[v26.1.x] CORE-15653 crypto/ossl: prevent openssl.cnf loading - #30141
Merged
pgellert merged 3 commits intoApr 13, 2026
Merged
Conversation
To avoid indirectly calling `OPENSSL_init_crypto` during static initialization and loading the openssl.cnf file. (cherry picked from commit ac5996e)
Prevent the default OpenSSL config from being loaded (OPENSSL_CONF env var or /etc/ssl/openssl.cnf file) as we want to control the initialization of OpenSSL and avoid any incompatibilities between the OS-provided openssl.cnf and our statically linked OpenSSL version. OpenSSL uses internal RUN_ONCE guards for initialization flags. The NO_* flags are sticky: once NO_LOAD_CONFIG wins, subsequent calls with LOAD_CONFIG are silently ignored. This is also why we can remove OPENSSL_INIT_NO_LOAD_CONFIG from OPENSSL_init_ssl — it is a flag for OPENSSL_init_crypto and has no effect once already set. Since NO_LOAD_CONFIG opts out of automatic config loading, the internal call to OPENSSL_load_builtin_modules that would normally happen during OPENSSL_config is skipped. Per the OPENSSL_load_builtin_modules(3) docs, applications that use configuration functions directly must call this before any other configuration code, so we call it explicitly early in start(). This must happen while the thread-local default context is still the global default: the CONF module list is protected by a global RCU lock (conf_mod.c) that is initialized exactly once via pthread_once. That initialization resolves a NULL OSSL_LIB_CTX* to the current thread-local default and permanently stores the pointer in the lock. Without this early call, the first OSSL_LIB_CTX_load_config (on the thread worker) would trigger the initialization after a custom context had been set as the thread-local default, causing the lock to capture a pointer to that context. Freeing the context later (e.g. between test runs) leaves the lock with a dangling pointer, resulting in a use-after-free on subsequent config loads. We also add a regression test that failed before this change. Ref: - https://docs.openssl.org/3.5/man3/OPENSSL_init_ssl/#description - https://docs.openssl.org/3.5/man3/OPENSSL_init_crypto/#description - https://docs.openssl.org/3.5/man3/OPENSSL_load_builtin_modules/#description (cherry picked from commit d9cbab9)
Cluster config validation uses OpenSSL functions for validating that the configured tls ciphers are valid. To ensure that openssl is correctly initialized, we need to move openssl initialization to before cluster config validation. Before: load node configs -> load cluster configs (triggers cipher validation) -> ... init openssl After: load node configs -> init openssl -> load cluster configs (cherry picked from commit c7fffc8)
pgellert
approved these changes
Apr 13, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backport of PR #29763