Skip to content

Commit 0bb15f6

Browse files
panvapanva
committed
crypto,https,tls: end OpenSSL engine support
OpenSSL removed support for engines in version 4. Remove the Node.js APIs, constants, native bindings, and implementation that depend on ENGINE. Keep recognizing the former TLS and HTTPS engine options so their use fails explicitly instead of appearing to work while being ignored. Move DEP0183 directly from Documentation-only to End-of-Life. Signed-off-by: Filip Skokan <panva.ip@gmail.com> Assisted-by: Codex
1 parent 769a39e commit 0bb15f6

40 files changed

Lines changed: 162 additions & 1279 deletions

‎deps/ncrypto/engine.cc‎

Lines changed: 0 additions & 105 deletions
This file was deleted.

‎deps/ncrypto/ncrypto.gyp‎

Lines changed: 0 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -5,19 +5,10 @@
55
'ncrypto.cc',
66
'ncrypto.h',
77
],
8-
'ncrypto_engine_sources': [
9-
'engine.cc',
10-
'ncrypto.h',
11-
],
128
'ncrypto_strict_defines': [
139
'OPENSSL_API_COMPAT=30000',
1410
'OPENSSL_NO_DEPRECATED',
1511
],
16-
'ncrypto_engine_defines': [
17-
'OPENSSL_API_COMPAT=30000',
18-
'OPENSSL_SUPPRESS_DEPRECATED',
19-
'NCRYPTO_ENGINE_COMPAT=1',
20-
],
2112
},
2213
'targets': [
2314
{
@@ -42,9 +33,6 @@
4233
'conditions': [
4334
['openssl_is_boringssl=="false"', {
4435
'defines': [ '<@(ncrypto_strict_defines)' ],
45-
'dependencies': [
46-
'ncrypto_engine',
47-
],
4836
}],
4937
['node_shared_openssl=="false"', {
5038
'dependencies': [
@@ -54,27 +42,4 @@
5442
]
5543
},
5644
],
57-
'conditions': [
58-
['openssl_is_boringssl=="false"', {
59-
'targets': [
60-
{
61-
'target_name': 'ncrypto_engine',
62-
'type': 'static_library',
63-
'include_dirs': ['.'],
64-
'defines': [
65-
'NCRYPTO_BSSL_LIBDECREPIT_MISSING=<(ncrypto_bssl_libdecrepit_missing)',
66-
'<@(ncrypto_engine_defines)',
67-
],
68-
'sources': [ '<@(ncrypto_engine_sources)' ],
69-
'conditions': [
70-
['node_shared_openssl=="false"', {
71-
'dependencies': [
72-
'../openssl/openssl.gyp:openssl'
73-
]
74-
}],
75-
]
76-
},
77-
],
78-
}],
79-
],
8045
}

‎deps/ncrypto/ncrypto.h‎

Lines changed: 0 additions & 43 deletions
Original file line numberDiff line numberDiff line change
@@ -22,11 +22,6 @@
2222
#include <string_view>
2323
#include <unordered_map>
2424
#include <vector>
25-
#if defined(NCRYPTO_ENGINE_COMPAT) && NCRYPTO_ENGINE_COMPAT && \
26-
!defined(OPENSSL_NO_ENGINE)
27-
#include <openssl/engine.h>
28-
#endif // NCRYPTO_ENGINE_COMPAT && !OPENSSL_NO_ENGINE
29-
3025
#ifndef OPENSSL_VERSION_PREREQ
3126
#define OPENSSL_VERSION_PREREQ(maj, min) \
3227
(OPENSSL_VERSION_NUMBER >= (((maj) << 28) | ((min) << 20)))
@@ -1988,44 +1983,6 @@ class MacCache final {
19881983
};
19891984
#endif
19901985

1991-
#ifndef OPENSSL_NO_ENGINE
1992-
class EnginePointer final {
1993-
public:
1994-
EnginePointer() = default;
1995-
1996-
explicit EnginePointer(void* engine_, bool finish_on_exit = false);
1997-
EnginePointer(EnginePointer&& other) noexcept;
1998-
EnginePointer& operator=(EnginePointer&& other) noexcept;
1999-
NCRYPTO_DISALLOW_COPY(EnginePointer)
2000-
~EnginePointer();
2001-
2002-
inline operator bool() const { return engine != nullptr; }
2003-
inline void setFinishOnExit() { finish_on_exit = true; }
2004-
2005-
void reset(void* engine_ = nullptr, bool finish_on_exit_ = false);
2006-
2007-
bool setAsDefault(uint32_t flags, CryptoErrorList* errors = nullptr);
2008-
bool init(bool finish_on_exit = false);
2009-
EVPKeyPointer loadPrivateKey(const char* key_name);
2010-
bool setClientCertEngine(SSL_CTX* ctx);
2011-
2012-
void* release();
2013-
2014-
// Retrieve an OpenSSL Engine instance by name. If the name does not
2015-
// identify a valid named engine, the returned EnginePointer will be
2016-
// empty.
2017-
static EnginePointer getEngineByName(const char* name,
2018-
CryptoErrorList* errors = nullptr);
2019-
2020-
// Call once when initializing OpenSSL at startup for the process.
2021-
static void initEnginesOnce();
2022-
2023-
private:
2024-
void* engine = nullptr;
2025-
bool finish_on_exit = false;
2026-
};
2027-
#endif // !OPENSSL_NO_ENGINE
2028-
20291986
// ============================================================================
20301987
// FIPS
20311988
bool isFipsEnabled();

‎deps/ncrypto/unofficial.gni‎

Lines changed: 1 addition & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -26,11 +26,7 @@ template("ncrypto_gn_build") {
2626
source_set(target_name) {
2727
forward_variables_from(invoker, "*")
2828
public_configs = [ ":ncrypto_config" ]
29-
defines = [
30-
"NCRYPTO_ENGINE_COMPAT=1",
31-
"OPENSSL_SUPPRESS_DEPRECATED",
32-
]
33-
sources = gypi_values.ncrypto_sources + gypi_values.ncrypto_engine_sources
29+
sources = gypi_values.ncrypto_sources
3430
deps = [ "$node_openssl_path" ]
3531
}
3632
}

‎doc/api/crypto.md‎

Lines changed: 0 additions & 89 deletions
Original file line numberDiff line numberDiff line change
@@ -6541,42 +6541,6 @@ added: v15.6.0
65416541
* `utilization` {number} The calculated ratio of `used` to `total`
65426542
allocated bytes.
65436543

6544-
### `crypto.setEngine(engine[, flags])`
6545-
6546-
<!-- YAML
6547-
added: v0.11.11
6548-
changes:
6549-
- version:
6550-
- v22.4.0
6551-
- v20.16.0
6552-
pr-url: https://github.com/nodejs/node/pull/53329
6553-
description: Custom engine support in OpenSSL 3 is deprecated.
6554-
-->
6555-
6556-
* `engine` {string}
6557-
* `flags` {crypto.constants} **Default:** `crypto.constants.ENGINE_METHOD_ALL`
6558-
6559-
Load and set the `engine` for some or all OpenSSL functions (selected by flags).
6560-
Support for custom engines in OpenSSL is deprecated from OpenSSL 3.
6561-
6562-
`engine` could be either an id or a path to the engine's shared library.
6563-
6564-
The optional `flags` argument uses `ENGINE_METHOD_ALL` by default. The `flags`
6565-
is a bit field taking one of or a mix of the following flags (defined in
6566-
`crypto.constants`):
6567-
6568-
* `crypto.constants.ENGINE_METHOD_RSA`
6569-
* `crypto.constants.ENGINE_METHOD_DSA`
6570-
* `crypto.constants.ENGINE_METHOD_DH`
6571-
* `crypto.constants.ENGINE_METHOD_RAND`
6572-
* `crypto.constants.ENGINE_METHOD_EC`
6573-
* `crypto.constants.ENGINE_METHOD_CIPHERS`
6574-
* `crypto.constants.ENGINE_METHOD_DIGESTS`
6575-
* `crypto.constants.ENGINE_METHOD_PKEY_METHS`
6576-
* `crypto.constants.ENGINE_METHOD_PKEY_ASN1_METHS`
6577-
* `crypto.constants.ENGINE_METHOD_ALL`
6578-
* `crypto.constants.ENGINE_METHOD_NONE`
6579-
65806544
### `crypto.setFips(bool)`
65816545

65826546
<!-- YAML
@@ -7403,59 +7367,6 @@ See the [list of SSL OP Flags][] for details.
74037367
</tr>
74047368
</table>
74057369

7406-
### OpenSSL engine constants
7407-
7408-
<table>
7409-
<tr>
7410-
<th>Constant</th>
7411-
<th>Description</th>
7412-
</tr>
7413-
<tr>
7414-
<td><code>ENGINE_METHOD_RSA</code></td>
7415-
<td>Limit engine usage to RSA</td>
7416-
</tr>
7417-
<tr>
7418-
<td><code>ENGINE_METHOD_DSA</code></td>
7419-
<td>Limit engine usage to DSA</td>
7420-
</tr>
7421-
<tr>
7422-
<td><code>ENGINE_METHOD_DH</code></td>
7423-
<td>Limit engine usage to DH</td>
7424-
</tr>
7425-
<tr>
7426-
<td><code>ENGINE_METHOD_RAND</code></td>
7427-
<td>Limit engine usage to RAND</td>
7428-
</tr>
7429-
<tr>
7430-
<td><code>ENGINE_METHOD_EC</code></td>
7431-
<td>Limit engine usage to EC</td>
7432-
</tr>
7433-
<tr>
7434-
<td><code>ENGINE_METHOD_CIPHERS</code></td>
7435-
<td>Limit engine usage to CIPHERS</td>
7436-
</tr>
7437-
<tr>
7438-
<td><code>ENGINE_METHOD_DIGESTS</code></td>
7439-
<td>Limit engine usage to DIGESTS</td>
7440-
</tr>
7441-
<tr>
7442-
<td><code>ENGINE_METHOD_PKEY_METHS</code></td>
7443-
<td>Limit engine usage to PKEY_METHS</td>
7444-
</tr>
7445-
<tr>
7446-
<td><code>ENGINE_METHOD_PKEY_ASN1_METHS</code></td>
7447-
<td>Limit engine usage to PKEY_ASN1_METHS</td>
7448-
</tr>
7449-
<tr>
7450-
<td><code>ENGINE_METHOD_ALL</code></td>
7451-
<td></td>
7452-
</tr>
7453-
<tr>
7454-
<td><code>ENGINE_METHOD_NONE</code></td>
7455-
<td></td>
7456-
</tr>
7457-
</table>
7458-
74597370
### Other OpenSSL constants
74607371

74617372
<table>

‎doc/api/deprecations.md‎

Lines changed: 11 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -4107,20 +4107,25 @@ that are shorter than the default authentication tag length (i.e., shorter than
41074107

41084108
<!-- YAML
41094109
changes:
4110+
- version: REPLACEME
4111+
pr-url: https://github.com/nodejs/node/pull/64777
4112+
description: End-of-Life.
41104113
- version:
41114114
- v22.4.0
41124115
- v20.16.0
41134116
pr-url: https://github.com/nodejs/node/pull/53329
41144117
description: Documentation-only deprecation.
41154118
-->
41164119

4117-
Type: Documentation-only
4120+
Type: End-of-Life
41184121

4119-
OpenSSL 3 has deprecated support for custom engines with a recommendation to
4120-
switch to its new provider model. The `clientCertEngine` option for
4121-
`https.request()`, [`tls.createSecureContext()`][], and [`tls.createServer()`][];
4122-
the `privateKeyEngine` and `privateKeyIdentifier` for [`tls.createSecureContext()`][];
4123-
and [`crypto.setEngine()`][] all depend on this functionality from OpenSSL.
4122+
The `crypto.setEngine()` API and the `crypto.constants.ENGINE_METHOD_*`
4123+
constants have been removed. The `clientCertEngine` option for
4124+
[`https.request()`][], [`tls.createSecureContext()`][], and
4125+
[`tls.createServer()`][] and the `privateKeyEngine` and `privateKeyIdentifier`
4126+
options for [`tls.createSecureContext()`][] now throw
4127+
`ERR_CRYPTO_CUSTOM_ENGINE_NOT_SUPPORTED` when used. There is no direct
4128+
replacement API in Node.js. OpenSSL's provider model replaces engines upstream.
41244129

41254130
### DEP0184: Instantiating `node:zlib` classes without `new`
41264131

@@ -4845,7 +4850,6 @@ async function example() {
48454850
[`crypto.pbkdf2()`]: crypto.md#cryptopbkdf2password-salt-iterations-keylen-digest-callback
48464851
[`crypto.randomBytes()`]: crypto.md#cryptorandombytessize-callback
48474852
[`crypto.scrypt()`]: crypto.md#cryptoscryptpassword-salt-keylen-options-callback
4848-
[`crypto.setEngine()`]: crypto.md#cryptosetengineengine-flags
48494853
[`decipher.final()`]: crypto.md#decipherfinaloutputencoding
48504854
[`decipher.setAuthTag()`]: crypto.md#deciphersetauthtagbuffer-encoding
48514855
[`dirent.parentPath`]: fs.md#direntparentpath

0 commit comments

Comments
 (0)