Support loading custom OpenSSL provider #2357
Conversation
When using OpenSSL, allow Squid to use a specific crypto provider named in ssl_provider. Replaces any system-wide configuration specified using openssl.conf.
|
Existing builds will start to see something like this is cache.log on startup: When |
rousskov
left a comment
rousskov
left a comment
There was a problem hiding this comment.
Thank you for adding this feature. I have not reviewed the entire PR yet, and will have more questions later, but these two change requests should allow you to make progress.
| if (::Config.SSL.ssl_provider) { | ||
| if (!OSSL_PROVIDER_load(nullptr, ::Config.SSL.ssl_provider)) { | ||
| const auto ssl_error = ERR_get_error(); | ||
| fatalf("Failed to load SSL provider: %s\n", Security::ErrorString(ssl_error)); |
There was a problem hiding this comment.
Please do not call fatalf() when reacting to a configuration application failure. Throw an exception instead.
There was a problem hiding this comment.
Unfortunately this function is not only called during startup. It can be delayed and called later in Squid operation after a reconfigure. The exception handlers for that case are not yet reliable.
FWIW, I planned to fix the above situation with the project moving init things into runners. But that work got stalled.
yadij
added
the
S-waiting-for-reviewer
2 participants
When using OpenSSL, allow Squid to use a specific
crypto provider named in ssl_provider.
Replaces any system-wide configuration specified
using openssl.conf.