s2n changing OpenSSL engine globally

[eliasdaler]

Describe the bug

Hello.
We're integrating the AWS SDK into our existing code base and noticed that RAND_poll started failing (returning 1) after Aws::InitAPI is called.
E.g.:

Aws::InitAPI(options);
printf("RAND_poll after InitAPI: %d\n", RAND_poll()); // 0, failure (returns 1 otherwise if InitAPI is not called)

After further investigation, I noticed that s2n was setting a custom random engine (here) which doesn't support "add" method which is why RAND_poll started failing: see the following line.

Is is possible to somehow stop s2n from doing replacing the global engine?

The only way options I see right now is to either use OpenSSL-FIPS (not an option for us, unfortunately) or disable the s2n usage completely. However, I've found that NO_ENCRYPTION/BYO_CRYPTO seems to be broken and I don't see any other way of disabling this behaviour.

Any further help will be appreciated.

Regression Issue

• Select this option if this issue appears to be a regression.

Expected Behavior

I expect aws-sdk-cpp to not change the OpenSSL engine globally.

Current Behavior

See the description above.

Reproduction Steps

#include <cstdio>
#include <aws/core/Aws.h>
#include <openssl/rand.h>

int main(int argc, char **argv) {
    Aws::SDKOptions options;
    options.loggingOptions.logLevel = Aws::Utils::Logging::LogLevel::Trace;

    printf("RAND_poll before InitAPI: %d\n", RAND_poll()); // 1 (success)
    Aws::InitAPI(options);
    printf("RAND_poll after InitAPI: %d\n", RAND_poll()); // 0 (failure)
}

Possible Solution

No response

Additional Information/Context

No response

AWS CPP SDK version used

1.11.490

Compiler and Version used

gcc (Ubuntu 11.4.0-1ubuntu1~22.04) 11.4.0

Operating System and version

Ubuntu 22.04

[sbiscigl]

Hey @eliasdaler ,

First and foremost thank you so much for the detailed investigation it really makes things a lot easier for us to action on.

Spoke with s2n about this and it looks like we are going to work to provide an option to disable replacing the rand engine. I cant say exactly when we will have it available but we are working at implementing it, will give you a update as we close to merging it.