1 /*
2 * Copyright 2020-2023 The OpenSSL Project Authors. All Rights Reserved.
3 *
4 * Licensed under the Apache License 2.0 (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
8 */
9
10 #include <openssl/core_dispatch.h>
11 #include "prov/seeding.h"
12 #include "prov/providercommon.h"
13
14 static OSSL_FUNC_get_entropy_fn *c_get_entropy = NULL;
15 static OSSL_FUNC_get_user_entropy_fn *c_get_user_entropy = NULL;
16 static OSSL_FUNC_cleanup_entropy_fn *c_cleanup_entropy = NULL;
17 static OSSL_FUNC_cleanup_user_entropy_fn *c_cleanup_user_entropy = NULL;
18 static OSSL_FUNC_get_nonce_fn *c_get_nonce = NULL;
19 static OSSL_FUNC_get_user_nonce_fn *c_get_user_nonce = NULL;
20 static OSSL_FUNC_cleanup_nonce_fn *c_cleanup_nonce = NULL;
21 static OSSL_FUNC_cleanup_user_nonce_fn *c_cleanup_user_nonce = NULL;
22
23 #ifdef FIPS_MODULE
24 /*
25 * The FIPS provider uses an internal library context which is what the
26 * passed provider context references. Since the seed source is external
27 * to the FIPS provider, this is the wrong one. We need to convert this
28 * to the correct core handle before up-calling libcrypto.
29 */
30 #define CORE_HANDLE(provctx) \
31 FIPS_get_core_handle(ossl_prov_ctx_get0_libctx(provctx))
32 #else
33 /*
34 * The non-FIPS path *should* be unused because the full DRBG chain including
35 * seed source is instantiated. However, that might not apply for third
36 * party providers, so this is retained for compatibility.
37 */
38 #define CORE_HANDLE(provctx) ossl_prov_ctx_get0_handle(provctx)
39 #endif
40
ossl_prov_seeding_from_dispatch(const OSSL_DISPATCH * fns)41 int ossl_prov_seeding_from_dispatch(const OSSL_DISPATCH *fns)
42 {
43 for (; fns->function_id != 0; fns++) {
44 /*
45 * We do not support the scenario of an application linked against
46 * multiple versions of libcrypto (e.g. one static and one dynamic), but
47 * sharing a single fips.so. We do a simple sanity check here.
48 */
49 #define set_func(c, f) \
50 do { \
51 if (c == NULL) \
52 c = f; \
53 else if (c != f) \
54 return 0; \
55 } while (0)
56 switch (fns->function_id) {
57 case OSSL_FUNC_GET_ENTROPY:
58 set_func(c_get_entropy, OSSL_FUNC_get_entropy(fns));
59 break;
60 case OSSL_FUNC_GET_USER_ENTROPY:
61 set_func(c_get_user_entropy, OSSL_FUNC_get_user_entropy(fns));
62 break;
63 case OSSL_FUNC_CLEANUP_ENTROPY:
64 set_func(c_cleanup_entropy, OSSL_FUNC_cleanup_entropy(fns));
65 break;
66 case OSSL_FUNC_CLEANUP_USER_ENTROPY:
67 set_func(c_cleanup_user_entropy, OSSL_FUNC_cleanup_user_entropy(fns));
68 break;
69 case OSSL_FUNC_GET_NONCE:
70 set_func(c_get_nonce, OSSL_FUNC_get_nonce(fns));
71 break;
72 case OSSL_FUNC_GET_USER_NONCE:
73 set_func(c_get_user_nonce, OSSL_FUNC_get_user_nonce(fns));
74 break;
75 case OSSL_FUNC_CLEANUP_NONCE:
76 set_func(c_cleanup_nonce, OSSL_FUNC_cleanup_nonce(fns));
77 break;
78 case OSSL_FUNC_CLEANUP_USER_NONCE:
79 set_func(c_cleanup_user_nonce, OSSL_FUNC_cleanup_user_nonce(fns));
80 break;
81 }
82 #undef set_func
83 }
84 return 1;
85 }
86
ossl_prov_get_entropy(PROV_CTX * prov_ctx,unsigned char ** pout,int entropy,size_t min_len,size_t max_len)87 size_t ossl_prov_get_entropy(PROV_CTX *prov_ctx, unsigned char **pout,
88 int entropy, size_t min_len, size_t max_len)
89 {
90 const OSSL_CORE_HANDLE *handle = CORE_HANDLE(prov_ctx);
91
92 if (c_get_user_entropy != NULL)
93 return c_get_user_entropy(handle, pout, entropy, min_len, max_len);
94 if (c_get_entropy != NULL)
95 return c_get_entropy(handle, pout, entropy, min_len, max_len);
96 return 0;
97 }
98
ossl_prov_cleanup_entropy(PROV_CTX * prov_ctx,unsigned char * buf,size_t len)99 void ossl_prov_cleanup_entropy(PROV_CTX *prov_ctx, unsigned char *buf,
100 size_t len)
101 {
102 const OSSL_CORE_HANDLE *handle = CORE_HANDLE(prov_ctx);
103
104 if (c_cleanup_user_entropy != NULL)
105 c_cleanup_user_entropy(handle, buf, len);
106 else if (c_cleanup_entropy != NULL)
107 c_cleanup_entropy(handle, buf, len);
108 }
109
ossl_prov_get_nonce(PROV_CTX * prov_ctx,unsigned char ** pout,size_t min_len,size_t max_len,const void * salt,size_t salt_len)110 size_t ossl_prov_get_nonce(PROV_CTX *prov_ctx, unsigned char **pout,
111 size_t min_len, size_t max_len,
112 const void *salt, size_t salt_len)
113 {
114 const OSSL_CORE_HANDLE *handle = CORE_HANDLE(prov_ctx);
115
116 if (c_get_user_nonce != NULL)
117 return c_get_user_nonce(handle, pout, min_len, max_len, salt, salt_len);
118 if (c_get_nonce != NULL)
119 return c_get_nonce(handle, pout, min_len, max_len, salt, salt_len);
120 return 0;
121 }
122
ossl_prov_cleanup_nonce(PROV_CTX * prov_ctx,unsigned char * buf,size_t len)123 void ossl_prov_cleanup_nonce(PROV_CTX *prov_ctx, unsigned char *buf, size_t len)
124 {
125 const OSSL_CORE_HANDLE *handle = CORE_HANDLE(prov_ctx);
126
127 if (c_cleanup_user_nonce != NULL)
128 c_cleanup_user_nonce(handle, buf, len);
129 else if (c_cleanup_nonce != NULL)
130 c_cleanup_nonce(handle, buf, len);
131 }
132