From 942c7abebfdb11f07c2815937695c77da0089af2 Mon Sep 17 00:00:00 2001 From: Athul Mallappallil Date: Wed, 24 Jun 2026 07:03:01 +0000 Subject: [PATCH 01/14] Remove the duplicate header include for pkcs11 --- .../daemon/provider/pkcs11/detail/pkcs11_algorithm_info.hpp | 1 - .../daemon/provider/pkcs11/key_management/pkcs11_key_store.hpp | 1 - .../provider/pkcs11/operations/hash/pkcs11_hash_context.hpp | 1 - .../provider/pkcs11/operations/hash/pkcs11_hash_handler.hpp | 1 - .../operations/key_management/pkcs11_key_management_handler.hpp | 1 - .../daemon/provider/pkcs11/operations/mac/pkcs11_mac_context.hpp | 1 - .../provider/pkcs11/operations/mac/pkcs11_mac_executor.hpp | 1 - .../daemon/provider/pkcs11/operations/mac/pkcs11_mac_handler.hpp | 1 - score/crypto/daemon/provider/pkcs11/pkcs11_module.hpp | 1 - score/crypto/daemon/provider/pkcs11/pkcs11_provider.hpp | 1 - 10 files changed, 10 deletions(-) diff --git a/score/crypto/daemon/provider/pkcs11/detail/pkcs11_algorithm_info.hpp b/score/crypto/daemon/provider/pkcs11/detail/pkcs11_algorithm_info.hpp index 22cbc9e1..a98cb384 100644 --- a/score/crypto/daemon/provider/pkcs11/detail/pkcs11_algorithm_info.hpp +++ b/score/crypto/daemon/provider/pkcs11/detail/pkcs11_algorithm_info.hpp @@ -16,7 +16,6 @@ #include "score/crypto/daemon/common/types.hpp" -#include #include #include diff --git a/score/crypto/daemon/provider/pkcs11/key_management/pkcs11_key_store.hpp b/score/crypto/daemon/provider/pkcs11/key_management/pkcs11_key_store.hpp index 9b4a9413..05583140 100644 --- a/score/crypto/daemon/provider/pkcs11/key_management/pkcs11_key_store.hpp +++ b/score/crypto/daemon/provider/pkcs11/key_management/pkcs11_key_store.hpp @@ -17,7 +17,6 @@ #include "score/crypto/daemon/common/daemon_error.hpp" #include "score/crypto/daemon/key_management/interfaces/key_types.hpp" -#include #include #include diff --git a/score/crypto/daemon/provider/pkcs11/operations/hash/pkcs11_hash_context.hpp b/score/crypto/daemon/provider/pkcs11/operations/hash/pkcs11_hash_context.hpp index 84a86ea6..502dc25e 100644 --- a/score/crypto/daemon/provider/pkcs11/operations/hash/pkcs11_hash_context.hpp +++ b/score/crypto/daemon/provider/pkcs11/operations/hash/pkcs11_hash_context.hpp @@ -14,7 +14,6 @@ #ifndef SCORE_CRYPTO_DAEMON_PROVIDER_PKCS11_HASH_CONTEXT_HPP #define SCORE_CRYPTO_DAEMON_PROVIDER_PKCS11_HASH_CONTEXT_HPP -#include #include #include diff --git a/score/crypto/daemon/provider/pkcs11/operations/hash/pkcs11_hash_handler.hpp b/score/crypto/daemon/provider/pkcs11/operations/hash/pkcs11_hash_handler.hpp index 116e40d9..c87e4e80 100644 --- a/score/crypto/daemon/provider/pkcs11/operations/hash/pkcs11_hash_handler.hpp +++ b/score/crypto/daemon/provider/pkcs11/operations/hash/pkcs11_hash_handler.hpp @@ -21,7 +21,6 @@ #include "score/crypto/daemon/provider/pkcs11/operations/hash/pkcs11_hash_executor.hpp" #include "score/crypto/daemon/provider/pkcs11/pkcs11_module.hpp" -#include #include #include diff --git a/score/crypto/daemon/provider/pkcs11/operations/key_management/pkcs11_key_management_handler.hpp b/score/crypto/daemon/provider/pkcs11/operations/key_management/pkcs11_key_management_handler.hpp index 299344aa..4bbec6df 100644 --- a/score/crypto/daemon/provider/pkcs11/operations/key_management/pkcs11_key_management_handler.hpp +++ b/score/crypto/daemon/provider/pkcs11/operations/key_management/pkcs11_key_management_handler.hpp @@ -22,7 +22,6 @@ #include "score/crypto/daemon/provider/executors/key_mgmt_executor.hpp" #include "score/crypto/daemon/provider/handler/i_handler.hpp" -#include #include #include diff --git a/score/crypto/daemon/provider/pkcs11/operations/mac/pkcs11_mac_context.hpp b/score/crypto/daemon/provider/pkcs11/operations/mac/pkcs11_mac_context.hpp index cff0d883..bcb2389b 100644 --- a/score/crypto/daemon/provider/pkcs11/operations/mac/pkcs11_mac_context.hpp +++ b/score/crypto/daemon/provider/pkcs11/operations/mac/pkcs11_mac_context.hpp @@ -16,7 +16,6 @@ #include "score/mw/crypto/api/common/types.hpp" // OperationMode -#include #include #include diff --git a/score/crypto/daemon/provider/pkcs11/operations/mac/pkcs11_mac_executor.hpp b/score/crypto/daemon/provider/pkcs11/operations/mac/pkcs11_mac_executor.hpp index a007cbfe..40793d62 100644 --- a/score/crypto/daemon/provider/pkcs11/operations/mac/pkcs11_mac_executor.hpp +++ b/score/crypto/daemon/provider/pkcs11/operations/mac/pkcs11_mac_executor.hpp @@ -20,7 +20,6 @@ #include "score/crypto/daemon/provider/pkcs11/operations/mac/pkcs11_mac_context.hpp" #include "score/mw/crypto/api/common/types.hpp" // OperationMode -#include #include #include diff --git a/score/crypto/daemon/provider/pkcs11/operations/mac/pkcs11_mac_handler.hpp b/score/crypto/daemon/provider/pkcs11/operations/mac/pkcs11_mac_handler.hpp index 50be7b58..e85df294 100644 --- a/score/crypto/daemon/provider/pkcs11/operations/mac/pkcs11_mac_handler.hpp +++ b/score/crypto/daemon/provider/pkcs11/operations/mac/pkcs11_mac_handler.hpp @@ -23,7 +23,6 @@ #include "score/crypto/daemon/provider/pkcs11/operations/mac/pkcs11_mac_executor.hpp" #include "score/crypto/daemon/provider/pkcs11/pkcs11_module.hpp" -#include #include #include diff --git a/score/crypto/daemon/provider/pkcs11/pkcs11_module.hpp b/score/crypto/daemon/provider/pkcs11/pkcs11_module.hpp index 2061057b..8d2abaca 100644 --- a/score/crypto/daemon/provider/pkcs11/pkcs11_module.hpp +++ b/score/crypto/daemon/provider/pkcs11/pkcs11_module.hpp @@ -17,7 +17,6 @@ #include "score/crypto/common/types.hpp" #include "score/crypto/daemon/common/daemon_error.hpp" -#include #include #include diff --git a/score/crypto/daemon/provider/pkcs11/pkcs11_provider.hpp b/score/crypto/daemon/provider/pkcs11/pkcs11_provider.hpp index 0fc2631f..115d8c4e 100644 --- a/score/crypto/daemon/provider/pkcs11/pkcs11_provider.hpp +++ b/score/crypto/daemon/provider/pkcs11/pkcs11_provider.hpp @@ -23,7 +23,6 @@ #include "score/crypto/daemon/provider/pkcs11/operations/factory/pkcs11_handler_factory.hpp" #include "score/crypto/daemon/provider/pkcs11/operations/key_management/pkcs11_key_management_handler.hpp" #include "score/crypto/daemon/provider/pkcs11/pkcs11_module.hpp" -#include #include #include From 21eb38ea650c397314a3aac9d053af25b17f2d32 Mon Sep 17 00:00:00 2001 From: Athul Mallappallil Date: Thu, 9 Jul 2026 09:58:09 +0000 Subject: [PATCH 02/14] Support preference order for default provider type - Only used when no config is provided --- .../daemon/provider/provider_manager.hpp | 8 +++++- .../daemon/provider/src/provider_manager.cpp | 26 +++++++++---------- 2 files changed, 19 insertions(+), 15 deletions(-) diff --git a/score/crypto/daemon/provider/provider_manager.hpp b/score/crypto/daemon/provider/provider_manager.hpp index ad7036ba..fc06bf20 100644 --- a/score/crypto/daemon/provider/provider_manager.hpp +++ b/score/crypto/daemon/provider/provider_manager.hpp @@ -237,10 +237,16 @@ class ProviderManager * The default configuration: * - Enables all available providers * - Sets first available provider as default for basic types + * - Uses preference order to select the DEFAULT provider type * + * @param preferenceOrder Priority order for selecting default provider. + * Defaults to HARDWARE → SOFTWARE fallback. * @return ProviderInitConfig with default settings */ - config::ProviderInitConfig CreateDefaultConfig(); + config::ProviderInitConfig CreateDefaultConfig( + const std::vector& preferenceOrder = { + common::CryptoProviderType::HARDWARE, + common::CryptoProviderType::SOFTWARE}); /** * @brief Invoke all registered factories to create and register providers. diff --git a/score/crypto/daemon/provider/src/provider_manager.cpp b/score/crypto/daemon/provider/src/provider_manager.cpp index e6163eb8..ac39bb74 100644 --- a/score/crypto/daemon/provider/src/provider_manager.cpp +++ b/score/crypto/daemon/provider/src/provider_manager.cpp @@ -54,7 +54,8 @@ bool ProviderManager::Initialize() return InitializeAll(); } -config::ProviderInitConfig ProviderManager::CreateDefaultConfig() +config::ProviderInitConfig ProviderManager::CreateDefaultConfig( + const std::vector& preferenceOrder) { config::ProviderInitConfig config; @@ -76,30 +77,27 @@ config::ProviderInitConfig ProviderManager::CreateDefaultConfig() if (config.typeToProviderId.find(common::CryptoProviderType::DEFAULT) == config.typeToProviderId.end()) { - // Prefer the HARDWARE provider (e.g., SoftHSM/PKCS#11) as DEFAULT when available, - // falling back to SOFTWARE (OpenSSL) and then the first registered provider. + // Select default provider based on preference order parameter common::ProviderId defaultId = common::kInvalidProviderId; - // Search for HARDWARE or SOFTWARE provider - for (const auto& entry : m_providers) - { - if (entry.second.cryptoType == common::CryptoProviderType::HARDWARE) - { - defaultId = entry.second.numeric_id; - break; - } - } - if (defaultId == common::kInvalidProviderId) + // Try each type in the preference order + for (const auto& preferredType : preferenceOrder) { for (const auto& entry : m_providers) { - if (entry.second.cryptoType == common::CryptoProviderType::SOFTWARE) + if (entry.second.cryptoType == preferredType) { defaultId = entry.second.numeric_id; break; } } + if (defaultId != common::kInvalidProviderId) + { + break; + } } + + // If no provider found via preference order, use first registered provider if (defaultId == common::kInvalidProviderId) { defaultId = firstProviderId; From dd30c7b02a0ab13f13de7dbfd18a6e42e6673af5 Mon Sep 17 00:00:00 2001 From: Athul Mallappallil Date: Thu, 16 Jul 2026 13:12:40 +0000 Subject: [PATCH 03/14] Adapt the third party build targets --- tests/demo/BUILD | 2 +- tests/integration_tests/BUILD | 6 +-- .../integration_tests/init_softhsm_token.cpp | 1 - tests/integration_tests/integration_test.py | 9 ++-- tests/key_management/BUILD | 2 +- tests/openssl/block_cipher/ECB-AES128/BUILD | 2 +- tests/provider_test/BUILD | 4 +- tests/softhsm/BUILD | 2 +- tests/softhsm/block_cipher/ECB-AES128/BUILD | 2 +- third_party/openssl/BUILD | 52 ++++++++++++++----- third_party/soft_hsm/BUILD | 41 ++++++++++++--- 11 files changed, 89 insertions(+), 34 deletions(-) diff --git a/tests/demo/BUILD b/tests/demo/BUILD index 23508764..532d5bbe 100644 --- a/tests/demo/BUILD +++ b/tests/demo/BUILD @@ -24,7 +24,7 @@ cc_test( "//score/crypto/daemon/provider:provider_headers", "//score/crypto/daemon/provider/score_provider/openssl:provider_openssl_library", "//score/crypto/daemon/provider/score_provider/operations/mac:score_mac_handler", - "//third_party/openssl", + "//third_party/openssl:openssl", "@googletest//:gtest_main", ], ) diff --git a/tests/integration_tests/BUILD b/tests/integration_tests/BUILD index 0d40463a..53a20916 100644 --- a/tests/integration_tests/BUILD +++ b/tests/integration_tests/BUILD @@ -29,7 +29,7 @@ cc_binary( name = "init_softhsm_token", srcs = ["init_softhsm_token.cpp"], deps = [ - "//third_party/soft_hsm:libsofthsm_shared", + "//third_party/soft_hsm:softhsm", ], ) @@ -95,8 +95,8 @@ py_itf_test( "//score/crypto/daemon:crypto_daemon", "//tests/config:logging.json", "//third_party/grpc:libgrpc_shared", - "//third_party/openssl:openssl_shared", - "//third_party/soft_hsm:soft_hsm_cmake", + "//third_party/openssl:openssl_so", + "//third_party/soft_hsm:softhsm_so", ], plugins = [ "itf.plugins.docker", diff --git a/tests/integration_tests/init_softhsm_token.cpp b/tests/integration_tests/init_softhsm_token.cpp index 5f20a449..dbca011e 100644 --- a/tests/integration_tests/init_softhsm_token.cpp +++ b/tests/integration_tests/init_softhsm_token.cpp @@ -29,7 +29,6 @@ /// Designed to run inside a Docker container as part of integration-test setup, /// avoiding any dependency on the host-side `softhsm2-util` package. -#include #include #include diff --git a/tests/integration_tests/integration_test.py b/tests/integration_tests/integration_test.py index b82499bf..db08795f 100644 --- a/tests/integration_tests/integration_test.py +++ b/tests/integration_tests/integration_test.py @@ -198,11 +198,14 @@ def setup_container(self, docker): Path("third_party/grpc/libgrpc++.so.1"): Path( "/opt/crypto/lib/libgrpc++.so.1" ), - Path("third_party/openssl/libopenssl.so.3"): Path( - "/opt/crypto/lib/libopenssl.so.3" + Path("third_party/openssl/libcrypto.so.3"): Path( + "/opt/crypto/lib/libcrypto.so.3" + ), + Path("third_party/openssl/libssl.so.3"): Path( + "/opt/crypto/lib/libssl.so.3" ), Path( - "third_party/soft_hsm/soft_hsm_cmake/lib/softhsm/libsofthsm2.so" + "third_party/soft_hsm/libsofthsm2.so" ): Path("/opt/crypto/lib/libsofthsm2.so"), Path("tests/test_vectors/config/integration_test_config.bin"): Path( self.CRYPTO_CONFIG_PATH diff --git a/tests/key_management/BUILD b/tests/key_management/BUILD index 611bc3fd..22a65e7e 100644 --- a/tests/key_management/BUILD +++ b/tests/key_management/BUILD @@ -78,7 +78,7 @@ cc_test( "//score/crypto/daemon/provider/executors:key_mgmt_executor", "//score/crypto/daemon/provider/pkcs11:provider_pkcs11_library", "//tests/softhsm:softhsm_test_fixture", - "//third_party/soft_hsm:libsofthsm_shared", + "//third_party/soft_hsm:softhsm", "@googletest//:gtest_main", ], ) diff --git a/tests/openssl/block_cipher/ECB-AES128/BUILD b/tests/openssl/block_cipher/ECB-AES128/BUILD index 67a89ae9..bf3c2a10 100644 --- a/tests/openssl/block_cipher/ECB-AES128/BUILD +++ b/tests/openssl/block_cipher/ECB-AES128/BUILD @@ -24,7 +24,7 @@ cc_test( ], deps = [ "//tests/utility", - "//third_party/openssl", + "//third_party/openssl:openssl", "@googletest//:gtest", ], ) diff --git a/tests/provider_test/BUILD b/tests/provider_test/BUILD index 43d24bc1..5614f04c 100644 --- a/tests/provider_test/BUILD +++ b/tests/provider_test/BUILD @@ -38,7 +38,7 @@ cc_test( "//score/crypto/daemon/provider/handler:hash_handler_operations", "//score/crypto/daemon/provider/pkcs11:provider_pkcs11_library", "//tests/utility", - "//third_party/soft_hsm:libsofthsm_shared", + "//third_party/soft_hsm:softhsm", "@googletest//:gtest", ], ) @@ -51,7 +51,7 @@ cc_test( "//score/crypto/daemon/provider:provider_headers", "//score/crypto/daemon/provider:provider_manager", "//score/crypto/daemon/provider/pkcs11:provider_pkcs11_library", - "//third_party/soft_hsm:libsofthsm_shared", + "//third_party/soft_hsm:softhsm", "@googletest//:gtest", ], ) diff --git a/tests/softhsm/BUILD b/tests/softhsm/BUILD index 04894c17..5bf63c1a 100644 --- a/tests/softhsm/BUILD +++ b/tests/softhsm/BUILD @@ -20,7 +20,7 @@ cc_library( includes = ["."], visibility = ["//:__subpackages__"], deps = [ - "//third_party/soft_hsm:libsofthsm_shared", + "//third_party/soft_hsm:softhsm", "@googletest//:gtest", ], ) diff --git a/tests/softhsm/block_cipher/ECB-AES128/BUILD b/tests/softhsm/block_cipher/ECB-AES128/BUILD index 315cd3df..e95f68d0 100644 --- a/tests/softhsm/block_cipher/ECB-AES128/BUILD +++ b/tests/softhsm/block_cipher/ECB-AES128/BUILD @@ -22,7 +22,7 @@ cc_test( linkstatic = True, deps = [ "//tests/utility", - "//third_party/soft_hsm:libsofthsm_shared", + "//third_party/soft_hsm:softhsm", "@googletest//:gtest", "@googletest//:gtest_main", ], diff --git a/third_party/openssl/BUILD b/third_party/openssl/BUILD index 2b2ffdfb..2dd3f108 100644 --- a/third_party/openssl/BUILD +++ b/third_party/openssl/BUILD @@ -13,6 +13,7 @@ load("@rules_cc//cc:defs.bzl", "cc_library") load("@rules_foreign_cc//foreign_cc:defs.bzl", "configure_make") +load("@rules_cc//cc:defs.bzl", "cc_shared_library") # OpenSSL build using rules_foreign_cc # Configure options reference for OpenSSL 3.6.1: @@ -36,7 +37,7 @@ configure_make( "//platforms:is_linux_aarch64": ["linux-aarch64"], "//conditions:default": [], }) + [ - "no-shared", + "shared", # Build shared libraries (libcrypto.so, libssl.so) "no-asm", # Disable assembly optimizations to avoid GCC inline assembly issues "no-threads", # Disable threading to avoid pthread requirement on QNX "no-makedepend", # Disable dependency generation that causes QCC issues @@ -109,30 +110,57 @@ configure_make( }), lib_source = "@openssl_source//:all", out_lib_dir = "lib", - out_static_libs = [ - "libcrypto.a", - "libssl.a", + out_shared_libs = [ + "libcrypto.so", + "libcrypto.so.3", + "libssl.so", + "libssl.so.3", ], + out_include_dir = "include", tags = ["no-sandbox"], targets = [ "build_libs", "install_dev", ], - visibility = ["//third_party/openssl:__subpackages__"], + visibility = [ + "//third_party/openssl:__subpackages__", + ], ) cc_library( name = "openssl", + linkstatic = False, visibility = ["//:__subpackages__"], deps = [":openssl_make"], ) -cc_shared_library( - name = "openssl_shared", - shared_lib_name = "libopenssl.so.3", - visibility = ["//visibility:public"], - deps = [ - ":openssl", - ":openssl_make", +# Extract the versioned .so files from the cmake output so they can be used +# as plain data files in runfiles (e.g. py_itf_test copying into Docker). +# cc_library (openssl) handles compile-time headers and dynamic linking; +# these genrules serve only the data= / file-copy use case. +genrule( + name = "openssl_libcrypto_so_extract", + srcs = [":openssl_make"], + outs = ["libcrypto.so.3"], + cmd = "for f in $(locations :openssl_make); do case $$f in *libcrypto.so.3) cp $$f $@; break;; esac; done", + visibility = ["//visibility:private"], +) + +genrule( + name = "openssl_libssl_so_extract", + srcs = [":openssl_make"], + outs = ["libssl.so.3"], + cmd = "for f in $(locations :openssl_make); do case $$f in *libssl.so.3) cp $$f $@; break;; esac; done", + visibility = ["//visibility:private"], +) + +# Single public target for all consumers that need the OpenSSL .so files as +# data (runfiles). Mirrors the pattern used for softhsm_so. +filegroup( + name = "openssl_so", + srcs = [ + ":openssl_libcrypto_so_extract", + ":openssl_libssl_so_extract", ], + visibility = ["//:__subpackages__"], ) diff --git a/third_party/soft_hsm/BUILD b/third_party/soft_hsm/BUILD index 26d18d09..8097e879 100644 --- a/third_party/soft_hsm/BUILD +++ b/third_party/soft_hsm/BUILD @@ -13,6 +13,7 @@ load("@rules_cc//cc:defs.bzl", "cc_library") load("@rules_foreign_cc//foreign_cc:defs.bzl", "cmake") +load("@rules_cc//cc:defs.bzl", "cc_shared_library") # SoftHSM build using rules_foreign_cc cmake # CMake build options reference for SoftHSM 2.7.0: @@ -51,7 +52,7 @@ cmake( "RUN_AES_KEY_WRAP_PAD": "0", "RUN_AES_KEY_WRAP_PAD__TRYRUN_OUTPUT": "", }, - dynamic_deps = ["//third_party/openssl:openssl_shared"], + deps = ["//third_party/openssl:openssl"], env = select({ "//platforms:is_qnx_aarch64": { # EXT_BUILD_ROOT is captured at the start of the build script (before any cd), @@ -71,8 +72,9 @@ cmake( "libsofthsm2.so", ], tags = ["no-sandbox"], - visibility = ["//visibility:public"], - deps = ["//third_party/openssl"], + visibility = [ + "//third_party/soft_hsm:__pkg__", # Internal wrappers + ], ) # Extract PKCS#11 headers from SoftHSM source for public consumption @@ -80,23 +82,46 @@ genrule( name = "extract_pkcs11_headers", srcs = ["@softhsm_source//:all"], outs = [ - "include/cryptoki.h", +# "include/cryptoki.h", "include/pkcs11.h", ], cmd = """ SRCDIR=$$(dirname $$(echo $(locations @softhsm_source//:all) | awk '{print $$1}')) mkdir -p $(RULEDIR)/include - cp $$SRCDIR/src/lib/pkcs11/cryptoki.h $(RULEDIR)/include/ cp $$SRCDIR/src/lib/pkcs11/pkcs11.h $(RULEDIR)/include/ """, visibility = ["//visibility:private"], ) -# soft_hsm_cmake only produces a shared library; cc_shared_library not required. +# Softhsm pkcs11 target for linking and header consumption cc_library( - name = "libsofthsm_shared", + name = "softhsm", + linkstatic = False, hdrs = [":extract_pkcs11_headers"], includes = ["include"], - visibility = ["//visibility:public"], + visibility = ["//:__subpackages__"], deps = [":soft_hsm_cmake"], ) + +# Extract libsofthsm2.so from the cmake output directory into a +# standalone declared file so that cc_import can reference it as a label +# (cc_import's shared_library must be a source or declared generated file, +# not an implicit path into a foreign_cc output tree). +genrule( + name = "softhsm_so_extract", + srcs = [":soft_hsm_cmake"], + outs = ["libsofthsm2.so"], + # $(locations :soft_hsm_cmake) expands to all cmake output paths; pick the .so. + cmd = "for f in $(locations :soft_hsm_cmake); do case $$f in *libsofthsm2.so) cp $$f $@; break;; esac; done", + visibility = ["//visibility:private"], +) + +# Data dependency for targets that need libsofthsm2.so as a plain file in +# runfiles (e.g. py_itf_test copying it into a Docker container). +# This mirrors the cc_shared_library pattern used by grpc/openssl: the .so +# appears as a default output and is therefore visible in Bazel runfiles. +filegroup( + name = "softhsm_so", + srcs = [":softhsm_so_extract"], + visibility = ["//:__subpackages__"], +) From 228330d8ac6db6a4df5fa1b5541ebb81e57a8dbd Mon Sep 17 00:00:00 2001 From: Athul Mallappallil Date: Thu, 16 Jul 2026 13:17:08 +0000 Subject: [PATCH 04/14] Create Provider manager factory --- score/crypto/daemon/BUILD | 5 +- score/crypto/daemon/config/inc/config.hpp | 10 +- score/crypto/daemon/config/src/config.cpp | 6 +- .../provider/provider_manager_factory.hpp | 96 ++++++++++++++++++ .../provider/src/provider_manager_factory.cpp | 97 +++++++++++++++++++ score/crypto/daemon/src/daemon.cpp | 34 ++----- 6 files changed, 213 insertions(+), 35 deletions(-) create mode 100644 score/crypto/daemon/provider/provider_manager_factory.hpp create mode 100644 score/crypto/daemon/provider/src/provider_manager_factory.cpp diff --git a/score/crypto/daemon/BUILD b/score/crypto/daemon/BUILD index 615a048f..06ff8322 100644 --- a/score/crypto/daemon/BUILD +++ b/score/crypto/daemon/BUILD @@ -25,7 +25,6 @@ cc_binary( ], }), dynamic_deps = [ - "//third_party/openssl:openssl_shared", "//third_party/grpc:libgrpc_shared", ], includes = ["IPC"], @@ -42,9 +41,7 @@ cc_binary( "//score/crypto/daemon/control_plane", "//score/crypto/daemon/data_manager", "//score/crypto/daemon/mediator", - "//score/crypto/daemon/provider:provider_manager", - "//score/crypto/daemon/provider/pkcs11:provider_pkcs11_factory", - "//score/crypto/daemon/provider/score_provider:score_provider_factory", + "//score/crypto/daemon/provider:provider_manager_factory", "//score/crypto/ipc:ipc_config", "//score/crypto/ipc/grpc_adapter:grpc_control_server", ], diff --git a/score/crypto/daemon/config/inc/config.hpp b/score/crypto/daemon/config/inc/config.hpp index 50691547..81d518bd 100644 --- a/score/crypto/daemon/config/inc/config.hpp +++ b/score/crypto/daemon/config/inc/config.hpp @@ -463,8 +463,14 @@ class Config const std::string& value, const std::string& option, std::string& target); - bool ParseUint32Arg(const std::string& arg, const std::string& value, const std::string& option, uint32_t& target); - bool ParseUint16Arg(const std::string& arg, const std::string& value, const std::string& option, uint16_t& target); + bool ParseUint32Arg(const std::string& arg, + const std::string& value, + const std::string& option, + uint32_t& target); + bool ParseUint16Arg(const std::string& arg, + const std::string& value, + const std::string& option, + uint16_t& target); }; } // namespace score::crypto::daemon::config diff --git a/score/crypto/daemon/config/src/config.cpp b/score/crypto/daemon/config/src/config.cpp index 2762a9d9..a5ca3d7b 100644 --- a/score/crypto/daemon/config/src/config.cpp +++ b/score/crypto/daemon/config/src/config.cpp @@ -90,15 +90,15 @@ bool Config::ParseConfig() struct stat st_cfg; if (::stat(config_file_path, &st_cfg) != 0) { - score::mw::log::LogError() << "[CONFIG] Configuration file does not exist:" << config_file_path; + score::mw::log::LogError() << "[CONFIG] Configuration file does not exist:" << std::string(config_file_path); return false; } - score::mw::log::LogDebug() << "[CONFIG] Parsing configuration from:" << config_file_path; + score::mw::log::LogDebug() << "[CONFIG] Parsing configuration from:" << std::string(config_file_path); auto result = FlatBufferConfigParser::ParseFromFile(config_file_path, m_key); if (!result.has_value()) { score::mw::log::LogError() << "[CONFIG] Failed to parse FlatBuffers configuration file: " - << config_file_path; + << std::string(config_file_path); return false; } return true; diff --git a/score/crypto/daemon/provider/provider_manager_factory.hpp b/score/crypto/daemon/provider/provider_manager_factory.hpp new file mode 100644 index 00000000..485d4ca9 --- /dev/null +++ b/score/crypto/daemon/provider/provider_manager_factory.hpp @@ -0,0 +1,96 @@ +/******************************************************************************** + * Copyright (c) 2026 Contributors to the Eclipse Foundation + * + * See the NOTICE file(s) distributed with this work for additional + * information regarding copyright ownership. + * + * This program and the accompanying materials are made available under the + * terms of the Apache License Version 2.0 which is available at + * https://www.apache.org/licenses/LICENSE-2.0 + * + * SPDX-License-Identifier: Apache-2.0 + ********************************************************************************/ + +#ifndef SCORE_CRYPTO_DAEMON_PROVIDER_MANAGER_FACTORY_HPP +#define SCORE_CRYPTO_DAEMON_PROVIDER_MANAGER_FACTORY_HPP + +#include + +#include "provider_manager.hpp" +#include "score/crypto/daemon/config/inc/config.hpp" + +namespace score::crypto::daemon::provider +{ + +/** + * @brief Factory for creating and initializing ProviderManager instances + * + * This factory encapsulates the complete setup of a ProviderManager: + * 1. Discover active backends from compile-time list (backend/BUILD) + * 2. Parse provider configurations + * 3. Create provider factories for enabled backends + * 4. Register factories with the provider manager + * 5. Initialize all providers + * + * Backend discovery uses dependency injection: + * - Score backends: Compile-time list from backend/active_backends_list.hpp + * - PKCS#11 backend: Conditionally created based on configuration + * + * Usage: + * @code + * Config config; + * config.ParseConfig(); + * auto provider_manager = ProviderManagerFactory::Create(config); + * @endcode + */ +class ProviderManagerFactory +{ + public: + /** + * @brief Create and initialize a fully configured ProviderManager + * + * This method: + * - Discovers active score backends (compile-time) + * - Invokes ParseConfig() on each provider-specific config section + * - Creates and configures provider factories + * - Registers factories with the provider manager + * - Calls Initialize() on the provider manager + * + * @param config The daemon configuration containing provider settings + * @return Shared pointer to initialized ProviderManager + * @throws std::runtime_error if initialization fails + */ + static std::shared_ptr Create(config::Config& config); + + private: + ProviderManagerFactory() = delete; + + /** + * @brief Create score provider factory if backends enabled + * + * Discovers active backends from backend/active_backends_list.hpp + * (controlled by backend/BUILD). Creates a single ScoreProviderFactory + * that handles all enabled score backends (OpenSSL, Primula, etc.). + * + * @param config Configuration containing score provider settings + * @return unique_ptr to ScoreProviderFactory if score backends enabled, + * nullptr if ENABLE_SCORE_BACKEND = False + */ + static std::unique_ptr CreateScoreProviderFactory(config::Config& config); + + /** + * @brief Create PKCS#11 provider factory if configured + * + * Checks PKCS#11 configuration and creates factory only if + * PKCS#11 providers are configured in the config. + * + * @param config Configuration containing PKCS#11 settings + * @return unique_ptr to Pkcs11ProviderFactory if configured, + * nullptr if PKCS#11 disabled or not configured + */ + static std::unique_ptr CreatePkcs11ProviderFactory(config::Config& config); +}; + +} // namespace score::crypto::daemon::provider + +#endif // SCORE_CRYPTO_DAEMON_PROVIDER_MANAGER_FACTORY_HPP diff --git a/score/crypto/daemon/provider/src/provider_manager_factory.cpp b/score/crypto/daemon/provider/src/provider_manager_factory.cpp new file mode 100644 index 00000000..f4c2babb --- /dev/null +++ b/score/crypto/daemon/provider/src/provider_manager_factory.cpp @@ -0,0 +1,97 @@ +/******************************************************************************** + * Copyright (c) 2026 Contributors to the Eclipse Foundation + * + * See the NOTICE file(s) distributed with this work for additional + * information regarding copyright ownership. + * + * This program and the accompanying materials are made available under the + * terms of the Apache License Version 2.0 which is available at + * https://www.apache.org/licenses/LICENSE-2.0 + * + * SPDX-License-Identifier: Apache-2.0 + ********************************************************************************/ + +#include "score/crypto/daemon/provider/provider_manager_factory.hpp" + +#if SCORE_BACKEND_ENABLED + #include "score/crypto/daemon/provider/score_provider/score_provider_factory.hpp" +#endif + +#if SCORE_CRYPTO_PKCS11_ENABLED + #include "score/crypto/daemon/provider/pkcs11/pkcs11_provider_factory.hpp" +#endif + +namespace score::crypto::daemon::provider +{ + +std::shared_ptr ProviderManagerFactory::Create(config::Config& config) +{ + // Create the provider manager instance + auto provider_manager = std::make_shared(config); + + // Create and register Score provider factory if backends enabled + auto score_factory = CreateScoreProviderFactory(config); + if (score_factory) + { + provider_manager->RegisterFactory(std::move(score_factory)); + } + + // Create and register PKCS#11 factory if configured + auto pkcs11_factory = CreatePkcs11ProviderFactory(config); + if (pkcs11_factory) + { + provider_manager->RegisterFactory(std::move(pkcs11_factory)); + } + + // Initialize all registered providers + provider_manager->Initialize(); + + return provider_manager; +} + +std::unique_ptr ProviderManagerFactory::CreateScoreProviderFactory( + config::Config& config) +{ +#if SCORE_BACKEND_ENABLED + config.GetScoreProviderConfig().ParseConfig(); + if (config.GetScoreProviderConfig().GetProviderEntries().empty()) + { + return nullptr; + } + + auto score_factory = std::make_unique(); + config.GetScoreProviderConfig().Configure(*score_factory); + return score_factory; +#else + (void)config; + return nullptr; +#endif +} + +std::unique_ptr ProviderManagerFactory::CreatePkcs11ProviderFactory( + config::Config& config) +{ +#if SCORE_CRYPTO_PKCS11_ENABLED + // Parse PKCS#11 configuration + config.GetPkcs11Config().ParseConfig(); + + // Check if PKCS#11 is configured + if (config.GetPkcs11Config().GetTokenEntries().empty()) + { + // PKCS#11 not configured or disabled + return nullptr; + } + + // Create and configure PKCS#11 factory + auto factory = std::make_unique(); + config.GetPkcs11Config().Configure(*factory); + + return factory; +#else + // PKCS#11 backend not enabled in build + (void)config; // Suppress unused parameter warning + return nullptr; +#endif +} + +} // namespace score::crypto::daemon::provider diff --git a/score/crypto/daemon/src/daemon.cpp b/score/crypto/daemon/src/daemon.cpp index 6f795f6f..637e47ee 100644 --- a/score/crypto/daemon/src/daemon.cpp +++ b/score/crypto/daemon/src/daemon.cpp @@ -25,10 +25,7 @@ #include "score/crypto/daemon/control_plane/i_control_server.h" #include "score/crypto/daemon/data_manager/data_manager.hpp" #include "score/crypto/daemon/key_management/key_management_module.hpp" -#include "score/crypto/daemon/provider/pkcs11/pkcs11_module.hpp" -#include "score/crypto/daemon/provider/pkcs11/pkcs11_provider_factory.hpp" -#include "score/crypto/daemon/provider/provider_manager.hpp" -#include "score/crypto/daemon/provider/score_provider/score_provider_factory.hpp" +#include "score/crypto/daemon/provider/provider_manager_factory.hpp" #include "score/crypto/ipc/grpc_adapter/grpc_control_server.h" #include "score/crypto/ipc/ipc_config.h" @@ -67,28 +64,13 @@ int main(int argc, char** argv) score::mw::log::LogError() << "Warning: Could not parse config file (may not exist)"; } - auto provider_manager = std::make_shared(config); - - // Wire provider factories — each factory encapsulates construction and registration - // of one or more providers. Factories are called in order during Initialize(). - - // Score provider factory (OpenSSL software provider) - config.GetScoreProviderConfig().PopulateDefaults(); - auto score_factory = std::make_unique(); - config.GetScoreProviderConfig().Configure(*score_factory); - provider_manager->RegisterFactory(std::move(score_factory)); - - // Populate production PKCS#11 default tokens (SoftHSM) unless the config - // file already supplied entries. - config.GetPkcs11Config().PopulateDefaults(); - - // Pkcs11Config visits the factory: converts Pkcs11TokenEntry entries to - // Pkcs11ProviderConfig and calls factory.SetTokenConfigs() internally. - auto pkcs11_factory = std::make_unique(); - config.GetPkcs11Config().Configure(*pkcs11_factory); - provider_manager->RegisterFactory(std::move(pkcs11_factory)); - - provider_manager->Initialize(); + // Create and initialize the provider manager via factory. + // The factory handles: + // 1. Parsing provider configurations from backend implementations (ParseConfig) + // 2. Creating and configuring provider factories (Score/OpenSSL, PKCS#11) + // 3. Registering factories with the provider manager + // 4. Initializing all providers + auto provider_manager = score::crypto::daemon::provider::ProviderManagerFactory::Create(config); // Create data manager auto data_manager = std::make_shared(); From 2b117405e9e0f6c3c6d332bfd6e6971f37c00eff Mon Sep 17 00:00:00 2001 From: Athul Mallappallil Date: Fri, 17 Jul 2026 12:26:07 +0000 Subject: [PATCH 05/14] Adapt missing features in the provider manager - Fix config attribute - Provider_Name used instead of provider_id --- score/crypto/daemon/config/inc/config.hpp | 22 +-- .../daemon/mediator/src/mediator_impl.cpp | 9 +- score/crypto/daemon/provider/i_provider.hpp | 10 + .../provider/pkcs11/pkcs11_provider.hpp | 4 + .../daemon/provider/provider_manager.hpp | 54 +++++- .../provider/provider_manager_factory.hpp | 4 +- .../score_provider/score_provider.hpp | 4 + .../daemon/provider/src/provider_manager.cpp | 180 +++++++++++++----- .../provider/src/provider_manager_factory.cpp | 13 +- tests/provider_test/test_provider_manager.cpp | 83 +++++++- 10 files changed, 308 insertions(+), 75 deletions(-) diff --git a/score/crypto/daemon/config/inc/config.hpp b/score/crypto/daemon/config/inc/config.hpp index 81d518bd..f454510c 100644 --- a/score/crypto/daemon/config/inc/config.hpp +++ b/score/crypto/daemon/config/inc/config.hpp @@ -104,21 +104,21 @@ class IPCConfig * @brief Provider configuration - contains metadata for adding a new provider * * This structure holds the necessary information to create and initialize a - * provider. Providers are identified by their ProviderId and can be categorized + * provider. Providers are identified by their ProviderName and can be categorized * by CryptoProviderType. The actual provider instance creation is handled by * the factory implementation, which can be easily extended to support new * provider types. */ struct ProviderConfig { - common::ProviderId providerId; ///< Unique provider identifier + common::ProviderName providerName; ///< Human-readable provider identifier common::CryptoProviderType cryptoType; ///< Functional category - bool enabled; ///< Whether this provider should be initialized + bool enabled{true}; ///< Whether this provider should be used ResourceQuotaPolicy quota_policy{}; ///< Per-provider quota policy override ProviderConfig() = default; - ProviderConfig(const common::ProviderId& id, common::CryptoProviderType cryptoType, bool enabled = true) - : providerId(id), cryptoType(cryptoType), enabled(enabled) + ProviderConfig(const common::ProviderName& name, common::CryptoProviderType cryptoType, bool enabled = true) + : providerName(name), cryptoType(cryptoType), enabled(enabled) { } }; @@ -133,9 +133,9 @@ struct ProviderConfig struct ProviderInitConfig { std::vector providers; ///< List of providers to initialize - std::unordered_map - typeToProviderId; ///< Mapping of provider types to their default - ///< ProviderId + std::unordered_map + typeToProviderName; ///< Mapping of provider types to their default + ///< provider name ProviderInitConfig() = default; @@ -151,11 +151,11 @@ struct ProviderInitConfig /** * @brief Set the default provider for a specific crypto provider type * @param cryptoType The functional category - * @param providerId The provider ID to use for this type + * @param providerName The provider name to use for this type */ - void SetDefaultProviderForType(common::CryptoProviderType cryptoType, const common::ProviderId& providerId) + void SetDefaultProviderForType(common::CryptoProviderType cryptoType, const common::ProviderName& providerName) { - typeToProviderId[cryptoType] = providerId; + typeToProviderName[cryptoType] = providerName; } }; diff --git a/score/crypto/daemon/mediator/src/mediator_impl.cpp b/score/crypto/daemon/mediator/src/mediator_impl.cpp index 123833a1..b0286b30 100644 --- a/score/crypto/daemon/mediator/src/mediator_impl.cpp +++ b/score/crypto/daemon/mediator/src/mediator_impl.cpp @@ -119,7 +119,6 @@ control_plane::ControlResponse MediatorImpl::processRequest(const control_plane: // ============================================================================ // Helper Method Implementations // ============================================================================ - bool MediatorImpl::HandleSingleOperation(const control_plane::ControlRequest& request, const control_plane::SingleOperationRequest& operation, control_plane::protocol::OperationResponseBuilder& responseBuilder) @@ -332,6 +331,14 @@ bool MediatorImpl::HandleContextCreationOperation(const score::crypto::daemon::c .return_error(score::mw::crypto::CryptoErrorCode::kInternalError); return false; } + if (!provider->IsInitialized()) + { + score::mw::log::LogError() << "[SCORE_API_MED] ERROR - Selected provider is not initialized: name='" + << provider->GetProviderName() << "' id=" << provider->GetProviderId(); + responseBuilder.operation(operation.operationId) + .return_error(score::mw::crypto::CryptoErrorCode::kInternalError); + return false; + } score::mw::log::LogDebug() << "[SCORE_API_MED] CTX_CREATE [" << context_type << "/" << algorithm << "] selected provider: name='" << provider->GetProviderName() << "' id=" << provider->GetProviderId() diff --git a/score/crypto/daemon/provider/i_provider.hpp b/score/crypto/daemon/provider/i_provider.hpp index 357b83c6..b0d0886e 100644 --- a/score/crypto/daemon/provider/i_provider.hpp +++ b/score/crypto/daemon/provider/i_provider.hpp @@ -77,6 +77,16 @@ class IProvider /// @brief Shutdown the provider and release all resources. virtual void Shutdown() = 0; + /// @brief Return whether the provider has been successfully initialized. + /// + /// ProviderManager uses this to hide providers whose Initialize() failed + /// without removing their registry entries. + /// @return true if Initialize() returned success, false otherwise + [[nodiscard]] virtual bool IsInitialized() const + { + return false; + } + /// @brief Return the provider's unique numeric identifier. /// @return ProviderId (uint16_t) assigned by ProviderManager virtual common::ProviderId GetProviderId() const = 0; diff --git a/score/crypto/daemon/provider/pkcs11/pkcs11_provider.hpp b/score/crypto/daemon/provider/pkcs11/pkcs11_provider.hpp index 115d8c4e..2f038a4b 100644 --- a/score/crypto/daemon/provider/pkcs11/pkcs11_provider.hpp +++ b/score/crypto/daemon/provider/pkcs11/pkcs11_provider.hpp @@ -79,6 +79,10 @@ class Pkcs11Provider final : public IProvider, public std::enable_shared_from_th [[nodiscard]] bool Initialize(const ProviderInitContext& ctx) override; void Shutdown() override; + [[nodiscard]] bool IsInitialized() const override + { + return m_initialized; + } [[nodiscard]] common::ProviderId GetProviderId() const override; [[nodiscard]] const common::ProviderName& GetProviderName() const override; diff --git a/score/crypto/daemon/provider/provider_manager.hpp b/score/crypto/daemon/provider/provider_manager.hpp index fc06bf20..33535946 100644 --- a/score/crypto/daemon/provider/provider_manager.hpp +++ b/score/crypto/daemon/provider/provider_manager.hpp @@ -80,9 +80,9 @@ struct ProviderEntry * In daemon main: * ProviderManager manager; * ProviderInitConfig config; - * config.SetDefaultProviderForType(CryptoProviderType::SOFTWARE, - * kProviderNameOpenSSL); manager.Initialize(config); auto provider = - * manager.GetProvider(kProviderNameOpenSSL); + * config.SetDefaultProviderForType(CryptoProviderType::SOFTWARE, "OPENSSL"); + * manager.Initialize(config); + * auto provider = manager.GetProvider("OPENSSL"); */ class ProviderManager { @@ -235,18 +235,45 @@ class ProviderManager * @brief Create a default provider initialization configuration * * The default configuration: - * - Enables all available providers + * - Enables all initialized providers * - Sets first available provider as default for basic types * - Uses preference order to select the DEFAULT provider type * + * Only providers whose IsInitialized() returns true are considered. + * Provider names are used instead of runtime ProviderIds so the + * configuration remains stable across restarts. + * * @param preferenceOrder Priority order for selecting default provider. * Defaults to HARDWARE → SOFTWARE fallback. * @return ProviderInitConfig with default settings */ - config::ProviderInitConfig CreateDefaultConfig( - const std::vector& preferenceOrder = { - common::CryptoProviderType::HARDWARE, - common::CryptoProviderType::SOFTWARE}); + config::ProviderInitConfig CreateDefaultConfig(const std::vector& preferenceOrder = { + common::CryptoProviderType::HARDWARE, + common::CryptoProviderType::SOFTWARE}); + + /** + * @brief Shutdown and remove providers that are not marked as enabled. + * + * Called by Initialize() after selecting the active ProviderInitConfig. + * Providers whose name is absent from @p provider_configs or whose + * ProviderConfig::enabled is false are shut down and removed from + * lookup tables. + * + * @param provider_configs Active provider configurations. + */ + void ApplyEnablement(const std::vector& provider_configs); + + /** + * @brief Build m_typeToProviderId from configured type-to-name mappings. + * + * Resolves provider names to the numeric IDs assigned at registration + * time. Warnings are logged for names that reference unknown or + * disabled providers. + * + * @param type_to_name Mapping from crypto provider type to provider name. + */ + void BuildTypeMappings( + const std::unordered_map& type_to_name); /** * @brief Invoke all registered factories to create and register providers. @@ -262,12 +289,21 @@ class ProviderManager * @brief Initialize all registered providers with ProviderInitContext. * * Passes each provider a ProviderInitContext containing its assigned - * numeric ID and name. + * numeric ID and name. Failed providers remain registered but are hidden + * from lookups because GetProvider() queries provider->IsInitialized(). * * @return true if all providers initialized successfully, false otherwise */ bool InitializeAll(); + /** + * @brief Check whether a provider has been successfully initialized. + * + * @param provider_id The provider's numeric ID. + * @return true if the provider has been successfully initialized, false otherwise. + */ + [[nodiscard]] bool IsProviderInitialized(common::ProviderId provider_id) const; + /// Ordered list of factories to invoke during Initialize(). std::vector> m_factories; diff --git a/score/crypto/daemon/provider/provider_manager_factory.hpp b/score/crypto/daemon/provider/provider_manager_factory.hpp index 485d4ca9..2d57b8ff 100644 --- a/score/crypto/daemon/provider/provider_manager_factory.hpp +++ b/score/crypto/daemon/provider/provider_manager_factory.hpp @@ -33,7 +33,7 @@ namespace score::crypto::daemon::provider * 5. Initialize all providers * * Backend discovery uses dependency injection: - * - Score backends: Compile-time list from backend/active_backends_list.hpp + * - Score backends: Compile-time list from backend/score_provider/active_backends_list.hpp * - PKCS#11 backend: Conditionally created based on configuration * * Usage: @@ -68,7 +68,7 @@ class ProviderManagerFactory /** * @brief Create score provider factory if backends enabled * - * Discovers active backends from backend/active_backends_list.hpp + * Discovers active backends from backend/score_provider/active_backends_list.hpp * (controlled by backend/BUILD). Creates a single ScoreProviderFactory * that handles all enabled score backends (OpenSSL, Primula, etc.). * diff --git a/score/crypto/daemon/provider/score_provider/score_provider.hpp b/score/crypto/daemon/provider/score_provider/score_provider.hpp index 4f07e88a..e2f65f70 100644 --- a/score/crypto/daemon/provider/score_provider/score_provider.hpp +++ b/score/crypto/daemon/provider/score_provider/score_provider.hpp @@ -44,6 +44,10 @@ class ScoreProvider : public IProvider // --- IProvider lifecycle --- bool Initialize(const ProviderInitContext& ctx) override; void Shutdown() override; + [[nodiscard]] bool IsInitialized() const override + { + return m_initialized; + } common::ProviderId GetProviderId() const override; const common::ProviderName& GetProviderName() const override; diff --git a/score/crypto/daemon/provider/src/provider_manager.cpp b/score/crypto/daemon/provider/src/provider_manager.cpp index ac39bb74..ef3bb4a8 100644 --- a/score/crypto/daemon/provider/src/provider_manager.cpp +++ b/score/crypto/daemon/provider/src/provider_manager.cpp @@ -12,8 +12,10 @@ ********************************************************************************/ #include +#include #include "score/crypto/daemon/provider/provider_manager.hpp" +#include "score/mw/log/logging.h" namespace score::crypto { @@ -39,7 +41,12 @@ bool ProviderManager::Initialize() return false; } - // Use provided config or create default + // Initialize all providers before deciding on default mappings. + // Individual failures are tolerated; failed providers are hidden from lookups + // because GetProvider() queries provider->IsInitialized() directly. + const bool init_ok = InitializeAll(); + + // Use provided config or create default from initialized providers only. config::ProviderInitConfig activeConfig = m_config.GetProviderInitConfig(); if (activeConfig.providers.empty()) @@ -47,11 +54,13 @@ bool ProviderManager::Initialize() activeConfig = CreateDefaultConfig(); } - // Set the type-to-provider mappings - m_typeToProviderId = activeConfig.typeToProviderId; + // Apply enablement: shutdown and hide providers not marked as enabled. + ApplyEnablement(activeConfig.providers); + + // Build type-to-provider mappings, resolving configured names to runtime IDs. + BuildTypeMappings(activeConfig.typeToProviderName); - // Initialize all providers - return InitializeAll(); + return init_ok; } config::ProviderInitConfig ProviderManager::CreateDefaultConfig( @@ -59,67 +68,123 @@ config::ProviderInitConfig ProviderManager::CreateDefaultConfig( { config::ProviderInitConfig config; - // Add all created providers to config as enabled + // Add all initialized providers to config as enabled for (const auto& pair : m_providers) { - config.AddProviderConfig(config::ProviderConfig(pair.second.numeric_id, pair.second.cryptoType, true)); + if (pair.second.instance && pair.second.instance->IsInitialized()) + { + config.AddProviderConfig(config::ProviderConfig(pair.first, pair.second.cryptoType, true)); + } } - // Set the first provider as default for all applicable types - if (!m_providers.empty()) + // Select a DEFAULT provider based on the preference order. SOFTWARE, + // HARDWARE and SPECIALIZED mappings are derived from each provider's + // declared cryptoType in BuildTypeMappings(), so they are not overridden + // here. + if (!config.providers.empty()) { - const auto& firstEntry = m_providers.begin()->second; - common::ProviderId firstProviderId = firstEntry.numeric_id; - - config.typeToProviderId = m_typeToProviderId; - - // Set as default for all common types not configured with a provider - - if (config.typeToProviderId.find(common::CryptoProviderType::DEFAULT) == config.typeToProviderId.end()) + if (config.typeToProviderName.find(common::CryptoProviderType::DEFAULT) == config.typeToProviderName.end()) { - // Select default provider based on preference order parameter - common::ProviderId defaultId = common::kInvalidProviderId; + common::ProviderName defaultName; - // Try each type in the preference order for (const auto& preferredType : preferenceOrder) { for (const auto& entry : m_providers) { - if (entry.second.cryptoType == preferredType) + if (entry.second.instance && entry.second.instance->IsInitialized() && + entry.second.cryptoType == preferredType) { - defaultId = entry.second.numeric_id; + defaultName = entry.first; break; } } - if (defaultId != common::kInvalidProviderId) + if (!defaultName.empty()) { break; } } - // If no provider found via preference order, use first registered provider - if (defaultId == common::kInvalidProviderId) + if (defaultName.empty()) { - defaultId = firstProviderId; + defaultName = config.providers.front().providerName; } - config.SetDefaultProviderForType(common::CryptoProviderType::DEFAULT, defaultId); + config.SetDefaultProviderForType(common::CryptoProviderType::DEFAULT, defaultName); } - if (config.typeToProviderId.find(common::CryptoProviderType::SOFTWARE) == config.typeToProviderId.end()) + } + + return config; +} + +void ProviderManager::ApplyEnablement(const std::vector& provider_configs) +{ + std::unordered_set enabled_names; + for (const auto& cfg : provider_configs) + { + if (cfg.enabled) { - config.SetDefaultProviderForType(common::CryptoProviderType::SOFTWARE, firstProviderId); + enabled_names.insert(cfg.providerName); } - if (config.typeToProviderId.find(common::CryptoProviderType::HARDWARE) == config.typeToProviderId.end()) + } + + for (auto it = m_providers.begin(); it != m_providers.end();) + { + if (enabled_names.find(it->first) == enabled_names.end()) { - config.SetDefaultProviderForType(common::CryptoProviderType::HARDWARE, firstProviderId); + const auto numeric_id = it->second.numeric_id; + if (it->second.instance) + { + it->second.instance->Shutdown(); + } + if (numeric_id < m_provider_by_id.size()) + { + m_provider_by_id[numeric_id].reset(); + } + it = m_providers.erase(it); } - if (config.typeToProviderId.find(common::CryptoProviderType::SPECIALIZED) == config.typeToProviderId.end()) + else { - config.SetDefaultProviderForType(common::CryptoProviderType::SPECIALIZED, firstProviderId); + ++it; } } + // List the enabled providers after applying enablement + score::mw::log::LogInfo() << "[ProviderManager] Enabled providers after applying enablement:"; + for (const auto& pair : m_providers) + { + score::mw::log::LogInfo() << " - " << pair.first << " (numeric_id=" << pair.second.numeric_id << ", type=" << static_cast(pair.second.cryptoType) << ")"; + } +} - return config; +void ProviderManager::BuildTypeMappings( + const std::unordered_map& type_to_name) +{ + // Start from the type declared by each registered provider. This ensures + // a SOFTWARE provider is reachable via CryptoProviderType::SOFTWARE and a + // HARDWARE provider via CryptoProviderType::HARDWARE even when the daemon + // config does not supply explicit type mappings. + m_typeToProviderId.clear(); + for (const auto& entry : m_providers) + { + const auto& crypto_type = entry.second.cryptoType; + if (m_typeToProviderId.find(crypto_type) == m_typeToProviderId.end()) + { + m_typeToProviderId[crypto_type] = entry.second.numeric_id; + } + } + + // Apply config-driven overrides. Configured names take precedence over the + // provider-declared types above. + for (const auto& [crypto_type, provider_name] : type_to_name) + { + auto it = m_providers.find(provider_name); + if (it == m_providers.end()) + { + score::mw::log::LogWarn() << "[ProviderManager] Type mapping references unknown or disabled provider: " + << provider_name; + continue; + } + m_typeToProviderId[crypto_type] = it->second.numeric_id; + } } bool ProviderManager::CreateProviders() @@ -187,33 +252,45 @@ std::shared_ptr ProviderManager::GetProvider(common::ProviderId provi { return nullptr; } + if (!IsProviderInitialized(providerId)) + { + return nullptr; + } return m_provider_by_id[providerId]; } std::shared_ptr ProviderManager::GetProvider(const common::ProviderName& providerName) const { auto it = m_providers.find(providerName); - if (it != m_providers.end()) + if (it == m_providers.end()) + { + return nullptr; + } + if (!IsProviderInitialized(it->second.numeric_id)) { - return it->second.instance; + return nullptr; } - return nullptr; + return it->second.instance; } std::shared_ptr ProviderManager::GetProvider(common::CryptoProviderType cryptoType) const { auto it = m_typeToProviderId.find(cryptoType); - if (it != m_typeToProviderId.end()) + if (it == m_typeToProviderId.end()) + { + return nullptr; + } + if (!IsProviderInitialized(it->second)) { - return GetProvider(it->second); + return nullptr; } - return nullptr; + return GetProvider(it->second); } bool ProviderManager::SetDefaultProviderForType(common::CryptoProviderType cryptoType, common::ProviderId providerId) { - // Verify the provider exists by numeric ID - if (providerId >= m_provider_by_id.size() || !m_provider_by_id[providerId]) + // Verify the provider exists by numeric ID and is initialized + if (providerId >= m_provider_by_id.size() || !m_provider_by_id[providerId] || !IsProviderInitialized(providerId)) { return false; } @@ -225,15 +302,26 @@ bool ProviderManager::SetDefaultProviderForType(common::CryptoProviderType crypt bool ProviderManager::InitializeAll() { + bool all_ok = true; for (auto& entry : m_providers) { ProviderInitContext ctx{entry.second.numeric_id, entry.first}; if (!entry.second.instance->Initialize(ctx)) { - return false; + all_ok = false; } } - return true; + return all_ok; +} + +bool ProviderManager::IsProviderInitialized(common::ProviderId provider_id) const +{ + if (provider_id >= m_provider_by_id.size()) + { + return false; + } + const auto& provider = m_provider_by_id[provider_id]; + return provider && provider->IsInitialized(); } void ProviderManager::Shutdown() @@ -261,6 +349,10 @@ std::optional ProviderManager::GetProviderType( bool ProviderManager::IsProviderCompatibleWithType(const common::ProviderId provider_id, common::CryptoProviderType requested_type) const { + if (!IsProviderInitialized(provider_id)) + { + return false; + } if (requested_type == common::CryptoProviderType::DEFAULT) { return true; diff --git a/score/crypto/daemon/provider/src/provider_manager_factory.cpp b/score/crypto/daemon/provider/src/provider_manager_factory.cpp index f4c2babb..19f6d9f5 100644 --- a/score/crypto/daemon/provider/src/provider_manager_factory.cpp +++ b/score/crypto/daemon/provider/src/provider_manager_factory.cpp @@ -14,11 +14,11 @@ #include "score/crypto/daemon/provider/provider_manager_factory.hpp" #if SCORE_BACKEND_ENABLED - #include "score/crypto/daemon/provider/score_provider/score_provider_factory.hpp" +#include "score/crypto/daemon/provider/score_provider/score_provider_factory.hpp" #endif #if SCORE_CRYPTO_PKCS11_ENABLED - #include "score/crypto/daemon/provider/pkcs11/pkcs11_provider_factory.hpp" +#include "score/crypto/daemon/provider/pkcs11/pkcs11_provider_factory.hpp" #endif namespace score::crypto::daemon::provider @@ -43,14 +43,14 @@ std::shared_ptr ProviderManagerFactory::Create(config::Config& provider_manager->RegisterFactory(std::move(pkcs11_factory)); } - // Initialize all registered providers + // Initialize all registered providers. Ignore failures here; + // Individual provider failures are logged and hidden from lookups. provider_manager->Initialize(); return provider_manager; } -std::unique_ptr ProviderManagerFactory::CreateScoreProviderFactory( - config::Config& config) +std::unique_ptr ProviderManagerFactory::CreateScoreProviderFactory(config::Config& config) { #if SCORE_BACKEND_ENABLED config.GetScoreProviderConfig().ParseConfig(); @@ -68,8 +68,7 @@ std::unique_ptr ProviderManagerFactory::CreateScoreProviderFac #endif } -std::unique_ptr ProviderManagerFactory::CreatePkcs11ProviderFactory( - config::Config& config) +std::unique_ptr ProviderManagerFactory::CreatePkcs11ProviderFactory(config::Config& config) { #if SCORE_CRYPTO_PKCS11_ENABLED // Parse PKCS#11 configuration diff --git a/tests/provider_test/test_provider_manager.cpp b/tests/provider_test/test_provider_manager.cpp index 8fa8faea..3f4f6d0f 100644 --- a/tests/provider_test/test_provider_manager.cpp +++ b/tests/provider_test/test_provider_manager.cpp @@ -40,10 +40,19 @@ class StubProvider final : public provider::IProvider bool Initialize(const provider::ProviderInitContext& ctx) override { + m_initialized = true; return true; } - void Shutdown() override {} + void Shutdown() override + { + m_initialized = false; + } + + [[nodiscard]] bool IsInitialized() const override + { + return m_initialized; + } common::ProviderId GetProviderId() const override { @@ -58,6 +67,51 @@ class StubProvider final : public provider::IProvider private: std::string m_name; common::ProviderId m_id; + bool m_initialized{true}; +}; + +class FailingStubProvider final : public provider::IProvider +{ + public: + FailingStubProvider(const std::string& name, common::ProviderId id, bool fail_init) + : m_name{name}, m_id{id}, m_fail_init{fail_init} + { + } + + bool Initialize(const provider::ProviderInitContext& ctx) override + { + if (m_fail_init) + { + return false; + } + m_initialized = true; + return true; + } + + void Shutdown() override + { + m_initialized = false; + } + + [[nodiscard]] bool IsInitialized() const override + { + return m_initialized; + } + + common::ProviderId GetProviderId() const override + { + return m_id; + } + const common::ProviderName& GetProviderName() const override + { + return m_name; + } + + private: + std::string m_name; + common::ProviderId m_id; + bool m_fail_init; + bool m_initialized{false}; }; } // namespace @@ -144,6 +198,33 @@ TEST_F(ProviderManagerTypeTest, UnknownProviderReturnsFalse) m_mgr->IsProviderCompatibleWithType(999, common::CryptoProviderType::SOFTWARE)); // Invalid provider ID } +// =========================================================================== +// Initialization state tracking +// =========================================================================== + +TEST(ProviderManagerInitStateTest, FailedProviderRemainsRegisteredButIsHidden) +{ + score::crypto::daemon::config::Config config; + provider::ProviderManager mgr(config); + + auto ok_provider = std::make_shared("OK_PROVIDER", 0, false); + auto fail_provider = std::make_shared("FAIL_PROVIDER", 1, true); + + ASSERT_TRUE(mgr.RegisterProvider("OK_PROVIDER", ok_provider, common::CryptoProviderType::SOFTWARE)); + ASSERT_TRUE(mgr.RegisterProvider("FAIL_PROVIDER", fail_provider, common::CryptoProviderType::HARDWARE)); + + // FailingStubProvider instances are not pre-initialized, so they are hidden + // from lookups until InitializeAll() runs. + EXPECT_EQ(mgr.GetProvider("OK_PROVIDER"), nullptr); + EXPECT_EQ(mgr.GetProvider("FAIL_PROVIDER"), nullptr); + EXPECT_EQ(mgr.GetProvider(common::CryptoProviderType::SOFTWARE), nullptr); + EXPECT_EQ(mgr.GetProvider(common::CryptoProviderType::HARDWARE), nullptr); + + // The registry still knows about the entries via GetProviderType. + EXPECT_TRUE(mgr.GetProviderType("OK_PROVIDER").has_value()); + EXPECT_TRUE(mgr.GetProviderType("FAIL_PROVIDER").has_value()); +} + // =========================================================================== // ContextDataNode GetNodeType // =========================================================================== From b0665d909af873f095871397a69a1f97e4f1344c Mon Sep 17 00:00:00 2001 From: Athul Mallappallil Date: Fri, 17 Jul 2026 12:33:10 +0000 Subject: [PATCH 06/14] Remove hardcoded provider names --- score/crypto/daemon/common/types.hpp | 28 ++++++++++++++++--- .../key_management/pkcs11_key_store.hpp | 2 +- tests/demo/mac_multi_provider_demo.cpp | 2 +- .../test_access_policy_enforcer.cpp | 2 +- 4 files changed, 27 insertions(+), 7 deletions(-) diff --git a/score/crypto/daemon/common/types.hpp b/score/crypto/daemon/common/types.hpp index 6a7ba439..b4556006 100644 --- a/score/crypto/daemon/common/types.hpp +++ b/score/crypto/daemon/common/types.hpp @@ -44,10 +44,6 @@ using ProviderId = std::uint16_t; constexpr ProviderId kInvalidProviderId = std::numeric_limits::max(); -// Predefined Provider Names (configuration-time identifiers) -const ProviderName kProviderNameOpenSSL{"OPENSSL"}; -const ProviderName kProviderNameSoftHSM{"SOFTHSM"}; - using OperationActor = uint16_t; using OperationAction = uint16_t; @@ -155,6 +151,30 @@ enum class CryptoProviderType : std::uint8_t SPECIALIZED, ///< Specialized provider for specific operations }; +inline CryptoProviderType CryptoProviderTypeFromString(const std::string& typeStr) +{ + if (typeStr == "DEFAULT") + { + return CryptoProviderType::DEFAULT; + } + else if (typeStr == "HARDWARE") + { + return CryptoProviderType::HARDWARE; + } + else if (typeStr == "SOFTWARE") + { + return CryptoProviderType::SOFTWARE; + } + else if (typeStr == "SPECIALIZED") + { + return CryptoProviderType::SPECIALIZED; + } + else + { + return CryptoProviderType::DEFAULT; + } +} + } // namespace score::crypto::daemon::common /** diff --git a/score/crypto/daemon/provider/pkcs11/key_management/pkcs11_key_store.hpp b/score/crypto/daemon/provider/pkcs11/key_management/pkcs11_key_store.hpp index 05583140..081d3da2 100644 --- a/score/crypto/daemon/provider/pkcs11/key_management/pkcs11_key_store.hpp +++ b/score/crypto/daemon/provider/pkcs11/key_management/pkcs11_key_store.hpp @@ -51,7 +51,7 @@ struct SearchTemplate /// /// Pkcs11KeyStore owns the per-provider key state: each daemon-visible key ID /// (uint64_t opaque_id) maps to a CK_OBJECT_HANDLE. Session objects additionally -/// carry the owning CK_SESSION_HANDLE (kept open to prevent SoftHSM2 from +/// carry the owning CK_SESSION_HANDLE (kept open to prevent underlying impl from /// destroying the object). Token objects carry only a SearchTemplate so that /// any number of handlers can independently resolve a session-local handle /// via ResolveObject(). diff --git a/tests/demo/mac_multi_provider_demo.cpp b/tests/demo/mac_multi_provider_demo.cpp index 23953984..9e3fe12d 100644 --- a/tests/demo/mac_multi_provider_demo.cpp +++ b/tests/demo/mac_multi_provider_demo.cpp @@ -255,7 +255,7 @@ TEST_F(MacDemoTest, Demo3_SlotDirectFileBackedKey) slot.slot_name = "demo/sw-hmac-256"; slot.algorithm = "HMAC-SHA256"; // Config-time: populate provider names; runtime would populate provider_ids via ResolveProviderIds - slot.provider_names = {common::kProviderNameOpenSSL}; + slot.provider_names = {"OPENSSL"}; slot.provider_ids = {0}; // 0 = OpenSSL (typical registration order) // Write a temporary deployment descriptor pointing to the test key file. const std::string deploy_path = diff --git a/tests/key_management/test_access_policy_enforcer.cpp b/tests/key_management/test_access_policy_enforcer.cpp index 92fbba87..75216096 100644 --- a/tests/key_management/test_access_policy_enforcer.cpp +++ b/tests/key_management/test_access_policy_enforcer.cpp @@ -27,7 +27,7 @@ class AccessPolicyEnforcerTest : public ::testing::Test m_slot_config.slot_name = "test/hmac-sha256"; m_slot_config.algorithm = "HMAC-SHA256"; // Config-time: populate provider names (strings from configuration) - m_slot_config.provider_names = {score::crypto::daemon::common::kProviderNameOpenSSL}; + m_slot_config.provider_names = {"OPENSSL"}; // Test setup: simulate resolved provider IDs (would normally be done by ResolveProviderIds) m_slot_config.provider_ids = {0}; // 0 = OpenSSL, assigned by ProviderManager m_slot_config.allowed_operations = score::mw::crypto::KeyOperationPermission::kMac; From b1cce3483dcb2f182978be43aa10f146938a8f46 Mon Sep 17 00:00:00 2001 From: Athul Mallappallil Date: Fri, 17 Jul 2026 12:39:24 +0000 Subject: [PATCH 07/14] Adapt score_provider for backend agnostic use --- score/crypto/daemon/provider/BUILD | 22 +++++ .../daemon/provider/score_provider/BUILD | 14 ++- .../provider/score_provider/openssl/BUILD | 14 +-- .../openssl/openssl_provider_factory.cpp | 32 ------- .../openssl/openssl_provider_factory.hpp | 48 ---------- .../score_provider/score_backend_adapter.hpp | 91 +++++++++++++++++++ .../score_provider/score_provider_config.hpp | 15 ++- .../score_provider/score_provider_factory.hpp | 4 +- .../src/score_provider_config.cpp | 12 --- .../src/score_provider_factory.cpp | 39 +++++--- 10 files changed, 165 insertions(+), 126 deletions(-) delete mode 100644 score/crypto/daemon/provider/score_provider/openssl/openssl_provider_factory.cpp delete mode 100644 score/crypto/daemon/provider/score_provider/openssl/openssl_provider_factory.hpp create mode 100644 score/crypto/daemon/provider/score_provider/score_backend_adapter.hpp diff --git a/score/crypto/daemon/provider/BUILD b/score/crypto/daemon/provider/BUILD index d210cd88..13a0f137 100644 --- a/score/crypto/daemon/provider/BUILD +++ b/score/crypto/daemon/provider/BUILD @@ -12,6 +12,9 @@ # ******************************************************************************* load("@rules_cc//cc:cc_library.bzl", "cc_library") +load("//score/crypto/backend:backend_exports.bzl", + "ENABLE_PKCS11_BACKEND", + "ENABLE_SCORE_BACKEND") cc_library( name = "provider_headers", @@ -19,6 +22,7 @@ cc_library( "i_provider.hpp", "i_provider_factory.hpp", "provider_manager.hpp", + "provider_manager_factory.hpp", ], visibility = ["//:__subpackages__"], deps = [ @@ -37,3 +41,21 @@ cc_library( ":provider_headers", ], ) + +cc_library( + name = "provider_manager_factory", + srcs = ["src/provider_manager_factory.cpp"], + hdrs = ["provider_manager_factory.hpp"], + visibility = ["//:__subpackages__"], + deps = [ + ":provider_headers", + ":provider_manager", + ] + (["//score/crypto/daemon/provider/score_provider:score_provider_factory"] + if ENABLE_SCORE_BACKEND else []) + + (["//score/crypto/daemon/provider/pkcs11:provider_pkcs11_factory"] + if ENABLE_PKCS11_BACKEND else []), + implementation_deps = [ + "//score/crypto/backend/score_provider:score_backend_defines", + "//score/crypto/backend:pkcs11_backend_defines", + ], +) diff --git a/score/crypto/daemon/provider/score_provider/BUILD b/score/crypto/daemon/provider/score_provider/BUILD index 433ab149..e73753e6 100644 --- a/score/crypto/daemon/provider/score_provider/BUILD +++ b/score/crypto/daemon/provider/score_provider/BUILD @@ -32,6 +32,16 @@ cc_library( visibility = ["//:__subpackages__"], ) +# Backend adapter interface (used by backend adapters to register with score provider). +cc_library( + name = "score_backend_adapter", + hdrs = ["score_backend_adapter.hpp"], + visibility = ["//:__subpackages__"], + deps = [ + "//score/crypto/daemon/provider:provider_headers", + ], +) + # Top-level factory for the score interface family. cc_library( name = "score_provider_factory", @@ -45,6 +55,8 @@ cc_library( ":score_provider", ":score_provider_config", "//score/crypto/daemon/provider:provider_headers", - "//score/crypto/daemon/provider/score_provider/openssl:provider_openssl_factory", + ], + implementation_deps = [ + "//score/crypto/backend/score_provider:backend", # Selected Score backends ], ) diff --git a/score/crypto/daemon/provider/score_provider/openssl/BUILD b/score/crypto/daemon/provider/score_provider/openssl/BUILD index 534f80b7..122140b0 100644 --- a/score/crypto/daemon/provider/score_provider/openssl/BUILD +++ b/score/crypto/daemon/provider/score_provider/openssl/BUILD @@ -37,7 +37,6 @@ cc_library( cc_library( name = "provider_openssl_headers", hdrs = [ - "openssl_provider_factory.hpp", "operations/factory/openssl_handler_factory.hpp", "operations/hash/openssl_hash_handler.hpp", "operations/key_management/openssl_key_management_handler.hpp", @@ -71,7 +70,7 @@ cc_library( "provider_openssl.cpp", ], implementation_deps = [ - "//third_party/openssl", + "//third_party/openssl:openssl", ], includes = ["."], linkstatic = True, @@ -88,14 +87,3 @@ cc_library( "//score/crypto/daemon/provider/handler:handler_utils_impl", ], ) - -cc_library( - name = "provider_openssl_factory", - srcs = ["openssl_provider_factory.cpp"], - hdrs = ["openssl_provider_factory.hpp"], - visibility = ["//:__subpackages__"], - deps = [ - ":provider_openssl_library", - "//score/crypto/daemon/provider:provider_headers", - ], -) diff --git a/score/crypto/daemon/provider/score_provider/openssl/openssl_provider_factory.cpp b/score/crypto/daemon/provider/score_provider/openssl/openssl_provider_factory.cpp deleted file mode 100644 index 92fc4aea..00000000 --- a/score/crypto/daemon/provider/score_provider/openssl/openssl_provider_factory.cpp +++ /dev/null @@ -1,32 +0,0 @@ -/******************************************************************************** - * Copyright (c) 2026 Contributors to the Eclipse Foundation - * - * See the NOTICE file(s) distributed with this work for additional - * information regarding copyright ownership. - * - * This program and the accompanying materials are made available under the - * terms of the Apache License Version 2.0 which is available at - * https://www.apache.org/licenses/LICENSE-2.0 - * - * SPDX-License-Identifier: Apache-2.0 - ********************************************************************************/ - -#include "score/crypto/daemon/provider/score_provider/openssl/openssl_provider_factory.hpp" - -#include - -#include "score/crypto/daemon/common/types.hpp" -#include "score/crypto/daemon/provider/provider_manager.hpp" -#include "score/crypto/daemon/provider/score_provider/openssl/provider_openssl.hpp" - -namespace score::crypto::daemon::provider::score_provider::openssl -{ - -bool OpenSSLProviderFactory::CreateAndRegister(ProviderManager& manager) -{ - auto openSSLProvider = std::make_shared(); - return manager.RegisterProvider( - common::kProviderNameOpenSSL, openSSLProvider, common::CryptoProviderType::SOFTWARE); -} - -} // namespace score::crypto::daemon::provider::score_provider::openssl diff --git a/score/crypto/daemon/provider/score_provider/openssl/openssl_provider_factory.hpp b/score/crypto/daemon/provider/score_provider/openssl/openssl_provider_factory.hpp deleted file mode 100644 index 47e1b4e0..00000000 --- a/score/crypto/daemon/provider/score_provider/openssl/openssl_provider_factory.hpp +++ /dev/null @@ -1,48 +0,0 @@ -/******************************************************************************** - * Copyright (c) 2026 Contributors to the Eclipse Foundation - * - * See the NOTICE file(s) distributed with this work for additional - * information regarding copyright ownership. - * - * This program and the accompanying materials are made available under the - * terms of the Apache License Version 2.0 which is available at - * https://www.apache.org/licenses/LICENSE-2.0 - * - * SPDX-License-Identifier: Apache-2.0 - ********************************************************************************/ - -#ifndef SCORE_CRYPTO_DAEMON_PROVIDER_SCORE_PROVIDER_OPENSSL_PROVIDER_FACTORY_HPP -#define SCORE_CRYPTO_DAEMON_PROVIDER_SCORE_PROVIDER_OPENSSL_PROVIDER_FACTORY_HPP - -#include "score/crypto/daemon/provider/i_provider_factory.hpp" - -namespace score::crypto::daemon::provider::score_provider::openssl -{ - -/** - * @brief Factory that creates and registers the OpenSSL software provider. - * - * Constructs an openssl::OpenSSL instance and registers it under the - * common::kProviderNameOpenSSL name with CryptoProviderType::SOFTWARE. - * - * No configuration fields are required — the OpenSSL provider needs no - * per-token setup beyond what is compiled in. - */ -class OpenSSLProviderFactory final : public IProviderFactory -{ - public: - OpenSSLProviderFactory() = default; - ~OpenSSLProviderFactory() override = default; - - /** - * @brief Constructs an OpenSSL provider and registers it as SOFTWARE. - * - * @param manager The ProviderManager to register the provider into. - * @return true if the provider was registered successfully. - */ - bool CreateAndRegister(ProviderManager& manager) override; -}; - -} // namespace score::crypto::daemon::provider::score_provider::openssl - -#endif // SCORE_CRYPTO_DAEMON_PROVIDER_SCORE_PROVIDER_OPENSSL_PROVIDER_FACTORY_HPP diff --git a/score/crypto/daemon/provider/score_provider/score_backend_adapter.hpp b/score/crypto/daemon/provider/score_provider/score_backend_adapter.hpp new file mode 100644 index 00000000..67b59466 --- /dev/null +++ b/score/crypto/daemon/provider/score_provider/score_backend_adapter.hpp @@ -0,0 +1,91 @@ +/******************************************************************************** + * Copyright (c) 2026 Contributors to the Eclipse Foundation + * + * See the NOTICE file(s) distributed with this work for additional + * information regarding copyright ownership. + * + * This program and the accompanying materials are made available under the + * terms of the Apache License Version 2.0 which is available at + * https://www.apache.org/licenses/LICENSE-2.0 + * + * SPDX-License-Identifier: Apache-2.0 + ********************************************************************************/ + +#ifndef SCORE_CRYPTO_DAEMON_PROVIDER_SCORE_PROVIDER_SCORE_BACKEND_ADAPTER_HPP +#define SCORE_CRYPTO_DAEMON_PROVIDER_SCORE_PROVIDER_SCORE_BACKEND_ADAPTER_HPP + +#include "score/crypto/daemon/provider/i_provider.hpp" + +#include +#include +#include + +namespace score::crypto::daemon::provider::score_provider +{ + +/// @brief Provider creator metadata for a score provider backend. +/// +/// Contains backend identification and a provider construction function. +/// ScoreProviderFactory uses this to create IProvider instances and +/// register them under the name and type from ScoreProviderEntry. +struct ProviderCreator +{ + /// Unique identifier for the backend (e.g., "openssl", "primula"). + /// Matched against ScoreProviderEntry::providerImpl during dispatch. + std::string backend_id; + + /// Human-readable name for the backend (e.g., "OPENSSL", "PRIMULA"). + /// Used as the default providerName when populating ScoreProviderEntry via ParseConfig(). + std::string backend_name; + + /// Provider type string (e.g., "SOFTWARE", "HARDWARE", "SPECIALIZED"). + /// Used as the default providerType when populating ScoreProviderEntry via ParseConfig(). + std::string provider_type{"SOFTWARE"}; + + /// Constructs and returns the concrete IProvider for this backend. + /// Registration (name, type, ProviderManager) is handled by ScoreProviderFactory. + std::function()> create_provider; +}; + +/// @brief Interface for score provider backend adapters. +/// +/// Each backend (OpenSSL, BoringSSL, mbedTLS) implements this interface to +/// expose a ProviderCreator. ScoreProviderFactory discovers active backends +/// at compile-time via backend/score_provider/active_backends_list.hpp and uses the creator +/// to construct IProvider instances; registration into ProviderManager is +/// handled by ScoreProviderFactory using config-driven name and type. +/// +/// Example implementation: +/// @code +/// class OpenSSLBackendAdapter : public IBackendProviderAdapter { +/// public: +/// ProviderCreator GetProviderCreator() const override { +/// return { +/// .backend_id = "openssl", +/// .backend_name = "OPENSSL", +/// .provider_type = "SOFTWARE", +/// .create_provider = []() { +/// return std::make_unique(); +/// } +/// }; +/// } +/// }; +/// @endcode +class IBackendProviderAdapter +{ + public: + virtual ~IBackendProviderAdapter() = default; + + /// @brief Returns the ProviderCreator for this backend. + /// + /// Called by ScoreProviderFactory per config entry to construct the + /// IProvider. Name and type for registration come from ScoreProviderEntry. + [[nodiscard]] virtual ProviderCreator GetProviderCreator() const = 0; + + protected: + IBackendProviderAdapter() = default; +}; + +} // namespace score::crypto::daemon::provider::score_provider + +#endif // SCORE_CRYPTO_DAEMON_PROVIDER_SCORE_PROVIDER_SCORE_BACKEND_ADAPTER_HPP diff --git a/score/crypto/daemon/provider/score_provider/score_provider_config.hpp b/score/crypto/daemon/provider/score_provider/score_provider_config.hpp index 37f195a1..deb6f54d 100644 --- a/score/crypto/daemon/provider/score_provider/score_provider_config.hpp +++ b/score/crypto/daemon/provider/score_provider/score_provider_config.hpp @@ -35,6 +35,9 @@ struct ScoreProviderEntry std::string providerName{}; /// Implementation tag that selects the concrete factory, e.g. "openssl". std::string providerImpl{}; + /// Provider type (SOFTWARE, HARDWARE, etc.) + /// Note: Uses string to avoid including common/types.hpp in config header + std::string providerType{"SOFTWARE"}; }; /// @brief Aggregates the ordered list of score-interface provider entries for the daemon. @@ -49,7 +52,7 @@ struct ScoreProviderEntry /// factory configuration lives entirely within the score_provider subsystem. /// Typical bootstrapper usage: /// @code -/// config.GetScoreProviderConfig().PopulateDefaults(); +/// config.GetScoreProviderConfig().ParseConfig(); /// auto factory = std::make_unique(); /// config.GetScoreProviderConfig().Configure(*factory); /// provider_manager->RegisterFactory(std::move(factory)); @@ -71,11 +74,13 @@ class ScoreProviderConfig return m_providers; } - /// @brief Populate production default provider entries when no config was loaded. + /// @brief Parse configuration from backend implementations and populate provider entries. /// - /// Adds an OpenSSL software entry with standard defaults. No-op if any - /// provider entries are already present (e.g. loaded from file or test fixture). - void PopulateDefaults(); + /// Unlike PKCS#11 (which selects one backend via label_flag), score providers support + /// multiple simultaneous backends. This method aggregates provider entries from all + /// enabled backends (OpenSSL, BoringSSL, etc.) that are linked into the build. + /// Each backend contributes its ParseConfig() implementation. No-op if entries already present. + void ParseConfig(); /// @brief Visit @p factory: convert each provider entry and configure the factory. /// diff --git a/score/crypto/daemon/provider/score_provider/score_provider_factory.hpp b/score/crypto/daemon/provider/score_provider/score_provider_factory.hpp index c1916242..05996cd2 100644 --- a/score/crypto/daemon/provider/score_provider/score_provider_factory.hpp +++ b/score/crypto/daemon/provider/score_provider/score_provider_factory.hpp @@ -26,8 +26,8 @@ namespace score::crypto::daemon::provider::score_provider /// /// Mirrors the Pkcs11ProviderFactory pattern: accepts a vector of configuration /// entries, each describing a concrete score-interface provider to create. -/// CreateAndRegister() iterates the entries and delegates to the respective -/// internal provider factory (e.g. OpenSSLProviderFactory). +/// CreateAndRegister() iterates the entries, constructs each IProvider via the +/// matching backend's ProviderCreator, and registers it into ProviderManager. /// /// Configuration is supplied externally via SetConfigs() (the acceptor side of /// the ScoreProviderConfig visitor pattern) or the explicit vector constructor. diff --git a/score/crypto/daemon/provider/score_provider/src/score_provider_config.cpp b/score/crypto/daemon/provider/score_provider/src/score_provider_config.cpp index bdac8cd0..84fcc001 100644 --- a/score/crypto/daemon/provider/score_provider/src/score_provider_config.cpp +++ b/score/crypto/daemon/provider/score_provider/src/score_provider_config.cpp @@ -18,18 +18,6 @@ namespace score::crypto::daemon::provider::score_provider { -void ScoreProviderConfig::PopulateDefaults() -{ - if (!m_providers.empty()) - { - return; // Entries already present (from config file or test fixture). - } - ScoreProviderEntry openssl{}; - openssl.providerName = "OPENSSL"; - openssl.providerImpl = "openssl"; - m_providers.push_back(std::move(openssl)); -} - void ScoreProviderConfig::Configure(ScoreProviderFactory& factory) const { factory.SetConfigs(m_providers); diff --git a/score/crypto/daemon/provider/score_provider/src/score_provider_factory.cpp b/score/crypto/daemon/provider/score_provider/src/score_provider_factory.cpp index 187ee6b4..46ddc03d 100644 --- a/score/crypto/daemon/provider/score_provider/src/score_provider_factory.cpp +++ b/score/crypto/daemon/provider/score_provider/src/score_provider_factory.cpp @@ -12,9 +12,10 @@ ********************************************************************************/ #include "score/crypto/daemon/provider/score_provider/score_provider_factory.hpp" -#include "score/crypto/daemon/provider/provider_manager.hpp" -#include "score/crypto/daemon/provider/score_provider/openssl/openssl_provider_factory.hpp" +#include "score/crypto/backend/score_provider/active_backends_list.hpp" +#include "score/crypto/daemon/common/types.hpp" +#include "score/crypto/daemon/provider/provider_manager.hpp" #include "score/mw/log/logging.h" namespace score::crypto::daemon::provider::score_provider @@ -30,25 +31,37 @@ void ScoreProviderFactory::SetConfigs(std::vector configs) bool ScoreProviderFactory::CreateAndRegister(ProviderManager& manager) { bool all_ok = true; + + // Get active backends to resolve providerImpl -> factory creator + auto backends = backend::GetActiveBackends(); + for (const auto& entry : m_configs) { - if (entry.providerImpl == "openssl") - { - openssl::OpenSSLProviderFactory openssl_factory; - if (!openssl_factory.CreateAndRegister(manager)) - { - score::mw::log::LogError() - << "[ScoreProviderFactory] Failed to create OpenSSL provider:" << entry.providerName; - all_ok = false; - } - } - else + // Find backend adapter for this provider implementation + auto backend_it = std::find_if(backends.begin(), backends.end(), [&entry](const auto& backend) { + return backend->GetProviderCreator().backend_id == entry.providerImpl; + }); + + if (backend_it == backends.end()) { score::mw::log::LogError() << "[ScoreProviderFactory] Unknown provider implementation: " << entry.providerImpl; all_ok = false; + continue; + } + + // Construct the provider via the backend's creator; register with config-driven name and type + auto creator = (*backend_it)->GetProviderCreator(); + auto provider = creator.create_provider(); + auto type = common::CryptoProviderTypeFromString(entry.providerType); + + if (!manager.RegisterProvider(entry.providerName, std::move(provider), type)) + { + score::mw::log::LogError() << "[ScoreProviderFactory] Failed to register provider: " << entry.providerName; + all_ok = false; } } + return all_ok; } From 6cd44f45bb6a5190eaa81405fe495d8f19d4aaea Mon Sep 17 00:00:00 2001 From: Athul Mallappallil Date: Fri, 17 Jul 2026 12:43:58 +0000 Subject: [PATCH 08/14] Adapt pkcs11 provider to support different backend - Pkcs11 adapter is agnostic to backend library --- score/crypto/daemon/provider/pkcs11/BUILD | 15 +++++++-- .../daemon/provider/pkcs11/pkcs11_module.hpp | 1 + .../pkcs11/pkcs11_provider_factory.cpp | 31 +++++++++++++++--- .../pkcs11/pkcs11_provider_factory.hpp | 17 ++++++---- .../provider/pkcs11/pkcs11_token_config.cpp | 32 +------------------ .../provider/pkcs11/pkcs11_token_config.hpp | 10 +++--- 6 files changed, 59 insertions(+), 47 deletions(-) diff --git a/score/crypto/daemon/provider/pkcs11/BUILD b/score/crypto/daemon/provider/pkcs11/BUILD index 0751bbb5..f0c21a2c 100644 --- a/score/crypto/daemon/provider/pkcs11/BUILD +++ b/score/crypto/daemon/provider/pkcs11/BUILD @@ -69,9 +69,11 @@ cc_library( "//score/crypto/daemon/provider/handler:handler_utils_impl", "//score/crypto/daemon/provider/handler:hash_handler_operations", "//score/crypto/daemon/provider/handler:mac_handler_operations", - "//third_party/soft_hsm:libsofthsm_shared", "@score_baselibs//score/result", ], + implementation_deps = [ + "//score/crypto/backend:active_pkcs11_backend", # Selected PKCS#11 backend + ], ) cc_library( @@ -91,6 +93,15 @@ cc_library( deps = [ ":pkcs11_token_config", ":provider_pkcs11_library", - "//score/crypto/daemon/provider:provider_headers", ], + implementation_deps = [ + "//score/crypto/backend:active_pkcs11_backend", # Selected PKCS#11 backend + ], +) + +# Alias for convenience - the full target is the factory +alias( + name = "pkcs11", + actual = ":provider_pkcs11_factory", + visibility = ["//:__subpackages__"], ) diff --git a/score/crypto/daemon/provider/pkcs11/pkcs11_module.hpp b/score/crypto/daemon/provider/pkcs11/pkcs11_module.hpp index 8d2abaca..7967dee2 100644 --- a/score/crypto/daemon/provider/pkcs11/pkcs11_module.hpp +++ b/score/crypto/daemon/provider/pkcs11/pkcs11_module.hpp @@ -182,6 +182,7 @@ struct Pkcs11ProviderConfig std::string userPin{}; std::string providerName{}; + std::string providerType{}; ///< Provider type string (e.g., "HARDWARE", "SOFTWARE") std::uint32_t maxRoSessionsOverride{0U}; ///< 0 = read from C_GetTokenInfo.ulMaxSessionCount std::uint32_t maxRwSessionsOverride{0U}; ///< 0 = read from C_GetTokenInfo.ulMaxRwSessionCount Pkcs11SessionCleanupStrategy cleanupStrategy{Pkcs11SessionCleanupStrategy::kSoftCleanup}; diff --git a/score/crypto/daemon/provider/pkcs11/pkcs11_provider_factory.cpp b/score/crypto/daemon/provider/pkcs11/pkcs11_provider_factory.cpp index f2bc0f85..9fbbabbf 100644 --- a/score/crypto/daemon/provider/pkcs11/pkcs11_provider_factory.cpp +++ b/score/crypto/daemon/provider/pkcs11/pkcs11_provider_factory.cpp @@ -24,12 +24,12 @@ namespace score::crypto::daemon::provider::pkcs11 { -Pkcs11ProviderFactory::Pkcs11ProviderFactory(std::vector configs) +Pkcs11ProviderFactory::Pkcs11ProviderFactory(std::vector configs) : m_injected_configs{std::move(configs)} { } -void Pkcs11ProviderFactory::SetTokenConfigs(std::vector configs) +void Pkcs11ProviderFactory::SetTokenConfigs(std::vector configs) { m_injected_configs = std::move(configs); } @@ -41,6 +41,28 @@ bool Pkcs11ProviderFactory::CreateAndRegister(ProviderManager& manager) return true; } + // Convert plain-data entries to internal PKCS#11 configs here, rather than + // in the header, so callers (including provider_manager_factory) never see + // pkcs11.h types. + auto convertTokenEntry = [](const Pkcs11TokenEntry& entry) { + Pkcs11ProviderConfig cfg{}; + cfg.tokenLabel = entry.tokenLabel; + cfg.tokenModel = entry.tokenModel; + cfg.userPin = entry.userPin; + cfg.providerName = entry.providerName; + cfg.providerType = entry.providerType; + cfg.cleanupStrategy = entry.useHardCleanup ? Pkcs11SessionCleanupStrategy::kHardCleanup + : Pkcs11SessionCleanupStrategy::kSoftCleanup; + return cfg; + }; + + std::vector provider_configs; + provider_configs.reserve(m_injected_configs.size()); + for (const auto& entry : m_injected_configs) + { + provider_configs.push_back(convertTokenEntry(entry)); + } + // All tokens on the same linked library MUST share a single Pkcs11Module // so that C_Initialize is called exactly once and C_Finalize is deferred // until the very last provider (and therefore all its sessions) is destroyed. @@ -51,10 +73,11 @@ bool Pkcs11ProviderFactory::CreateAndRegister(ProviderManager& manager) return false; } - for (const auto& config : m_injected_configs) + for (const auto& config : provider_configs) { auto provider = std::make_shared(config, pkcs11Module); - if (!manager.RegisterProvider(config.providerName, provider, common::CryptoProviderType::HARDWARE)) + if (!manager.RegisterProvider( + config.providerName, provider, common::CryptoProviderTypeFromString(config.providerType))) { return false; } diff --git a/score/crypto/daemon/provider/pkcs11/pkcs11_provider_factory.hpp b/score/crypto/daemon/provider/pkcs11/pkcs11_provider_factory.hpp index 08817d26..cf21272c 100644 --- a/score/crypto/daemon/provider/pkcs11/pkcs11_provider_factory.hpp +++ b/score/crypto/daemon/provider/pkcs11/pkcs11_provider_factory.hpp @@ -15,7 +15,7 @@ #define SCORE_CRYPTO_DAEMON_PROVIDER_PKCS11_PROVIDER_FACTORY_HPP #include "score/crypto/daemon/provider/i_provider_factory.hpp" -#include "score/crypto/daemon/provider/pkcs11/pkcs11_module.hpp" +#include "score/crypto/daemon/provider/pkcs11/pkcs11_token_config.hpp" #include @@ -36,6 +36,11 @@ namespace score::crypto::daemon::provider::pkcs11 * manager.RegisterFactory(std::move(factory)); * @endcode * + * The factory accepts plain-data Pkcs11TokenEntry objects and converts them to + * the internal Pkcs11ProviderConfig type in the implementation file. This keeps + * pkcs11.h (and CK_* types) out of this header so that provider_manager_factory + * does not transitively depend on the PKCS#11 C API. + * * All configured tokens share a single Pkcs11Module so that C_Initialize is * called only once for the linked PKCS#11 library, regardless of how many * token-bound providers are registered. @@ -50,14 +55,14 @@ class Pkcs11ProviderFactory final : public IProviderFactory /// /// Called by Pkcs11Config::Configure() via SetTokenConfigs(), or directly /// in tests that need to inject specific PKCS#11 provider configs. - explicit Pkcs11ProviderFactory(std::vector configs); + explicit Pkcs11ProviderFactory(std::vector configs); /// @brief Accept a token-config vector pushed by Pkcs11Config::Configure(). /// /// This is the "acceptor" side of the visitor pattern: Pkcs11Config - /// (the visitor) converts its Pkcs11TokenEntry list to Pkcs11ProviderConfigs - /// and hands them to the factory via this method. - void SetTokenConfigs(std::vector configs); + /// (the visitor) hands its Pkcs11TokenEntry list to the factory via this + /// method. The conversion to Pkcs11ProviderConfig happens internally. + void SetTokenConfigs(std::vector configs); ~Pkcs11ProviderFactory() override = default; @@ -77,7 +82,7 @@ class Pkcs11ProviderFactory final : public IProviderFactory private: /// Token configurations injected at construction (empty = no providers registered). - std::vector m_injected_configs; + std::vector m_injected_configs; }; } // namespace score::crypto::daemon::provider::pkcs11 diff --git a/score/crypto/daemon/provider/pkcs11/pkcs11_token_config.cpp b/score/crypto/daemon/provider/pkcs11/pkcs11_token_config.cpp index 1f1fda9e..064e57dc 100644 --- a/score/crypto/daemon/provider/pkcs11/pkcs11_token_config.cpp +++ b/score/crypto/daemon/provider/pkcs11/pkcs11_token_config.cpp @@ -13,44 +13,14 @@ #include "score/crypto/daemon/provider/pkcs11/pkcs11_token_config.hpp" -// pkcs11_module.hpp brings in Pkcs11ProviderConfig + Pkcs11SessionCleanupStrategy; -// pkcs11_provider_factory.hpp brings in SetTokenConfigs() and the full class definition. -#include "score/crypto/daemon/provider/pkcs11/pkcs11_module.hpp" #include "score/crypto/daemon/provider/pkcs11/pkcs11_provider_factory.hpp" namespace score::crypto::daemon::provider::pkcs11 { -void Pkcs11Config::PopulateDefaults() -{ - if (!m_tokens.empty()) - { - return; // Entries already present (from config file or test fixture). - } - Pkcs11TokenEntry softHsm{}; - softHsm.tokenLabel = "SoftHSM"; - softHsm.userPin = "1234"; - softHsm.providerName = "SOFTHSM"; - softHsm.useHardCleanup = true; - m_tokens.push_back(std::move(softHsm)); -} - void Pkcs11Config::Configure(Pkcs11ProviderFactory& factory) const { - std::vector configs; - configs.reserve(m_tokens.size()); - for (const auto& entry : m_tokens) - { - Pkcs11ProviderConfig cfg{}; - cfg.tokenLabel = entry.tokenLabel; - cfg.tokenModel = entry.tokenModel; - cfg.userPin = entry.userPin; - cfg.providerName = entry.providerName; - cfg.cleanupStrategy = entry.useHardCleanup ? Pkcs11SessionCleanupStrategy::kHardCleanup - : Pkcs11SessionCleanupStrategy::kSoftCleanup; - configs.push_back(std::move(cfg)); - } - factory.SetTokenConfigs(std::move(configs)); + factory.SetTokenConfigs(m_tokens); } } // namespace score::crypto::daemon::provider::pkcs11 diff --git a/score/crypto/daemon/provider/pkcs11/pkcs11_token_config.hpp b/score/crypto/daemon/provider/pkcs11/pkcs11_token_config.hpp index 053f0070..8dca1b13 100644 --- a/score/crypto/daemon/provider/pkcs11/pkcs11_token_config.hpp +++ b/score/crypto/daemon/provider/pkcs11/pkcs11_token_config.hpp @@ -39,6 +39,9 @@ struct Pkcs11TokenEntry std::string userPin{}; /// Provider name used to register and look up this provider in ProviderManager. std::string providerName{}; + /// Provider Type used to register this provider in ProviderManager (HARDWARE or SOFTWARE). + std::string providerType{"HARDWARE"}; + /// Cleanup strategy for session objects (soft vs hard cleanup). /// true = kHardCleanup (re-open session after every handler), false = kSoftCleanup. bool useHardCleanup{true}; }; @@ -77,11 +80,10 @@ class Pkcs11Config return m_tokens; } - /// @brief Populate production default token entries when no config was loaded. + /// @brief Parse the configuration and populate the token information. /// - /// Adds a SoftHSM entry with standard test credentials. No-op if any - /// token entries are already present (e.g. loaded from file or test fixture). - void PopulateDefaults(); + /// This method parses the pkcs11 configuration and populates the token information. + void ParseConfig(); /// @brief Visit @p factory: convert each token entry and configure the factory. /// From 146cb81bd33203316b351d05e11eff1321a182ec Mon Sep 17 00:00:00 2001 From: Athul Mallappallil Date: Fri, 17 Jul 2026 12:45:38 +0000 Subject: [PATCH 09/14] backend provider integration and configuration --- score/crypto/backend/BUILD | 90 ++++++++++++ score/crypto/backend/README.md | 137 ++++++++++++++++++ score/crypto/backend/backend_config.bzl | 90 ++++++++++++ score/crypto/backend/backend_exports.bzl | 71 +++++++++ score/crypto/backend/openssl/BUILD | 35 +++++ .../openssl/openssl_backend_adapter.cpp | 33 +++++ .../openssl/openssl_backend_adapter.hpp | 57 ++++++++ score/crypto/backend/pkcs11/BUILD | 41 ++++++ .../pkcs11/pkcs11_token_config_parser.cpp | 33 +++++ score/crypto/backend/score_provider/BUILD | 44 ++++++ .../score_provider/active_backends_list.hpp | 74 ++++++++++ .../score_provider_config_parser.cpp | 45 ++++++ 12 files changed, 750 insertions(+) create mode 100644 score/crypto/backend/BUILD create mode 100644 score/crypto/backend/README.md create mode 100644 score/crypto/backend/backend_config.bzl create mode 100644 score/crypto/backend/backend_exports.bzl create mode 100644 score/crypto/backend/openssl/BUILD create mode 100644 score/crypto/backend/openssl/openssl_backend_adapter.cpp create mode 100644 score/crypto/backend/openssl/openssl_backend_adapter.hpp create mode 100644 score/crypto/backend/pkcs11/BUILD create mode 100644 score/crypto/backend/pkcs11/pkcs11_token_config_parser.cpp create mode 100644 score/crypto/backend/score_provider/BUILD create mode 100644 score/crypto/backend/score_provider/active_backends_list.hpp create mode 100644 score/crypto/backend/score_provider/score_provider_config_parser.cpp diff --git a/score/crypto/backend/BUILD b/score/crypto/backend/BUILD new file mode 100644 index 00000000..6b6233a6 --- /dev/null +++ b/score/crypto/backend/BUILD @@ -0,0 +1,90 @@ +# ******************************************************************************* +# Copyright (c) 2026 Contributors to the Eclipse Foundation +# +# See the NOTICE file(s) distributed with this work for additional +# information regarding copyright ownership. +# +# This program and the accompanying materials are made available under the +# terms of the Apache License Version 2.0 which is available at +# https://www.apache.org/licenses/LICENSE-2.0 +# +# SPDX-License-Identifier: Apache-2.0 +# ******************************************************************************* + +load("@rules_cc//cc:defs.bzl", "cc_library") +load(":backend_exports.bzl", + "BACKEND_DEFINES", + "ENABLE_PKCS11_BACKEND", + "PKCS11_BACKEND_DEFAULT_LABEL", + "PKCS11_BACKEND_DEPS", + "SCORE_BACKEND_DEPS") + +# ============================================================================ +# Backend Architecture: +# ============================================================================ +# +# MASTER CONFIGURATION: All backend selection flags are in backend_exports.bzl +# +# PKCS#11 Backend: +# - Enable/disable: Set ENABLE_PKCS11_BACKEND in backend_exports.bzl +# - Implementation selection: Set PKCS11_BACKEND = "softhsm" | "vendor_hsm" | ... +# +# Score Provider Backends (multiple can be active simultaneously): +# - openssl/ : OpenSSL crypto backend +# - primula/ : Primula backend (future) +# Enable/disable by setting ENABLE_BACKEND_OPENSSL, etc. in backend_exports.bzl +# +# See backend_exports.bzl for the single source of truth for all backend flags. +# ============================================================================ +# + +# ============================================================================ +# Score Provider Backends +# ============================================================================ +# + +# Heavy: actual adapter implementations. +# Only score_provider_factory should consume this (via implementation_deps). +cc_library( + name = "active_score_backends", + visibility = ["//visibility:public"], + deps = [ + "//score/crypto/backend/score_provider:score_backend_defines", + ] + SCORE_BACKEND_DEPS, +) + +# ============================================================================ +# PKCS#11 Backend +# ============================================================================ +# + +# Label flag allowing command-line override of the PKCS#11 backend. +# Default value is derived from PKCS11_BACKEND in backend_exports.bzl. +# Example override: +# bazel build //score/crypto/daemon:crypto_daemon \ +# --//score/crypto/backend:pkcs11_backend=//external/vendor_hsm:backend +label_flag( + name = "pkcs11_backend", + build_setting_default = PKCS11_BACKEND_DEFAULT_LABEL, +) + +# Lightweight: single define exposing whether PKCS#11 is compiled in. +# Replaces the __has_include anti-pattern in provider_manager_factory. +cc_library( + name = "pkcs11_backend_defines", + visibility = ["//visibility:public"], + defines = (["SCORE_CRYPTO_PKCS11_ENABLED=1"] if ENABLE_PKCS11_BACKEND else []), +) + +# PKCS#11 backend: selected library + fixed config parser. +# Only provider_pkcs11_library/factory should consume this (via implementation_deps). +cc_library( + name = "active_pkcs11_backend", + visibility = ["//visibility:public"], + deps = [ + ":pkcs11_backend_defines", + ] + ([ + ":pkcs11_backend", + "//score/crypto/backend/pkcs11:pkcs11_config_parser", + ] if ENABLE_PKCS11_BACKEND else []), +) diff --git a/score/crypto/backend/README.md b/score/crypto/backend/README.md new file mode 100644 index 00000000..c295b1b0 --- /dev/null +++ b/score/crypto/backend/README.md @@ -0,0 +1,137 @@ +# Backend Configuration + +This folder controls which cryptographic backends are compiled into the daemon. +It is the **single source of truth** for backend selection at build time. + +## Files + +| File | Purpose | +|------|---------| +| `backend_exports.bzl` | Master flags (`ENABLE_BACKEND_OPENSSL`, `PKCS11_BACKEND`, ...) | +| `backend_config.bzl` | Helper functions that map flags to Bazel labels/defines | +| `BUILD` | Bazel targets: `active_score_backends`, `active_pkcs11_backend`, `pkcs11_backend` label_flag | +| `score_provider/active_backends_list.hpp` | Compile-time discovery of enabled score backends | + +## How It Works + +### Score Provider Backends + +A single `ScoreProviderFactory` handles multiple score backends (OpenSSL, Primula, etc.). +The factory discovers enabled backends at compile time via `score_provider/active_backends_list.hpp`. +Each backend adapter exposes: + +- `backend_id` — implementation tag used for dispatch (e.g. `"openssl"`) +- `backend_name` — human-readable provider name (e.g. `"OPENSSL"`) +- `provider_type` — `"SOFTWARE"`, `"HARDWARE"` or `"SPECIALIZED"` +- `create_provider` — factory function for the concrete provider + +### PKCS#11 Backends + +A separate `Pkcs11ProviderFactory` handles the PKCS#11 family. Only one PKCS#11 +backend can be active at a time. The active backend is selected through a Bazel +`label_flag`: + +```starlark +# backend/BUILD +label_flag( + name = "pkcs11_backend", + build_setting_default = PKCS11_BACKEND_DEFAULT_LABEL, +) +``` + +The default value comes from `PKCS11_BACKEND` in `backend_exports.bzl`. It can be +overridden on the command line: + +```bash +bazel build //score/crypto/daemon:crypto_daemon \ + --//score/crypto/backend:pkcs11_backend=//external/vendor_hsm:backend +``` + +Each PKCS#11 backend target provides: + +1. A `Pkcs11Config::ParseConfig()` implementation with backend-specific defaults +2. The PKCS#11 library and headers for linking + +## Configuration (`backend_exports.bzl`) + +```starlark +# Backend family flags +ENABLE_PKCS11_BACKEND = True # Enable/disable PKCS#11 +ENABLE_SCORE_BACKEND = True # Enable/disable all score backends + +# Individual score backends (only if ENABLE_SCORE_BACKEND = True) +ENABLE_BACKEND_OPENSSL = True +ENABLE_BACKEND_PRIMULA = False + +# Active PKCS#11 backend (only if ENABLE_PKCS11_BACKEND = True) +PKCS11_BACKEND = "softhsm" # Options: "softhsm", "vendor_hsm", ... +``` + +## Adding a New Score Backend + +1. Implement the provider in `score_provider//` +2. Create an adapter in `backend//`: + ```cpp + ProviderCreator GetProviderCreator() const override { + return { + .backend_id = "", + .backend_name = "", + .provider_type = "SOFTWARE", // or "HARDWARE", "SPECIALIZED" + .create_provider = []() { return std::make_unique<...>(); } + }; + } + ``` +3. Add flags to `backend_exports.bzl` and update `backend_config.bzl` +4. Update `score_provider/active_backends_list.hpp` (include + instantiate) + +## Adding a New PKCS#11 Backend + +Config parsing (`Pkcs11Config::ParseConfig`) lives in `backend/pkcs11/` and is +independent of which backend library is selected. Backend targets provide only +the PKCS#11 library and headers. + +1. Add the backend name → library label mapping in `backend_config.bzl`: + ```starlark + def _pkcs11_backend_map(): + return { + "softhsm": "//third_party/soft_hsm:softhsm", + "": "//third_party/:", # NEW + } + ``` +2. Select it in `backend_exports.bzl`: + ```starlark + PKCS11_BACKEND = "" + ``` + Or override at build time: + ```bash + bazel build //score/crypto/daemon:crypto_daemon \ + --//score/crypto/backend:pkcs11_backend=//third_party/: + ``` + +## Common Configurations + +| Use Case | Config | +|----------|--------| +| **Software-only** | `ENABLE_PKCS11_BACKEND = False`
`ENABLE_SCORE_BACKEND = True`
`ENABLE_BACKEND_OPENSSL = True` | +| **HSM-only** | `ENABLE_PKCS11_BACKEND = True`
`ENABLE_SCORE_BACKEND = False`
`PKCS11_BACKEND = "vendor_hsm"` | +| **Hybrid** | Both families enabled | + +## Command-Line Overrides + +| What | Example | +|------|---------| +| PKCS#11 backend | `--//score/crypto/backend:pkcs11_backend=//external/vendor_hsm:backend` | + +## Verification + +Check which backends are compiled into the daemon: + +```bash +bazel query 'deps(//score/crypto/daemon:crypto_daemon)' | grep -E "openssl|softhsm" +``` + +Check the effective PKCS#11 backend: + +```bash +bazel cquery //score/crypto/daemon:crypto_daemon --output=build | grep pkcs11_backend +``` diff --git a/score/crypto/backend/backend_config.bzl b/score/crypto/backend/backend_config.bzl new file mode 100644 index 00000000..fd022442 --- /dev/null +++ b/score/crypto/backend/backend_config.bzl @@ -0,0 +1,90 @@ +"""Backend configuration helpers for score crypto backends.""" + +def backend_defines(enable_score_backend, enable_openssl, enable_primula): + """Generate preprocessor defines for enabled backends. + + Args: + enable_score_backend: Whether score backend family is enabled + enable_openssl: Whether OpenSSL backend is enabled + enable_primula: Whether Primula backend is enabled + + Returns: + List of preprocessor defines (e.g., ["SCORE_BACKEND_ENABLED=1", + "SCORE_BACKEND_OPENSSL_ENABLED=1"]) + """ + if not enable_score_backend: + return [] + + defines = ["SCORE_BACKEND_ENABLED=1"] + if enable_openssl: + defines.append("SCORE_BACKEND_OPENSSL_ENABLED=1") + if enable_primula: + defines.append("SCORE_BACKEND_PRIMULA_ENABLED=1") + return defines + +def backend_deps(enable_score_backend, enable_openssl, enable_primula): + """Generate backend adapter dependencies. + + Args: + enable_score_backend: Whether score backend family is enabled + enable_openssl: Whether OpenSSL backend is enabled + enable_primula: Whether Primula backend is enabled + + Returns: + List of backend adapter dependency labels + """ + if not enable_score_backend: + return [] + + deps = [] + if enable_openssl: + deps.append("//score/crypto/backend/openssl:openssl_backend_adapter") + if enable_primula: + deps.append("//score/crypto/backend/primula:primula_backend_adapter") + return deps + +def _pkcs11_backend_map(): + """Return the mapping of PKCS#11 backend names to Bazel labels.""" + return { + "softhsm": "//third_party/soft_hsm:softhsm", + # Future backends point directly to their library target, e.g.: + # "vendor_hsm": "//third_party/vendor_hsm:vendor_hsm", + } + +def pkcs11_backend_label(backend_name): + """Map a PKCS#11 backend name to its Bazel label. + + Args: + backend_name: Name of PKCS#11 backend ("softhsm", "vendor_hsm", etc.) + + Returns: + Bazel label string for the selected backend + + Raises: + fail: If the backend name is unknown + """ + backend_map = _pkcs11_backend_map() + target = backend_map.get(backend_name) + if not target: + fail("Unknown PKCS#11 backend: '{}'. Valid options: {}".format( + backend_name, ", ".join(backend_map.keys()))) + return target + +def pkcs11_backend_deps(enable_pkcs11, backend_name): + """Generate PKCS#11 backend dependency. + + Maps the backend name to its build target. The selected target provides + the PKCS#11 library and headers. Config parsing is a fixed dep, independent + of which backend library is selected. + + Args: + enable_pkcs11: Whether PKCS#11 backend family is enabled + backend_name: Name of PKCS#11 backend ("softhsm", "vendor_hsm", etc.) + + Returns: + List containing the selected backend target, or empty list if disabled + """ + if not enable_pkcs11: + return [] + + return [pkcs11_backend_label(backend_name)] diff --git a/score/crypto/backend/backend_exports.bzl b/score/crypto/backend/backend_exports.bzl new file mode 100644 index 00000000..a0590095 --- /dev/null +++ b/score/crypto/backend/backend_exports.bzl @@ -0,0 +1,71 @@ +"""Backend selection and build dependency exports. + +This file contains the master backend configuration flags and exports +computed dependency lists for consumption by other BUILD files. + +This is the SINGLE SOURCE OF TRUTH for backend selection. +To enable/disable backends, modify the flags below. +""" + +load(":backend_config.bzl", + "backend_defines", + "backend_deps", + "pkcs11_backend_deps", + "pkcs11_backend_label") + +# ============================================================================ +# MASTER BACKEND CONFIGURATION FLAGS +# +# Modify these flags to enable/disable backends. +# Changes here automatically propagate to both compilation and runtime linking. +# ============================================================================ + +# ============================================================================ +# PKCS#11 Backend Selection +# ============================================================================ + +# PKCS#11 backend family (True = enabled, False = excluded) +ENABLE_PKCS11_BACKEND = True + +# Active PKCS#11 backend implementation (only one at a time) +# Options: "softhsm", "vendor_hsm", "cryptoki", etc. +PKCS11_BACKEND = "softhsm" + +# ============================================================================ +# Score Provider Backend Selection +# ============================================================================ + +# Score provider backend family (True = enabled, False = excluded all) +ENABLE_SCORE_BACKEND = True + +# Individual score provider backends (multiple can be active simultaneously) +ENABLE_BACKEND_OPENSSL = True +ENABLE_BACKEND_PRIMULA = False + +# ============================================================================ +# COMPUTED EXPORTS (Do not modify below this line) +# ============================================================================ + +# Preprocessor defines for conditional compilation +BACKEND_DEFINES = backend_defines( + ENABLE_SCORE_BACKEND, + ENABLE_BACKEND_OPENSSL, + ENABLE_BACKEND_PRIMULA, +) + +# Build-time dependencies (backend adapters) +SCORE_BACKEND_DEPS = backend_deps( + ENABLE_SCORE_BACKEND, + ENABLE_BACKEND_OPENSSL, + ENABLE_BACKEND_PRIMULA, +) + +PKCS11_BACKEND_DEPS = pkcs11_backend_deps( + ENABLE_PKCS11_BACKEND, + PKCS11_BACKEND, +) + +# Default PKCS#11 backend label (used as label_flag default). +# Can be overridden at build time with: +# --//score/crypto/backend:pkcs11_backend=//some/other:target +PKCS11_BACKEND_DEFAULT_LABEL = pkcs11_backend_label(PKCS11_BACKEND) diff --git a/score/crypto/backend/openssl/BUILD b/score/crypto/backend/openssl/BUILD new file mode 100644 index 00000000..c42ec0ea --- /dev/null +++ b/score/crypto/backend/openssl/BUILD @@ -0,0 +1,35 @@ +# ******************************************************************************* +# Copyright (c) 2026 Contributors to the Eclipse Foundation +# +# See the NOTICE file(s) distributed with this work for additional +# information regarding copyright ownership. +# +# This program and the accompanying materials are made available under the +# terms of the Apache License Version 2.0 which is available at +# https://www.apache.org/licenses/LICENSE-2.0 +# +# SPDX-License-Identifier: Apache-2.0 +# ******************************************************************************* + +load("@rules_cc//cc:defs.bzl", "cc_library") + +# ============================================================================ +# OpenSSL Backend Adapter +# +# Provides registration/enablement layer for OpenSSL score provider backend. +# The actual OpenSSL provider implementation lives in +# daemon/provider/score_provider/openssl/. +# ============================================================================ + +cc_library( + name = "openssl_backend_adapter", + srcs = ["openssl_backend_adapter.cpp"], + hdrs = ["openssl_backend_adapter.hpp"], + visibility = [ + "//score/crypto/backend:__pkg__", # For active_backends_list.hpp + ], + deps = [ + "//score/crypto/daemon/provider/score_provider:score_backend_adapter", + "//score/crypto/daemon/provider/score_provider/openssl:provider_openssl_library", + ], +) diff --git a/score/crypto/backend/openssl/openssl_backend_adapter.cpp b/score/crypto/backend/openssl/openssl_backend_adapter.cpp new file mode 100644 index 00000000..bb022ba9 --- /dev/null +++ b/score/crypto/backend/openssl/openssl_backend_adapter.cpp @@ -0,0 +1,33 @@ +/******************************************************************************** + * Copyright (c) 2026 Contributors to the Eclipse Foundation + * + * See the NOTICE file(s) distributed with this work for additional + * information regarding copyright ownership. + * + * This program and the accompanying materials are made available under the + * terms of the Apache License Version 2.0 which is available at + * https://www.apache.org/licenses/LICENSE-2.0 + * + * SPDX-License-Identifier: Apache-2.0 + ********************************************************************************/ + +#include "openssl_backend_adapter.hpp" + +#include "score/crypto/daemon/provider/score_provider/openssl/provider_openssl.hpp" + +namespace score::crypto::backend::openssl +{ + +daemon::provider::score_provider::ProviderCreator OpenSSLBackendAdapter::GetProviderCreator() const +{ + using namespace daemon::provider::score_provider; + + return ProviderCreator{.backend_id = "openssl", + .backend_name = "OPENSSL", + .provider_type = "SOFTWARE", + .create_provider = []() -> std::unique_ptr { + return std::make_unique(); + }}; +} + +} // namespace score::crypto::backend::openssl diff --git a/score/crypto/backend/openssl/openssl_backend_adapter.hpp b/score/crypto/backend/openssl/openssl_backend_adapter.hpp new file mode 100644 index 00000000..3cbb99c0 --- /dev/null +++ b/score/crypto/backend/openssl/openssl_backend_adapter.hpp @@ -0,0 +1,57 @@ +/******************************************************************************** + * Copyright (c) 2026 Contributors to the Eclipse Foundation + * + * See the NOTICE file(s) distributed with this work for additional + * information regarding copyright ownership. + * + * This program and the accompanying materials are made available under the + * terms of the Apache License Version 2.0 which is available at + * https://www.apache.org/licenses/LICENSE-2.0 + * + * SPDX-License-Identifier: Apache-2.0 + ********************************************************************************/ + +#ifndef SCORE_CRYPTO_BACKEND_OPENSSL_OPENSSL_BACKEND_ADAPTER_HPP +#define SCORE_CRYPTO_BACKEND_OPENSSL_OPENSSL_BACKEND_ADAPTER_HPP + +#include "score/crypto/daemon/provider/score_provider/score_backend_adapter.hpp" + +namespace score::crypto::backend::openssl +{ + +/// @brief OpenSSL backend adapter for score provider family +/// +/// Provides factory creation metadata for the OpenSSL crypto backend. +/// This adapter is discovered at compile-time via backend/score_provider/active_backends_list.hpp +/// (generated from backend/BUILD). +/// +/// The OpenSSL backend implementation lives in: +/// - daemon/provider/score_provider/openssl/provider_openssl.* +/// - daemon/provider/score_provider/openssl/provider_openssl.* +/// - daemon/provider/score_provider/openssl/operations/* +/// +/// This adapter serves as the registration/enablement layer only. +class OpenSSLBackendAdapter final : public daemon::provider::score_provider::IBackendProviderAdapter +{ + public: + OpenSSLBackendAdapter() = default; + ~OpenSSLBackendAdapter() override = default; + + OpenSSLBackendAdapter(const OpenSSLBackendAdapter&) = delete; + OpenSSLBackendAdapter& operator=(const OpenSSLBackendAdapter&) = delete; + OpenSSLBackendAdapter(OpenSSLBackendAdapter&&) = delete; + OpenSSLBackendAdapter& operator=(OpenSSLBackendAdapter&&) = delete; + + /// @brief Get provider creator for the OpenSSL backend. + /// + /// Returns: + /// - backend_id: "openssl" + /// - backend_name: "OPENSSL" + /// - provider_type: "SOFTWARE" + /// - create_provider: constructs and returns a unique_ptr + [[nodiscard]] daemon::provider::score_provider::ProviderCreator GetProviderCreator() const override; +}; + +} // namespace score::crypto::backend::openssl + +#endif // SCORE_CRYPTO_BACKEND_OPENSSL_OPENSSL_BACKEND_ADAPTER_HPP diff --git a/score/crypto/backend/pkcs11/BUILD b/score/crypto/backend/pkcs11/BUILD new file mode 100644 index 00000000..8a424c59 --- /dev/null +++ b/score/crypto/backend/pkcs11/BUILD @@ -0,0 +1,41 @@ +# ******************************************************************************* +# Copyright (c) 2026 Contributors to the Eclipse Foundation +# +# See the NOTICE file(s) distributed with this work for additional +# information regarding copyright ownership. +# +# This program and the accompanying materials are made available under the +# terms of the Apache License Version 2.0 which is available at +# https://www.apache.org/licenses/LICENSE-2.0 +# +# SPDX-License-Identifier: Apache-2.0 +# ******************************************************************************* + +load("@rules_cc//cc:defs.bzl", "cc_library") + +# Default Pkcs11Config::ParseConfig() implementation. +# +# This is a fixed dependency of active_pkcs11_backend and is always present +# when PKCS#11 is enabled, regardless of which backend library is selected via +# the pkcs11_backend label_flag. +# +# Currently hardwires SoftHSM token defaults. Future: wire actual flatbuffer +# config parsing here without touching backend library targets. +# +# Backend subdirectories (softhsm/, vendor_hsm/, etc.) provide only the +# PKCS#11 library and headers — they do NOT own config parsing. +# +# To add a new PKCS#11 backend library: +# 1. Add entry to pkcs11_backend_label() in backend/backend_config.bzl pointing +# to the library target (third_party or external) +# 2. Set PKCS11_BACKEND = "" in backend/backend_exports.bzl +# Or override at build time: +# --//score/crypto/backend:pkcs11_backend=//third_party/your_hsm:your_hsm +cc_library( + name = "pkcs11_config_parser", + srcs = ["pkcs11_token_config_parser.cpp"], + visibility = ["//score/crypto/backend:__pkg__"], + deps = [ + "//score/crypto/daemon/provider/pkcs11:pkcs11_token_config", + ], +) diff --git a/score/crypto/backend/pkcs11/pkcs11_token_config_parser.cpp b/score/crypto/backend/pkcs11/pkcs11_token_config_parser.cpp new file mode 100644 index 00000000..432bf98c --- /dev/null +++ b/score/crypto/backend/pkcs11/pkcs11_token_config_parser.cpp @@ -0,0 +1,33 @@ +/******************************************************************************** + * Copyright (c) 2026 Contributors to the Eclipse Foundation + * + * See the NOTICE file(s) distributed with this work for additional + * information regarding copyright ownership. + * + * This program and the accompanying materials are made available under the + * terms of the Apache License Version 2.0 which is available at + * https://www.apache.org/licenses/LICENSE-2.0 + * + * SPDX-License-Identifier: Apache-2.0 + ********************************************************************************/ + +#include "score/crypto/daemon/provider/pkcs11/pkcs11_token_config.hpp" + +namespace score::crypto::daemon::provider::pkcs11 +{ + +void Pkcs11Config::ParseConfig() +{ + if (!m_tokens.empty()) + { + return; + } + Pkcs11TokenEntry entry{}; + entry.tokenLabel = "SoftHSM"; + entry.userPin = "1234"; + entry.providerName = "SOFTHSM"; + entry.useHardCleanup = true; + m_tokens.push_back(std::move(entry)); +} + +} // namespace score::crypto::daemon::provider::pkcs11 diff --git a/score/crypto/backend/score_provider/BUILD b/score/crypto/backend/score_provider/BUILD new file mode 100644 index 00000000..f4b5f306 --- /dev/null +++ b/score/crypto/backend/score_provider/BUILD @@ -0,0 +1,44 @@ +# ******************************************************************************* +# Copyright (c) 2026 Contributors to the Eclipse Foundation +# +# See the NOTICE file(s) distributed with this work for additional +# information regarding copyright ownership. +# +# This program and the accompanying materials are made available under the +# terms of the Apache License Version 2.0 which is available at +# https://www.apache.org/licenses/LICENSE-2.0 +# +# SPDX-License-Identifier: Apache-2.0 +# ******************************************************************************* + +load("@rules_cc//cc:defs.bzl", "cc_library") +load("//score/crypto/backend:backend_exports.bzl", "BACKEND_DEFINES") + +# Score provider backend - provides ScoreProviderConfig::ParseConfig() with +# default behaviour: discover all active backends via GetActiveBackends(). +# +# active_score_backends is in deps (not implementation_deps) so that +# score_provider_factory can still call GetActiveBackends() transitively +# via this target without needing a direct dep on active_score_backends. +cc_library( + name = "backend", + srcs = ["score_provider_config_parser.cpp"], + visibility = ["//visibility:public"], + deps = [ + "//score/crypto/backend:active_score_backends", + "//score/crypto/daemon/provider/score_provider:score_provider_config", + ], +) + +# Lightweight: preprocessor defines + discovery header only. +# Consumed by any target that needs to know which score provider backends are enabled +# (e.g. provider_manager_factory) without pulling in adapter implementations. +cc_library( + name = "score_backend_defines", + hdrs = ["active_backends_list.hpp"], + visibility = ["//visibility:public"], + defines = BACKEND_DEFINES, + deps = [ + "//score/crypto/daemon/provider/score_provider:score_backend_adapter", + ], +) diff --git a/score/crypto/backend/score_provider/active_backends_list.hpp b/score/crypto/backend/score_provider/active_backends_list.hpp new file mode 100644 index 00000000..3d4233d2 --- /dev/null +++ b/score/crypto/backend/score_provider/active_backends_list.hpp @@ -0,0 +1,74 @@ +/******************************************************************************** + * Copyright (c) 2026 Contributors to the Eclipse Foundation + * + * See the NOTICE file(s) distributed with this work for additional + * information regarding copyright ownership. + * + * This program and the accompanying materials are made available under the + * terms of the Apache License Version 2.0 which is available at + * https://www.apache.org/licenses/LICENSE-2.0 + * + * SPDX-License-Identifier: Apache-2.0 + ********************************************************************************/ + +#ifndef SCORE_CRYPTO_BACKEND_SCORE_PROVIDER_ACTIVE_BACKENDS_LIST_HPP +#define SCORE_CRYPTO_BACKEND_SCORE_PROVIDER_ACTIVE_BACKENDS_LIST_HPP + +#include "score/crypto/daemon/provider/score_provider/score_backend_adapter.hpp" + +#include +#include + +// Include enabled backend adapters (controlled by BUILD file defines) +#ifdef SCORE_BACKEND_OPENSSL_ENABLED +#include "score/crypto/backend/openssl/openssl_backend_adapter.hpp" +#endif + +#ifdef SCORE_BACKEND_PRIMULA_ENABLED +#include "score/crypto/backend/primula/primula_backend_adapter.hpp" +#endif + +namespace score::crypto::backend +{ + +/// @brief Get list of active score provider backends +/// +/// Returns a vector of backend adapters for all backends enabled in +/// backend/score_provider/BUILD. Backends are enabled via preprocessor defines set +/// in the BUILD file (e.g., SCORE_BACKEND_OPENSSL_ENABLED). +/// +/// Each backend adapter provides factory creation metadata (backend_id, +/// backend_name, create_provider function) that ScoreProviderFactory +/// uses to instantiate provider factories. +/// +/// @return Vector of IBackendProviderAdapter instances (one per enabled backend) +/// +/// @note This function creates new adapter instances on each call. +/// No global state is maintained. +inline std::vector> GetActiveBackends() +{ + std::vector> backends; + +// Reserve space if we know how many backends are enabled +#ifdef SCORE_BACKEND_OPENSSL_ENABLED + backends.reserve(backends.capacity() + 1); +#endif +#ifdef SCORE_BACKEND_PRIMULA_ENABLED + backends.reserve(backends.capacity() + 1); +#endif + +// Instantiate enabled backend adapters +#ifdef SCORE_BACKEND_OPENSSL_ENABLED + backends.push_back(std::make_unique()); +#endif + +#ifdef SCORE_BACKEND_PRIMULA_ENABLED + backends.push_back(std::make_unique()); +#endif + + return backends; +} + +} // namespace score::crypto::backend + +#endif // SCORE_CRYPTO_BACKEND_SCORE_PROVIDER_ACTIVE_BACKENDS_LIST_HPP diff --git a/score/crypto/backend/score_provider/score_provider_config_parser.cpp b/score/crypto/backend/score_provider/score_provider_config_parser.cpp new file mode 100644 index 00000000..a6689bea --- /dev/null +++ b/score/crypto/backend/score_provider/score_provider_config_parser.cpp @@ -0,0 +1,45 @@ +/******************************************************************************** + * Copyright (c) 2026 Contributors to the Eclipse Foundation + * + * See the NOTICE file(s) distributed with this work for additional + * information regarding copyright ownership. + * + * This program and the accompanying materials are made available under the + * terms of the Apache License Version 2.0 which is available at + * https://www.apache.org/licenses/LICENSE-2.0 + * + * SPDX-License-Identifier: Apache-2.0 + ********************************************************************************/ + +#include "score/crypto/daemon/provider/score_provider/score_provider_config.hpp" + +#include "score/crypto/backend/score_provider/active_backends_list.hpp" + +namespace score::crypto::daemon::provider::score_provider +{ + +// This function can later parse the actual configuration file to populate +// the ScoreProviderConfig with entries for each backend. +void ScoreProviderConfig::ParseConfig() +{ + if (!m_providers.empty()) + { + return; + } + + auto backends = backend::GetActiveBackends(); + + for (auto& b : backends) + { + auto creator = b->GetProviderCreator(); + + ScoreProviderEntry entry{}; + entry.providerName = creator.backend_name; + entry.providerImpl = creator.backend_id; + entry.providerType = creator.provider_type; + + m_providers.push_back(std::move(entry)); + } +} + +} // namespace score::crypto::daemon::provider::score_provider From 0dca1fa57b4f05f6bf9e27444594c621cc6762f3 Mon Sep 17 00:00:00 2001 From: Athul Mallappallil Date: Fri, 17 Jul 2026 12:46:25 +0000 Subject: [PATCH 10/14] Provider configuration documentation --- docs/crypto/architecture/index.rst | 2 +- .../architecture/provider_architecture.rst | 111 ++++++++++++++++-- 2 files changed, 102 insertions(+), 11 deletions(-) diff --git a/docs/crypto/architecture/index.rst b/docs/crypto/architecture/index.rst index 382532e3..a5fdb9a6 100644 --- a/docs/crypto/architecture/index.rst +++ b/docs/crypto/architecture/index.rst @@ -128,7 +128,7 @@ through two complementary abstractions: ``OpenSSLProviderFactory`` Internal factory used by ``ScoreProviderFactory``. Constructs ``score::openssl::OpenSSL`` and registers it as ``CryptoProviderType::SOFTWARE`` - under the ``common::kProviderNameOpenSSL`` name. No per-instance configuration required. + under the name read from config (e.g. ``"OPENSSL"``). No per-instance configuration required. ``Pkcs11ProviderFactory`` Accepts an injected ``std::vector`` via diff --git a/docs/crypto/architecture/provider_architecture.rst b/docs/crypto/architecture/provider_architecture.rst index 17d4c3a7..602f2f0a 100644 --- a/docs/crypto/architecture/provider_architecture.rst +++ b/docs/crypto/architecture/provider_architecture.rst @@ -66,6 +66,87 @@ integer constants (``HASH_INIT``, ``HASH_UPDATE``, ``HASH_FINALIZE``, Both provider families include these headers directly — the constants are not specific to any algorithm family or provider. +Provider Configuration +~~~~~~~~~~~~~~~~~~~~~~ + +Provider configuration is split into three layers. Each layer is owned by a +separate config type and resolved at a different point during daemon startup. + +1. Provider-family topology — build time + The set of provider families that can exist in a given daemon binary is +decided by compile-time flags (for example ``SCORE_BACKEND_ENABLED`` and +``SCORE_CRYPTO_PKCS11_ENABLED``). ``ProviderManagerFactory`` registers a factory +for every family that is compiled in. + +2. Provider-specific parameters — config file / defaults + Each family parses its own parameters from the daemon configuration: + + - ``ScoreProviderConfig`` (``score_provider/score_provider_config.hpp``) + holds one ``ScoreProviderEntry`` per score backend. An entry contains the + provider name, the backend implementation tag (for example ``"openssl"``), + and the provider type (``SOFTWARE``, ``HARDWARE``, ``SPECIALIZED``). + ``ScoreProviderConfig::ParseConfig()`` populates entries from the config + file; when no config is present it falls back to the active backends + discovered at compile time. + + - ``Pkcs11Config`` (``pkcs11/pkcs11_token_config.hpp``) holds one + ``Pkcs11TokenEntry`` per token. An entry contains the token label, model, + user PIN, provider name, provider type, and session cleanup strategy. + ``Pkcs11Config::ParseConfig()`` reads these values from the daemon config. + + Both config classes use only standard-library types in their public headers + so that the top-level ``Config`` class can own them without pulling in + backend-specific headers. + +3. Runtime enablement and type mapping — ``ProviderInitConfig`` + After all factories have created and registered their providers, and after + every provider has been initialized, ``ProviderManager::Initialize()`` loads + ``ProviderInitConfig`` to decide: + + - Which registered providers are enabled. Disabled providers are shut down + and removed from lookup tables. + - Which provider is the default for each ``CryptoProviderType`` + (``DEFAULT``, ``SOFTWARE``, ``HARDWARE``, ``SPECIALIZED``). + + ``ProviderInitConfig`` identifies providers by their stable + ``ProviderName`` (for example ``"OPENSSL"`` or ``"hsm_slot_1"``), not by the + runtime ``ProviderId`` assigned during registration. This keeps the + configuration stable across restarts and independent of registration order. + + If the daemon config does not supply a ``ProviderInitConfig``, + ``ProviderManager`` creates a default one that enables every successfully + initialized provider and selects defaults using the preference order + ``HARDWARE`` → ``SOFTWARE``. + +Configuration flow +^^^^^^^^^^^^^^^^^^ + +.. code-block:: text + + Config::ParseConfig() + │ + ├── ScoreProviderConfig::ParseConfig() ──► ScoreProviderEntry list + │ + └── Pkcs11Config::ParseConfig() ──► Pkcs11TokenEntry list + │ + ProviderManagerFactory::Create(config) + │ + ├── CreateScoreProviderFactory(config) + │ ScoreProviderConfig::Configure(ScoreProviderFactory) + │ + ├── CreatePkcs11ProviderFactory(config) + │ Pkcs11Config::Configure(Pkcs11ProviderFactory) + │ + └── provider_manager->Initialize() + │ + ├── CreateProviders() ← factories create & RegisterProvider() + ├── InitializeAll() ← providers initialize + │ + ├── ApplyEnablement(ProviderInitConfig.providers) + │ shut down / hide disabled providers + │ + └── BuildTypeMappings(ProviderInitConfig.typeToProviderName) + resolve names → runtime ProviderId Directory Layout ---------------- @@ -73,6 +154,10 @@ Directory Layout .. code-block:: text provider/ + ├── i_provider.hpp ← IProvider interface + ├── i_provider_factory.hpp ← IProviderFactory interface + ├── provider_manager.hpp/.cpp ← Provider registry & lifecycle + ├── provider_manager_factory.hpp/.cpp ← Build-time factory wiring ├── handler/ │ ├── i_handler.hpp ← Handler interface │ ├── i_crypto_handler_factory.hpp ← Factory interface @@ -91,18 +176,24 @@ Directory Layout ├── score_provider/ │ ├── score_provider_config.hpp/.cpp ← Config / visitor │ ├── score_provider_factory.hpp/.cpp - │ ├── score_provider.hpp/.cpp ← Abstract base provider - │ ├── operations/ - │ │ ├── hash/ ← ScoreHashHandler + HashExecutor - │ │ ├── mac/ ← ScoreMacHandler + MacExecutor - │ │ ├── key_management/ ← ScoreKeyManagementHandler - │ │ └── factory/ ← ScoreHandlerFactory + │ ├── score_provider.hpp ← Abstract base provider + │ ├── score_backend_adapter.hpp ← Backend adapter interface + │ ├── operations/ ← Score*Handler + *Executor bases + │ │ ├── hash/ + │ │ ├── mac/ + │ │ ├── key_management/ + │ │ └── factory/ │ └── openssl/ ← OpenSSL concrete provider │ ├── provider_openssl.hpp/.cpp - │ ├── openssl_provider_factory.hpp/.cpp │ ├── operations/ ← OpenSsl*Handler implementations │ ├── key_management/ ← OpenSslKeyHandler, OpenSslKeyFactory │ └── detail/ - ├── pkcs11/ ← PKCS#11 provider family - └── src/ - └── provider_manager.cpp + └── pkcs11/ ← PKCS#11 provider family + ├── pkcs11_token_config.hpp/.cpp ← Token config / visitor + ├── pkcs11_provider_factory.hpp/.cpp + ├── pkcs11_provider.hpp/.cpp + ├── pkcs11_module.hpp/.cpp + ├── pkcs11_session_guard.hpp + ├── operations/ + ├── key_management/ + └── detail/ From 5d2531f1b48656fb5eb848d0202ac4ff33785f6d Mon Sep 17 00:00:00 2001 From: Athul Mallappallil Date: Fri, 17 Jul 2026 12:46:54 +0000 Subject: [PATCH 11/14] Test for backend config --- tests/backend_symbol_check/BUILD | 38 +++++++++++++ .../backend_config_check_test.cpp | 56 +++++++++++++++++++ 2 files changed, 94 insertions(+) create mode 100644 tests/backend_symbol_check/BUILD create mode 100644 tests/backend_symbol_check/backend_config_check_test.cpp diff --git a/tests/backend_symbol_check/BUILD b/tests/backend_symbol_check/BUILD new file mode 100644 index 00000000..6894fc98 --- /dev/null +++ b/tests/backend_symbol_check/BUILD @@ -0,0 +1,38 @@ +# ******************************************************************************* +# Copyright (c) 2026 Contributors to the Eclipse Foundation +# +# See the NOTICE file(s) distributed with this work for additional +# information regarding copyright ownership. +# +# This program and the accompanying materials are made available under the +# terms of the Apache License Version 2.0 which is available at +# https://www.apache.org/licenses/LICENSE-2.0 +# +# SPDX-License-Identifier: Apache-2.0 +# ******************************************************************************* + +load("@rules_cc//cc:defs.bzl", "cc_test") + +# Verifies that the preprocessor defines emitted by the backend_defines targets +# match the configuration declared in backend_exports.bzl: +# +# ENABLE_PKCS11_BACKEND = True → SCORE_CRYPTO_PKCS11_ENABLED is defined +# ENABLE_SCORE_BACKEND = False → SCORE_BACKEND_ENABLED is NOT defined +# +# Checks happen at compile time (wrong config → build failure) and are confirmed +# at runtime via gtest assertions. +# +# If you change ENABLE_PKCS11_BACKEND or ENABLE_SCORE_BACKEND in +# backend_exports.bzl, update the expected values in backend_config_check_test.cpp. +# +# Run with: +# bazel test //tests/backend_symbol_check:backend_config_check +cc_test( + name = "backend_config_check", + srcs = ["backend_config_check_test.cpp"], + deps = [ + "//score/crypto/backend:pkcs11_backend_defines", + "//score/crypto/backend/score_provider:score_backend_defines", + "@googletest//:gtest_main", + ], +) diff --git a/tests/backend_symbol_check/backend_config_check_test.cpp b/tests/backend_symbol_check/backend_config_check_test.cpp new file mode 100644 index 00000000..b6d0e201 --- /dev/null +++ b/tests/backend_symbol_check/backend_config_check_test.cpp @@ -0,0 +1,56 @@ +/******************************************************************************** + * Copyright (c) 2026 Contributors to the Eclipse Foundation + * + * See the NOTICE file(s) distributed with this work for additional + * information regarding copyright ownership. + * + * This program and the accompanying materials are made available under the + * terms of the Apache License Version 2.0 which is available at + * https://www.apache.org/licenses/LICENSE-2.0 + * + * SPDX-License-Identifier: Apache-2.0 + ********************************************************************************/ + +// Compile-time and run-time checks that the crypto daemon backend configuration +// in backend_exports.bzl is reflected correctly in the preprocessor defines +// that gate backend code paths. +// +// If you change ENABLE_PKCS11_BACKEND or ENABLE_SCORE_BACKEND in +// backend_exports.bzl, update the expected values below accordingly. + +#include + +// ── Expected configuration ─────────────────────────────────────────────────── +// Mirrors backend_exports.bzl: +// ENABLE_PKCS11_BACKEND = True → SCORE_CRYPTO_PKCS11_ENABLED defined +// ENABLE_SCORE_BACKEND = False → SCORE_BACKEND_ENABLED not defined + +TEST(BackendConfig, Pkcs11BackendIsEnabled) +{ +#ifdef SCORE_CRYPTO_PKCS11_ENABLED + SUCCEED(); +#else + FAIL() << "SCORE_CRYPTO_PKCS11_ENABLED is not defined — " + "ENABLE_PKCS11_BACKEND should be True in backend_exports.bzl"; +#endif +} + +TEST(BackendConfig, ScoreBackendIsEnabled) +{ +#ifdef SCORE_BACKEND_ENABLED + SUCCEED(); +#else + FAIL() << "SCORE_BACKEND_ENABLED is not defined — " + "ENABLE_SCORE_BACKEND should be True in backend_exports.bzl"; +#endif +} + +TEST(BackendConfig, OpenSslBackendIsEnabled) +{ +#ifdef SCORE_BACKEND_OPENSSL_ENABLED + SUCCEED(); +#else + FAIL() << "SCORE_BACKEND_OPENSSL_ENABLED is not defined — " + "OpenSSL backend should be active when ENABLE_SCORE_BACKEND is True"; +#endif +} From f6ee22dc897430b7bad61e4a28a59275115ea296 Mon Sep 17 00:00:00 2001 From: Athul Mallappallil Date: Fri, 17 Jul 2026 14:10:30 +0000 Subject: [PATCH 12/14] Fix format and copyrights --- score/crypto/backend/BUILD | 16 +++++++------ score/crypto/backend/backend_config.bzl | 16 ++++++++++++- score/crypto/backend/backend_exports.bzl | 24 +++++++++++++++---- score/crypto/backend/score_provider/BUILD | 2 +- score/crypto/daemon/config/inc/config.hpp | 10 ++------ score/crypto/daemon/config/src/config.cpp | 5 ++-- score/crypto/daemon/provider/BUILD | 24 +++++++++---------- score/crypto/daemon/provider/pkcs11/BUILD | 12 +++++----- .../daemon/provider/provider_manager.hpp | 3 +-- .../daemon/provider/score_provider/BUILD | 6 ++--- .../provider/score_provider/openssl/BUILD | 2 +- .../operations/mac/openssl_hmac_handler.cpp | 1 - .../daemon/provider/src/provider_manager.cpp | 5 ++-- tests/demo/BUILD | 2 +- tests/integration_tests/integration_test.py | 6 ++--- tests/openssl/block_cipher/ECB-AES128/BUILD | 2 +- third_party/openssl/BUILD | 5 ++-- third_party/soft_hsm/BUILD | 9 ++++--- 18 files changed, 86 insertions(+), 64 deletions(-) diff --git a/score/crypto/backend/BUILD b/score/crypto/backend/BUILD index 6b6233a6..479de4e7 100644 --- a/score/crypto/backend/BUILD +++ b/score/crypto/backend/BUILD @@ -12,12 +12,14 @@ # ******************************************************************************* load("@rules_cc//cc:defs.bzl", "cc_library") -load(":backend_exports.bzl", - "BACKEND_DEFINES", - "ENABLE_PKCS11_BACKEND", - "PKCS11_BACKEND_DEFAULT_LABEL", - "PKCS11_BACKEND_DEPS", - "SCORE_BACKEND_DEPS") +load( + ":backend_exports.bzl", + "BACKEND_DEFINES", + "ENABLE_PKCS11_BACKEND", + "PKCS11_BACKEND_DEFAULT_LABEL", + "PKCS11_BACKEND_DEPS", + "SCORE_BACKEND_DEPS", +) # ============================================================================ # Backend Architecture: @@ -72,8 +74,8 @@ label_flag( # Replaces the __has_include anti-pattern in provider_manager_factory. cc_library( name = "pkcs11_backend_defines", - visibility = ["//visibility:public"], defines = (["SCORE_CRYPTO_PKCS11_ENABLED=1"] if ENABLE_PKCS11_BACKEND else []), + visibility = ["//visibility:public"], ) # PKCS#11 backend: selected library + fixed config parser. diff --git a/score/crypto/backend/backend_config.bzl b/score/crypto/backend/backend_config.bzl index fd022442..80610b24 100644 --- a/score/crypto/backend/backend_config.bzl +++ b/score/crypto/backend/backend_config.bzl @@ -1,3 +1,15 @@ +# ******************************************************************************* +# Copyright (c) 2026 Contributors to the Eclipse Foundation +# +# See the NOTICE file(s) distributed with this work for additional +# information regarding copyright ownership. +# +# This program and the accompanying materials are made available under the +# terms of the Apache License Version 2.0 which is available at +# https://www.apache.org/licenses/LICENSE-2.0 +# +# SPDX-License-Identifier: Apache-2.0 +# ******************************************************************************* """Backend configuration helpers for score crypto backends.""" def backend_defines(enable_score_backend, enable_openssl, enable_primula): @@ -67,7 +79,9 @@ def pkcs11_backend_label(backend_name): target = backend_map.get(backend_name) if not target: fail("Unknown PKCS#11 backend: '{}'. Valid options: {}".format( - backend_name, ", ".join(backend_map.keys()))) + backend_name, + ", ".join(backend_map.keys()), + )) return target def pkcs11_backend_deps(enable_pkcs11, backend_name): diff --git a/score/crypto/backend/backend_exports.bzl b/score/crypto/backend/backend_exports.bzl index a0590095..84fe69ac 100644 --- a/score/crypto/backend/backend_exports.bzl +++ b/score/crypto/backend/backend_exports.bzl @@ -1,3 +1,15 @@ +# ******************************************************************************* +# Copyright (c) 2026 Contributors to the Eclipse Foundation +# +# See the NOTICE file(s) distributed with this work for additional +# information regarding copyright ownership. +# +# This program and the accompanying materials are made available under the +# terms of the Apache License Version 2.0 which is available at +# https://www.apache.org/licenses/LICENSE-2.0 +# +# SPDX-License-Identifier: Apache-2.0 +# ******************************************************************************* """Backend selection and build dependency exports. This file contains the master backend configuration flags and exports @@ -7,11 +19,13 @@ This is the SINGLE SOURCE OF TRUTH for backend selection. To enable/disable backends, modify the flags below. """ -load(":backend_config.bzl", - "backend_defines", - "backend_deps", - "pkcs11_backend_deps", - "pkcs11_backend_label") +load( + ":backend_config.bzl", + "backend_defines", + "backend_deps", + "pkcs11_backend_deps", + "pkcs11_backend_label", +) # ============================================================================ # MASTER BACKEND CONFIGURATION FLAGS diff --git a/score/crypto/backend/score_provider/BUILD b/score/crypto/backend/score_provider/BUILD index f4b5f306..d7e23ce9 100644 --- a/score/crypto/backend/score_provider/BUILD +++ b/score/crypto/backend/score_provider/BUILD @@ -36,8 +36,8 @@ cc_library( cc_library( name = "score_backend_defines", hdrs = ["active_backends_list.hpp"], - visibility = ["//visibility:public"], defines = BACKEND_DEFINES, + visibility = ["//visibility:public"], deps = [ "//score/crypto/daemon/provider/score_provider:score_backend_adapter", ], diff --git a/score/crypto/daemon/config/inc/config.hpp b/score/crypto/daemon/config/inc/config.hpp index f454510c..0bbf3a7c 100644 --- a/score/crypto/daemon/config/inc/config.hpp +++ b/score/crypto/daemon/config/inc/config.hpp @@ -463,14 +463,8 @@ class Config const std::string& value, const std::string& option, std::string& target); - bool ParseUint32Arg(const std::string& arg, - const std::string& value, - const std::string& option, - uint32_t& target); - bool ParseUint16Arg(const std::string& arg, - const std::string& value, - const std::string& option, - uint16_t& target); + bool ParseUint32Arg(const std::string& arg, const std::string& value, const std::string& option, uint32_t& target); + bool ParseUint16Arg(const std::string& arg, const std::string& value, const std::string& option, uint16_t& target); }; } // namespace score::crypto::daemon::config diff --git a/score/crypto/daemon/config/src/config.cpp b/score/crypto/daemon/config/src/config.cpp index a5ca3d7b..ee7c5b03 100644 --- a/score/crypto/daemon/config/src/config.cpp +++ b/score/crypto/daemon/config/src/config.cpp @@ -15,8 +15,8 @@ #include "score/crypto/daemon/config/src/flatbuffer_config_parser.hpp" #include "score/mw/log/logging.h" -#include #include +#include #include #include @@ -90,7 +90,8 @@ bool Config::ParseConfig() struct stat st_cfg; if (::stat(config_file_path, &st_cfg) != 0) { - score::mw::log::LogError() << "[CONFIG] Configuration file does not exist:" << std::string(config_file_path); + score::mw::log::LogError() << "[CONFIG] Configuration file does not exist:" + << std::string(config_file_path); return false; } score::mw::log::LogDebug() << "[CONFIG] Parsing configuration from:" << std::string(config_file_path); diff --git a/score/crypto/daemon/provider/BUILD b/score/crypto/daemon/provider/BUILD index 13a0f137..53b2c56e 100644 --- a/score/crypto/daemon/provider/BUILD +++ b/score/crypto/daemon/provider/BUILD @@ -12,9 +12,11 @@ # ******************************************************************************* load("@rules_cc//cc:cc_library.bzl", "cc_library") -load("//score/crypto/backend:backend_exports.bzl", - "ENABLE_PKCS11_BACKEND", - "ENABLE_SCORE_BACKEND") +load( + "//score/crypto/backend:backend_exports.bzl", + "ENABLE_PKCS11_BACKEND", + "ENABLE_SCORE_BACKEND", +) cc_library( name = "provider_headers", @@ -46,16 +48,14 @@ cc_library( name = "provider_manager_factory", srcs = ["src/provider_manager_factory.cpp"], hdrs = ["provider_manager_factory.hpp"], - visibility = ["//:__subpackages__"], - deps = [ - ":provider_headers", - ":provider_manager", - ] + (["//score/crypto/daemon/provider/score_provider:score_provider_factory"] - if ENABLE_SCORE_BACKEND else []) - + (["//score/crypto/daemon/provider/pkcs11:provider_pkcs11_factory"] - if ENABLE_PKCS11_BACKEND else []), implementation_deps = [ - "//score/crypto/backend/score_provider:score_backend_defines", "//score/crypto/backend:pkcs11_backend_defines", + "//score/crypto/backend/score_provider:score_backend_defines", ], + visibility = ["//:__subpackages__"], + deps = [ + ":provider_headers", + ":provider_manager", + ] + (["//score/crypto/daemon/provider/score_provider:score_provider_factory"] if ENABLE_SCORE_BACKEND else []) + + (["//score/crypto/daemon/provider/pkcs11:provider_pkcs11_factory"] if ENABLE_PKCS11_BACKEND else []), ) diff --git a/score/crypto/daemon/provider/pkcs11/BUILD b/score/crypto/daemon/provider/pkcs11/BUILD index f0c21a2c..a85fb9d2 100644 --- a/score/crypto/daemon/provider/pkcs11/BUILD +++ b/score/crypto/daemon/provider/pkcs11/BUILD @@ -56,6 +56,9 @@ cc_library( "pkcs11_module.cpp", "pkcs11_provider.cpp", ], + implementation_deps = [ + "//score/crypto/backend:active_pkcs11_backend", # Selected PKCS#11 backend + ], includes = ["."], linkstatic = True, visibility = ["//:__subpackages__"], @@ -71,9 +74,6 @@ cc_library( "//score/crypto/daemon/provider/handler:mac_handler_operations", "@score_baselibs//score/result", ], - implementation_deps = [ - "//score/crypto/backend:active_pkcs11_backend", # Selected PKCS#11 backend - ], ) cc_library( @@ -89,14 +89,14 @@ cc_library( "pkcs11_token_config.cpp", ], hdrs = ["pkcs11_provider_factory.hpp"], + implementation_deps = [ + "//score/crypto/backend:active_pkcs11_backend", # Selected PKCS#11 backend + ], visibility = ["//:__subpackages__"], deps = [ ":pkcs11_token_config", ":provider_pkcs11_library", ], - implementation_deps = [ - "//score/crypto/backend:active_pkcs11_backend", # Selected PKCS#11 backend - ], ) # Alias for convenience - the full target is the factory diff --git a/score/crypto/daemon/provider/provider_manager.hpp b/score/crypto/daemon/provider/provider_manager.hpp index 33535946..da9939e1 100644 --- a/score/crypto/daemon/provider/provider_manager.hpp +++ b/score/crypto/daemon/provider/provider_manager.hpp @@ -272,8 +272,7 @@ class ProviderManager * * @param type_to_name Mapping from crypto provider type to provider name. */ - void BuildTypeMappings( - const std::unordered_map& type_to_name); + void BuildTypeMappings(const std::unordered_map& type_to_name); /** * @brief Invoke all registered factories to create and register providers. diff --git a/score/crypto/daemon/provider/score_provider/BUILD b/score/crypto/daemon/provider/score_provider/BUILD index e73753e6..5a37c290 100644 --- a/score/crypto/daemon/provider/score_provider/BUILD +++ b/score/crypto/daemon/provider/score_provider/BUILD @@ -50,13 +50,13 @@ cc_library( "src/score_provider_factory.cpp", ], hdrs = ["score_provider_factory.hpp"], + implementation_deps = [ + "//score/crypto/backend/score_provider:backend", # Selected Score backends + ], visibility = ["//:__subpackages__"], deps = [ ":score_provider", ":score_provider_config", "//score/crypto/daemon/provider:provider_headers", ], - implementation_deps = [ - "//score/crypto/backend/score_provider:backend", # Selected Score backends - ], ) diff --git a/score/crypto/daemon/provider/score_provider/openssl/BUILD b/score/crypto/daemon/provider/score_provider/openssl/BUILD index 122140b0..53b54bfd 100644 --- a/score/crypto/daemon/provider/score_provider/openssl/BUILD +++ b/score/crypto/daemon/provider/score_provider/openssl/BUILD @@ -70,7 +70,7 @@ cc_library( "provider_openssl.cpp", ], implementation_deps = [ - "//third_party/openssl:openssl", + "//third_party/openssl", ], includes = ["."], linkstatic = True, diff --git a/score/crypto/daemon/provider/score_provider/openssl/operations/mac/openssl_hmac_handler.cpp b/score/crypto/daemon/provider/score_provider/openssl/operations/mac/openssl_hmac_handler.cpp index d7fdd338..0fbde777 100644 --- a/score/crypto/daemon/provider/score_provider/openssl/operations/mac/openssl_hmac_handler.cpp +++ b/score/crypto/daemon/provider/score_provider/openssl/operations/mac/openssl_hmac_handler.cpp @@ -192,7 +192,6 @@ OpenSslHmacHandler::InitializeContext( return std::monostate{}; } - ::score::crypto::Expected OpenSslHmacHandler::InitMac( const std::optional /*initialDataOrIV*/) { diff --git a/score/crypto/daemon/provider/src/provider_manager.cpp b/score/crypto/daemon/provider/src/provider_manager.cpp index ef3bb4a8..0cbb1421 100644 --- a/score/crypto/daemon/provider/src/provider_manager.cpp +++ b/score/crypto/daemon/provider/src/provider_manager.cpp @@ -151,7 +151,8 @@ void ProviderManager::ApplyEnablement(const std::vector& score::mw::log::LogInfo() << "[ProviderManager] Enabled providers after applying enablement:"; for (const auto& pair : m_providers) { - score::mw::log::LogInfo() << " - " << pair.first << " (numeric_id=" << pair.second.numeric_id << ", type=" << static_cast(pair.second.cryptoType) << ")"; + score::mw::log::LogInfo() << " - " << pair.first << " (numeric_id=" << pair.second.numeric_id + << ", type=" << static_cast(pair.second.cryptoType) << ")"; } } @@ -180,7 +181,7 @@ void ProviderManager::BuildTypeMappings( if (it == m_providers.end()) { score::mw::log::LogWarn() << "[ProviderManager] Type mapping references unknown or disabled provider: " - << provider_name; + << provider_name; continue; } m_typeToProviderId[crypto_type] = it->second.numeric_id; diff --git a/tests/demo/BUILD b/tests/demo/BUILD index 532d5bbe..23508764 100644 --- a/tests/demo/BUILD +++ b/tests/demo/BUILD @@ -24,7 +24,7 @@ cc_test( "//score/crypto/daemon/provider:provider_headers", "//score/crypto/daemon/provider/score_provider/openssl:provider_openssl_library", "//score/crypto/daemon/provider/score_provider/operations/mac:score_mac_handler", - "//third_party/openssl:openssl", + "//third_party/openssl", "@googletest//:gtest_main", ], ) diff --git a/tests/integration_tests/integration_test.py b/tests/integration_tests/integration_test.py index db08795f..222af857 100644 --- a/tests/integration_tests/integration_test.py +++ b/tests/integration_tests/integration_test.py @@ -204,9 +204,9 @@ def setup_container(self, docker): Path("third_party/openssl/libssl.so.3"): Path( "/opt/crypto/lib/libssl.so.3" ), - Path( - "third_party/soft_hsm/libsofthsm2.so" - ): Path("/opt/crypto/lib/libsofthsm2.so"), + Path("third_party/soft_hsm/libsofthsm2.so"): Path( + "/opt/crypto/lib/libsofthsm2.so" + ), Path("tests/test_vectors/config/integration_test_config.bin"): Path( self.CRYPTO_CONFIG_PATH ), diff --git a/tests/openssl/block_cipher/ECB-AES128/BUILD b/tests/openssl/block_cipher/ECB-AES128/BUILD index bf3c2a10..67a89ae9 100644 --- a/tests/openssl/block_cipher/ECB-AES128/BUILD +++ b/tests/openssl/block_cipher/ECB-AES128/BUILD @@ -24,7 +24,7 @@ cc_test( ], deps = [ "//tests/utility", - "//third_party/openssl:openssl", + "//third_party/openssl", "@googletest//:gtest", ], ) diff --git a/third_party/openssl/BUILD b/third_party/openssl/BUILD index 2dd3f108..1d3e50dd 100644 --- a/third_party/openssl/BUILD +++ b/third_party/openssl/BUILD @@ -11,9 +11,8 @@ # SPDX-License-Identifier: Apache-2.0 # ******************************************************************************* -load("@rules_cc//cc:defs.bzl", "cc_library") +load("@rules_cc//cc:defs.bzl", "cc_library", "cc_shared_library") load("@rules_foreign_cc//foreign_cc:defs.bzl", "configure_make") -load("@rules_cc//cc:defs.bzl", "cc_shared_library") # OpenSSL build using rules_foreign_cc # Configure options reference for OpenSSL 3.6.1: @@ -109,6 +108,7 @@ configure_make( "//conditions:default": {}, }), lib_source = "@openssl_source//:all", + out_include_dir = "include", out_lib_dir = "lib", out_shared_libs = [ "libcrypto.so", @@ -116,7 +116,6 @@ configure_make( "libssl.so", "libssl.so.3", ], - out_include_dir = "include", tags = ["no-sandbox"], targets = [ "build_libs", diff --git a/third_party/soft_hsm/BUILD b/third_party/soft_hsm/BUILD index 8097e879..b0752ecc 100644 --- a/third_party/soft_hsm/BUILD +++ b/third_party/soft_hsm/BUILD @@ -11,9 +11,8 @@ # SPDX-License-Identifier: Apache-2.0 # ******************************************************************************* -load("@rules_cc//cc:defs.bzl", "cc_library") +load("@rules_cc//cc:defs.bzl", "cc_library", "cc_shared_library") load("@rules_foreign_cc//foreign_cc:defs.bzl", "cmake") -load("@rules_cc//cc:defs.bzl", "cc_shared_library") # SoftHSM build using rules_foreign_cc cmake # CMake build options reference for SoftHSM 2.7.0: @@ -52,7 +51,6 @@ cmake( "RUN_AES_KEY_WRAP_PAD": "0", "RUN_AES_KEY_WRAP_PAD__TRYRUN_OUTPUT": "", }, - deps = ["//third_party/openssl:openssl"], env = select({ "//platforms:is_qnx_aarch64": { # EXT_BUILD_ROOT is captured at the start of the build script (before any cd), @@ -75,6 +73,7 @@ cmake( visibility = [ "//third_party/soft_hsm:__pkg__", # Internal wrappers ], + deps = ["//third_party/openssl"], ) # Extract PKCS#11 headers from SoftHSM source for public consumption @@ -82,7 +81,7 @@ genrule( name = "extract_pkcs11_headers", srcs = ["@softhsm_source//:all"], outs = [ -# "include/cryptoki.h", + # "include/cryptoki.h", "include/pkcs11.h", ], cmd = """ @@ -96,9 +95,9 @@ genrule( # Softhsm pkcs11 target for linking and header consumption cc_library( name = "softhsm", - linkstatic = False, hdrs = [":extract_pkcs11_headers"], includes = ["include"], + linkstatic = False, visibility = ["//:__subpackages__"], deps = [":soft_hsm_cmake"], ) From 424f8315f65fc3d8235d238bc137723f1e23f593 Mon Sep 17 00:00:00 2001 From: Athul Mallappallil Date: Fri, 17 Jul 2026 14:46:26 +0000 Subject: [PATCH 13/14] Fix doc build --- conf.py | 1 + docs/crypto/architecture/provider_architecture.rst | 6 +++--- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/conf.py b/conf.py index df8ed2f2..66888502 100644 --- a/conf.py +++ b/conf.py @@ -50,6 +50,7 @@ ".venv_docs", "_build", "examples/README.md", + "score/crypto/backend/README.md", # developer-only README ] templates_path = ["templates"] diff --git a/docs/crypto/architecture/provider_architecture.rst b/docs/crypto/architecture/provider_architecture.rst index 602f2f0a..9606f707 100644 --- a/docs/crypto/architecture/provider_architecture.rst +++ b/docs/crypto/architecture/provider_architecture.rst @@ -74,9 +74,9 @@ separate config type and resolved at a different point during daemon startup. 1. Provider-family topology — build time The set of provider families that can exist in a given daemon binary is -decided by compile-time flags (for example ``SCORE_BACKEND_ENABLED`` and -``SCORE_CRYPTO_PKCS11_ENABLED``). ``ProviderManagerFactory`` registers a factory -for every family that is compiled in. + decided by compile-time flags (for example ``SCORE_BACKEND_ENABLED`` and + ``SCORE_CRYPTO_PKCS11_ENABLED``). ``ProviderManagerFactory`` registers a factory + for every family that is compiled in. 2. Provider-specific parameters — config file / defaults Each family parses its own parameters from the daemon configuration: From ec72296a1e5584c8dee045ce06e48823f982a561 Mon Sep 17 00:00:00 2001 From: Athul Mallappallil Date: Tue, 21 Jul 2026 09:36:10 +0200 Subject: [PATCH 14/14] Minor doc and Readme fix --- docs/crypto/architecture/provider_architecture.rst | 4 ---- score/crypto/backend/README.md | 2 +- 2 files changed, 1 insertion(+), 5 deletions(-) diff --git a/docs/crypto/architecture/provider_architecture.rst b/docs/crypto/architecture/provider_architecture.rst index 9606f707..84d17f02 100644 --- a/docs/crypto/architecture/provider_architecture.rst +++ b/docs/crypto/architecture/provider_architecture.rst @@ -94,10 +94,6 @@ separate config type and resolved at a different point during daemon startup. user PIN, provider name, provider type, and session cleanup strategy. ``Pkcs11Config::ParseConfig()`` reads these values from the daemon config. - Both config classes use only standard-library types in their public headers - so that the top-level ``Config`` class can own them without pulling in - backend-specific headers. - 3. Runtime enablement and type mapping — ``ProviderInitConfig`` After all factories have created and registered their providers, and after every provider has been initialized, ``ProviderManager::Initialize()`` loads diff --git a/score/crypto/backend/README.md b/score/crypto/backend/README.md index c295b1b0..05dcf422 100644 --- a/score/crypto/backend/README.md +++ b/score/crypto/backend/README.md @@ -133,5 +133,5 @@ bazel query 'deps(//score/crypto/daemon:crypto_daemon)' | grep -E "openssl|softh Check the effective PKCS#11 backend: ```bash -bazel cquery //score/crypto/daemon:crypto_daemon --output=build | grep pkcs11_backend +bazel cquery //score/crypto/backend:pkcs11_backend --output=build ```