2 * Copyright 2019 The OpenSSL Project Authors. All Rights Reserved.
4 * Licensed under the Apache License 2.0 (the "License"). You may not use
5 * this file except in compliance with the License. You can obtain a copy
6 * in the file LICENSE in the source distribution or at
7 * https://www.openssl.org/source/license.html
10 #include <openssl/core.h>
11 #include <openssl/core_numbers.h>
12 #include <openssl/params.h>
13 #include <openssl/opensslv.h>
14 #include "internal/cryptlib_int.h"
15 #include "internal/nelem.h"
16 #include "internal/thread_once.h"
17 #include "internal/provider.h"
18 #include "internal/refcount.h"
19 #include "provider_local.h"
21 static OSSL_PROVIDER *provider_new(const char *name,
22 OSSL_provider_init_fn *init_function);
25 * Provider Object structure
26 * =========================
33 DEFINE_STACK_OF(INFOPAIR)
35 struct provider_store_st; /* Forward declaration */
37 struct ossl_provider_st {
39 unsigned int flag_initialized:1;
40 unsigned int flag_fallback:1;
42 /* OpenSSL library side data */
43 CRYPTO_REF_COUNT refcnt;
44 CRYPTO_RWLOCK *refcnt_lock; /* For the ref counter */
48 OSSL_provider_init_fn *init_function;
49 STACK_OF(INFOPAIR) *parameters;
50 OPENSSL_CTX *libctx; /* The library context this instance is in */
51 struct provider_store_st *store; /* The store this instance belongs to */
54 * In the FIPS module inner provider, this isn't needed, since the
55 * error upcalls are always direct calls to the outer provider.
57 int error_lib; /* ERR library number, one for each provider */
58 # ifndef OPENSSL_NO_ERR
59 ERR_STRING_DATA *error_strings; /* Copy of what the provider gives us */
63 /* Provider side functions */
64 OSSL_provider_teardown_fn *teardown;
65 OSSL_provider_get_param_types_fn *get_param_types;
66 OSSL_provider_get_params_fn *get_params;
67 OSSL_provider_query_operation_fn *query_operation;
69 /* Provider side data */
72 DEFINE_STACK_OF(OSSL_PROVIDER)
74 static int ossl_provider_cmp(const OSSL_PROVIDER * const *a,
75 const OSSL_PROVIDER * const *b)
77 return strcmp((*a)->name, (*b)->name);
81 * Provider Object store
82 * =====================
84 * The Provider Object store is a library context object, and therefore needs
88 struct provider_store_st {
89 STACK_OF(OSSL_PROVIDER) *providers;
91 unsigned int use_fallbacks:1;
94 static void provider_store_free(void *vstore)
96 struct provider_store_st *store = vstore;
100 sk_OSSL_PROVIDER_pop_free(store->providers, ossl_provider_free);
101 CRYPTO_THREAD_lock_free(store->lock);
105 static void *provider_store_new(OPENSSL_CTX *ctx)
107 struct provider_store_st *store = OPENSSL_zalloc(sizeof(*store));
108 const struct predefined_providers_st *p = NULL;
111 || (store->providers = sk_OSSL_PROVIDER_new(ossl_provider_cmp)) == NULL
112 || (store->lock = CRYPTO_THREAD_lock_new()) == NULL) {
113 provider_store_free(store);
116 store->use_fallbacks = 1;
118 for (p = predefined_providers; p->name != NULL; p++) {
119 OSSL_PROVIDER *prov = NULL;
122 * We use the internal constructor directly here,
123 * otherwise we get a call loop
125 prov = provider_new(p->name, p->init);
128 || sk_OSSL_PROVIDER_push(store->providers, prov) == 0) {
129 ossl_provider_free(prov);
130 provider_store_free(store);
131 CRYPTOerr(CRYPTO_F_PROVIDER_STORE_NEW, ERR_R_INTERNAL_ERROR);
137 prov->error_lib = ERR_get_next_error_library();
140 ossl_provider_set_fallback(prov);
146 static const OPENSSL_CTX_METHOD provider_store_method = {
151 static struct provider_store_st *get_provider_store(OPENSSL_CTX *libctx)
153 struct provider_store_st *store = NULL;
155 store = openssl_ctx_get_data(libctx, OPENSSL_CTX_PROVIDER_STORE_INDEX,
156 &provider_store_method);
158 CRYPTOerr(CRYPTO_F_GET_PROVIDER_STORE, ERR_R_INTERNAL_ERROR);
162 OSSL_PROVIDER *ossl_provider_find(OPENSSL_CTX *libctx, const char *name)
164 struct provider_store_st *store = NULL;
165 OSSL_PROVIDER *prov = NULL;
167 if ((store = get_provider_store(libctx)) != NULL) {
168 OSSL_PROVIDER tmpl = { 0, };
171 tmpl.name = (char *)name;
172 CRYPTO_THREAD_write_lock(store->lock);
173 if ((i = sk_OSSL_PROVIDER_find(store->providers, &tmpl)) == -1
174 || (prov = sk_OSSL_PROVIDER_value(store->providers, i)) == NULL
175 || !ossl_provider_up_ref(prov))
177 CRYPTO_THREAD_unlock(store->lock);
184 * Provider Object methods
185 * =======================
188 static OSSL_PROVIDER *provider_new(const char *name,
189 OSSL_provider_init_fn *init_function)
191 OSSL_PROVIDER *prov = NULL;
193 if ((prov = OPENSSL_zalloc(sizeof(*prov))) == NULL
195 || (prov->refcnt_lock = CRYPTO_THREAD_lock_new()) == NULL
197 || !ossl_provider_up_ref(prov) /* +1 One reference to be returned */
198 || (prov->name = OPENSSL_strdup(name)) == NULL) {
199 ossl_provider_free(prov);
200 CRYPTOerr(CRYPTO_F_PROVIDER_NEW, ERR_R_MALLOC_FAILURE);
204 prov->init_function = init_function;
208 int ossl_provider_up_ref(OSSL_PROVIDER *prov)
212 if (CRYPTO_UP_REF(&prov->refcnt, &ref, prov->refcnt_lock) <= 0)
217 OSSL_PROVIDER *ossl_provider_new(OPENSSL_CTX *libctx, const char *name,
218 OSSL_provider_init_fn *init_function)
220 struct provider_store_st *store = NULL;
221 OSSL_PROVIDER *prov = NULL;
223 if ((store = get_provider_store(libctx)) == NULL)
226 if ((prov = ossl_provider_find(libctx, name)) != NULL) { /* refcount +1 */
227 ossl_provider_free(prov); /* refcount -1 */
228 ERR_raise_data(ERR_LIB_CRYPTO, CRYPTO_R_PROVIDER_ALREADY_EXISTS, NULL,
233 /* provider_new() generates an error, so no need here */
234 if ((prov = provider_new(name, init_function)) == NULL)
237 CRYPTO_THREAD_write_lock(store->lock);
238 if (!ossl_provider_up_ref(prov)) { /* +1 One reference for the store */
239 ossl_provider_free(prov); /* -1 Reference that was to be returned */
241 } else if (sk_OSSL_PROVIDER_push(store->providers, prov) == 0) {
242 ossl_provider_free(prov); /* -1 Store reference */
243 ossl_provider_free(prov); /* -1 Reference that was to be returned */
246 prov->libctx = libctx;
249 prov->error_lib = ERR_get_next_error_library();
252 CRYPTO_THREAD_unlock(store->lock);
255 CRYPTOerr(CRYPTO_F_OSSL_PROVIDER_NEW, ERR_R_MALLOC_FAILURE);
258 * At this point, the provider is only partially "loaded". To be
259 * fully "loaded", ossl_provider_activate() must also be called.
265 static void free_infopair(INFOPAIR *pair)
267 OPENSSL_free(pair->name);
268 OPENSSL_free(pair->value);
272 void ossl_provider_free(OSSL_PROVIDER *prov)
277 CRYPTO_DOWN_REF(&prov->refcnt, &ref, prov->refcnt_lock);
280 * When the refcount drops below two, the store is the only
281 * possible reference, or it has already been taken away from
282 * the store (this may happen if a provider was activated
283 * because it's a fallback, but isn't currently used)
284 * When that happens, the provider is inactivated.
286 if (ref < 2 && prov->flag_initialized) {
288 ossl_init_thread_deregister(prov);
290 if (prov->teardown != NULL)
291 prov->teardown(prov->provctx);
292 #ifndef OPENSSL_NO_ERR
294 if (prov->error_strings != NULL) {
295 ERR_unload_strings(prov->error_lib, prov->error_strings);
296 OPENSSL_free(prov->error_strings);
297 prov->error_strings = NULL;
301 prov->flag_initialized = 0;
305 * When the refcount drops to zero, it has been taken out of
306 * the store. All we have to do here is clean it out.
310 DSO_free(prov->module);
312 OPENSSL_free(prov->name);
313 OPENSSL_free(prov->path);
314 sk_INFOPAIR_pop_free(prov->parameters, free_infopair);
316 CRYPTO_THREAD_lock_free(prov->refcnt_lock);
324 int ossl_provider_set_module_path(OSSL_PROVIDER *prov, const char *module_path)
326 OPENSSL_free(prov->path);
327 if (module_path == NULL)
329 if ((prov->path = OPENSSL_strdup(module_path)) != NULL)
331 CRYPTOerr(CRYPTO_F_OSSL_PROVIDER_SET_MODULE_PATH, ERR_R_MALLOC_FAILURE);
335 int ossl_provider_add_parameter(OSSL_PROVIDER *prov,
336 const char *name, const char *value)
338 INFOPAIR *pair = NULL;
340 if ((pair = OPENSSL_zalloc(sizeof(*pair))) != NULL
341 && (prov->parameters != NULL
342 || (prov->parameters = sk_INFOPAIR_new_null()) != NULL)
343 && (pair->name = OPENSSL_strdup(name)) != NULL
344 && (pair->value = OPENSSL_strdup(value)) != NULL
345 && sk_INFOPAIR_push(prov->parameters, pair) > 0)
349 OPENSSL_free(pair->name);
350 OPENSSL_free(pair->value);
353 CRYPTOerr(CRYPTO_F_OSSL_PROVIDER_ADD_PARAMETER, ERR_R_MALLOC_FAILURE);
358 * Provider activation.
360 * What "activation" means depends on the provider form; for built in
361 * providers (in the library or the application alike), the provider
362 * can already be considered to be loaded, all that's needed is to
363 * initialize it. However, for dynamically loadable provider modules,
364 * we must first load that module.
366 * Built in modules are distinguished from dynamically loaded modules
367 * with an already assigned init function.
369 static const OSSL_DISPATCH *core_dispatch; /* Define further down */
372 * Internal version that doesn't affect the store flags, and thereby avoid
373 * locking. Direct callers must remember to set the store flags when
376 static int provider_activate(OSSL_PROVIDER *prov)
378 const OSSL_DISPATCH *provider_dispatch = NULL;
379 #ifndef OPENSSL_NO_ERR
381 OSSL_provider_get_reason_strings_fn *p_get_reason_strings = NULL;
385 if (prov->flag_initialized)
389 * If the init function isn't set, it indicates that this provider is
392 if (prov->init_function == NULL) {
396 if (prov->module == NULL) {
397 char *allocated_path = NULL;
398 const char *module_path = NULL;
399 char *merged_path = NULL;
400 const char *load_dir = ossl_safe_getenv("OPENSSL_MODULES");
402 if ((prov->module = DSO_new()) == NULL) {
403 /* DSO_new() generates an error already */
407 if (load_dir == NULL)
408 load_dir = MODULESDIR;
410 DSO_ctrl(prov->module, DSO_CTRL_SET_FLAGS,
411 DSO_FLAG_NAME_TRANSLATION_EXT_ONLY, NULL);
413 module_path = prov->path;
414 if (module_path == NULL)
415 module_path = allocated_path =
416 DSO_convert_filename(prov->module, prov->name);
417 if (module_path != NULL)
418 merged_path = DSO_merge(prov->module, module_path, load_dir);
420 if (merged_path == NULL
421 || (DSO_load(prov->module, merged_path, NULL, 0)) == NULL) {
422 DSO_free(prov->module);
426 OPENSSL_free(merged_path);
427 OPENSSL_free(allocated_path);
430 if (prov->module != NULL)
431 prov->init_function = (OSSL_provider_init_fn *)
432 DSO_bind_func(prov->module, "OSSL_provider_init");
436 /* Call the initialise function for the provider. */
437 if (prov->init_function == NULL
438 || !prov->init_function(prov, core_dispatch, &provider_dispatch,
440 ERR_raise_data(ERR_LIB_CRYPTO, ERR_R_INIT_FAIL, NULL,
441 "name=%s", prov->name);
443 DSO_free(prov->module);
449 for (; provider_dispatch->function_id != 0; provider_dispatch++) {
450 switch (provider_dispatch->function_id) {
451 case OSSL_FUNC_PROVIDER_TEARDOWN:
453 OSSL_get_provider_teardown(provider_dispatch);
455 case OSSL_FUNC_PROVIDER_GET_PARAM_TYPES:
456 prov->get_param_types =
457 OSSL_get_provider_get_param_types(provider_dispatch);
459 case OSSL_FUNC_PROVIDER_GET_PARAMS:
461 OSSL_get_provider_get_params(provider_dispatch);
463 case OSSL_FUNC_PROVIDER_QUERY_OPERATION:
464 prov->query_operation =
465 OSSL_get_provider_query_operation(provider_dispatch);
467 #ifndef OPENSSL_NO_ERR
469 case OSSL_FUNC_PROVIDER_GET_REASON_STRINGS:
470 p_get_reason_strings =
471 OSSL_get_provider_get_reason_strings(provider_dispatch);
478 #ifndef OPENSSL_NO_ERR
480 if (p_get_reason_strings != NULL) {
481 const OSSL_ITEM *reasonstrings = p_get_reason_strings(prov->provctx);
485 * ERR_load_strings() handles ERR_STRING_DATA rather than OSSL_ITEM,
486 * although they are essentially the same type.
487 * Furthermore, ERR_load_strings() patches the array's error number
488 * with the error library number, so we need to make a copy of that
491 cnt = 1; /* One for the terminating item */
492 while (reasonstrings[cnt].id != 0) {
493 if (ERR_GET_LIB(reasonstrings[cnt].id) != 0)
498 /* Allocate one extra item for the "library" name */
499 prov->error_strings =
500 OPENSSL_zalloc(sizeof(ERR_STRING_DATA) * (cnt + 1));
501 if (prov->error_strings == NULL)
505 * Set the "library" name.
507 prov->error_strings[0].error = ERR_PACK(prov->error_lib, 0, 0);
508 prov->error_strings[0].string = prov->name;
510 * Copy reasonstrings item 0..cnt-1 to prov->error_trings positions
513 for (cnt2 = 1; cnt2 <= cnt; cnt2++) {
514 prov->error_strings[cnt2].error = (int)reasonstrings[cnt2-1].id;
515 prov->error_strings[cnt2].string = reasonstrings[cnt2-1].ptr;
518 ERR_load_strings(prov->error_lib, prov->error_strings);
523 /* With this flag set, this provider has become fully "loaded". */
524 prov->flag_initialized = 1;
529 int ossl_provider_activate(OSSL_PROVIDER *prov)
531 if (provider_activate(prov)) {
532 CRYPTO_THREAD_write_lock(prov->store->lock);
533 prov->store->use_fallbacks = 0;
534 CRYPTO_THREAD_unlock(prov->store->lock);
541 void *ossl_provider_ctx(const OSSL_PROVIDER *prov)
543 return prov->provctx;
547 static int provider_forall_loaded(struct provider_store_st *store,
548 int *found_activated,
549 int (*cb)(OSSL_PROVIDER *provider,
555 int num_provs = sk_OSSL_PROVIDER_num(store->providers);
557 if (found_activated != NULL)
558 *found_activated = 0;
559 for (i = 0; i < num_provs; i++) {
560 OSSL_PROVIDER *prov =
561 sk_OSSL_PROVIDER_value(store->providers, i);
563 if (prov->flag_initialized) {
564 if (found_activated != NULL)
565 *found_activated = 1;
566 if (!(ret = cb(prov, cbdata)))
575 * This function only does something once when store->use_fallbacks == 1,
576 * and then sets store->use_fallbacks = 0, so the second call and so on is
577 * effectively a no-op.
579 static void provider_activate_fallbacks(struct provider_store_st *store)
581 if (store->use_fallbacks) {
582 int num_provs = sk_OSSL_PROVIDER_num(store->providers);
583 int activated_fallback_count = 0;
586 for (i = 0; i < num_provs; i++) {
587 OSSL_PROVIDER *prov = sk_OSSL_PROVIDER_value(store->providers, i);
590 * Note that we don't care if the activation succeeds or not.
591 * If it doesn't succeed, then any attempt to use any of the
592 * fallback providers will fail anyway.
594 if (prov->flag_fallback) {
595 activated_fallback_count++;
596 provider_activate(prov);
601 * We assume that all fallbacks have been added to the store before
602 * any fallback is activated.
603 * TODO: We may have to reconsider this, IF we find ourselves adding
604 * fallbacks after any previous fallback has been activated.
606 if (activated_fallback_count > 0)
607 store->use_fallbacks = 0;
611 int ossl_provider_forall_loaded(OPENSSL_CTX *ctx,
612 int (*cb)(OSSL_PROVIDER *provider,
617 struct provider_store_st *store = get_provider_store(ctx);
620 CRYPTO_THREAD_read_lock(store->lock);
622 provider_activate_fallbacks(store);
625 * Now, we sweep through all providers
627 ret = provider_forall_loaded(store, NULL, cb, cbdata);
629 CRYPTO_THREAD_unlock(store->lock);
635 int ossl_provider_available(OSSL_PROVIDER *prov)
638 CRYPTO_THREAD_read_lock(prov->store->lock);
639 provider_activate_fallbacks(prov->store);
640 CRYPTO_THREAD_unlock(prov->store->lock);
642 return prov->flag_initialized;
647 /* Setters of Provider Object data */
648 int ossl_provider_set_fallback(OSSL_PROVIDER *prov)
653 prov->flag_fallback = 1;
657 /* Getters of Provider Object data */
658 const char *ossl_provider_name(const OSSL_PROVIDER *prov)
663 const DSO *ossl_provider_dso(const OSSL_PROVIDER *prov)
668 const char *ossl_provider_module_name(const OSSL_PROVIDER *prov)
673 return DSO_get_filename(prov->module);
677 const char *ossl_provider_module_path(const OSSL_PROVIDER *prov)
682 /* FIXME: Ensure it's a full path */
683 return DSO_get_filename(prov->module);
687 /* Wrappers around calls to the provider */
688 void ossl_provider_teardown(const OSSL_PROVIDER *prov)
690 if (prov->teardown != NULL)
691 prov->teardown(prov->provctx);
694 const OSSL_PARAM *ossl_provider_get_param_types(const OSSL_PROVIDER *prov)
696 return prov->get_param_types == NULL
697 ? NULL : prov->get_param_types(prov->provctx);
700 int ossl_provider_get_params(const OSSL_PROVIDER *prov, OSSL_PARAM params[])
702 return prov->get_params == NULL
703 ? 0 : prov->get_params(prov->provctx, params);
707 const OSSL_ALGORITHM *ossl_provider_query_operation(const OSSL_PROVIDER *prov,
711 return prov->query_operation(prov->provctx, operation_id, no_cache);
715 * Core functions for the provider
716 * ===============================
718 * This is the set of functions that the core makes available to the provider
722 * This returns a list of Provider Object parameters with their types, for
723 * discovery. We do not expect that many providers will use this, but one
726 static const OSSL_PARAM param_types[] = {
727 OSSL_PARAM_DEFN("openssl-verstion", OSSL_PARAM_UTF8_PTR, NULL, 0),
728 OSSL_PARAM_DEFN("provider-name", OSSL_PARAM_UTF8_PTR, NULL, 0),
733 * Forward declare all the functions that are provided aa dispatch.
734 * This ensures that the compiler will complain if they aren't defined
735 * with the correct signature.
737 static OSSL_core_get_param_types_fn core_get_param_types;
738 static OSSL_core_get_params_fn core_get_params;
739 static OSSL_core_thread_start_fn core_thread_start;
740 static OSSL_core_get_library_context_fn core_get_libctx;
742 static OSSL_core_new_error_fn core_new_error;
743 static OSSL_core_set_error_debug_fn core_set_error_debug;
744 static OSSL_core_vset_error_fn core_vset_error;
747 static const OSSL_PARAM *core_get_param_types(const OSSL_PROVIDER *prov)
752 static int core_get_params(const OSSL_PROVIDER *prov, OSSL_PARAM params[])
757 if ((p = OSSL_PARAM_locate(params, "openssl-version")) != NULL)
758 OSSL_PARAM_set_utf8_ptr(p, OPENSSL_VERSION_STR);
759 if ((p = OSSL_PARAM_locate(params, "provider-name")) != NULL)
760 OSSL_PARAM_set_utf8_ptr(p, prov->name);
762 if (prov->parameters == NULL)
765 for (i = 0; i < sk_INFOPAIR_num(prov->parameters); i++) {
766 INFOPAIR *pair = sk_INFOPAIR_value(prov->parameters, i);
768 if ((p = OSSL_PARAM_locate(params, pair->name)) != NULL)
769 OSSL_PARAM_set_utf8_ptr(p, pair->value);
775 static OPENSSL_CTX *core_get_libctx(const OSSL_PROVIDER *prov)
780 static int core_thread_start(const OSSL_PROVIDER *prov,
781 OSSL_thread_stop_handler_fn handfn)
783 return ossl_init_thread_start(prov, prov->provctx, handfn);
787 * The FIPS module inner provider doesn't implement these. They aren't
788 * needed there, since the FIPS module upcalls are always the outer provider
793 * TODO(3.0) These error functions should use |prov| to select the proper
794 * library context to report in the correct error stack, at least if error
795 * stacks become tied to the library context.
796 * We cannot currently do that since there's no support for it in the
799 static void core_new_error(const OSSL_PROVIDER *prov)
804 static void core_set_error_debug(const OSSL_PROVIDER *prov,
805 const char *file, int line, const char *func)
807 ERR_set_debug(file, line, func);
810 static void core_vset_error(const OSSL_PROVIDER *prov,
811 uint32_t reason, const char *fmt, va_list args)
814 * If the uppermost 8 bits are non-zero, it's an OpenSSL library
815 * error and will be treated as such. Otherwise, it's a new style
816 * provider error and will be treated as such.
818 if (ERR_GET_LIB(reason) != 0) {
819 ERR_vset_error(ERR_GET_LIB(reason), ERR_GET_REASON(reason), fmt, args);
821 ERR_vset_error(prov->error_lib, (int)reason, fmt, args);
827 * Functions provided by the core. Blank line separates "families" of related
830 static const OSSL_DISPATCH core_dispatch_[] = {
831 { OSSL_FUNC_CORE_GET_PARAM_TYPES, (void (*)(void))core_get_param_types },
832 { OSSL_FUNC_CORE_GET_PARAMS, (void (*)(void))core_get_params },
833 { OSSL_FUNC_CORE_GET_LIBRARY_CONTEXT, (void (*)(void))core_get_libctx },
834 { OSSL_FUNC_CORE_THREAD_START, (void (*)(void))core_thread_start },
836 { OSSL_FUNC_CORE_NEW_ERROR, (void (*)(void))core_new_error },
837 { OSSL_FUNC_CORE_SET_ERROR_DEBUG, (void (*)(void))core_set_error_debug },
838 { OSSL_FUNC_CORE_VSET_ERROR, (void (*)(void))core_vset_error },
841 { OSSL_FUNC_CRYPTO_MALLOC, (void (*)(void))CRYPTO_malloc },
842 { OSSL_FUNC_CRYPTO_ZALLOC, (void (*)(void))CRYPTO_zalloc },
843 { OSSL_FUNC_CRYPTO_FREE, (void (*)(void))CRYPTO_free },
844 { OSSL_FUNC_CRYPTO_CLEAR_FREE, (void (*)(void))CRYPTO_clear_free },
845 { OSSL_FUNC_CRYPTO_REALLOC, (void (*)(void))CRYPTO_realloc },
846 { OSSL_FUNC_CRYPTO_CLEAR_REALLOC, (void (*)(void))CRYPTO_clear_realloc },
847 { OSSL_FUNC_CRYPTO_SECURE_MALLOC, (void (*)(void))CRYPTO_secure_malloc },
848 { OSSL_FUNC_CRYPTO_SECURE_ZALLOC, (void (*)(void))CRYPTO_secure_zalloc },
849 { OSSL_FUNC_CRYPTO_SECURE_FREE, (void (*)(void))CRYPTO_secure_free },
850 { OSSL_FUNC_CRYPTO_SECURE_CLEAR_FREE,
851 (void (*)(void))CRYPTO_secure_clear_free },
852 { OSSL_FUNC_CRYPTO_SECURE_ALLOCATED,
853 (void (*)(void))CRYPTO_secure_allocated },
854 { OSSL_FUNC_OPENSSL_CLEANSE, (void (*)(void))OPENSSL_cleanse },
858 static const OSSL_DISPATCH *core_dispatch = core_dispatch_;