From 3eecd40cec6415fc033f8d9141ab652047e71524 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Wed, 23 Feb 2022 17:29:02 +0100 Subject: [PATCH] openssl: Don't unload providers There is a conflict between atexit() handlers registered by OpenSSL and some executables (e.g. swanctl or pki) to deinitialize libstrongswan. Because plugins are usually loaded after atexit() has been called, the handler registered by OpenSSL will run before our handler. So when the latter destroys the plugins it's a bad idea to try to access any OpenSSL objects as they might already be invalid. Fixes: f556fce16b60 ("openssl: Load "legacy" provider in OpenSSL 3 for algorithms like MD4, DES etc.") Closes strongswan/strongswan#921 --- .../plugins/openssl/openssl_plugin.c | 27 +++---------------- 1 file changed, 3 insertions(+), 24 deletions(-) diff --git a/src/libstrongswan/plugins/openssl/openssl_plugin.c b/src/libstrongswan/plugins/openssl/openssl_plugin.c index 6b49236490..1491d5cf83 100644 --- a/src/libstrongswan/plugins/openssl/openssl_plugin.c +++ b/src/libstrongswan/plugins/openssl/openssl_plugin.c @@ -16,7 +16,6 @@ #include #include -#include #include #include #include @@ -74,13 +73,6 @@ struct private_openssl_plugin_t { * public functions */ openssl_plugin_t public; - -#if OPENSSL_VERSION_NUMBER >= 0x30000000L - /** - * Loaded providers - */ - array_t *providers; -#endif }; /** @@ -887,15 +879,6 @@ METHOD(plugin_t, get_features, int, METHOD(plugin_t, destroy, void, private_openssl_plugin_t *this) { -#if OPENSSL_VERSION_NUMBER >= 0x30000000L - OSSL_PROVIDER *provider; - while (array_remove(this->providers, ARRAY_TAIL, &provider)) - { - OSSL_PROVIDER_unload(provider); - } - array_destroy(this->providers); -#endif /* OPENSSL_VERSION_NUMBER */ - /* OpenSSL 1.1.0 cleans up itself at exit and while OPENSSL_cleanup() exists we * can't call it as we couldn't re-initialize the library (as required by the * unit tests and the Android app) */ @@ -1009,20 +992,16 @@ plugin_t *openssl_plugin_create() DBG1(DBG_LIB, "unable to load OpenSSL FIPS provider"); return NULL; } - array_insert_create(&this->providers, ARRAY_TAIL, fips); /* explicitly load the base provider containing encoding functions */ - array_insert_create(&this->providers, ARRAY_TAIL, - OSSL_PROVIDER_load(NULL, "base")); + OSSL_PROVIDER_load(NULL, "base"); } else if (lib->settings->get_bool(lib->settings, "%s.plugins.openssl.load_legacy", TRUE, lib->ns)) { /* load the legacy provider for algorithms like MD4, DES, BF etc. */ - array_insert_create(&this->providers, ARRAY_TAIL, - OSSL_PROVIDER_load(NULL, "legacy")); + OSSL_PROVIDER_load(NULL, "legacy"); /* explicitly load the default provider, as mentioned by crypto(7) */ - array_insert_create(&this->providers, ARRAY_TAIL, - OSSL_PROVIDER_load(NULL, "default")); + OSSL_PROVIDER_load(NULL, "default"); } ossl_provider_names_t data = {}; OSSL_PROVIDER_do_all(NULL, concat_ossl_providers, &data); -- 2.47.2