OSSL_LIB_CTX_freeze: Freeze multiple propq inputs

[npajkovsky]

@paulidale has suggested:

I'd abrogate this decision to the calling application and allow multiple propq inputs. An application could then freeze "fips='yes'", "?fips='yes'" and "fips='no'". This is a case which I think would be used. Certainly, the cases of "fips='yes'" and "?fips='yes'" will be widely used if available. Multiple query strings can be resolved either using a hash table or a TRIE (which is generally faster).

It should be up to the user what propq wishes to freeze for the given context.

[bob-beck]

while a possibility? I don't think this is really the normal case for this.

Remember this is a thing for a very specific kind of code that can not / will not easily refactor itself to pass around a CTX with the EVP stuff already initialized so it does not need to fetch it.

Such things are designed from before the days of OpenSSL 3, and in a nutshell, do not do such things, becuase they
were never a consideration before then anyway.

If someone wants complicated propq logic, realistically they will write their code for the OpenSSL 3.0+ way of doing things
and they will not need freeze.

[paulidale]

I strongly disagree. It's not just difficult to refactor code. People do not rewrite their code to do the 3.0 way. They make the minimal changes necessary to get it working again and move on.

Remember this is a thing for a very specific kind of code that can not / will not easily refactor itself to pass around a CTX with the EVP stuff already initialized so it does not need to fetch it.

Could you please point me to this justification in the design document? I don't remember seeing it.

Since the design already calls for two cached property queries, extending it to more ought to be straightforward. If not, it's probably a bad design.

[paulidale]

In my suggestion, I mentioned threading. Ignore that part. I think it better that all queries should be specified up front before threads are created. Too much flexibility is the source of many of the current problems and was a mistake in the 3.0 design.