2 * Copyright 2016-2020 The OpenSSL Project Authors. All Rights Reserved.
4 * Licensed under the OpenSSL license (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
17 #include <openssl/crypto.h>
18 #include <openssl/err.h>
19 #include <openssl/store.h>
20 #include "internal/thread_once.h"
21 #include "crypto/store.h"
22 #include "store_local.h"
24 struct ossl_store_ctx_st {
25 const OSSL_STORE_LOADER *loader;
26 OSSL_STORE_LOADER_CTX *loader_ctx;
27 const UI_METHOD *ui_method;
29 OSSL_STORE_post_process_info_fn post_process;
30 void *post_process_data;
33 /* 0 before the first STORE_load(), 1 otherwise */
37 OSSL_STORE_CTX *OSSL_STORE_open(const char *uri, const UI_METHOD *ui_method,
39 OSSL_STORE_post_process_info_fn post_process,
40 void *post_process_data)
42 const OSSL_STORE_LOADER *loader = NULL;
43 OSSL_STORE_LOADER_CTX *loader_ctx = NULL;
44 OSSL_STORE_CTX *ctx = NULL;
45 char scheme_copy[256], *p, *schemes[2];
50 * Put the file scheme first. If the uri does represent an existing file,
51 * possible device name and all, then it should be loaded. Only a failed
52 * attempt at loading a local file should have us try something else.
54 schemes[schemes_n++] = "file";
57 * Now, check if we have something that looks like a scheme, and add it
58 * as a second scheme. However, also check if there's an authority start
59 * (://), because that will invalidate the previous file scheme. Also,
60 * check that this isn't actually the file scheme, as there's no point
61 * going through that one twice!
63 OPENSSL_strlcpy(scheme_copy, uri, sizeof(scheme_copy));
64 if ((p = strchr(scheme_copy, ':')) != NULL) {
66 if (strcasecmp(scheme_copy, "file") != 0) {
67 if (strncmp(p, "//", 2) == 0)
68 schemes_n--; /* Invalidate the file scheme */
69 schemes[schemes_n++] = scheme_copy;
75 /* Try each scheme until we find one that could open the URI */
76 for (i = 0; loader_ctx == NULL && i < schemes_n; i++) {
77 if ((loader = ossl_store_get0_loader_int(schemes[i])) != NULL)
78 loader_ctx = loader->open(loader, uri, ui_method, ui_data);
80 if (loader_ctx == NULL)
83 if ((ctx = OPENSSL_zalloc(sizeof(*ctx))) == NULL) {
84 OSSL_STOREerr(OSSL_STORE_F_OSSL_STORE_OPEN, ERR_R_MALLOC_FAILURE);
89 ctx->loader_ctx = loader_ctx;
90 ctx->ui_method = ui_method;
91 ctx->ui_data = ui_data;
92 ctx->post_process = post_process;
93 ctx->post_process_data = post_process_data;
96 * If the attempt to open with the 'file' scheme loader failed and the
97 * other scheme loader succeeded, the failure to open with the 'file'
98 * scheme loader leaves an error on the error stack. Let's remove it.
105 ERR_clear_last_mark();
106 if (loader_ctx != NULL) {
108 * We ignore a returned error because we will return NULL anyway in
109 * this case, so if something goes wrong when closing, that'll simply
110 * just add another entry on the error stack.
112 (void)loader->close(loader_ctx);
117 int OSSL_STORE_ctrl(OSSL_STORE_CTX *ctx, int cmd, ...)
123 ret = OSSL_STORE_vctrl(ctx, cmd, args);
129 int OSSL_STORE_vctrl(OSSL_STORE_CTX *ctx, int cmd, va_list args)
131 if (ctx->loader->ctrl != NULL)
132 return ctx->loader->ctrl(ctx->loader_ctx, cmd, args);
136 int OSSL_STORE_expect(OSSL_STORE_CTX *ctx, int expected_type)
139 OSSL_STOREerr(OSSL_STORE_F_OSSL_STORE_EXPECT,
140 OSSL_STORE_R_LOADING_STARTED);
144 ctx->expected_type = expected_type;
145 if (ctx->loader->expect != NULL)
146 return ctx->loader->expect(ctx->loader_ctx, expected_type);
150 int OSSL_STORE_find(OSSL_STORE_CTX *ctx, OSSL_STORE_SEARCH *search)
153 OSSL_STOREerr(OSSL_STORE_F_OSSL_STORE_FIND,
154 OSSL_STORE_R_LOADING_STARTED);
157 if (ctx->loader->find == NULL) {
158 OSSL_STOREerr(OSSL_STORE_F_OSSL_STORE_FIND,
159 OSSL_STORE_R_UNSUPPORTED_OPERATION);
163 return ctx->loader->find(ctx->loader_ctx, search);
166 OSSL_STORE_INFO *OSSL_STORE_load(OSSL_STORE_CTX *ctx)
168 OSSL_STORE_INFO *v = NULL;
172 if (OSSL_STORE_eof(ctx))
175 v = ctx->loader->load(ctx->loader_ctx, ctx->ui_method, ctx->ui_data);
177 if (ctx->post_process != NULL && v != NULL) {
178 v = ctx->post_process(v, ctx->post_process_data);
181 * By returning NULL, the callback decides that this object should
188 if (v != NULL && ctx->expected_type != 0) {
189 int returned_type = OSSL_STORE_INFO_get_type(v);
191 if (returned_type != OSSL_STORE_INFO_NAME && returned_type != 0) {
193 * Soft assert here so those who want to harsly weed out faulty
194 * loaders can do so using a debugging version of libcrypto.
196 if (ctx->loader->expect != NULL)
197 assert(ctx->expected_type == returned_type);
199 if (ctx->expected_type != returned_type) {
200 OSSL_STORE_INFO_free(v);
209 int OSSL_STORE_error(OSSL_STORE_CTX *ctx)
211 return ctx->loader->error(ctx->loader_ctx);
214 int OSSL_STORE_eof(OSSL_STORE_CTX *ctx)
216 return ctx->loader->eof(ctx->loader_ctx);
219 int OSSL_STORE_close(OSSL_STORE_CTX *ctx)
225 loader_ret = ctx->loader->close(ctx->loader_ctx);
232 * Functions to generate OSSL_STORE_INFOs, one function for each type we
233 * support having in them as well as a generic constructor.
235 * In all cases, ownership of the object is transferred to the OSSL_STORE_INFO
236 * and will therefore be freed when the OSSL_STORE_INFO is freed.
238 static OSSL_STORE_INFO *store_info_new(int type, void *data)
240 OSSL_STORE_INFO *info = OPENSSL_zalloc(sizeof(*info));
250 OSSL_STORE_INFO *OSSL_STORE_INFO_new_NAME(char *name)
252 OSSL_STORE_INFO *info = store_info_new(OSSL_STORE_INFO_NAME, NULL);
255 OSSL_STOREerr(OSSL_STORE_F_OSSL_STORE_INFO_NEW_NAME,
256 ERR_R_MALLOC_FAILURE);
260 info->_.name.name = name;
261 info->_.name.desc = NULL;
266 int OSSL_STORE_INFO_set0_NAME_description(OSSL_STORE_INFO *info, char *desc)
268 if (info->type != OSSL_STORE_INFO_NAME) {
269 OSSL_STOREerr(OSSL_STORE_F_OSSL_STORE_INFO_SET0_NAME_DESCRIPTION,
270 ERR_R_PASSED_INVALID_ARGUMENT);
274 info->_.name.desc = desc;
278 OSSL_STORE_INFO *OSSL_STORE_INFO_new_PARAMS(EVP_PKEY *params)
280 OSSL_STORE_INFO *info = store_info_new(OSSL_STORE_INFO_PARAMS, params);
283 OSSL_STOREerr(OSSL_STORE_F_OSSL_STORE_INFO_NEW_PARAMS,
284 ERR_R_MALLOC_FAILURE);
288 OSSL_STORE_INFO *OSSL_STORE_INFO_new_PKEY(EVP_PKEY *pkey)
290 OSSL_STORE_INFO *info = store_info_new(OSSL_STORE_INFO_PKEY, pkey);
293 OSSL_STOREerr(OSSL_STORE_F_OSSL_STORE_INFO_NEW_PKEY,
294 ERR_R_MALLOC_FAILURE);
298 OSSL_STORE_INFO *OSSL_STORE_INFO_new_CERT(X509 *x509)
300 OSSL_STORE_INFO *info = store_info_new(OSSL_STORE_INFO_CERT, x509);
303 OSSL_STOREerr(OSSL_STORE_F_OSSL_STORE_INFO_NEW_CERT,
304 ERR_R_MALLOC_FAILURE);
308 OSSL_STORE_INFO *OSSL_STORE_INFO_new_CRL(X509_CRL *crl)
310 OSSL_STORE_INFO *info = store_info_new(OSSL_STORE_INFO_CRL, crl);
313 OSSL_STOREerr(OSSL_STORE_F_OSSL_STORE_INFO_NEW_CRL,
314 ERR_R_MALLOC_FAILURE);
319 * Functions to try to extract data from a OSSL_STORE_INFO.
321 int OSSL_STORE_INFO_get_type(const OSSL_STORE_INFO *info)
326 const char *OSSL_STORE_INFO_get0_NAME(const OSSL_STORE_INFO *info)
328 if (info->type == OSSL_STORE_INFO_NAME)
329 return info->_.name.name;
333 char *OSSL_STORE_INFO_get1_NAME(const OSSL_STORE_INFO *info)
335 if (info->type == OSSL_STORE_INFO_NAME) {
336 char *ret = OPENSSL_strdup(info->_.name.name);
339 OSSL_STOREerr(OSSL_STORE_F_OSSL_STORE_INFO_GET1_NAME,
340 ERR_R_MALLOC_FAILURE);
343 OSSL_STOREerr(OSSL_STORE_F_OSSL_STORE_INFO_GET1_NAME,
344 OSSL_STORE_R_NOT_A_NAME);
348 const char *OSSL_STORE_INFO_get0_NAME_description(const OSSL_STORE_INFO *info)
350 if (info->type == OSSL_STORE_INFO_NAME)
351 return info->_.name.desc;
355 char *OSSL_STORE_INFO_get1_NAME_description(const OSSL_STORE_INFO *info)
357 if (info->type == OSSL_STORE_INFO_NAME) {
358 char *ret = OPENSSL_strdup(info->_.name.desc
359 ? info->_.name.desc : "");
362 OSSL_STOREerr(OSSL_STORE_F_OSSL_STORE_INFO_GET1_NAME_DESCRIPTION,
363 ERR_R_MALLOC_FAILURE);
366 OSSL_STOREerr(OSSL_STORE_F_OSSL_STORE_INFO_GET1_NAME_DESCRIPTION,
367 OSSL_STORE_R_NOT_A_NAME);
371 EVP_PKEY *OSSL_STORE_INFO_get0_PARAMS(const OSSL_STORE_INFO *info)
373 if (info->type == OSSL_STORE_INFO_PARAMS)
374 return info->_.params;
378 EVP_PKEY *OSSL_STORE_INFO_get1_PARAMS(const OSSL_STORE_INFO *info)
380 if (info->type == OSSL_STORE_INFO_PARAMS) {
381 EVP_PKEY_up_ref(info->_.params);
382 return info->_.params;
384 OSSL_STOREerr(OSSL_STORE_F_OSSL_STORE_INFO_GET1_PARAMS,
385 OSSL_STORE_R_NOT_PARAMETERS);
389 EVP_PKEY *OSSL_STORE_INFO_get0_PKEY(const OSSL_STORE_INFO *info)
391 if (info->type == OSSL_STORE_INFO_PKEY)
396 EVP_PKEY *OSSL_STORE_INFO_get1_PKEY(const OSSL_STORE_INFO *info)
398 if (info->type == OSSL_STORE_INFO_PKEY) {
399 EVP_PKEY_up_ref(info->_.pkey);
402 OSSL_STOREerr(OSSL_STORE_F_OSSL_STORE_INFO_GET1_PKEY,
403 OSSL_STORE_R_NOT_A_KEY);
407 X509 *OSSL_STORE_INFO_get0_CERT(const OSSL_STORE_INFO *info)
409 if (info->type == OSSL_STORE_INFO_CERT)
414 X509 *OSSL_STORE_INFO_get1_CERT(const OSSL_STORE_INFO *info)
416 if (info->type == OSSL_STORE_INFO_CERT) {
417 X509_up_ref(info->_.x509);
420 OSSL_STOREerr(OSSL_STORE_F_OSSL_STORE_INFO_GET1_CERT,
421 OSSL_STORE_R_NOT_A_CERTIFICATE);
425 X509_CRL *OSSL_STORE_INFO_get0_CRL(const OSSL_STORE_INFO *info)
427 if (info->type == OSSL_STORE_INFO_CRL)
432 X509_CRL *OSSL_STORE_INFO_get1_CRL(const OSSL_STORE_INFO *info)
434 if (info->type == OSSL_STORE_INFO_CRL) {
435 X509_CRL_up_ref(info->_.crl);
438 OSSL_STOREerr(OSSL_STORE_F_OSSL_STORE_INFO_GET1_CRL,
439 OSSL_STORE_R_NOT_A_CRL);
444 * Free the OSSL_STORE_INFO
446 void OSSL_STORE_INFO_free(OSSL_STORE_INFO *info)
449 switch (info->type) {
450 case OSSL_STORE_INFO_EMBEDDED:
451 BUF_MEM_free(info->_.embedded.blob);
452 OPENSSL_free(info->_.embedded.pem_name);
454 case OSSL_STORE_INFO_NAME:
455 OPENSSL_free(info->_.name.name);
456 OPENSSL_free(info->_.name.desc);
458 case OSSL_STORE_INFO_PARAMS:
459 EVP_PKEY_free(info->_.params);
461 case OSSL_STORE_INFO_PKEY:
462 EVP_PKEY_free(info->_.pkey);
464 case OSSL_STORE_INFO_CERT:
465 X509_free(info->_.x509);
467 case OSSL_STORE_INFO_CRL:
468 X509_CRL_free(info->_.crl);
475 int OSSL_STORE_supports_search(OSSL_STORE_CTX *ctx, int search_type)
477 OSSL_STORE_SEARCH tmp_search;
479 if (ctx->loader->find == NULL)
481 tmp_search.search_type = search_type;
482 return ctx->loader->find(NULL, &tmp_search);
485 /* Search term constructors */
486 OSSL_STORE_SEARCH *OSSL_STORE_SEARCH_by_name(X509_NAME *name)
488 OSSL_STORE_SEARCH *search = OPENSSL_zalloc(sizeof(*search));
490 if (search == NULL) {
491 OSSL_STOREerr(OSSL_STORE_F_OSSL_STORE_SEARCH_BY_NAME,
492 ERR_R_MALLOC_FAILURE);
496 search->search_type = OSSL_STORE_SEARCH_BY_NAME;
501 OSSL_STORE_SEARCH *OSSL_STORE_SEARCH_by_issuer_serial(X509_NAME *name,
502 const ASN1_INTEGER *serial)
504 OSSL_STORE_SEARCH *search = OPENSSL_zalloc(sizeof(*search));
506 if (search == NULL) {
507 OSSL_STOREerr(OSSL_STORE_F_OSSL_STORE_SEARCH_BY_ISSUER_SERIAL,
508 ERR_R_MALLOC_FAILURE);
512 search->search_type = OSSL_STORE_SEARCH_BY_ISSUER_SERIAL;
514 search->serial = serial;
518 OSSL_STORE_SEARCH *OSSL_STORE_SEARCH_by_key_fingerprint(const EVP_MD *digest,
522 OSSL_STORE_SEARCH *search = OPENSSL_zalloc(sizeof(*search));
524 if (search == NULL) {
525 OSSL_STOREerr(OSSL_STORE_F_OSSL_STORE_SEARCH_BY_KEY_FINGERPRINT,
526 ERR_R_MALLOC_FAILURE);
530 if (digest != NULL && len != (size_t)EVP_MD_size(digest)) {
531 char buf1[20], buf2[20];
533 BIO_snprintf(buf1, sizeof(buf1), "%d", EVP_MD_size(digest));
534 BIO_snprintf(buf2, sizeof(buf2), "%zu", len);
535 OSSL_STOREerr(OSSL_STORE_F_OSSL_STORE_SEARCH_BY_KEY_FINGERPRINT,
536 OSSL_STORE_R_FINGERPRINT_SIZE_DOES_NOT_MATCH_DIGEST);
537 ERR_add_error_data(5, EVP_MD_name(digest), " size is ", buf1,
538 ", fingerprint size is ", buf2);
541 search->search_type = OSSL_STORE_SEARCH_BY_KEY_FINGERPRINT;
542 search->digest = digest;
543 search->string = bytes;
544 search->stringlength = len;
548 OSSL_STORE_SEARCH *OSSL_STORE_SEARCH_by_alias(const char *alias)
550 OSSL_STORE_SEARCH *search = OPENSSL_zalloc(sizeof(*search));
552 if (search == NULL) {
553 OSSL_STOREerr(OSSL_STORE_F_OSSL_STORE_SEARCH_BY_ALIAS,
554 ERR_R_MALLOC_FAILURE);
558 search->search_type = OSSL_STORE_SEARCH_BY_ALIAS;
559 search->string = (const unsigned char *)alias;
560 search->stringlength = strlen(alias);
564 /* Search term destructor */
565 void OSSL_STORE_SEARCH_free(OSSL_STORE_SEARCH *search)
567 OPENSSL_free(search);
570 /* Search term accessors */
571 int OSSL_STORE_SEARCH_get_type(const OSSL_STORE_SEARCH *criterion)
573 return criterion->search_type;
576 X509_NAME *OSSL_STORE_SEARCH_get0_name(OSSL_STORE_SEARCH *criterion)
578 return criterion->name;
581 const ASN1_INTEGER *OSSL_STORE_SEARCH_get0_serial(const OSSL_STORE_SEARCH
584 return criterion->serial;
587 const unsigned char *OSSL_STORE_SEARCH_get0_bytes(const OSSL_STORE_SEARCH
588 *criterion, size_t *length)
590 *length = criterion->stringlength;
591 return criterion->string;
594 const char *OSSL_STORE_SEARCH_get0_string(const OSSL_STORE_SEARCH *criterion)
596 return (const char *)criterion->string;
599 const EVP_MD *OSSL_STORE_SEARCH_get0_digest(const OSSL_STORE_SEARCH *criterion)
601 return criterion->digest;
604 /* Internal functions */
605 OSSL_STORE_INFO *ossl_store_info_new_EMBEDDED(const char *new_pem_name,
608 OSSL_STORE_INFO *info = store_info_new(OSSL_STORE_INFO_EMBEDDED, NULL);
611 OSSL_STOREerr(OSSL_STORE_F_OSSL_STORE_INFO_NEW_EMBEDDED,
612 ERR_R_MALLOC_FAILURE);
616 info->_.embedded.blob = embedded;
617 info->_.embedded.pem_name =
618 new_pem_name == NULL ? NULL : OPENSSL_strdup(new_pem_name);
620 if (new_pem_name != NULL && info->_.embedded.pem_name == NULL) {
621 OSSL_STOREerr(OSSL_STORE_F_OSSL_STORE_INFO_NEW_EMBEDDED,
622 ERR_R_MALLOC_FAILURE);
623 OSSL_STORE_INFO_free(info);
630 BUF_MEM *ossl_store_info_get0_EMBEDDED_buffer(OSSL_STORE_INFO *info)
632 if (info->type == OSSL_STORE_INFO_EMBEDDED)
633 return info->_.embedded.blob;
637 char *ossl_store_info_get0_EMBEDDED_pem_name(OSSL_STORE_INFO *info)
639 if (info->type == OSSL_STORE_INFO_EMBEDDED)
640 return info->_.embedded.pem_name;
644 OSSL_STORE_CTX *ossl_store_attach_pem_bio(BIO *bp, const UI_METHOD *ui_method,
647 OSSL_STORE_CTX *ctx = NULL;
648 const OSSL_STORE_LOADER *loader = NULL;
649 OSSL_STORE_LOADER_CTX *loader_ctx = NULL;
651 if ((loader = ossl_store_get0_loader_int("file")) == NULL
652 || ((loader_ctx = ossl_store_file_attach_pem_bio_int(bp)) == NULL))
654 if ((ctx = OPENSSL_zalloc(sizeof(*ctx))) == NULL) {
655 OSSL_STOREerr(OSSL_STORE_F_OSSL_STORE_ATTACH_PEM_BIO,
656 ERR_R_MALLOC_FAILURE);
660 ctx->loader = loader;
661 ctx->loader_ctx = loader_ctx;
663 ctx->ui_method = ui_method;
664 ctx->ui_data = ui_data;
665 ctx->post_process = NULL;
666 ctx->post_process_data = NULL;
669 if (loader_ctx != NULL)
671 * We ignore a returned error because we will return NULL anyway in
672 * this case, so if something goes wrong when closing, that'll simply
673 * just add another entry on the error stack.
675 (void)loader->close(loader_ctx);
679 int ossl_store_detach_pem_bio(OSSL_STORE_CTX *ctx)
681 int loader_ret = ossl_store_file_detach_pem_bio_int(ctx->loader_ctx);