FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

crypto: split OpenSSL 3, BoringSSL, and legacy backends · nodejs/node@195f103 · GitHub

/ node Public

Commit 195f103

Browse files
panva
authored and
aduh95
committed
crypto: split OpenSSL 3, BoringSSL, and legacy backends
This separates the native crypto backend paths for OpenSSL >= 3, BoringSSL, and legacy OpenSSL. The OpenSSL >= 3 path now builds with `OPENSSL_API_COMPAT=30000` and `OPENSSL_NO_DEPRECATED`, moving normal crypto/TLS code away from APIs that OpenSSL 3.0.0 marks deprecated. BoringSSL remains on its own branch, and OpenSSL < 3 remains the legacy fallback. The exception is ENGINE support. ENGINE APIs are isolated into a dedicated compatibility target so they can remain available while the JS-facing engine APIs are runtime-deprecated in 27.x. That gives us a clear removal point for 28.x, without letting ENGINE usage leak back into the strict OpenSSL 3 path. The split also makes the eventual OpenSSL 1.1.1 removal easier to reason about. Once support for OpenSSL < 3 is dropped, the legacy branch can be removed in a focused follow-up, possibly targeting 27.x, instead of untangling mixed version guards throughout the crypto implementation. No public crypto or TLS API behavior is intentionally changed. Assisted-by: Codex:gpt-5 Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: #64211 Refs: #56733 Reviewed-By: Matteo Collina <matteo.collina@gmail.com> Reviewed-By: Richard Lau <richard.lau@ibm.com> Reviewed-By: James M Snell <jasnell@gmail.com>
1 parent d2c8acd commit 195f103

23 files changed

Lines changed: 2454 additions & 204 deletions

‎common.gypi‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@
2424
'node_module_version%': '',
2525
'node_with_ltcg%': '',
2626
'node_shared_openssl%': 'false',
27+
'openssl_is_boringssl%': 'false',
2728

2829
'node_tag%': '',
2930
'uv_library%': 'static_library',

‎configure.py‎

Lines changed: 51 additions & 33 deletions
Original file line numberDiff line numberDiff line change
@@ -1434,6 +1434,48 @@ def get_gas_version(cc):
14341434
warn(f'Could not recognize `gas`: {gas_ret}')
14351435
return '0.0'
14361436

1437+
def get_openssl_macros(o):
1438+
"""Extract OpenSSL preprocessor macros from the configured headers."""
1439+
1440+
# Use the C compiler to extract preprocessor macros from OpenSSL headers.
1441+
# crypto.h is included because BoringSSL declares OPENSSL_IS_BORINGSSL there.
1442+
args = ['-E', '-dM',
1443+
'-include', 'openssl/opensslv.h',
1444+
'-include', 'openssl/crypto.h',
1445+
'-']
1446+
if not options.shared_openssl:
1447+
args = ['-I', 'deps/openssl/openssl/include'] + args
1448+
elif options.shared_openssl_includes:
1449+
args = ['-I', options.shared_openssl_includes] + args
1450+
else:
1451+
for dir in o['include_dirs']:
1452+
args = ['-I', dir] + args
1453+
1454+
proc = subprocess.Popen(
1455+
shlex.split(CC) + args,
1456+
stdin=subprocess.PIPE,
1457+
stdout=subprocess.PIPE,
1458+
stderr=subprocess.PIPE
1459+
)
1460+
with proc:
1461+
proc.stdin.write(b'\n')
1462+
out = to_utf8(proc.communicate()[0])
1463+
1464+
if proc.returncode != 0:
1465+
warn('Failed to extract OpenSSL macros from headers')
1466+
return {}
1467+
1468+
macros = {}
1469+
for line in out.split('\n'):
1470+
if line.startswith('#define OPENSSL_'):
1471+
parts = line.split()
1472+
if len(parts) >= 2:
1473+
macro_name = parts[1]
1474+
macro_value = parts[2] if len(parts) >= 3 else '1'
1475+
macros[macro_name] = macro_value
1476+
1477+
return macros
1478+
14371479
def get_openssl_version(o):
14381480
"""Parse OpenSSL version from opensslv.h header file.
14391481
@@ -1443,39 +1485,7 @@ def get_openssl_version(o):
14431485
"""
14441486

14451487
try:
1446-
# Use the C compiler to extract preprocessor macros from opensslv.h
1447-
args = ['-E', '-dM', '-include', 'openssl/opensslv.h', '-']
1448-
if not options.shared_openssl:
1449-
args = ['-I', 'deps/openssl/openssl/include'] + args
1450-
elif options.shared_openssl_includes:
1451-
args = ['-I', options.shared_openssl_includes] + args
1452-
else:
1453-
for dir in o['include_dirs']:
1454-
args = ['-I', dir] + args
1455-
1456-
proc = subprocess.Popen(
1457-
shlex.split(CC) + args,
1458-
stdin=subprocess.PIPE,
1459-
stdout=subprocess.PIPE,
1460-
stderr=subprocess.PIPE
1461-
)
1462-
with proc:
1463-
proc.stdin.write(b'\n')
1464-
out = to_utf8(proc.communicate()[0])
1465-
1466-
if proc.returncode != 0:
1467-
warn('Failed to extract OpenSSL version from opensslv.h header')
1468-
return 0
1469-
1470-
# Parse the macro definitions
1471-
macros = {}
1472-
for line in out.split('\n'):
1473-
if line.startswith('#define OPENSSL_VERSION_'):
1474-
parts = line.split()
1475-
if len(parts) >= 3:
1476-
macro_name = parts[1]
1477-
macro_value = parts[2]
1478-
macros[macro_name] = macro_value
1488+
macros = get_openssl_macros(o)
14791489

14801490
# Extract version components
14811491
major = int(macros.get('OPENSSL_VERSION_MAJOR', '0'))
@@ -1505,6 +1515,13 @@ def get_openssl_version(o):
15051515
warn(f'Failed to determine OpenSSL version from header: {e}')
15061516
return 0
15071517

1518+
def get_openssl_is_boringssl(o):
1519+
try:
1520+
return b('OPENSSL_IS_BORINGSSL' in get_openssl_macros(o))
1521+
except (OSError, ValueError, subprocess.SubprocessError) as e:
1522+
warn(f'Failed to determine whether OpenSSL headers are BoringSSL: {e}')
1523+
return 'false'
1524+
15081525
def get_cargo_version(cargo):
15091526
try:
15101527
proc = subprocess.Popen(shlex.split(cargo) + ['--version'],
@@ -2309,6 +2326,7 @@ def without_ssl_error(option):
23092326
configure_library('openssl', o)
23102327

23112328
o['variables']['openssl_version'] = get_openssl_version(o)
2329+
o['variables']['openssl_is_boringssl'] = get_openssl_is_boringssl(o)
23122330

23132331
def configure_lief(o):
23142332
if options.without_lief:

‎deps/ncrypto/engine.cc‎

Lines changed: 25 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,18 @@
11
#include "ncrypto.h"
22

3+
#if !defined(OPENSSL_NO_ENGINE) && \
4+
((defined(NCRYPTO_ENGINE_COMPAT) && NCRYPTO_ENGINE_COMPAT) || \
5+
NCRYPTO_USE_LEGACY_OPENSSL)
6+
#include <openssl/engine.h>
7+
#endif
8+
39
namespace ncrypto {
410

511
// ============================================================================
612
// Engine
713

814
#ifndef OPENSSL_NO_ENGINE
9-
EnginePointer::EnginePointer(ENGINE* engine_, bool finish_on_exit_)
15+
EnginePointer::EnginePointer(void* engine_, bool finish_on_exit_)
1016
: engine(engine_), finish_on_exit(finish_on_exit_) {}
1117

1218
EnginePointer::EnginePointer(EnginePointer&& other) noexcept
@@ -24,21 +30,22 @@ EnginePointer& EnginePointer::operator=(EnginePointer&& other) noexcept {
2430
return *new (this) EnginePointer(std::move(other));
2531
}
2632

27-
void EnginePointer::reset(ENGINE* engine_, bool finish_on_exit_) {
33+
void EnginePointer::reset(void* engine_, bool finish_on_exit_) {
2834
if (engine != nullptr) {
35+
ENGINE* current = static_cast<ENGINE*>(engine);
2936
if (finish_on_exit) {
3037
// This also does the equivalent of ENGINE_free.
31-
ENGINE_finish(engine);
38+
ENGINE_finish(current);
3239
} else {
33-
ENGINE_free(engine);
40+
ENGINE_free(current);
3441
}
3542
}
3643
engine = engine_;
3744
finish_on_exit = finish_on_exit_;
3845
}
3946

40-
ENGINE* EnginePointer::release() {
41-
ENGINE* ret = engine;
47+
void* EnginePointer::release() {
48+
void* ret = engine;
4249
engine = nullptr;
4350
finish_on_exit = false;
4451
return ret;
@@ -52,8 +59,9 @@ EnginePointer EnginePointer::getEngineByName(const char* name,
5259
// Engine not found, try loading dynamically.
5360
engine = EnginePointer(ENGINE_by_id("dynamic"));
5461
if (engine) {
55-
if (!ENGINE_ctrl_cmd_string(engine.get(), "SO_PATH", name, 0) ||
56-
!ENGINE_ctrl_cmd_string(engine.get(), "LOAD", nullptr, 0)) {
62+
ENGINE* current = static_cast<ENGINE*>(engine.engine);
63+
if (!ENGINE_ctrl_cmd_string(current, "SO_PATH", name, 0) ||
64+
!ENGINE_ctrl_cmd_string(current, "LOAD", nullptr, 0)) {
5765
engine.reset();
5866
}
5967
}
@@ -64,19 +72,24 @@ EnginePointer EnginePointer::getEngineByName(const char* name,
6472
bool EnginePointer::setAsDefault(uint32_t flags, CryptoErrorList* errors) {
6573
if (engine == nullptr) return false;
6674
ClearErrorOnReturn clear_error_on_return(errors);
67-
return ENGINE_set_default(engine, flags) != 0;
75+
return ENGINE_set_default(static_cast<ENGINE*>(engine), flags) != 0;
6876
}
6977

7078
bool EnginePointer::init(bool finish_on_exit) {
7179
if (engine == nullptr) return false;
7280
if (finish_on_exit) setFinishOnExit();
73-
return ENGINE_init(engine) == 1;
81+
return ENGINE_init(static_cast<ENGINE*>(engine)) == 1;
7482
}
7583

7684
EVPKeyPointer EnginePointer::loadPrivateKey(const char* key_name) {
7785
if (engine == nullptr) return EVPKeyPointer();
78-
return EVPKeyPointer(
79-
ENGINE_load_private_key(engine, key_name, nullptr, nullptr));
86+
return EVPKeyPointer(ENGINE_load_private_key(
87+
static_cast<ENGINE*>(engine), key_name, nullptr, nullptr));
88+
}
89+
90+
bool EnginePointer::setClientCertEngine(SSL_CTX* ctx) {
91+
if (engine == nullptr || ctx == nullptr) return false;
92+
return SSL_CTX_set_client_cert_engine(ctx, static_cast<ENGINE*>(engine)) == 1;
8093
}
8194

8295
void EnginePointer::initEnginesOnce() {

0 commit comments

Comments
 (0)
Back | FazBrowse Home | New Git URL