src: add proper mutexes for accessing FIPS state

The FIPS state handling and OpenSSL initialization code makes accesses to global OpenSSL state without any protection against parallel modifications from multiple threads. This commit adds such protections. PR-URL: #42278 Reviewed-By: Tobias Nießen <[email protected]> Reviewed-By: Richard Lau <[email protected]> Reviewed-By: James M Snell <[email protected]> Reviewed-By: Darshan Sen <[email protected]>

Author: addaleax

src/crypto/crypto_util.cc

@@ -136,7 +136,13 @@ bool InitCryptoOnce(Isolate* isolate){
 returntrue;
 }
 
+// Protect accesses to FIPS state with a mutex. This should potentially
+// be part of a larger mutex for global OpenSSL state.
+static Mutex fips_mutex;
+
 voidInitCryptoOnce(){
+ Mutex::ScopedLock lock(per_process::cli_options_mutex);
+ Mutex::ScopedLock fips_lock(fips_mutex);
 #ifndef OPENSSL_IS_BORINGSSL
  OPENSSL_INIT_SETTINGS* settings = OPENSSL_INIT_new();
 
@@ -186,6 +192,9 @@ void InitCryptoOnce(){
 }
 
 voidGetFipsCrypto(const FunctionCallbackInfo<Value>& args){
+ Mutex::ScopedLock lock(per_process::cli_options_mutex);
+ Mutex::ScopedLock fips_lock(fips_mutex);
+
 #if OPENSSL_VERSION_MAJOR >= 3
  args.GetReturnValue().Set(EVP_default_properties_is_fips_enabled(nullptr) ?
 1 : 0);
@@ -195,8 +204,13 @@ void GetFipsCrypto(const FunctionCallbackInfo<Value>& args){
 }
 
 voidSetFipsCrypto(const FunctionCallbackInfo<Value>& args){
+ Mutex::ScopedLock lock(per_process::cli_options_mutex);
+ Mutex::ScopedLock fips_lock(fips_mutex);
+
 CHECK(!per_process::cli_options->force_fips_crypto);
  Environment* env = Environment::GetCurrent(args);
+// TODO(addaleax): This should not be possible to set from worker threads.
+// CHECK(env->owns_process_state());
 bool enable = args[0]->BooleanValue(env->isolate());
 
 #if OPENSSL_VERSION_MAJOR >= 3
@@ -217,6 +231,9 @@ void SetFipsCrypto(const FunctionCallbackInfo<Value>& args){
 }
 
 voidTestFipsCrypto(const v8::FunctionCallbackInfo<v8::Value>& args){
+ Mutex::ScopedLock lock(per_process::cli_options_mutex);
+ Mutex::ScopedLock fips_lock(fips_mutex);
+
 #ifdef OPENSSL_FIPS
 #if OPENSSL_VERSION_MAJOR >= 3
  OSSL_PROVIDER* fips_provider = nullptr;