019-03-111-0/+70
Adding a provider means creating an internal provier object and adding it to the store. This allows the addition of built in providers, be it in the OpenSSL libraries or in any application. "Loading" a provider is defined broadly. A built in provider is already "loaded" in essence and only needs activating, while a provider in a dynamically loadable module requires actually loading the module itself. In this API, "loading" a provider does both. Reviewed-by: Matt Caswell <matt@openssl.org> (Merged from https://github.com/openssl/openssl/pull/8287)
generated by cgit v1.2.3 (git 2.39.1) at 2024-09-19 22:06:38 +0000