Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly
Appearance settings

Commit 677ca7e

Browse filesBrowse files
panvasxa
panva
authored and
sxa
committed
src: simplify OpenSSL feature gates
Add OPENSSL_WITH_* feature macros for crypto capabilities that vary by OpenSSL version and use those instead of repeating version checks. Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: nodejs#63255 Backport-PR-URL: nodejs#63563 Refs: electron/electron#36256 Refs: electron/electron#41720 Refs: electron/electron#51127 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
1 parent c863c75 commit 677ca7e
Copy full SHA for 677ca7e

13 files changed

+91-48Lines changed: 91 additions & 48 deletions
Expand file treeCollapse file tree
Open diff view settings
Collapse file

‎deps/ncrypto/ncrypto.cc‎

Copy file name to clipboardExpand all lines: deps/ncrypto/ncrypto.cc
+10-12Lines changed: 10 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@
2020
#include <openssl/core_names.h>
2121
#include <openssl/params.h>
2222
#include <openssl/provider.h>
23-
#if OPENSSL_VERSION_NUMBER >= 0x30200000L
23+
#if OPENSSL_WITH_ARGON2
2424
#include <openssl/thread.h>
2525
#endif
2626
#endif
@@ -1955,8 +1955,7 @@ DataPointer pbkdf2(const Digest& md,
19551955
return {};
19561956
}
19571957

1958-
#if OPENSSL_VERSION_NUMBER >= 0x30200000L
1959-
#ifndef OPENSSL_NO_ARGON2
1958+
#if OPENSSL_WITH_ARGON2
19601959
DataPointer argon2(const Buffer<const char>& pass,
19611960
const Buffer<const unsigned char>& salt,
19621961
uint32_t lanes,
@@ -2049,7 +2048,6 @@ DataPointer argon2(const Buffer<const char>& pass,
20492048
return {};
20502049
}
20512050
#endif
2052-
#endif
20532051

20542052
// ============================================================================
20552053

@@ -4614,7 +4612,7 @@ HMACCtxPointer HMACCtxPointer::New() {
46144612
return HMACCtxPointer(HMAC_CTX_new());
46154613
}
46164614

4617-
#if OPENSSL_VERSION_MAJOR >= 3
4615+
#if OPENSSL_WITH_KMAC
46184616
EVPMacPointer::EVPMacPointer(EVP_MAC* mac) : mac_(mac) {}
46194617

46204618
EVPMacPointer::EVPMacPointer(EVPMacPointer&& other) noexcept
@@ -4702,7 +4700,7 @@ EVPMacCtxPointer EVPMacCtxPointer::New(EVP_MAC* mac) {
47024700
if (!mac) return EVPMacCtxPointer();
47034701
return EVPMacCtxPointer(EVP_MAC_CTX_new(mac));
47044702
}
4705-
#endif // OPENSSL_VERSION_MAJOR >= 3
4703+
#endif // OPENSSL_WITH_KMAC
47064704

47074705
DataPointer hashDigest(const Buffer<const unsigned char>& buf,
47084706
const EVP_MD* md) {
@@ -4849,16 +4847,16 @@ const Digest Digest::FromName(const char* name) {
48494847

48504848
// ============================================================================
48514849
// KEM Implementation
4852-
#if OPENSSL_VERSION_MAJOR >= 3
4853-
#if !OPENSSL_VERSION_PREREQ(3, 5)
4850+
#if OPENSSL_WITH_KEM
4851+
#if OPENSSL_WITH_KEM_OPERATION_PARAM
48544852
bool KEM::SetOperationParameter(EVP_PKEY_CTX* ctx, const EVPKeyPointer& key) {
48554853
const char* operation = nullptr;
48564854

48574855
switch (EVP_PKEY_id(key.get())) {
48584856
case EVP_PKEY_RSA:
48594857
operation = OSSL_KEM_PARAM_OPERATION_RSASVE;
48604858
break;
4861-
#if OPENSSL_VERSION_PREREQ(3, 2)
4859+
#if OPENSSL_WITH_OPENSSL_DHKEM
48624860
case EVP_PKEY_EC:
48634861
case EVP_PKEY_X25519:
48644862
case EVP_PKEY_X448:
@@ -4895,7 +4893,7 @@ std::optional<KEM::EncapsulateResult> KEM::Encapsulate(
48954893
return std::nullopt;
48964894
}
48974895

4898-
#if !OPENSSL_VERSION_PREREQ(3, 5)
4896+
#if OPENSSL_WITH_KEM_OPERATION_PARAM
48994897
if (!SetOperationParameter(ctx.get(), public_key)) {
49004898
return std::nullopt;
49014899
}
@@ -4936,7 +4934,7 @@ DataPointer KEM::Decapsulate(const EVPKeyPointer& private_key,
49364934
return {};
49374935
}
49384936

4939-
#if !OPENSSL_VERSION_PREREQ(3, 5)
4937+
#if OPENSSL_WITH_KEM_OPERATION_PARAM
49404938
if (!SetOperationParameter(ctx.get(), private_key)) {
49414939
return {};
49424940
}
@@ -4966,6 +4964,6 @@ DataPointer KEM::Decapsulate(const EVPKeyPointer& private_key,
49664964
return shared_key;
49674965
}
49684966

4969-
#endif // OPENSSL_VERSION_MAJOR >= 3
4967+
#endif // OPENSSL_WITH_KEM
49704968

49714969
} // namespace ncrypto
Collapse file

‎deps/ncrypto/ncrypto.h‎

Copy file name to clipboardExpand all lines: deps/ncrypto/ncrypto.h
+57-12Lines changed: 57 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -42,20 +42,67 @@
4242

4343
// The FIPS-related functions are only available
4444
// when the OpenSSL itself was compiled with FIPS support.
45-
#if defined(OPENSSL_FIPS) && OPENSSL_VERSION_MAJOR < 3
45+
#if defined(OPENSSL_FIPS) && !OPENSSL_VERSION_PREREQ(3, 0)
4646
#include <openssl/fips.h>
4747
#endif // OPENSSL_FIPS
4848

49-
// Define OPENSSL_WITH_PQC for post-quantum cryptography support
50-
#if OPENSSL_VERSION_NUMBER >= 0x30500000L
49+
#if OPENSSL_VERSION_PREREQ(3, 0)
50+
#define OPENSSL_WITH_AES_OCB 1
51+
#else
52+
#define OPENSSL_WITH_AES_OCB 0
53+
#endif
54+
55+
#if !defined(OPENSSL_NO_ARGON2) && OPENSSL_VERSION_PREREQ(3, 2)
56+
#define OPENSSL_WITH_ARGON2 1
57+
#else
58+
#define OPENSSL_WITH_ARGON2 0
59+
#endif
60+
61+
#if OPENSSL_VERSION_PREREQ(3, 0)
62+
#define OPENSSL_WITH_KEM 1
63+
#else
64+
#define OPENSSL_WITH_KEM 0
65+
#endif
66+
67+
#if OPENSSL_VERSION_PREREQ(3, 0)
68+
#define OPENSSL_WITH_KMAC 1
69+
#else
70+
#define OPENSSL_WITH_KMAC 0
71+
#endif
72+
73+
#if OPENSSL_VERSION_PREREQ(3, 2)
74+
#define OPENSSL_WITH_SIGNATURE_CONTEXT_STRING 1
75+
#else
76+
#define OPENSSL_WITH_SIGNATURE_CONTEXT_STRING 0
77+
#endif
78+
79+
#if !defined(OPENSSL_IS_BORINGSSL) && OPENSSL_VERSION_PREREQ(3, 2)
80+
#define OPENSSL_WITH_OPENSSL_DHKEM 1
81+
#else
82+
#define OPENSSL_WITH_OPENSSL_DHKEM 0
83+
#endif
84+
85+
#if OPENSSL_WITH_KEM && !OPENSSL_VERSION_PREREQ(3, 5)
86+
#define OPENSSL_WITH_KEM_OPERATION_PARAM 1
87+
#else
88+
#define OPENSSL_WITH_KEM_OPERATION_PARAM 0
89+
#endif
90+
91+
// Define OPENSSL_WITH_PQC for post-quantum cryptography support.
92+
#if OPENSSL_VERSION_PREREQ(3, 5)
5193
#define OPENSSL_WITH_PQC 1
94+
#else
95+
#define OPENSSL_WITH_PQC 0
96+
#endif
97+
98+
#if OPENSSL_WITH_PQC
5299
#define EVP_PKEY_ML_KEM_512 NID_ML_KEM_512
53100
#define EVP_PKEY_ML_KEM_768 NID_ML_KEM_768
54101
#define EVP_PKEY_ML_KEM_1024 NID_ML_KEM_1024
55102
#include <openssl/core_names.h>
56103
#endif
57104

58-
#if OPENSSL_VERSION_MAJOR >= 3
105+
#if OPENSSL_VERSION_PREREQ(3, 0)
59106
#define OSSL3_CONST const
60107
#else
61108
#define OSSL3_CONST
@@ -1492,7 +1539,7 @@ class HMACCtxPointer final {
14921539
DeleteFnPtr<HMAC_CTX, HMAC_CTX_free> ctx_;
14931540
};
14941541

1495-
#if OPENSSL_VERSION_MAJOR >= 3
1542+
#if OPENSSL_WITH_KMAC
14961543
class EVPMacPointer final {
14971544
public:
14981545
EVPMacPointer() = default;
@@ -1540,7 +1587,7 @@ class EVPMacCtxPointer final {
15401587
private:
15411588
DeleteFnPtr<EVP_MAC_CTX, EVP_MAC_CTX_free> ctx_;
15421589
};
1543-
#endif // OPENSSL_VERSION_MAJOR >= 3
1590+
#endif // OPENSSL_WITH_KMAC
15441591

15451592
#ifndef OPENSSL_NO_ENGINE
15461593
class EnginePointer final {
@@ -1653,8 +1700,7 @@ DataPointer pbkdf2(const Digest& md,
16531700
uint32_t iterations,
16541701
size_t length);
16551702

1656-
#if OPENSSL_VERSION_NUMBER >= 0x30200000L
1657-
#ifndef OPENSSL_NO_ARGON2
1703+
#if OPENSSL_WITH_ARGON2
16581704
enum class Argon2Type { ARGON2D, ARGON2I, ARGON2ID };
16591705

16601706
DataPointer argon2(const Buffer<const char>& pass,
@@ -1668,11 +1714,10 @@ DataPointer argon2(const Buffer<const char>& pass,
16681714
const Buffer<const unsigned char>& ad,
16691715
Argon2Type type);
16701716
#endif
1671-
#endif
16721717

16731718
// ============================================================================
16741719
// KEM (Key Encapsulation Mechanism)
1675-
#if OPENSSL_VERSION_MAJOR >= 3
1720+
#if OPENSSL_WITH_KEM
16761721

16771722
class KEM final {
16781723
public:
@@ -1696,13 +1741,13 @@ class KEM final {
16961741
const Buffer<const void>& ciphertext);
16971742

16981743
private:
1699-
#if !OPENSSL_VERSION_PREREQ(3, 5)
1744+
#if OPENSSL_WITH_KEM_OPERATION_PARAM
17001745
static bool SetOperationParameter(EVP_PKEY_CTX* ctx,
17011746
const EVPKeyPointer& key);
17021747
#endif
17031748
};
17041749

1705-
#endif // OPENSSL_VERSION_MAJOR >= 3
1750+
#endif // OPENSSL_WITH_KEM
17061751

17071752
// ============================================================================
17081753
// Version metadata
Collapse file

‎src/crypto/crypto_aes.h‎

Copy file name to clipboardExpand all lines: src/crypto/crypto_aes.h
+1-1Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ constexpr unsigned kNoAuthTagLength = static_cast<unsigned>(-1);
2626
V(KW_192, AES_Cipher, ncrypto::Cipher::AES_192_KW) \
2727
V(KW_256, AES_Cipher, ncrypto::Cipher::AES_256_KW)
2828

29-
#if OPENSSL_VERSION_MAJOR >= 3
29+
#if OPENSSL_WITH_AES_OCB
3030
#define VARIANTS_OCB(V) \
3131
V(OCB_128, AES_Cipher, ncrypto::Cipher::AES_128_OCB) \
3232
V(OCB_192, AES_Cipher, ncrypto::Cipher::AES_192_OCB) \
Collapse file

‎src/crypto/crypto_argon2.cc‎

Copy file name to clipboardExpand all lines: src/crypto/crypto_argon2.cc
+1-3Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,7 @@
22
#include "async_wrap-inl.h"
33
#include "threadpoolwork-inl.h"
44

5-
#if OPENSSL_VERSION_NUMBER >= 0x30200000L
6-
#ifndef OPENSSL_NO_ARGON2
5+
#if OPENSSL_WITH_ARGON2
76
#include <openssl/core_names.h>
87

98
namespace node::crypto {
@@ -155,4 +154,3 @@ void Argon2::RegisterExternalReferences(ExternalReferenceRegistry* registry) {
155154
} // namespace node::crypto
156155

157156
#endif
158-
#endif
Collapse file

‎src/crypto/crypto_argon2.h‎

Copy file name to clipboardExpand all lines: src/crypto/crypto_argon2.h
+1-1Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
#include "crypto/crypto_util.h"
77

88
namespace node::crypto {
9-
#if !defined(OPENSSL_NO_ARGON2) && OPENSSL_VERSION_NUMBER >= 0x30200000L
9+
#if OPENSSL_WITH_ARGON2
1010

1111
// Argon2 is a password-based key derivation algorithm
1212
// defined in https://datatracker.ietf.org/doc/html/rfc9106
Collapse file

‎src/crypto/crypto_cipher.cc‎

Copy file name to clipboardExpand all lines: src/crypto/crypto_cipher.cc
+1-1Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -738,7 +738,7 @@ bool CipherBase::Final(std::unique_ptr<BackingStore>* out) {
738738
static_cast<size_t>(ctx_.getBlockSize()),
739739
BackingStoreInitializationMode::kUninitialized);
740740

741-
#if (OPENSSL_VERSION_NUMBER < 0x30000000L)
741+
#if !OPENSSL_VERSION_PREREQ(3, 0)
742742
// OpenSSL v1.x doesn't verify the presence of the auth tag so do
743743
// it ourselves, see https://github.com/nodejs/node/issues/45874.
744744
if (kind_ == kDecipher && ctx_.isChaCha20Poly1305() &&
Collapse file

‎src/crypto/crypto_kem.cc‎

Copy file name to clipboardExpand all lines: src/crypto/crypto_kem.cc
+1-1Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
#include "crypto/crypto_kem.h"
22

3-
#if OPENSSL_VERSION_MAJOR >= 3
3+
#if OPENSSL_WITH_KEM
44

55
#include "async_wrap-inl.h"
66
#include "base_object-inl.h"
Collapse file

‎src/crypto/crypto_kem.h‎

Copy file name to clipboardExpand all lines: src/crypto/crypto_kem.h
+1-1Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010
#include "memory_tracker.h"
1111
#include "node_external_reference.h"
1212

13-
#if OPENSSL_VERSION_MAJOR >= 3
13+
#if OPENSSL_WITH_KEM
1414

1515
namespace node {
1616
namespace crypto {
Collapse file

‎src/crypto/crypto_kmac.cc‎

Copy file name to clipboardExpand all lines: src/crypto/crypto_kmac.cc
+2-2Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
#include "node_internals.h"
44
#include "threadpoolwork-inl.h"
55

6-
#if OPENSSL_VERSION_MAJOR >= 3
6+
#if OPENSSL_WITH_KMAC
77
#include <openssl/core_names.h>
88
#include <openssl/params.h>
99
#include "crypto/crypto_keys.h"
@@ -218,4 +218,4 @@ void Kmac::RegisterExternalReferences(ExternalReferenceRegistry* registry) {
218218

219219
} // namespace node::crypto
220220

221-
#endif
221+
#endif // OPENSSL_WITH_KMAC
Collapse file

‎src/crypto/crypto_kmac.h‎

Copy file name to clipboardExpand all lines: src/crypto/crypto_kmac.h
+2-3Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -10,8 +10,7 @@
1010

1111
namespace node::crypto {
1212

13-
// KMAC (Keccak Message Authentication Code) is available since OpenSSL 3.0.
14-
#if OPENSSL_VERSION_MAJOR >= 3
13+
#if OPENSSL_WITH_KMAC
1514

1615
enum class KmacVariant { KMAC128, KMAC256 };
1716

@@ -71,7 +70,7 @@ namespace Kmac {
7170
void Initialize(Environment* env, v8::Local<v8::Object> target) {}
7271
void RegisterExternalReferences(ExternalReferenceRegistry* registry) {}
7372
} // namespace Kmac
74-
#endif
73+
#endif // OPENSSL_WITH_KMAC
7574

7675
} // namespace node::crypto
7776

0 commit comments

Comments
0 (0)
Morty Proxy This is a proxified and sanitized view of the page, visit original site.