diff options
author | Richard Levitte <levitte@openssl.org> | 2020-08-02 12:14:19 +0200 |
---|---|---|
committer | Richard Levitte <levitte@openssl.org> | 2020-08-24 10:02:25 +0200 |
commit | a517edec0385280e31e2dc2912301501e6b0c4a3 (patch) | |
tree | 78538835d6f1fcc93a7c1a637931bf1f1f23d127 /crypto/encode_decode | |
parent | 14c8a3d118e3ec5d0179d45c7f227d29a52f7697 (diff) |
CORE: Generalise internal pass phrase prompter
The pass phrase prompter that's part of OSSL_ENCODER and OSSL_DECODER
is really a passphrase callback bridge between the diverse forms of
prompters that exist within OpenSSL: pem_password_cb, ui_method and
OSSL_PASSPHRASE_CALLBACK.
This can be generalised, to be re-used by other parts of OpenSSL, and
to thereby allow the users to specify whatever form of pass phrase
callback they need, while being able to pass that on to other APIs
that are called internally, in the form that those APIs demand.
Additionally, we throw in the possibility to cache pass phrases during
a "session" (we leave it to each API to define what a "session" is).
This is useful for any API that implements discovery and therefore may
need to get the same password more than once, such as OSSL_DECODER and
OSSL_STORE.
Reviewed-by: Shane Lontis <shane.lontis@oracle.com>
(Merged from https://github.com/openssl/openssl/pull/12512)
Diffstat (limited to 'crypto/encode_decode')
-rw-r--r-- | crypto/encode_decode/build.info | 5 | ||||
-rw-r--r-- | crypto/encode_decode/decoder_lib.c | 13 | ||||
-rw-r--r-- | crypto/encode_decode/decoder_meth.c | 4 | ||||
-rw-r--r-- | crypto/encode_decode/decoder_pkey.c | 65 | ||||
-rw-r--r-- | crypto/encode_decode/encoder_local.h | 44 | ||||
-rw-r--r-- | crypto/encode_decode/encoder_meth.c | 2 | ||||
-rw-r--r-- | crypto/encode_decode/encoder_pkey.c | 38 | ||||
-rw-r--r-- | crypto/encode_decode/endecode_pass.c | 162 |
8 files changed, 23 insertions, 310 deletions
diff --git a/crypto/encode_decode/build.info b/crypto/encode_decode/build.info index 4686c4a19d..e2cd846673 100644 --- a/crypto/encode_decode/build.info +++ b/crypto/encode_decode/build.info @@ -1,8 +1,5 @@ -SOURCE[../../libcrypto]=endecode_pass.c - SOURCE[../../libcrypto]=encoder_meth.c encoder_lib.c encoder_pkey.c -SOURCE[../../libcrypto]=decoder_meth.c decoder_lib.c \ - decoder_pkey.c +SOURCE[../../libcrypto]=decoder_meth.c decoder_lib.c decoder_pkey.c SOURCE[../../libcrypto]=encoder_err.c SOURCE[../../libcrypto]=decoder_err.c diff --git a/crypto/encode_decode/decoder_lib.c b/crypto/encode_decode/decoder_lib.c index cd6215e309..5d18ef1eff 100644 --- a/crypto/encode_decode/decoder_lib.c +++ b/crypto/encode_decode/decoder_lib.c @@ -11,6 +11,7 @@ #include <openssl/bio.h> #include <openssl/params.h> #include <openssl/provider.h> +#include "internal/passphrase.h" #include "encoder_local.h" #include "e_os.h" @@ -35,13 +36,14 @@ int OSSL_DECODER_from_bio(OSSL_DECODER_CTX *ctx, BIO *in) data.ctx = ctx; data.bio = in; + /* Enable passphrase caching */ + (void)ossl_pw_enable_passphrase_caching(&ctx->pwdata); + ok = decoder_process(NULL, &data); /* Clear any internally cached passphrase */ - if (!ctx->flag_user_passphrase) { - OSSL_DECODER_CTX_set_passphrase(ctx, NULL, 0); - ctx->flag_user_passphrase = 0; - } + (void)ossl_pw_clear_passphrase_cache(&ctx->pwdata); + return ok; } @@ -472,7 +474,8 @@ static int decoder_process(const OSSL_PARAM params[], void *arg) new_data.current_deser_inst_index = i; ok = new_deser->decode(new_deser_inst->deserctx, (OSSL_CORE_BIO *)bio, decoder_process, &new_data, - ctx->passphrase_cb, new_data.ctx); + ossl_pw_passphrase_callback_dec, + &new_data.ctx->pwdata); if (ok) break; } diff --git a/crypto/encode_decode/decoder_meth.c b/crypto/encode_decode/decoder_meth.c index 2259c6348a..409bb1aa54 100644 --- a/crypto/encode_decode/decoder_meth.c +++ b/crypto/encode_decode/decoder_meth.c @@ -492,7 +492,6 @@ OSSL_DECODER_CTX *OSSL_DECODER_CTX_new(void) return NULL; } - ctx->passphrase_cb = ossl_decoder_passphrase_in_cb; return ctx; } @@ -545,8 +544,7 @@ void OSSL_DECODER_CTX_free(OSSL_DECODER_CTX *ctx) ctx->cleanup(ctx->construct_data); sk_OSSL_DECODER_INSTANCE_pop_free(ctx->decoder_insts, OSSL_DECODER_INSTANCE_free); - OSSL_DECODER_CTX_set_passphrase_ui(ctx, NULL, NULL); - OSSL_DECODER_CTX_set_passphrase(ctx, NULL, 0); + ossl_pw_clear_passphrase_data(&ctx->pwdata); OPENSSL_free(ctx); } } diff --git a/crypto/encode_decode/decoder_pkey.c b/crypto/encode_decode/decoder_pkey.c index db75041d17..92c0d5a6ea 100644 --- a/crypto/encode_decode/decoder_pkey.c +++ b/crypto/encode_decode/decoder_pkey.c @@ -20,79 +20,20 @@ int OSSL_DECODER_CTX_set_passphrase(OSSL_DECODER_CTX *ctx, const unsigned char *kstr, size_t klen) { - if (!ossl_assert(ctx != NULL)) { - ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_PASSED_NULL_PARAMETER); - return 0; - } - - OPENSSL_clear_free(ctx->cached_passphrase, ctx->cached_passphrase_len); - ctx->cached_passphrase = NULL; - ctx->cached_passphrase_len = 0; - if (kstr != NULL) { - if (klen == 0) { - ctx->cached_passphrase = OPENSSL_zalloc(1); - ctx->cached_passphrase_len = 0; - } else { - ctx->cached_passphrase = OPENSSL_memdup(kstr, klen); - ctx->cached_passphrase_len = klen; - } - if (ctx->cached_passphrase == NULL) { - ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_MALLOC_FAILURE); - return 0; - } - } - ctx->flag_user_passphrase = 1; - return 1; -} - -static void decoder_ctx_reset_passphrase_ui(OSSL_DECODER_CTX *ctx) -{ - UI_destroy_method(ctx->allocated_ui_method); - ctx->allocated_ui_method = NULL; - ctx->ui_method = NULL; - ctx->ui_data = NULL; + return ossl_pw_set_passphrase(&ctx->pwdata, kstr, klen); } int OSSL_DECODER_CTX_set_passphrase_ui(OSSL_DECODER_CTX *ctx, const UI_METHOD *ui_method, void *ui_data) { - if (!ossl_assert(ctx != NULL)) { - ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_PASSED_NULL_PARAMETER); - return 0; - } - - decoder_ctx_reset_passphrase_ui(ctx); - ctx->ui_method = ui_method; - ctx->ui_data = ui_data; - return 1; + return ossl_pw_set_ui_method(&ctx->pwdata, ui_method, ui_data); } int OSSL_DECODER_CTX_set_pem_password_cb(OSSL_DECODER_CTX *ctx, pem_password_cb *cb, void *cbarg) { - UI_METHOD *ui_method = NULL; - - if (!ossl_assert(ctx != NULL)) { - ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_PASSED_NULL_PARAMETER); - return 0; - } - - /* - * If |cb| is NULL, it means the caller wants to reset previous - * password callback info. Otherwise, we only set the new data - * if a new UI_METHOD could be created for this sort of callback. - */ - if (cb == NULL - || (ui_method = UI_UTIL_wrap_read_pem_callback(cb, 0)) != NULL) { - decoder_ctx_reset_passphrase_ui(ctx); - ctx->ui_method = ctx->allocated_ui_method = ui_method; - ctx->ui_data = cbarg; - ctx->passphrase_cb = ossl_decoder_passphrase_in_cb; - return 1; - } - - return 0; + return ossl_pw_set_pem_password_cb(&ctx->pwdata, cb, cbarg); } /* diff --git a/crypto/encode_decode/encoder_local.h b/crypto/encode_decode/encoder_local.h index 34931d4e43..749b2688e4 100644 --- a/crypto/encode_decode/encoder_local.h +++ b/crypto/encode_decode/encoder_local.h @@ -13,6 +13,7 @@ #include <openssl/encoder.h> #include <openssl/decoder.h> #include "internal/cryptlib.h" +#include "internal/passphrase.h" #include "internal/refcount.h" struct ossl_serdes_base_st { @@ -64,13 +65,7 @@ struct ossl_encoder_ctx_st { int (*do_output)(OSSL_ENCODER_CTX *ctx, BIO *out); /* For any function that needs a passphrase reader */ - const UI_METHOD *ui_method; - void *ui_data; - /* - * if caller used OSSL_ENCODER_CTX_set_passphrase_cb(), we need - * intermediary storage. - */ - UI_METHOD *allocated_ui_method; + struct ossl_passphrase_data_st pwdata; }; struct ossl_decoder_instance_st { @@ -103,38 +98,5 @@ struct ossl_decoder_ctx_st { void *construct_data; /* For any function that needs a passphrase reader */ - OSSL_PASSPHRASE_CALLBACK *passphrase_cb; - const UI_METHOD *ui_method; - void *ui_data; - /* - * if caller used OSSL_ENCODER_CTX_set_pem_password_cb(), we need - * intermediary storage. - */ - UI_METHOD *allocated_ui_method; - /* - * Because the same input may pass through more than one decoder, - * we cache any passphrase passed to us. The desrializing processor - * must clear this at the end of a run. - */ - unsigned char *cached_passphrase; - size_t cached_passphrase_len; - - /* - * Flag section. Keep these together - */ - - /* - * The passphrase was passed to us by the user. In that case, it - * should only be freed when freeing this context. - */ - unsigned int flag_user_passphrase:1; + struct ossl_passphrase_data_st pwdata; }; - -/* Passphrase callbacks, found in serdes_pass.c */ - -/* - * Encoders typically want to get an outgoing passphrase, while - * decoders typically want to get en incoming passphrase. - */ -OSSL_PASSPHRASE_CALLBACK ossl_encoder_passphrase_out_cb; -OSSL_PASSPHRASE_CALLBACK ossl_decoder_passphrase_in_cb; diff --git a/crypto/encode_decode/encoder_meth.c b/crypto/encode_decode/encoder_meth.c index ef3c24433e..81bc5c47b9 100644 --- a/crypto/encode_decode/encoder_meth.c +++ b/crypto/encode_decode/encoder_meth.c @@ -517,7 +517,7 @@ void OSSL_ENCODER_CTX_free(OSSL_ENCODER_CTX *ctx) if (ctx->encoder != NULL && ctx->encoder->freectx != NULL) ctx->encoder->freectx(ctx->serctx); OSSL_ENCODER_free(ctx->encoder); - UI_destroy_method(ctx->allocated_ui_method); + ossl_pw_clear_passphrase_data(&ctx->pwdata); OPENSSL_free(ctx); } } diff --git a/crypto/encode_decode/encoder_pkey.c b/crypto/encode_decode/encoder_pkey.c index dc776c023e..6664f589b4 100644 --- a/crypto/encode_decode/encoder_pkey.c +++ b/crypto/encode_decode/encoder_pkey.c @@ -48,45 +48,17 @@ int OSSL_ENCODER_CTX_set_passphrase(OSSL_ENCODER_CTX *ctx, return OSSL_ENCODER_CTX_set_params(ctx, params); } -static void encoder_ctx_reset_passphrase_ui(OSSL_ENCODER_CTX *ctx) -{ - UI_destroy_method(ctx->allocated_ui_method); - ctx->allocated_ui_method = NULL; - ctx->ui_method = NULL; - ctx->ui_data = NULL; -} - int OSSL_ENCODER_CTX_set_passphrase_ui(OSSL_ENCODER_CTX *ctx, const UI_METHOD *ui_method, void *ui_data) { - if (!ossl_assert(ctx != NULL)) { - ERR_raise(ERR_LIB_OSSL_ENCODER, ERR_R_PASSED_NULL_PARAMETER); - return 0; - } - - encoder_ctx_reset_passphrase_ui(ctx); - ctx->ui_method = ui_method; - ctx->ui_data = ui_data; - return 1; + return ossl_pw_set_ui_method(&ctx->pwdata, ui_method, ui_data); } int OSSL_ENCODER_CTX_set_passphrase_cb(OSSL_ENCODER_CTX *ctx, pem_password_cb *cb, void *cbarg) { - if (!ossl_assert(ctx != NULL)) { - ERR_raise(ERR_LIB_OSSL_ENCODER, ERR_R_PASSED_NULL_PARAMETER); - return 0; - } - - encoder_ctx_reset_passphrase_ui(ctx); - if (cb == NULL) - return 1; - ctx->ui_method = - ctx->allocated_ui_method = UI_UTIL_wrap_read_pem_callback(cb, 1); - ctx->ui_data = cbarg; - - return ctx->ui_method != NULL; + return ossl_pw_set_pem_password_cb(&ctx->pwdata, cb, cbarg); } /* @@ -125,7 +97,8 @@ static int encoder_write_cb(const OSSL_PARAM params[], void *arg) BIO *out = write_data->out; return ctx->encoder->encode_data(ctx->serctx, params, (OSSL_CORE_BIO *)out, - ossl_encoder_passphrase_out_cb, ctx); + ossl_pw_passphrase_callback_enc, + &ctx->pwdata); } /* @@ -164,7 +137,8 @@ static int encoder_EVP_PKEY_to_bio(OSSL_ENCODER_CTX *ctx, BIO *out) return ctx->encoder->encode_object(ctx->serctx, keydata, (OSSL_CORE_BIO *)out, - ossl_encoder_passphrase_out_cb, ctx); + ossl_pw_passphrase_callback_enc, + &ctx->pwdata); } /* diff --git a/crypto/encode_decode/endecode_pass.c b/crypto/encode_decode/endecode_pass.c deleted file mode 100644 index 113f5eeb84..0000000000 --- a/crypto/encode_decode/endecode_pass.c +++ /dev/null @@ -1,162 +0,0 @@ -/* - * Copyright 2020 The OpenSSL Project Authors. All Rights Reserved. - * - * Licensed under the Apache License 2.0 (the "License"). You may not use - * this file except in compliance with the License. You can obtain a copy - * in the file LICENSE in the source distribution or at - * https://www.openssl.org/source/license.html - */ - -#include <openssl/err.h> -#include <openssl/ui.h> -#include <openssl/core_names.h> -#include "internal/cryptlib.h" -#include "encoder_local.h" - -/* Passphrase callbacks for any who need it */ - -/* - * First, define the generic passphrase function that supports both - * outgoing (with passphrase verify) and incoming (without passphrase - * verify) passphrase reading. - */ -static int do_passphrase(char *pass, size_t pass_size, size_t *pass_len, - const OSSL_PARAM params[], void *arg, int verify, - const UI_METHOD *ui_method, void *ui_data, int errlib) -{ - const OSSL_PARAM *p; - const char *prompt_info = NULL; - char *prompt = NULL, *vpass = NULL; - int prompt_idx = -1, verify_idx = -1; - UI *ui = NULL; - int ret = 0; - - if (!ossl_assert(pass != NULL && pass_size != 0 && pass_len != NULL)) { - ERR_raise(errlib, ERR_R_PASSED_NULL_PARAMETER); - return 0; - } - - if ((p = OSSL_PARAM_locate_const(params, - OSSL_PASSPHRASE_PARAM_INFO)) != NULL) { - if (p->data_type != OSSL_PARAM_UTF8_STRING) - return 0; - prompt_info = p->data; - } - - if ((ui = UI_new()) == NULL) { - ERR_raise(errlib, ERR_R_MALLOC_FAILURE); - return 0; - } - - if (ui_method != NULL) { - UI_set_method(ui, ui_method); - if (ui_data != NULL) - UI_add_user_data(ui, ui_data); - } - - /* Get an application constructed prompt */ - prompt = UI_construct_prompt(ui, "pass phrase", prompt_info); - if (prompt == NULL) { - ERR_raise(errlib, ERR_R_MALLOC_FAILURE); - goto end; - } - - prompt_idx = UI_add_input_string(ui, prompt, - UI_INPUT_FLAG_DEFAULT_PWD, - pass, 0, pass_size - 1) - 1; - if (prompt_idx < 0) { - ERR_raise(errlib, ERR_R_UI_LIB); - goto end; - } - - if (verify) { - /* Get a buffer for verification prompt */ - vpass = OPENSSL_zalloc(pass_size); - if (vpass == NULL) { - ERR_raise(errlib, ERR_R_MALLOC_FAILURE); - goto end; - } - verify_idx = UI_add_verify_string(ui, prompt, - UI_INPUT_FLAG_DEFAULT_PWD, - vpass, 0, pass_size - 1, - pass) - 1; - if (verify_idx < 0) { - ERR_raise(errlib, ERR_R_UI_LIB); - goto end; - } - } - - switch (UI_process(ui)) { - case -2: - ERR_raise(errlib, ERR_R_INTERRUPTED_OR_CANCELLED); - break; - case -1: - ERR_raise(errlib, ERR_R_UI_LIB); - break; - default: - *pass_len = (size_t)UI_get_result_length(ui, prompt_idx); - ret = 1; - break; - } - - end: - OPENSSL_free(vpass); - OPENSSL_free(prompt); - UI_free(ui); - return ret; -} - -/* - * Encoders typically want to get an outgoing passphrase, while - * decoders typically want to get en incoming passphrase. - */ -int ossl_encoder_passphrase_out_cb(char *pass, size_t pass_size, - size_t *pass_len, - const OSSL_PARAM params[], void *arg) -{ - OSSL_ENCODER_CTX *ctx = arg; - - if (!ossl_assert(ctx != NULL)) { - ERR_raise(ERR_LIB_OSSL_ENCODER, ERR_R_PASSED_NULL_PARAMETER); - return 0; - } - - return do_passphrase(pass, pass_size, pass_len, params, arg, 1, - ctx->ui_method, ctx->ui_data, - ERR_LIB_OSSL_ENCODER); -} - -int ossl_decoder_passphrase_in_cb(char *pass, size_t pass_size, - size_t *pass_len, - const OSSL_PARAM params[], void *arg) -{ - OSSL_DECODER_CTX *ctx = arg; - - if (!ossl_assert(ctx != NULL)) { - ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_PASSED_NULL_PARAMETER); - return 0; - } - - if (ctx->cached_passphrase != NULL) { - size_t len = ctx->cached_passphrase_len; - - if (len > pass_size) - len = pass_size; - memcpy(pass, ctx->cached_passphrase, len); - *pass_len = len; - return 1; - } else { - if ((ctx->cached_passphrase = OPENSSL_zalloc(pass_size)) == NULL) { - ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_MALLOC_FAILURE); - return 0; - } - } - if (do_passphrase(pass, pass_size, pass_len, params, arg, 0, - ctx->ui_method, ctx->ui_data, - ERR_LIB_OSSL_DECODER)) { - memcpy(ctx->cached_passphrase, pass, *pass_len); - ctx->cached_passphrase_len = *pass_len; - return 1; - } - return 0; -} |