Skip to content

Commit 239d9db

Browse files
panvapanva
committed
crypto,https,tls: end OpenSSL engine support
OpenSSL removed support for engines in version 4. Remove the Node.js APIs, constants, native bindings, and implementation that depend on ENGINE. Keep recognizing the former TLS and HTTPS engine options so their use fails explicitly instead of appearing to work while being ignored. Move DEP0183 directly from Documentation-only to End-of-Life. Signed-off-by: Filip Skokan <panva.ip@gmail.com> Assisted-by: Codex
1 parent 8c5b772 commit 239d9db

40 files changed

Lines changed: 162 additions & 1279 deletions

‎deps/ncrypto/engine.cc‎

Lines changed: 0 additions & 105 deletions
This file was deleted.

‎deps/ncrypto/ncrypto.gyp‎

Lines changed: 0 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -5,19 +5,10 @@
55
'ncrypto.cc',
66
'ncrypto.h',
77
],
8-
'ncrypto_engine_sources': [
9-
'engine.cc',
10-
'ncrypto.h',
11-
],
128
'ncrypto_strict_defines': [
139
'OPENSSL_API_COMPAT=30000',
1410
'OPENSSL_NO_DEPRECATED',
1511
],
16-
'ncrypto_engine_defines': [
17-
'OPENSSL_API_COMPAT=30000',
18-
'OPENSSL_SUPPRESS_DEPRECATED',
19-
'NCRYPTO_ENGINE_COMPAT=1',
20-
],
2112
},
2213
'targets': [
2314
{
@@ -42,9 +33,6 @@
4233
'conditions': [
4334
['openssl_is_boringssl=="false"', {
4435
'defines': [ '<@(ncrypto_strict_defines)' ],
45-
'dependencies': [
46-
'ncrypto_engine',
47-
],
4836
}],
4937
['node_shared_openssl=="false"', {
5038
'dependencies': [
@@ -54,27 +42,4 @@
5442
]
5543
},
5644
],
57-
'conditions': [
58-
['openssl_is_boringssl=="false"', {
59-
'targets': [
60-
{
61-
'target_name': 'ncrypto_engine',
62-
'type': 'static_library',
63-
'include_dirs': ['.'],
64-
'defines': [
65-
'NCRYPTO_BSSL_LIBDECREPIT_MISSING=<(ncrypto_bssl_libdecrepit_missing)',
66-
'<@(ncrypto_engine_defines)',
67-
],
68-
'sources': [ '<@(ncrypto_engine_sources)' ],
69-
'conditions': [
70-
['node_shared_openssl=="false"', {
71-
'dependencies': [
72-
'../openssl/openssl.gyp:openssl'
73-
]
74-
}],
75-
]
76-
},
77-
],
78-
}],
79-
],
8045
}

‎deps/ncrypto/ncrypto.h‎

Lines changed: 0 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -22,11 +22,6 @@
2222
#include <string_view>
2323
#include <unordered_map>
2424
#include <vector>
25-
#if defined(NCRYPTO_ENGINE_COMPAT) && NCRYPTO_ENGINE_COMPAT && \
26-
!defined(OPENSSL_NO_ENGINE)
27-
#include <openssl/engine.h>
28-
#endif // NCRYPTO_ENGINE_COMPAT && !OPENSSL_NO_ENGINE
29-
3025
#ifndef OPENSSL_VERSION_PREREQ
3126
#define OPENSSL_VERSION_PREREQ(maj, min) \
3227
(OPENSSL_VERSION_NUMBER >= (((maj) << 28) | ((min) << 20)))
@@ -1988,44 +1983,6 @@ class MacCache final {
19881983
};
19891984
#endif
19901985

1991-
#ifndef OPENSSL_NO_ENGINE
1992-
class EnginePointer final {
1993-
public:
1994-
EnginePointer() = default;
1995-
1996-
explicit EnginePointer(void* engine_, bool finish_on_exit = false);
1997-
EnginePointer(EnginePointer&& other) noexcept;
1998-
EnginePointer& operator=(EnginePointer&& other) noexcept;
1999-
NCRYPTO_DISALLOW_COPY(EnginePointer)
2000-
~EnginePointer();
2001-
2002-
inline operator bool() const { return engine != nullptr; }
2003-
inline void setFinishOnExit() { finish_on_exit = true; }
2004-
2005-
void reset(void* engine_ = nullptr, bool finish_on_exit_ = false);
2006-
2007-
bool setAsDefault(uint32_t flags, CryptoErrorList* errors = nullptr);
2008-
bool init(bool finish_on_exit = false);
2009-
EVPKeyPointer loadPrivateKey(const char* key_name);
2010-
bool setClientCertEngine(SSL_CTX* ctx);
2011-
2012-
void* release();
2013-
2014-
// Retrieve an OpenSSL Engine instance by name. If the name does not
2015-
// identify a valid named engine, the returned EnginePointer will be
2016-
// empty.
2017-
static EnginePointer getEngineByName(const char* name,
2018-
CryptoErrorList* errors = nullptr);
2019-
2020-
// Call once when initializing OpenSSL at startup for the process.
2021-
static void initEnginesOnce();
2022-
2023-
private:
2024-
void* engine = nullptr;
2025-
bool finish_on_exit = false;
2026-
};
2027-
#endif // !OPENSSL_NO_ENGINE
2028-
20291986
// ============================================================================
20301987
// FIPS
20311988
bool isFipsEnabled();

‎deps/ncrypto/unofficial.gni‎

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -26,11 +26,7 @@ template("ncrypto_gn_build") {
2626
source_set(target_name) {
2727
forward_variables_from(invoker, "*")
2828
public_configs = [ ":ncrypto_config" ]
29-
defines = [
30-
"NCRYPTO_ENGINE_COMPAT=1",
31-
"OPENSSL_SUPPRESS_DEPRECATED",
32-
]
33-
sources = gypi_values.ncrypto_sources + gypi_values.ncrypto_engine_sources
29+
sources = gypi_values.ncrypto_sources
3430
deps = [ "$node_openssl_path" ]
3531
}
3632
}

‎doc/api/crypto.md‎

Lines changed: 0 additions & 89 deletions
Original file line numberDiff line numberDiff line change
@@ -6541,42 +6541,6 @@ added: v15.6.0
65416541
* `utilization` {number} The calculated ratio of `used` to `total`
65426542
allocated bytes.
65436543

6544-
### `crypto.setEngine(engine[, flags])`
6545-
6546-
<!-- YAML
6547-
added: v0.11.11
6548-
changes:
6549-
- version:
6550-
- v22.4.0
6551-
- v20.16.0
6552-
pr-url: https://github.com/nodejs/node/pull/53329
6553-
description: Custom engine support in OpenSSL 3 is deprecated.
6554-
-->
6555-
6556-
* `engine` {string}
6557-
* `flags` {crypto.constants} **Default:** `crypto.constants.ENGINE_METHOD_ALL`
6558-
6559-
Load and set the `engine` for some or all OpenSSL functions (selected by flags).
6560-
Support for custom engines in OpenSSL is deprecated from OpenSSL 3.
6561-
6562-
`engine` could be either an id or a path to the engine's shared library.
6563-
6564-
The optional `flags` argument uses `ENGINE_METHOD_ALL` by default. The `flags`
6565-
is a bit field taking one of or a mix of the following flags (defined in
6566-
`crypto.constants`):
6567-
6568-
* `crypto.constants.ENGINE_METHOD_RSA`
6569-
* `crypto.constants.ENGINE_METHOD_DSA`
6570-
* `crypto.constants.ENGINE_METHOD_DH`
6571-
* `crypto.constants.ENGINE_METHOD_RAND`
6572-
* `crypto.constants.ENGINE_METHOD_EC`
6573-
* `crypto.constants.ENGINE_METHOD_CIPHERS`
6574-
* `crypto.constants.ENGINE_METHOD_DIGESTS`
6575-
* `crypto.constants.ENGINE_METHOD_PKEY_METHS`
6576-
* `crypto.constants.ENGINE_METHOD_PKEY_ASN1_METHS`
6577-
* `crypto.constants.ENGINE_METHOD_ALL`
6578-
* `crypto.constants.ENGINE_METHOD_NONE`
6579-
65806544
### `crypto.setFips(bool)`
65816545

65826546
<!-- YAML
@@ -7403,59 +7367,6 @@ See the [list of SSL OP Flags][] for details.
74037367
</tr>
74047368
</table>
74057369

7406-
### OpenSSL engine constants
7407-
7408-
<table>
7409-
<tr>
7410-
<th>Constant</th>
7411-
<th>Description</th>
7412-
</tr>
7413-
<tr>
7414-
<td><code>ENGINE_METHOD_RSA</code></td>
7415-
<td>Limit engine usage to RSA</td>
7416-
</tr>
7417-
<tr>
7418-
<td><code>ENGINE_METHOD_DSA</code></td>
7419-
<td>Limit engine usage to DSA</td>
7420-
</tr>
7421-
<tr>
7422-
<td><code>ENGINE_METHOD_DH</code></td>
7423-
<td>Limit engine usage to DH</td>
7424-
</tr>
7425-
<tr>
7426-
<td><code>ENGINE_METHOD_RAND</code></td>
7427-
<td>Limit engine usage to RAND</td>
7428-
</tr>
7429-
<tr>
7430-
<td><code>ENGINE_METHOD_EC</code></td>
7431-
<td>Limit engine usage to EC</td>
7432-
</tr>
7433-
<tr>
7434-
<td><code>ENGINE_METHOD_CIPHERS</code></td>
7435-
<td>Limit engine usage to CIPHERS</td>
7436-
</tr>
7437-
<tr>
7438-
<td><code>ENGINE_METHOD_DIGESTS</code></td>
7439-
<td>Limit engine usage to DIGESTS</td>
7440-
</tr>
7441-
<tr>
7442-
<td><code>ENGINE_METHOD_PKEY_METHS</code></td>
7443-
<td>Limit engine usage to PKEY_METHS</td>
7444-
</tr>
7445-
<tr>
7446-
<td><code>ENGINE_METHOD_PKEY_ASN1_METHS</code></td>
7447-
<td>Limit engine usage to PKEY_ASN1_METHS</td>
7448-
</tr>
7449-
<tr>
7450-
<td><code>ENGINE_METHOD_ALL</code></td>
7451-
<td></td>
7452-
</tr>
7453-
<tr>
7454-
<td><code>ENGINE_METHOD_NONE</code></td>
7455-
<td></td>
7456-
</tr>
7457-
</table>
7458-
74597370
### Other OpenSSL constants
74607371

74617372
<table>

‎doc/api/deprecations.md‎

Lines changed: 11 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -4111,20 +4111,25 @@ that are shorter than the default authentication tag length (i.e., shorter than
41114111

41124112
<!-- YAML
41134113
changes:
4114+
- version: REPLACEME
4115+
pr-url: https://github.com/nodejs/node/pull/64777
4116+
description: End-of-Life.
41144117
- version:
41154118
- v22.4.0
41164119
- v20.16.0
41174120
pr-url: https://github.com/nodejs/node/pull/53329
41184121
description: Documentation-only deprecation.
41194122
-->
41204123

4121-
Type: Documentation-only
4124+
Type: End-of-Life
41224125

4123-
OpenSSL 3 has deprecated support for custom engines with a recommendation to
4124-
switch to its new provider model. The `clientCertEngine` option for
4125-
`https.request()`, [`tls.createSecureContext()`][], and [`tls.createServer()`][];
4126-
the `privateKeyEngine` and `privateKeyIdentifier` for [`tls.createSecureContext()`][];
4127-
and [`crypto.setEngine()`][] all depend on this functionality from OpenSSL.
4126+
The `crypto.setEngine()` API and the `crypto.constants.ENGINE_METHOD_*`
4127+
constants have been removed. The `clientCertEngine` option for
4128+
[`https.request()`][], [`tls.createSecureContext()`][], and
4129+
[`tls.createServer()`][] and the `privateKeyEngine` and `privateKeyIdentifier`
4130+
options for [`tls.createSecureContext()`][] now throw
4131+
`ERR_CRYPTO_CUSTOM_ENGINE_NOT_SUPPORTED` when used. There is no direct
4132+
replacement API in Node.js. OpenSSL's provider model replaces engines upstream.
41284133

41294134
### DEP0184: Instantiating `node:zlib` classes without `new`
41304135

@@ -4849,7 +4854,6 @@ async function example() {
48494854
[`crypto.pbkdf2()`]: crypto.md#cryptopbkdf2password-salt-iterations-keylen-digest-callback
48504855
[`crypto.randomBytes()`]: crypto.md#cryptorandombytessize-callback
48514856
[`crypto.scrypt()`]: crypto.md#cryptoscryptpassword-salt-keylen-options-callback
4852-
[`crypto.setEngine()`]: crypto.md#cryptosetengineengine-flags
48534857
[`decipher.final()`]: crypto.md#decipherfinaloutputencoding
48544858
[`decipher.setAuthTag()`]: crypto.md#deciphersetauthtagbuffer-encoding
48554859
[`dirent.parentPath`]: fs.md#direntparentpath

0 commit comments

Comments
 (0)