CRYPTO_THREAD_RUN_ONCE(3ossl)

📦

version 3.5.9 · 8 versions

3.5.9 · fedora 43, fedora 44 (latest)
3.5.9 · centos-stream 9
3.5.9 · centos-stream 10
3.5.9 · alpine 3.22
3.5.9 · alpine 3.23, alpine 3.24
3.5.8 · fedora 43
3.5.1 · fedora 43
3.5.5 · fedora 44

🌸 NAME 🌸

okay bestie, gather round, this is CRYPTO_THREAD_RUN_ONCE from the 3ossl manual, and it's literally the whole OpenSSL thread support saga: CRYPTO_THREAD_run_once, CRYPTO_THREAD_lock_new, CRYPTO_THREAD_read_lock, CRYPTO_THREAD_write_lock, CRYPTO_THREAD_unlock, CRYPTO_THREAD_lock_free, CRYPTO_atomic_add, CRYPTO_atomic_add64, CRYPTO_atomic_and, CRYPTO_atomic_or, CRYPTO_atomic_load, CRYPTO_atomic_store, CRYPTO_atomic_load_int, OSSL_set_max_threads, OSSL_get_max_threads, OSSL_get_thread_support_flags, OSSL_THREAD_SUPPORT_FLAG_THREAD_POOL, and OSSL_THREAD_SUPPORT_FLAG_DEFAULT_SPAWN. That's the roster. Iconic lineup fr fr. 👑

✨ SYNOPSIS ✨

#include <openssl/crypto.h>

CRYPTO_ONCE CRYPTO_ONCE_STATIC_INIT;
int CRYPTO_THREAD_run_once(CRYPTO_ONCE *once, void (*init)(void));

CRYPTO_RWLOCK *CRYPTO_THREAD_lock_new(void);
int CRYPTO_THREAD_read_lock(CRYPTO_RWLOCK *lock);
int CRYPTO_THREAD_write_lock(CRYPTO_RWLOCK *lock);
int CRYPTO_THREAD_unlock(CRYPTO_RWLOCK *lock);
void CRYPTO_THREAD_lock_free(CRYPTO_RWLOCK *lock);

int CRYPTO_atomic_add(int *val, int amount, int *ret, CRYPTO_RWLOCK *lock);
int CRYPTO_atomic_add64(uint64_t *val, uint64_t op, uint64_t *ret,
                        CRYPTO_RWLOCK *lock);
int CRYPTO_atomic_and(uint64_t *val, uint64_t op, uint64_t *ret,
                      CRYPTO_RWLOCK *lock);
int CRYPTO_atomic_or(uint64_t *val, uint64_t op, uint64_t *ret,
                     CRYPTO_RWLOCK *lock);
int CRYPTO_atomic_load(uint64_t *val, uint64_t *ret, CRYPTO_RWLOCK *lock);
int CRYPTO_atomic_store(uint64_t *dst, uint64_t val, CRYPTO_RWLOCK *lock);
int CRYPTO_atomic_load_int(int *val, int *ret, CRYPTO_RWLOCK *lock);

int OSSL_set_max_threads(OSSL_LIB_CTX *ctx, uint64_t max_threads);
uint64_t OSSL_get_max_threads(OSSL_LIB_CTX *ctx);
uint32_t OSSL_get_thread_support_flags(void);

#define OSSL_THREAD_SUPPORT_FLAG_THREAD_POOL
#define OSSL_THREAD_SUPPORT_FLAG_DEFAULT_SPAWN

💅 DESCRIPTION 💅

so here's the tea: OpenSSL can be used safely in multi-threaded applications, but only if support for the underlying OS threading API is built in. Right now OpenSSL vibes with pthread and Windows APIs. It can also be built with absolutely zero multi-threading support — like, imagine — for platforms that don't provide any threading support, or that provide a threading API OpenSSL hasn't caught up with yet. 🙈

These are the multi-threading functions it hands you:

CRYPTO_THREAD_run_once() — your one-time initialization moment. The once argument has to be a pointer to a static object of type CRYPTO_ONCE that was statically initialized to the value CRYPTO_ONCE_STATIC_INIT. The init argument is a pointer to a function that does the desired exactly-once initialization. Specifically, this is how you allocate locks in a thread-safe way, which you can then use with the locking functions down below. ✨
CRYPTO_THREAD_lock_new() — allocates, initializes, and returns a brand-new read/write lock.
CRYPTO_THREAD_read_lock() — locks the lock you gave it, for reading.
CRYPTO_THREAD_write_lock() — locks the lock you gave it, for writing.
CRYPTO_THREAD_unlock() — unlocks a lock that was previously locked.
CRYPTO_THREAD_lock_free() — frees the lock you gave it. If the argument is NULL, nothing happens, no drama. 🫶
CRYPTO_atomic_add() — atomically adds amount to *val and returns the result of the operation in *ret. lock will be locked, unless atomic operations are supported on that specific platform. Because of that, if a variable gets modified by CRYPTO_atomic_add() then CRYPTO_atomic_add() must be the only way that variable is modified. And if atomic operations aren't supported and lock is NULL, the function will fail. 💀
CRYPTO_atomic_add64() — atomically adds op to *val and returns the result of the operation in *ret. lock will be locked, unless atomic operations are supported on that specific platform. Because of that, if a variable gets modified by CRYPTO_atomic_add64() then CRYPTO_atomic_add64() must be the only way that variable is modified. If atomic operations aren't supported and lock is NULL, the function will fail.
CRYPTO_atomic_and() — does an atomic bitwise and of op and *val and stores the result back in *val. It also returns the result of the operation in *ret. lock will be locked, unless atomic operations are supported on that specific platform. Because of that, if a variable is modified by CRYPTO_atomic_and() or read by CRYPTO_atomic_load() then CRYPTO_atomic_and() must be the only way that variable is modified. If atomic operations aren't supported and lock is NULL, the function will fail.
CRYPTO_atomic_or() — does an atomic bitwise or of op and *val and stores the result back in *val. It also returns the result of the operation in *ret. lock will be locked, unless atomic operations are supported on that specific platform. Because of that, if a variable is modified by CRYPTO_atomic_or() or read by CRYPTO_atomic_load() then CRYPTO_atomic_or() must be the only way that variable is modified. If atomic operations aren't supported and lock is NULL, the function will fail.
CRYPTO_atomic_load() — atomically loads the contents of *val into *ret. lock will be locked, unless atomic operations are supported on that specific platform. Because of that, if a variable is modified by CRYPTO_atomic_or() or read by CRYPTO_atomic_load() then CRYPTO_atomic_load() must be the only way that variable is read. If atomic operations aren't supported and lock is NULL, the function will fail.
CRYPTO_atomic_store() — atomically stores the contents of val into *dst. lock will be locked, unless atomic operations are supported on that specific platform.
CRYPTO_atomic_load_int() — works identically to CRYPTO_atomic_load() but operates on an int value instead of a uint64_t value.
OSSL_set_max_threads() — sets the maximum number of threads the thread pool is allowed to use. If the argument is 0, thread pooling is disabled. OpenSSL won't create any threads, and existing threads in the thread pool get torn down. The maximum thread count is a limit, not a target — threads will not be spawned unless (and until) there's demand. Thread polling is disabled by default. To enable threading you have to call OSSL_set_max_threads() explicitly. Under no circumstances is this done for you. 👑
OSSL_get_thread_support_flags() — figures out what thread pool functionality OpenSSL was compiled with and can actually support in the current run-time environment. OSSL_THREAD_SUPPORT_FLAG_THREAD_POOL means the base thread pool functionality is available, and OSSL_THREAD_SUPPORT_FLAG_DEFAULT_SPAWN means the default thread pool model is available. The default thread pool model is currently the only model available, so both of these flags have to be set for thread pool functionality to be used.

🦋 RETURN VALUES 🦋

CRYPTO_THREAD_run_once() returns 1 on success, or 0 on error.
CRYPTO_THREAD_lock_new() returns the allocated lock, or NULL on error.
CRYPTO_THREAD_lock_free() returns no value. (it's giving void 💅)
OSSL_set_max_threads() returns 1 on success and 0 on failure. It returns failure if OpenSSL-managed thread pooling isn't supported — for example, if it's not supported on the current platform, or because OpenSSL wasn't built with the necessary support.
OSSL_get_max_threads() returns the maximum number of threads currently allowed to be used by the thread pool. If thread pooling is disabled or not available, it returns 0.
OSSL_get_thread_support_flags() returns zero or more OSSL_THREAD_SUPPORT_FLAG values.
The other functions return 1 on success, or 0 on error.

🎀 NOTES 🎀

On Windows platforms, the CRYPTO_THREAD_* types and functions in the <openssl/crypto.h> header depend on some of the types customarily made available by including <windows.h>. The application developer is likely to want control over when that header gets included, commonly as one of the first included headers. So: it's defined as an application developer's responsibility to include <windows.h> prior to <openssl/crypto.h> wherever use of CRYPTO_THREAD_* types and functions is required. no cap, that one's on you bestie 😭

🌈 EXAMPLES 🌈

You can find out if OpenSSL was configured with thread support:

#include <openssl/opensslconf.h>
#if defined(OPENSSL_THREADS)
    /* thread support enabled */
#else
    /* no thread support */
#endif

This example safely initializes and uses a lock.

#ifdef _WIN32
# include <windows.h>
#endif
#include <openssl/crypto.h>

static CRYPTO_ONCE once = CRYPTO_ONCE_STATIC_INIT;
static CRYPTO_RWLOCK *lock;

static void myinit(void)
{
    lock = CRYPTO_THREAD_lock_new();
}

static int mylock(void)
{
    if (!CRYPTO_THREAD_run_once(&once, void init) || lock == NULL)
        return 0;
    return CRYPTO_THREAD_write_lock(lock);
}

static int myunlock(void)
{
    return CRYPTO_THREAD_unlock(lock);
}

int serialized(void)
{
    int ret = 0;

    if (!mylock()) {
       /* Do not unlock unless the lock was successfully acquired. */
       return 0;
    }

    /* Your code here, do not return without releasing the lock! */
    ret = ... ;
    myunlock();
    return ret;
}

Finalization of locks is an advanced topic, not covered in this example. It can only be done at process exit, or when a dynamically loaded library is no longer in use and gets unloaded. The simplest solution is to just "leak" the lock in applications and not repeatedly load/unload shared libraries that allocate locks. 🫶

⚠️ also pls note: do not return without releasing the lock! That comment in the example is not a suggestion, it's a whole warning.

💜 SEE ALSO 💜

crypto(7), openssl-threads(7).

⭐ HISTORY ⭐

CRYPTO_atomic_load_int(), OSSL_set_max_threads(), OSSL_get_max_threads(), OSSL_get_thread_support_flags() were added in OpenSSL 3.2. ✨

CRYPTO_atomic_store(), CRYPTO_atomic_add64(), CRYPTO_atomic_and() were added in OpenSSL 3.4. ✨

👑 COPYRIGHT 👑

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

okay that's the whole page bestie, you ate it up fr fr 💖 this was the CRYPTO_THREAD_RUN_ONCE(3ossl) manual from OpenSSL 3.5.9, dated 2026-09-29 — go forth and lock responsibly, mwah 🎀✨🦋

📦 where this page comes from

fedora 43: openssl-devel 1:3.5.9-1.fc43 · Apache-2.0
fedora 43: openssl-devel 1:3.5.9-1.fc43 · Apache-2.0
fedora 44: openssl-devel 1:3.5.9-1.fc44 · Apache-2.0
fedora 44: openssl-devel 1:3.5.9-1.fc44 · Apache-2.0
💖 girlified by deepseek-ai/DeepSeek-V4.1-Flash on 2026-10-14: a language model's rewrite of the original, under its terms