1 /*
2 * Copyright 2020-2025 The OpenSSL Project Authors. All Rights Reserved.
3 *
4 * Licensed under the Apache License 2.0 (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
8 */
9
10 #include <openssl/core_names.h>
11 #include <openssl/bio.h>
12 #include <openssl/params.h>
13 #include <openssl/provider.h>
14 #include <openssl/evperr.h>
15 #include <openssl/ecerr.h>
16 #include <openssl/pkcs12err.h>
17 #include <openssl/x509err.h>
18 #include <openssl/trace.h>
19 #include "internal/bio.h"
20 #include "internal/provider.h"
21 #include "internal/namemap.h"
22 #include "crypto/decoder.h"
23 #include "encoder_local.h"
24 #include "internal/e_os.h"
25
26 struct decoder_process_data_st {
27 OSSL_DECODER_CTX *ctx;
28
29 /* Current BIO */
30 BIO *bio;
31
32 /* Index of the current decoder instance to be processed */
33 size_t current_decoder_inst_index;
34 /* For tracing, count recursion level */
35 size_t recursion;
36
37 /*-
38 * Flags
39 */
40 unsigned int flag_next_level_called : 1;
41 unsigned int flag_construct_called : 1;
42 unsigned int flag_input_structure_checked : 1;
43 };
44
45 static int decoder_process(const OSSL_PARAM params[], void *arg);
46
OSSL_DECODER_from_bio(OSSL_DECODER_CTX * ctx,BIO * in)47 int OSSL_DECODER_from_bio(OSSL_DECODER_CTX *ctx, BIO *in)
48 {
49 struct decoder_process_data_st data;
50 int ok = 0;
51 BIO *new_bio = NULL;
52 unsigned long lasterr;
53
54 if (in == NULL) {
55 ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_PASSED_NULL_PARAMETER);
56 return 0;
57 }
58
59 if (OSSL_DECODER_CTX_get_num_decoders(ctx) == 0) {
60 ERR_raise_data(ERR_LIB_OSSL_DECODER, OSSL_DECODER_R_DECODER_NOT_FOUND,
61 "No decoders were found. For standard decoders you need "
62 "at least one of the default or base providers "
63 "available. Did you forget to load them?");
64 return 0;
65 }
66
67 lasterr = ERR_peek_last_error();
68
69 if (BIO_tell(in) < 0) {
70 new_bio = BIO_new(BIO_f_readbuffer());
71 if (new_bio == NULL)
72 return 0;
73 in = BIO_push(new_bio, in);
74 }
75 memset(&data, 0, sizeof(data));
76 data.ctx = ctx;
77 data.bio = in;
78
79 /* Enable passphrase caching */
80 (void)ossl_pw_enable_passphrase_caching(&ctx->pwdata);
81
82 ok = decoder_process(NULL, &data);
83
84 if (!data.flag_construct_called) {
85 const char *spaces
86 = ctx->start_input_type != NULL && ctx->input_structure != NULL
87 ? " " : "";
88 const char *input_type_label
89 = ctx->start_input_type != NULL ? "Input type: " : "";
90 const char *input_structure_label
91 = ctx->input_structure != NULL ? "Input structure: " : "";
92 const char *comma
93 = ctx->start_input_type != NULL && ctx->input_structure != NULL
94 ? ", " : "";
95 const char *input_type
96 = ctx->start_input_type != NULL ? ctx->start_input_type : "";
97 const char *input_structure
98 = ctx->input_structure != NULL ? ctx->input_structure : "";
99
100 if (ERR_peek_last_error() == lasterr || ERR_peek_error() == 0)
101 /* Prevent spurious decoding error but add at least something */
102 ERR_raise_data(ERR_LIB_OSSL_DECODER, ERR_R_UNSUPPORTED,
103 "No supported data to decode. %s%s%s%s%s%s",
104 spaces, input_type_label, input_type, comma,
105 input_structure_label, input_structure);
106 ok = 0;
107 }
108
109 /* Clear any internally cached passphrase */
110 (void)ossl_pw_clear_passphrase_cache(&ctx->pwdata);
111
112 if (new_bio != NULL) {
113 BIO_pop(new_bio);
114 BIO_free(new_bio);
115 }
116 return ok;
117 }
118
119 #ifndef OPENSSL_NO_STDIO
bio_from_file(FILE * fp)120 static BIO *bio_from_file(FILE *fp)
121 {
122 BIO *b;
123
124 if ((b = BIO_new(BIO_s_file())) == NULL) {
125 ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_BIO_LIB);
126 return NULL;
127 }
128 BIO_set_fp(b, fp, BIO_NOCLOSE);
129 return b;
130 }
131
OSSL_DECODER_from_fp(OSSL_DECODER_CTX * ctx,FILE * fp)132 int OSSL_DECODER_from_fp(OSSL_DECODER_CTX *ctx, FILE *fp)
133 {
134 BIO *b = bio_from_file(fp);
135 int ret = 0;
136
137 if (b != NULL)
138 ret = OSSL_DECODER_from_bio(ctx, b);
139
140 BIO_free(b);
141 return ret;
142 }
143 #endif
144
OSSL_DECODER_from_data(OSSL_DECODER_CTX * ctx,const unsigned char ** pdata,size_t * pdata_len)145 int OSSL_DECODER_from_data(OSSL_DECODER_CTX *ctx, const unsigned char **pdata,
146 size_t *pdata_len)
147 {
148 BIO *membio;
149 int ret = 0;
150
151 if (pdata == NULL || *pdata == NULL || pdata_len == NULL) {
152 ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_PASSED_NULL_PARAMETER);
153 return 0;
154 }
155
156 membio = BIO_new_mem_buf(*pdata, (int)*pdata_len);
157 if (OSSL_DECODER_from_bio(ctx, membio)) {
158 *pdata_len = (size_t)BIO_get_mem_data(membio, pdata);
159 ret = 1;
160 }
161 BIO_free(membio);
162
163 return ret;
164 }
165
OSSL_DECODER_CTX_set_selection(OSSL_DECODER_CTX * ctx,int selection)166 int OSSL_DECODER_CTX_set_selection(OSSL_DECODER_CTX *ctx, int selection)
167 {
168 if (!ossl_assert(ctx != NULL)) {
169 ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_PASSED_NULL_PARAMETER);
170 return 0;
171 }
172
173 /*
174 * 0 is a valid selection, and means that the caller leaves
175 * it to code to discover what the selection is.
176 */
177 ctx->selection = selection;
178 return 1;
179 }
180
OSSL_DECODER_CTX_set_input_type(OSSL_DECODER_CTX * ctx,const char * input_type)181 int OSSL_DECODER_CTX_set_input_type(OSSL_DECODER_CTX *ctx,
182 const char *input_type)
183 {
184 if (!ossl_assert(ctx != NULL)) {
185 ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_PASSED_NULL_PARAMETER);
186 return 0;
187 }
188
189 /*
190 * NULL is a valid starting input type, and means that the caller leaves
191 * it to code to discover what the starting input type is.
192 */
193 ctx->start_input_type = input_type;
194 return 1;
195 }
196
OSSL_DECODER_CTX_set_input_structure(OSSL_DECODER_CTX * ctx,const char * input_structure)197 int OSSL_DECODER_CTX_set_input_structure(OSSL_DECODER_CTX *ctx,
198 const char *input_structure)
199 {
200 if (!ossl_assert(ctx != NULL)) {
201 ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_PASSED_NULL_PARAMETER);
202 return 0;
203 }
204
205 /*
206 * NULL is a valid starting input structure, and means that the caller
207 * leaves it to code to discover what the starting input structure is.
208 */
209 ctx->input_structure = input_structure;
210 return 1;
211 }
212
213 OSSL_DECODER_INSTANCE *
ossl_decoder_instance_new_forprov(OSSL_DECODER * decoder,void * provctx,const char * input_structure)214 ossl_decoder_instance_new_forprov(OSSL_DECODER *decoder, void *provctx,
215 const char *input_structure)
216 {
217 void *decoderctx;
218
219 if (!ossl_assert(decoder != NULL)) {
220 ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_PASSED_NULL_PARAMETER);
221 return 0;
222 }
223
224 decoderctx = decoder->newctx(provctx);
225 if (decoderctx == NULL)
226 return 0;
227 if (input_structure != NULL && decoder->set_ctx_params != NULL) {
228 OSSL_PARAM params[] = { OSSL_PARAM_END, OSSL_PARAM_END };
229
230 params[0] =
231 OSSL_PARAM_construct_utf8_string(OSSL_OBJECT_PARAM_DATA_STRUCTURE,
232 (char *)input_structure, 0);
233 if (!decoder->set_ctx_params(decoderctx, params)) {
234 decoder->freectx(decoderctx);
235 return 0;
236 }
237 }
238 return ossl_decoder_instance_new(decoder, decoderctx);
239 }
240
ossl_decoder_instance_new(OSSL_DECODER * decoder,void * decoderctx)241 OSSL_DECODER_INSTANCE *ossl_decoder_instance_new(OSSL_DECODER *decoder,
242 void *decoderctx)
243 {
244 OSSL_DECODER_INSTANCE *decoder_inst = NULL;
245 const OSSL_PROVIDER *prov;
246 OSSL_LIB_CTX *libctx;
247 const OSSL_PROPERTY_LIST *props;
248 const OSSL_PROPERTY_DEFINITION *prop;
249
250 if (!ossl_assert(decoder != NULL)) {
251 ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_PASSED_NULL_PARAMETER);
252 return 0;
253 }
254
255 if ((decoder_inst = OPENSSL_zalloc(sizeof(*decoder_inst))) == NULL)
256 return 0;
257
258 prov = OSSL_DECODER_get0_provider(decoder);
259 libctx = ossl_provider_libctx(prov);
260 props = ossl_decoder_parsed_properties(decoder);
261 if (props == NULL) {
262 ERR_raise_data(ERR_LIB_OSSL_DECODER, ERR_R_INVALID_PROPERTY_DEFINITION,
263 "there are no property definitions with decoder %s",
264 OSSL_DECODER_get0_name(decoder));
265 goto err;
266 }
267
268 /* The "input" property is mandatory */
269 prop = ossl_property_find_property(props, libctx, "input");
270 decoder_inst->input_type = ossl_property_get_string_value(libctx, prop);
271 decoder_inst->input_type_id = 0;
272 if (decoder_inst->input_type == NULL) {
273 ERR_raise_data(ERR_LIB_OSSL_DECODER, ERR_R_INVALID_PROPERTY_DEFINITION,
274 "the mandatory 'input' property is missing "
275 "for decoder %s (properties: %s)",
276 OSSL_DECODER_get0_name(decoder),
277 OSSL_DECODER_get0_properties(decoder));
278 goto err;
279 }
280
281 /* The "structure" property is optional */
282 prop = ossl_property_find_property(props, libctx, "structure");
283 if (prop != NULL) {
284 decoder_inst->input_structure
285 = ossl_property_get_string_value(libctx, prop);
286 }
287
288 if (!OSSL_DECODER_up_ref(decoder)) {
289 ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_INTERNAL_ERROR);
290 goto err;
291 }
292 decoder_inst->decoder = decoder;
293 decoder_inst->decoderctx = decoderctx;
294 return decoder_inst;
295 err:
296 ossl_decoder_instance_free(decoder_inst);
297 return NULL;
298 }
299
ossl_decoder_instance_free(OSSL_DECODER_INSTANCE * decoder_inst)300 void ossl_decoder_instance_free(OSSL_DECODER_INSTANCE *decoder_inst)
301 {
302 if (decoder_inst != NULL) {
303 if (decoder_inst->decoder != NULL)
304 decoder_inst->decoder->freectx(decoder_inst->decoderctx);
305 decoder_inst->decoderctx = NULL;
306 OSSL_DECODER_free(decoder_inst->decoder);
307 decoder_inst->decoder = NULL;
308 OPENSSL_free(decoder_inst);
309 }
310 }
311
ossl_decoder_instance_dup(const OSSL_DECODER_INSTANCE * src)312 OSSL_DECODER_INSTANCE *ossl_decoder_instance_dup(const OSSL_DECODER_INSTANCE *src)
313 {
314 OSSL_DECODER_INSTANCE *dest;
315 const OSSL_PROVIDER *prov;
316 void *provctx;
317
318 if ((dest = OPENSSL_zalloc(sizeof(*dest))) == NULL)
319 return NULL;
320
321 *dest = *src;
322 if (!OSSL_DECODER_up_ref(dest->decoder)) {
323 ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_INTERNAL_ERROR);
324 goto err;
325 }
326 prov = OSSL_DECODER_get0_provider(dest->decoder);
327 provctx = OSSL_PROVIDER_get0_provider_ctx(prov);
328
329 dest->decoderctx = dest->decoder->newctx(provctx);
330 if (dest->decoderctx == NULL) {
331 ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_INTERNAL_ERROR);
332 OSSL_DECODER_free(dest->decoder);
333 goto err;
334 }
335
336 return dest;
337
338 err:
339 OPENSSL_free(dest);
340 return NULL;
341 }
342
ossl_decoder_ctx_set_harderr(OSSL_DECODER_CTX * ctx)343 void ossl_decoder_ctx_set_harderr(OSSL_DECODER_CTX *ctx)
344 {
345 ctx->harderr = 1;
346 }
347
ossl_decoder_ctx_get_harderr(const OSSL_DECODER_CTX * ctx)348 int ossl_decoder_ctx_get_harderr(const OSSL_DECODER_CTX *ctx)
349 {
350 return ctx->harderr;
351 }
352
ossl_decoder_ctx_add_decoder_inst(OSSL_DECODER_CTX * ctx,OSSL_DECODER_INSTANCE * di)353 int ossl_decoder_ctx_add_decoder_inst(OSSL_DECODER_CTX *ctx,
354 OSSL_DECODER_INSTANCE *di)
355 {
356 int ok;
357
358 if (ctx->decoder_insts == NULL
359 && (ctx->decoder_insts =
360 sk_OSSL_DECODER_INSTANCE_new_null()) == NULL) {
361 ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_CRYPTO_LIB);
362 return 0;
363 }
364
365 ok = (sk_OSSL_DECODER_INSTANCE_push(ctx->decoder_insts, di) > 0);
366 if (ok) {
367 OSSL_TRACE_BEGIN(DECODER) {
368 BIO_printf(trc_out,
369 "(ctx %p) Added decoder instance %p for decoder %p\n"
370 " %s with %s\n",
371 (void *)ctx, (void *)di, (void *)di->decoder,
372 OSSL_DECODER_get0_name(di->decoder),
373 OSSL_DECODER_get0_properties(di->decoder));
374 } OSSL_TRACE_END(DECODER);
375 }
376 return ok;
377 }
378
OSSL_DECODER_CTX_add_decoder(OSSL_DECODER_CTX * ctx,OSSL_DECODER * decoder)379 int OSSL_DECODER_CTX_add_decoder(OSSL_DECODER_CTX *ctx, OSSL_DECODER *decoder)
380 {
381 OSSL_DECODER_INSTANCE *decoder_inst = NULL;
382 const OSSL_PROVIDER *prov = NULL;
383 void *decoderctx = NULL;
384 void *provctx = NULL;
385
386 if (!ossl_assert(ctx != NULL) || !ossl_assert(decoder != NULL)) {
387 ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_PASSED_NULL_PARAMETER);
388 return 0;
389 }
390
391 prov = OSSL_DECODER_get0_provider(decoder);
392 provctx = OSSL_PROVIDER_get0_provider_ctx(prov);
393
394 if ((decoderctx = decoder->newctx(provctx)) == NULL
395 || (decoder_inst =
396 ossl_decoder_instance_new(decoder, decoderctx)) == NULL)
397 goto err;
398 /* Avoid double free of decoderctx on further errors */
399 decoderctx = NULL;
400
401 if (!ossl_decoder_ctx_add_decoder_inst(ctx, decoder_inst))
402 goto err;
403
404 return 1;
405 err:
406 ossl_decoder_instance_free(decoder_inst);
407 if (decoderctx != NULL)
408 decoder->freectx(decoderctx);
409 return 0;
410 }
411
412 struct collect_extra_decoder_data_st {
413 OSSL_DECODER_CTX *ctx;
414 const char *output_type;
415 int output_type_id;
416
417 /*
418 * 0 to check that the decoder's input type is the same as the decoder name
419 * 1 to check that the decoder's input type differs from the decoder name
420 */
421 enum { IS_SAME = 0, IS_DIFFERENT = 1 } type_check;
422 size_t w_prev_start, w_prev_end; /* "previous" decoders */
423 size_t w_new_start, w_new_end; /* "new" decoders */
424 };
425
DEFINE_STACK_OF(OSSL_DECODER)426 DEFINE_STACK_OF(OSSL_DECODER)
427
428 static void collect_all_decoders(OSSL_DECODER *decoder, void *arg)
429 {
430 STACK_OF(OSSL_DECODER) *skdecoders = arg;
431
432 if (OSSL_DECODER_up_ref(decoder)
433 && !sk_OSSL_DECODER_push(skdecoders, decoder))
434 OSSL_DECODER_free(decoder);
435 }
436
collect_extra_decoder(OSSL_DECODER * decoder,void * arg)437 static void collect_extra_decoder(OSSL_DECODER *decoder, void *arg)
438 {
439 struct collect_extra_decoder_data_st *data = arg;
440 size_t j;
441 const OSSL_PROVIDER *prov = OSSL_DECODER_get0_provider(decoder);
442 void *provctx = OSSL_PROVIDER_get0_provider_ctx(prov);
443
444 if (ossl_decoder_fast_is_a(decoder, data->output_type, &data->output_type_id)) {
445 void *decoderctx = NULL;
446 OSSL_DECODER_INSTANCE *di = NULL;
447
448 OSSL_TRACE_BEGIN(DECODER) {
449 BIO_printf(trc_out,
450 "(ctx %p) [%d] Checking out decoder %p:\n"
451 " %s with %s\n",
452 (void *)data->ctx, data->type_check, (void *)decoder,
453 OSSL_DECODER_get0_name(decoder),
454 OSSL_DECODER_get0_properties(decoder));
455 } OSSL_TRACE_END(DECODER);
456
457 /*
458 * Check that we don't already have this decoder in our stack,
459 * starting with the previous windows but also looking at what
460 * we have added in the current window.
461 */
462 for (j = data->w_prev_start; j < data->w_new_end; j++) {
463 OSSL_DECODER_INSTANCE *check_inst =
464 sk_OSSL_DECODER_INSTANCE_value(data->ctx->decoder_insts, j);
465
466 if (decoder->base.algodef == check_inst->decoder->base.algodef) {
467 /* We found it, so don't do anything more */
468 OSSL_TRACE_BEGIN(DECODER) {
469 BIO_printf(trc_out,
470 " REJECTED: already exists in the chain\n");
471 } OSSL_TRACE_END(DECODER);
472 return;
473 }
474 }
475
476 if ((decoderctx = decoder->newctx(provctx)) == NULL)
477 return;
478
479 if (decoder->set_ctx_params != NULL
480 && data->ctx->input_structure != NULL) {
481 OSSL_PARAM params[] = { OSSL_PARAM_END, OSSL_PARAM_END };
482 const char *str = data->ctx->input_structure;
483
484 params[0] =
485 OSSL_PARAM_construct_utf8_string(OSSL_OBJECT_PARAM_DATA_STRUCTURE,
486 (char *)str, 0);
487 if (!decoder->set_ctx_params(decoderctx, params)) {
488 decoder->freectx(decoderctx);
489 return;
490 }
491 }
492
493 if ((di = ossl_decoder_instance_new(decoder, decoderctx)) == NULL) {
494 decoder->freectx(decoderctx);
495 return;
496 }
497
498 switch (data->type_check) {
499 case IS_SAME:
500 /* If it differs, this is not a decoder to add for now. */
501 if (!ossl_decoder_fast_is_a(decoder,
502 OSSL_DECODER_INSTANCE_get_input_type(di),
503 &di->input_type_id)) {
504 ossl_decoder_instance_free(di);
505 OSSL_TRACE_BEGIN(DECODER) {
506 BIO_printf(trc_out,
507 " REJECTED: input type doesn't match output type\n");
508 } OSSL_TRACE_END(DECODER);
509 return;
510 }
511 break;
512 case IS_DIFFERENT:
513 /* If it's the same, this is not a decoder to add for now. */
514 if (ossl_decoder_fast_is_a(decoder,
515 OSSL_DECODER_INSTANCE_get_input_type(di),
516 &di->input_type_id)) {
517 ossl_decoder_instance_free(di);
518 OSSL_TRACE_BEGIN(DECODER) {
519 BIO_printf(trc_out,
520 " REJECTED: input type matches output type\n");
521 } OSSL_TRACE_END(DECODER);
522 return;
523 }
524 break;
525 }
526
527 /*
528 * Apart from keeping w_new_end up to date, We don't care about
529 * errors here. If it doesn't collect, then it doesn't...
530 */
531 if (!ossl_decoder_ctx_add_decoder_inst(data->ctx, di)) {
532 ossl_decoder_instance_free(di);
533 return;
534 }
535
536 data->w_new_end++;
537 }
538 }
539
decoder_sk_cmp(const OSSL_DECODER_INSTANCE * const * a,const OSSL_DECODER_INSTANCE * const * b)540 static int decoder_sk_cmp(const OSSL_DECODER_INSTANCE *const *a,
541 const OSSL_DECODER_INSTANCE *const *b)
542 {
543 if ((*a)->score == (*b)->score)
544 return (*a)->order - (*b)->order;
545 return (*a)->score - (*b)->score;
546 }
547
OSSL_DECODER_CTX_add_extra(OSSL_DECODER_CTX * ctx,OSSL_LIB_CTX * libctx,const char * propq)548 int OSSL_DECODER_CTX_add_extra(OSSL_DECODER_CTX *ctx,
549 OSSL_LIB_CTX *libctx, const char *propq)
550 {
551 /*
552 * This function goes through existing decoder methods in
553 * |ctx->decoder_insts|, and tries to fetch new decoders that produce
554 * what the existing ones want as input, and push those newly fetched
555 * decoders on top of the same stack.
556 * Then it does the same again, but looping over the newly fetched
557 * decoders, until there are no more decoders to be fetched, or
558 * when we have done this 10 times.
559 *
560 * we do this with sliding windows on the stack by keeping track of indexes
561 * and of the end.
562 *
563 * +----------------+
564 * | DER to RSA | <--- w_prev_start
565 * +----------------+
566 * | DER to DSA |
567 * +----------------+
568 * | DER to DH |
569 * +----------------+
570 * | PEM to DER | <--- w_prev_end, w_new_start
571 * +----------------+
572 * <--- w_new_end
573 */
574 struct collect_extra_decoder_data_st data;
575 size_t depth = 0; /* Counts the number of iterations */
576 size_t count; /* Calculates how many were added in each iteration */
577 size_t numdecoders;
578 STACK_OF(OSSL_DECODER) *skdecoders;
579
580 if (!ossl_assert(ctx != NULL)) {
581 ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_PASSED_NULL_PARAMETER);
582 return 0;
583 }
584
585 /*
586 * If there is no stack of OSSL_DECODER_INSTANCE, we have nothing
587 * more to add. That's fine.
588 */
589 if (ctx->decoder_insts == NULL)
590 return 1;
591
592 OSSL_TRACE_BEGIN(DECODER) {
593 BIO_printf(trc_out, "(ctx %p) Looking for extra decoders\n",
594 (void *)ctx);
595 } OSSL_TRACE_END(DECODER);
596
597
598 skdecoders = sk_OSSL_DECODER_new_null();
599 if (skdecoders == NULL) {
600 ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_CRYPTO_LIB);
601 return 0;
602 }
603 OSSL_DECODER_do_all_provided(libctx, collect_all_decoders, skdecoders);
604 numdecoders = sk_OSSL_DECODER_num(skdecoders);
605
606 /*
607 * If there are provided or default properties, sort the initial decoder list
608 * by property matching score so that the highest scored provider is selected
609 * first.
610 */
611 if (propq != NULL || ossl_ctx_global_properties(libctx, 0) != NULL) {
612 int num_decoder_insts = sk_OSSL_DECODER_INSTANCE_num(ctx->decoder_insts);
613 int i;
614 OSSL_DECODER_INSTANCE *di;
615 sk_OSSL_DECODER_INSTANCE_compfunc old_cmp =
616 sk_OSSL_DECODER_INSTANCE_set_cmp_func(ctx->decoder_insts, decoder_sk_cmp);
617
618 for (i = 0; i < num_decoder_insts; i++) {
619 di = sk_OSSL_DECODER_INSTANCE_value(ctx->decoder_insts, i);
620 di->order = i;
621 }
622 sk_OSSL_DECODER_INSTANCE_sort(ctx->decoder_insts);
623 sk_OSSL_DECODER_INSTANCE_set_cmp_func(ctx->decoder_insts, old_cmp);
624 }
625
626 memset(&data, 0, sizeof(data));
627 data.ctx = ctx;
628 data.w_prev_start = 0;
629 data.w_prev_end = sk_OSSL_DECODER_INSTANCE_num(ctx->decoder_insts);
630 do {
631 size_t i, j;
632
633 data.w_new_start = data.w_new_end = data.w_prev_end;
634
635 /*
636 * Two iterations:
637 * 0. All decoders that have the same name as their input type.
638 * This allows for decoders that unwrap some data in a specific
639 * encoding, and pass the result on with the same encoding.
640 * 1. All decoders that a different name than their input type.
641 */
642 for (data.type_check = IS_SAME;
643 data.type_check <= IS_DIFFERENT;
644 data.type_check++) {
645 for (i = data.w_prev_start; i < data.w_prev_end; i++) {
646 OSSL_DECODER_INSTANCE *decoder_inst =
647 sk_OSSL_DECODER_INSTANCE_value(ctx->decoder_insts, i);
648
649 data.output_type
650 = OSSL_DECODER_INSTANCE_get_input_type(decoder_inst);
651
652 data.output_type_id = 0;
653
654 for (j = 0; j < numdecoders; j++)
655 collect_extra_decoder(sk_OSSL_DECODER_value(skdecoders, j),
656 &data);
657 }
658 }
659 /* How many were added in this iteration */
660 count = data.w_new_end - data.w_new_start;
661
662 /* Slide the "previous decoder" windows */
663 data.w_prev_start = data.w_new_start;
664 data.w_prev_end = data.w_new_end;
665
666 depth++;
667 } while (count != 0 && depth <= 10);
668
669 sk_OSSL_DECODER_pop_free(skdecoders, OSSL_DECODER_free);
670 return 1;
671 }
672
OSSL_DECODER_CTX_get_num_decoders(OSSL_DECODER_CTX * ctx)673 int OSSL_DECODER_CTX_get_num_decoders(OSSL_DECODER_CTX *ctx)
674 {
675 if (ctx == NULL || ctx->decoder_insts == NULL)
676 return 0;
677 return sk_OSSL_DECODER_INSTANCE_num(ctx->decoder_insts);
678 }
679
OSSL_DECODER_CTX_set_construct(OSSL_DECODER_CTX * ctx,OSSL_DECODER_CONSTRUCT * construct)680 int OSSL_DECODER_CTX_set_construct(OSSL_DECODER_CTX *ctx,
681 OSSL_DECODER_CONSTRUCT *construct)
682 {
683 if (!ossl_assert(ctx != NULL)) {
684 ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_PASSED_NULL_PARAMETER);
685 return 0;
686 }
687 ctx->construct = construct;
688 return 1;
689 }
690
OSSL_DECODER_CTX_set_construct_data(OSSL_DECODER_CTX * ctx,void * construct_data)691 int OSSL_DECODER_CTX_set_construct_data(OSSL_DECODER_CTX *ctx,
692 void *construct_data)
693 {
694 if (!ossl_assert(ctx != NULL)) {
695 ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_PASSED_NULL_PARAMETER);
696 return 0;
697 }
698 ctx->construct_data = construct_data;
699 return 1;
700 }
701
OSSL_DECODER_CTX_set_cleanup(OSSL_DECODER_CTX * ctx,OSSL_DECODER_CLEANUP * cleanup)702 int OSSL_DECODER_CTX_set_cleanup(OSSL_DECODER_CTX *ctx,
703 OSSL_DECODER_CLEANUP *cleanup)
704 {
705 if (!ossl_assert(ctx != NULL)) {
706 ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_PASSED_NULL_PARAMETER);
707 return 0;
708 }
709 ctx->cleanup = cleanup;
710 return 1;
711 }
712
713 OSSL_DECODER_CONSTRUCT *
OSSL_DECODER_CTX_get_construct(OSSL_DECODER_CTX * ctx)714 OSSL_DECODER_CTX_get_construct(OSSL_DECODER_CTX *ctx)
715 {
716 if (ctx == NULL)
717 return NULL;
718 return ctx->construct;
719 }
720
OSSL_DECODER_CTX_get_construct_data(OSSL_DECODER_CTX * ctx)721 void *OSSL_DECODER_CTX_get_construct_data(OSSL_DECODER_CTX *ctx)
722 {
723 if (ctx == NULL)
724 return NULL;
725 return ctx->construct_data;
726 }
727
728 OSSL_DECODER_CLEANUP *
OSSL_DECODER_CTX_get_cleanup(OSSL_DECODER_CTX * ctx)729 OSSL_DECODER_CTX_get_cleanup(OSSL_DECODER_CTX *ctx)
730 {
731 if (ctx == NULL)
732 return NULL;
733 return ctx->cleanup;
734 }
735
OSSL_DECODER_export(OSSL_DECODER_INSTANCE * decoder_inst,void * reference,size_t reference_sz,OSSL_CALLBACK * export_cb,void * export_cbarg)736 int OSSL_DECODER_export(OSSL_DECODER_INSTANCE *decoder_inst,
737 void *reference, size_t reference_sz,
738 OSSL_CALLBACK *export_cb, void *export_cbarg)
739 {
740 OSSL_DECODER *decoder = NULL;
741 void *decoderctx = NULL;
742
743 if (!(ossl_assert(decoder_inst != NULL)
744 && ossl_assert(reference != NULL)
745 && ossl_assert(export_cb != NULL)
746 && ossl_assert(export_cbarg != NULL))) {
747 ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_PASSED_NULL_PARAMETER);
748 return 0;
749 }
750
751 decoder = OSSL_DECODER_INSTANCE_get_decoder(decoder_inst);
752 decoderctx = OSSL_DECODER_INSTANCE_get_decoder_ctx(decoder_inst);
753 return decoder->export_object(decoderctx, reference, reference_sz,
754 export_cb, export_cbarg);
755 }
756
757 OSSL_DECODER *
OSSL_DECODER_INSTANCE_get_decoder(OSSL_DECODER_INSTANCE * decoder_inst)758 OSSL_DECODER_INSTANCE_get_decoder(OSSL_DECODER_INSTANCE *decoder_inst)
759 {
760 if (decoder_inst == NULL)
761 return NULL;
762 return decoder_inst->decoder;
763 }
764
765 void *
OSSL_DECODER_INSTANCE_get_decoder_ctx(OSSL_DECODER_INSTANCE * decoder_inst)766 OSSL_DECODER_INSTANCE_get_decoder_ctx(OSSL_DECODER_INSTANCE *decoder_inst)
767 {
768 if (decoder_inst == NULL)
769 return NULL;
770 return decoder_inst->decoderctx;
771 }
772
773 const char *
OSSL_DECODER_INSTANCE_get_input_type(OSSL_DECODER_INSTANCE * decoder_inst)774 OSSL_DECODER_INSTANCE_get_input_type(OSSL_DECODER_INSTANCE *decoder_inst)
775 {
776 if (decoder_inst == NULL)
777 return NULL;
778 return decoder_inst->input_type;
779 }
780
781 const char *
OSSL_DECODER_INSTANCE_get_input_structure(OSSL_DECODER_INSTANCE * decoder_inst,int * was_set)782 OSSL_DECODER_INSTANCE_get_input_structure(OSSL_DECODER_INSTANCE *decoder_inst,
783 int *was_set)
784 {
785 if (decoder_inst == NULL)
786 return NULL;
787 *was_set = decoder_inst->flag_input_structure_was_set;
788 return decoder_inst->input_structure;
789 }
790
decoder_process(const OSSL_PARAM params[],void * arg)791 static int decoder_process(const OSSL_PARAM params[], void *arg)
792 {
793 struct decoder_process_data_st *data = arg;
794 OSSL_DECODER_CTX *ctx = data->ctx;
795 OSSL_DECODER_INSTANCE *decoder_inst = NULL;
796 OSSL_DECODER *decoder = NULL;
797 OSSL_CORE_BIO *cbio = NULL;
798 BIO *bio = data->bio;
799 long loc;
800 size_t i;
801 int ok = 0;
802 /* For recursions */
803 struct decoder_process_data_st new_data;
804 const char *data_type = NULL;
805 const char *data_structure = NULL;
806 /* Saved to restore on return, mutated in PEM->DER transition. */
807 const char *start_input_type = ctx->start_input_type;
808
809 /*
810 * This is an indicator up the call stack that something was indeed
811 * decoded, leading to a recursive call of this function.
812 */
813 data->flag_next_level_called = 1;
814
815 memset(&new_data, 0, sizeof(new_data));
816 new_data.ctx = data->ctx;
817 new_data.recursion = data->recursion + 1;
818
819 #define LEVEL_STR ">>>>>>>>>>>>>>>>"
820 #define LEVEL (new_data.recursion < sizeof(LEVEL_STR) \
821 ? &LEVEL_STR[sizeof(LEVEL_STR) - new_data.recursion - 1] \
822 : LEVEL_STR "...")
823
824 if (params == NULL) {
825 /* First iteration, where we prepare for what is to come */
826
827 OSSL_TRACE_BEGIN(DECODER) {
828 BIO_printf(trc_out,
829 "(ctx %p) starting to walk the decoder chain\n",
830 (void *)new_data.ctx);
831 } OSSL_TRACE_END(DECODER);
832
833 data->current_decoder_inst_index =
834 OSSL_DECODER_CTX_get_num_decoders(ctx);
835
836 bio = data->bio;
837 } else {
838 const OSSL_PARAM *p;
839 const char *trace_data_structure;
840
841 decoder_inst =
842 sk_OSSL_DECODER_INSTANCE_value(ctx->decoder_insts,
843 data->current_decoder_inst_index);
844 decoder = OSSL_DECODER_INSTANCE_get_decoder(decoder_inst);
845
846 data->flag_construct_called = 0;
847 if (ctx->construct != NULL) {
848 int rv;
849
850 OSSL_TRACE_BEGIN(DECODER) {
851 BIO_printf(trc_out,
852 "(ctx %p) %s Running constructor\n",
853 (void *)new_data.ctx, LEVEL);
854 } OSSL_TRACE_END(DECODER);
855
856 rv = ctx->construct(decoder_inst, params, ctx->construct_data);
857
858 OSSL_TRACE_BEGIN(DECODER) {
859 BIO_printf(trc_out,
860 "(ctx %p) %s Running constructor => %d\n",
861 (void *)new_data.ctx, LEVEL, rv);
862 } OSSL_TRACE_END(DECODER);
863
864 ok = (rv > 0);
865 if (ok) {
866 data->flag_construct_called = 1;
867 goto end;
868 }
869 }
870
871 /* The constructor didn't return success */
872
873 /*
874 * so we try to use the object we got and feed it to any next
875 * decoder that will take it. Object references are not
876 * allowed for this.
877 * If this data isn't present, decoding has failed.
878 */
879
880 p = OSSL_PARAM_locate_const(params, OSSL_OBJECT_PARAM_DATA);
881 if (p == NULL || p->data_type != OSSL_PARAM_OCTET_STRING)
882 goto end;
883 new_data.bio = BIO_new_mem_buf(p->data, (int)p->data_size);
884 if (new_data.bio == NULL)
885 goto end;
886 bio = new_data.bio;
887
888 /* Get the data type if there is one */
889 p = OSSL_PARAM_locate_const(params, OSSL_OBJECT_PARAM_DATA_TYPE);
890 if (p != NULL && !OSSL_PARAM_get_utf8_string_ptr(p, &data_type))
891 goto end;
892
893 /* Get the data structure if there is one */
894 p = OSSL_PARAM_locate_const(params, OSSL_OBJECT_PARAM_DATA_STRUCTURE);
895 if (p != NULL && !OSSL_PARAM_get_utf8_string_ptr(p, &data_structure))
896 goto end;
897
898 /* Get the new input type if there is one */
899 p = OSSL_PARAM_locate_const(params, OSSL_OBJECT_PARAM_INPUT_TYPE);
900 if (p != NULL) {
901 if (!OSSL_PARAM_get_utf8_string_ptr(p, &ctx->start_input_type))
902 goto end;
903 /*
904 * When switching PKCS8 from PEM to DER we decrypt the data if needed
905 * and then determine the algorithm OID. Likewise, with SPKI, only
906 * this time sans decryption.
907 */
908 if (ctx->input_structure != NULL
909 && (OPENSSL_strcasecmp(ctx->input_structure, "SubjectPublicKeyInfo") == 0
910 || OPENSSL_strcasecmp(data_structure, "PrivateKeyInfo") == 0
911 || OPENSSL_strcasecmp(ctx->input_structure, "PrivateKeyInfo") == 0))
912 data->flag_input_structure_checked = 1;
913 }
914
915 /*
916 * If the data structure is "type-specific" and the data type is
917 * given, we drop the data structure. The reasoning is that the
918 * data type is already enough to find the applicable next decoder,
919 * so an additional "type-specific" data structure is extraneous.
920 *
921 * Furthermore, if the OSSL_DECODER caller asked for a type specific
922 * structure under another name, such as "DH", we get a mismatch
923 * if the data structure we just received is "type-specific".
924 * There's only so much you can do without infusing this code with
925 * too special knowledge.
926 */
927 trace_data_structure = data_structure;
928 if (data_type != NULL && data_structure != NULL
929 && OPENSSL_strcasecmp(data_structure, "type-specific") == 0)
930 data_structure = NULL;
931
932 OSSL_TRACE_BEGIN(DECODER) {
933 BIO_printf(trc_out,
934 "(ctx %p) %s incoming from previous decoder (%p):\n"
935 " data type: %s, data structure: %s%s\n",
936 (void *)new_data.ctx, LEVEL, (void *)decoder,
937 data_type, trace_data_structure,
938 (trace_data_structure == data_structure
939 ? "" : " (dropped)"));
940 } OSSL_TRACE_END(DECODER);
941 }
942
943 /*
944 * If we have no more decoders to look through at this point,
945 * we failed
946 */
947 if (data->current_decoder_inst_index == 0)
948 goto end;
949
950 if ((loc = BIO_tell(bio)) < 0) {
951 ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_BIO_LIB);
952 goto end;
953 }
954
955 if ((cbio = ossl_core_bio_new_from_bio(bio)) == NULL) {
956 ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_BIO_LIB);
957 goto end;
958 }
959
960 for (i = data->current_decoder_inst_index; i-- > 0;) {
961 OSSL_DECODER_INSTANCE *new_decoder_inst =
962 sk_OSSL_DECODER_INSTANCE_value(ctx->decoder_insts, i);
963 OSSL_DECODER *new_decoder =
964 OSSL_DECODER_INSTANCE_get_decoder(new_decoder_inst);
965 const char *new_decoder_name = NULL;
966 void *new_decoderctx =
967 OSSL_DECODER_INSTANCE_get_decoder_ctx(new_decoder_inst);
968 const char *new_input_type =
969 OSSL_DECODER_INSTANCE_get_input_type(new_decoder_inst);
970 int n_i_s_was_set = 0; /* We don't care here */
971 const char *new_input_structure =
972 OSSL_DECODER_INSTANCE_get_input_structure(new_decoder_inst,
973 &n_i_s_was_set);
974
975 OSSL_TRACE_BEGIN(DECODER) {
976 new_decoder_name = OSSL_DECODER_get0_name(new_decoder);
977 BIO_printf(trc_out,
978 "(ctx %p) %s [%u] Considering decoder instance %p (decoder %p):\n"
979 " %s with %s\n",
980 (void *)new_data.ctx, LEVEL, (unsigned int)i,
981 (void *)new_decoder_inst, (void *)new_decoder,
982 new_decoder_name,
983 OSSL_DECODER_get0_properties(new_decoder));
984 } OSSL_TRACE_END(DECODER);
985
986 /*
987 * If |decoder| is NULL, it means we've just started, and the caller
988 * may have specified what it expects the initial input to be. If
989 * that's the case, we do this extra check.
990 */
991 if (decoder == NULL && ctx->start_input_type != NULL
992 && OPENSSL_strcasecmp(ctx->start_input_type, new_input_type) != 0) {
993 OSSL_TRACE_BEGIN(DECODER) {
994 BIO_printf(trc_out,
995 "(ctx %p) %s [%u] the start input type '%s' doesn't match the input type of the considered decoder, skipping...\n",
996 (void *)new_data.ctx, LEVEL, (unsigned int)i,
997 ctx->start_input_type);
998 } OSSL_TRACE_END(DECODER);
999 continue;
1000 }
1001
1002 /*
1003 * If we have a previous decoder, we check that the input type
1004 * of the next to be used matches the type of this previous one.
1005 * |new_input_type| holds the value of the "input-type" parameter
1006 * for the decoder we're currently considering.
1007 */
1008 if (decoder != NULL && !ossl_decoder_fast_is_a(decoder, new_input_type,
1009 &new_decoder_inst->input_type_id)) {
1010 OSSL_TRACE_BEGIN(DECODER) {
1011 BIO_printf(trc_out,
1012 "(ctx %p) %s [%u] the input type doesn't match the name of the previous decoder (%p), skipping...\n",
1013 (void *)new_data.ctx, LEVEL, (unsigned int)i,
1014 (void *)decoder);
1015 } OSSL_TRACE_END(DECODER);
1016 continue;
1017 }
1018
1019 /*
1020 * If the previous decoder gave us a data type, we check to see
1021 * if that matches the decoder we're currently considering.
1022 */
1023 if (data_type != NULL && !OSSL_DECODER_is_a(new_decoder, data_type)) {
1024 OSSL_TRACE_BEGIN(DECODER) {
1025 BIO_printf(trc_out,
1026 "(ctx %p) %s [%u] the previous decoder's data type doesn't match the name of the considered decoder, skipping...\n",
1027 (void *)new_data.ctx, LEVEL, (unsigned int)i);
1028 } OSSL_TRACE_END(DECODER);
1029 continue;
1030 }
1031
1032 /*
1033 * If the previous decoder gave us a data structure name, we check
1034 * to see that it matches the input data structure of the decoder
1035 * we're currently considering.
1036 */
1037 if (data_structure != NULL
1038 && (new_input_structure == NULL
1039 || OPENSSL_strcasecmp(data_structure,
1040 new_input_structure) != 0)) {
1041 OSSL_TRACE_BEGIN(DECODER) {
1042 BIO_printf(trc_out,
1043 "(ctx %p) %s [%u] the previous decoder's data structure doesn't match the input structure of the considered decoder, skipping...\n",
1044 (void *)new_data.ctx, LEVEL, (unsigned int)i);
1045 } OSSL_TRACE_END(DECODER);
1046 continue;
1047 }
1048
1049 /*
1050 * If the decoder we're currently considering specifies a structure,
1051 * and this check hasn't already been done earlier in this chain of
1052 * decoder_process() calls, check that it matches the user provided
1053 * input structure, if one is given.
1054 */
1055 if (!data->flag_input_structure_checked
1056 && ctx->input_structure != NULL
1057 && new_input_structure != NULL) {
1058 data->flag_input_structure_checked = 1;
1059 if (OPENSSL_strcasecmp(new_input_structure,
1060 ctx->input_structure) != 0) {
1061 OSSL_TRACE_BEGIN(DECODER) {
1062 BIO_printf(trc_out,
1063 "(ctx %p) %s [%u] the previous decoder's data structure doesn't match the input structure given by the user, skipping...\n",
1064 (void *)new_data.ctx, LEVEL, (unsigned int)i);
1065 } OSSL_TRACE_END(DECODER);
1066 continue;
1067 }
1068 }
1069
1070 /*
1071 * Checking the return value of BIO_reset() or BIO_seek() is unsafe.
1072 * Furthermore, BIO_reset() is unsafe to use if the source BIO happens
1073 * to be a BIO_s_mem(), because the earlier BIO_tell() gives us zero
1074 * no matter where we are in the underlying buffer we're reading from.
1075 *
1076 * So, we simply do a BIO_seek(), and use BIO_tell() that we're back
1077 * at the same position. This is a best effort attempt, but BIO_seek()
1078 * and BIO_tell() should come as a pair...
1079 */
1080 (void)BIO_seek(bio, loc);
1081 if (BIO_tell(bio) != loc)
1082 goto end;
1083
1084 /* Recurse */
1085 OSSL_TRACE_BEGIN(DECODER) {
1086 BIO_printf(trc_out,
1087 "(ctx %p) %s [%u] Running decoder instance %s (%p)\n",
1088 (void *)new_data.ctx, LEVEL, (unsigned int)i,
1089 new_decoder_name, (void *)new_decoder_inst);
1090 } OSSL_TRACE_END(DECODER);
1091
1092 /*
1093 * We only care about errors reported from decoder implementations
1094 * if it returns false (i.e. there was a fatal error).
1095 */
1096 ERR_set_mark();
1097
1098 new_data.current_decoder_inst_index = i;
1099 new_data.flag_input_structure_checked
1100 = data->flag_input_structure_checked;
1101 ok = new_decoder->decode(new_decoderctx, cbio,
1102 new_data.ctx->selection,
1103 decoder_process, &new_data,
1104 ossl_pw_passphrase_callback_dec,
1105 &new_data.ctx->pwdata);
1106
1107 OSSL_TRACE_BEGIN(DECODER) {
1108 BIO_printf(trc_out,
1109 "(ctx %p) %s [%u] Running decoder instance %s (%p) => %d"
1110 " (recursed further: %s, construct called: %s)\n",
1111 (void *)new_data.ctx, LEVEL, (unsigned int)i,
1112 new_decoder_name, (void *)new_decoder_inst, ok,
1113 new_data.flag_next_level_called ? "yes" : "no",
1114 new_data.flag_construct_called ? "yes" : "no");
1115 } OSSL_TRACE_END(DECODER);
1116
1117 data->flag_construct_called = new_data.flag_construct_called;
1118
1119 /* Break on error or if we tried to construct an object already */
1120 if (!ok || data->flag_construct_called) {
1121 ERR_clear_last_mark();
1122 break;
1123 }
1124 ERR_pop_to_mark();
1125
1126 /*
1127 * Break if the decoder implementation that we called recursed, since
1128 * that indicates that it successfully decoded something.
1129 */
1130 if (new_data.flag_next_level_called)
1131 break;
1132 }
1133
1134 end:
1135 ossl_core_bio_free(cbio);
1136 BIO_free(new_data.bio);
1137 ctx->start_input_type = start_input_type;
1138 return ok;
1139 }
1140