A built-in provider for using external key with OpenSSL 3.0

A built-in provider for using external key with OpenSSL 3.0

Hooking into callbacks in RSA_METHOD and EVP_PKEY_METHOD
structures is deprecated in OpenSSL 3.0. For signing with
external keys that are not exportable (tokens, stores, etc.)
requires a custom provider interface so that key operations
are done under its context.

A single provider is enough for handling all external keys
we support -- management-external-key, cryptoapicert(CNG) and
pkcs11-helper. The series of patches starting with this implement
such a provider.

This patch implements only the provider_init function so
that it can be loaded, but has no capabilities. The required
interfaces are added in following commits.

v2 changes:
 - Require OpenSSL 3.0.1 or newer: 3.0.0 is "buggy" as it
   does not preferentially fetch operations from the keymgmt
   of the key. This causes either an unsuccessful attempt at
   exporting unexportable keys or an onerous requirement that
   the external key's KEYMGMT should support a whole lot
   of unrelated functionalities including key generation and
   key exchange.
   Fixed by PR #16725 in OpenSSL.
 - Use a child libctx for internal use in the provider

v3 changes:
 - Move OpenSSL version check for 3.0.1+ from configure to
   xkey_common.h

Signed-off-by: Selva Nair <selva.nair@gmail.com>
Acked-by: Arne Schwabe <arne@rfc2549.org>
Message-Id: <20211214165928.30676-2-selva.nair@gmail.com>
URL: https://www.mail-archive.com/openvpn-devel@lists.sourceforge.net/msg23446.html
Signed-off-by: Gert Doering <gert@greenie.muc.de>