1 /*
2 * Copyright 2018-2022 The OpenSSL Project Authors. All Rights Reserved.
3 *
4 * Licensed under the Apache License 2.0 (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
8 */
9
10 #include "../testutil.h"
11 #include <ctype.h>
12 #include <openssl/provider.h>
13 #include <openssl/core_names.h>
14 #include <string.h>
15
test_get_libctx(OSSL_LIB_CTX ** libctx,OSSL_PROVIDER ** default_null_prov,const char * config_file,OSSL_PROVIDER ** provider,const char * module_name)16 int test_get_libctx(OSSL_LIB_CTX **libctx, OSSL_PROVIDER **default_null_prov,
17 const char *config_file,
18 OSSL_PROVIDER **provider, const char *module_name)
19 {
20 OSSL_LIB_CTX *new_libctx = NULL;
21
22 if (libctx != NULL) {
23 if ((new_libctx = *libctx = OSSL_LIB_CTX_new()) == NULL) {
24 opt_printf_stderr("Failed to create libctx\n");
25 goto err;
26 }
27 }
28
29 if (default_null_prov != NULL
30 && (*default_null_prov = OSSL_PROVIDER_load(NULL, "null")) == NULL) {
31 opt_printf_stderr("Failed to load null provider into default libctx\n");
32 goto err;
33 }
34
35 if (config_file != NULL
36 && !OSSL_LIB_CTX_load_config(new_libctx, config_file)) {
37 opt_printf_stderr("Error loading config from file %s\n", config_file);
38 goto err;
39 }
40
41 if (module_name != NULL
42 && (*provider = OSSL_PROVIDER_load(new_libctx, module_name)) == NULL) {
43 opt_printf_stderr("Failed to load provider %s\n", module_name);
44 goto err;
45 }
46 return 1;
47
48 err:
49 ERR_print_errors_fp(stderr);
50 return 0;
51 }
52
test_arg_libctx(OSSL_LIB_CTX ** libctx,OSSL_PROVIDER ** default_null_prov,OSSL_PROVIDER ** provider,int argn,const char * usage)53 int test_arg_libctx(OSSL_LIB_CTX **libctx, OSSL_PROVIDER **default_null_prov,
54 OSSL_PROVIDER **provider, int argn, const char *usage)
55 {
56 const char *module_name;
57
58 if (!TEST_ptr(module_name = test_get_argument(argn))) {
59 TEST_error("usage: <prog> %s", usage);
60 return 0;
61 }
62 if (strcmp(module_name, "none") == 0)
63 return 1;
64 return test_get_libctx(libctx, default_null_prov,
65 test_get_argument(argn + 1), provider, module_name);
66 }
67
68 typedef struct {
69 int major, minor, patch;
70 } FIPS_VERSION;
71
72 /*
73 * Query the FIPS provider to determine it's version number.
74 * Returns 1 if the version is retrieved correctly, 0 if the FIPS provider isn't
75 * loaded and -1 on error.
76 */
fips_provider_version(OSSL_LIB_CTX * libctx,FIPS_VERSION * vers)77 static int fips_provider_version(OSSL_LIB_CTX *libctx, FIPS_VERSION *vers)
78 {
79 OSSL_PARAM params[2] = { OSSL_PARAM_END, OSSL_PARAM_END };
80 OSSL_PROVIDER *fips_prov;
81 char *vs;
82
83 if (!OSSL_PROVIDER_available(libctx, "fips"))
84 return 0;
85 *params = OSSL_PARAM_construct_utf8_ptr(OSSL_PROV_PARAM_VERSION, &vs, 0);
86 if ((fips_prov = OSSL_PROVIDER_load(libctx, "fips")) == NULL)
87 return -1;
88 if (!OSSL_PROVIDER_get_params(fips_prov, params)
89 || sscanf(vs, "%d.%d.%d", &vers->major, &vers->minor, &vers->patch) != 3)
90 goto err;
91 if (!OSSL_PROVIDER_unload(fips_prov))
92 return -1;
93 return 1;
94 err:
95 OSSL_PROVIDER_unload(fips_prov);
96 return -1;
97 }
98
fips_provider_version_eq(OSSL_LIB_CTX * libctx,int major,int minor,int patch)99 int fips_provider_version_eq(OSSL_LIB_CTX *libctx, int major, int minor, int patch)
100 {
101 FIPS_VERSION prov;
102 int res;
103
104 if ((res = fips_provider_version(libctx, &prov)) <= 0)
105 return res == 0;
106 return major == prov.major && minor == prov.minor && patch == prov.patch;
107 }
108
fips_provider_version_ne(OSSL_LIB_CTX * libctx,int major,int minor,int patch)109 int fips_provider_version_ne(OSSL_LIB_CTX *libctx, int major, int minor, int patch)
110 {
111 FIPS_VERSION prov;
112 int res;
113
114 if ((res = fips_provider_version(libctx, &prov)) <= 0)
115 return res == 0;
116 return major != prov.major || minor != prov.minor || patch != prov.patch;
117 }
118
fips_provider_version_le(OSSL_LIB_CTX * libctx,int major,int minor,int patch)119 int fips_provider_version_le(OSSL_LIB_CTX *libctx, int major, int minor, int patch)
120 {
121 FIPS_VERSION prov;
122 int res;
123
124 if ((res = fips_provider_version(libctx, &prov)) <= 0)
125 return res == 0;
126 return prov.major < major
127 || (prov.major == major
128 && (prov.minor < minor
129 || (prov.minor == minor && prov.patch <= patch)));
130 }
131
fips_provider_version_gt(OSSL_LIB_CTX * libctx,int major,int minor,int patch)132 int fips_provider_version_gt(OSSL_LIB_CTX *libctx, int major, int minor, int patch)
133 {
134 FIPS_VERSION prov;
135 int res;
136
137 if ((res = fips_provider_version(libctx, &prov)) <= 0)
138 return res == 0;
139 return prov.major > major
140 || (prov.major == major
141 && (prov.minor > minor
142 || (prov.minor == minor && prov.patch > patch)));
143 }
144
fips_provider_version_match(OSSL_LIB_CTX * libctx,const char * versions)145 int fips_provider_version_match(OSSL_LIB_CTX *libctx, const char *versions)
146 {
147 const char *p;
148 int major, minor, patch, r;
149 enum {
150 MODE_EQ, MODE_NE, MODE_LE, MODE_GT
151 } mode;
152
153 while (*versions != '\0') {
154 for (; isspace(*versions); versions++)
155 continue;
156 if (*versions == '\0')
157 break;
158 for (p = versions; *versions != '\0' && !isspace(*versions); versions++)
159 continue;
160 if (*p == '!') {
161 mode = MODE_NE;
162 p++;
163 } else if (*p == '=') {
164 mode = MODE_EQ;
165 p++;
166 } else if (*p == '<' && p[1] == '=') {
167 mode = MODE_LE;
168 p += 2;
169 } else if (*p == '>') {
170 mode = MODE_GT;
171 p++;
172 } else if (isdigit(*p)) {
173 mode = MODE_EQ;
174 } else {
175 TEST_info("Error matching FIPS version: mode %s\n", p);
176 return -1;
177 }
178 if (sscanf(p, "%d.%d.%d", &major, &minor, &patch) != 3) {
179 TEST_info("Error matching FIPS version: version %s\n", p);
180 return -1;
181 }
182 switch (mode) {
183 case MODE_EQ:
184 r = fips_provider_version_eq(libctx, major, minor, patch);
185 break;
186 case MODE_NE:
187 r = fips_provider_version_ne(libctx, major, minor, patch);
188 break;
189 case MODE_LE:
190 r = fips_provider_version_le(libctx, major, minor, patch);
191 break;
192 case MODE_GT:
193 r = fips_provider_version_gt(libctx, major, minor, patch);
194 break;
195 }
196 if (r < 0) {
197 TEST_info("Error matching FIPS version: internal error\n");
198 return -1;
199 }
200 if (r == 0)
201 return 0;
202 }
203 return 1;
204 }
205