Visitar URL original
src: simplify OpenSSL feature gates · nodejs/node@677ca7e · GitHub
Skip to content

Commit 677ca7e

Browse files
panvasxa
panva
authored and
sxa
committed
src: simplify OpenSSL feature gates
Add OPENSSL_WITH_* feature macros for crypto capabilities that vary by OpenSSL version and use those instead of repeating version checks. Signed-off-by: Filip Skokan <panva.ip@gmail.com> PR-URL: #63255 Backport-PR-URL: #63563 Refs: electron/electron#36256 Refs: electron/electron#41720 Refs: electron/electron#51127 Reviewed-By: James M Snell <jasnell@gmail.com> Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
1 parent c863c75 commit 677ca7e

13 files changed

Lines changed: 91 additions & 48 deletions

‎deps/ncrypto/ncrypto.cc‎

Lines changed: 10 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@
2020
#include <openssl/core_names.h>
2121
#include <openssl/params.h>
2222
#include <openssl/provider.h>
23-
#if OPENSSL_VERSION_NUMBER >= 0x30200000L
23+
#if OPENSSL_WITH_ARGON2
2424
#include <openssl/thread.h>
2525
#endif
2626
#endif
@@ -1955,8 +1955,7 @@ DataPointer pbkdf2(const Digest& md,
19551955
return {};
19561956
}
19571957

1958-
#if OPENSSL_VERSION_NUMBER >= 0x30200000L
1959-
#ifndef OPENSSL_NO_ARGON2
1958+
#if OPENSSL_WITH_ARGON2
19601959
DataPointer argon2(const Buffer<const char>& pass,
19611960
const Buffer<const unsigned char>& salt,
19621961
uint32_t lanes,
@@ -2049,7 +2048,6 @@ DataPointer argon2(const Buffer<const char>& pass,
20492048
return {};
20502049
}
20512050
#endif
2052-
#endif
20532051

20542052
// ============================================================================
20552053

@@ -4614,7 +4612,7 @@ HMACCtxPointer HMACCtxPointer::New() {
46144612
return HMACCtxPointer(HMAC_CTX_new());
46154613
}
46164614

4617-
#if OPENSSL_VERSION_MAJOR >= 3
4615+
#if OPENSSL_WITH_KMAC
46184616
EVPMacPointer::EVPMacPointer(EVP_MAC* mac) : mac_(mac) {}
46194617

46204618
EVPMacPointer::EVPMacPointer(EVPMacPointer&& other) noexcept
@@ -4702,7 +4700,7 @@ EVPMacCtxPointer EVPMacCtxPointer::New(EVP_MAC* mac) {
47024700
if (!mac) return EVPMacCtxPointer();
47034701
return EVPMacCtxPointer(EVP_MAC_CTX_new(mac));
47044702
}
4705-
#endif // OPENSSL_VERSION_MAJOR >= 3
4703+
#endif // OPENSSL_WITH_KMAC
47064704

47074705
DataPointer hashDigest(const Buffer<const unsigned char>& buf,
47084706
const EVP_MD* md) {
@@ -4849,16 +4847,16 @@ const Digest Digest::FromName(const char* name) {
48494847

48504848
// ============================================================================
48514849
// KEM Implementation
4852-
#if OPENSSL_VERSION_MAJOR >= 3
4853-
#if !OPENSSL_VERSION_PREREQ(3, 5)
4850+
#if OPENSSL_WITH_KEM
4851+
#if OPENSSL_WITH_KEM_OPERATION_PARAM
48544852
bool KEM::SetOperationParameter(EVP_PKEY_CTX* ctx, const EVPKeyPointer& key) {
48554853
const char* operation = nullptr;
48564854

48574855
switch (EVP_PKEY_id(key.get())) {
48584856
case EVP_PKEY_RSA:
48594857
operation = OSSL_KEM_PARAM_OPERATION_RSASVE;
48604858
break;
4861-
#if OPENSSL_VERSION_PREREQ(3, 2)
4859+
#if OPENSSL_WITH_OPENSSL_DHKEM
48624860
case EVP_PKEY_EC:
48634861
case EVP_PKEY_X25519:
48644862
case EVP_PKEY_X448:
@@ -4895,7 +4893,7 @@ std::optional<KEM::EncapsulateResult> KEM::Encapsulate(
48954893
return std::nullopt;
48964894
}
48974895

4898-
#if !OPENSSL_VERSION_PREREQ(3, 5)
4896+
#if OPENSSL_WITH_KEM_OPERATION_PARAM
48994897
if (!SetOperationParameter(ctx.get(), public_key)) {
49004898
return std::nullopt;
49014899
}
@@ -4936,7 +4934,7 @@ DataPointer KEM::Decapsulate(const EVPKeyPointer& private_key,
49364934
return {};
49374935
}
49384936

4939-
#if !OPENSSL_VERSION_PREREQ(3, 5)
4937+
#if OPENSSL_WITH_KEM_OPERATION_PARAM
49404938
if (!SetOperationParameter(ctx.get(), private_key)) {
49414939
return {};
49424940
}
@@ -4966,6 +4964,6 @@ DataPointer KEM::Decapsulate(const EVPKeyPointer& private_key,
49664964
return shared_key;
49674965
}
49684966

4969-
#endif // OPENSSL_VERSION_MAJOR >= 3
4967+
#endif // OPENSSL_WITH_KEM
49704968

49714969
} // namespace ncrypto

‎deps/ncrypto/ncrypto.h‎

Lines changed: 57 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -42,20 +42,67 @@
4242

4343
// The FIPS-related functions are only available
4444
// when the OpenSSL itself was compiled with FIPS support.
45-
#if defined(OPENSSL_FIPS) && OPENSSL_VERSION_MAJOR < 3
45+
#if defined(OPENSSL_FIPS) && !OPENSSL_VERSION_PREREQ(3, 0)
4646
#include <openssl/fips.h>
4747
#endif // OPENSSL_FIPS
4848

49-
// Define OPENSSL_WITH_PQC for post-quantum cryptography support
50-
#if OPENSSL_VERSION_NUMBER >= 0x30500000L
49+
#if OPENSSL_VERSION_PREREQ(3, 0)
50+
#define OPENSSL_WITH_AES_OCB 1
51+
#else
52+
#define OPENSSL_WITH_AES_OCB 0
53+
#endif
54+
55+
#if !defined(OPENSSL_NO_ARGON2) && OPENSSL_VERSION_PREREQ(3, 2)
56+
#define OPENSSL_WITH_ARGON2 1
57+
#else
58+
#define OPENSSL_WITH_ARGON2 0
59+
#endif
60+
61+
#if OPENSSL_VERSION_PREREQ(3, 0)
62+
#define OPENSSL_WITH_KEM 1
63+
#else
64+
#define OPENSSL_WITH_KEM 0
65+
#endif
66+
67+
#if OPENSSL_VERSION_PREREQ(3, 0)
68+
#define OPENSSL_WITH_KMAC 1
69+
#else
70+
#define OPENSSL_WITH_KMAC 0
71+
#endif
72+
73+
#if OPENSSL_VERSION_PREREQ(3, 2)
74+
#define OPENSSL_WITH_SIGNATURE_CONTEXT_STRING 1
75+
#else
76+
#define OPENSSL_WITH_SIGNATURE_CONTEXT_STRING 0
77+
#endif
78+
79+
#if !defined(OPENSSL_IS_BORINGSSL) && OPENSSL_VERSION_PREREQ(3, 2)
80+
#define OPENSSL_WITH_OPENSSL_DHKEM 1
81+
#else
82+
#define OPENSSL_WITH_OPENSSL_DHKEM 0
83+
#endif
84+
85+
#if OPENSSL_WITH_KEM && !OPENSSL_VERSION_PREREQ(3, 5)
86+
#define OPENSSL_WITH_KEM_OPERATION_PARAM 1
87+
#else
88+
#define OPENSSL_WITH_KEM_OPERATION_PARAM 0
89+
#endif
90+
91+
// Define OPENSSL_WITH_PQC for post-quantum cryptography support.
92+
#if OPENSSL_VERSION_PREREQ(3, 5)
5193
#define OPENSSL_WITH_PQC 1
94+
#else
95+
#define OPENSSL_WITH_PQC 0
96+
#endif
97+
98+
#if OPENSSL_WITH_PQC
5299
#define EVP_PKEY_ML_KEM_512 NID_ML_KEM_512
53100
#define EVP_PKEY_ML_KEM_768 NID_ML_KEM_768
54101
#define EVP_PKEY_ML_KEM_1024 NID_ML_KEM_1024
55102
#include <openssl/core_names.h>
56103
#endif
57104

58-
#if OPENSSL_VERSION_MAJOR >= 3
105+
#if OPENSSL_VERSION_PREREQ(3, 0)
59106
#define OSSL3_CONST const
60107
#else
61108
#define OSSL3_CONST
@@ -1492,7 +1539,7 @@ class HMACCtxPointer final {
14921539
DeleteFnPtr<HMAC_CTX, HMAC_CTX_free> ctx_;
14931540
};
14941541

1495-
#if OPENSSL_VERSION_MAJOR >= 3
1542+
#if OPENSSL_WITH_KMAC
14961543
class EVPMacPointer final {
14971544
public:
14981545
EVPMacPointer() = default;
@@ -1540,7 +1587,7 @@ class EVPMacCtxPointer final {
15401587
private:
15411588
DeleteFnPtr<EVP_MAC_CTX, EVP_MAC_CTX_free> ctx_;
15421589
};
1543-
#endif // OPENSSL_VERSION_MAJOR >= 3
1590+
#endif // OPENSSL_WITH_KMAC
15441591

15451592
#ifndef OPENSSL_NO_ENGINE
15461593
class EnginePointer final {
@@ -1653,8 +1700,7 @@ DataPointer pbkdf2(const Digest& md,
16531700
uint32_t iterations,
16541701
size_t length);
16551702

1656-
#if OPENSSL_VERSION_NUMBER >= 0x30200000L
1657-
#ifndef OPENSSL_NO_ARGON2
1703+
#if OPENSSL_WITH_ARGON2
16581704
enum class Argon2Type { ARGON2D, ARGON2I, ARGON2ID };
16591705

16601706
DataPointer argon2(const Buffer<const char>& pass,
@@ -1668,11 +1714,10 @@ DataPointer argon2(const Buffer<const char>& pass,
16681714
const Buffer<const unsigned char>& ad,
16691715
Argon2Type type);
16701716
#endif
1671-
#endif
16721717

16731718
// ============================================================================
16741719
// KEM (Key Encapsulation Mechanism)
1675-
#if OPENSSL_VERSION_MAJOR >= 3
1720+
#if OPENSSL_WITH_KEM
16761721

16771722
class KEM final {
16781723
public:
@@ -1696,13 +1741,13 @@ class KEM final {
16961741
const Buffer<const void>& ciphertext);
16971742

16981743
private:
1699-
#if !OPENSSL_VERSION_PREREQ(3, 5)
1744+
#if OPENSSL_WITH_KEM_OPERATION_PARAM
17001745
static bool SetOperationParameter(EVP_PKEY_CTX* ctx,
17011746
const EVPKeyPointer& key);
17021747
#endif
17031748
};
17041749

1705-
#endif // OPENSSL_VERSION_MAJOR >= 3
1750+
#endif // OPENSSL_WITH_KEM
17061751

17071752
// ============================================================================
17081753
// Version metadata

‎src/crypto/crypto_aes.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ constexpr unsigned kNoAuthTagLength = static_cast<unsigned>(-1);
2626
V(KW_192, AES_Cipher, ncrypto::Cipher::AES_192_KW) \
2727
V(KW_256, AES_Cipher, ncrypto::Cipher::AES_256_KW)
2828

29-
#if OPENSSL_VERSION_MAJOR >= 3
29+
#if OPENSSL_WITH_AES_OCB
3030
#define VARIANTS_OCB(V) \
3131
V(OCB_128, AES_Cipher, ncrypto::Cipher::AES_128_OCB) \
3232
V(OCB_192, AES_Cipher, ncrypto::Cipher::AES_192_OCB) \

‎src/crypto/crypto_argon2.cc‎

Lines changed: 1 addition & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,7 @@
22
#include "async_wrap-inl.h"
33
#include "threadpoolwork-inl.h"
44

5-
#if OPENSSL_VERSION_NUMBER >= 0x30200000L
6-
#ifndef OPENSSL_NO_ARGON2
5+
#if OPENSSL_WITH_ARGON2
76
#include <openssl/core_names.h>
87

98
namespace node::crypto {
@@ -155,4 +154,3 @@ void Argon2::RegisterExternalReferences(ExternalReferenceRegistry* registry) {
155154
} // namespace node::crypto
156155

157156
#endif
158-
#endif

‎src/crypto/crypto_argon2.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
#include "crypto/crypto_util.h"
77

88
namespace node::crypto {
9-
#if !defined(OPENSSL_NO_ARGON2) && OPENSSL_VERSION_NUMBER >= 0x30200000L
9+
#if OPENSSL_WITH_ARGON2
1010

1111
// Argon2 is a password-based key derivation algorithm
1212
// defined in https://datatracker.ietf.org/doc/html/rfc9106

‎src/crypto/crypto_cipher.cc‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -738,7 +738,7 @@ bool CipherBase::Final(std::unique_ptr<BackingStore>* out) {
738738
static_cast<size_t>(ctx_.getBlockSize()),
739739
BackingStoreInitializationMode::kUninitialized);
740740

741-
#if (OPENSSL_VERSION_NUMBER < 0x30000000L)
741+
#if !OPENSSL_VERSION_PREREQ(3, 0)
742742
// OpenSSL v1.x doesn't verify the presence of the auth tag so do
743743
// it ourselves, see https://github.com/nodejs/node/issues/45874.
744744
if (kind_ == kDecipher && ctx_.isChaCha20Poly1305() &&

‎src/crypto/crypto_kem.cc‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
#include "crypto/crypto_kem.h"
22

3-
#if OPENSSL_VERSION_MAJOR >= 3
3+
#if OPENSSL_WITH_KEM
44

55
#include "async_wrap-inl.h"
66
#include "base_object-inl.h"

‎src/crypto/crypto_kem.h‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@
1010
#include "memory_tracker.h"
1111
#include "node_external_reference.h"
1212

13-
#if OPENSSL_VERSION_MAJOR >= 3
13+
#if OPENSSL_WITH_KEM
1414

1515
namespace node {
1616
namespace crypto {

‎src/crypto/crypto_kmac.cc‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
#include "node_internals.h"
44
#include "threadpoolwork-inl.h"
55

6-
#if OPENSSL_VERSION_MAJOR >= 3
6+
#if OPENSSL_WITH_KMAC
77
#include <openssl/core_names.h>
88
#include <openssl/params.h>
99
#include "crypto/crypto_keys.h"
@@ -218,4 +218,4 @@ void Kmac::RegisterExternalReferences(ExternalReferenceRegistry* registry) {
218218

219219
} // namespace node::crypto
220220

221-
#endif
221+
#endif // OPENSSL_WITH_KMAC

‎src/crypto/crypto_kmac.h‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -10,8 +10,7 @@
1010

1111
namespace node::crypto {
1212

13-
// KMAC (Keccak Message Authentication Code) is available since OpenSSL 3.0.
14-
#if OPENSSL_VERSION_MAJOR >= 3
13+
#if OPENSSL_WITH_KMAC
1514

1615
enum class KmacVariant { KMAC128, KMAC256 };
1716

@@ -71,7 +70,7 @@ namespace Kmac {
7170
void Initialize(Environment* env, v8::Local<v8::Object> target) {}
7271
void RegisterExternalReferences(ExternalReferenceRegistry* registry) {}
7372
} // namespace Kmac
74-
#endif
73+
#endif // OPENSSL_WITH_KMAC
7574

7675
} // namespace node::crypto
7776

0 commit comments

Comments
 (0)