From 6592ab81d21fc01e05a01cd5b96c84b069bf8acf Mon Sep 17 00:00:00 2001 From: Richard Levitte Date: Tue, 18 Jun 2019 11:39:13 +0200 Subject: [PATCH] FIPS module: adapt for the changed error reporting methods The FIPS module inner provider doesn't need to deal with error reason strings or error library number, since it uses the outer provider's error reporting upcalls. We therefore disable that code in crypto/provider_core.c when building the FIPS module. Reviewed-by: Matt Caswell (Merged from https://github.com/openssl/openssl/pull/9174) --- crypto/provider_core.c | 27 ++++++++++++++++++++++++++- providers/fips/fipsprov.c | 11 +++++------ 2 files changed, 31 insertions(+), 7 deletions(-) diff --git a/crypto/provider_core.c b/crypto/provider_core.c index 7b15f58c0a..58604487bd 100644 --- a/crypto/provider_core.c +++ b/crypto/provider_core.c @@ -49,9 +49,15 @@ struct ossl_provider_st { STACK_OF(INFOPAIR) *parameters; OPENSSL_CTX *libctx; /* The library context this instance is in */ struct provider_store_st *store; /* The store this instance belongs to */ +#ifndef FIPS_MODE + /* + * In the FIPS module inner provider, this isn't needed, since the + * error upcalls are always direct calls to the outer provider. + */ int error_lib; /* ERR library number, one for each provider */ -#ifndef OPENSSL_NO_ERR +# ifndef OPENSSL_NO_ERR ERR_STRING_DATA *error_strings; /* Copy of what the provider gives us */ +# endif #endif /* Provider side functions */ @@ -127,7 +133,9 @@ static void *provider_store_new(OPENSSL_CTX *ctx) } prov->libctx = ctx; prov->store = store; +#ifndef FIPS_MODE prov->error_lib = ERR_get_next_error_library(); +#endif if(p->is_fallback) ossl_provider_set_fallback(prov); } @@ -238,7 +246,9 @@ OSSL_PROVIDER *ossl_provider_new(OPENSSL_CTX *libctx, const char *name, } else { prov->libctx = libctx; prov->store = store; +#ifndef FIPS_MODE prov->error_lib = ERR_get_next_error_library(); +#endif } CRYPTO_THREAD_unlock(store->lock); @@ -368,7 +378,9 @@ static int provider_activate(OSSL_PROVIDER *prov) { const OSSL_DISPATCH *provider_dispatch = NULL; #ifndef OPENSSL_NO_ERR +# ifndef FIPS_MODE OSSL_provider_get_reason_strings_fn *p_get_reason_strings = NULL; +# endif #endif if (prov->flag_initialized) @@ -454,15 +466,18 @@ static int provider_activate(OSSL_PROVIDER *prov) OSSL_get_provider_query_operation(provider_dispatch); break; #ifndef OPENSSL_NO_ERR +# ifndef FIPS_MODE case OSSL_FUNC_PROVIDER_GET_REASON_STRINGS: p_get_reason_strings = OSSL_get_provider_get_reason_strings(provider_dispatch); break; +# endif #endif } } #ifndef OPENSSL_NO_ERR +# ifndef FIPS_MODE if (p_get_reason_strings != NULL) { const OSSL_ITEM *reasonstrings = p_get_reason_strings(prov->provctx); size_t cnt, cnt2; @@ -503,6 +518,7 @@ static int provider_activate(OSSL_PROVIDER *prov) ERR_load_strings(prov->error_lib, prov->error_strings); } +# endif #endif /* With this flag set, this provider has become fully "loaded". */ @@ -742,6 +758,12 @@ static int core_thread_start(const OSSL_PROVIDER *prov, return ossl_init_thread_start(prov, prov->provctx, handfn); } +/* + * The FIPS module inner provider doesn't implement these. They aren't + * needed there, since the FIPS module upcalls are always the outer provider + * ones. + */ +#ifndef FIPS_MODE static void core_put_error(const OSSL_PROVIDER *prov, uint32_t reason, const char *file, int line) { @@ -772,14 +794,17 @@ static void core_add_error_vdata(const OSSL_PROVIDER *prov, { ERR_add_error_vdata(num, args); } +#endif static const OSSL_DISPATCH core_dispatch_[] = { { OSSL_FUNC_CORE_GET_PARAM_TYPES, (void (*)(void))core_get_param_types }, { OSSL_FUNC_CORE_GET_PARAMS, (void (*)(void))core_get_params }, { OSSL_FUNC_CORE_GET_LIBRARY_CONTEXT, (void (*)(void))core_get_libctx }, { OSSL_FUNC_CORE_THREAD_START, (void (*)(void))core_thread_start }, +#ifndef FIPS_MODE { OSSL_FUNC_CORE_PUT_ERROR, (void (*)(void))core_put_error }, { OSSL_FUNC_CORE_ADD_ERROR_VDATA, (void (*)(void))core_add_error_vdata }, +#endif { 0, NULL } }; static const OSSL_DISPATCH *core_dispatch = core_dispatch_; diff --git a/providers/fips/fipsprov.c b/providers/fips/fipsprov.c index b0196f01d6..eb2a0c45c3 100644 --- a/providers/fips/fipsprov.c +++ b/providers/fips/fipsprov.c @@ -378,12 +378,11 @@ int fips_intern_provider_init(const OSSL_PROVIDER *provider, void ERR_put_error(int lib, int func, int reason, const char *file, int line) { /* - * TODO(3.0): This works for the FIPS module because we're going to be - * using lib/func/reason codes that libcrypto already knows about. This - * won't work for third party providers that have their own error mechanisms, - * so we'll need to come up with something else for them. + * TODO(3.0) the first argument is currently NULL but is expected to + * be passed something else in the future, either an OSSL_PROVIDER or + * a OPENSSL_CTX pointer. */ - c_put_error(lib, func, reason, file, line); + c_put_error(NULL, ERR_PACK(lib, func, reason), file, line); ERR_add_error_data(1, "(in the FIPS module)"); } @@ -398,7 +397,7 @@ void ERR_add_error_data(int num, ...) void ERR_add_error_vdata(int num, va_list args) { - c_add_error_vdata(num, args); + c_add_error_vdata(NULL, num, args); } const OSSL_PROVIDER *FIPS_get_provider(OPENSSL_CTX *ctx) -- 2.25.1