Author: minfrin
Date: Tue Mar 18 13:03:11 2025
New Revision: 1924450
URL: http://svn.apache.org/viewvc?rev=1924450&view=rev
Log:
apr_crypto_openssl: Add provider support on OpenSSL3+.
Modified:
apr/apr-util/branches/1.7.x/CHANGES
apr/apr-util/branches/1.7.x/crypto/apr_crypto_openssl.c
apr/apr-util/branches/1.7.x/include/apr_crypto.h
apr/apr-util/branches/1.7.x/test/testcrypto.c
Modified: apr/apr-util/branches/1.7.x/CHANGES
URL: http://svn.apache.org/viewvc/apr/apr-util/branches/1.7.x/CHANGES?rev=1924450&r1=1924449&r2=1924450&view=diff
==============================================================================
--- apr/apr-util/branches/1.7.x/CHANGES [utf-8] (original)
+++ apr/apr-util/branches/1.7.x/CHANGES [utf-8] Tue Mar 18 13:03:11 2025
@@ -1,7 +1,10 @@
-*- coding: utf-8 -*-
Changes with APR-util 1.7.0
- *) apr-dbm-lmdb: Add LMDB driver for apr_dbm.
+ *) apr_crypto_openssl: Add provider support on OpenSSL3+.
+ [Graham Leggett]
+
+ *) apr_dbm_lmdb: Add LMDB driver for apr_dbm.
[Lubos Uhliarik <uhliarik redhat.com>]
*) apr_ldap: Add write capability to the LDAP API. Support for
Modified: apr/apr-util/branches/1.7.x/crypto/apr_crypto_openssl.c
URL: http://svn.apache.org/viewvc/apr/apr-util/branches/1.7.x/crypto/apr_crypto_openssl.c?rev=1924450&r1=1924449&r2=1924450&view=diff
==============================================================================
--- apr/apr-util/branches/1.7.x/crypto/apr_crypto_openssl.c (original)
+++ apr/apr-util/branches/1.7.x/crypto/apr_crypto_openssl.c Tue Mar 18 13:03:11 2025
@@ -82,19 +82,30 @@
#else
#define APR_USE_OPENSSL_PRE_3_0_API 0
#endif
+#if OPENSSL_VERSION_NUMBER < 0x30500000L
+#define APR_USE_OPENSSL_PRE_3_5_API 1
+#else
+#define APR_USE_OPENSSL_PRE_3_5_API 0
+#endif
#endif /* defined(LIBRESSL_VERSION_NUMBER) */
#if APR_USE_OPENSSL_PRE_3_0_API
#define APR_USE_OPENSSL_ENGINE_API 1
+#define APR_USE_OPENSSL_PROVIDER_API 0
#else
#define APR_USE_OPENSSL_ENGINE_API 0
+#define APR_USE_OPENSSL_PROVIDER_API 1
#endif
#if APR_USE_OPENSSL_ENGINE_API
#include <openssl/engine.h>
#endif
+#if APR_USE_OPENSSL_PROVIDER_API
+#include <openssl/provider.h>
+#endif
+
#define LOG_PREFIX "apr_crypto_openssl: "
struct apr_crypto_t {
@@ -113,6 +124,9 @@ struct apr_crypto_config_t {
#else
void *engine;
#endif
+#if APR_USE_OPENSSL_PROVIDER_API
+ OSSL_LIB_CTX *libctx;
+#endif
};
struct apr_crypto_key_t {
@@ -403,6 +417,11 @@ static apr_status_t crypto_cleanup(apr_c
f->config->engine = NULL;
}
#endif
+#if APR_USE_OPENSSL_PROVIDER_API
+ if (f->config->libctx) {
+ OSSL_LIB_CTX_free(f->config->libctx);
+ }
+#endif
return APR_SUCCESS;
}
@@ -413,6 +432,15 @@ static apr_status_t crypto_cleanup_helpe
return crypto_cleanup(f);
}
+#if APR_USE_OPENSSL_PROVIDER_API
+static apr_status_t provider_cleanup(void *data)
+{
+ OSSL_PROVIDER *prov = data;
+ OSSL_PROVIDER_unload(prov);
+ return APR_SUCCESS;
+}
+#endif
+
/**
* @brief Create a context for supporting encryption. Keys, certificates,
* algorithms and other parameters will be set per context. More than
@@ -447,8 +475,24 @@ static apr_status_t crypto_make(apr_cryp
char *elt;
int i = 0, j;
+#if APR_USE_OPENSSL_PROVIDER_API
+ OSSL_PROVIDER *prov = NULL;
+ const char *path = NULL;
+#endif
+
*ff = NULL;
+ f = apr_pcalloc(pool, sizeof(apr_crypto_t));
+ if (!f) {
+ return APR_ENOMEM;
+ }
+ f->config = config = apr_pcalloc(pool, sizeof(apr_crypto_config_t));
+ if (!config) {
+ return APR_ENOMEM;
+ }
+ f->pool = pool;
+ f->provider = provider;
+
if (params) {
if (APR_SUCCESS != (status = apr_tokenize_to_argv(params, &elts, pool))) {
return status;
@@ -476,22 +520,54 @@ static apr_status_t crypto_make(apr_cryp
}
}
+#if APR_USE_OPENSSL_PROVIDER_API
+ if (!strcasecmp("provider-path", elt)) {
+ path = ptr;
+ }
+ else if (!strcasecmp("provider", elt)) {
+
+ /* first provider, avoid loading the default by loading null */
+ if (!config->libctx) {
+ prov = OSSL_PROVIDER_load(NULL, "null");
+ config->libctx = OSSL_LIB_CTX_new();
+ if (!config->libctx) {
+ return APR_ENOMEM;
+ }
+
+ apr_pool_cleanup_register(pool, prov, provider_cleanup,
+ apr_pool_cleanup_null);
+ }
+
+ if (path) {
+ OSSL_PROVIDER_set_default_search_path(config->libctx, path);
+ path = NULL;
+ }
+
+ prov = OSSL_PROVIDER_load(config->libctx, ptr);
+ if (!prov) {
+ return APR_ENOENGINE;
+ }
+
+ apr_pool_cleanup_register(pool, prov, provider_cleanup,
+ apr_pool_cleanup_null);
+ }
+ else if (prov) {
+ /* options after a provider apply to the provider */
+#if !APR_USE_OPENSSL_PRE_3_5_API
+ if (!OSSL_PROVIDER_add_conf_parameter(prov, elt, ptr)) {
+ return PR_EINVAL;
+ }
+#else
+ return APR_ENOTIMPL;
+#endif
+ }
+#endif
+
i++;
}
engine = fields[0].value;
}
- f = apr_pcalloc(pool, sizeof(apr_crypto_t));
- if (!f) {
- return APR_ENOMEM;
- }
- f->config = config = apr_pcalloc(pool, sizeof(apr_crypto_config_t));
- if (!config) {
- return APR_ENOMEM;
- }
- f->pool = pool;
- f->provider = provider;
-
/* The default/builtin "openssl" engine is the same as NULL though with
* openssl-3+ it's called something else, keep NULL for that name.
*/
Modified: apr/apr-util/branches/1.7.x/include/apr_crypto.h
URL: http://svn.apache.org/viewvc/apr/apr-util/branches/1.7.x/include/apr_crypto.h?rev=1924450&r1=1924449&r2=1924450&view=diff
==============================================================================
--- apr/apr-util/branches/1.7.x/include/apr_crypto.h (original)
+++ apr/apr-util/branches/1.7.x/include/apr_crypto.h Tue Mar 18 13:03:11 2025
@@ -608,8 +608,11 @@ APU_DECLARE(apr_status_t) apr_crypto_err
* @return APR_ENOENGINE when the engine specified does not exist. APR_EINITENGINE
* if the engine cannot be initialised.
* @remarks NSS: currently no params are supported.
- * @remarks OpenSSL: the params can have "engine" as a key, followed by an equal
- * sign and a value.
+ * @remarks OpenSSL legacy: prior to v3, use "engine=[engine]" to set the engine.
+ * @remarks OpenSSL3+: use "provider=[provider]" to set the provider to load, can
+ * be specified more than once.
+ * @remarks OpenSSL3.5+: "name=[value]" params specified after each "provider"
+ * are applied to that provider.
*/
APU_DECLARE(apr_status_t) apr_crypto_make(apr_crypto_t **f,
const apr_crypto_driver_t *driver, const char *params,
Modified: apr/apr-util/branches/1.7.x/test/testcrypto.c
URL: http://svn.apache.org/viewvc/apr/apr-util/branches/1.7.x/test/testcrypto.c?rev=1924450&r1=1924449&r2=1924450&view=diff
==============================================================================
--- apr/apr-util/branches/1.7.x/test/testcrypto.c (original)
+++ apr/apr-util/branches/1.7.x/test/testcrypto.c Tue Mar 18 13:03:11 2025
@@ -102,12 +102,19 @@ static apr_crypto_t *make(abts_case *tc,
apr_crypto_t *f = NULL;
+ apr_status_t status;
+
if (!driver) {
return NULL;
}
/* get the context */
- apr_crypto_make(&f, driver, "engine=openssl", pool);
+ status = apr_crypto_make(&f, driver, "engine=openssl", pool);
+
+ if (APR_ENOTIMPL == status) {
+ apr_crypto_make(&f, driver, "provider=default", pool);
+ }
+
ABTS_ASSERT(tc, "apr_crypto_make returned NULL", f != NULL);
return f;
lmpx.com only provides a reader for public news (NNTP) servers. It is not
affiliated with the servers or forums shown here and is not responsible for
the content of articles, which is written by their respective authors.