Skip to content

Split registrations - #763

Open
simo5 wants to merge 3 commits into
openssl-projects:mainfrom
simo5:split_registration
Open

Split registrations#763
simo5 wants to merge 3 commits into
openssl-projects:mainfrom
simo5:split_registration

Conversation

@simo5

@simo5 simo5 commented Aug 7, 2026

Copy link
Copy Markdown
Collaborator

Description

Refactor the central operations registration process and split each operation registration into its own operation file.

Additionally fix a locking issue that came up from a Gemini review, and add missing decoders for PQC key types.

Fixes #759

Checklist

  • Code modified for feature
  • Test suite updated with functionality tests
  • Test suite updated with negative tests
  • Documentation updated

Reviewer's checklist:

  • Any issues marked for closing are addressed
  • There is a test suite reasonably covering new functionality or modifications
  • This feature/change has adequate documentation added
  • Code conform to coding style that today cannot yet be enforced via the check style test
  • Commits have short titles and sensible commit messages

@simo5
simo5 requested a review from Jakuje August 7, 2026 22:36
@simo5
simo5 force-pushed the split_registration branch from d4e5018 to c79e526 Compare August 7, 2026 22:36
simo5 added 3 commits August 7, 2026 18:53
Move the algorithm registration logic from a single, large switch statement in
`provider.c` to individual module files (ciphers, digests, signatures, etc.).
A new `registration.c` file is introduced to map PKCS#11 mechanisms to
internal table IDs, allowing each module to independently evaluate and
register its supported algorithms.

This significantly improves code maintainability, decouples algorithm
implementations from the core provider initialization, and makes adding future
algorithms much cleaner.

Assisted-by: Gemini:Gemini Pro Latest
Signed-off-by: Simo Sorce <simo@redhat.com>
Move the initialization mutex from the module context to the provider context
and introduce a new `P11PROV_OPS_NEEDS_INIT` state.

By handling the lock at the context level, both module and operations
initialization are now executed within a single locked section. This reduces
lock toggling, optimizes initialization, and prevents race conditions when
multiple threads attempt to initialize the provider simultaneously.

Assisted-by: Gemini:Gemini Pro Latest
Signed-off-by: Simo Sorce <simo@redhat.com>
Register DER decoders for post-quantum algorithms including ML-DSA, ML-KEM,
and SLH-DSA variants. This enables the PKCS#11 provider to properly decode and
load these keys.

Additionally, add tests for ML-DSA, ML-KEM, and SLH-DSA to `tpem_encoder` to
verify their PEM encoding and decoding functionality.
@simo5
simo5 force-pushed the split_registration branch from c79e526 to f60231f Compare August 7, 2026 22:53
@simo5

simo5 commented Aug 7, 2026

Copy link
Copy Markdown
Collaborator Author

@Jakuje sorry for the huge PR, but in my defense, you opened the bug and asked for it :-D

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Split algorithm encoder/decoder registration to mechanism-specific files

1 participant