OSSL_PROVIDER_do_all creating side effects #13844
Description
This pertains to a locally build (linux-x86_64) master (OpenSSL3): The return value of OSSL_PROVIDER_available depends on whether (apparently side-effect free OSSL_PROVIDER_do_all) has been run before (or not). This is at least unexpected; if there is an explanation, I'd be glad to get it.
Code to reproduce:
#include <string.h>
#include <openssl/crypto.h>
#include <openssl/provider.h>
int display_provider(OSSL_PROVIDER *provider, void *cbdata) {
printf("Provider loaded: %s\n", OSSL_PROVIDER_name(provider));
return 1;
}
int main(int argc, char *argv[]) {
OSSL_LIB_CTX *libctx = OSSL_LIB_CTX_new();
if (!libctx)
return -1;
// run this iterator only if two parameters are passed:
if (argc>2) OSSL_PROVIDER_do_all(libctx, display_provider, NULL);
if (!OSSL_LIB_CTX_load_config(libctx, "base.cnf"))
return -1;
// run this iterator if any parameter is passed:
if (argc>1) OSSL_PROVIDER_do_all(libctx, display_provider, NULL);
printf("default provider available: %d\n",
OSSL_PROVIDER_available(libctx, "default"));
}
Compiled with gcc -Iinclude bug.c -L. -lcrypto, this command sequence shows the problem:
> LD_LIBRARY_PATH=. ./a.out
default provider available: 0
> LD_LIBRARY_PATH=. ./a.out 1
Provider loaded: base
default provider available: 0
> LD_LIBRARY_PATH=. ./a.out 1 2
Provider loaded: default
Provider loaded: base
Provider loaded: default
default provider available: 1
The first invocation returns as expected: "default" provider is not loaded (as per cnf below).
The second invocation now iterates providers after loading the configuration and only the loaded "base" is shown; "default" is correctly shown as absent.
The final iteration already at the start shows "default" loaded when iterating providers (and subsequently returns a different result in OSSL_PROVIDER_available). This does not seem plausible and is not explicable from the documentation: Or in other words: Why does calling OSSL_PROVIDER_do_all cause the "default" provider to be loaded?
base.cnf contents:
openssl_conf = openssl_init
[openssl_init]
providers = provider_sect
[provider_sect]
base = base_sect
[base_sect]
activate = 1