Commit 85bfe9a9384 for nodejs
commit 85bfe9a93846b5863512e056637d7398280874ec
Author: Filip Skokan <panva.ip@gmail.com>
Date: Sun Jul 26 14:18:37 2026 +0200
deps: remove ncrypto legacy OpenSSL backend
Remove the OpenSSL 1.x backend and its legacy dss1 digest aliases.
Rename the provider-backed path switch to NCRYPTO_USE_OPENSSL_PROVIDER
and rewrite the remaining version guards as OPENSSL_IS_BORINGSSL checks.
Remove version-adapter casts now that supported OpenSSL signatures are
uniform. Drop legacy digest-context, raw-key, seed, signature-context,
SM2, primality, and RSA2 key-detail fallbacks. Keep name-based key
algorithms and capability discovery, with numeric key adapters and
low-level key paths only for BoringSSL.
Use the same backend split for KDFs, PKCS#1 decoding, key serialization,
and provider EC/RSA key details. Gate BoringSSL-only alternatives
explicitly instead of leaving them in #else branches.
Signed-off-by: Filip Skokan <panva.ip@gmail.com>
Assisted-by: Codex
PR-URL: https://github.com/nodejs/node/pull/64777
Fixes: https://github.com/nodejs/node/issues/56733
Refs: https://github.com/nodejs/node/pull/64211
Refs: https://github.com/nodejs/node/pull/63966
Refs: https://github.com/nodejs/node/pull/53329
Refs: https://github.com/nodejs/node/pull/48950
Refs: https://github.com/nodejs/node/issues/45465
Refs: https://github.com/nodejs/node/issues/42827
Refs: https://github.com/nodejs/node/issues/47076
Refs: https://github.com/nodejs/node/pull/62862
Refs: https://github.com/nodejs/node/pull/38512
Reviewed-By: Yagiz Nizipli <yagiz@nizipli.com>
Reviewed-By: James M Snell <jasnell@gmail.com>
Reviewed-By: Richard Lau <richard.lau@ibm.com>
Reviewed-By: Gürgün Dayıoğlu <hey@gurgun.day>
diff --git a/deps/ncrypto/engine.cc b/deps/ncrypto/engine.cc
index a8e64e25049..6b9514b8565 100644
--- a/deps/ncrypto/engine.cc
+++ b/deps/ncrypto/engine.cc
@@ -1,8 +1,7 @@
#include "ncrypto.h"
-#if !defined(OPENSSL_NO_ENGINE) && \
- ((defined(NCRYPTO_ENGINE_COMPAT) && NCRYPTO_ENGINE_COMPAT) || \
- NCRYPTO_USE_LEGACY_OPENSSL)
+#if !defined(OPENSSL_NO_ENGINE) && defined(NCRYPTO_ENGINE_COMPAT) && \
+ NCRYPTO_ENGINE_COMPAT
#include <openssl/engine.h>
#endif
diff --git a/deps/ncrypto/ncrypto.cc b/deps/ncrypto/ncrypto.cc
index 284ba456a49..5c20b482878 100644
--- a/deps/ncrypto/ncrypto.cc
+++ b/deps/ncrypto/ncrypto.cc
@@ -8,7 +8,7 @@
#include <openssl/pkcs12.h>
#include <openssl/rand.h>
#include <openssl/x509v3.h>
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
#include <openssl/decoder.h>
#endif
#if NCRYPTO_USE_BORINGSSL_EVP_DO_ALL_FALLBACK
@@ -22,7 +22,7 @@
#include <cstring>
#include <string_view>
#include <vector>
-#if OPENSSL_VERSION_MAJOR >= 3
+#ifndef OPENSSL_IS_BORINGSSL
#include <openssl/core_names.h>
#include <openssl/params.h>
#include <openssl/provider.h>
@@ -32,20 +32,10 @@
#include <openssl/thread.h>
#endif
#endif
-// EVP_PKEY_CTX_set_dsa_paramgen_q_bits was added in OpenSSL 1.1.1e.
-#if OPENSSL_VERSION_NUMBER < 0x1010105fL
-#define EVP_PKEY_CTX_set_dsa_paramgen_q_bits(ctx, qbits) \
- EVP_PKEY_CTX_ctrl((ctx), \
- EVP_PKEY_DSA, \
- EVP_PKEY_OP_PARAMGEN, \
- EVP_PKEY_CTRL_DSA_PARAMGEN_Q_BITS, \
- (qbits), \
- nullptr)
-#endif
// Ubuntu 22.04's default libssl-dev still lacks EVP_PKEY_PRIVATE_KEY when
// fully updated. The macro was added upstream in OpenSSL 3.0.12.
-#if NCRYPTO_USE_OPENSSL3_PROVIDER && !defined(EVP_PKEY_PRIVATE_KEY)
+#if NCRYPTO_USE_OPENSSL_PROVIDER && !defined(EVP_PKEY_PRIVATE_KEY)
#define EVP_PKEY_PRIVATE_KEY \
(EVP_PKEY_KEY_PARAMETERS | OSSL_KEYMGMT_SELECT_PRIVATE_KEY)
#endif
@@ -56,7 +46,7 @@ using BignumCtxPointer = DeleteFnPtr<BN_CTX, BN_CTX_free>;
using BignumGenCallbackPointer = DeleteFnPtr<BN_GENCB, BN_GENCB_free>;
using NetscapeSPKIPointer = DeleteFnPtr<NETSCAPE_SPKI, NETSCAPE_SPKI_free>;
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
using X509PubKeyPointer = DeleteFnPtr<X509_PUBKEY, X509_PUBKEY_free>;
// OSSL_STORE_close() returns int, so it needs a void-returning adapter to be
// usable as a DeleteFnPtr deleter.
@@ -68,22 +58,18 @@ using UIMethodPointer = DeleteFnPtr<UI_METHOD, UI_destroy_method>;
#endif
const EVP_CIPHER* GetCipherCtxCipher(const EVP_CIPHER_CTX* ctx) {
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
return EVP_CIPHER_CTX_get0_cipher(ctx);
-#else
+#elif NCRYPTO_USE_BORINGSSL
return EVP_CIPHER_CTX_cipher(ctx);
#endif
}
const EVP_MD* GetDigestCtxMd(const EVP_MD_CTX* ctx) {
-#if NCRYPTO_USE_OPENSSL3_PROVIDER || NCRYPTO_USE_BORINGSSL
return EVP_MD_CTX_get0_md(ctx);
-#else
- return EVP_MD_CTX_md(ctx);
-#endif
}
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
using ASN1StringPointer = DeleteFnPtr<ASN1_STRING, ASN1_STRING_free>;
using OSSLParamBldPointer = DeleteFnPtr<OSSL_PARAM_BLD, OSSL_PARAM_BLD_free>;
using RsaPssParamsPointer = DeleteFnPtr<RSA_PSS_PARAMS, RSA_PSS_PARAMS_free>;
@@ -137,7 +123,7 @@ constexpr std::array<RsaOtherPrimeParamNames, 8> kRsaOtherPrimeParamNames = {{
static constexpr int kX509NameFlagsRFC2253WithinUtf8JSON =
XN_FLAG_RFC2253 & ~ASN1_STRFLGS_ESC_MSB & ~ASN1_STRFLGS_ESC_CTRL;
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
template <typename Pointer>
bool GetPKeyBnParam(const EVP_PKEY* pkey, const char* name, Pointer* out) {
BIGNUM* bn = nullptr;
@@ -414,7 +400,7 @@ DataPointer DataPointer::SecureAlloc(size_t len) {
// free function (OPENSSL_secure_clear_free vs. OPENSSL_clear_free) and
// callers of isSecure() get a truthful answer.
return DataPointer(ptr, len, CRYPTO_secure_allocated(ptr) == 1);
-#else
+#elif defined(OPENSSL_IS_BORINGSSL)
// BoringSSL does not implement the OPENSSL_secure_zalloc API.
auto ptr = OPENSSL_malloc(len);
if (ptr == nullptr) return {};
@@ -518,9 +504,9 @@ namespace {
std::atomic<uint64_t> fips_state_generation{0};
bool isFipsEnabledRaw() {
-#if OPENSSL_VERSION_MAJOR >= 3
+#ifndef OPENSSL_IS_BORINGSSL
return EVP_default_properties_is_fips_enabled(nullptr) == 1;
-#else
+#elif defined(OPENSSL_IS_BORINGSSL)
return FIPS_mode() == 1;
#endif
}
@@ -535,10 +521,10 @@ bool setFipsEnabled(bool enable, CryptoErrorList* errors) {
const bool was_enabled = isFipsEnabled();
if (was_enabled == enable) return true;
ClearErrorOnReturn clearErrorOnReturn(errors);
-#if OPENSSL_VERSION_MAJOR >= 3
+#ifndef OPENSSL_IS_BORINGSSL
const bool success =
EVP_default_properties_enable_fips(nullptr, enable ? 1 : 0) == 1;
-#else
+#elif defined(OPENSSL_IS_BORINGSSL)
const bool success = FIPS_mode_set(enable ? 1 : 0) == 1;
#endif
if (success && isFipsEnabledRaw() != was_enabled) {
@@ -553,7 +539,7 @@ uint64_t getFipsStateGeneration() {
bool testFipsEnabled() {
ClearErrorOnReturn clear_error_on_return;
-#if OPENSSL_VERSION_MAJOR >= 3
+#ifndef OPENSSL_IS_BORINGSSL
OSSL_PROVIDER* fips_provider = nullptr;
if (OSSL_PROVIDER_available(nullptr, "fips")) {
fips_provider = OSSL_PROVIDER_load(nullptr, "fips");
@@ -562,7 +548,7 @@ bool testFipsEnabled() {
int result = OSSL_PROVIDER_self_test(fips_provider);
OSSL_PROVIDER_unload(fips_provider);
return result;
-#else
+#elif defined(OPENSSL_IS_BORINGSSL)
#ifdef OPENSSL_FIPS
return FIPS_selftest();
#else // OPENSSL_FIPS
@@ -735,7 +721,7 @@ int BignumPointer::isPrime(int nchecks,
},
&innerCb);
}
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
return BN_check_prime(get(), ctx.get(), cb.get());
#elif NCRYPTO_USE_BORINGSSL
int is_probably_prime = 0;
@@ -744,8 +730,6 @@ int BignumPointer::isPrime(int nchecks,
return -1;
}
return is_probably_prime;
-#else
- return BN_is_prime_ex(get(), nchecks, ctx.get(), cb.get());
#endif
}
@@ -815,11 +799,11 @@ bool CSPRNG(void* buffer, size_t length) {
auto buf = reinterpret_cast<unsigned char*>(buffer);
do {
if (1 == RAND_status()) {
-#if OPENSSL_VERSION_MAJOR >= 3
+#ifndef OPENSSL_IS_BORINGSSL
if (1 == RAND_bytes_ex(nullptr, buf, length, 0)) {
return true;
}
-#else
+#elif defined(OPENSSL_IS_BORINGSSL)
while (length > INT_MAX && 1 == RAND_bytes(buf, INT_MAX)) {
buf += INT_MAX;
length -= INT_MAX;
@@ -828,9 +812,9 @@ bool CSPRNG(void* buffer, size_t length) {
return true;
#endif
}
-#if OPENSSL_VERSION_MAJOR >= 3
+#ifndef OPENSSL_IS_BORINGSSL
const auto code = ERR_peek_last_error();
- // A misconfigured OpenSSL 3 installation may report 1 from RAND_poll()
+ // A misconfigured OpenSSL installation may report 1 from RAND_poll()
// and RAND_status() but fail in RAND_bytes() if it cannot look up
// a matching algorithm for the CSPRNG.
if (ERR_GET_LIB(code) == ERR_LIB_RAND) {
@@ -865,7 +849,7 @@ int PasswordCallback(char* buf, int size, int rwflag, void* u) {
return -1;
}
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
namespace {
struct StorePassphraseData {
Buffer<char> passphrase{.data = nullptr, .len = 0};
@@ -1186,9 +1170,9 @@ bool PrintGeneralName(const BIOPointer& out, const GENERAL_NAME* gen) {
}
}
} else {
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
return BIOPointer::PrintfAll(out, "<invalid length=%d>", ip_len);
-#else
+#elif NCRYPTO_USE_BORINGSSL
return BIOPointer::WriteAll(out, "<invalid>");
#endif
}
@@ -1204,14 +1188,14 @@ bool PrintGeneralName(const BIOPointer& out, const GENERAL_NAME* gen) {
return false;
}
// The format that is used here is based on OpenSSL's implementation of
- // GENERAL_NAME_print (as of OpenSSL 3.0.1). Earlier versions of Node.js
+ // GENERAL_NAME_print. Earlier versions of Node.js
// instead produced the same format as i2v_GENERAL_NAME, which was somewhat
// awkward, especially when passed to translatePeerCertificate.
bool unicode = true;
const char* prefix = nullptr;
- // OpenSSL 1.1.1 does not support othername in GENERAL_NAME_print and may
+ // BoringSSL does not support othername in GENERAL_NAME_print and may
// not define these NIDs.
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
int nid = OBJ_obj2nid(gen->d.otherName->type_id);
switch (nid) {
case NID_id_on_SmtpUTF8Mailbox:
@@ -1231,7 +1215,7 @@ bool PrintGeneralName(const BIOPointer& out, const GENERAL_NAME* gen) {
prefix = "NAIRealm";
break;
}
-#endif // NCRYPTO_USE_OPENSSL3_PROVIDER
+#endif // NCRYPTO_USE_OPENSSL_PROVIDER
int val_type = gen->d.otherName->value->type;
if (prefix == nullptr || (unicode && val_type != V_ASN1_UTF8STRING) ||
(!unicode && val_type != V_ASN1_IA5STRING)) {
@@ -1352,7 +1336,7 @@ bool SafeX509InfoAccessPrint(const BIOPointer& out, const X509_EXTENSION* ext) {
}
sk_ACCESS_DESCRIPTION_pop_free(descs, ACCESS_DESCRIPTION_free);
-#if NCRYPTO_USE_LEGACY_OPENSSL || NCRYPTO_USE_BORINGSSL
+#if NCRYPTO_USE_BORINGSSL
if (ok && !BIOPointer::WriteAll(out, "\n")) return false;
#endif
@@ -1780,9 +1764,9 @@ bool X509View::ifRsa(KeyCallback<Rsa> callback) const {
std::optional<Rsa> rsa;
{
MarkPopErrorOnReturn mark_pop_error_on_return;
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
rsa.emplace(pkey);
-#else
+#elif NCRYPTO_USE_BORINGSSL
rsa.emplace(EVP_PKEY_get0_RSA(pkey));
#endif
}
@@ -1805,9 +1789,9 @@ bool X509View::ifEc(KeyCallback<Ec> callback) const {
std::optional<Ec> ec;
{
MarkPopErrorOnReturn mark_pop_error_on_return;
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
ec.emplace(pkey);
-#else
+#elif NCRYPTO_USE_BORINGSSL
ec.emplace(EVP_PKEY_get0_EC_KEY(pkey));
#endif
}
@@ -1838,9 +1822,9 @@ X509Pointer X509Pointer::IssuerFrom(const SSL_CTX* ctx, const X509View& cert) {
}
X509Pointer X509Pointer::PeerFrom(const SSLPointer& ssl) {
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
return X509Pointer(SSL_get1_peer_certificate(ssl.get()));
-#else
+#elif NCRYPTO_USE_BORINGSSL
return X509Pointer(SSL_get_peer_certificate(ssl.get()));
#endif
}
@@ -1978,7 +1962,7 @@ bool BIOPointer::WriteAll(const BIOPointer& bio, std::string_view message) {
// DHPointer
namespace {
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
const char* GetOpenSSLDhGroupName(const std::string_view name,
DHPointer::FindGroupOption option) {
if (option != DHPointer::FindGroupOption::NO_SMALL_PRIMES &&
@@ -2055,7 +2039,7 @@ std::optional<int> CheckDhParams(const BIGNUM* p,
const BIGNUM* g,
const BIGNUM* q,
const BIGNUM* j) {
- // TODO(panva): In a semver-major, consider tightening OpenSSL 3 validation
+ // TODO(panva): In a semver-major, consider tightening OpenSSL validation
// to report generator and q failures as strictly as legacy DH_check().
if (p == nullptr || g == nullptr) return std::nullopt;
@@ -2143,7 +2127,7 @@ std::optional<int> CheckDhParams(const BIGNUM* p,
#endif
} // namespace
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
DHPointer::DHPointer(EVPKeyPointer&& key, const char* group_name)
: dh_(key.release()), group_name_(group_name) {}
@@ -2151,12 +2135,12 @@ DHPointer::DHPointer(BignumPointer&& p,
BignumPointer&& g,
const char* group_name)
: p_(std::move(p)), g_(std::move(g)), group_name_(group_name) {}
-#else
+#elif NCRYPTO_USE_BORINGSSL
DHPointer::DHPointer(DH* dh) : dh_(dh) {}
#endif
DHPointer::DHPointer(DHPointer&& other) noexcept
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
: dh_(other.dh_.release()),
p_(std::move(other.p_)),
g_(std::move(other.g_)),
@@ -2165,7 +2149,7 @@ DHPointer::DHPointer(DHPointer&& other) noexcept
group_name_(other.group_name_) {
other.group_name_ = nullptr;
}
-#else
+#elif NCRYPTO_USE_BORINGSSL
: dh_(other.release()) {
}
#endif
@@ -2181,14 +2165,14 @@ DHPointer::~DHPointer() {
}
void DHPointer::reset(
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
EVP_PKEY* dh
-#else
+#elif NCRYPTO_USE_BORINGSSL
DH* dh
#endif
) {
dh_.reset(dh);
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
p_.reset();
g_.reset();
pub_key_.reset();
@@ -2197,7 +2181,7 @@ void DHPointer::reset(
#endif
}
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
EVP_PKEY* DHPointer::release() {
if (!dh_ && p_ && g_) {
auto pkey =
@@ -2214,7 +2198,7 @@ EVP_PKEY* DHPointer::release() {
group_name_ = nullptr;
return dh_.release();
}
-#else
+#elif NCRYPTO_USE_BORINGSSL
DH* DHPointer::release() {
return dh_.release();
}
@@ -2256,10 +2240,10 @@ DHPointer DHPointer::FromGroup(const std::string_view name,
auto generator = GetStandardGenerator();
if (!generator) return {}; // Unable to create the generator.
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
const char* group_name = GetOpenSSLDhGroupName(name, option);
return DHPointer(std::move(group), std::move(generator), group_name);
-#else
+#elif NCRYPTO_USE_BORINGSSL
return New(std::move(group), std::move(generator));
#endif
}
@@ -2267,11 +2251,11 @@ DHPointer DHPointer::FromGroup(const std::string_view name,
DHPointer DHPointer::New(BignumPointer&& p, BignumPointer&& g) {
if (!p || !g) return {};
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
auto pkey = NewDhPKey(p.get(), g.get());
if (!pkey) return {};
return DHPointer(std::move(pkey));
-#else
+#elif NCRYPTO_USE_BORINGSSL
DHPointer dh(DH_new());
if (!dh) return {};
@@ -2290,7 +2274,7 @@ DHPointer DHPointer::New(BignumPointer&& p, BignumPointer&& g) {
}
DHPointer DHPointer::New(size_t bits, unsigned int generator) {
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
auto param_ctx = EVPKeyCtxPointer::NewFromAlgorithm(KeyAlgorithm::DH);
if (!param_ctx.initForParamgen() ||
!param_ctx.setDhParameters(bits, generator)) {
@@ -2300,7 +2284,7 @@ DHPointer DHPointer::New(size_t bits, unsigned int generator) {
auto key_params = param_ctx.paramgen();
if (!key_params) return {};
return DHPointer(std::move(key_params));
-#else
+#elif NCRYPTO_USE_BORINGSSL
DHPointer dh(DH_new());
if (!dh) return {};
@@ -2315,7 +2299,7 @@ DHPointer DHPointer::New(size_t bits, unsigned int generator) {
DHPointer::CheckResult DHPointer::check() {
ClearErrorOnReturn clearErrorOnReturn;
if (!*this) return DHPointer::CheckResult::NONE;
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
// TODO(panva): In a semver-major, consider validating named DH groups
// through the provider instead of preserving the historical verifyError.
if (group_name_ != nullptr) return CheckResult::NONE;
@@ -2343,7 +2327,7 @@ DHPointer::CheckResult DHPointer::check() {
auto codes = CheckDhParams(p_bn, g_bn, q_bn, j_bn);
if (!codes) return DHPointer::CheckResult::CHECK_FAILED;
return static_cast<CheckResult>(*codes);
-#else
+#elif NCRYPTO_USE_BORINGSSL
int codes = 0;
if (DH_check(dh_.get(), &codes) != 1)
return DHPointer::CheckResult::CHECK_FAILED;
@@ -2357,7 +2341,7 @@ DHPointer::CheckPublicKeyResult DHPointer::checkPublicKey(
if (!pub_key || !*this) {
return DHPointer::CheckPublicKeyResult::CHECK_FAILED;
}
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
DeleteFnPtr<BIGNUM, BN_free> p;
DeleteFnPtr<BIGNUM, BN_free> g;
const BIGNUM* p_bn = p_.get();
@@ -2405,7 +2389,7 @@ DHPointer::CheckPublicKeyResult DHPointer::checkPublicKey(
return DHPointer::CheckPublicKeyResult::INVALID;
}
return CheckPublicKeyResult::NONE;
-#else
+#elif NCRYPTO_USE_BORINGSSL
int codes = 0;
if (DH_check_pub_key(dh_.get(), pub_key.get(), &codes) != 1) {
return DHPointer::CheckPublicKeyResult::CHECK_FAILED;
@@ -2424,14 +2408,14 @@ DHPointer::CheckPublicKeyResult DHPointer::checkPublicKey(
DataPointer DHPointer::getPrime() const {
if (!*this) return {};
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
if (p_) return p_.encode();
DeleteFnPtr<BIGNUM, BN_free> p;
DeleteFnPtr<BIGNUM, BN_free> g;
if (!GetDhParams(dh_.get(), &p, &g)) return {};
return BignumPointer::Encode(p.get());
-#else
+#elif NCRYPTO_USE_BORINGSSL
const BIGNUM* p;
DH_get0_pqg(dh_.get(), &p, nullptr, nullptr);
return BignumPointer::Encode(p);
@@ -2440,14 +2424,14 @@ DataPointer DHPointer::getPrime() const {
size_t DHPointer::getPrimeBits() const {
if (!*this) return 0;
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
if (p_) return BignumPointer::GetBitCount(p_.get());
DeleteFnPtr<BIGNUM, BN_free> p;
DeleteFnPtr<BIGNUM, BN_free> g;
if (!GetDhParams(dh_.get(), &p, &g)) return 0;
return BignumPointer::GetBitCount(p.get());
-#else
+#elif NCRYPTO_USE_BORINGSSL
const BIGNUM* p;
DH_get0_pqg(dh_.get(), &p, nullptr, nullptr);
return BignumPointer::GetBitCount(p);
@@ -2456,14 +2440,14 @@ size_t DHPointer::getPrimeBits() const {
DataPointer DHPointer::getGenerator() const {
if (!*this) return {};
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
if (g_) return g_.encode();
DeleteFnPtr<BIGNUM, BN_free> p;
DeleteFnPtr<BIGNUM, BN_free> g;
if (!GetDhParams(dh_.get(), &p, &g)) return {};
return BignumPointer::Encode(g.get());
-#else
+#elif NCRYPTO_USE_BORINGSSL
const BIGNUM* g;
DH_get0_pqg(dh_.get(), nullptr, nullptr, &g);
return BignumPointer::Encode(g);
@@ -2472,14 +2456,14 @@ DataPointer DHPointer::getGenerator() const {
DataPointer DHPointer::getPublicKey() const {
if (!*this) return {};
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
if (pub_key_) return pub_key_.encode();
if (!dh_) return {};
DeleteFnPtr<BIGNUM, BN_free> pub_key;
if (!GetDhKeys(dh_.get(), &pub_key, nullptr)) return {};
return BignumPointer::Encode(pub_key.get());
-#else
+#elif NCRYPTO_USE_BORINGSSL
const BIGNUM* pub_key;
DH_get0_key(dh_.get(), &pub_key, nullptr);
return BignumPointer::Encode(pub_key);
@@ -2488,14 +2472,14 @@ DataPointer DHPointer::getPublicKey() const {
DataPointer DHPointer::getPrivateKey() const {
if (!*this) return {};
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
if (pvt_key_) return pvt_key_.encode();
if (!dh_) return {};
DeleteFnPtr<BIGNUM, BN_clear_free> pvt_key;
if (!GetDhKeys(dh_.get(), nullptr, &pvt_key)) return {};
return BignumPointer::Encode(pvt_key.get());
-#else
+#elif NCRYPTO_USE_BORINGSSL
const BIGNUM* pvt_key;
DH_get0_key(dh_.get(), nullptr, &pvt_key);
return BignumPointer::Encode(pvt_key);
@@ -2504,14 +2488,14 @@ DataPointer DHPointer::getPrivateKey() const {
bool DHPointer::hasPrivateKey() const {
if (!*this) return false;
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
if (pvt_key_) return true;
if (!dh_) return false;
DeleteFnPtr<BIGNUM, BN_clear_free> pvt_key;
if (!GetDhKeys(dh_.get(), nullptr, &pvt_key)) return false;
return pvt_key != nullptr;
-#else
+#elif NCRYPTO_USE_BORINGSSL
const BIGNUM* pvt_key = nullptr;
DH_get0_key(dh_.get(), nullptr, &pvt_key);
return pvt_key != nullptr;
@@ -2522,7 +2506,7 @@ DataPointer DHPointer::generateKeys() {
ClearErrorOnReturn clearErrorOnReturn;
if (!*this) return {};
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
if (p_ && g_) {
if (!pvt_key_ && !GenerateDhPrivateKey(&pvt_key_, p_.get(), group_name_)) {
return {};
@@ -2579,7 +2563,7 @@ DataPointer DHPointer::generateKeys() {
if (EVP_PKEY_keygen(ctx.get(), &generated) != 1) return {};
dh_.reset(generated);
return getPublicKey();
-#else
+#elif NCRYPTO_USE_BORINGSSL
// Key generation failed
if (!DH_generate_key(dh_.get())) return {};
@@ -2589,12 +2573,12 @@ DataPointer DHPointer::generateKeys() {
size_t DHPointer::size() const {
if (!*this) return 0;
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
if (p_) return BignumPointer::GetByteCount(p_.get());
const int bits = EVP_PKEY_get_bits(dh_.get());
return bits > 0 ? (static_cast<size_t>(bits) + 7) / 8 : 0;
-#else
+#elif NCRYPTO_USE_BORINGSSL
int ret = DH_size(dh_.get());
// DH_size can return a -1 on error but we just want to return a 0
// in that case so we don't wrap around when returning the size_t.
@@ -2606,7 +2590,7 @@ DataPointer DHPointer::computeSecret(const BignumPointer& peer) const {
ClearErrorOnReturn clearErrorOnReturn;
if (!*this || !peer) return {};
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
if (p_ && pvt_key_) {
auto secret = BignumPointer::NewSecure();
BignumCtxPointer ctx(BN_CTX_new());
@@ -2651,7 +2635,7 @@ DataPointer DHPointer::computeSecret(const BignumPointer& peer) const {
return {};
}
return dp.resize(out_size);
-#else
+#elif NCRYPTO_USE_BORINGSSL
auto dp = DataPointer::Alloc(size());
if (!dp) return {};
@@ -2674,7 +2658,7 @@ DataPointer DHPointer::computeSecret(const BignumPointer& peer) const {
bool DHPointer::setPublicKey(BignumPointer&& key) {
if (!*this) return false;
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
if (p_ && g_) {
pub_key_ = std::move(key);
return true;
@@ -2696,7 +2680,7 @@ bool DHPointer::setPublicKey(BignumPointer&& key) {
if (!pkey) return false;
dh_.reset(pkey.release());
return true;
-#else
+#elif NCRYPTO_USE_BORINGSSL
if (DH_set0_key(dh_.get(), key.get(), nullptr) == 1) {
// If DH_set0_key returns successfully, then dh_ takes ownership of the
// BIGNUM, so we must release it here. Unfortunately coverity does not
@@ -2711,7 +2695,7 @@ bool DHPointer::setPublicKey(BignumPointer&& key) {
bool DHPointer::setPrivateKey(BignumPointer&& key) {
if (!*this) return false;
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
if (p_ && g_) {
pvt_key_ = std::move(key);
return true;
@@ -2733,7 +2717,7 @@ bool DHPointer::setPrivateKey(BignumPointer&& key) {
if (!pkey) return false;
dh_.reset(pkey.release());
return true;
-#else
+#elif NCRYPTO_USE_BORINGSSL
if (DH_set0_key(dh_.get(), nullptr, key.get()) == 1) {
// If DH_set0_key returns successfully, then dh_ takes ownership of the
// BIGNUM, so we must release it here. Unfortunately coverity does not
@@ -2755,7 +2739,7 @@ DataPointer DHPointer::stateless(const EVPKeyPointer& ourKey,
if (!ctx || EVP_PKEY_derive_init(ctx.get()) <= 0) {
return {};
}
- // TODO(panva): In a semver-major, consider padding OpenSSL 3 DH derivation
+ // TODO(panva): In a semver-major, consider padding OpenSSL DH derivation
// results here to match DiffieHellman::computeSecret().
if (EVP_PKEY_derive_set_peer(ctx.get(), theirKey.get()) <= 0 ||
EVP_PKEY_derive(ctx.get(), nullptr, &out_size) <= 0) {
@@ -2783,7 +2767,7 @@ DataPointer DHPointer::stateless(const EVPKeyPointer& ourKey,
// ============================================================================
// KDF
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
KDF::KDF(EVP_KDF* kdf) : kdf_(kdf) {}
KDF KDF::Fetch(const char* algorithm, OSSL_LIB_CTX* libctx) {
@@ -2799,11 +2783,6 @@ bool KDF::derive(const Buffer<unsigned char>& out,
#endif
const EVP_MD* getDigestByName(const char* name) {
- // Historically, "dss1" and "DSS1" were DSA aliases for SHA-1
- // exposed through the public API.
- if (strcmp(name, "dss1") == 0 || strcmp(name, "DSS1") == 0) [[unlikely]] {
- return EVP_sha1();
- }
#if NCRYPTO_USE_BORINGSSL
// BoringSSL exposes SHA-3 through EVP_MD descriptors without registering
// their names or assigning them NIDs.
@@ -2842,9 +2821,9 @@ DataPointer hkdf(const Digest& md,
actual_salt = {default_salt, static_cast<unsigned>(md.size())};
}
- // Keep extraction as a one-shot HMAC. The legacy path requires it because
- // EVP_PKEY_derive rejects the zero-length keys Web Crypto allows. Both
- // backends expand a pseudorandom key of exactly one digest block.
+ // Keep extraction as a one-shot HMAC because BoringSSL's EVP_PKEY_derive
+ // rejects the zero-length keys Web Crypto allows. Both backends expand a
+ // pseudorandom key of exactly one digest block.
unsigned char pseudorandom_key[EVP_MAX_MD_SIZE];
unsigned pseudorandom_key_len = sizeof(pseudorandom_key);
@@ -2861,7 +2840,7 @@ DataPointer hkdf(const Digest& md,
auto buf = DataPointer::Alloc(length);
if (!buf) return {};
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
// Expand through EVP_KDF directly. The EVP_PKEY_HKDF interface reaches the
// same provider implementation, but only after allocating a second context
// and translating every parameter across the legacy bridge.
@@ -2888,13 +2867,10 @@ DataPointer hkdf(const Digest& md,
if (!kdf.derive({buf.get<unsigned char>(), length}, params.data())) {
return {};
}
-#else
+#elif NCRYPTO_USE_BORINGSSL
auto ctx = EVPKeyCtxPointer::NewFromName("HKDF");
- // OpenSSL < 3.0.0 accepted only a void* as the argument of
- // EVP_PKEY_CTX_set_hkdf_md.
- const EVP_MD* md_ptr = md;
if (!ctx || !EVP_PKEY_derive_init(ctx.get()) ||
- !EVP_PKEY_CTX_set_hkdf_md(ctx.get(), md_ptr) ||
+ !EVP_PKEY_CTX_set_hkdf_md(ctx.get(), md) ||
!EVP_PKEY_CTX_add1_hkdf_info(ctx.get(), info.data, info.len) ||
!EVP_PKEY_CTX_hkdf_mode(ctx.get(), EVP_PKEY_HKDEF_MODE_EXPAND_ONLY) ||
!EVP_PKEY_CTX_set1_hkdf_key(
@@ -2911,7 +2887,7 @@ DataPointer hkdf(const Digest& md,
return buf;
}
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
namespace {
bool ScryptDerive(const Buffer<const char>& pass,
const Buffer<const unsigned char>& salt,
@@ -2956,10 +2932,10 @@ bool ScryptDerive(const Buffer<const char>& pass,
#endif
bool checkScryptParams(uint64_t N, uint64_t r, uint64_t p, uint64_t maxmem) {
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
// A null output validates the parameters without deriving a key.
return ScryptDerive({nullptr, 0}, {nullptr, 0}, N, r, p, maxmem, nullptr, 0);
-#else
+#elif NCRYPTO_USE_BORINGSSL
return EVP_PBE_scrypt(nullptr, 0, nullptr, 0, N, r, p, maxmem, nullptr, 0) ==
1;
#endif
@@ -2977,10 +2953,10 @@ DataPointer scrypt(const Buffer<const char>& pass,
}
auto dp = DataPointer::Alloc(length);
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
if (dp && ScryptDerive(
pass, salt, N, r, p, maxmem, dp.get<unsigned char>(), length)) {
-#else
+#elif NCRYPTO_USE_BORINGSSL
if (dp && EVP_PBE_scrypt(pass.data,
pass.len,
salt.data,
@@ -3008,7 +2984,7 @@ DataPointer pbkdf2(const Digest& md,
}
auto dp = DataPointer::Alloc(length);
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
if (!dp) return {};
auto kdf = KDF::Fetch(OSSL_KDF_NAME_PBKDF2);
if (!kdf) return {};
@@ -3045,7 +3021,7 @@ DataPointer pbkdf2(const Digest& md,
if (kdf.derive({dp.get<unsigned char>(), length}, params)) {
return dp;
}
-#else
+#elif NCRYPTO_USE_BORINGSSL
const EVP_MD* md_ptr = md;
if (dp && PKCS5_PBKDF2_HMAC(pass.data,
pass.len,
@@ -3221,7 +3197,7 @@ const KeyAlgorithm KeyAlgorithm::SLH_DSA_SHAKE_256S("SLH-DSA-SHAKE-256s", Family
// clang-format on
namespace {
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
constexpr char kSignatureContextString[] = "context-string";
constexpr char kSignatureInstance[] = "instance";
#endif
@@ -3298,75 +3274,61 @@ size_t KeyAlgorithm::seedSize() const {
}
namespace {
-#if !NCRYPTO_USE_OPENSSL3_PROVIDER
-struct LegacyKeyAlgorithm {
+#if NCRYPTO_USE_BORINGSSL
+struct BoringSSLKeyAlgorithm {
const char* name;
int id;
-#if NCRYPTO_USE_BORINGSSL
const EVP_PKEY_ALG* (*raw_key_algorithm)() = nullptr;
-#endif
};
-// These backends require native key IDs. BoringSSL also uses EVP_PKEY_ALG
-// descriptors for raw keys; keep both adapters in the same table.
+// BoringSSL requires native key IDs and EVP_PKEY_ALG descriptors for raw keys;
+// keep both adapters in the same table.
// clang-format off
// NOLINTBEGIN(whitespace/line_length)
-const LegacyKeyAlgorithm kLegacyKeyAlgorithms[] = {
+const BoringSSLKeyAlgorithm kBoringSSLKeyAlgorithms[] = {
{KeyAlgorithm::RSA.name(), EVP_PKEY_RSA},
{KeyAlgorithm::RSA_PSS.name(), EVP_PKEY_RSA_PSS},
{KeyAlgorithm::DSA.name(), EVP_PKEY_DSA},
{KeyAlgorithm::DH.name(), EVP_PKEY_DH},
{KeyAlgorithm::EC.name(), EVP_PKEY_EC},
-#if NCRYPTO_USE_BORINGSSL
{KeyAlgorithm::ED25519.name(), EVP_PKEY_ED25519, EVP_pkey_ed25519},
{KeyAlgorithm::X25519.name(), EVP_PKEY_X25519, EVP_pkey_x25519},
-#else
- {KeyAlgorithm::ED25519.name(), EVP_PKEY_ED25519},
- {KeyAlgorithm::X25519.name(), EVP_PKEY_X25519},
-#endif
{"HKDF", EVP_PKEY_HKDF},
{KeyAlgorithm::ED448.name(), EVP_PKEY_ED448},
{KeyAlgorithm::X448.name(), EVP_PKEY_X448},
-#ifndef OPENSSL_NO_SM2
- {KeyAlgorithm::SM2.name(), EVP_PKEY_SM2},
-#endif
-#if NCRYPTO_USE_BORINGSSL
{KeyAlgorithm::ML_DSA_44.name(), EVP_PKEY_ML_DSA_44, EVP_pkey_ml_dsa_44},
{KeyAlgorithm::ML_DSA_65.name(), EVP_PKEY_ML_DSA_65, EVP_pkey_ml_dsa_65},
{KeyAlgorithm::ML_DSA_87.name(), EVP_PKEY_ML_DSA_87, EVP_pkey_ml_dsa_87},
{KeyAlgorithm::ML_KEM_768.name(), EVP_PKEY_ML_KEM_768, EVP_pkey_ml_kem_768},
{KeyAlgorithm::ML_KEM_1024.name(), EVP_PKEY_ML_KEM_1024, EVP_pkey_ml_kem_1024},
-#endif
};
// NOLINTEND(whitespace/line_length)
// clang-format on
-const LegacyKeyAlgorithm* FindLegacyKeyAlgorithm(const char* name) {
+const BoringSSLKeyAlgorithm* FindBoringSSLKeyAlgorithm(const char* name) {
if (name == nullptr) return nullptr;
- for (const auto& algorithm : kLegacyKeyAlgorithms) {
+ for (const auto& algorithm : kBoringSSLKeyAlgorithms) {
if (CaseInsensitiveNameEqual()(name, algorithm.name)) return &algorithm;
}
return nullptr;
}
-int GetLegacyKeyId(const char* name) {
- const auto* algorithm = FindLegacyKeyAlgorithm(name);
+int GetBoringSSLKeyId(const char* name) {
+ const auto* algorithm = FindBoringSSLKeyAlgorithm(name);
return algorithm == nullptr ? NID_undef : algorithm->id;
}
-#if NCRYPTO_USE_BORINGSSL
const EVP_PKEY_ALG* GetBoringSSLKeyAlgorithm(const KeyAlgorithm& algorithm) {
- const auto* entry = FindLegacyKeyAlgorithm(algorithm.name());
+ const auto* entry = FindBoringSSLKeyAlgorithm(algorithm.name());
return entry != nullptr && entry->raw_key_algorithm != nullptr
? entry->raw_key_algorithm()
: nullptr;
}
#endif
-#endif
} // namespace
void ConfigurePqcEncoding() {
-#if NCRYPTO_USE_OPENSSL3_PROVIDER && OPENSSL_VERSION_PREREQ(3, 5)
+#if NCRYPTO_USE_OPENSSL_PROVIDER && OPENSSL_VERSION_PREREQ(3, 5)
// Configure all loaded providers to prefer seed-only format for ML-KEM and
// ML-DSA private keys in PKCS#8 export, falling back to priv-only when a
// seed is not available. The provider encoder reads these parameters at
@@ -3395,35 +3357,25 @@ EVPKeyPointer EVPKeyPointer::New() {
EVPKeyPointer EVPKeyPointer::NewRawPublic(
const KeyAlgorithm& algorithm, const Buffer<const unsigned char>& data) {
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
return EVPKeyPointer(EVP_PKEY_new_raw_public_key_ex(
nullptr, algorithm.name(), nullptr, data.data, data.len));
#elif NCRYPTO_USE_BORINGSSL
const auto* alg = GetBoringSSLKeyAlgorithm(algorithm);
if (alg == nullptr) return {};
return EVPKeyPointer(EVP_PKEY_from_raw_public_key(alg, data.data, data.len));
-#else
- const int id = GetLegacyKeyId(algorithm.name());
- if (id == NID_undef) return {};
- return EVPKeyPointer(
- EVP_PKEY_new_raw_public_key(id, nullptr, data.data, data.len));
#endif
}
EVPKeyPointer EVPKeyPointer::NewRawPrivate(
const KeyAlgorithm& algorithm, const Buffer<const unsigned char>& data) {
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
return EVPKeyPointer(EVP_PKEY_new_raw_private_key_ex(
nullptr, algorithm.name(), nullptr, data.data, data.len));
#elif NCRYPTO_USE_BORINGSSL
const auto* alg = GetBoringSSLKeyAlgorithm(algorithm);
if (alg == nullptr) return {};
return EVPKeyPointer(EVP_PKEY_from_raw_private_key(alg, data.data, data.len));
-#else
- const int id = GetLegacyKeyId(algorithm.name());
- if (id == NID_undef) return {};
- return EVPKeyPointer(
- EVP_PKEY_new_raw_private_key(id, nullptr, data.data, data.len));
#endif
}
@@ -3435,7 +3387,7 @@ EVPKeyPointer EVPKeyPointer::NewRawSeed(
if (seed_alg == nullptr) return {};
return EVPKeyPointer(
EVP_PKEY_from_private_seed(seed_alg, data.data, data.len));
-#elif NCRYPTO_USE_OPENSSL3_PROVIDER
+#else
// ML-DSA and ML-KEM both use the provider parameter "seed".
OSSL_PARAM params[] = {
OSSL_PARAM_construct_octet_string(
@@ -3449,16 +3401,14 @@ EVPKeyPointer EVPKeyPointer::NewRawSeed(
return {};
}
return EVPKeyPointer(pkey);
-#else
- return {};
#endif
}
EVPKeyPointer EVPKeyPointer::NewDH(DHPointer&& dh) {
if (!dh) return {};
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
return EVPKeyPointer(dh.release());
-#else
+#elif NCRYPTO_USE_BORINGSSL
auto key = New();
if (!key) return {};
if (EVP_PKEY_assign_DH(key.get(), dh.get())) {
@@ -3468,7 +3418,7 @@ EVPKeyPointer EVPKeyPointer::NewDH(DHPointer&& dh) {
#endif
}
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
EVPKeyPointer EVPKeyPointer::NewRSA(const Rsa& rsa) {
const auto public_key = rsa.getPublicKey();
if (public_key.n == nullptr || public_key.e == nullptr) return {};
@@ -3522,7 +3472,7 @@ EVPKeyPointer EVPKeyPointer::NewRSA(const Rsa& rsa) {
if (!params) return {};
return NewPKeyFromData(KeyAlgorithm::RSA, selection, params.get());
}
-#else
+#elif NCRYPTO_USE_BORINGSSL
EVPKeyPointer EVPKeyPointer::NewRSA(RSAPointer&& rsa) {
if (!rsa) return {};
auto key = New();
@@ -3532,7 +3482,7 @@ EVPKeyPointer EVPKeyPointer::NewRSA(RSAPointer&& rsa) {
}
return key;
}
-#endif // NCRYPTO_USE_OPENSSL3_PROVIDER
+#endif // NCRYPTO_USE_OPENSSL_PROVIDER
EVPKeyPointer::EVPKeyPointer(EVP_PKEY* pkey) : pkey_(pkey) {}
@@ -3559,12 +3509,12 @@ EVP_PKEY* EVPKeyPointer::release() {
bool EVPKeyPointer::isA(const EVP_PKEY* key, const char* name) {
if (key == nullptr || name == nullptr) return false;
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
// EVP_PKEY_is_a() can match an untyped key to an unknown legacy name.
return EVP_PKEY_get0_type_name(key) != nullptr &&
EVP_PKEY_is_a(key, name) == 1;
-#else
- const int id = GetLegacyKeyId(name);
+#elif NCRYPTO_USE_BORINGSSL
+ const int id = GetBoringSSLKeyId(name);
return id != NID_undef && EVP_PKEY_id(key) == id;
#endif
}
@@ -3572,13 +3522,12 @@ bool EVPKeyPointer::isA(const EVP_PKEY* key, const char* name) {
// Returns true unless the key is known not to be SM2, so that a key whose curve
// cannot be determined opts out of the prehashed fallback rather than into it.
bool EVPKeyPointer::mayBeSM2() const {
-#ifdef OPENSSL_NO_SM2
+#if defined(OPENSSL_IS_BORINGSSL) || defined(OPENSSL_NO_SM2)
return false;
#else
if (isA(KeyAlgorithm::SM2)) return true;
if (!isA(KeyAlgorithm::EC)) return false;
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
// An ECKeyPointer would also need the public point, which a provider-backed
// key need not expose.
char group_name[64];
@@ -3592,14 +3541,6 @@ bool EVPKeyPointer::mayBeSM2() const {
}
return OBJ_sn2nid(group_name) == NID_sm2 ||
EC_curve_nist2nid(group_name) == NID_sm2;
-#else
- ECKeyPointer ec(*this);
- if (!ec) return true;
-
- const EC_GROUP* group = ec.getGroup();
- if (group == nullptr) return true;
- return EC_GROUP_get_curve_name(group) == NID_sm2;
-#endif
#endif
}
@@ -3617,7 +3558,7 @@ bool EVPKeyPointer::isA(const KeyAlgorithm& algorithm) const {
const KeyAlgorithm* EVPKeyPointer::getAlgorithm() const {
if (!pkey_) return nullptr;
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
// Provider primary names identify algorithms. Legacy ASN.1 methods can
// share names (for example, SM2 uses EC), so resolve those through isA().
// The fallback also handles providers with a noncanonical primary alias.
@@ -3630,9 +3571,9 @@ const KeyAlgorithm* EVPKeyPointer::getAlgorithm() const {
for (const auto* algorithm : kKeyAlgorithms) {
if (isA(*algorithm)) return algorithm;
}
-#else
+#elif NCRYPTO_USE_BORINGSSL
const int id = EVP_PKEY_id(get());
- for (const auto& algorithm : kLegacyKeyAlgorithms) {
+ for (const auto& algorithm : kBoringSSLKeyAlgorithms) {
if (id == algorithm.id) return KeyAlgorithm::FromName(algorithm.name);
}
#endif
@@ -3657,7 +3598,7 @@ bool EVPKeyPointer::supportsRawPrivate() const {
bool EVPKeyPointer::supportsContextString() const {
const auto* algorithm = getAlgorithm();
if (algorithm == nullptr || !algorithm->isOneShot()) return false;
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
MarkPopErrorOnReturn mark_pop_error_on_return;
DeleteFnPtr<EVP_SIGNATURE, EVP_SIGNATURE_free> signature(
EVP_SIGNATURE_fetch(nullptr, EVP_PKEY_get0_type_name(get()), nullptr));
@@ -3669,8 +3610,6 @@ bool EVPKeyPointer::supportsContextString() const {
OSSL_PARAM_locate_const(params, kSignatureInstance) != nullptr);
#elif NCRYPTO_USE_BORINGSSL
return algorithm->isPqc();
-#else
- return false;
#endif
}
@@ -3849,21 +3788,17 @@ DataPointer EVPKeyPointer::rawPublicKey() const {
}
namespace {
-DataPointer GetRawSeed([[maybe_unused]] EVP_PKEY* key, size_t seed_len) {
+DataPointer GetRawSeed(EVP_PKEY* key, size_t seed_len) {
auto data = DataPointer::Alloc(seed_len);
if (!data) return {};
-#if NCRYPTO_USE_BORINGSSL || NCRYPTO_USE_OPENSSL3_PROVIDER
const Buffer<unsigned char> buf = data;
size_t len = data.size();
-#endif
#if NCRYPTO_USE_BORINGSSL
if (EVP_PKEY_get_private_seed(key, buf.data, &len) != 1) return {};
-#elif NCRYPTO_USE_OPENSSL3_PROVIDER
+#else
if (EVP_PKEY_get_octet_string_param(key, "seed", buf.data, buf.len, &len) !=
1)
return {};
-#else
- return {};
#endif
return data;
}
@@ -3941,16 +3876,16 @@ BIOPointer EVPKeyPointer::derPublicKey() const {
bool EVPKeyPointer::assign(const ECKeyPointer& eckey) {
if (!pkey_ || !eckey) return {};
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
return set(eckey);
-#else
+#elif NCRYPTO_USE_BORINGSSL
return EVP_PKEY_assign_EC_KEY(pkey_.get(), eckey.get());
#endif
}
bool EVPKeyPointer::set(const ECKeyPointer& eckey) {
if (!pkey_ || !eckey) return false;
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
const int nid = EC_GROUP_get_curve_name(eckey.group_.get());
const char* group_name = OBJ_nid2sn(nid);
if (group_name == nullptr) return false;
@@ -4007,7 +3942,7 @@ bool EVPKeyPointer::set(const ECKeyPointer& eckey) {
if (!pkey) return false;
reset(pkey.release());
return true;
-#else
+#elif NCRYPTO_USE_BORINGSSL
return EVP_PKEY_set1_EC_KEY(pkey_.get(), eckey);
#endif
}
@@ -4022,7 +3957,7 @@ EVPKeyPointer::operator const EC_KEY*() const {
namespace {
EVP_PKEY* DecodeRsaPublicKey(const unsigned char** data, size_t length) {
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
// Borrow the EVP_PKEY constructor and its data from a context that stays
// alive until after the restricted decoder context is destroyed.
EVP_PKEY* raw = nullptr;
@@ -4057,7 +3992,7 @@ EVP_PKEY* DecodeRsaPublicKey(const unsigned char** data, size_t length) {
const int result = OSSL_DECODER_from_data(ctx.get(), data, &length);
EVPKeyPointer key(raw);
return result == 1 ? key.release() : nullptr;
-#else
+#elif NCRYPTO_USE_BORINGSSL
return d2i_PublicKey(NID_rsaEncryption, nullptr, data, length);
#endif
}
@@ -4231,7 +4166,7 @@ Buffer<char> GetPassphrase(
return pass;
}
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
using OSSLEncoderCtxPointer =
DeleteFnPtr<OSSL_ENCODER_CTX, OSSL_ENCODER_CTX_free>;
@@ -4397,7 +4332,7 @@ EVPKeyPointer::ParseKeyResult EVPKeyPointer::TryParsePrivateKey(
EVPKeyPointer::ParseKeyResult EVPKeyPointer::TryLoadPrivateKeyFromStore(
const StorePrivateKeyConfig& config) {
-#if !NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_BORINGSSL
return ParseKeyResult(PKParseError::FAILED);
#else
// The error queue is left populated on failure so the caller can surface a
@@ -4508,7 +4443,7 @@ Result<BIOPointer, bool> EVPKeyPointer::writePrivateKey(
// PKCS1 is only permitted for RSA keys.
if (!isA(KeyAlgorithm::RSA)) return Result<BIOPointer, bool>(false);
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
const EVP_CIPHER* cipher =
config.format == PKFormatType::PEM ? config.cipher.get() : nullptr;
if (cipher != nullptr && passphrase.len == 0) {
@@ -4523,12 +4458,8 @@ Result<BIOPointer, bool> EVPKeyPointer::writePrivateKey(
cipher,
passphrase);
}
-#else
-#if OPENSSL_VERSION_MAJOR >= 3
- const RSA* rsa = EVP_PKEY_get0_RSA(get());
-#else
+#elif NCRYPTO_USE_BORINGSSL
RSA* rsa = EVP_PKEY_get0_RSA(get());
-#endif
if (rsa == nullptr) return Result<BIOPointer, bool>(false);
switch (config.format) {
@@ -4558,7 +4489,7 @@ Result<BIOPointer, bool> EVPKeyPointer::writePrivateKey(
}
case PKEncodingType::PKCS8: {
EVP_PKEY* export_key = get();
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
// OpenSSL's provider EC PKCS8 encoders temporarily change encoding flags.
// Use an independent key so concurrent exports do not change the source.
EVPKeyPointer key_copy;
@@ -4605,7 +4536,7 @@ Result<BIOPointer, bool> EVPKeyPointer::writePrivateKey(
// SEC1 is only permitted for EC keys
if (!isA(KeyAlgorithm::EC)) return Result<BIOPointer, bool>(false);
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
const EVP_CIPHER* cipher =
config.format == PKFormatType::PEM ? config.cipher.get() : nullptr;
err = !WriteEncodedPKey(bio.get(),
@@ -4615,12 +4546,8 @@ Result<BIOPointer, bool> EVPKeyPointer::writePrivateKey(
"type-specific",
cipher,
passphrase);
-#else
-#if OPENSSL_VERSION_MAJOR >= 3
- const EC_KEY* ec = EVP_PKEY_get0_EC_KEY(get());
-#else
+#elif NCRYPTO_USE_BORINGSSL
EC_KEY* ec = EVP_PKEY_get0_EC_KEY(get());
-#endif
if (ec == nullptr) return Result<BIOPointer, bool>(false);
switch (config.format) {
@@ -4672,7 +4599,7 @@ Result<BIOPointer, bool> EVPKeyPointer::writePublicKey(
if (config.type == ncrypto::EVPKeyPointer::PKEncodingType::PKCS1) {
// PKCS#1 is only valid for RSA keys.
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
if (!isA(KeyAlgorithm::RSA)) return Result<BIOPointer, bool>(false);
if (!WriteEncodedPKey(bio.get(),
get(),
@@ -4683,12 +4610,8 @@ Result<BIOPointer, bool> EVPKeyPointer::writePublicKey(
mark_pop_error_on_return.peekError());
}
return bio;
-#else
-#if OPENSSL_VERSION_MAJOR >= 3
- const RSA* rsa = EVP_PKEY_get0_RSA(get());
-#else
+#elif NCRYPTO_USE_BORINGSSL
RSA* rsa = EVP_PKEY_get0_RSA(get());
-#endif
if (rsa == nullptr) return Result<BIOPointer, bool>(false);
if (config.format == ncrypto::EVPKeyPointer::PKFormatType::PEM) {
@@ -4709,7 +4632,7 @@ Result<BIOPointer, bool> EVPKeyPointer::writePublicKey(
#endif
}
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
if (ECKeyHasMissingOid(*this)) {
ERR_raise(ERR_LIB_EC, EC_R_MISSING_OID);
return Result<BIOPointer, bool>(false,
@@ -4719,7 +4642,7 @@ Result<BIOPointer, bool> EVPKeyPointer::writePublicKey(
if (config.format == ncrypto::EVPKeyPointer::PKFormatType::PEM) {
// Encode SPKI as PEM.
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
// Build the SubjectPublicKeyInfo wrapper explicitly before PEM encoding.
// Provider-backed keys can fail the direct PEM_write_bio_PUBKEY() path even
// when OpenSSL can materialize the public wrapper with X509_PUBKEY_set().
@@ -4734,8 +4657,8 @@ Result<BIOPointer, bool> EVPKeyPointer::writePublicKey(
return Result<BIOPointer, bool>(false,
mark_pop_error_on_return.peekError());
}
-#else
- // Non-OpenSSL >= 3 builds do not all declare PEM_write_bio_X509_PUBKEY().
+#elif NCRYPTO_USE_BORINGSSL
+ // BoringSSL does not declare PEM_write_bio_X509_PUBKEY().
if (PEM_write_bio_PUBKEY(bio.get(), get()) != 1) {
return Result<BIOPointer, bool>(false,
mark_pop_error_on_return.peekError());
@@ -4753,9 +4676,6 @@ Result<BIOPointer, bool> EVPKeyPointer::writePublicKey(
}
bool EVPKeyPointer::isRsaVariant(const EVP_PKEY* key) {
-#if !NCRYPTO_USE_OPENSSL3_PROVIDER && !NCRYPTO_USE_BORINGSSL
- if (key != nullptr && EVP_PKEY_id(key) == EVP_PKEY_RSA2) return true;
-#endif
return isA(key, KeyAlgorithm::RSA) || isA(key, KeyAlgorithm::RSA_PSS);
}
@@ -4776,11 +4696,11 @@ std::optional<uint32_t> EVPKeyPointer::getBytesOfRS() const {
int bits;
if (isA(KeyAlgorithm::DSA)) {
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
DeleteFnPtr<BIGNUM, BN_free> q;
if (!GetPKeyBnParam(get(), OSSL_PKEY_PARAM_FFC_Q, &q)) return std::nullopt;
bits = BignumPointer::GetBitCount(q.get());
-#else
+#elif NCRYPTO_USE_BORINGSSL
const DSA* dsa_key = EVP_PKEY_get0_DSA(get());
bool has_bits = false;
// Both r and s are computed mod q, so their width is limited by that of q.
@@ -4794,9 +4714,9 @@ std::optional<uint32_t> EVPKeyPointer::getBytesOfRS() const {
if (!has_bits) return std::nullopt;
#endif
} else if (isA(KeyAlgorithm::EC)) {
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
bits = EVP_PKEY_bits(get());
-#else
+#elif NCRYPTO_USE_BORINGSSL
const EC_KEY* ec_key = EVP_PKEY_get0_EC_KEY(get());
if (ec_key == nullptr) return std::nullopt;
const EC_GROUP* group = ECKeyPointer::GetGroup(ec_key);
@@ -4815,17 +4735,10 @@ std::optional<uint32_t> EVPKeyPointer::getBytesOfRS() const {
EVPKeyPointer::operator Rsa() const {
if (!isA(KeyAlgorithm::RSA) && !isA(KeyAlgorithm::RSA_PSS)) return {};
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
return Rsa(get());
-#else
- // TODO(tniessen): Remove the "else" branch once we drop support for OpenSSL
- // versions older than 1.1.1e via FIPS / dynamic linking.
- OSSL3_CONST RSA* rsa;
- if (OPENSSL_VERSION_NUMBER >= 0x1010105fL) {
- rsa = EVP_PKEY_get0_RSA(get());
- } else {
- rsa = static_cast<OSSL3_CONST RSA*>(EVP_PKEY_get0(get()));
- }
+#elif NCRYPTO_USE_BORINGSSL
+ OSSL3_CONST RSA* rsa = EVP_PKEY_get0_RSA(get());
if (rsa == nullptr) return {};
return Rsa(rsa);
#endif
@@ -4834,9 +4747,9 @@ EVPKeyPointer::operator Rsa() const {
EVPKeyPointer::operator Dsa() const {
if (!isA(KeyAlgorithm::DSA)) return {};
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
return Dsa(get());
-#else
+#elif NCRYPTO_USE_BORINGSSL
OSSL3_CONST DSA* dsa = EVP_PKEY_get0_DSA(get());
if (dsa == nullptr) return {};
return Dsa(dsa);
@@ -4845,14 +4758,14 @@ EVPKeyPointer::operator Dsa() const {
bool EVPKeyPointer::validateDsaParameters() const {
if (!pkey_) return false;
-#if OPENSSL_VERSION_MAJOR >= 3
+#ifndef OPENSSL_IS_BORINGSSL
if (EVP_default_properties_is_fips_enabled(nullptr) &&
isA(KeyAlgorithm::DSA)) {
-#else
+#elif defined(OPENSSL_IS_BORINGSSL)
if (FIPS_mode() && isA(KeyAlgorithm::DSA)) {
#endif
// Validate DSA2 parameters from FIPS 186-4.
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
DeleteFnPtr<BIGNUM, BN_free> p;
DeleteFnPtr<BIGNUM, BN_free> q;
if (!GetPKeyBnParam(pkey_.get(), OSSL_PKEY_PARAM_FFC_P, &p) ||
@@ -4861,7 +4774,7 @@ bool EVPKeyPointer::validateDsaParameters() const {
}
const BIGNUM* p_value = p.get();
const BIGNUM* q_value = q.get();
-#else
+#elif NCRYPTO_USE_BORINGSSL
const DSA* dsa = EVP_PKEY_get0_DSA(pkey_.get());
if (dsa == nullptr) return false;
const BIGNUM* p;
@@ -5113,7 +5026,7 @@ bool SSLCtxPointer::setCipherSuites(const char* ciphers) {
if (!ctx_) return false;
#ifndef OPENSSL_IS_BORINGSSL
return SSL_CTX_set_ciphersuites(ctx_.get(), ciphers);
-#else
+#elif defined(OPENSSL_IS_BORINGSSL)
constexpr std::array<uint16_t, 3> supported = {
SSL_CIPHER_AES_128_GCM_SHA256,
SSL_CIPHER_AES_256_GCM_SHA384,
@@ -5171,7 +5084,7 @@ constexpr char AsciiToLower(char c) {
return c >= 'A' && c <= 'Z' ? c + ('a' - 'A') : c;
}
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
constexpr auto kUnsupportedCipherFlags =
EVP_CIPH_FLAG_CIPHER_WITH_MAC | EVP_CIPH_FLAG_TLS1_1_MULTIBLOCK;
@@ -5213,7 +5126,7 @@ void PushAlgorithmAlias(const char* name, void* arg) {
#endif
} // namespace
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
Cipher::Cipher(DeleteFnPtr<EVP_CIPHER, EVP_CIPHER_free> cipher)
: cipher_(cipher.get()), fetched_cipher_(std::move(cipher)) {}
#endif
@@ -5236,12 +5149,12 @@ bool CaseInsensitiveNameEqual::operator()(std::string_view lhs,
DigestCache::Result DigestCache::lookup(const char* name,
uint64_t generation) const {
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
if (generation_ != generation) return {};
const auto it = aliases_.find(name);
if (it == aliases_.end()) return {};
return lookup(it->second, generation);
-#else
+#elif NCRYPTO_USE_BORINGSSL
static_cast<void>(name);
static_cast<void>(generation);
return {};
@@ -5251,7 +5164,7 @@ DigestCache::Result DigestCache::lookup(const char* name,
DigestCache::Result DigestCache::insert(const char* name,
const EVP_MD* digest,
uint64_t generation) {
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
if (generation_ != generation || name == nullptr || digest == nullptr) {
return {};
}
@@ -5287,7 +5200,7 @@ DigestCache::Result DigestCache::insert(const char* name,
aliases_.insert_or_assign(name, id);
return {digests_[index].get(), id};
-#else
+#elif NCRYPTO_USE_BORINGSSL
static_cast<void>(name);
static_cast<void>(digest);
static_cast<void>(generation);
@@ -5296,7 +5209,7 @@ DigestCache::Result DigestCache::insert(const char* name,
}
void DigestCache::reset(uint64_t generation) {
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
if (generation_ == generation) return;
aliases_.clear();
digests_.clear();
@@ -5306,16 +5219,16 @@ void DigestCache::reset(uint64_t generation) {
}
const DigestCache::AliasMap& DigestCache::aliases() const {
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
return aliases_;
-#else
+#elif NCRYPTO_USE_BORINGSSL
static const AliasMap empty;
return empty;
#endif
}
const EVP_CIPHER* CipherCache::lookup(const char* name, uint64_t generation) {
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
if (generation_ != generation) {
aliases_.clear();
ciphers_.clear();
@@ -5326,14 +5239,14 @@ const EVP_CIPHER* CipherCache::lookup(const char* name, uint64_t generation) {
if (it == aliases_.end()) return nullptr;
if (it->second >= ciphers_.size()) return nullptr;
return ciphers_[it->second].get();
-#else
+#elif NCRYPTO_USE_BORINGSSL
static_cast<void>(name);
static_cast<void>(generation);
return nullptr;
#endif
}
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
const EVP_CIPHER* CipherCache::insert(
const char* name,
DeleteFnPtr<EVP_CIPHER, EVP_CIPHER_free>&& cipher,
@@ -5370,7 +5283,7 @@ const EVP_CIPHER* CipherCache::insert(
#endif
Cipher::Cipher(const Cipher& other) : cipher_(other.cipher_) {
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
if (other.fetched_cipher_ != nullptr) {
if (EVP_CIPHER_up_ref(other.fetched_cipher_.get()) == 1) {
fetched_cipher_.reset(other.fetched_cipher_.get());
@@ -5383,7 +5296,7 @@ Cipher::Cipher(const Cipher& other) : cipher_(other.cipher_) {
Cipher& Cipher::operator=(const Cipher& other) {
if (this == &other) return *this;
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
if (other.fetched_cipher_ != nullptr) {
if (EVP_CIPHER_up_ref(other.fetched_cipher_.get()) == 1) {
fetched_cipher_.reset(other.fetched_cipher_.get());
@@ -5403,13 +5316,13 @@ Cipher& Cipher::operator=(const Cipher& other) {
const Cipher Cipher::FromName(const char* name, CipherCache* cache) {
const EVP_CIPHER* cipher = EVP_get_cipherbyname(name);
if (cipher != nullptr) {
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
if (!IsSupportedLegacyCipher(cipher)) return Cipher();
#endif
return Cipher(cipher);
}
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
// A resolution that overlaps a FIPS transition may use either property
// state. The cache retains the generation observed here, so the first
// resolution begun after the transition clears any stale entries.
@@ -5433,7 +5346,7 @@ const Cipher Cipher::FromName(const char* name, CipherCache* cache) {
}
return Cipher(std::move(fetched));
-#else
+#elif NCRYPTO_USE_BORINGSSL
static_cast<void>(cache);
return Cipher();
#endif
@@ -5442,7 +5355,7 @@ const Cipher Cipher::FromName(const char* name, CipherCache* cache) {
const Cipher Cipher::FromNameForKeyEncoding(const char* name) {
// Key serializers have their own cipher restrictions. Preserve their policy
// instead of applying the filters used by the general cipher operations.
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
MarkPopErrorOnReturn mark_pop_error_on_return;
DeleteFnPtr<EVP_CIPHER, EVP_CIPHER_free> fetched(
EVP_CIPHER_fetch(nullptr, name, nullptr));
@@ -5455,16 +5368,16 @@ const Cipher Cipher::FromNameForKeyEncoding(const char* name) {
const Cipher Cipher::FromNid(int nid, CipherCache* cache) {
const EVP_CIPHER* cipher = EVP_get_cipherbynid(nid);
if (cipher != nullptr) {
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
if (!IsSupportedLegacyCipher(cipher)) return Cipher();
#endif
return Cipher(cipher);
}
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
const char* name = OBJ_nid2sn(nid);
if (name != nullptr) return FromName(name, cache);
-#else
+#elif NCRYPTO_USE_BORINGSSL
static_cast<void>(cache);
#endif
@@ -5571,9 +5484,9 @@ bool Cipher::isCcmMode() const {
bool Cipher::isCtsMode() const {
if (!cipher_) return false;
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
return (EVP_CIPHER_get_flags(cipher_) & EVP_CIPH_FLAG_CTS) != 0;
-#else
+#elif NCRYPTO_USE_BORINGSSL
return false;
#endif
}
@@ -5587,7 +5500,7 @@ bool Cipher::isSivMode() const {
if (!cipher_) return false;
#if OPENSSL_WITH_AES_SIV
return getMode() == EVP_CIPH_SIV_MODE;
-#else
+#elif NCRYPTO_USE_BORINGSSL
return false;
#endif
}
@@ -5682,9 +5595,9 @@ const char* Cipher::getName() const {
const char* name = OBJ_nid2sn(nid);
if (name != nullptr) return name;
}
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
return EVP_CIPHER_get0_name(cipher_);
-#else
+#elif NCRYPTO_USE_BORINGSSL
return {};
#endif
}
@@ -5779,10 +5692,10 @@ bool CipherCtxPointer::setAeadTagLength(size_t length) {
ctx_.get(), EVP_CTRL_AEAD_SET_TAG, length, nullptr);
}
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
namespace {
// OSSL_CIPHER_PARAM_XTS_STANDARD is not defined by OpenSSL 3.0. Use its
-// parameter name directly so custom 3.0 providers can advertise it too.
+// parameter name directly so custom providers can advertise it too.
constexpr char kCipherParamXtsStandard[] = "xts_standard";
bool SetCipherCtxStringParam(EVP_CIPHER_CTX* ctx,
@@ -5808,9 +5721,9 @@ bool SetCipherCtxStringParam(EVP_CIPHER_CTX* ctx,
#endif
bool CipherCtxPointer::setCtsMode(const char* mode) {
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
return SetCipherCtxStringParam(ctx_.get(), OSSL_CIPHER_PARAM_CTS_MODE, mode);
-#else
+#elif NCRYPTO_USE_BORINGSSL
static_cast<void>(mode);
return false;
#endif
@@ -5822,9 +5735,9 @@ bool CipherCtxPointer::setPadding(bool padding) {
}
bool CipherCtxPointer::setXtsStandard(const char* standard) {
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
return SetCipherCtxStringParam(ctx_.get(), kCipherParamXtsStandard, standard);
-#else
+#elif NCRYPTO_USE_BORINGSSL
static_cast<void>(standard);
return false;
#endif
@@ -5874,7 +5787,7 @@ bool CipherCtxPointer::isSivMode() const {
if (!ctx_) return false;
#if OPENSSL_WITH_AES_SIV
return getMode() == EVP_CIPH_SIV_MODE;
-#else
+#elif NCRYPTO_USE_BORINGSSL
return false;
#endif
}
@@ -6527,15 +6440,13 @@ EVPKeyCtxPointer EVPKeyCtxPointer::New(const EVPKeyPointer& key) {
EVPKeyCtxPointer EVPKeyCtxPointer::NewFromName(const char* name) {
if (name == nullptr) return {};
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
return EVPKeyCtxPointer(EVP_PKEY_CTX_new_from_name(nullptr, name, nullptr));
-#else
- const int id = GetLegacyKeyId(name);
+#elif NCRYPTO_USE_BORINGSSL
+ const int id = GetBoringSSLKeyId(name);
if (id == NID_undef) return {};
-#ifdef OPENSSL_IS_BORINGSSL
// DSA keys are not supported with BoringSSL.
if (id == EVP_PKEY_DSA) return {};
-#endif
return EVPKeyCtxPointer(EVP_PKEY_CTX_new_id(id, nullptr));
#endif
}
@@ -6576,7 +6487,7 @@ bool EVPKeyCtxPointer::setDhParameters(int prime_size, uint32_t generator) {
if (!ctx_) return false;
return EVP_PKEY_CTX_set_dh_paramgen_prime_len(ctx_.get(), prime_size) == 1 &&
EVP_PKEY_CTX_set_dh_paramgen_generator(ctx_.get(), generator) == 1;
-#else
+#elif defined(OPENSSL_IS_BORINGSSL)
// TODO(jasnell): Boringssl appears not to support this operation.
// Is there an alternative approach that Boringssl does support?
return false;
@@ -6603,7 +6514,7 @@ bool EVPKeyCtxPointer::setEcParameters(int curve, int encoding) {
bool EVPKeyCtxPointer::setEcParameters(const char* group_name, int encoding) {
if (!ctx_ || group_name == nullptr) return false;
const int curve = Ec::GetCurveIdFromName(group_name);
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
// Keep the historical aliases while allowing names known only to providers.
if (curve != NID_undef) group_name = OBJ_nid2sn(curve);
@@ -6626,7 +6537,7 @@ bool EVPKeyCtxPointer::setEcParameters(const char* group_name, int encoding) {
OSSL_PARAM_END,
};
return EVP_PKEY_CTX_set_params(ctx_.get(), params) == 1;
-#else
+#elif NCRYPTO_USE_BORINGSSL
return curve != NID_undef &&
EVP_PKEY_CTX_set_ec_paramgen_curve_nid(ctx_.get(), curve) == 1 &&
EVP_PKEY_CTX_set_ec_param_enc(ctx_.get(), encoding) == 1;
@@ -6669,9 +6580,9 @@ bool EVPKeyCtxPointer::setRsaKeygenBits(int bits) {
bool EVPKeyCtxPointer::setRsaKeygenPubExp(BignumPointer&& e) {
if (!ctx_) return false;
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
return EVP_PKEY_CTX_set1_rsa_keygen_pubexp(ctx_.get(), e.get()) == 1;
-#else
+#elif NCRYPTO_USE_BORINGSSL
if (EVP_PKEY_CTX_set_rsa_keygen_pubexp(ctx_.get(), e.get()) == 1) {
// The ctx_ takes ownership of e on success.
e.release();
@@ -6683,15 +6594,12 @@ bool EVPKeyCtxPointer::setRsaKeygenPubExp(BignumPointer&& e) {
bool EVPKeyCtxPointer::setRsaPssKeygenMd(const Digest& md) {
if (!md || !ctx_) return false;
- // OpenSSL < 3 accepts a void* for the md parameter.
- const EVP_MD* md_ptr = md;
- return EVP_PKEY_CTX_set_rsa_pss_keygen_md(ctx_.get(), md_ptr) > 0;
+ return EVP_PKEY_CTX_set_rsa_pss_keygen_md(ctx_.get(), md) > 0;
}
bool EVPKeyCtxPointer::setRsaPssKeygenMgf1Md(const Digest& md) {
if (!md || !ctx_) return false;
- const EVP_MD* md_ptr = md;
- return EVP_PKEY_CTX_set_rsa_pss_keygen_mgf1_md(ctx_.get(), md_ptr) > 0;
+ return EVP_PKEY_CTX_set_rsa_pss_keygen_mgf1_md(ctx_.get(), md) > 0;
}
bool EVPKeyCtxPointer::setRsaPssSaltlen(int salt_len) {
@@ -6711,7 +6619,7 @@ bool EVPKeyCtxPointer::setRsaImplicitRejection() {
// of how it is set. The call to set the value
// will not affect what is used since a different context is
// used in the call if the option is supported
-#else
+#elif defined(OPENSSL_IS_BORINGSSL)
// TODO(jasnell): Boringssl appears not to support this operation.
// Is there an alternative approach that Boringssl does support?
return true;
@@ -6769,12 +6677,8 @@ EVPKeyPointer EVPKeyCtxPointer::paramgen() const {
bool EVPKeyCtxPointer::publicCheck() const {
if (!ctx_) return false;
#ifndef OPENSSL_IS_BORINGSSL
-#if OPENSSL_VERSION_MAJOR >= 3
return EVP_PKEY_public_check_quick(ctx_.get()) == 1;
-#else
- return EVP_PKEY_public_check(ctx_.get()) == 1;
-#endif
-#else // OPENSSL_IS_BORINGSSL
+#elif defined(OPENSSL_IS_BORINGSSL)
// Boringssl appears not to support this operation.
// TODO(jasnell): Is there an alternative approach that Boringssl does
// support?
@@ -6786,7 +6690,7 @@ bool EVPKeyCtxPointer::privateCheck() const {
if (!ctx_) return false;
#ifndef OPENSSL_IS_BORINGSSL
return EVP_PKEY_check(ctx_.get()) == 1;
-#else
+#elif defined(OPENSSL_IS_BORINGSSL)
// Boringssl appears not to support this operation.
// TODO(jasnell): Is there an alternative approach that Boringssl does
// support?
@@ -6931,7 +6835,7 @@ Rsa::OtherPrimeInfoPointer::OtherPrimeInfoPointer(BignumPointer&& r,
BignumPointer&& t)
: r(r.release()), d(d.release()), t(t.release()) {}
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
namespace {
// Normalizes a provider digest name such as "SHA2-256" to the long name the
// rest of the key details use ("sha256"). The returned storage has static
@@ -7083,24 +6987,24 @@ Rsa::Rsa(const EVP_PKEY* pkey, Selection selection) : Rsa() {
rsa_ = true;
}
-#else
+#elif NCRYPTO_USE_BORINGSSL
Rsa::Rsa() : rsa_(nullptr) {}
Rsa::Rsa(OSSL3_CONST RSA* ptr) : rsa_(ptr) {}
#endif
Rsa Rsa::PublicOnly(const EVPKeyPointer& key) {
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
return Rsa(key.get(), Selection::Public);
-#else
+#elif NCRYPTO_USE_BORINGSSL
return key;
#endif
}
const Rsa::PublicKey Rsa::getPublicKey() const {
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
if (!rsa_) return {};
return PublicKey{n_.get(), e_.get(), d_.get()};
-#else
+#elif NCRYPTO_USE_BORINGSSL
if (rsa_ == nullptr) return {};
PublicKey key;
RSA_get0_key(rsa_, &key.n, &key.e, &key.d);
@@ -7109,10 +7013,10 @@ const Rsa::PublicKey Rsa::getPublicKey() const {
}
const Rsa::PrivateKey Rsa::getPrivateKey() const {
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
if (!rsa_) return {};
return PrivateKey{p_.get(), q_.get(), dp_.get(), dq_.get(), qi_.get()};
-#else
+#elif NCRYPTO_USE_BORINGSSL
if (rsa_ == nullptr) return {};
PrivateKey key;
RSA_get0_factors(rsa_, &key.p, &key.q);
@@ -7123,29 +7027,11 @@ const Rsa::PrivateKey Rsa::getPrivateKey() const {
const Rsa::OtherPrimeInfos Rsa::getOtherPrimeInfos() const {
OtherPrimeInfos infos;
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
infos.reserve(other_prime_infos_.size());
for (const auto& info : other_prime_infos_) {
infos.push_back({info.r.get(), info.d.get(), info.t.get()});
}
-#elif NCRYPTO_USE_LEGACY_OPENSSL
- if (rsa_ == nullptr) return infos;
- const int count = RSA_get_multi_prime_extra_count(rsa_);
- if (count <= 0) return infos;
-
- std::vector<const BIGNUM*> factors(count);
- std::vector<const BIGNUM*> exponents(count);
- std::vector<const BIGNUM*> coefficients(count);
- if (RSA_get0_multi_prime_factors(rsa_, factors.data()) != 1 ||
- RSA_get0_multi_prime_crt_params(
- rsa_, exponents.data(), coefficients.data()) != 1) {
- return {};
- }
-
- infos.reserve(count);
- for (int i = 0; i < count; i++) {
- infos.push_back({factors[i], exponents[i], coefficients[i]});
- }
#endif
return infos;
}
@@ -7171,9 +7057,9 @@ bool Rsa::checkPrimeProduct() const {
}
const std::optional<Rsa::PssParams> Rsa::getPssParams() const {
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
return pss_params_;
-#else
+#elif NCRYPTO_USE_BORINGSSL
if (rsa_ == nullptr) return std::nullopt;
const RSA_PSS_PARAMS* params = RSA_get0_pss_params(rsa_);
if (params == nullptr) return std::nullopt;
@@ -7212,7 +7098,7 @@ const std::optional<Rsa::PssParams> Rsa::getPssParams() const {
BIOPointer Rsa::derPublicKey() const {
auto bio = BIOPointer::NewMem();
if (!bio) return {};
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
auto pkey = EVPKeyPointer::NewRSA(*this);
if (!pkey) return {};
if (!rsa_pss_) {
@@ -7243,7 +7129,7 @@ BIOPointer Rsa::derPublicKey() const {
}
parameters.release();
if (i2d_X509_PUBKEY_bio(bio.get(), pubkey.get()) != 1) return {};
-#else
+#elif NCRYPTO_USE_BORINGSSL
if (rsa_ == nullptr || i2d_RSA_PUBKEY_bio(bio.get(), rsa_) != 1) return {};
#endif
return bio;
@@ -7251,12 +7137,12 @@ BIOPointer Rsa::derPublicKey() const {
bool Rsa::setPublicKey(BignumPointer&& n, BignumPointer&& e) {
if (!n || !e) return false;
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
n_.reset(n.release());
e_.reset(e.release());
rsa_ = true;
return true;
-#else
+#elif NCRYPTO_USE_BORINGSSL
if (RSA_set0_key(const_cast<RSA*>(rsa_), n.get(), e.get(), nullptr) == 1) {
n.release();
e.release();
@@ -7273,7 +7159,7 @@ bool Rsa::setPrivateKey(BignumPointer&& d,
BignumPointer&& dq,
BignumPointer&& qi,
OtherPrimeInfoPointers&& other_prime_infos) {
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
if (!d || !q || !p || !dp || !dq || !qi) return false;
for (const auto& info : other_prime_infos) {
if (!info.r || !info.d || !info.t) return false;
@@ -7287,7 +7173,7 @@ bool Rsa::setPrivateKey(BignumPointer&& d,
other_prime_infos_ = std::move(other_prime_infos);
rsa_ = n_ != nullptr && e_ != nullptr;
return rsa_;
-#else
+#elif NCRYPTO_USE_BORINGSSL
if (!RSA_set0_key(const_cast<RSA*>(rsa_), nullptr, nullptr, d.get())) {
return false;
}
@@ -7307,36 +7193,7 @@ bool Rsa::setPrivateKey(BignumPointer&& d,
dq.release();
qi.release();
-#if NCRYPTO_USE_LEGACY_OPENSSL
- if (!other_prime_infos.empty()) {
- std::vector<BIGNUM*> factors;
- std::vector<BIGNUM*> exponents;
- std::vector<BIGNUM*> coefficients;
- factors.reserve(other_prime_infos.size());
- exponents.reserve(other_prime_infos.size());
- coefficients.reserve(other_prime_infos.size());
- for (const auto& info : other_prime_infos) {
- if (!info.r || !info.d || !info.t) return false;
- factors.push_back(info.r.get());
- exponents.push_back(info.d.get());
- coefficients.push_back(info.t.get());
- }
- if (RSA_set0_multi_prime_params(const_cast<RSA*>(rsa_),
- factors.data(),
- exponents.data(),
- coefficients.data(),
- static_cast<int>(factors.size())) != 1) {
- return false;
- }
- for (auto& info : other_prime_infos) {
- info.r.release();
- info.d.release();
- info.t.release();
- }
- }
-#else
if (!other_prime_infos.empty()) return false;
-#endif
return true;
#endif
}
@@ -7390,7 +7247,7 @@ struct CipherCallbackContext {
void operator()(const char* name) { cb(name); }
};
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
template <class TypeName,
TypeName* fetch_type(OSSL_LIB_CTX*, const char*, const char*),
void free_type(TypeName*),
@@ -7457,7 +7314,7 @@ void array_push_back_provider(EVP_CIPHER* cipher, void* arg) {
EVP_CIPHER_names_do_all(fetched.get(), array_push_back_provider_name, arg);
}
-#else
+#elif NCRYPTO_USE_BORINGSSL
template <class TypeName>
void array_push_back(const TypeName* evp_ref,
const char* from,
@@ -7482,17 +7339,17 @@ void Cipher::ForEach(Cipher::CipherNameCallback callback) {
}
#else
EVP_CIPHER_do_all_sorted(
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
array_push_back<EVP_CIPHER,
EVP_CIPHER_fetch,
EVP_CIPHER_free,
EVP_get_cipherbyname,
EVP_CIPHER_get0_name>,
-#else
+#elif NCRYPTO_USE_BORINGSSL
array_push_back<EVP_CIPHER>,
#endif
&context);
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
EVP_CIPHER_do_all_provided(nullptr, array_push_back_provider, &context);
#endif
#endif
@@ -7500,7 +7357,7 @@ void Cipher::ForEach(Cipher::CipherNameCallback callback) {
// ============================================================================
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
Ec::Ec() : ec_(nullptr), pub_(nullptr) {}
Ec::Ec(const EVP_PKEY* pkey) : Ec() {
@@ -7566,31 +7423,31 @@ Ec::Ec(const EVP_PKEY* pkey) : Ec() {
}
pub_.reset(point.release());
}
-#else
+#elif NCRYPTO_USE_BORINGSSL
Ec::Ec() : ec_(nullptr) {}
Ec::Ec(OSSL3_CONST EC_KEY* key) : ec_(key) {}
#endif
const EC_GROUP* Ec::getGroup() const {
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
return ec_.get();
-#else
+#elif NCRYPTO_USE_BORINGSSL
return ECKeyPointer::GetGroup(ec_);
#endif
}
const EC_POINT* Ec::getPublicKey() const {
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
return pub_.get();
-#else
+#elif NCRYPTO_USE_BORINGSSL
return ECKeyPointer::GetPublicKey(ec_);
#endif
}
point_conversion_form_t Ec::getPointConversionForm() const {
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
return form_;
-#else
+#elif NCRYPTO_USE_BORINGSSL
return EC_KEY_get_conv_form(ec_);
#endif
}
@@ -7620,7 +7477,7 @@ BIOPointer Ec::ExportPrivatePkcs8(const EVPKeyPointer& key) {
DataPointer Ec::TryExportPublic(const EVPKeyPointer& key,
point_conversion_form_t form) {
if (!key || form != POINT_CONVERSION_UNCOMPRESSED) return {};
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
{
MarkPopErrorOnReturn pop_errors;
size_t length = 0;
@@ -7644,7 +7501,7 @@ DataPointer Ec::TryExportPublic(const EVPKeyPointer& key,
DataPointer Ec::ExportPrivate(const EVPKeyPointer& key) {
if (!key) return {};
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
{
MarkPopErrorOnReturn pop_errors;
BignumPointer priv;
@@ -7669,7 +7526,7 @@ bool Ec::GetKeyComponents(const EVPKeyPointer& key,
BignumPointer* priv,
int* degree) {
if (!key) return false;
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
const int nid = GetCurveId(key);
switch (nid) {
case NID_X9_62_prime256v1:
@@ -7725,7 +7582,7 @@ bool Ec::GetKeyComponents(const EVPKeyPointer& key,
int Ec::GetCurveId(const EVPKeyPointer& key) {
if (!key) return NID_undef;
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
char name[80];
size_t length = 0;
if (EVP_PKEY_get_utf8_string_param(
@@ -7734,7 +7591,7 @@ int Ec::GetCurveId(const EVPKeyPointer& key) {
return NID_undef;
}
return GetCurveIdFromName(name);
-#else
+#elif NCRYPTO_USE_BORINGSSL
const EC_KEY* ec = key;
if (ec == nullptr) return NID_undef;
const EC_GROUP* group = EC_KEY_get0_group(ec);
@@ -7744,7 +7601,7 @@ int Ec::GetCurveId(const EVPKeyPointer& key) {
std::optional<std::string> Ec::GetCurveName(const EVPKeyPointer& key) {
if (!key) return std::nullopt;
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
size_t length = 0;
if (EVP_PKEY_get_utf8_string_param(
key.get(), OSSL_PKEY_PARAM_GROUP_NAME, nullptr, 0, &length) != 1) {
@@ -7762,14 +7619,14 @@ std::optional<std::string> Ec::GetCurveName(const EVPKeyPointer& key) {
// Preserve the public short names for the curves OpenSSL already knows.
const int nid = GetCurveIdFromName(name.c_str());
return nid == NID_undef ? name : std::string(OBJ_nid2sn(nid));
-#else
+#elif NCRYPTO_USE_BORINGSSL
const int nid = GetCurveId(key);
if (nid == NID_undef) return std::nullopt;
return std::string(OBJ_nid2sn(nid));
#endif
}
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
namespace {
bool IsAvailableEcGroup(const char* name) {
MarkPopErrorOnReturn mark;
@@ -7783,12 +7640,12 @@ bool IsAvailableEcGroup(const char* name) {
bool Ec::CheckCurveName(const char* name) {
if (name == nullptr) return false;
if (GetCurveIdFromName(name) != NID_undef) return true;
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
// Keep invalid names a synchronous argument error. Generation contexts can
// defer rejecting a group until parameter generation. Use the same parameter
// generation path as key generation without requiring parameter import.
return IsAvailableEcGroup(name);
-#else
+#elif NCRYPTO_USE_BORINGSSL
return false;
#endif
}
@@ -7817,7 +7674,7 @@ bool Ec::GetCurves(Ec::GetCurveCallback callback) {
}
for (const auto& curve : curves) {
const char* name = OBJ_nid2sn(curve.nid);
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
if (!IsAvailableEcGroup(name)) continue;
#endif
if (!callback(name)) return false;
@@ -7956,7 +7813,7 @@ std::optional<EVP_PKEY_CTX*> EVPMDCtxPointer::signInitWithContext(
return std::nullopt;
}
return ctx;
-#elif NCRYPTO_USE_OPENSSL3_PROVIDER
+#else
EVP_PKEY_CTX* ctx = nullptr;
// Ed25519 requires the INSTANCE param to switch into Ed25519ctx mode.
@@ -7990,8 +7847,6 @@ std::optional<EVP_PKEY_CTX*> EVPMDCtxPointer::signInitWithContext(
return std::nullopt;
}
return ctx;
-#else
- return std::nullopt;
#endif
}
@@ -8009,7 +7864,7 @@ std::optional<EVP_PKEY_CTX*> EVPMDCtxPointer::verifyInitWithContext(
return std::nullopt;
}
return ctx;
-#elif NCRYPTO_USE_OPENSSL3_PROVIDER
+#else
EVP_PKEY_CTX* ctx = nullptr;
// Ed25519 requires the INSTANCE param to switch into Ed25519ctx mode.
@@ -8043,8 +7898,6 @@ std::optional<EVP_PKEY_CTX*> EVPMDCtxPointer::verifyInitWithContext(
return std::nullopt;
}
return ctx;
-#else
- return std::nullopt;
#endif
}
@@ -8118,7 +7971,7 @@ bool extractP1363(const Buffer<const unsigned char>& buf,
// ============================================================================
-#if !OPENSSL_WITH_EVP_MAC
+#if NCRYPTO_USE_BORINGSSL
HMACCtxPointer::HMACCtxPointer() : ctx_(nullptr) {}
HMACCtxPointer::HMACCtxPointer(HMAC_CTX* ctx) : ctx_(ctx) {}
@@ -8178,7 +8031,7 @@ bool HMACCtxPointer::digestInto(Buffer<void>* buf) {
HMACCtxPointer HMACCtxPointer::New() {
return HMACCtxPointer(HMAC_CTX_new());
}
-#endif // !OPENSSL_WITH_EVP_MAC
+#endif // NCRYPTO_USE_BORINGSSL
#if OPENSSL_WITH_EVP_MAC
EVPMacPointer::EVPMacPointer(EVP_MAC* mac) : mac_(mac) {}
@@ -8580,7 +8433,7 @@ std::optional<X509Name::Entry> X509Name::Iterator::operator*() const {
// ============================================================================
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
Dsa::Dsa() : dsa_(false) {}
Dsa::Dsa(const EVP_PKEY* pkey) : Dsa() {
@@ -8591,16 +8444,16 @@ Dsa::Dsa(const EVP_PKEY* pkey) : Dsa() {
}
dsa_ = true;
}
-#else
+#elif NCRYPTO_USE_BORINGSSL
Dsa::Dsa() : dsa_(nullptr) {}
Dsa::Dsa(OSSL3_CONST DSA* dsa) : dsa_(dsa) {}
#endif
const BIGNUM* Dsa::getP() const {
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
if (!dsa_) return nullptr;
return p_.get();
-#else
+#elif NCRYPTO_USE_BORINGSSL
if (dsa_ == nullptr) return nullptr;
const BIGNUM* p;
DSA_get0_pqg(dsa_, &p, nullptr, nullptr);
@@ -8609,10 +8462,10 @@ const BIGNUM* Dsa::getP() const {
}
const BIGNUM* Dsa::getQ() const {
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
if (!dsa_) return nullptr;
return q_.get();
-#else
+#elif NCRYPTO_USE_BORINGSSL
if (dsa_ == nullptr) return nullptr;
const BIGNUM* q;
DSA_get0_pqg(dsa_, nullptr, &q, nullptr);
@@ -8621,18 +8474,18 @@ const BIGNUM* Dsa::getQ() const {
}
size_t Dsa::getModulusLength() const {
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
if (!dsa_) return 0;
-#else
+#elif NCRYPTO_USE_BORINGSSL
if (dsa_ == nullptr) return 0;
#endif
return BignumPointer::GetBitCount(getP());
}
size_t Dsa::getDivisorLength() const {
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
if (!dsa_) return 0;
-#else
+#elif NCRYPTO_USE_BORINGSSL
if (dsa_ == nullptr) return 0;
#endif
return BignumPointer::GetBitCount(getQ());
@@ -8645,13 +8498,13 @@ size_t Digest::size() const {
return EVP_MD_size(md_);
}
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
Digest::Digest(DeleteFnPtr<EVP_MD, EVP_MD_free> md)
: md_(md.get()), fetched_md_(std::move(md)) {}
#endif
Digest::Digest(const Digest& other) : md_(other.md_) {
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
if (other.fetched_md_ != nullptr) {
if (EVP_MD_up_ref(other.fetched_md_.get()) == 1) {
fetched_md_.reset(other.fetched_md_.get());
@@ -8664,7 +8517,7 @@ Digest::Digest(const Digest& other) : md_(other.md_) {
Digest& Digest::operator=(const Digest& other) {
if (this == &other) return *this;
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
if (other.fetched_md_ != nullptr) {
if (EVP_MD_up_ref(other.fetched_md_.get()) == 1) {
fetched_md_.reset(other.fetched_md_.get());
@@ -8687,7 +8540,7 @@ const Digest Digest::SHA256 = Digest(EVP_sha256());
const Digest Digest::SHA384 = Digest(EVP_sha384());
const Digest Digest::SHA512 = Digest(EVP_sha512());
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
namespace {
bool IsSupportedDigest(const EVP_MD* md) {
if (md == nullptr || EVP_MD_is_a(md, "NULL")) return false;
@@ -8705,7 +8558,7 @@ bool IsSupportedDigest(const EVP_MD* md) {
const Digest Digest::FromName(const char* name) {
const EVP_MD* md = ncrypto::getDigestByName(name);
if (md != nullptr) {
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
if (md == EVP_md_null()) return Digest();
#endif
return Digest(md);
@@ -8715,7 +8568,7 @@ const Digest Digest::FromName(const char* name) {
}
const Digest Digest::Fetch(const char* name) {
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
MarkPopErrorOnReturn mark_pop_error_on_return;
DeleteFnPtr<EVP_MD, EVP_MD_free> fetched(
EVP_MD_fetch(nullptr, name, nullptr));
@@ -8730,7 +8583,7 @@ const Digest Digest::Fetch(const char* name) {
// ============================================================================
// KEM Implementation
#if OPENSSL_WITH_KEM
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
bool KEM::SetOperationParameter(EVP_PKEY_CTX* ctx, const EVPKeyPointer& key) {
const OSSL_PARAM* settable = EVP_PKEY_CTX_settable_params(ctx);
if (settable == nullptr ||
@@ -8763,7 +8616,7 @@ std::optional<KEM::EncapsulateResult> KEM::Encapsulate(
return std::nullopt;
}
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
if (!SetOperationParameter(ctx.get(), public_key)) {
return std::nullopt;
}
@@ -8804,7 +8657,7 @@ DataPointer KEM::Decapsulate(const EVPKeyPointer& private_key,
return {};
}
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
if (!SetOperationParameter(ctx.get(), private_key)) {
return {};
}
diff --git a/deps/ncrypto/ncrypto.gyp b/deps/ncrypto/ncrypto.gyp
index 9b3732d6f95..40f7760ed77 100644
--- a/deps/ncrypto/ncrypto.gyp
+++ b/deps/ncrypto/ncrypto.gyp
@@ -17,9 +17,6 @@
'OPENSSL_API_COMPAT=<(ncrypto_openssl3_api_compat)',
'OPENSSL_NO_DEPRECATED',
],
- 'ncrypto_legacy_openssl_defines': [
- 'OPENSSL_API_COMPAT=0x10100000L',
- ],
'ncrypto_engine_defines': [
'OPENSSL_API_COMPAT=<(ncrypto_openssl3_api_compat)',
'OPENSSL_SUPPRESS_DEPRECATED',
@@ -40,24 +37,19 @@
'NCRYPTO_BSSL_LIBDECREPIT_MISSING=<(ncrypto_bssl_libdecrepit_missing)',
],
'conditions': [
- ['openssl_is_boringssl=="false" and openssl_version >= 0x3000000f', {
- 'defines!': [ '<@(ncrypto_legacy_openssl_defines)' ],
+ ['openssl_is_boringssl=="false"', {
'defines': [ '<@(ncrypto_strict_defines)' ],
}],
],
},
'sources': [ '<@(ncrypto_sources)' ],
'conditions': [
- ['openssl_is_boringssl=="false" and openssl_version >= 0x3000000f', {
- 'defines!': [ '<@(ncrypto_legacy_openssl_defines)' ],
+ ['openssl_is_boringssl=="false"', {
'defines': [ '<@(ncrypto_strict_defines)' ],
'dependencies': [
'ncrypto_engine',
],
}],
- ['openssl_is_boringssl=="false" and openssl_version < 0x3000000f', {
- 'sources': [ '<@(ncrypto_engine_sources)' ],
- }],
['node_shared_openssl=="false"', {
'dependencies': [
'../openssl/openssl.gyp:openssl'
@@ -67,7 +59,7 @@
},
],
'conditions': [
- ['openssl_is_boringssl=="false" and openssl_version >= 0x3000000f', {
+ ['openssl_is_boringssl=="false"', {
'targets': [
{
'target_name': 'ncrypto_engine',
diff --git a/deps/ncrypto/ncrypto.h b/deps/ncrypto/ncrypto.h
index 9a501a551b4..2a84f4b2073 100644
--- a/deps/ncrypto/ncrypto.h
+++ b/deps/ncrypto/ncrypto.h
@@ -33,6 +33,11 @@
(OPENSSL_VERSION_NUMBER >= (((maj) << 28) | ((min) << 20)))
#endif
+// BoringSSL reports itself as OpenSSL 1.1.1, so it has to be excluded here.
+#if !defined(OPENSSL_IS_BORINGSSL) && !OPENSSL_VERSION_PREREQ(3, 0)
+#error "OpenSSL 1.x is no longer supported, v3.0.0 or later is required."
+#endif
+
// BoringSSL declares the EVP_*_do_all* APIs, but their implementation may
// live in libdecrepit. This matches standalone ncrypto's build flag.
#ifndef NCRYPTO_BSSL_LIBDECREPIT_MISSING
@@ -46,48 +51,28 @@
#endif
// Backend split:
-// - OpenSSL >= 3 uses provider APIs and hides deprecated low-level objects.
-// - BoringSSL has its own API-compatible branch.
-// - OpenSSL < 3 remains the legacy fallback branch.
-#if !defined(OPENSSL_IS_BORINGSSL) && OPENSSL_VERSION_PREREQ(3, 0)
-#define NCRYPTO_USE_OPENSSL3_PROVIDER 1
-#else
-#define NCRYPTO_USE_OPENSSL3_PROVIDER 0
-#endif
-
+// - OpenSSL uses provider APIs and hides deprecated low-level objects.
+// - BoringSSL has its own API-compatible branch and keeps using the legacy
+// low-level key types.
#ifdef OPENSSL_IS_BORINGSSL
#define NCRYPTO_USE_BORINGSSL 1
+#define NCRYPTO_USE_OPENSSL_PROVIDER 0
#else
#define NCRYPTO_USE_BORINGSSL 0
+#define NCRYPTO_USE_OPENSSL_PROVIDER 1
#endif
-#if !NCRYPTO_USE_OPENSSL3_PROVIDER && !NCRYPTO_USE_BORINGSSL
-#define NCRYPTO_USE_LEGACY_OPENSSL 1
-#else
-#define NCRYPTO_USE_LEGACY_OPENSSL 0
-#endif
-
-#if NCRYPTO_USE_BORINGSSL || NCRYPTO_USE_LEGACY_OPENSSL
-#define NCRYPTO_USE_LEGACY_KEY_TYPES 1
-#else
-#define NCRYPTO_USE_LEGACY_KEY_TYPES 0
-#endif
+#define NCRYPTO_USE_LEGACY_KEY_TYPES NCRYPTO_USE_BORINGSSL
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
#include <openssl/core_names.h>
#include <openssl/encoder.h>
#include <openssl/param_build.h>
#endif
-// The FIPS-related functions are only available
-// when the OpenSSL itself was compiled with FIPS support.
-#if defined(OPENSSL_FIPS) && !OPENSSL_VERSION_PREREQ(3, 0)
-#include <openssl/fips.h>
-#endif // OPENSSL_FIPS
-
-#if OPENSSL_VERSION_PREREQ(3, 0)
+#if !defined(OPENSSL_IS_BORINGSSL)
#define OPENSSL_WITH_AES_OCB 1
-#else
+#elif defined(OPENSSL_IS_BORINGSSL)
#define OPENSSL_WITH_AES_OCB 0
#endif
@@ -97,21 +82,17 @@
#define OPENSSL_WITH_ARGON2 0
#endif
-#if OPENSSL_VERSION_PREREQ(3, 0) || defined(OPENSSL_IS_BORINGSSL)
#define OPENSSL_WITH_KEM 1
-#else
-#define OPENSSL_WITH_KEM 0
-#endif
-#if OPENSSL_VERSION_PREREQ(3, 0)
+#if !defined(OPENSSL_IS_BORINGSSL)
#define OPENSSL_WITH_EVP_MAC 1
-#else
+#elif defined(OPENSSL_IS_BORINGSSL)
#define OPENSSL_WITH_EVP_MAC 0
#endif
-#if !defined(OPENSSL_IS_BORINGSSL) && OPENSSL_VERSION_PREREQ(3, 0)
+#if !defined(OPENSSL_IS_BORINGSSL)
#define OPENSSL_WITH_AES_SIV 1
-#else
+#elif defined(OPENSSL_IS_BORINGSSL)
#define OPENSSL_WITH_AES_SIV 0
#endif
@@ -121,9 +102,9 @@
#define OPENSSL_WITH_AES_GCM_SIV 0
#endif
-#if OPENSSL_VERSION_PREREQ(3, 0)
+#if !defined(OPENSSL_IS_BORINGSSL)
#define OSSL3_CONST const
-#else
+#elif defined(OPENSSL_IS_BORINGSSL)
#define OSSL3_CONST
#endif
@@ -359,7 +340,7 @@ class Digest final {
Digest(const Digest& other);
Digest& operator=(const Digest& other);
inline Digest& operator=(const EVP_MD* md) {
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
fetched_md_.reset();
#endif
md_ = md;
@@ -384,7 +365,7 @@ class Digest final {
private:
const EVP_MD* md_ = nullptr;
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
explicit Digest(DeleteFnPtr<EVP_MD, EVP_MD_free> md);
DeleteFnPtr<EVP_MD, EVP_MD_free> fetched_md_;
#endif
@@ -417,14 +398,14 @@ class DigestCache final {
Result lookup(const char* name, uint64_t generation) const;
inline Result lookup(int32_t id, uint64_t generation) const {
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
if (generation_ != generation || id == -1) return {};
const uint32_t unsigned_id = static_cast<uint32_t>(id);
if (unsigned_id < first_id_) return {};
const size_t index = unsigned_id - first_id_;
if (index >= digests_.size()) return {};
return {digests_[index].get(), id};
-#else
+#elif NCRYPTO_USE_BORINGSSL
static_cast<void>(id);
static_cast<void>(generation);
return {};
@@ -436,7 +417,7 @@ class DigestCache final {
private:
uint64_t generation_ = 0;
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
using EVPMDPointer = DeleteFnPtr<EVP_MD, EVP_MD_free>;
// IDs are not reused across generations because JavaScript caches them
@@ -462,14 +443,14 @@ class CipherCache final {
NCRYPTO_DISALLOW_COPY_AND_MOVE(CipherCache)
const EVP_CIPHER* lookup(const char* name, uint64_t generation);
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
const EVP_CIPHER* insert(const char* name,
DeleteFnPtr<EVP_CIPHER, EVP_CIPHER_free>&& cipher,
uint64_t generation);
#endif
private:
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
using EVPCipherPointer = DeleteFnPtr<EVP_CIPHER, EVP_CIPHER_free>;
uint64_t generation_ = 0;
@@ -503,7 +484,7 @@ class Cipher final {
Cipher(const Cipher& other);
Cipher& operator=(const Cipher& other);
inline Cipher& operator=(const EVP_CIPHER* cipher) {
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
fetched_cipher_.reset();
#endif
cipher_ = cipher;
@@ -599,7 +580,7 @@ class Cipher final {
private:
const EVP_CIPHER* cipher_ = nullptr;
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
explicit Cipher(DeleteFnPtr<EVP_CIPHER, EVP_CIPHER_free> cipher);
DeleteFnPtr<EVP_CIPHER, EVP_CIPHER_free> fetched_cipher_;
#endif
@@ -611,18 +592,18 @@ class Cipher final {
class Dsa final {
public:
Dsa();
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
explicit Dsa(const EVP_PKEY* pkey);
-#else
+#elif NCRYPTO_USE_BORINGSSL
Dsa(OSSL3_CONST DSA* dsa);
#endif
NCRYPTO_DISALLOW_COPY_AND_MOVE(Dsa)
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
inline operator bool() const {
return dsa_;
}
-#else
+#elif NCRYPTO_USE_BORINGSSL
inline operator bool() const { return dsa_ != nullptr; }
#endif
#if NCRYPTO_USE_LEGACY_KEY_TYPES
@@ -635,11 +616,11 @@ class Dsa final {
size_t getDivisorLength() const;
private:
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
bool dsa_ = false;
DeleteFnPtr<BIGNUM, BN_free> p_;
DeleteFnPtr<BIGNUM, BN_free> q_;
-#else
+#elif NCRYPTO_USE_BORINGSSL
OSSL3_CONST DSA* dsa_;
#endif
};
@@ -652,18 +633,18 @@ class Rsa final {
Rsa();
enum class Selection { Public, Private };
static Rsa PublicOnly(const EVPKeyPointer& key);
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
explicit Rsa(const EVP_PKEY* pkey, Selection selection = Selection::Private);
-#else
+#elif NCRYPTO_USE_BORINGSSL
Rsa(OSSL3_CONST RSA* rsa);
#endif
NCRYPTO_DISALLOW_COPY_AND_MOVE(Rsa)
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
inline operator bool() const {
return rsa_;
}
-#else
+#elif NCRYPTO_USE_BORINGSSL
inline operator bool() const { return rsa_ != nullptr; }
#endif
#if NCRYPTO_USE_LEGACY_KEY_TYPES
@@ -733,7 +714,7 @@ class Rsa final {
const Buffer<const void> in);
private:
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
bool rsa_ = false;
bool rsa_pss_ = false;
DeleteFnPtr<BIGNUM, BN_free> n_;
@@ -746,7 +727,7 @@ class Rsa final {
DeleteFnPtr<BIGNUM, BN_clear_free> qi_;
OtherPrimeInfoPointers other_prime_infos_;
std::optional<PssParams> pss_params_;
-#else
+#elif NCRYPTO_USE_BORINGSSL
OSSL3_CONST RSA* rsa_;
#endif
};
@@ -754,9 +735,9 @@ class Rsa final {
class Ec final {
public:
Ec();
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
explicit Ec(const EVP_PKEY* pkey);
-#else
+#elif NCRYPTO_USE_BORINGSSL
Ec(OSSL3_CONST EC_KEY* key);
#endif
NCRYPTO_DISALLOW_COPY_AND_MOVE(Ec)
@@ -790,11 +771,11 @@ class Ec final {
static bool GetCurves(GetCurveCallback callback);
private:
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
DeleteFnPtr<EC_GROUP, EC_GROUP_free> ec_;
DeleteFnPtr<EC_POINT, EC_POINT_free> pub_;
point_conversion_form_t form_ = POINT_CONVERSION_UNCOMPRESSED;
-#else
+#elif NCRYPTO_USE_BORINGSSL
OSSL3_CONST EC_KEY* ec_ = nullptr;
#endif
};
@@ -1236,9 +1217,9 @@ class EVPKeyPointer final {
static EVPKeyPointer NewRawSeed(const KeyAlgorithm& algorithm,
const Buffer<const unsigned char>& data);
static EVPKeyPointer NewDH(DHPointer&& dh);
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
static EVPKeyPointer NewRSA(const Rsa& rsa);
-#else
+#elif NCRYPTO_USE_BORINGSSL
static EVPKeyPointer NewRSA(RSAPointer&& rsa);
#endif
@@ -1423,10 +1404,10 @@ class DHPointer final {
static DHPointer New(size_t bits, unsigned int generator);
DHPointer() = default;
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
explicit DHPointer(EVPKeyPointer&& key, const char* group_name = nullptr);
DHPointer(BignumPointer&& p, BignumPointer&& g, const char* group_name);
-#else
+#elif NCRYPTO_USE_BORINGSSL
explicit DHPointer(DH* dh);
#endif
DHPointer(DHPointer&& other) noexcept;
@@ -1434,14 +1415,14 @@ class DHPointer final {
NCRYPTO_DISALLOW_COPY(DHPointer)
~DHPointer();
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
inline bool operator==(std::nullptr_t) noexcept {
return !operator bool();
}
inline operator bool() const {
return dh_ != nullptr || (p_ && g_);
}
-#else
+#elif NCRYPTO_USE_BORINGSSL
inline bool operator==(std::nullptr_t) noexcept { return dh_ == nullptr; }
inline operator bool() const { return dh_ != nullptr; }
#endif
@@ -1503,14 +1484,14 @@ class DHPointer final {
const EVPKeyPointer& theirKey);
private:
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
DeleteFnPtr<EVP_PKEY, EVP_PKEY_free> dh_;
BignumPointer p_;
BignumPointer g_;
BignumPointer pub_key_;
BignumPointer pvt_key_;
const char* group_name_ = nullptr;
-#else
+#elif NCRYPTO_USE_BORINGSSL
DeleteFnPtr<DH, DH_free> dh_;
#endif
};
@@ -1838,14 +1819,14 @@ class ECKeyPointer final {
NCRYPTO_DISALLOW_COPY(ECKeyPointer)
~ECKeyPointer();
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
inline bool operator==(std::nullptr_t) noexcept {
return group_ == nullptr;
}
inline operator bool() const {
return group_ != nullptr;
}
-#else
+#elif NCRYPTO_USE_BORINGSSL
inline bool operator==(std::nullptr_t) noexcept { return key_ == nullptr; }
inline operator bool() const { return key_ != nullptr; }
#endif
@@ -1883,11 +1864,11 @@ class ECKeyPointer final {
#endif
private:
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
DeleteFnPtr<EC_GROUP, EC_GROUP_free> group_;
DeleteFnPtr<EC_POINT, EC_POINT_free> pub_;
DeleteFnPtr<BIGNUM, BN_clear_free> priv_;
-#else
+#elif NCRYPTO_USE_BORINGSSL
DeleteFnPtr<EC_KEY, EC_KEY_free> key_;
#endif
};
@@ -1957,7 +1938,7 @@ class EVPMDCtxPointer final {
DeleteFnPtr<EVP_MD_CTX, EVP_MD_CTX_free> ctx_;
};
-#if !OPENSSL_WITH_EVP_MAC
+#if NCRYPTO_USE_BORINGSSL
class HMACCtxPointer final {
public:
HMACCtxPointer();
@@ -1984,7 +1965,7 @@ class HMACCtxPointer final {
private:
DeleteFnPtr<HMAC_CTX, HMAC_CTX_free> ctx_;
};
-#endif // !OPENSSL_WITH_EVP_MAC
+#endif // NCRYPTO_USE_BORINGSSL
#if OPENSSL_WITH_EVP_MAC
class EVPMacPointer final {
@@ -2120,7 +2101,7 @@ class HMACCtxPointer final {
};
#endif // OPENSSL_WITH_EVP_MAC
-#if !OPENSSL_WITH_EVP_MAC
+#if NCRYPTO_USE_BORINGSSL
class MacCache final {
public:
MacCache() = default;
@@ -2210,7 +2191,7 @@ Buffer<char> ExportChallenge(const char* input, size_t length);
// ============================================================================
// KDF
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
class KDF final {
public:
KDF() = default;
@@ -2306,7 +2287,7 @@ class KEM final {
const Buffer<const void>& ciphertext);
private:
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
static bool SetOperationParameter(EVP_PKEY_CTX* ctx,
const EVPKeyPointer& key);
#endif
diff --git a/src/crypto/crypto_context.cc b/src/crypto/crypto_context.cc
index 13edcb58886..5163cc1c445 100644
--- a/src/crypto/crypto_context.cc
+++ b/src/crypto/crypto_context.cc
@@ -1885,7 +1885,7 @@ void SecureContext::Init(const FunctionCallbackInfo<Value>& args) {
return THROW_ERR_CRYPTO_OPERATION_FAILED(
env, "Error generating ticket keys");
}
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
SSL_CTX_set_tlsext_ticket_key_evp_cb(sc->ctx_.get(),
TicketCompatibilityCallback);
#else
@@ -2197,7 +2197,7 @@ void SecureContext::SetDHParam(const FunctionCallbackInfo<Value>& args) {
if (!bio)
return;
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
EVPKeyPointer params(PEM_read_bio_Parameters(bio.get(), nullptr));
if (params && params.isA(KeyAlgorithm::DH)) dh.reset(params.release());
#else
@@ -2221,7 +2221,7 @@ void SecureContext::SetDHParam(const FunctionCallbackInfo<Value>& args) {
env->isolate(), "DH parameter is less than 2048 bits"));
}
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
EVPKeyPointer dh_pkey(dh.release());
if (!SSL_CTX_set0_tmp_dh_pkey(sc->ctx_.get(), dh_pkey.get())) {
#else
@@ -2230,7 +2230,7 @@ void SecureContext::SetDHParam(const FunctionCallbackInfo<Value>& args) {
return THROW_ERR_CRYPTO_OPERATION_FAILED(
env, "Error setting temp DH parameter");
}
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
dh_pkey.release();
#endif
}
@@ -2620,7 +2620,7 @@ void SecureContext::EnableTicketKeyCallback(
SecureContext* wrap;
ASSIGN_OR_RETURN_UNWRAP(&wrap, args.This());
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
SSL_CTX_set_tlsext_ticket_key_evp_cb(wrap->ctx_.get(), TicketKeyCallback);
#else
SSL_CTX_set_tlsext_ticket_key_cb(wrap->ctx_.get(), TicketKeyCallback);
@@ -2628,7 +2628,7 @@ void SecureContext::EnableTicketKeyCallback(
}
namespace {
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
bool InitTicketHmac(EVP_MAC_CTX* hctx,
const unsigned char* key,
size_t key_len) {
@@ -2652,7 +2652,7 @@ int SecureContext::TicketKeyCallback(SSL* ssl,
unsigned char* name,
unsigned char* iv,
EVP_CIPHER_CTX* ectx,
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
EVP_MAC_CTX* hctx,
#else
HMAC_CTX* hctx,
@@ -2749,7 +2749,7 @@ int SecureContext::TicketCompatibilityCallback(SSL* ssl,
unsigned char* name,
unsigned char* iv,
EVP_CIPHER_CTX* ectx,
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
EVP_MAC_CTX* hctx,
#else
HMAC_CTX* hctx,
diff --git a/src/crypto/crypto_context.h b/src/crypto/crypto_context.h
index c2da04bbbb5..1a4eba212b6 100644
--- a/src/crypto/crypto_context.h
+++ b/src/crypto/crypto_context.h
@@ -173,7 +173,7 @@ class SecureContext final : public BaseObject {
unsigned char* name,
unsigned char* iv,
EVP_CIPHER_CTX* ectx,
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
EVP_MAC_CTX* hctx,
#else
HMAC_CTX* hctx,
@@ -184,7 +184,7 @@ class SecureContext final : public BaseObject {
unsigned char* name,
unsigned char* iv,
EVP_CIPHER_CTX* ectx,
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
EVP_MAC_CTX* hctx,
#else
HMAC_CTX* hctx,
diff --git a/src/crypto/crypto_dh.cc b/src/crypto/crypto_dh.cc
index 28abba798da..8bfde65327f 100644
--- a/src/crypto/crypto_dh.cc
+++ b/src/crypto/crypto_dh.cc
@@ -195,7 +195,7 @@ void New(const FunctionCallbackInfo<Value>& args) {
}
}
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
if (BN_num_bits(bn_p.get()) >= 512 && BN_cmp(bn_g.get(), bn_p.get()) >= 0) {
PutDhError(DH_R_BAD_GENERATOR);
return ThrowCryptoError(env, ERR_get_error(), "Invalid generator");
diff --git a/src/crypto/crypto_hash.cc b/src/crypto/crypto_hash.cc
index fabf6654430..81977941889 100644
--- a/src/crypto/crypto_hash.cc
+++ b/src/crypto/crypto_hash.cc
@@ -76,7 +76,7 @@ constexpr BoringSSLDigest kBoringSSLDigests[] = {
void ResetHashCache(Environment* env,
uint64_t generation,
Local<Object> algorithm_cache = Local<Object>()) {
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
ncrypto::DigestCache* cache = env->provider_digest_cache.get();
CHECK_NOT_NULL(cache);
if (!algorithm_cache.IsEmpty()) {
@@ -107,7 +107,7 @@ bool SynchronizeHashCache(Environment* env,
return true;
}
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
const EVP_MD* GetCachedMDByID(Environment* env,
int32_t id,
Local<Object> algorithm_cache = Local<Object>()) {
@@ -235,7 +235,7 @@ void SaveSupportedHashAlgorithms(const EVP_MD* md,
Environment* env = static_cast<Environment*>(arg);
env->supported_hash_algorithms.push_back(from);
}
-#endif // NCRYPTO_USE_OPENSSL3_PROVIDER
+#endif // NCRYPTO_USE_OPENSSL_PROVIDER
const std::vector<std::string>& GetSupportedHashAlgorithms(Environment* env) {
while (true) {
@@ -248,7 +248,7 @@ const std::vector<std::string>& GetSupportedHashAlgorithms(Environment* env) {
static_cast<void>(digest.get);
env->supported_hash_algorithms.emplace_back(digest.name);
}
-#elif NCRYPTO_USE_OPENSSL3_PROVIDER
+#elif NCRYPTO_USE_OPENSSL_PROVIDER
// Since we'll fetch the EVP_MD*, cache them along the way to speed up
// later lookups instead of throwing them away immediately.
EVP_MD_do_all_sorted(SaveSupportedHashAlgorithmsAndCacheMD, env);
@@ -290,7 +290,7 @@ void Hash::GetCachedAliases(const FunctionCallbackInfo<Value>& args) {
size_t size = 0;
LocalVector<Name> names(isolate);
LocalVector<Value> values(isolate);
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
const auto& aliases = env->provider_digest_cache->aliases();
size = aliases.size();
names.reserve(size);
@@ -317,7 +317,7 @@ const EVP_MD* GetDigestImplementation(
CHECK(algorithm_cache->IsObject());
DCHECK(!digest_owner.has_value());
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
Local<Object> cache = algorithm_cache.As<Object>();
int32_t cache_id = cache_id_val.As<Int32>()->Value();
if (cache_id != -1) {
@@ -358,7 +358,7 @@ const EVP_MD* GetDigestImplementation(
}
void MarkInvalidXofLength() {
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
ERR_raise(ERR_LIB_EVP, EVP_R_NOT_XOF_OR_INVALID_LENGTH);
#else
EVPerr(EVP_F_EVP_DIGESTFINALXOF, EVP_R_NOT_XOF_OR_INVALID_LENGTH);
@@ -373,7 +373,7 @@ void MarkInvalidXofLength() {
// version-independent.
#if !OPENSSL_VERSION_PREREQ(3, 4)
bool IsShakeDigest(const EVP_MD* md) {
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
return EVP_MD_is_a(md, "SHAKE128") || EVP_MD_is_a(md, "SHAKE256");
#else
const char* name = OBJ_nid2sn(EVP_MD_type(md));
@@ -537,7 +537,7 @@ void Hash::OneShotDigest(const FunctionCallbackInfo<Value>& args) {
CHECK(args[6]->IsUint32() || args[6]->IsUndefined()); // outputLength
if (args.Length() == 7) {
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
const int32_t cache_id = args[1].As<Int32>()->Value();
if (cache_id != -1) {
if (const EVP_MD* md =
@@ -613,7 +613,7 @@ void Hash::New(const FunctionCallbackInfo<Value>& args) {
xof_md_len = Just<unsigned int>(args[1].As<Uint32>()->Value());
}
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
// This is the common path after the first lookup. Avoid constructing a
// digest owner when the Environment already owns the cached implementation.
if (args.Length() == 4 && args[0]->IsString()) {
diff --git a/src/crypto/crypto_keys.cc b/src/crypto/crypto_keys.cc
index 64bbd6da072..71464785c11 100644
--- a/src/crypto/crypto_keys.cc
+++ b/src/crypto/crypto_keys.cc
@@ -333,8 +333,7 @@ bool GetAsymmetricKeyDetail(Environment* env,
}
const auto& pkey = key.GetAsymmetricKey();
const auto* algorithm = pkey.getAlgorithm();
- // Preserve RSA2 support on legacy backends without exposing its numeric ID.
- if (algorithm != nullptr ? algorithm->isRsa() : pkey.isRsaVariant()) {
+ if (algorithm != nullptr && algorithm->isRsa()) {
return GetRsaKeyDetail(env, key, target);
}
if (algorithm == &KeyAlgorithm::DSA) return GetDsaKeyDetail(env, key, target);
diff --git a/src/crypto/crypto_rsa.cc b/src/crypto/crypto_rsa.cc
index 25d8808e6ea..c95bd46635f 100644
--- a/src/crypto/crypto_rsa.cc
+++ b/src/crypto/crypto_rsa.cc
@@ -44,7 +44,7 @@ namespace {
constexpr uint32_t kMaxRsaOtherPrimeInfos = 8;
bool IsRsaPssDigestEncodable(const Digest& digest) {
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
const int nid = EVP_MD_type(digest.get());
if (nid == NID_undef) return false;
@@ -395,7 +395,7 @@ KeyObjectData ImportJWKRsaKey(Environment* env, Local<Object> jwk) {
return {};
}
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
ncrypto::Rsa rsa_view;
#else
RSAPointer rsa(RSA_new());
@@ -509,7 +509,7 @@ KeyObjectData ImportJWKRsaKey(Environment* env, Local<Object> jwk) {
}
}
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
auto pkey = EVPKeyPointer::NewRSA(rsa_view);
#else
auto pkey = EVPKeyPointer::NewRSA(std::move(rsa));
diff --git a/src/crypto/crypto_sig.cc b/src/crypto/crypto_sig.cc
index 400dce70ad2..aeb9b11e865 100644
--- a/src/crypto/crypto_sig.cc
+++ b/src/crypto/crypto_sig.cc
@@ -7,7 +7,7 @@
#include "env-inl.h"
#include "memory_tracker-inl.h"
#include "openssl/ec.h"
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
#include <openssl/core_names.h>
#include <openssl/evp.h>
#endif
diff --git a/src/crypto/crypto_tls.cc b/src/crypto/crypto_tls.cc
index 5483a040af1..a73eb7220a4 100644
--- a/src/crypto/crypto_tls.cc
+++ b/src/crypto/crypto_tls.cc
@@ -951,7 +951,7 @@ void TLSWrap::ClearOut() {
return;
const char* ls = ERR_lib_error_string(ssl_err);
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
const char* fs = nullptr;
#else
const char* fs = ERR_func_error_string(ssl_err);
diff --git a/src/crypto/crypto_util.cc b/src/crypto/crypto_util.cc
index a99b4f10af2..b980a578721 100644
--- a/src/crypto/crypto_util.cc
+++ b/src/crypto/crypto_util.cc
@@ -899,7 +899,7 @@ Maybe<void> Decorate(Environment* env,
if (err == 0) return JustVoid(); // No decoration necessary.
const char* ls = ERR_lib_error_string(err);
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
const char* fs = nullptr;
#else
const char* fs = ERR_func_error_string(err);
diff --git a/src/env.cc b/src/env.cc
index 33e2121d45f..c30b6e2f504 100644
--- a/src/env.cc
+++ b/src/env.cc
@@ -995,7 +995,7 @@ Environment::Environment(IsolateData* isolate_data,
: thread_id.id),
thread_name_(thread_name) {
isolate_data->AddEnvironment();
-#if HAVE_OPENSSL && NCRYPTO_USE_OPENSSL3_PROVIDER
+#if HAVE_OPENSSL && NCRYPTO_USE_OPENSSL_PROVIDER
provider_digest_cache = std::make_unique<ncrypto::DigestCache>();
provider_cipher_cache = std::make_unique<ncrypto::CipherCache>();
#if OPENSSL_WITH_EVP_MAC
diff --git a/test/cctest/test_node_crypto.cc b/test/cctest/test_node_crypto.cc
index df387ab00f9..7658e1810cd 100644
--- a/test/cctest/test_node_crypto.cc
+++ b/test/cctest/test_node_crypto.cc
@@ -17,7 +17,7 @@
#include <string_view>
#include <vector>
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
#include <openssl/core_dispatch.h>
#include <openssl/core_names.h>
#include <openssl/params.h>
@@ -119,7 +119,7 @@ TEST(NodeCrypto, KeyAlgorithmNames) {
EXPECT_FALSE(empty.isA(static_cast<const char*>(nullptr)));
}
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
TEST(NodeCrypto, ProviderPkcs1PublicKeyImport) {
ncrypto::ClearErrorOnReturn clear_errors;
auto ctx = EVPKeyCtxPointer::NewFromAlgorithm(KeyAlgorithm::RSA);
@@ -449,11 +449,11 @@ TEST(NodeCrypto, EcKeyComponents) {
0);
auto raw_public =
ncrypto::Ec::TryExportPublic(key, POINT_CONVERSION_UNCOMPRESSED);
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
ASSERT_TRUE(raw_public);
ASSERT_EQ(raw_public.size(), point.size());
EXPECT_EQ(memcmp(raw_public.get(), point.get(), point.size()), 0);
-#else
+#elif NCRYPTO_USE_BORINGSSL
EXPECT_FALSE(raw_public);
#endif
EXPECT_FALSE(
@@ -508,7 +508,7 @@ TEST(NodeCrypto, ResolveKeyAlgorithm) {
key.reset();
EXPECT_EQ(key.getAlgorithm(), nullptr);
}
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
// Legacy keys must resolve even without provider-backed key material.
key = EVPKeyPointer::New();
ASSERT_EQ(EVP_PKEY_set_type(key.get(), NID_rsaEncryption), 1);
@@ -532,7 +532,7 @@ TEST(NodeCrypto, PublicKeyTypeNames) {
EXPECT_STREQ(key.getKeyTypeName(), "ed25519");
}
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
TEST(NodeCrypto, LegacyKeyAlgorithmResolution) {
ncrypto::ClearErrorOnReturn clear_errors;
auto key = EVPKeyPointer::New();
@@ -578,7 +578,7 @@ TEST(NodeCrypto, EcGroupNames) {
}
}
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
namespace {
// Deliberately longer than the fixed-size group buffer formerly used by
// ncrypto.
@@ -768,7 +768,7 @@ TEST(NodeCrypto, NamedRawKey) {
EXPECT_TRUE(key.supportsRawPublic());
EXPECT_TRUE(key.supportsRawPrivate());
EXPECT_EQ(key.getAlgorithm()->seedSize(), 0);
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
// Provider aliases are recognized without comparing the primary type name.
EXPECT_TRUE(key.isA("1.3.101.112"));
auto ctx = ncrypto::EVPKeyCtxPointer::NewFromName("1.3.101.112");
@@ -823,7 +823,7 @@ TEST(NodeCrypto, ProviderPqcKeyWithoutLegacyId) {
algorithm->seedSize()};
auto key = EVPKeyPointer::NewRawSeed(*algorithm, input);
ASSERT_TRUE(key);
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
EXPECT_EQ(EVP_PKEY_id(key.get()), -1);
#endif
EXPECT_TRUE(key.isA(*algorithm));
@@ -900,7 +900,7 @@ TEST(NodeCrypto, UnavailableBoringSSLKeyAlgorithms) {
}
#endif
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
TEST(NodeCrypto, PrivateKeyEncodingOwnsFetchedCipher) {
ncrypto::ClearErrorOnReturn clear_errors;
EVPKeyPointer::PrivateKeyEncodingConfig assigned;
@@ -1011,9 +1011,9 @@ TEST(NodeCrypto, X509FormattingPreservesUnrelatedErrors) {
ASSERT_EQ(X509_set_subject_name(cert.get(), empty_name.get()), 1);
ERR_clear_error();
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
ERR_raise(ERR_LIB_USER, 1);
-#else
+#elif NCRYPTO_USE_BORINGSSL
ERR_put_error(ERR_LIB_USER, 0, 1, __FILE__, __LINE__);
#endif
const unsigned long expected = ERR_peek_error(); // NOLINT(runtime/int)
@@ -1044,9 +1044,9 @@ TEST(NodeCrypto, X509KeyVisitorsHandleMissingPublicKey) {
visit();
EXPECT_EQ(ERR_peek_error(), 0UL);
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
ERR_raise(ERR_LIB_USER, 1);
-#else
+#elif NCRYPTO_USE_BORINGSSL
ERR_put_error(ERR_LIB_USER, 0, 1, __FILE__, __LINE__);
#endif
const unsigned long expected = ERR_peek_error(); // NOLINT(runtime/int)
@@ -1076,9 +1076,9 @@ TEST(NodeCrypto, X509UsageVisitorPreservesCallbackErrors) {
EXPECT_TRUE(cert.view().enumUsages([&calls](const char* oid) {
calls++;
EXPECT_STREQ(oid, "1.3.6.1.5.5.7.3.1");
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
ERR_raise(ERR_LIB_USER, 1);
-#else
+#elif NCRYPTO_USE_BORINGSSL
ERR_put_error(ERR_LIB_USER, 0, 1, __FILE__, __LINE__);
#endif
}));
@@ -1231,7 +1231,7 @@ TEST(NodeCrypto, PrintsLongX509ExtensionObjectIdentifiers) {
ASSERT_TRUE(output);
ASSERT_TRUE(ncrypto::SafeX509InfoAccessPrint(output, info_access.get()));
std::string expected = oid_text + " - URI:https://example.com/";
-#if NCRYPTO_USE_LEGACY_OPENSSL || NCRYPTO_USE_BORINGSSL
+#if NCRYPTO_USE_BORINGSSL
expected += "\n";
#endif
EXPECT_EQ(BioContents(output), expected);
diff --git a/test/cctest/test_node_crypto_env.cc b/test/cctest/test_node_crypto_env.cc
index fddf584d7d4..1d31dc98329 100644
--- a/test/cctest/test_node_crypto_env.cc
+++ b/test/cctest/test_node_crypto_env.cc
@@ -35,7 +35,7 @@ TEST_F(NodeCryptoEnv, LoadBIO) {
"any errors on the OpenSSL error stack\n";
}
-#if NCRYPTO_USE_OPENSSL3_PROVIDER
+#if NCRYPTO_USE_OPENSSL_PROVIDER
TEST_F(NodeCryptoEnv, ExportIncompleteRsaPrivateKeyAsJwk) {
v8::HandleScope handle_scope(isolate_);
Argv argv;