FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

quic: update the guard to check openssl version · nodejs/node@b2b0bf8 · GitHub

/ node Public

Commit b2b0bf8

Browse files
jasnell
authored and
aduh95
committed
quic: update the guard to check openssl version
Since we need to be able to use the openssl adapter provided by the ngtcp2 library, and because that adapter does not include any compile guards to ensure that OpenSSL 3.5 is being used and that the APIs are actually available, we need to add a compile time check for the openssl version in order to conditionally include the adapter to avoid build errors when using a shared openssl library that is not OpenSSL 3.5. Signed-off-by: James M Snell <jasnell@gmail.com> PR-URL: #59249 Reviewed-By: Matteo Collina <matteo.collina@gmail.com>
1 parent e073b38 commit b2b0bf8

3 files changed

Lines changed: 92 additions & 10 deletions

File tree

‎configure.py‎

Lines changed: 61 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1308,6 +1308,65 @@ def get_gas_version(cc):
13081308
warn(f'Could not recognize `gas`: {gas_ret}')
13091309
return '0.0'
13101310

1311+
def get_openssl_version():
1312+
"""Parse OpenSSL version from opensslv.h header file.
1313+
1314+
Returns the version as a number matching OPENSSL_VERSION_NUMBER format:
1315+
0xMNN00PPSL where M=major, NN=minor, PP=patch, S=status(0xf=release,0x0=pre), L=0
1316+
"""
1317+
1318+
try:
1319+
# Use the C compiler to extract preprocessor macros from opensslv.h
1320+
args = ['-E', '-dM', '-include', 'openssl/opensslv.h', '-']
1321+
if not options.shared_openssl:
1322+
args = ['-I', 'deps/openssl/openssl/include'] + args
1323+
elif options.shared_openssl_includes:
1324+
args = ['-I', options.shared_openssl_includes] + args
1325+
1326+
proc = subprocess.Popen(
1327+
shlex.split(CC) + args,
1328+
stdin=subprocess.PIPE,
1329+
stdout=subprocess.PIPE,
1330+
stderr=subprocess.PIPE
1331+
)
1332+
with proc:
1333+
proc.stdin.write(b'\n')
1334+
out = to_utf8(proc.communicate()[0])
1335+
1336+
if proc.returncode != 0:
1337+
warn('Failed to extract OpenSSL version from opensslv.h header')
1338+
return 0
1339+
1340+
# Parse the macro definitions
1341+
macros = {}
1342+
for line in out.split('\n'):
1343+
if line.startswith('#define OPENSSL_VERSION_'):
1344+
parts = line.split()
1345+
if len(parts) >= 3:
1346+
macro_name = parts[1]
1347+
macro_value = parts[2]
1348+
macros[macro_name] = macro_value
1349+
1350+
# Extract version components
1351+
major = int(macros.get('OPENSSL_VERSION_MAJOR', '0'))
1352+
minor = int(macros.get('OPENSSL_VERSION_MINOR', '0'))
1353+
patch = int(macros.get('OPENSSL_VERSION_PATCH', '0'))
1354+
1355+
# Check if it's a pre-release (has non-empty PRE_RELEASE string)
1356+
pre_release = macros.get('OPENSSL_VERSION_PRE_RELEASE', '""').strip('"')
1357+
status = 0x0 if pre_release else 0xf
1358+
# Construct version number: 0xMNN00PPSL
1359+
version_number = ((major << 28) |
1360+
(minor << 20) |
1361+
(patch << 4) |
1362+
status)
1363+
1364+
return version_number
1365+
1366+
except (OSError, ValueError, subprocess.SubprocessError) as e:
1367+
warn(f'Failed to determine OpenSSL version from header: {e}')
1368+
return 0
1369+
13111370
# Note: Apple clang self-reports as clang 4.2.0 and gcc 4.2.1. It passes
13121371
# the version check more by accident than anything else but a more rigorous
13131372
# check involves checking the build number against an allowlist. I'm not
@@ -1948,6 +2007,8 @@ def without_ssl_error(option):
19482007
if options.quic:
19492008
o['defines'] += ['NODE_OPENSSL_HAS_QUIC']
19502009

2010+
o['variables']['openssl_version'] = get_openssl_version()
2011+
19512012
configure_library('openssl', o)
19522013

19532014
def configure_sqlite(o):

‎deps/ngtcp2/ngtcp2.gyp‎

Lines changed: 30 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -129,6 +129,36 @@
129129
'HAVE_NETINET_IN_H',
130130
],
131131
}],
132+
# TODO: Support OpenSSL 3.5 shared library builds.
133+
# The complexity here is that we need to use the ngtcp2 ossl
134+
# adapter, which does not include any conditional checks to
135+
# see if the version of OpenSSL used has the necessary QUIC
136+
# APIs, so we need to ensure that we conditionally enable use
137+
# of the adapter only when we know that the OpenSSL version we
138+
# are compiling against has the necessary APIs. We can do that
139+
# by checkig the OpenSSL version number but, currently, the
140+
# code that does so checks only the VERSION.dat file that is
141+
# bundled with the openssl dependency. We'll need to update
142+
# that to support the shared library case, where the version
143+
# of the shared library needs to be determined.
144+
#
145+
# TODO: Support Boringssl here also. ngtcp2 provides an adapter
146+
# for Boringssl. If we can detect that boringssl is being used
147+
# here then we can use that adapter and also set the
148+
# QUIC_NGTCP2_USE_BORINGSSL define (the guard in quic/guard.h
149+
# would need to be updated to check for this define).
150+
['node_shared_openssl=="false" and openssl_version >= 0x3050001f', {
151+
'sources': [
152+
'<@(ngtcp2_sources_ossl)',
153+
],
154+
'direct_dependent_settings': {
155+
'defines': [
156+
# Tells us that we are using the OpenSSL 3.5 adapter
157+
# that is provided by ngtcp2.
158+
'QUIC_NGTCP2_USE_OPENSSL_3_5',
159+
],
160+
},
161+
}]
132162
],
133163
'direct_dependent_settings': {
134164
'defines': [
@@ -143,7 +173,6 @@
143173
},
144174
'sources': [
145175
'<@(ngtcp2_sources)',
146-
'<@(ngtcp2_sources_ossl)',
147176
]
148177
},
149178
{

‎src/quic/guard.h‎

Lines changed: 1 addition & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,5 @@
11
#pragma once
22

3-
#if HAVE_OPENSSL
4-
#include <openssl/opensslv.h>
5-
// QUIC is only available in Openssl 3.5.x and later. It was not introduced in
6-
// Node.js until 3.5.1... prior to that we will not compile any of the QUIC
7-
// related code.
8-
#if OPENSSL_VERSION_NUMBER < 0x30500010 || OPENSSL_IS_BORINGSSL
9-
#define OPENSSL_NO_QUIC = 1
10-
#endif
11-
#else
3+
#ifndef QUIC_NGTCP2_USE_OPENSSL_3_5
124
#define OPENSSL_NO_QUIC = 1
135
#endif

0 commit comments

Comments
 (0)
Back | FazBrowse Home | New Git URL