Rework the "by store" X509_LOOKUP method to open the given URI early [3.3]#27551
Rework the "by store" X509_LOOKUP method to open the given URI early [3.3]#27551levitte wants to merge 3 commits intoopenssl:openssl-3.3from
Conversation
|
Making this a draft for the moment. Need to check the test suite |
The cached X509_LOOKUP method data is no longer just the URI, but now includes the OSSL_STORE_CTX pointer, and required parameters to reopen the URI at any time. cache_objects() is modified to handle this, and only (re)open the URI when it wasn't previously opened, or when it was closed by an earlier call. This way, we can call OSSL_STORE_open_ex() in by_store_ctrl_ex(), and get to see possible errors when the URI is loaded. This assumes that if the URI could be opened once, it can be opened again. Fixes openssl#27461 Reviewed-by: David von Oheimb <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> (Merged from openssl#27529) (cherry picked from commit 0c48ee2)
Originally from openssl#27507, with some changes. Co-authored-by: Richard Levitte <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Richard Levitte <[email protected]> (Merged from openssl#27529) (cherry picked from commit 927deba)
It was used to pass libctx and propq, which would override the corresponding values passed to by_store_ctrl_ex(). This wasn't really reasonable to do either way, as it could potentially be a surprise to the user, who can reasonably expect that the URI is opened with the libctx and propq that was passed with the URI, and not with those passed later. Reviewed-by: David von Oheimb <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> (Merged from openssl#27529) (cherry picked from commit af5952d)
|
I've just verified that this cherry-picks cleanly to OpenSSL 3.2 |
|
I've also verified that this cherry-picks cleanly to OpenSSL 3.0, |
|
Style needed to be waived here too, for the same reason as in #27529 |
|
close/open to kick the workflows |
|
I had a look at the changes and would have liked to approve them, but feel that I do not have sufficient familiarity with |
|
This pull request is ready to merge |
|
Thank you @openssl-machine. Merging now |
The cached X509_LOOKUP method data is no longer just the URI, but now includes the OSSL_STORE_CTX pointer, and required parameters to reopen the URI at any time. cache_objects() is modified to handle this, and only (re)open the URI when it wasn't previously opened, or when it was closed by an earlier call. This way, we can call OSSL_STORE_open_ex() in by_store_ctrl_ex(), and get to see possible errors when the URI is loaded. This assumes that if the URI could be opened once, it can be opened again. Fixes #27461 (cherry picked from commit 0c48ee2) Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> (Merged from #27551)
Originally from #27507, with some changes. Co-authored-by: Richard Levitte <[email protected]> (cherry picked from commit 927deba) Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Richard Levitte <[email protected]> (Merged from #27551)
It was used to pass libctx and propq, which would override the corresponding values passed to by_store_ctrl_ex(). This wasn't really reasonable to do either way, as it could potentially be a surprise to the user, who can reasonably expect that the URI is opened with the libctx and propq that was passed with the URI, and not with those passed later. (cherry picked from commit af5952d) Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> (Merged from #27551)
The cached X509_LOOKUP method data is no longer just the URI, but now includes the OSSL_STORE_CTX pointer, and required parameters to reopen the URI at any time. cache_objects() is modified to handle this, and only (re)open the URI when it wasn't previously opened, or when it was closed by an earlier call. This way, we can call OSSL_STORE_open_ex() in by_store_ctrl_ex(), and get to see possible errors when the URI is loaded. This assumes that if the URI could be opened once, it can be opened again. Fixes #27461 (cherry picked from commit 0c48ee2) Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> (Merged from #27551) (cherry picked from commit 08220ef)
Originally from #27507, with some changes. Co-authored-by: Richard Levitte <[email protected]> (cherry picked from commit 927deba) Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Richard Levitte <[email protected]> (Merged from #27551) (cherry picked from commit 6143e70)
It was used to pass libctx and propq, which would override the corresponding values passed to by_store_ctrl_ex(). This wasn't really reasonable to do either way, as it could potentially be a surprise to the user, who can reasonably expect that the URI is opened with the libctx and propq that was passed with the URI, and not with those passed later. (cherry picked from commit af5952d) Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> (Merged from #27551) (cherry picked from commit 8bc0f67)
|
Merged 3.3: 08220ef Rework the "by store" X509_LOOKUP method to open the given URI early 3.2: 1432e85 Rework the "by store" X509_LOOKUP method to open the given URI early 3.0: 340383f Rework the "by store" X509_LOOKUP method to open the given URI early |
The cached X509_LOOKUP method data is no longer just the URI, but now includes the OSSL_STORE_CTX pointer, and required parameters to reopen the URI at any time. cache_objects() is modified to handle this, and only (re)open the URI when it wasn't previously opened, or when it was closed by an earlier call. This way, we can call OSSL_STORE_open_ex() in by_store_ctrl_ex(), and get to see possible errors when the URI is loaded. This assumes that if the URI could be opened once, it can be opened again. Fixes #27461 (cherry picked from commit 0c48ee2) Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> (Merged from #27551) (cherry picked from commit 08220ef)
Originally from #27507, with some changes. Co-authored-by: Richard Levitte <[email protected]> (cherry picked from commit 927deba) Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> Reviewed-by: Richard Levitte <[email protected]> (Merged from #27551) (cherry picked from commit 6143e70)
It was used to pass libctx and propq, which would override the corresponding values passed to by_store_ctrl_ex(). This wasn't really reasonable to do either way, as it could potentially be a surprise to the user, who can reasonably expect that the URI is opened with the libctx and propq that was passed with the URI, and not with those passed later. (cherry picked from commit af5952d) Reviewed-by: Dmitry Belyavskiy <[email protected]> Reviewed-by: Tomas Mraz <[email protected]> (Merged from #27551) (cherry picked from commit 8bc0f67)
This is a backport of #27529 to OpenSSL 3.3