1 /*
2  * Copyright 2020-2023 The OpenSSL Project Authors. All Rights Reserved.
3  *
4  * Licensed under the Apache License 2.0 (the "License").  You may not use
5  * this file except in compliance with the License.  You can obtain a copy
6  * in the file LICENSE in the source distribution or at
7  * https://www.openssl.org/source/license.html
8  */
9 
10 #include <openssl/core_names.h>
11 #include <openssl/bio.h>
12 #include <openssl/params.h>
13 #include <openssl/provider.h>
14 #include <openssl/evperr.h>
15 #include <openssl/ecerr.h>
16 #include <openssl/pkcs12err.h>
17 #include <openssl/x509err.h>
18 #include <openssl/trace.h>
19 #include "internal/bio.h"
20 #include "internal/provider.h"
21 #include "internal/namemap.h"
22 #include "crypto/decoder.h"
23 #include "encoder_local.h"
24 #include "internal/e_os.h"
25 
26 struct decoder_process_data_st {
27     OSSL_DECODER_CTX *ctx;
28 
29     /* Current BIO */
30     BIO *bio;
31 
32     /* Index of the current decoder instance to be processed */
33     size_t current_decoder_inst_index;
34     /* For tracing, count recursion level */
35     size_t recursion;
36 
37     /*-
38      * Flags
39      */
40     unsigned int flag_next_level_called : 1;
41     unsigned int flag_construct_called : 1;
42     unsigned int flag_input_structure_checked : 1;
43 };
44 
45 static int decoder_process(const OSSL_PARAM params[], void *arg);
46 
OSSL_DECODER_from_bio(OSSL_DECODER_CTX * ctx,BIO * in)47 int OSSL_DECODER_from_bio(OSSL_DECODER_CTX *ctx, BIO *in)
48 {
49     struct decoder_process_data_st data;
50     int ok = 0;
51     BIO *new_bio = NULL;
52     unsigned long lasterr;
53 
54     if (in == NULL) {
55         ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_PASSED_NULL_PARAMETER);
56         return 0;
57     }
58 
59     if (OSSL_DECODER_CTX_get_num_decoders(ctx) == 0) {
60         ERR_raise_data(ERR_LIB_OSSL_DECODER, OSSL_DECODER_R_DECODER_NOT_FOUND,
61                        "No decoders were found. For standard decoders you need "
62                        "at least one of the default or base providers "
63                        "available. Did you forget to load them?");
64         return 0;
65     }
66 
67     lasterr = ERR_peek_last_error();
68 
69     if (BIO_tell(in) < 0) {
70         new_bio = BIO_new(BIO_f_readbuffer());
71         if (new_bio == NULL)
72             return 0;
73         in = BIO_push(new_bio, in);
74     }
75     memset(&data, 0, sizeof(data));
76     data.ctx = ctx;
77     data.bio = in;
78 
79     /* Enable passphrase caching */
80     (void)ossl_pw_enable_passphrase_caching(&ctx->pwdata);
81 
82     ok = decoder_process(NULL, &data);
83 
84     if (!data.flag_construct_called) {
85         const char *spaces
86             = ctx->start_input_type != NULL && ctx->input_structure != NULL
87             ? " " : "";
88         const char *input_type_label
89             = ctx->start_input_type != NULL ? "Input type: " : "";
90         const char *input_structure_label
91             = ctx->input_structure != NULL ? "Input structure: " : "";
92         const char *comma
93             = ctx->start_input_type != NULL && ctx->input_structure != NULL
94             ? ", " : "";
95         const char *input_type
96             = ctx->start_input_type != NULL ? ctx->start_input_type : "";
97         const char *input_structure
98             = ctx->input_structure != NULL ? ctx->input_structure : "";
99 
100         if (ERR_peek_last_error() == lasterr || ERR_peek_error() == 0)
101             /* Prevent spurious decoding error but add at least something */
102             ERR_raise_data(ERR_LIB_OSSL_DECODER, ERR_R_UNSUPPORTED,
103                            "No supported data to decode. %s%s%s%s%s%s",
104                            spaces, input_type_label, input_type, comma,
105                            input_structure_label, input_structure);
106         ok = 0;
107     }
108 
109     /* Clear any internally cached passphrase */
110     (void)ossl_pw_clear_passphrase_cache(&ctx->pwdata);
111 
112     if (new_bio != NULL) {
113         BIO_pop(new_bio);
114         BIO_free(new_bio);
115     }
116     return ok;
117 }
118 
119 #ifndef OPENSSL_NO_STDIO
bio_from_file(FILE * fp)120 static BIO *bio_from_file(FILE *fp)
121 {
122     BIO *b;
123 
124     if ((b = BIO_new(BIO_s_file())) == NULL) {
125         ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_BIO_LIB);
126         return NULL;
127     }
128     BIO_set_fp(b, fp, BIO_NOCLOSE);
129     return b;
130 }
131 
OSSL_DECODER_from_fp(OSSL_DECODER_CTX * ctx,FILE * fp)132 int OSSL_DECODER_from_fp(OSSL_DECODER_CTX *ctx, FILE *fp)
133 {
134     BIO *b = bio_from_file(fp);
135     int ret = 0;
136 
137     if (b != NULL)
138         ret = OSSL_DECODER_from_bio(ctx, b);
139 
140     BIO_free(b);
141     return ret;
142 }
143 #endif
144 
OSSL_DECODER_from_data(OSSL_DECODER_CTX * ctx,const unsigned char ** pdata,size_t * pdata_len)145 int OSSL_DECODER_from_data(OSSL_DECODER_CTX *ctx, const unsigned char **pdata,
146                            size_t *pdata_len)
147 {
148     BIO *membio;
149     int ret = 0;
150 
151     if (pdata == NULL || *pdata == NULL || pdata_len == NULL) {
152         ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_PASSED_NULL_PARAMETER);
153         return 0;
154     }
155 
156     membio = BIO_new_mem_buf(*pdata, (int)*pdata_len);
157     if (OSSL_DECODER_from_bio(ctx, membio)) {
158         *pdata_len = (size_t)BIO_get_mem_data(membio, pdata);
159         ret = 1;
160     }
161     BIO_free(membio);
162 
163     return ret;
164 }
165 
OSSL_DECODER_CTX_set_selection(OSSL_DECODER_CTX * ctx,int selection)166 int OSSL_DECODER_CTX_set_selection(OSSL_DECODER_CTX *ctx, int selection)
167 {
168     if (!ossl_assert(ctx != NULL)) {
169         ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_PASSED_NULL_PARAMETER);
170         return 0;
171     }
172 
173     /*
174      * 0 is a valid selection, and means that the caller leaves
175      * it to code to discover what the selection is.
176      */
177     ctx->selection = selection;
178     return 1;
179 }
180 
OSSL_DECODER_CTX_set_input_type(OSSL_DECODER_CTX * ctx,const char * input_type)181 int OSSL_DECODER_CTX_set_input_type(OSSL_DECODER_CTX *ctx,
182                                     const char *input_type)
183 {
184     if (!ossl_assert(ctx != NULL)) {
185         ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_PASSED_NULL_PARAMETER);
186         return 0;
187     }
188 
189     /*
190      * NULL is a valid starting input type, and means that the caller leaves
191      * it to code to discover what the starting input type is.
192      */
193     ctx->start_input_type = input_type;
194     return 1;
195 }
196 
OSSL_DECODER_CTX_set_input_structure(OSSL_DECODER_CTX * ctx,const char * input_structure)197 int OSSL_DECODER_CTX_set_input_structure(OSSL_DECODER_CTX *ctx,
198                                          const char *input_structure)
199 {
200     if (!ossl_assert(ctx != NULL)) {
201         ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_PASSED_NULL_PARAMETER);
202         return 0;
203     }
204 
205     /*
206      * NULL is a valid starting input structure, and means that the caller
207      * leaves it to code to discover what the starting input structure is.
208      */
209     ctx->input_structure = input_structure;
210     return 1;
211 }
212 
ossl_decoder_instance_new(OSSL_DECODER * decoder,void * decoderctx)213 OSSL_DECODER_INSTANCE *ossl_decoder_instance_new(OSSL_DECODER *decoder,
214                                                  void *decoderctx)
215 {
216     OSSL_DECODER_INSTANCE *decoder_inst = NULL;
217     const OSSL_PROVIDER *prov;
218     OSSL_LIB_CTX *libctx;
219     const OSSL_PROPERTY_LIST *props;
220     const OSSL_PROPERTY_DEFINITION *prop;
221 
222     if (!ossl_assert(decoder != NULL)) {
223         ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_PASSED_NULL_PARAMETER);
224         return 0;
225     }
226 
227     if ((decoder_inst = OPENSSL_zalloc(sizeof(*decoder_inst))) == NULL)
228         return 0;
229 
230     prov = OSSL_DECODER_get0_provider(decoder);
231     libctx = ossl_provider_libctx(prov);
232     props = ossl_decoder_parsed_properties(decoder);
233     if (props == NULL) {
234         ERR_raise_data(ERR_LIB_OSSL_DECODER, ERR_R_INVALID_PROPERTY_DEFINITION,
235                        "there are no property definitions with decoder %s",
236                        OSSL_DECODER_get0_name(decoder));
237         goto err;
238     }
239 
240     /* The "input" property is mandatory */
241     prop = ossl_property_find_property(props, libctx, "input");
242     decoder_inst->input_type = ossl_property_get_string_value(libctx, prop);
243     decoder_inst->input_type_id = 0;
244     if (decoder_inst->input_type == NULL) {
245         ERR_raise_data(ERR_LIB_OSSL_DECODER, ERR_R_INVALID_PROPERTY_DEFINITION,
246                        "the mandatory 'input' property is missing "
247                        "for decoder %s (properties: %s)",
248                        OSSL_DECODER_get0_name(decoder),
249                        OSSL_DECODER_get0_properties(decoder));
250         goto err;
251     }
252 
253     /* The "structure" property is optional */
254     prop = ossl_property_find_property(props, libctx, "structure");
255     if (prop != NULL) {
256         decoder_inst->input_structure
257             = ossl_property_get_string_value(libctx, prop);
258     }
259 
260     if (!OSSL_DECODER_up_ref(decoder)) {
261         ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_INTERNAL_ERROR);
262         goto err;
263     }
264     decoder_inst->decoder = decoder;
265     decoder_inst->decoderctx = decoderctx;
266     return decoder_inst;
267  err:
268     ossl_decoder_instance_free(decoder_inst);
269     return NULL;
270 }
271 
ossl_decoder_instance_free(OSSL_DECODER_INSTANCE * decoder_inst)272 void ossl_decoder_instance_free(OSSL_DECODER_INSTANCE *decoder_inst)
273 {
274     if (decoder_inst != NULL) {
275         if (decoder_inst->decoder != NULL)
276             decoder_inst->decoder->freectx(decoder_inst->decoderctx);
277         decoder_inst->decoderctx = NULL;
278         OSSL_DECODER_free(decoder_inst->decoder);
279         decoder_inst->decoder = NULL;
280         OPENSSL_free(decoder_inst);
281     }
282 }
283 
ossl_decoder_instance_dup(const OSSL_DECODER_INSTANCE * src)284 OSSL_DECODER_INSTANCE *ossl_decoder_instance_dup(const OSSL_DECODER_INSTANCE *src)
285 {
286     OSSL_DECODER_INSTANCE *dest;
287     const OSSL_PROVIDER *prov;
288     void *provctx;
289 
290     if ((dest = OPENSSL_zalloc(sizeof(*dest))) == NULL)
291         return NULL;
292 
293     *dest = *src;
294     if (!OSSL_DECODER_up_ref(dest->decoder)) {
295         ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_INTERNAL_ERROR);
296         goto err;
297     }
298     prov = OSSL_DECODER_get0_provider(dest->decoder);
299     provctx = OSSL_PROVIDER_get0_provider_ctx(prov);
300 
301     dest->decoderctx = dest->decoder->newctx(provctx);
302     if (dest->decoderctx == NULL) {
303         ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_INTERNAL_ERROR);
304         OSSL_DECODER_free(dest->decoder);
305         goto err;
306     }
307 
308     return dest;
309 
310  err:
311     OPENSSL_free(dest);
312     return NULL;
313 }
314 
ossl_decoder_ctx_add_decoder_inst(OSSL_DECODER_CTX * ctx,OSSL_DECODER_INSTANCE * di)315 int ossl_decoder_ctx_add_decoder_inst(OSSL_DECODER_CTX *ctx,
316                                       OSSL_DECODER_INSTANCE *di)
317 {
318     int ok;
319 
320     if (ctx->decoder_insts == NULL
321         && (ctx->decoder_insts =
322             sk_OSSL_DECODER_INSTANCE_new_null()) == NULL) {
323         ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_CRYPTO_LIB);
324         return 0;
325     }
326 
327     ok = (sk_OSSL_DECODER_INSTANCE_push(ctx->decoder_insts, di) > 0);
328     if (ok) {
329         OSSL_TRACE_BEGIN(DECODER) {
330             BIO_printf(trc_out,
331                        "(ctx %p) Added decoder instance %p for decoder %p\n"
332                        "    %s with %s\n",
333                        (void *)ctx, (void *)di, (void *)di->decoder,
334                        OSSL_DECODER_get0_name(di->decoder),
335                        OSSL_DECODER_get0_properties(di->decoder));
336         } OSSL_TRACE_END(DECODER);
337     }
338     return ok;
339 }
340 
OSSL_DECODER_CTX_add_decoder(OSSL_DECODER_CTX * ctx,OSSL_DECODER * decoder)341 int OSSL_DECODER_CTX_add_decoder(OSSL_DECODER_CTX *ctx, OSSL_DECODER *decoder)
342 {
343     OSSL_DECODER_INSTANCE *decoder_inst = NULL;
344     const OSSL_PROVIDER *prov = NULL;
345     void *decoderctx = NULL;
346     void *provctx = NULL;
347 
348     if (!ossl_assert(ctx != NULL) || !ossl_assert(decoder != NULL)) {
349         ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_PASSED_NULL_PARAMETER);
350         return 0;
351     }
352 
353     prov = OSSL_DECODER_get0_provider(decoder);
354     provctx = OSSL_PROVIDER_get0_provider_ctx(prov);
355 
356     if ((decoderctx = decoder->newctx(provctx)) == NULL
357         || (decoder_inst =
358             ossl_decoder_instance_new(decoder, decoderctx)) == NULL)
359         goto err;
360     /* Avoid double free of decoderctx on further errors */
361     decoderctx = NULL;
362 
363     if (!ossl_decoder_ctx_add_decoder_inst(ctx, decoder_inst))
364         goto err;
365 
366     return 1;
367  err:
368     ossl_decoder_instance_free(decoder_inst);
369     if (decoderctx != NULL)
370         decoder->freectx(decoderctx);
371     return 0;
372 }
373 
374 struct collect_extra_decoder_data_st {
375     OSSL_DECODER_CTX *ctx;
376     const char *output_type;
377     int output_type_id;
378 
379     /*
380      * 0 to check that the decoder's input type is the same as the decoder name
381      * 1 to check that the decoder's input type differs from the decoder name
382      */
383     enum { IS_SAME = 0, IS_DIFFERENT = 1 } type_check;
384     size_t w_prev_start, w_prev_end; /* "previous" decoders */
385     size_t w_new_start, w_new_end;   /* "new" decoders */
386 };
387 
DEFINE_STACK_OF(OSSL_DECODER)388 DEFINE_STACK_OF(OSSL_DECODER)
389 
390 static void collect_all_decoders(OSSL_DECODER *decoder, void *arg)
391 {
392     STACK_OF(OSSL_DECODER) *skdecoders = arg;
393 
394     if (OSSL_DECODER_up_ref(decoder)
395             && !sk_OSSL_DECODER_push(skdecoders, decoder))
396         OSSL_DECODER_free(decoder);
397 }
398 
collect_extra_decoder(OSSL_DECODER * decoder,void * arg)399 static void collect_extra_decoder(OSSL_DECODER *decoder, void *arg)
400 {
401     struct collect_extra_decoder_data_st *data = arg;
402     size_t j;
403     const OSSL_PROVIDER *prov = OSSL_DECODER_get0_provider(decoder);
404     void *provctx = OSSL_PROVIDER_get0_provider_ctx(prov);
405 
406     if (ossl_decoder_fast_is_a(decoder, data->output_type, &data->output_type_id)) {
407         void *decoderctx = NULL;
408         OSSL_DECODER_INSTANCE *di = NULL;
409 
410         OSSL_TRACE_BEGIN(DECODER) {
411             BIO_printf(trc_out,
412                        "(ctx %p) [%d] Checking out decoder %p:\n"
413                        "    %s with %s\n",
414                        (void *)data->ctx, data->type_check, (void *)decoder,
415                        OSSL_DECODER_get0_name(decoder),
416                        OSSL_DECODER_get0_properties(decoder));
417         } OSSL_TRACE_END(DECODER);
418 
419         /*
420          * Check that we don't already have this decoder in our stack,
421          * starting with the previous windows but also looking at what
422          * we have added in the current window.
423          */
424         for (j = data->w_prev_start; j < data->w_new_end; j++) {
425             OSSL_DECODER_INSTANCE *check_inst =
426                 sk_OSSL_DECODER_INSTANCE_value(data->ctx->decoder_insts, j);
427 
428             if (decoder->base.algodef == check_inst->decoder->base.algodef) {
429                 /* We found it, so don't do anything more */
430                 OSSL_TRACE_BEGIN(DECODER) {
431                     BIO_printf(trc_out,
432                                "    REJECTED: already exists in the chain\n");
433                 } OSSL_TRACE_END(DECODER);
434                 return;
435             }
436         }
437 
438         if ((decoderctx = decoder->newctx(provctx)) == NULL)
439             return;
440 
441         if ((di = ossl_decoder_instance_new(decoder, decoderctx)) == NULL) {
442             decoder->freectx(decoderctx);
443             return;
444         }
445 
446         switch (data->type_check) {
447         case IS_SAME:
448             /* If it differs, this is not a decoder to add for now. */
449             if (!ossl_decoder_fast_is_a(decoder,
450                                         OSSL_DECODER_INSTANCE_get_input_type(di),
451                                         &di->input_type_id)) {
452                 ossl_decoder_instance_free(di);
453                 OSSL_TRACE_BEGIN(DECODER) {
454                     BIO_printf(trc_out,
455                                "    REJECTED: input type doesn't match output type\n");
456                 } OSSL_TRACE_END(DECODER);
457                 return;
458             }
459             break;
460         case IS_DIFFERENT:
461             /* If it's the same, this is not a decoder to add for now. */
462             if (ossl_decoder_fast_is_a(decoder,
463                                        OSSL_DECODER_INSTANCE_get_input_type(di),
464                                        &di->input_type_id)) {
465                 ossl_decoder_instance_free(di);
466                 OSSL_TRACE_BEGIN(DECODER) {
467                     BIO_printf(trc_out,
468                                "    REJECTED: input type matches output type\n");
469                 } OSSL_TRACE_END(DECODER);
470                 return;
471             }
472             break;
473         }
474 
475         /*
476          * Apart from keeping w_new_end up to date, We don't care about
477          * errors here.  If it doesn't collect, then it doesn't...
478          */
479         if (!ossl_decoder_ctx_add_decoder_inst(data->ctx, di)) {
480             ossl_decoder_instance_free(di);
481             return;
482         }
483 
484         data->w_new_end++;
485     }
486 }
487 
OSSL_DECODER_CTX_add_extra(OSSL_DECODER_CTX * ctx,OSSL_LIB_CTX * libctx,const char * propq)488 int OSSL_DECODER_CTX_add_extra(OSSL_DECODER_CTX *ctx,
489                                OSSL_LIB_CTX *libctx, const char *propq)
490 {
491     /*
492      * This function goes through existing decoder methods in
493      * |ctx->decoder_insts|, and tries to fetch new decoders that produce
494      * what the existing ones want as input, and push those newly fetched
495      * decoders on top of the same stack.
496      * Then it does the same again, but looping over the newly fetched
497      * decoders, until there are no more decoders to be fetched, or
498      * when we have done this 10 times.
499      *
500      * we do this with sliding windows on the stack by keeping track of indexes
501      * and of the end.
502      *
503      * +----------------+
504      * |   DER to RSA   | <--- w_prev_start
505      * +----------------+
506      * |   DER to DSA   |
507      * +----------------+
508      * |   DER to DH    |
509      * +----------------+
510      * |   PEM to DER   | <--- w_prev_end, w_new_start
511      * +----------------+
512      *                    <--- w_new_end
513      */
514     struct collect_extra_decoder_data_st data;
515     size_t depth = 0; /* Counts the number of iterations */
516     size_t count; /* Calculates how many were added in each iteration */
517     size_t numdecoders;
518     STACK_OF(OSSL_DECODER) *skdecoders;
519 
520     if (!ossl_assert(ctx != NULL)) {
521         ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_PASSED_NULL_PARAMETER);
522         return 0;
523     }
524 
525     /*
526      * If there is no stack of OSSL_DECODER_INSTANCE, we have nothing
527      * more to add.  That's fine.
528      */
529     if (ctx->decoder_insts == NULL)
530         return 1;
531 
532     OSSL_TRACE_BEGIN(DECODER) {
533         BIO_printf(trc_out, "(ctx %p) Looking for extra decoders\n",
534                    (void *)ctx);
535     } OSSL_TRACE_END(DECODER);
536 
537 
538     skdecoders = sk_OSSL_DECODER_new_null();
539     if (skdecoders == NULL) {
540         ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_CRYPTO_LIB);
541         return 0;
542     }
543     OSSL_DECODER_do_all_provided(libctx, collect_all_decoders, skdecoders);
544     numdecoders = sk_OSSL_DECODER_num(skdecoders);
545 
546     memset(&data, 0, sizeof(data));
547     data.ctx = ctx;
548     data.w_prev_start = 0;
549     data.w_prev_end = sk_OSSL_DECODER_INSTANCE_num(ctx->decoder_insts);
550     do {
551         size_t i, j;
552 
553         data.w_new_start = data.w_new_end = data.w_prev_end;
554 
555         /*
556          * Two iterations:
557          * 0.  All decoders that have the same name as their input type.
558          *     This allows for decoders that unwrap some data in a specific
559          *     encoding, and pass the result on with the same encoding.
560          * 1.  All decoders that a different name than their input type.
561          */
562         for (data.type_check = IS_SAME;
563              data.type_check <= IS_DIFFERENT;
564              data.type_check++) {
565             for (i = data.w_prev_start; i < data.w_prev_end; i++) {
566                 OSSL_DECODER_INSTANCE *decoder_inst =
567                     sk_OSSL_DECODER_INSTANCE_value(ctx->decoder_insts, i);
568 
569                 data.output_type
570                     = OSSL_DECODER_INSTANCE_get_input_type(decoder_inst);
571 
572                 data.output_type_id = 0;
573 
574                 for (j = 0; j < numdecoders; j++)
575                     collect_extra_decoder(sk_OSSL_DECODER_value(skdecoders, j),
576                                           &data);
577             }
578         }
579         /* How many were added in this iteration */
580         count = data.w_new_end - data.w_new_start;
581 
582         /* Slide the "previous decoder" windows */
583         data.w_prev_start = data.w_new_start;
584         data.w_prev_end = data.w_new_end;
585 
586         depth++;
587     } while (count != 0 && depth <= 10);
588 
589     sk_OSSL_DECODER_pop_free(skdecoders, OSSL_DECODER_free);
590     return 1;
591 }
592 
OSSL_DECODER_CTX_get_num_decoders(OSSL_DECODER_CTX * ctx)593 int OSSL_DECODER_CTX_get_num_decoders(OSSL_DECODER_CTX *ctx)
594 {
595     if (ctx == NULL || ctx->decoder_insts == NULL)
596         return 0;
597     return sk_OSSL_DECODER_INSTANCE_num(ctx->decoder_insts);
598 }
599 
OSSL_DECODER_CTX_set_construct(OSSL_DECODER_CTX * ctx,OSSL_DECODER_CONSTRUCT * construct)600 int OSSL_DECODER_CTX_set_construct(OSSL_DECODER_CTX *ctx,
601                                    OSSL_DECODER_CONSTRUCT *construct)
602 {
603     if (!ossl_assert(ctx != NULL)) {
604         ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_PASSED_NULL_PARAMETER);
605         return 0;
606     }
607     ctx->construct = construct;
608     return 1;
609 }
610 
OSSL_DECODER_CTX_set_construct_data(OSSL_DECODER_CTX * ctx,void * construct_data)611 int OSSL_DECODER_CTX_set_construct_data(OSSL_DECODER_CTX *ctx,
612                                         void *construct_data)
613 {
614     if (!ossl_assert(ctx != NULL)) {
615         ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_PASSED_NULL_PARAMETER);
616         return 0;
617     }
618     ctx->construct_data = construct_data;
619     return 1;
620 }
621 
OSSL_DECODER_CTX_set_cleanup(OSSL_DECODER_CTX * ctx,OSSL_DECODER_CLEANUP * cleanup)622 int OSSL_DECODER_CTX_set_cleanup(OSSL_DECODER_CTX *ctx,
623                                  OSSL_DECODER_CLEANUP *cleanup)
624 {
625     if (!ossl_assert(ctx != NULL)) {
626         ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_PASSED_NULL_PARAMETER);
627         return 0;
628     }
629     ctx->cleanup = cleanup;
630     return 1;
631 }
632 
633 OSSL_DECODER_CONSTRUCT *
OSSL_DECODER_CTX_get_construct(OSSL_DECODER_CTX * ctx)634 OSSL_DECODER_CTX_get_construct(OSSL_DECODER_CTX *ctx)
635 {
636     if (ctx == NULL)
637         return NULL;
638     return ctx->construct;
639 }
640 
OSSL_DECODER_CTX_get_construct_data(OSSL_DECODER_CTX * ctx)641 void *OSSL_DECODER_CTX_get_construct_data(OSSL_DECODER_CTX *ctx)
642 {
643     if (ctx == NULL)
644         return NULL;
645     return ctx->construct_data;
646 }
647 
648 OSSL_DECODER_CLEANUP *
OSSL_DECODER_CTX_get_cleanup(OSSL_DECODER_CTX * ctx)649 OSSL_DECODER_CTX_get_cleanup(OSSL_DECODER_CTX *ctx)
650 {
651     if (ctx == NULL)
652         return NULL;
653     return ctx->cleanup;
654 }
655 
OSSL_DECODER_export(OSSL_DECODER_INSTANCE * decoder_inst,void * reference,size_t reference_sz,OSSL_CALLBACK * export_cb,void * export_cbarg)656 int OSSL_DECODER_export(OSSL_DECODER_INSTANCE *decoder_inst,
657                         void *reference, size_t reference_sz,
658                         OSSL_CALLBACK *export_cb, void *export_cbarg)
659 {
660     OSSL_DECODER *decoder = NULL;
661     void *decoderctx = NULL;
662 
663     if (!(ossl_assert(decoder_inst != NULL)
664           && ossl_assert(reference != NULL)
665           && ossl_assert(export_cb != NULL)
666           && ossl_assert(export_cbarg != NULL))) {
667         ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_PASSED_NULL_PARAMETER);
668         return 0;
669     }
670 
671     decoder = OSSL_DECODER_INSTANCE_get_decoder(decoder_inst);
672     decoderctx = OSSL_DECODER_INSTANCE_get_decoder_ctx(decoder_inst);
673     return decoder->export_object(decoderctx, reference, reference_sz,
674                                   export_cb, export_cbarg);
675 }
676 
677 OSSL_DECODER *
OSSL_DECODER_INSTANCE_get_decoder(OSSL_DECODER_INSTANCE * decoder_inst)678 OSSL_DECODER_INSTANCE_get_decoder(OSSL_DECODER_INSTANCE *decoder_inst)
679 {
680     if (decoder_inst == NULL)
681         return NULL;
682     return decoder_inst->decoder;
683 }
684 
685 void *
OSSL_DECODER_INSTANCE_get_decoder_ctx(OSSL_DECODER_INSTANCE * decoder_inst)686 OSSL_DECODER_INSTANCE_get_decoder_ctx(OSSL_DECODER_INSTANCE *decoder_inst)
687 {
688     if (decoder_inst == NULL)
689         return NULL;
690     return decoder_inst->decoderctx;
691 }
692 
693 const char *
OSSL_DECODER_INSTANCE_get_input_type(OSSL_DECODER_INSTANCE * decoder_inst)694 OSSL_DECODER_INSTANCE_get_input_type(OSSL_DECODER_INSTANCE *decoder_inst)
695 {
696     if (decoder_inst == NULL)
697         return NULL;
698     return decoder_inst->input_type;
699 }
700 
701 const char *
OSSL_DECODER_INSTANCE_get_input_structure(OSSL_DECODER_INSTANCE * decoder_inst,int * was_set)702 OSSL_DECODER_INSTANCE_get_input_structure(OSSL_DECODER_INSTANCE *decoder_inst,
703                                           int *was_set)
704 {
705     if (decoder_inst == NULL)
706         return NULL;
707     *was_set = decoder_inst->flag_input_structure_was_set;
708     return decoder_inst->input_structure;
709 }
710 
decoder_process(const OSSL_PARAM params[],void * arg)711 static int decoder_process(const OSSL_PARAM params[], void *arg)
712 {
713     struct decoder_process_data_st *data = arg;
714     OSSL_DECODER_CTX *ctx = data->ctx;
715     OSSL_DECODER_INSTANCE *decoder_inst = NULL;
716     OSSL_DECODER *decoder = NULL;
717     OSSL_CORE_BIO *cbio = NULL;
718     BIO *bio = data->bio;
719     long loc;
720     size_t i;
721     int ok = 0;
722     /* For recursions */
723     struct decoder_process_data_st new_data;
724     const char *data_type = NULL;
725     const char *data_structure = NULL;
726 
727     /*
728      * This is an indicator up the call stack that something was indeed
729      * decoded, leading to a recursive call of this function.
730      */
731     data->flag_next_level_called = 1;
732 
733     memset(&new_data, 0, sizeof(new_data));
734     new_data.ctx = data->ctx;
735     new_data.recursion = data->recursion + 1;
736 
737 #define LEVEL_STR ">>>>>>>>>>>>>>>>"
738 #define LEVEL (new_data.recursion < sizeof(LEVEL_STR)                   \
739                ? &LEVEL_STR[sizeof(LEVEL_STR) - new_data.recursion - 1] \
740                : LEVEL_STR "...")
741 
742     if (params == NULL) {
743         /* First iteration, where we prepare for what is to come */
744 
745         OSSL_TRACE_BEGIN(DECODER) {
746             BIO_printf(trc_out,
747                        "(ctx %p) starting to walk the decoder chain\n",
748                        (void *)new_data.ctx);
749         } OSSL_TRACE_END(DECODER);
750 
751         data->current_decoder_inst_index =
752             OSSL_DECODER_CTX_get_num_decoders(ctx);
753 
754         bio = data->bio;
755     } else {
756         const OSSL_PARAM *p;
757         const char *trace_data_structure;
758 
759         decoder_inst =
760             sk_OSSL_DECODER_INSTANCE_value(ctx->decoder_insts,
761                                            data->current_decoder_inst_index);
762         decoder = OSSL_DECODER_INSTANCE_get_decoder(decoder_inst);
763 
764         data->flag_construct_called = 0;
765         if (ctx->construct != NULL) {
766             int rv;
767 
768             OSSL_TRACE_BEGIN(DECODER) {
769                 BIO_printf(trc_out,
770                            "(ctx %p) %s Running constructor\n",
771                            (void *)new_data.ctx, LEVEL);
772             } OSSL_TRACE_END(DECODER);
773 
774             rv = ctx->construct(decoder_inst, params, ctx->construct_data);
775 
776             OSSL_TRACE_BEGIN(DECODER) {
777                 BIO_printf(trc_out,
778                            "(ctx %p) %s Running constructor => %d\n",
779                            (void *)new_data.ctx, LEVEL, rv);
780             } OSSL_TRACE_END(DECODER);
781 
782             ok = (rv > 0);
783             if (ok) {
784                 data->flag_construct_called = 1;
785                 goto end;
786             }
787         }
788 
789         /* The constructor didn't return success */
790 
791         /*
792          * so we try to use the object we got and feed it to any next
793          * decoder that will take it.  Object references are not
794          * allowed for this.
795          * If this data isn't present, decoding has failed.
796          */
797 
798         p = OSSL_PARAM_locate_const(params, OSSL_OBJECT_PARAM_DATA);
799         if (p == NULL || p->data_type != OSSL_PARAM_OCTET_STRING)
800             goto end;
801         new_data.bio = BIO_new_mem_buf(p->data, (int)p->data_size);
802         if (new_data.bio == NULL)
803             goto end;
804         bio = new_data.bio;
805 
806         /* Get the data type if there is one */
807         p = OSSL_PARAM_locate_const(params, OSSL_OBJECT_PARAM_DATA_TYPE);
808         if (p != NULL && !OSSL_PARAM_get_utf8_string_ptr(p, &data_type))
809             goto end;
810 
811         /* Get the data structure if there is one */
812         p = OSSL_PARAM_locate_const(params, OSSL_OBJECT_PARAM_DATA_STRUCTURE);
813         if (p != NULL && !OSSL_PARAM_get_utf8_string_ptr(p, &data_structure))
814             goto end;
815 
816         /*
817          * If the data structure is "type-specific" and the data type is
818          * given, we drop the data structure.  The reasoning is that the
819          * data type is already enough to find the applicable next decoder,
820          * so an additional "type-specific" data structure is extraneous.
821          *
822          * Furthermore, if the OSSL_DECODER caller asked for a type specific
823          * structure under another name, such as "DH", we get a mismatch
824          * if the data structure we just received is "type-specific".
825          * There's only so much you can do without infusing this code with
826          * too special knowledge.
827          */
828         trace_data_structure = data_structure;
829         if (data_type != NULL && data_structure != NULL
830             && OPENSSL_strcasecmp(data_structure, "type-specific") == 0)
831             data_structure = NULL;
832 
833         OSSL_TRACE_BEGIN(DECODER) {
834             BIO_printf(trc_out,
835                        "(ctx %p) %s incoming from previous decoder (%p):\n"
836                        "    data type: %s, data structure: %s%s\n",
837                        (void *)new_data.ctx, LEVEL, (void *)decoder,
838                        data_type, trace_data_structure,
839                        (trace_data_structure == data_structure
840                         ? "" : " (dropped)"));
841         } OSSL_TRACE_END(DECODER);
842     }
843 
844     /*
845      * If we have no more decoders to look through at this point,
846      * we failed
847      */
848     if (data->current_decoder_inst_index == 0)
849         goto end;
850 
851     if ((loc = BIO_tell(bio)) < 0) {
852         ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_BIO_LIB);
853         goto end;
854     }
855 
856     if ((cbio = ossl_core_bio_new_from_bio(bio)) == NULL) {
857         ERR_raise(ERR_LIB_OSSL_DECODER, ERR_R_BIO_LIB);
858         goto end;
859     }
860 
861     for (i = data->current_decoder_inst_index; i-- > 0;) {
862         OSSL_DECODER_INSTANCE *new_decoder_inst =
863             sk_OSSL_DECODER_INSTANCE_value(ctx->decoder_insts, i);
864         OSSL_DECODER *new_decoder =
865             OSSL_DECODER_INSTANCE_get_decoder(new_decoder_inst);
866         void *new_decoderctx =
867             OSSL_DECODER_INSTANCE_get_decoder_ctx(new_decoder_inst);
868         const char *new_input_type =
869             OSSL_DECODER_INSTANCE_get_input_type(new_decoder_inst);
870         int n_i_s_was_set = 0;   /* We don't care here */
871         const char *new_input_structure =
872             OSSL_DECODER_INSTANCE_get_input_structure(new_decoder_inst,
873                                                       &n_i_s_was_set);
874 
875         OSSL_TRACE_BEGIN(DECODER) {
876             BIO_printf(trc_out,
877                        "(ctx %p) %s [%u] Considering decoder instance %p (decoder %p):\n"
878                        "    %s with %s\n",
879                        (void *)new_data.ctx, LEVEL, (unsigned int)i,
880                        (void *)new_decoder_inst, (void *)new_decoder,
881                        OSSL_DECODER_get0_name(new_decoder),
882                        OSSL_DECODER_get0_properties(new_decoder));
883         } OSSL_TRACE_END(DECODER);
884 
885         /*
886          * If |decoder| is NULL, it means we've just started, and the caller
887          * may have specified what it expects the initial input to be.  If
888          * that's the case, we do this extra check.
889          */
890         if (decoder == NULL && ctx->start_input_type != NULL
891             && OPENSSL_strcasecmp(ctx->start_input_type, new_input_type) != 0) {
892             OSSL_TRACE_BEGIN(DECODER) {
893                 BIO_printf(trc_out,
894                            "(ctx %p) %s [%u] the start input type '%s' doesn't match the input type of the considered decoder, skipping...\n",
895                            (void *)new_data.ctx, LEVEL, (unsigned int)i,
896                            ctx->start_input_type);
897             } OSSL_TRACE_END(DECODER);
898             continue;
899         }
900 
901         /*
902          * If we have a previous decoder, we check that the input type
903          * of the next to be used matches the type of this previous one.
904          * |new_input_type| holds the value of the "input-type" parameter
905          * for the decoder we're currently considering.
906          */
907         if (decoder != NULL && !ossl_decoder_fast_is_a(decoder, new_input_type,
908                                                        &new_decoder_inst->input_type_id)) {
909             OSSL_TRACE_BEGIN(DECODER) {
910                 BIO_printf(trc_out,
911                            "(ctx %p) %s [%u] the input type doesn't match the name of the previous decoder (%p), skipping...\n",
912                            (void *)new_data.ctx, LEVEL, (unsigned int)i,
913                            (void *)decoder);
914             } OSSL_TRACE_END(DECODER);
915             continue;
916         }
917 
918         /*
919          * If the previous decoder gave us a data type, we check to see
920          * if that matches the decoder we're currently considering.
921          */
922         if (data_type != NULL && !OSSL_DECODER_is_a(new_decoder, data_type)) {
923             OSSL_TRACE_BEGIN(DECODER) {
924                 BIO_printf(trc_out,
925                            "(ctx %p) %s [%u] the previous decoder's data type doesn't match the name of the considered decoder, skipping...\n",
926                            (void *)new_data.ctx, LEVEL, (unsigned int)i);
927             } OSSL_TRACE_END(DECODER);
928             continue;
929         }
930 
931         /*
932          * If the previous decoder gave us a data structure name, we check
933          * to see that it matches the input data structure of the decoder
934          * we're currently considering.
935          */
936         if (data_structure != NULL
937             && (new_input_structure == NULL
938                 || OPENSSL_strcasecmp(data_structure,
939                                       new_input_structure) != 0)) {
940             OSSL_TRACE_BEGIN(DECODER) {
941                 BIO_printf(trc_out,
942                            "(ctx %p) %s [%u] the previous decoder's data structure doesn't match the input structure of the considered decoder, skipping...\n",
943                            (void *)new_data.ctx, LEVEL, (unsigned int)i);
944             } OSSL_TRACE_END(DECODER);
945             continue;
946         }
947 
948         /*
949          * If the decoder we're currently considering specifies a structure,
950          * and this check hasn't already been done earlier in this chain of
951          * decoder_process() calls, check that it matches the user provided
952          * input structure, if one is given.
953          */
954         if (!data->flag_input_structure_checked
955             && ctx->input_structure != NULL
956             && new_input_structure != NULL) {
957             data->flag_input_structure_checked = 1;
958             if (OPENSSL_strcasecmp(new_input_structure,
959                                    ctx->input_structure) != 0) {
960                 OSSL_TRACE_BEGIN(DECODER) {
961                     BIO_printf(trc_out,
962                                "(ctx %p) %s [%u] the previous decoder's data structure doesn't match the input structure given by the user, skipping...\n",
963                                (void *)new_data.ctx, LEVEL, (unsigned int)i);
964                 } OSSL_TRACE_END(DECODER);
965                 continue;
966             }
967         }
968 
969         /*
970          * Checking the return value of BIO_reset() or BIO_seek() is unsafe.
971          * Furthermore, BIO_reset() is unsafe to use if the source BIO happens
972          * to be a BIO_s_mem(), because the earlier BIO_tell() gives us zero
973          * no matter where we are in the underlying buffer we're reading from.
974          *
975          * So, we simply do a BIO_seek(), and use BIO_tell() that we're back
976          * at the same position.  This is a best effort attempt, but BIO_seek()
977          * and BIO_tell() should come as a pair...
978          */
979         (void)BIO_seek(bio, loc);
980         if (BIO_tell(bio) != loc)
981             goto end;
982 
983         /* Recurse */
984         OSSL_TRACE_BEGIN(DECODER) {
985             BIO_printf(trc_out,
986                        "(ctx %p) %s [%u] Running decoder instance %p\n",
987                        (void *)new_data.ctx, LEVEL, (unsigned int)i,
988                        (void *)new_decoder_inst);
989         } OSSL_TRACE_END(DECODER);
990 
991         /*
992          * We only care about errors reported from decoder implementations
993          * if it returns false (i.e. there was a fatal error).
994          */
995         ERR_set_mark();
996 
997         new_data.current_decoder_inst_index = i;
998         new_data.flag_input_structure_checked
999             = data->flag_input_structure_checked;
1000         ok = new_decoder->decode(new_decoderctx, cbio,
1001                                  new_data.ctx->selection,
1002                                  decoder_process, &new_data,
1003                                  ossl_pw_passphrase_callback_dec,
1004                                  &new_data.ctx->pwdata);
1005 
1006         OSSL_TRACE_BEGIN(DECODER) {
1007             BIO_printf(trc_out,
1008                        "(ctx %p) %s [%u] Running decoder instance %p => %d"
1009                        " (recursed further: %s, construct called: %s)\n",
1010                        (void *)new_data.ctx, LEVEL, (unsigned int)i,
1011                        (void *)new_decoder_inst, ok,
1012                        new_data.flag_next_level_called ? "yes" : "no",
1013                        new_data.flag_construct_called ? "yes" : "no");
1014         } OSSL_TRACE_END(DECODER);
1015 
1016         data->flag_construct_called = new_data.flag_construct_called;
1017 
1018         /* Break on error or if we tried to construct an object already */
1019         if (!ok || data->flag_construct_called) {
1020             ERR_clear_last_mark();
1021             break;
1022         }
1023         ERR_pop_to_mark();
1024 
1025         /*
1026          * Break if the decoder implementation that we called recursed, since
1027          * that indicates that it successfully decoded something.
1028          */
1029         if (new_data.flag_next_level_called)
1030             break;
1031     }
1032 
1033  end:
1034     ossl_core_bio_free(cbio);
1035     BIO_free(new_data.bio);
1036     return ok;
1037 }
1038