Skip to content

Commit b3016c7

Browse files
addaleaxjuanarbol
addaleax
authored and
juanarbol
committed
src: add proper mutexes for accessing FIPS state
The FIPS state handling and OpenSSL initialization code makes accesses to global OpenSSL state without any protection against parallel modifications from multiple threads. This commit adds such protections. PR-URL: #42278 Reviewed-By: Tobias Nießen <[email protected]> Reviewed-By: Richard Lau <[email protected]> Reviewed-By: James M Snell <[email protected]> Reviewed-By: Darshan Sen <[email protected]>
1 parent fd3a8bf commit b3016c7

1 file changed

Lines changed: 17 additions & 0 deletions

File tree

‎src/crypto/crypto_util.cc‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -136,7 +136,13 @@ bool InitCryptoOnce(Isolate* isolate) {
136136
return true;
137137
}
138138

139+
// Protect accesses to FIPS state with a mutex. This should potentially
140+
// be part of a larger mutex for global OpenSSL state.
141+
static Mutex fips_mutex;
142+
139143
void InitCryptoOnce() {
144+
Mutex::ScopedLock lock(per_process::cli_options_mutex);
145+
Mutex::ScopedLock fips_lock(fips_mutex);
140146
#ifndef OPENSSL_IS_BORINGSSL
141147
OPENSSL_INIT_SETTINGS* settings = OPENSSL_INIT_new();
142148

@@ -186,6 +192,9 @@ void InitCryptoOnce() {
186192
}
187193

188194
void GetFipsCrypto(const FunctionCallbackInfo<Value>& args) {
195+
Mutex::ScopedLock lock(per_process::cli_options_mutex);
196+
Mutex::ScopedLock fips_lock(fips_mutex);
197+
189198
#if OPENSSL_VERSION_MAJOR >= 3
190199
args.GetReturnValue().Set(EVP_default_properties_is_fips_enabled(nullptr) ?
191200
1 : 0);
@@ -195,8 +204,13 @@ void GetFipsCrypto(const FunctionCallbackInfo<Value>& args) {
195204
}
196205

197206
void SetFipsCrypto(const FunctionCallbackInfo<Value>& args) {
207+
Mutex::ScopedLock lock(per_process::cli_options_mutex);
208+
Mutex::ScopedLock fips_lock(fips_mutex);
209+
198210
CHECK(!per_process::cli_options->force_fips_crypto);
199211
Environment* env = Environment::GetCurrent(args);
212+
// TODO(addaleax): This should not be possible to set from worker threads.
213+
// CHECK(env->owns_process_state());
200214
bool enable = args[0]->BooleanValue(env->isolate());
201215

202216
#if OPENSSL_VERSION_MAJOR >= 3
@@ -217,6 +231,9 @@ void SetFipsCrypto(const FunctionCallbackInfo<Value>& args) {
217231
}
218232

219233
void TestFipsCrypto(const v8::FunctionCallbackInfo<v8::Value>& args) {
234+
Mutex::ScopedLock lock(per_process::cli_options_mutex);
235+
Mutex::ScopedLock fips_lock(fips_mutex);
236+
220237
#ifdef OPENSSL_FIPS
221238
#if OPENSSL_VERSION_MAJOR >= 3
222239
OSSL_PROVIDER* fips_provider = nullptr;

0 commit comments

Comments
 (0)