c++ - 如何以新方式编写线程安全的 OpenSSL 代码？

Question

我正在学习如何使用 OpenSSL 编写多线程 DTLS 服务器。我一直在查看文档，如果我设置了 CRYPTO_set_id_callback，看起来 OpenSSL 应该可以使用多个线程。和 CRYPTO_set_locking_callback .我正在使用 OpenSSL 1.1.1c，当我查看 crypto.h 时，我发现这个:

/*
 * The old locking functions have been removed completely without compatibility
 * macros. This is because the old functions either could not properly report
 * errors, or the returned error values were not clearly documented.
 * Replacing the locking functions with no-ops would cause race condition
 * issues in the affected applications. It is far better for them to fail at
 * compile time.
 * On the other hand, the locking callbacks are no longer used.  Consequently,
 * the callback management functions can be safely replaced with no-op macros.
 */
#  define CRYPTO_num_locks()            (1)
#  define CRYPTO_set_locking_callback(func)
#  define CRYPTO_get_locking_callback()         (NULL)
#  define CRYPTO_set_add_lock_callback(func)
#  define CRYPTO_get_add_lock_callback()        (NULL)

所以，我看起来这个方法已经过时了。我应该怎么做才能确保我的 OpenSSL 代码是线程安全的？

——
经过更多研究，我发现了这个: Tutorial on Using OpenSSL with pthreads .我还找到了 https://www.openssl.org/docs/man1.0.2/man3/CRYPTO_THREADID_set_callback.html .
然而， CRYPTO_THREADID_set_callback()也是一个no-op!看起来我只能用正确的标志编译 OpenSSL。

Answer 1

实际上，您不再需要在 OpenSSL 1.1.0 及更高版本中设置锁。

Programming with OpenSSL Is OpenSSL thread-safe?

Yes but with some limitations; for example, an SSL connection cannot be used concurrently > by multiple threads. This is true for most OpenSSL objects.

For version 1.1.0 and later, there is nothing further you need do.

For earlier versions than 1.1.0, it is necessary for your application to set up the thread callback functions. To do this, your application must call CRYPTO_set_locking_callback(3) and one of the CRYPTO_THREADID_set... API's. See the OpenSSL threads manpage for details and "note on multi-threading" in the INSTALL file in the source distribution.

您可以查看 OpenSSL 常见问题 here !